IEEE Guide For Power System Protection Testing

IEEE Power & Energy Society
C37.233
TM
IEEE Guide for Power System

Protection Testing
Sponsored by the
Power System Relaying Committee
IEEE
3 Park Avenue
New York, NY 10016-5997, USA
IEEE Std C37.233-2009
11 December 2009
Authorized licensed use limited to: UNIVERSITY OF BATH. Downloaded on May 23,2015 at 18:15:05 UTC from IEEE Xplore. Restrictions apply.
IEEE Std C37.233TM-2009

Protection Testing
Sponsor
IEEE Power System Relaying Committee

of the
IEEE Power & Energy Society
Approved 11 September 2009
IEEE-SA Standards Board
Abstract: Test approaches and procedures for the components and the overall protection and
control system functions are presented. Test of equipment in the system protection scheme,
associated communications equipment, auxiliary power supplies, and the control of power
apparatus are addressed. Much of the testing emphasizes a bottom-up approach, in which the
basic behavior of scheme components are verified first, followed by testing of interconnected
components in a function-oriented assembly.
Keywords: application testing, commissioning testing, design testing, maintenance testing,
performance assessment
The Institute of Electrical and Electronics Engineers, Inc.

3 Park Avenue, New York, NY 10016-5997, USA
Copyright 2009 by the Institute of Electrical and Electronics Engineers, Inc.
All rights reserved. Published 11 December 2009. Printed in the United States of America.
IEEE is a registered trademark in the U.S. Patent & Trademark Office, owned by the Institute of Electrical and Electronics
Engineers, Incorporated.
PDF: ISBN 978-0-7381-6080-1 STD95978
Print: ISBN 978-0-7381-6081-8 STDPD95978
No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without the prior written permission
of the publisher.
IEEE Standards documents are developed within the IEEE Societies and the Standards Coordinating Committees of
the IEEE Standards Association (IEEE-SA) Standards Board. The IEEE develops its standards through a consensus
development process, approved by the American National Standards Institute, which brings together volunteers
representing varied viewpoints and interests to achieve the final product. Volunteers are not necessarily members of the
Institute and serve without compensation. While the IEEE administers the process and establishes rules to promote
fairness in the consensus development process, the IEEE does not independently evaluate, test, or verify the accuracy
of any of the information or the soundness of any judgments contained in its standards.
Use of an IEEE Standard is wholly voluntary. The IEEE disclaims liability for any personal injury, property or other
damage, of any nature whatsoever, whether special, indirect, consequential, or compensatory, directly or indirectly
resulting from the publication, use of, or reliance upon this, or any other IEEE Standard document.
The IEEE does not warrant or represent the accuracy or content of the material contained herein, and expressly
disclaims any express or implied warranty, including any implied warranty of merchantability or fitness for a specific
purpose, or that the use of the material contained herein is free from patent infringement. IEEE Standards documents
are supplied AS IS.
The existence of an IEEE Standard does not imply that there are no other ways to produce, test, measure, purchase,
market, or provide other goods and services related to the scope of the IEEE Standard. Furthermore, the viewpoint
expressed at the time a standard is approved and issued is subject to change brought about through developments in the
state of the art and comments received from users of the standard. Every IEEE Standard is subjected to review at least
every five years for revision or reaffirmation. When a document is more than five years old and has not been
reaffirmed, it is reasonable to conclude that its contents, although still of some value, do not wholly reflect the present
state of the art. Users are cautioned to check to determine that they have the latest edition of any IEEE Standard.
In publishing and making this document available, the IEEE is not suggesting or rendering professional or other
services for, or on behalf of, any person or entity. Nor is the IEEE undertaking to perform any duty owed by any other
person or entity to another. Any person utilizing this, and any other IEEE Standards document, should rely upon his or
her independent judgment in the exercise of reasonable care in any given circumstances or, as appropriate, seek the
advice of a competent professional in determining the appropriateness of a given IEEE standard.
Interpretations: Occasionally questions may arise regarding the meaning of portions of standards as they relate to
specific applications. When the need for interpretations is brought to the attention of IEEE, the Institute will initiate
action to prepare appropriate responses. Since IEEE Standards represent a consensus of concerned interests, it is
important to ensure that any interpretation has also received the concurrence of a balance of interests. For this reason,
IEEE and the members of its societies and Standards Coordinating Committees are not able to provide an instant
response to interpretation requests except in those cases where the matter has previously received formal consideration.
A statement, written or oral, that is not processed in accordance with the IEEE-SA Standards Board Operations Manual
shall not be considered the official position of IEEE or any of its committees and shall not be considered to be, nor be
relied upon as, a formal interpretation of the IEEE. At lectures, symposia, seminars, or educational courses, an
individual presenting information on IEEE standards shall make it clear that his or her views should be considered the
personal views of that individual rather than the formal position, explanation, or interpretation of the IEEE.
Comments for revision of IEEE Standards are welcome from any interested party, regardless of membership affiliation
with IEEE. Suggestions for changes in documents should be in the form of a proposed change of text, together with
appropriate supporting comments. Comments on standards and requests for interpretations should be submitted to the
following address:
Secretary, IEEE-SA Standards Board
445 Hoes Lane
Piscataway, NJ 08854
USA
Authorization to photocopy portions of any individual standard for internal or personal use is granted by The Institute
of Electrical and Electronics Engineers, Inc., provided that the appropriate fee is paid to Copyright Clearance Center.
To arrange for payment of licensing fee, please contact Copyright Clearance Center, Customer Service, 222 Rosewood
Drive, Danvers, MA 01923 USA; +1 978 750 8400. Permission to photocopy portions of any individual standard for
educational classroom use can also be obtained through the Copyright Clearance Center.
Introduction
This introduction is not part of IEEE Std C37.233-2009, IEEE Guide for Power System Protection Testing.
This guide focuses on the general approach and specific procedures for testing protective relaying systems
that include multiple interacting relay components, auxiliary devices, and power apparatus. In the most
critical applications, these system devices may interact over an extended physical or geographic area and
use communications systems. The procedures focus separately on design testing, commissioning testing,
routine maintenance testing, and ongoing performance assessment with a discussion of what each of these
test categories aims to accomplish.
Notice to users
Laws and regulations

Users of these documents should consult all applicable laws and regulations. Compliance with the
provisions of this standard does not imply compliance to any applicable regulatory requirements.
Implementers of the standard are responsible for observing or referring to the applicable regulatory
requirements. IEEE does not, by the publication of its standards, intend to urge action that is not in
compliance with applicable laws, and these documents may not be construed as doing so.
Copyrights
This document is copyrighted by the IEEE. It is made available for a wide variety of both public and
private uses. These include both use, by reference, in laws and regulations, and use in private selfregulation, standardization, and the promotion of engineering practices and methods. By making this
document available for use and adoption by public authorities and private users, the IEEE does not waive
any rights in copyright to this document.
Updating of IEEE documents

Users of IEEE standards should be aware that these documents may be superseded at any time by the
issuance of new editions or may be amended from time to time through the issuance of amendments,
corrigenda, or errata. An official IEEE document at any point in time consists of the current edition of the
document together with any amendments, corrigenda, or errata then in effect. In order to determine whether
a given document is the current edition and whether it has been amended through the issuance of
amendments, corrigenda, or errata, visit the IEEE Standards Association Web site at
http://ieeexplore.ieee.org/xpl/standards.jsp, or contact the IEEE at the address listed previously.
For more information about the IEEE Standards Association or the IEEE standards development process,
visit the IEEE-SA Web site at http://standards.ieee.org.
iv
Copyright 2009 IEEE. All rights reserved.
Errata
Errata, if any, for this and all other standards can be accessed at the following URL:
http://standards.ieee.org/reading/ieee/updates/errata/index.html. Users are encouraged to check this URL
for errata periodically.
Interpretations
Current interpretations can be accessed at the following URL: http://standards.ieee.org/reading/ieee/interp/
index.html.
Patents
Attention is called to the possibility that implementation of this guide may require use of subject matter
covered by patent rights. By publication of this guide, no position is taken with respect to the existence or
validity of any patent rights in connection therewith. The IEEE is not responsible for identifying Essential
Patent Claims for which a license may be required, for conducting inquiries into the legal validity or scope
of Patents Claims or determining whether any licensing terms or conditions provided in connection with
submission of a Letter of Assurance, if any, or in any licensing agreements are reasonable or nondiscriminatory. Users of this guide are expressly advised that determination of the validity of any patent
rights, and the risk of infringement of such rights, is entirely their own responsibility. Further information
may be obtained from the IEEE Standards Association.
Participants
At the time this guide was submitted to the IEEE-SA Standards Board for approval, the Power System
Protection Testing Working Group had the following membership:
Vahid Madani, Chair
Hyder DoCarmo, Vice Chair
Marc Achterkamp
Mark Adamiak
Mike Agudo
Alexander Apostolov
James Ariza
Miroslav Begovic
Robert Beresh
Gustavo Brunello
Dac-Phouc Bui
Sean Chilcote
Guy Colpron
Ratan Das
Kelly Gardner
Daniel Goodrich
Anthony Giuliante
Gene Henneberg
Rich Hunt
Bogdan Kasztenny
Tim Kern
Mladen Kezunovic
Gary L. Kobet
Peter McLaren
Michael Mendik
Kalyan Mustaphi
Damir Novosel
Farnoosh Rahmatian
Andr Santos
Tony Seegers
Jon Sykes
Eric Udren
Alfredo Vaccaro
Benton A. Vandiver
Jun Verzosa
Ilia Voloh
v
The following members of the individual balloting committee voted on this guide. Balloters may have
voted for approval, disapproval, or abstention.
William J. Ackerman
Steven Alexanderson
Alexander Apostolov
Stan Arnot
Ali Al Awazi
Thomas Barnes
G. Bartok
David Basset
Thomas Basso
Robert Beresh
Martin Best
Steven Bezner
Wallace Binder
Kenneth Birt
William Bloethe
Chris Brooks
Gustavo Brunello
Hyder DoCarmo
Arvind K. Chaudhary
Stephen Conrad
Tommy Cooper
Jerry Corkran
James Cornelison
Ratan Das
Alla Deronja
Gary L. Donner
Ernest Duckworth
Donald Dunn
Douglas J. Edwards
Gearold O. H. Eidhin
Gary Engmann
Keith Flowers
Fredric Friend
Jeffrey Gilbert
Anthony Giuliante
Jalal Gohari
Stephen Grier
Randall Groves
Ajit Gwal
Roger Hedding
Charles Henville
Lee Herron
Gary Heuston
Scott Hietpas
Jerry Hohn
Dennis Holstein
David Horvath
James Huddleston III
James Ingleson
Gerald Johnson
James Jones
Innocent Kamwa
Bogdan Kasztenny
Gael Kennedy
Mladen Kezunovic
Tanuj Khandelwal
Yuri Khersonsky
Chad Kiger
James Kinney
Gary L. Kobet
Joseph L. Koepfinger
David W. Krause
Jim Kulchisky
Saumen Kundu
Chung-Yiu Lam
Raluca Lascu
Debra Longtin
Federico Lopez
William Lowe
Bruce Mackie
Vahid Madani
O. Malik
Omar Mazzoni
Gary Michel
Georges Montillet
Charles Morse
Jerry Murphy
Dennis Nietzel
Michael S. Newman
Joe Nims
Gary Nissen
Allan St. Peter
Craig Preuss
Iulian Profir
Farnoosh Rahmatian
Madan Rana
R. Rebbapragada
Michael Roberts
Charles Rogers
M. Sachdev
Miriam Sanders
Steven Sano
Daniel Sauer
Bartien Sayogo
Thomas Schossig
Sam Sciacca
Tony Seegers
Douglas Seely
Gregory Sessler
Devki Sharma
Gil Shultz
Tarlochan Sidhu
David Smith
James E. Smith
Jerry Smith
Kevin Stephan
Charles Sufana
Richard Taylor
John Tengdin
David Tepen
Demetrios Tziouvaras
Joe Uchiyama
Eric Udren
Benton A. Vandiver
John Vergis
Jane Verner
Solveig Ward
Kenneth White
When the IEEE-SA Standards Board approved this guide on 11 September 2009, it had the following
membership:
Robert M. Grow, Chair
Thomas Prevost, Vice Chair
Steve M. Mills, Past Chair
Judith Gorman, Secretary
John Barr
Karen Bartleson
Victor Berman
Ted Burse
Richard DeBlasio
Andy Drozd
Mark Epstein
Alexander Gelman
Jim Hughes
Richard H. Hulett
Young Kyun Kim
Joseph L. Koepfinger*
John Kulick
David J. Law
Ted Olsen
Glenn Parsons
Ronald C. Petersen
Narayanan Ramachandran
Jon Walter Rosdahl
Sam Sciacca
*Member Emeritus
vi
Also included are the following nonvoting IEEE-SA Standards Board liaisons:
Howard L. Wolfman, TAB Representative
Michael Janezic, NIST Representative
Satish K. Aggarwal, NRC Representative
Lorraine Patsco
IEEE Standards Program Manager, Document Development
Soo Kim
IEEE Standards Program Manager, Technical Program Development
vii
Contents
1. Overview .......................................................................................................................................................1
1.1 Scope ......................................................................................................................................................1
1.2 Purpose ...................................................................................................................................................1
1.3 General ...................................................................................................................................................2
1.4 Types of applications..............................................................................................................................2
1.5 Types of tests ..........................................................................................................................................3
1.6 Applications for systems, schemes, and multistation testing..................................................................5
1.7 Considerations for testing and scheme self-monitoring..........................................................................7
2. Normative references.....................................................................................................................................10
3. Definitions, acronyms, and abbreviations .....................................................................................................11
3.1 Definitions ..............................................................................................................................................11
3.2 Acronyms and abbreviations ..................................................................................................................11
4. Types of tests.................................................................................................................................................12
4.1 Certification tests....................................................................................................................................12
4.2 Application tests .....................................................................................................................................13
4.3 Commissioning tests...............................................................................................................................14
4.4 Maintenance tests ...................................................................................................................................15
4.5 Example of test setup configurations and equipment (end-to-end testing) .............................................18
4.6 Methods for generating test modules and cases......................................................................................21
4.7 Analyses and retention of test results .....................................................................................................26
5. Benefits and justification for different types of tests .....................................................................................30
6. Description of types of relay schemes and testing requirements ...................................................................31
6.1 Introduction ............................................................................................................................................31
6.2 Line protection........................................................................................................................................32
6.3 Transformer protection ...........................................................................................................................43
6.4 Distribution protection............................................................................................................................49
6.5 Shunt capacitor protection ......................................................................................................................56
6.6 Bus protection.........................................................................................................................................58
6.7 Breaker failure protection and control ....................................................................................................59
6.8 Reactor protection...................................................................................................................................67
6.9 Generator protection ...............................................................................................................................68
6.10 Trip circuit logic scheme ......................................................................................................................70
7. Protection system communication testing .....................................................................................................74
7.1 Power-line carrier testing........................................................................................................................74
7.2 Functional testing of IEC 61850-based substation automation systems .................................................77
7.3 Wireless communication ........................................................................................................................82
viii
8. SIPS test requirements...................................................................................................................................83

8.1 Proof-of-concept testing .........................................................................................................................86
8.2 Field commissioning tests.......................................................................................................................87
8.3 System-wide performance testing during maintenance intervals............................................................87
8.4 Validation through state estimation ........................................................................................................88
8.5 Automatic and manual periodic testing of the entire scheme .................................................................88
9. Testing protection and control systems with unconventional voltage and current sensing inputs.................90
9.1 Testing inputs to relays and microprocessor-based devices with low-level analog inputs per
IEEE Std C37.92TM-2005 [B17] ...................................................................................................................90
9.2 Testing inputs to relays with digital interfaces per IEC 61850-9-2-2004 [B13] process bus .................91
9.3 Testing outputs of unconventional sensors .............................................................................................94
9.4 Verification by condition-based maintenance ........................................................................................96
Annex A (informative) Bibliography ................................................................................................................97
Annex B (informative) Suggested line current differential scheme testing procedure .....................................100
Annex C (informative) Impact of high-impedance faults to protective relay performance
and system testing .............................................................................................................................................105
Annex D (informative) Transformer oil and winding temperature computational methods .............................108
Annex E (informative) Measuring and compensating for time delay after trigger for performing end-to-end
testing using different relay test sets..................................................................................................................110
ix

Protection Testing
IMPORTANT NOTICE: This guide is not intended to ensure safety, security, health, or environmental
protection in all circumstances. Implementers of the guide are responsible for determining appropriate
safety, security, environmental, and health practices or regulatory requirements.
This IEEE document is made available for use subject to important notices and legal disclaimers. These
notices and disclaimers appear in all publications containing this document and may be found under the
heading Important Notice or Important Notices and Disclaimers Concerning IEEE Documents.
They can also be obtained on request from IEEE or viewed at http://standards.ieee.org/IPR/
disclaimers.html.
1. Overview
1.1 Scope
This guide covers suggested test requirements for power system protection scheme testing, system
application tests, the scope and level of tests based on the application, and benefits of the overall protective
schemes testing. This guide encompasses overall system testing procedures (generators, line, line reactors,
transformer, capacitors, special protection schemes, end-to-end testing, distributed application within
substation, etc.) and data collection requirements, as well as the test procedure definitions. This guide
describes the methods, extent, and types of system tests for protection applications at various voltage
levels. Control functions inherent to the protective systems are included. Importance of line testing, indirect
trip applications, open/closed-loop tests, and dynamic/nonlinear tests are also covered.
1.2 Purpose
This guide is intended for power system protection professionals. It includes a reference list of type tests
for protective devices as well as overall protection scheme performance tests for various types of protection
schemes. The guide describes the methods, extent, and types of protection scheme tests. Interlocking and
control functions inherent to the protective schemes are included.
1
IEEE Std C37.233-2009

IEEE Guide for Power System Protection Testing
1.3 General
Testing individual relays, or testing within the confines of one traditional protected-zone panel, is not
comprehensive enough to demonstrate that the system is ready to respond to a real fault or emergency. This
guide focuses on the general approach and procedures for testing protective relaying systems that include
multiple interacting relay components, auxiliary devices, and power apparatus.
Many elaborate or wide area protection systems are installed to handle rare and critical events, and these
systems must work as designed to avoid major system outages. Sustained operation in the field does not
give the user benign opportunities to observe and correct performance issues. These systems need accurate
and realistic simulation of these rare events for type testing and effective in-service maintenance tests.
This guide presents test approaches and procedures for the components of the system and the overall
protection and control system functions. The testing of equipment in the system protection scheme, the
associated communications equipment, the auxiliary power supplies, and the control of power apparatus are
addressed. The system is tested as a functional unit when possible, but it may be necessary to test
components or portions of the system in overlapping test schemes when it is not practical to test the whole
system together. Much of the testing emphasizes a bottom-up approach, in which the basic behavior of
scheme components is verified first, followed by testing of interconnected components in a functionoriented assembly.
The procedures focus separately on design testing, commissioning testing, routine maintenance testing, and
ongoing performance assessment with a discussion of what each of these test categories aims to
accomplish.
Testing recommendations in this document are intended not only to assist engineering and maintenance
personnel in developing technical testing procedures, but also to help in planning testing resource
requirements for discussion with utility management.
1.4 Types of applications

The three overlapping categories of system design and applications needing these specialized functional
testing approaches are listed in 1.4.1 through 1.4.3.
1.4.1 Wide area special protection schemes incorporating power system measurements
from multiple substations around the network
These types of schemes utilize communications systems to combine results or distribute the control action
commands. The testing challenge lies in stimulating and observing the performance of the system as
installed over its extended physical domain. The user needs robust verification of both security and
dependability of the protection.
1.4.2 Wide or local area protection schemes based on exchange of data among relays and
microprocessor-based devices on a communications data bus or local area network (LAN)
or wide area network
The data communications networks perform the signal exchange previously handled by individually wired
dedicated connections that the user can check with simple test instruments. The communications networks
may be dedicated but are increasingly shared with other operating functions or even with the highly diverse
utility information technology (IT) infrastructure. The testing challenge lies in verifying that the protection
function performs with robust design margins, without imposing the need for impractical levels of expertise
2
IEEE Std C37.233-2009

in data transmission and protocols or specialized protocol analysis instruments. Testing also needs to
demonstrate that no credible interference of unrelated communications traffic leaves the shared
communications network unable to serve the critical protective function under test.
1.4.3 Local area protection schemes with complex wired interconnections of components,
input signals, and control outputs
The objective is to verify the output or protection performance of the entire scheme over all the expected
combinations or ranges of input conditions. The test can verify behavior by input stimulation and
observation of the entire ensemble operating as a system. However, this may not show behavior or security
margins in signals among the components, so some additional observation of these signals may be required.
When a full input-to-output test requires more repetitive cases than is practical, it is sometimes acceptable
to test individual components or portions of the scheme separately as long as the boundaries among the
tested portions overlap. Every component or interconnection should have at least one functional test.
An example is an electromechanical transformer or generator relaying system with 10 or more relays, plus
interconnecting wiring and auxiliary tripping devices such as lockout switches. Tripping and lockout
operation may occur as a result of inputs to any of a number of measuring elements, each of which must be
tested. In at least one case, the lockout switch should be operated and its ability to trip and lock out
breakers should be confirmed. For many other test cases used to verify the relays that feed the lockout
switch, the breaker tripping or the lockout switch operation can be blocked, as long as no wire or path is
left untested.
1.5 Types of tests

The document addresses several testing situations in detail, as discussed in 1.5.1 through 1.5.4.
1.5.1 Application certification type tests in the factory or laboratory
The objective of application certification type tests (also known as functional tests) is to verify the
engineering design and performance of the system and its components through simulation of the full range
of expected operating conditions. These cases can be in the form of playback of simulation results or realtime interactive testing. Typically, the developers run such type tests only on a first production sample if
more than one is to be built.
In the case of playback of simulated cases, the tests rely on power system or apparatus modeling,
simulation, and tools to demonstrate the security and dependability of the scheme before shipping to the
site. Features include comprehensive modeling of the application, standardized test cases, large variety of
test cases to exercise design, and simulation of communications and environmental challenges of a field
installation. The test personnel document the test cases and results in some detail. For a specialized
protection system or critical application, representatives of the end user may witness some or all of the type
testing process to learn the system and gain confidence.
In general, component devices of a system under test have been or should be type-tested according to
relevant standards for the physical and electrical environment. For example, protective relays are tested
according to specified revisions of IEEE Std C37.90TM as well as IEEE Std C37.90.1TM,
IEEE Std C37.90.2TM, and IEEE Std C37.90.3TM; such test results are documented separately. These welldefined product type tests are not discussed further in this document.
3
IEEE Std C37.233-2009

1.5.2 Commissioning tests (at installation site)

The objectives are to determine whether equipment was damaged or changed during shipping and field
installation, to ensure that equipment is installed and wired properly, to verify that installers entered
appropriate settings and option selections, and to observe interaction with the power apparatus. The test
focus shifts from verification of design to verification that the system is working as designed.
The commissioning test objectives are as follows:
a)
Install and integrate the system components with the site current transformers (CTs), voltage
transformer (VTs), sensors, communications systems, wiring, and auxiliary power supplies.
b)
To verify that factory-supplied connections are correct and complete.
c)
To ensure each component performs in accordance with vendor specifications and type testing
for that component.
d)
Test interactions, and overall system performance, with a sampling of test cases across the
spectrum of possibilities but not a comprehensive suite as is used for factory type tests.
e)
Test the overall scheme by simulating power system events that cannot be generated on
demand, using techniques described in this guide. Examples include transient simulation, tests
for abnormal conditions, end-to-end testing, and functional testing of applications using
IEC 61850.
f)
Operate other power apparatus or secondary control systems in the vicinity to show that the
system is secure and/or dependable in the face of spurious environmental influences or
communications traffic.
g)
Verify proper mapping and operation of the protective device with other data/control systems to
which it is interconnected.
1.5.3 Periodic maintenance tests

The objective is to detect in-service failures of components, wiring, interfaces, communications, or
unwanted changes of setting or configuration.
a)
Assume the design requires no additional verification.
b)
Test for correctness of wiring or switching configuration that could conceivably have been
changed by maintenance elsewhere in the substation, including polarity or phase rotation, and
instrument transformer or other interface grounding/earthing.
Periodic testing should focus on carrying out steps that detect most in-service hardware failures and avoid
additional testing that tends to reverify the design, software behavior, or the fundamental installation
correctness that were already confirmed. Excessive testing risks accidental introduction of problems and
work errors that leave the system unable to protect after the test is complete and the technicians have left
the site. This is especially true for invasive testing that calls for taking systems out of service, disconnecting
circuits, changing settings, or opening unit cases.
Note that for electromechanical relays, as well as solid-state and microprocessor-based devices, users have
been accustomed to reverifying pickup characteristics during each periodic test because some internal
failures can change these characteristics. Relay technicians open test switches and apply a large set of
boundary tests from a computer-operated test set.
For microprocessor-based devices with self-monitoring and diagnostics, internal failures have different
effects, most of which can be observed during normal operation via data communications or front-panel
data checking. For example, metered nonfault data that the processor communicates or displays can show
any measurement error that could influence trip characteristics. Although settings could be incorrect, they
4
IEEE Std C37.233-2009

can also be checked via data communications or the panel. The only element of the tripping chain that
might need an overt periodic test is the trip contact and circuit to the breaker, and that can sometimes be
tested via communications or the relay front panel. Periodic maintenance tests can thus be minimally
invasive, and the risk of problems caused by maintenance activity is reduced. If the scheme is designed and
installed with this opportunity in mind, the user may be then able to carry out some or all of the periodic
checking without entering the substation.
In making efforts to detect every possible failure, the user should balance the risk from a missed element of
low failure probability versus the maintenance risk of introducing a disruptive step to check it.
1.5.4 Troubleshooting tests following operations
It is important to emphasize the value of verifying overall system performance following correct as well as
incorrect operations by retrieving and analyzing sequence-of-events and oscillographic records captured
from various devices and recorders for nearby disturbances. It is also suggested that correct operations also
be studied to verify security and quantify nearness to trip. Some key steps in reviewing performance of
relay systems after operation include the following:
a)
Periodically review the application in light of power system evolution and protection and
control system changes.
b)
Analyze relay or digital fault recorder (DFR) data from disturbances for which the protection
system did or did not operate.
c)
Consider correctness of logic, characteristics, and set points.
d)
When problems appear, carry out commissioning-like tests to demonstrate continuing suitability
or to verify needed changes.
e)
Make and verify needed changes to the periodic test procedures.
1.6 Applications for systems, schemes, and multistation testing

The document discusses examples of protection schemes and testing approaches for the following
applications. In some applications, references are provided to other IEEE guides or standards where
specific aspects of testing are covered.
Line protection
Transmission
Directional comparison pilot protection
Multiterminal
Tapped line configuration
Line switching equipment integration
Series compensated
Shunt compensated
Current differential or comparison
Integrated relaying communications monitoring
Conductor heating/sag
5
IEEE Std C37.233-2009

Distribution circuits, including interaction with reclosers, switches, capacitor banks, monitors,
load control systems, and other circuit equipment
Integrated automatic reclosing and voltage/synch check
Conditional single-pole tripping and reclosing
Transformer protection
Multiwinding
Phase shifting
Tap changing
Overload protection with distributed thermal inputs
Distributed winding measurement or data acquisition systems
Integrated load, life, and condition monitoring systems
Predictive, acoustic, or partial discharge detection systems
Bus protection
Low impedance
Medium impedance
High impedance
Distributed measurement and control
Configuration dependent protection zones and switching
Postfault closing lockout
Automatic reclosing
Shunt capacitor protection

Breaker failure protection and control
Reactor protection
Voltage control
Line reactors
Current-limiting reactors
Wide area special protection schemes
Generator or tie outage reconfiguration or load shedding
Plant load or tie rejection
Voltage collapse protection and restoration
Out of step, synchrophasor-triggered, or phasor measurement unit (PMU)-based protection
Distributed load shedding schemes
Frequency or voltage-based load shedding that is dependent on centralized system conditions or

remote event triggers
6
IEEE Std C37.233-2009

There are many other power system apparatus, such as static VAR compensators, harmonic filters, and
automatic transfer schemes, which in most cases are application specific and are not covered in this guide.
1.7 Considerations for testing and scheme self-monitoring

One important aspect of testing any scheme is the documentation. This documentation includes the
procedures and results, verifying that tests have been conducted and schemes are performing within design
and acceptable parameters. The procedures and test setups also ensure consistency in testing. Schemes can
be simple, and the documentation may also be simple. When schemes are complicated and involve multiple
owners and devices at sites, detailed documentation describing the steps necessary to accomplish this
testing will make sure that these schemes are tested the same way each time to provide repeatability and
comparison of test results. The procedures need to include test setups, equipment required, and procedures
to isolate the system to be tested. When testing is conducted in an energized environment, additional steps
are needed to ensure that all elements of the electric system are protected while testing is progress.
Documentation of test procedures are usually retained to track performance history and for future
maintenance purposes, and it is available as needed for demonstrating methods used for testing.
1.7.1 Built-in checks for internal or system problem identification
A critical aspect of testing is to develop an approach that can detect when the normal evolutionary changes
in the power system or protective and communications systems surrounding the scheme under test threaten
its ability to perform as designed. As the industry develops such adaptive testing approaches, the designers
of components and systems should focus on incorporating the sensing and logic needed to look for
impending trouble and make the system robust in the face of such gradual change.
For example, a system integrity protection scheme (SIPS), also known as a special protection system (SPS),
might use an ON-OFF power-line carrier (PLC) channel to transmit a single critical status report between
two substations. Many PLC channels are typically multiplexed through symmetric or skewed hybrids, line
tuners, and capacitance coupled voltage transformers (CCVTs) and are dependent on tuned line traps and
on the modal carrier propagation characteristics of the transmission line itself. For this example, the SPS is
thoroughly tested during commissioning and a simplified maintenance test is periodically or automatically
carried out after that. The PLC monitoring may include automatic check-back testing.
In subsequent years, several transformer taps are installed to serve new customers along the line. Additional
PLC channels may be multiplexed with those that were operating at commissioning time, both on the line
in question and on adjacent lines. At some point, the expanded combination of frequencies and signal levels
combines with the multiplexing schemes and line propagation modes such that the simultaneous operation
of two carrier sets not associated with the SPS will cancel the SPS carrier signal. If this circumstance
occurs only during a fault, the SPS maintenance testing may show all is well until the SPS really must do
its job. For a particular fault situation, the carrier state is not received and the SPS fails.
Although there are no convenient checklists to protect against all future changes, the designers and their
testing approaches should include scheme verification in the face of routine surrounding events and
changes that do not call for operation of the scheme under test or for restraint of the scheme. In the example
above, using a frequency-shift carrier or continuously observable channel can combine with SPS carrier
dropout monitoring that can point to trouble on the horizon.
In most cases, checks for nonfault behavior of components can passively monitor critical signals without
adding links to the critical protective chain. In hard-coded or programmable logic of microprocessor-based
devices, monitored critical signals can be posted as events or alarms to be checked by the user without
disrupting the tripping chain. These signals can be supervised by independently programmed logic that
filters the alarm cases without having any effect on tripping. The scheme designers should integrate this
monitoring logic so that it is subjected to the full range of type and commissioning tests.
7
IEEE Std C37.233-2009

1.7.2 Drive for scheme and test simplicity

In designing for robustness, engineers often consider the effectiveness and complexity of the scheme and
how it can be tested. During the engineering and design stage, consider the following factors and their
impact on testing:
Supervising elements, their setpoints, and how the elements have been optimized.
Whether the design includes use of redundant elements, applied in parallel formation, and the
impact on security/dependability of the application.
Whether the scheme is voting or vetoing, and the impact of security/dependability of the
application.
Redundant systems may offer flexibility for testing of elements without removing protection
from service during tests.
Impact on scheme complexity: Complex systems have sometimes failed to perform adequately
because of difficulty to test and/or identify fundamental design or application flaws.
Test procedures and verification to return equipment to normal conditions after tests. Test
switches and testing equipment present opportunities for test personnel to leave protective
devices or systems in a nonfunctioning state.
1.7.3 Test from the bottom up

For all of type testing, commissioning testing, and maintenance testing, start with verification of the
smallest elements to be verified. Determine what is assumed or knownfor example, environmental tests
have been performed on a numerical (microprocessor-based) device to be type tested in an SPS scheme;
firmware design is assumed to be solid in a maintenance test. Check the points to be verified on these
smallest units and then proceed to check the joint behavior of the next level of interconnected units.
Continue until the highest overall system test is completed.
1.7.4 Overlap zones of testing
It is important to design the system and its maintenance test program for segmented testing or selfmonitoring of the links in the protective chain. Maintenance verification by testing or observing segments
is effective as long as the segments overlap. In other words, the interface between segments or links must
be verified by observations during the test of the adjacent elements.
For example, a relay input may be isolated and a test signal applied to check for trip output via contact
closure. Separately, the breaker may be tested by a manual trip. This pair of tests does not check the ability
of the relay trip contact to trip the breakeran undetected cold solder joint in the relay could pass an
ohmmeter test and open up when a real trip is initiated. The overlapping test would be to apply inputs and
check relay response as before and then to test breaker tripping by using the front-panel or data
communications trip function to operate the breaker.
Also, there may be power system effects that need to be fed into all segments as a result of a specific
segment action. Therefore, segmented testing should consider a scheme purpose and incorporate sufficient
levels of overlapping to prove adequacy for overall scheme performance.
8
IEEE Std C37.233-2009

1.7.5 Make use of in-service experience

In many cases, faults or system events are used to validate performance of parts or whole protection
systems. Events and oscillographic records are used to verify recently exercised elements of the scheme. If
a relay in a scheme under test also tripped correctly for a routine fault, the trip output and trip circuit are
probably working and can be left alone.
1.7.6 Use continuous performance checks for schemes using communications messaging
Many new protection schemes make use of control messaging or status and value reporting among
multifunction relays, over an Ethernet LAN or other data communications media. The messages may be
based on IEC 61850 generic object-oriented substation event (GOOSE) or generic substation state event
(GSSE), modbus transmission control protocol (TCP), DNP3/TCP, or any of a number of other standard
control protocols or vendor-specific protocols. Serial data links or networks such as RS422 or RS485 are
also widely used for critical protection and control.
For Ethernet LANs and IEC 61850 GOOSE/GSSE applications in particular, IEEE Std C37.115TM provides
reference background on the analysis of normal and transient levels of message traffic on the LAN. At the
time that IEEE Std C37.115 was written, there was concern over the risk of performance degradation or lost
messages due to collisions or LAN capacity during a data storm triggered by a multiple-contingency
relaying situation at the substation. While system designers still need to pay attention to these possibilities,
the newest LAN implementations are not vulnerable to these shortcomings. Managed Ethernet switches
direct the message traffic and eliminate any opportunity for collision and message loss. Network links
between microprocessor-based devices and their dedicated Ethernet switch ports operate at speeds between
10 MB/s and 1 GB/s, where a properly designed LAN will not introduce any rational level of message
traffic with insignificant delays that could impact protection performance. Refer to IEEE Std 1615TM for the
recommended practice for designing Ethernet networks in substations and to IEEE Std 1613TM for
environmental and testing requirements.
Additionally, if the protection scheme includes application of cyber security communication links (i.e.,
routable protocols), it is important to verify the performance of the scheme, as well as test data
communications channel integrity on a continuous basis. Refer to IEEE Std 1686TM for cyber security
standards associated with devices used at substations. In such cases, communication link monitoring
requires the following:
For continuously streamed data, such as analog measurements or status reports, establish a
predictable maximum time interval between messages in the never-ending transmission stream.
The receiving microprocessor-based protection device with integrated communications interface
then watches for the critical messages and raises an alarm if valid messages are not received in
the expected time frame. This presumes that the integrity of the message is also confirmed via
parity, cyclic redundancy check (CRC), or other message bit error detection methods available
in the applied communications protocol. In such cases, corrupted messages can be alarmed
along with missing messages.
For transient control messages, such as a control command, it is important to define a

companion nontrip monitoring message that is sent as a streaming message and used for
monitoring the messaging path as explained above. The monitoring message must use the same
data communications hardware, transmission path, and protocol and be as close as practical yet
clearly distinguished from the rarely used control command. IEC 61850 GOOSE and GSSE
messages used for control inherently offer this capability. The messages are time-tagged and
constantly streamed in their quiescent state at a designer-set time interval when the station has
no protection events in progress. All the relays that subscribe to a GOOSE message from a
particular publishing relay watch for the stream of messages, and each can alarm if it is not
receiving the stream of no-operate messages at the expected time intervals. Channel problems
are thus caught when they occur as opposed to waiting for a mishandled fault to point to a
9
IEEE Std C37.233-2009

communications failure. The monitoring is complete from relay processor to relay processor, so
periodic testing by personnel is neither necessary nor advisable. When a state change, such as a
fault, occurs, IEC 61850 GOOSE defines a temporary acceleration of the messaging rate to
ensure that all the subscribing relays have multiple opportunities to receive the critical tripping
message without significant time delay.
GPS time tagging or sequential numbering of the messages can improve the quality and precision of the
monitoring but is not always necessary. IEC 61850 GOOSE/GSSE includes this message identification
feature by which subscribing relays can report the times of missing or corrupted messages.
2. Normative references
The following referenced documents are indispensable for the application of this document (i.e., they must
be understood and used, so each referenced document is cited in text and its relationship to this document is
explained). For dated references, only the edition cited applies. For undated references, the latest edition of
the referenced document (including any amendments or corrigenda) applies.
IEEE Std C37.90TM, IEEE Standard for Relays and Relay Systems Associated with Electric Power
Apparatus.1,2
IEEE Std C37.90.1TM, IEEE Standard for Surge Withstand Capability (SWC) Tests for Relays and Relay
Systems.
IEEE Std C37.90.2TM, IEEE Standard for Withstand Capability of Relay Systems to Radiated
Electromagnetic Interference from Transceivers.
IEEE Std C37.90.3TM, IEEE Standard for Electrostatic Discharge Tests for Protective Relays.
IEEE Std C37.99TM, IEEE Guide for the Protection of Shunt Capacitor Banks.
IEEE Std C37.116TM, IEEE Guide for Protective Relay Application to Transmission-Line Series Capacitor
Banks.
IEEE Std C37.119TM, IEEE Guide for Breaker Failure Protection of Power Circuit Breakers.
IEEE Std C57.91TM, IEEE Guide for Loading Mineral-Oil-Immersed Transformers.
IEEE Std 643TM, IEEE Guide for Power-Line Carrier Applications.
IEEE Std 1613TM, IEEE Standard Environmental and Testing Requirements for Communications
Networking Devices Installed in Electric Power Substations.
IEEE Std 1615TM, IEEE Recommended Practice for Network Communication in Electric Power
Substations.
IEEE Std 1686TM, IEEE Standard for Substation Intelligent Electronic Devices (IEDs) Cyber Security
Capabilities.
IEEE publications are available from the Institute of Electrical and Electronics Engineers, 445 Hoes Lane, Piscataway, NJ 08854,
USA (http://standards.ieee.org/).
2
The IEEE standards or products referred to in this clause are trademarks of the Institute of Electrical and Electronics Engineers, Inc.
10
IEEE Std C37.233-2009

3. Definitions, acronyms, and abbreviations
3.1 Definitions
For the purposes of this document, The IEEE Standards Dictionary: Glossary of Terms & Definitions3
should be referenced.
3.2 Acronyms and abbreviations

ATP
BER
BF
BFR
CBM
CCVT
CT
DCB
DFR
DNP
DTT
DUT
DUTT
EMTP
EHV
FSK
GOOSE
GPS
GSSE
GSU
HV
ICT
IED
IOU
LAN
LD
LN
MOV
MU
OOS
PLC
PMU
POTT
PSTN
PUTT
RAS
RF
RUT
SAS
SCADA
3
Alternative Transient Program

bit error ratio
breaker failure
breaker failure relaying
condition-based maintenance
capacitive coupled voltage transformer
current transformer
directional comparison blocking
digital fault recorder
data network protocol
direct transfer trip
device under test
direct underreaching transfer trip
Electromagnetic Transients Program
extra high voltage
frequency-shift keying
generic object-oriented substation event
global positioning satellite
generic substation state event
generator step-up
high voltage
information and communication technology
intelligent electronic device
input/output unit
local area network
logical device
logical node
metal-oxide varistor
merging unit
out of step
power line carrier
phasor measurement unit
permissive overreaching transfer trip
public switched telephone network
permissive underreaching transfer trip
remedial action scheme
reflected frequency
relay under test
substation automation system
supervisory control and data acquisition
The IEEE Standards Dictionary: Glossary of Terms & Definitions is available at http://shop.ieee.org/.
11
IEEE Std C37.233-2009

SCL
SDH
SER
SIPS
SONET
SPS
SWC
SWR
TMU
TCP
TOC
TRV
VLF
VT
substation configuration language

synchronous digital hierarchy
sequence of events recorder
special integrity protection scheme
synchronous optical network
special protection system
surge withstand capability
standing wave ratio
test merging unit
transmission control protocol
time overcurrent
transient recovery voltage
very low frequency
voltage transformer
4. Types of tests
In this clause, different types of tests are described. Some of the tests are device specific, and others are
application oriented.
4.1 Certification tests

Type tests are certification tests performed by a certification organization or application tests on demand of
a user. Certification tests are objective and can be accepted by a wide range of users. Certification tests are
normalized tests under normalized procedures and with normalized equipment. For numerical protection
devices, type tests cover hardware as well as software. Each hardware or software version can be a different
type. The results of these tests are acceptable to a wide range of users, independent of the application.
Certification tests consist of conformance tests and performance tests.
4.1.1 Conformance tests
The goal of conformance testing is to verify the performance of the protective device or protection system
against a set of predefined specifications.
Functional conformance tests: Functional conformance tests verify whether the functionality of
a protective function is as expected. Tests are focused on verifying the general characteristics
against specification by means of signals without transients and direct current (dc) components.
Functional conformance tests are generally steady-state accuracy tests.
Technological conformance tests: Technological conformance tests verify the response of the
protective function to external disturbances and internal failures. Technological tests cover the
verification of the hardware quality, a reliability assessment, and an evaluation of the selfsupervision. The verification of the hardware quality includes insulation properties and
environmental conditions (electromagnetic compatibility, mechanical, and climatic).
4.1.2 Performance tests

A performance test (also referred to as acceptance or type testing) is a type of certification test that
describes the limits of performance of protective relays used in a specific application. The testing is a
generic way to rate the performance of a specific relay. The test results clearly describe the ability of the
relay to perform according to its specifications and the performance of the relay during certain types of
common performance requirements and fault conditions. Test conditions are generally derived from testing
12
IEEE Std C37.233-2009

models based on a simple power system model. These types of tests are typically performed when
evaluating a new relay for use on a specific power system, or, in some cases, when evaluating new
firmware. See IEEE Std C37.231TM-2006 [B28]4 for additional information regarding firmware revision
control. The severity of firmware changes can be used to determine whether a new suite of tests is needed.
The general results from certification tests include operating speed, consistency and repeatability of
performance, boundary conditions for optimal performance, understanding of settings methodology, and
the suitability of this relay for typical applications. As an example, certification tests of a distance relay will
illustrate operating speed of the distance element and the reliability of the distance element for zone
boundary faults and during CCVT transients. These tests, therefore, determine the general suitability of a
distance relay for extra high voltage (EHV) and high voltage (HV) protection applications.
The goal of performance testing is to verify the behavior of the protection under realizable network
conditions. It includes aspects like dc offset, source-to-impedance ratio, fault resistance, various types of
faults, and so on. In contrast to conformance testing, performance tests do not focus on how a certain
function is performed within the protection but on what is to be expected from a function under certain
power system conditions. In case of multifunctional protection, distinction can be made between function
tests and scheme tests.
Functional performance tests: At functional performance testing, each function is tested and
evaluated separately. The performance of an individual protective function is examined in
detail.
Scheme performance tests: Scheme performance testing verifies the performance of a protective
function under various conditions. Because numerical protection contains a large number of
functionality combinations, it will be impossible to test them all. Scheme performance tests are
therefore limited to a number of practical protection applications, with the protection schemes
configured as applicable.
Software (firmware) upgrade of a protective function should be treated as testing a new protection type.
Due to the interval of software upgrades, full replication of all tests may not be cost effective. Therefore, a
limited program can be performed if, in an earlier stage, a complete type test is performed. The limited
program should consist of the following:
Tests to verify that the new or changed function works correctly.
Tests to verify that no other functions are declining. This is more complicated because of the
number of functions and possible combinations.
Some probabilistic analysis may help to determine which elements or hardware components need retesting.
4.2 Application tests

Application tests are driven by the user and are mostly subjective. Application tests are specific tests to
determine the suitability of a relay for a specific protection system design application or location.
Application tests are based on a detailed model of the power system and include performance testing
against a wide variety of possible fault conditions. This type of testing typically uses transient simulation to
replicate more accurately the behavior of the power system. The goal is to ensure a specific relay will
perform for a specific application or location before actual installation. Although certification tests focus on
specific relays, which are the basic building blocks, application tests may also be used to verify the entire
protection scheme. Application tests are typically performed during the evaluation and design phases. The
benefits of application testing are numerous. The application tests document that a specific relay, algorithm,
or protection scheme is the correct choice for a certain set of power system conditions or criteria. It is
typical, for example, to use a transient model of the specific power system, using multiple fault conditions,
to determine the suitability of a distance relay. System integrity protection schemes require significant
4
The numbers in brackets correspond to those of the bibliography in Annex A.

13
IEEE Std C37.233-2009

application testing as transient system modeling is inherently used to design the scheme and specify the
scheme response to power system events.
A second benefit of application testing can be the determination of, and documentation of, appropriate
settings. Application testing verifies the performance of a protection system in total response and will
highlight the failure or overlap of specific elements of the scheme. The operating settings of these elements
can then be modified based on the results of the application testing.
The following application tests are based on the use of transients for testing protective relays in order to
simulate the behavior of the network during faulted conditions:
Fault resistance
Current transformer saturation
Potential transformer transients
Commonly practiced methods of creating test files for transient testing include use of transient signals
obtained from fault recorders (COMTRADE format), generating test files using simulation programs in
combination with playback, or closed-loop test equipment such as real-time simulators. Refer to
IEEE Std C37.111TM-1999 [B25] for information related to the COMTRADE file formatting and standard.
4.3 Commissioning tests

Commissioning tests are intended to ensure the protection system will operate as designed after field
installation. These tests verify the individual components, interactions between components,
communications system, and scheme redundancy along with wiring and installation. These basic tests must
be performed for any new installation or significant modification to an existing installation and are
typically combinations of certification and application tests. The certification tests performed during
commissioning verify that elements perform in a field installation in a manner consistent with laboratory
results. This step is important for equipment with performance that varies due to environmental conditions
or age of components such as electromechanical relays. Application tests performed during commissioning
verify that the total installed scheme works as designed and intended, especially in regard to installation
accuracy and interaction between various protection and control system components.
Commission testing is vitally important, as these tests prove that the actual installed system will work as
designed. Commissioning tests can become very advanced. End-to-end testing of transmission lines is one
advanced method, ensuring that units at both ends operate correctly. The most important benefit of
commissioning tests is verifying that the protection and control system works in the field as it was
designed. A second benefit is documentation of field performance as a benchmark for verifying
performance for future tests.
For the elements or features that have been set on a device, the tests normally follow the functional
hierarchy of the protection system in the following order:
Check the available system parameters measurements and make sure that they meet the
technical specifications.
Test the enabled and configured protection elements.
Test the built-in protection schemes.
Test the multirelay protection schemes.
Commission testing of an entire system is also intended to verify the hard-wired or communication-based
interfaces between the multiple microprocessor-based devices included in a protection scheme, or other
14
IEEE Std C37.233-2009

distributed applications. The interface with the auxiliary contacts of the breaker and its trip coils are
generally included as part of the tests.
Commissioning tests may require the use of multiple synchronized test devices in order to verify the
performance of protection schemes or other distributed applications. Proper simulation of abnormal
conditions for each of the devices in a scheme is essential for the testing.
In summary, commission testing is used to make sure the protection system is properly installed and
working as expected in a substation.
4.4 Maintenance tests

Maintenance tests are specific tests to validate that the protection and control system is operating correctly
after a period of time of field installation. Some of these tests are calibration tests to confirm that individual
components are still operating within desirable performance parameters. This type of test is especially vital
for the components susceptible to degraded or changing characteristic due to aging and wear. Another type
of test is application tests. Application tests are performed to verify that the total protection system works,
from measurement of power system values, to properly identifying fault characteristics, to the operation of
the interrupting device and associated interlocking with automatic or manual restoration devices and
schemes. One form of maintenance testing involves performing forced outage of protective equipment
when performance of the respective scheme is identified as questionable and immediate attention to
servicing the relay or the scheme is needed.
There are different philosophies concerning when it is appropriate to perform maintenance tests in an
attempt to best balance assurance that the protection system will perform correctly versus the costs
involved in maintaining the system. Aside from forced outage testing, there are two basic methodologies in
use that are time-based maintenance and condition-based maintenance practices.
Periodic maintenance testing is performed to ensure that the protection and control system is operating
correctly after a period of time of field installation. These tests may be used to ensure that individual
components are still operating within acceptable performance parametersthis type of test is needed for
components susceptible to degraded or changing characteristics due to aging and wear. Full system
performance tests may be used to confirm that the total protection system functions from measurement of
power system values, to properly identifying fault characteristics, to the operation of the interrupting device
and associated interlocking with automatic or manual restoration devices and schemes.
Time-based maintenance is based on scheduled intervals for review and maintenance of the system, to
demonstrate that routine testing of the system and system components are performed. Test schedules are
generally determined by operating experience with a system or device, manufacturers recommendations,
and the availability of resources to perform the testing. Periodic testing may include a review of the recent
power system activities on the particular terminal and whether the entire protective system has operated
correctly since the last scheduled interval. If it is determined that a protection system and scheme has
performed correctly, the interval may be adjusted based on most recent operational experience on the
respective terminal. Similar to performance-based maintenance, condition-based maintenance includes
examination of the relay system, history of specific systems and devices, and operating experience to
perform maintenance only when necessary to ensure adequate performance of the protection system.
Intelligent electronic devices, such as microprocessor-based protective relays, add an additional form of
maintenance testing, which is the ability to perform continuous self-monitoring for correct performance of
the device. Self-monitoring capabilities vary between devices and may include the ability to monitor the
incoming analog measuring circuits, the device output contacts, time synchronization signals,
communications signals, internal hardware (including battery status and system board voltages),
nonvolatile erasable programmable read-only memory, and the internal software algorithms. Failure of a
self-test routine typically generates an alarm available through supervisory control and data acquisition
15
IEEE Std C37.233-2009

(SCADA) communications and output contacts. Certain self-test alarms may disable the functioning of the
device.
Troubleshooting operating problems, from a protection system testing perspective, is generally a
combination of commissioning tests and calibration tests, designed to identify specific components or
specific parts of the protection system design that do not provide the desired operation results.
Troubleshooting always involves good engineering practices and experience to identify the cause of
operating problems.
4.4.1 Maintenance practices
Maintenance and test programs that often incorporate the following types of maintenance practices:
a)
Time-based maintenance (TBM)Externally prescribed maximum maintenance or testing

intervals are applied for components or groups of components. The intervals may have been
developed from prior experience or manufacturers recommendations. The TBM verification
interval is based on a variety of factors, including experience of the particular asset owner,
collective experiences of several asset owners who are members of a country or regional
council, and so on. The maintenance intervals are fixed and may range in number of months or
in years.
TBM can include review of recent power system events near the particular terminal. Operating
records may prove that some portion of the protection system has operated correctly since the
last test occurred. If specific protection scheme components have demonstrated correct
performance within specifications, the maintenance test time clock is reset for those
components.
b)
Performance-based maintenance (PBM)Maintenance intervals are established based on

analytical or historical results of TBM failure rates on a statistically significant population of
similar components. Some level of TBM is generally followed to justify continued use of PBMdeveloped extended intervals for low occurrence of test failures or in-service failures.
c)
Condition-based maintenance (CBM)Continuously or frequently reported results from

nondisruptive self-monitoring of components demonstrate operational status as those
components remain in service. Whatever is verified by CBM does not require manual testing,
but taking advantage of this requires precise technical focus on exactly what parts are included
as part of the self-diagnostics. Microprocessor-based protective relays that perform continuous
self-monitoring to verify correct operation of most components within the device. Selfmonitoring capabilities may include the alternating current (ac) signal inputs, analog measuring
circuits, processors and memory for measurement, protection, data communications, trip circuit
monitoring, and protection or data communications signals. For those conditions, failure of a
self-monitoring routine generates an alarm and may inhibit operation to avoid false trips. When
internal components, such as critical output relay contacts, are not equipped with selfmonitoring, they can be manually tested. Method of testing may be local or remote, or through
inherent performance of the scheme during a system event.
The TBM is the overarching maintenance process of which the other types are subsets. Unlike TBM, PBM
intervals are adjusted based on good or bad experiences. The CBM verification intervals can be hours or
even milliseconds between nondisruptive self-monitoring checks within or around components as they
remain in service.
16
IEEE Std C37.233-2009

TBM, PBM, and CBM can be combined for individual components, or within a complete protection
system. Figure 1 illustrates the relationship between various types of maintenance practices described in
this section. In the Venn diagram, the overlapping regions show the relationship of TBM with PBM
historical information and the inherent continuous monitoring offered through CBM. This figure shows:
Region 1: The TBM intervals that are increased based on known reported operational condition
of individual components that are monitoring themselves.
Region 2: The TBM intervals that are adjusted up or down based on results of analysis of
maintenance history of a statistically significant population of similar products that have been
subject to TBM.
Region 3: Optimal TBM intervals based on regions 1 and 2.
Figure 1 Relationship of time-based maintenance types

4.4.2 Regulatory considerations
It is important to the reliability of the electric system that protection and control systems function properly.
Malfunctioning systems can contribute to major power system outages and widespread cascading events.
Maintenance programs have demonstrated benefits in uncovering problems and allowing the problems to
be addressed under a controlled power system environment. It is important to follow prudent maintenance
programs to uncover problems and hidden failures in advance.
The effectiveness of a maintenance program is often tracked and determined by the asset owner. These
tracking mechanisms allow the owner to optimize the program based on the application. However, when
the performance of a protective device or system has a greater impact to the overall power system, the
proper performance of the protective system will benefit the entire electrical grid, which may be composed
of several interconnected power systems, or in some cases possibly part of a regulatory controlled electric
system. In some countries or electrical grid systems, the regulatory agency may require evidence that the
asset owners each have established a prudent maintenance program that meets a minimum level of
standards and practices established by the regulatory body. Furthermore, the regulatory agency may require
evidence that the owner is performing maintenance based on the program. Depending on the level of
regulatory oversight, the asset owners may be asked periodically to either voluntarily, or through a cohesive
and collective established audit process, or both, demonstrate that they have met their obligations to
maintain the protection and control system.
17
IEEE Std C37.233-2009

In a regulatory system, the owner may be asked to certify that he or she can perform the following tasks:
Demonstrate and submit detailed maintenance records and that asset owners are cognizant that
regulatory agencies may require verification of the maintenance program, including evidence
that protection systems and components are being maintained and tested per the owners
program.
Submit a program documenting the methodology or philosophy behind the owners program.
Show a tracking mechanism and archiving system for the maintenance records related to the
protection and control equipment and systems.
An example of a regulatory agency that establishes reliability standards and compliance measures is the
North American Electric Reliability Corporation (NERC). NERC has established some standards and
requirements (see NERC [B33]) of a Protection System Maintenance Program and a technical document
that describes maintenance program options (NERC [B34]).
NERC and its regional reliability organizations (RROs) audit asset owning organizations across North
America for compliance with these maintenance standards. Organizations found to be deficient in
compliance with these standards are subject to serious fines, depending on the severity of the infraction,
and they must also carry out a corrective action program.
For example, the NERC Standard for Protection System Maintenance and Testing is enforced for the bulk
electric system. This standard does not impose specific test or maintenance procedures, or time intervals.
Rather, it requires the asset owner to establish its own maintenance practices and include the following:
A documented maintenance program.
A documented basis for that program.
Documentation that tracks the program and proves that it is being carried out as described,
consistently and completely.
Note that the NERC definition of a protection system includes all of the following:
Protective relays.
Instrument transformers and sensors of electrical quantities needed for fault protection.
Communications systems needed for relaying or protective tripping.
DC station batteries supplying the protection system.
Breaker tripping and control circuits, including auxiliary tripping and lockout relays, and
primary equipment status indications required for correct relaying operation.
Similar programs are established in other interconnected electrical systems and countries.
4.5 Example of test setup configurations and equipment (end-to-end testing)

To perform end-to-end testing, some basic equipment is needed at both ends of the line under test. In this
subclause, a list of recommended equipment is provided for reference purposes. This listing can be used in
conjunction with the established testing practices of the owner of the protection equipment. The following
description applies specifically to two terminal lines but can be extrapolated to three or more terminals by
including additional sets of equipment and the necessary personnel.
This list of recommended equipment is based on having qualified personnel and equipment at both ends of
the transmission line for which the protection is being tested. There are techniques for having personnel at
one terminal only and remotely controlling the activities at the opposing terminal. Refer to Schreiner and
Kunter [B35] for more information.
The following equipment is recommended for use in the end-to-end testing of transmission lines.
18
IEEE Std C37.233-2009

a)
Test equipment
1) Interface to microprocessor-based device: A computer with appropriate manufacturerspecific software is often used in order to communicate with the microprocessor-based
device under test to monitor performance, view/retrieve data, and possibly modify
settings and application logic.
2) Test equipment: To test the devices, test equipment capable of being time synchronized
and to provide three-phase voltages and currents are often used. In some cases, such as
line differential, three-phase voltages may not be essential but are useful for testing the
performance of ancillary or backup functions.
3) Fault simulation software: Software is needed that can generate fault sequences. The
output from this software is used by the primary injection equipment and provides the
sequence information and waveforms necessary for the test. This software may be
associated with the specific primary injection equipment or may be some third-party
software that has output data format compatibility with the primary injection test
equipment.
4) Fault recorders: To monitor all the requisite test points, the use of a fault recorder at
each site may be needed to capture information that is not already recorded by the
microprocessor-based device.
5) Time coordination: Time coordination at both terminals of the transmission line is
essential in performing end-to-end tests. A global positioning satellite (GPS) receiver
that provides an accuracy of 10 s (which is equivalent to an angle of 0.216 at 60 Hz)
or better should be used. A suitable GPS receiver is required at both ends of the
transmission line.
NOTEExisting GPS receivers at the test sites may be loaded to their maximum output
capability, and it would be prudent to check that enough signal strength is available prior to
commencing the test. An oscilloscope can be used to measure the voltage level of the GPS
signal, and this can be compared with manufacturer specifications. The GPS signal is connected
to both the microprocessor-based device under test and the test equipment. This time
synchronization is used to coordinate the start of the test cycle at both ends of the transmission
line and to time-stamp the data accurately. Signal strength at the receiving end should be verified
prior to testing. 5
6) Miscellaneous equipment: In addition to the above equipment, standard miscellaneous

devices and components such as multimeters, connector cables from the
microprocessor-based device to the laptop, jumpers, tools, and test leads may also be
required for testing purposes.
b) Communication equipment
1) Data: Many multiterminal protections (for example, line differential relays) pass such
data as voltage, current, trip signals, and time stamps among each other over existing
communication channels in the normal course of operation. Additional data
transmission requirements for testing purposes may not be necessary in these cases. For
protection schemes where power system data is not normally passed from one terminal
to the other (for example, distance protections where only a permissive signal may be
sent), some additional method may be required such as a modem connection. However,
this data transmission requirement may not be necessary in most cases as coordinated
testing schemes from test equipment can be used and data can be retrieved from the test
equipment and microprocessor-based devices at each site after the tests are completed.
In the planning stages of the test, determine what data are required at both ends during
the test and how to obtain that data.
5
Notes in text, tables, and figures of a standard are given for information only and do not contain requirements needed to implement
this standard.
19
IEEE Std C37.233-2009

2) Voice: A voice channel is necessary for staff to communicate with each other and
system control operators. This channel can be anything that is convenient and reliable
such as a cell phone or microwave/fiber channel.
The configuration in Figure 2 can be used to perform end-to-end testing of a two-terminal transmission
line. The test equipment injects required three-phase voltages and currents into the protection under test.
The test equipment also monitors the trip output, breaker failure initiate, transfer trip receive, and transfer
trip send signals from the protection. GPS satellite receiver clock synchronization is used in order to allow
comparison of data between the two terminals. More detailed description of end-to-end testing is available
in the line protection section.
Figure 2 Example setup for transmission line end-to-end testing using GPS
20
IEEE Std C37.233-2009

4.6 Methods for generating test modules and cases

4.6.1 Fault studies
A test module comprises currents and voltages with/without external logic inputs (for example, digital
signals for fault inception point or reclosing command) that need to be applied to a protection device or
system. In order to generate test modules, specific fault studies need to be conducted and analyzed. One has
to make sure that a specific test set can handle these quantities. Otherwise, some compromise or adjustment
has to be made for accommodating the test set.
In general, there are 11 types of faults: ABC, ABCG, ABG, BCG, CAG, AB, BC, CA, AG, BG,
and CG. However, there are variations in the way these faults occur.
Simultaneous faults (unusual). There can be simultaneous faults of two types mentioned above
at the same or different location. For example, BC and AG fault at the same time. Or AG and
BG demonstrate fault resistances at the same time. Also, a conductor can break and fault to
ground, causing open phase with line-to-ground fault.
Sequential faults (unusual). There can be more than one fault in power system, particularly
during bad weather conditions. This will test relays that can experience external faults or
external faults followed by an internal fault.
Intercircuit/cross-country faults. A fault can occur between two lines operating at same voltages
(intercircuit) or different voltages (cross-country) but located on the same tower. For example,
phase A of a 230 KV line can be faulted to phase B of another 230 KV or 69 KV circuit on the
same tower or sharing the same right of way.
Evolving faults. A fault may start with one phase and evolve into other phases within a time
period. Here, the speed of the relay may be slower because of phase-selection logic. For
example, the fault can start with AG for one cycle followed by AB or ABG for three cycles.
Fault locations. When deriving the test currents and voltages from fault studies, faults should be
created on the line at different points. Usually, a close-in fault, middle of the line, end of the
line, and in the reverse direction close to the bus will be adequate. If there are parallel lines, a
fault on the parallel line should be created to see the effect of zero sequence mutual coupling.
When applicable, the effect of sequential clearing on the adjacent line is tested.
Fault duration. Fault duration can be anywhere between 0.5 cycles and a few seconds to test
various aspects of a protective systems logic. A self-clearing fault may last 0.5 to 1 cycle.
Faults through reclosing cycles. This is an extension of fault duration. Here, the fault currents
and voltages may change after reclosing. If it is high-speed reclosing from both ends, the fault
current reversal can occur within a cycle or more that can be experienced by a parallel line as an
external fault.
Varying fault impedance helps determine protection sensitivity, phase selection, and time
coordination.
Varying fault inception angles. For example, simulating different fault types with 15 or 30
intervals helps verify protection performance under various dc offset conditions.
21
IEEE Std C37.233-2009

4.6.2 Fault data assembly

Compilation of fault data usually consists of gathering the prefault, fault, and postfault quantities. Threephase voltages are needed. Depending on the type of test, single or three-phase currents may be needed.
Prefault. Prior to a fault, the line can be loaded between minimum and maximum. If the fault is
sequential, i.e., an external fault with a subsequent internal fault, then prefault can be external
fault quantity. The prefault time can be set from a few cycles to many seconds.
Fault. Fault quantities that are derived from fault studies or selected may last for three cycles to
a few seconds, which should be determined by the user.
Lines with automatic reclosing. For lines with automatic reclosing, two sets of fault quantities
may be needed to simulate reclosing interval. One set is for the initial fault, followed by dead
time/band (open breaker) before reclosing with another set of test quantities. For external fault
simulations adjacent to the line position under test, the impact of automatic reclosing on the
adjacent line should be considered as part of the test. For example, changes in line loading
characteristics after the initial fault may need to be considered as part of the automatic reclosing.
Other examples include voltage and current oscillations after the initial fault.
4.6.3 Transient simulation

Protection systems or relays are exposed to transient currents and voltages in various circumstances as
pointed out below. This transient situation can best be simulated using time-domain simulation programs
described more in depth in later sections of this guide. The outputs from these programs can be downloaded
to an active test set that can be activated for testing. Transient simulation tools assist in preparing test cases
that may include the following:
DC offset. The fault current may include dc offset, based on factors such as X/R ratio and pointon-wave incidence. The dc offset may have influence on the performance of a relay. The relay
can overreach/underreach unless the relay filters the dc. The speed of the relay may be affected,
too. The offset current can be simulated by transient simulation programs.
Power swing simulations.
CT saturation modeling. A heavy fault current or presence of dc offset current can saturate a
CT, causing a distorted secondary current waveform. Relay performance can be degraded due to
this distorted waveform.
CCVT subsidence transients and high-frequency ring behavior. A CCVT contains capacitors,
inductors, and a voltage transformer. Any change in power system voltage results in transient
energy adjustment within these components that causes nonfundamental frequency to appear in
the voltage waveforms, which affects the performance of equipment.
Subsynchronous fault current. A subsynchronous fault current can occur in a power system
having series compensation. This subsynchronous current can degrade the performance of the
distance function.
Line energization. Line energization transients can contain harmonic currents and voltages. For
long lines, sometimes line reactors are used to control the voltages. Line capacitance and reactor
impedance can produce resonant currents. Relays can be affected by these harmonic transients,
which may last for few to several seconds.
Transformer (local and remote end) energization. Sometimes, a transformer is part of a line
zone of protection. This transformer can be energized by a breaker or a disconnect switch.
During transformer energization, current containing harmonics can last many seconds. Because
of the saturation effect of the transformer, harmonic resonance can occur. Relays can be affected
by these transient currents and voltages.
22
IEEE Std C37.233-2009

Voltage source location (i.e., CCVT). Location of voltage source has impact on distance
measuring elements, for example, on series compensated lines.
Fault location and characteristics. Variations in fault location and characteristics such as
incipient angles, fault impedance, and so on, have an impact on the performance of the
protective device.
Current differential protection.
4.6.4 Power swing abnormal conditions

Transmission line relays are designed with out-of-step (OOS) elements (i.e., out-of-step tripping or
power swing blocking) by measuring the impedance locus. Examples include time delay between two
impedance characteristics, one encompassing the other. The applied voltage, current, and phase angle can
be manipulated in a dynamic test simulator to move the impedance trajectory from the outside
characteristic to inside characteristic beyond a set time. This method is generally used for blocking
function. Similarly, tripping functions are designed by moving the trajectory from outside to inside to
outside within a time frame.
It has been observed by some power system engineers that the traditional testing methods for
microprocessor distance elements may not work on OOS elements, considering that out-of-step swings are
three-phase phenomena and are more slow-moving and gradual than faults. As with other protective
elements, it is crucial that the functions are adequately tested prior to placing them in-service.
It should be noted that it is generally inaccurate to test OOS elements by examining the results of the
stability program and the R-X impedance swing locus, picking out several states of a swing condition and
playing those states through the relay, trying to make the transition as smooth as possible. The reason is the
step change between states does not accurately reflect the actual impedance transitions the relay will
experience. Figure 3 illustrates stable and unstable swings as generated by a transient stability program,
using 0.25 cycle steps, superimposed on line protection and out-of-step characteristics.
It has been proven that it is possible to take the raw positive-sequence voltage and R-X output from a
dynamic stability program (using power system load flow modeling), calculate balanced three-phase
quantities for each time step, and then translate this data into COMTRADE waveforms that can then be
imported into modern relay test software that can play the waveforms through a relay. Figure 4 and
Figure 5 illustrate an impedance trajectory generated by a stability program and the resulting COMTRADE
waveforms in a relay testing program.
One challenge for out-of-step relays is the case of a fault that occurs during a power swing when the
distance function has been already blocked. Again, the testing of these functions requires a simulation as
close as possible to the real system conditions and at the same time needs to take into consideration the
capabilities of the test equipment. Because testing tools normally generate the simulated current and
voltage signals based on built-in modules or replay of COMTRADE files, it is clear that the following two
approaches are possible: 1) use of a testing tool designed to simulate power swing conditions (synchronous
or asynchronous) and faults that occur during a power swing, and 2) play COMTRADE files for power
swing conditions (synchronous or asynchronous) and faults that occur during a power swing. Such files can
be generated using off-the-shelf transient simulation programs or can be produced from disturbance
recorders capturing real events.
Figure 6 and Figure 7 show an asynchronous power swing and asynchronous power swing with a single
phase to ground fault that can be used for testing the power swing blocking function of distance relays.
23
IEEE Std C37.233-2009

Figure 3 OOS impedance trajectory from dynamic simulation

using transient stability program
Figure 4 OOS impedance trajectory from dynamic simulation

using transient stability program
24
IEEE Std C37.233-2009

Figure 5 Resulting three-phase voltages and currents
Figure 6 Asynchronous power swing simulation
25
IEEE Std C37.233-2009

Figure 7 Asynchronous power swing with single-phase-to-ground fault simulation

4.6.5 Real-time simulation for transmission line relay performance evaluation
Power system simulations for relay performance evaluations are often conducted by users as well as by
manufacturers to verify the performance of a newly developed relaying system or to verify the performance
of an existing product in some special situations. Real-time simulation testing is covered in detail in the line
protection section.
Power system simulation has been used for the relay performance evaluation for many years. The
simulation tool should be easy to configure, should be able to simulate all power system contingencies, and
provide means to analyze test cases automatically. The simulator should operate in a closed-loop mode
with relays tripping and reclosing circuit breakers within the simulator. Performance evaluation of relays
may take anywhere between 2 days and 2 weeks in most applications, depending on the complexity of the
relaying system. Simulation tools such as real-time simulators can also provide means for testing of backup elements, sympathy trips, voltage collapse, and other slow events that require interactive testing.
4.7 Analyses and retention of test results

The goal of analyzing test results is to determine the performance of relay systems. This analysis may
determine whether the scheme operated correctly or whether the scheme has any subtle and/or noncritical
problems. It may help establish a historical reference that will help in determining degradation of the
system over time, and the analysis can even help determine component failure.
Systems are tested initially from the component level to the overall system. For example, a line relaying
system may have each individual relay tested for specific calibration, but fault simulation tests will be
applied at all terminals of the line to determine how the entire line relaying system functions. Frequently,
routine testing no longer involves component testing and will consist of an overall system test. Component
testing is only performed during initial commissioning of a system or after major or significant changes.
26
IEEE Std C37.233-2009

Requirements for retention of test results may include pretest and posttest records. For example, a
description of what is needed for testing is as follows:
Description of concept
Verification of firmware and software versions
Setting calculations
Apparatus engineering datasheets
Procedure to perform tests
Set points
Test block diagram
Required test equipment with tolerances
Schematics
The requirements for the analysis and the pass/no pass criteria for each test are also identified. For example,
test equipment tolerances and correction factors and how they are incorporated into pass/no pass checks
may be described.
This subclause provides a description of test result analysis and how the findings are archived.
4.7.1 Certification tests
Certification tests are performed to verify that a relay system or scheme is performing according to its
design. Relay systems/schemes are usually made up of devices from various manufactures; therefore,
certification tests at the factory are important because they provide a modeled, controlled environment
similar to that found in real life. Models prepared to perform certification tests include circuit breakers
and other equipment or functions found in the substation. Certification tests are made up of the following:
Technological conformance tests
Functional conformance tests
Functional performance tests
Technological and functional conformance tests are generally type tests made by the manufacturer to
validate the design of the microprocessor-based device, and consequently in most cases, there is no need to
repeat them for a specific, customized system or scheme (Table 1).
Functional performance tests are commonly performed on mockup assemblies located in a laboratory under
a controlled environment. These mockups, which are made up of relays, microprocessor-based devices, and
supplementary apparatus such as model circuit breakers, shall provide the same functionality of the real
application. Some components of the real systems need to be simulated like breaker status and operation.
The laboratory environment allows all aspects of the system to be monitored, and the final result of the
testing is that the user will have a high degree of confidence in the functionality of the systems.
SIPS, which are also referred as special protection schemes (SPSs) or remedial action schemes (RASs), are
some examples of a protection system that usually require certification tests (proof of concept) prior to
implementation. SIPS may involve analog and status data from sources at many remote locations and
perform actions at many different sites. A SIPS may have significant impact to the stability of the electric
system, where the initiating events can be the loss of a transmission line, generator, frequency excursions,
and other losses of equipment. It is not practical or prudent to perform certification tests in the field on the
actual electric system. The details of the SIPS may be verified with mockups/proof of concept under
controlled situations. The owner of the SIPS will only test the actual SIPS under verified specific
27
IEEE Std C37.233-2009

conditions, and even then the SIPS may have to be tested in subsets of the entire system. For example, if a
SIPS involves load tripping at multiple substations, system testing may be accomplished with overlapping
concepts and predetermined blocks of load based on the SIPS application.
Table 1 Types of certification tests
Test
Technological
conformance tests
(for each individual
device)
Functional
conformance tests
Analysis/verification
Verifies the response of the device to the environment
(physical, electrical, electromagnetic, mechanical)
according to the IEEE or IEC standards and to own
design of the device. Usually the manufacturer provides
type test certificates and no need to repeat.
Verifies the response of the different protections and
control functions implemented in the microprocessorbased devices to IEEE or IEC standard and/or the
manufacturer own specifications. Typically these tests
are performed using a pure sinusoidal 60 Hz input.
Usually, the manufacturer provides type test certificates
and there is no need to repeat.
Retention
Type test reports to keep in
files
Type test reports to keep in

files
4.7.2 Application test

Application tests are specific tests to determine the suitability of a relay for a specific protection system
design. Application tests are based on a detailed model of the power system and include performance
testing against a wide variety of possible system disturbances or fault conditions. The model, the simulation
case results in COMTRADE format or real-time digital simulation, special cases such as current reversal
for a line protection, or a high-impedance fault are commonly retained as part of the protection system
performance evaluations. Different types of application test records include relay targets, oscillography,
fault location, event records, pilot channel performance, breaker failure and reclosing, and so on. The test
results may be reported from a variety of sources such as test equipment software, independent fault
recorders and station sequence of event recorders, and microprocessor protective devices.
Results from the application tests can be used in a variety of ways, such as for collaborations with a
respective product manufacturers feature enhancement and standard scheme installations. Application test
results retention is equally important for interconnected power systems. As power system conditions
change, these records could be used for further system evaluation and set point verification.
4.7.3 Commissioning tests
Commissioning tests are performed on equipment installed in the field to verify the proper functionality of
relaying systems. These tests are usually products of the certification tests performed in the laboratory and
generally do not involve component testing. These tests may involve tests of the entire system (Table 2).
Table 2 Samples of functional testing as part of commissioning
Test
Scheme checks
Fault simulations
Relay input and output contacts work properly.
Cut-off blades and test switch function properly.
Breakers can be operated by supervisory, local, and relay
contacts.
Relay pushbuttons for enabling of functions (reclosing,
cold load, local control) work properly.
Alarm conditions are simulated to check proper
indication in the sequential event recording device.
Verify instantaneous tripping for all types of internal
faults (a communications-assisted trip scheme). Selected
3L, LL, SLG, 2LG faults located at 10%, 50%, and 90%
along the line are simulated at both ends using satellite-
Retention
The relay technician
performs these tests,
fixing any problems
found, and documents
any changes on the prints
and in the configurations
as applicable.
Check-off of written
procedure by the test
engineer. Fault reports
and event recorders
28
IEEE Std C37.233-2009

In-service tests
synchronized end-to-end tests.

Verify restraint for all external faults (reverse element of
distance relay restrains either end from tripping).
Verify time-delayed backup tripping.
Phasing is correct into relays and meters.
generated by the relays

are saved. Sequential
event
records
are
retained as applicable.
Phase reads are recorded
and
sent
to
the
Maintenance
Division
for storage. Metering
snapshots are taken and
documented.
4.7.4 Periodic maintenance tests

Periodic maintenance testing is used to verify the proper functionality and reliability of protection systems.
The information gathered from periodic testing can be used to establish a history of relay performance.
Periodic testing is usually performed on a component basis such as protective relays or transducers to
verify proper calibration and operation. The interval of these tests is usually determined by each owners
Relay Maintenance Program and often takes into account owner preferences. The protection systems can be
configured with individual electromechanical or solid state components, which may not have selfmonitoring, or can be made of microprocessor-based type with self-monitoring and alarming capability,
where performance and availability are fully monitored at all times. In some cases, a regulatory agency
may require a more rigorous process for demonstrating with sufficient levels of documentation their
maintenance practices and records, as described in the Regulatory Considerations section. The periodic
maintenance programs have established testing intervals with tracking and archival of test results. (See
Table 3 below for an example of relay testing intervals.)
Table 3 Example of relay testing intervals
Relay voltage
(kV)
500
230
115
69
Less than 69
Maintenance interval
(years)
2
4
4
4
4
Periodic system testing is becoming more popular. Table 4 indicates a typical example of a test performed
on line relaying systems.
Table 4 Example test plan for line relaying systems
Test
Fault simulations
Verify relays call for instantaneous tripping for all types
of internal faults (a communications-assisted trip
scheme). Selected 3L, LL, SLG, and 2LG faults 10%,
50%, and 90% along the line are simulated at both ends
using satellite-synchronized end-to-end tests.
Verify restraint for all external faults (reverse element of
distance relay restrains either end from tripping).
Verify time-delayed backup tripping.
Retention
Compare all test results
(fault reports, sequence
of events records) to
previous years results.
4.7.5 Testing after a forced outage

This type of test is often performed after a loss of a significant element of the electric system or after a
suspected incorrect operation of a relay system. During a disturbance in the electric system, relays are
expected to operate correctly to isolate the affected equipment. If the protection system performs properly,
then damage will be minimized. When the disturbance compromises a significant corridor, load center, or
generation, it may be necessary to analyze the results to determine the proper operation of all protection
29
IEEE Std C37.233-2009

systems. When the detailed evaluation of the protection records demonstrates satisfactory scheme
performance, the operation of the relay system may be considered as a substitute for scheduled periodic
maintenance testing.
If a disturbance of the electric system results in a suspected operation of a protective relaying system, then
testing will be required. The test results can be compared with archived data to identify the failure. This
failure may be a component, a relay setting, or even the overall logic, and the solution may require more
certification tests.
Tests following apparent incorrect operations:
The steps for these kinds of tests are as follows:
Analyze the original event to try to determine why the system operated incorrectly and compare
the event to the last tests run on this system (commissioning or periodic maintenance test).
Attempt to recreate the misoperation by simulating the initial event.
Make the appropriate correction (wiring, relay settings, replacement of damaged components),
resimulate the original event, and verify that it fixes the problem.
The information kept from disturbances includes the following:
SCADA breaker operation record.
SCADA event log.
Power operations dispatcher log.
Relay fault records, oscillography, and sequence of events record (SER) data.
System diagram detailing system conditions at the time of the event.
Fault report [also called the disturbance analysis report (DAR)].
Final root-cause analysis report, which includes a summary of what corrective action was taken.
This report becomes the official record of the event.
5. Benefits and justification for different types of tests

Traditionally, the protection and control system is designed to identify local fault events, such as a short
circuit, based on the voltage, current, and frequency determined at a specific point on the utility system.
The protection and control system is designed to prevent a wide area failure of the utility system by
isolating these local events. Changes in the operation of the power system, in terms of location and
operation of generation sources, transmission capacity, and load demand, as well as changes in power
system equipment such as the growing availability of reliable wide area communications result in changes
in some basic philosophies of the protection and control system. For example, wide area protection
schemes and system integrity protection schemes are applied more frequently to prevent failure of the
utility system during wide area events or to prevent local faults from cascading into wide area events.
These types of schemes and the narrower safe operating margins of the utility system commonplace today
make improperly controlled local fault events a rising danger and require the testing of the protection and
control system as a system, not as only individual components.
The goal of testing the entire protection and control system is to validate the performance of the entire
system, from the individual components to backup, redundant, and auxiliary components, and the
interaction between these components work correctly in terms of maintaining the dependability and
security of the scheme at a desirable level of performance. The benefit of testing individual components is
known from years of experience: If the individual parts work and the scheme is designed and installed
30
IEEE Std C37.233-2009

correctly, there is a high probability the system will work correctly. However, protection system testing
verifies that the scheme is correct in both concept and application settings. An example is end-to-end
testing of transmission lines, using test conditions based on fault contingency studies. The different test
cases, run simultaneously at each end of the line, confirm that all relays, communications equipment, and
auxiliary equipment work for commonly anticipated events and worst-case scenarios. It is even possible to
simulate typical modes of failure of the individual components to ensure the protection and control system
will still identify and control fault events.
The key benefit to protection system testing includes verification of the protection and control scheme in its
entirety. A proper test documents the performance of the protection and control system and limitations of
performance. The test documentation also serves as a baseline for evaluating future performance during
actual events versus the expected performance. Baseline performance is used to compare differences
between expected and actual events. Testing the performance of the protection system, especially wide area
protection schemes or system-integrity protection schemes, is dependent on static and dynamic system
models. As these schemes and the system behavior during events the schemes are designed to protect are
very complex, testing can provide the engineer a better understanding of the protection system, the limits of
performance, and the possible modes of failure. One type of testing for system-integrity protection schemes
is to install the system, while blocking any control actions, to analyze the performance of this protection
system during actual system events. This actual test data can be used to improve the static and dynamic
models of the power system. Another benefit is actually illustrating or understanding the protection and
control system performance during certain types of events and where and why failures may occur. The
importance of written test procedures and documentation are described in 4.7.
The design of the protection and control system requires careful consideration of the performance
requirements for the specific location, analysis of power system behavior, and an understanding of the
actual limits of performance of components available for use in this application. Testing for the protection
and control system at a specific location should be performed to prove the assumptions made during the
design phase, starting with the individual components and working toward testing total system
performance.
6. Description of types of relay schemes and testing requirements
6.1 Introduction
Different types of tests identified in this guide are as follows:
Certification
Conformance
Application
Commissioning
Maintenance (forced or periodic)
Troubleshooting
Application
This subclause presents guidelines pertaining to application, commissioning, and periodic maintenance
tests for the purpose of scheme testing, throughput timing, and validation.
31
IEEE Std C37.233-2009

6.2 Line protection

6.2.1 Types of transmission line protection schemes
Relay protection schemes for transmission lines can be generalized into nonpilot and pilot protection
schemes. The nonpilot relaying system is used on radial transmission lines or other lines where high-speed
tripping is not required. It is also used in conjunction with a pilot relaying scheme as a backup line
protection. The most commonly used relays in nonpilot schemes are phase and ground overcurrent and
stepped distance relays. Refer to the normative references in IEEE Std C37.113TM-1999 [B26].
6.2.1.1 Nonpilot protection schemes
6.2.1.1.1 Overcurrent relaying
An overcurrent relay is a simple relaying device that requires only one input variable (current) in sensing
and measuring fault currents. The basic function of the relay is to operate or pick up when the detected
current exceeds a predetermined value or level. Overcurrent relays are applied separately in phase and
ground fault protections. The phase overcurrent relay senses phase-to-phase and three-phase faults while
the ground overcurrent relay senses any phase-to-ground or multiphase-to-ground fault. A complete set of
overcurrent protection would require three phase-overcurrent relays and one ground-overcurrent relay.
The operating time characteristic of overcurrent relays can be instantaneous or time delayed. Instantaneous
overcurrent relays operate with no intentional time delay when the measured current exceeds the set level.
Time-delay overcurrent relays can have fixed or inverse time delays. The inverse time-overcurrent relays
have operating times that vary inversely with the magnitude of fault current.
Overcurrent relays are inherently nondirectional. However, by providing some polarizing quantity such as
voltage, overcurrent relays can be directionally supervised. For ground directional supervision, for
example, the zero sequence voltage may be used to establish the potential polarization or directional
reference. Another method of obtaining directionality is to use the neutral current of a wye-grounded/delta
power transformer. The polarizing technique will depend on the type of device or setting elements
appropriate to the application.
6.2.1.1.2 Distance relaying
Distance relaying is the most widely used type of transmission line protection scheme. It offers several
advantages with respect to overcurrent relaying such as higher speed, simpler coordination, lesser influence
by system changes and power swings, and permitting higher line loadings. Distance relays are designed to
respond to the current, the voltage, and the phase angle between the current and voltage. The relay
measures the ratio of voltage to the current or the impedance of the line section to the fault and of the fault.
The impedance measurement approach provides an excellent way of discriminating faults from normal
conditions. The discrimination is obtained by limiting relay operation to certain ranges of impedance or
zones of protection. Typically, the first zone of protection (zone 1) covers 80% to 90% of the line. A fault
located in this zone operates the relay instantaneously. The second zone of protection typically overreaches
the line coverage by 10% to 20%. The relay can be set with a time delay, typically, 20 cycles, for the relay
to operate in zone 2. The third zone may be set to cover beyond 200% of the line. Relay tripping in the
third zone is set at higher time delay than that of the second zone. These protection zones are set as stepped
distances or ranges of impedance. Zones 2 and 3 protection time delay provides remote backup to local
relays.
The stepped zones of protection provide distance relays with enhanced selectivity and improved
coordination. However, the major disadvantage of straight distance relaying scheme is that high-speed
32
IEEE Std C37.233-2009

tripping of breakers at both terminals can only be achieved if the fault is located within zone 1 of both
distance relays. If the fault occurs beyond the zone 1 of one of the relays, then tripping of associated circuit
breaker(s) is achieved with the zone 2 time delay. Hence, the straight distance scheme is not applicable on
transmission lines where high-speed reclosing is applied to maintain system stability. In this particular
application, the only solution is some form of pilot relaying.
6.2.1.2 Pilot protection schemes
The pilot relaying scheme is generally used in HV and EHV transmission lines. The term pilot refers to
the use of communication paths or channels to send signals between the protective relays. Pilot relaying
schemes are inherently selective with the primary purpose of providing simultaneous high-speed tripping of
all circuit breakers in the protection system for any kind of fault. However, pilot protection schemes are
more complex primarily because of the requirement for highly coordinated relaying functions and
communications.
The pilot protection schemes that are commonly used for line protection are pilot distance and line
differential schemes. The pilot distance relaying schemes normally involve the use of distance relays. In
some pilot schemes, ground directional overcurrent relays are used instead of ground distance. The widely
used pilot distance relaying schemes are directional comparison blocking and unblocking, permissive
overreaching and underreaching transfer tripping, and direct underreaching transfer tripping. In line
differential schemes, the most commonly used schemes are phase comparison and current differential
relaying.
6.2.1.2.1 Directional comparison blocking and unblocking schemes
The directional comparison blocking (DCB) scheme using a power-line carrier is widely used. The
versatility and flexibility of the scheme makes it most applicable in multiterminal lines. By sensing the
direction of the fault current at a given terminal and by sending information to the remote end and applying
appropriate logic, the relays at each terminal can determine whether the fault is internal or external to the
zone of protection. For external faults, the fault current flows in the same direction at the terminals. The
relay at the terminal closest to the fault sends a blocking signal to other terminals to block tripping. When
the fault is internal, all fault currents at the terminals flow toward the fault. The relays at each terminal
detect the fault currents but do not receive any blocking signal. Hence, simultaneous high-speed tripping is
permitted. The system employs an ON-OFF power-line carrier channel, distance relays for phase fault
detectors, and directional instantaneous overcurrent relays for ground fault detector. The channel signal is
initiated by the phase distance and ground overcurrent units known as carrier start relays.
The directional comparison unblocking pilot relaying scheme uses frequency-shift keying (FSK) powerline carrier channels. There are two communication modes in the form of frequency shifts: block and
unblock signals. The block signal is continuously transmitted between terminals, thus eliminating the need
for carrier start relays. For internal faults, the carrier signal is dropped and the unblock signal is keyed,
thereby permitting simultaneous high-speed tripping at all terminals. Unlike the ON-OFF channel in the
blocking scheme, the integrity of the FSK communication channel can be monitored, which is important to
prove that the loss of carrier for block signal will not result in false tripping.
6.2.1.2.2 Direct underreaching transfer trip scheme
In transfer trip schemes, the communication channels are generally via a microwave or fiber-optic medium
or a hybrid microwave and fiber-optic medium. Because the communication system is separate from the
power system, the scheme offers certain advantages. The channel time can be shorter, in the range of
subcycles, and different types of signaling such as tone and digital mirrored bits can be implemented.
33
IEEE Std C37.233-2009

In the direct underreaching transfer trip (DUTT) scheme, directional distance relays are used at the
terminals. The relays are set for underreaching (zone 1) and overreaching (zone 2 or 3) relaying. If the fault
occurs within the zone 1 of both relays, the relays trip their local circuit breakers instantaneously and, at the
same time, send direct transfer trip signals to the remote ends. At the receiving end, the received transfer
trip signal directly trips the circuit breaker(s) without supervision. When only one underreaching relay sees
the fault, it is the only one that sends the direct transfer trip to the remote end and instantaneously trips the
remote circuit breaker(s). In the event the remote end fails to receive the transfer trip signal, its circuit
breaker(s) will trip after the zone 2 relay times out.
6.2.1.2.3 Permissive overreaching transfer trip scheme
The shortfall of DUTT in security can be resolved by the use of the permissive overreaching transfer trip
(POTT) scheme. In this scheme, the transmission of the permissive transfer trip signal is initiated by the
overreaching relaying elements (zone 2 or 3). For any internal fault, the distance relays at both ends receive
permissive transfer trip signals. The received POTT signal is logically coupled with fault detection by the
overreaching relay element to trip the local circuit breaker(s). Should one of these logic inputs be absent,
the breaker tripping does not occur. The overreaching relaying elements also provide time-delayed backup
relaying. Because of the added security, POTT is a widely used transfer trip scheme.
6.2.1.2.4 Permissive underreaching transfer trip scheme
In the permissive underreaching transfer trip (PUTT) scheme, the distance relays at the terminals are set
with underreaching and overreaching relaying elements. For internal faults, the underreaching (zone 1)
relay that detects the fault initiates or keys the transmission of transfer trip signal and instantaneously trips
the local circuit breaker(s). At the receiving end, the overreaching (zone 2) fault detecting relay is logically
coupled with the received PUTT signal to trip the circuit breaker(s) instantaneously. For a fault in the
overlapping zone 1, both terminals trip their local breakers and send PUTT signals to the remote ends. This
variation of permissive transfer trip scheme is also widely used.
6.2.1.2.5 Phase comparison relaying scheme
A phase comparison relaying scheme is a form of line differential relaying where the phase angles of
currents measured at the terminals are compared. When an internal fault occurs, the currents at the
terminals flow toward the fault. Since the currents are 180 out of phase (i.e., they are flowing in opposite
direction), the relays instantaneously trip their respective circuit breakers. For external faults, the currents at
the terminals flow in the same direction, and therefore, the circuit breakers are not tripped. Many phase
comparison techniques are available for this scheme and any communication medium can be used.
6.2.1.2.6 Line current differential scheme
Line current differential relay (87L) is a type of protection where peer relays are sending and receiving
current phasors or sampled data over a communications channel in order to detect faults on the protected
transmission lines. Two or more (in case of multiterminal line) peer-to-peer relays are required to comprise
a line protection system. The preparation for system testing requires a good understanding of the particular
relay system operating principles and the various components associated with the current differential
protection and its scheme.
The major advantage of this type of protection is that line current differential is a unit protection, providing
fast and simultaneous fault clearing at all terminals of the protected line. Other advantages include the
following: The operating principle of this protection is based on terminal current only, protection is not
affected by swings, and it is very fast and sensitive. However, there are some disadvantages. This
34
IEEE Std C37.233-2009

protection is a heavily channel-dependent system. In a case of systems using digital communication,

security and sensitivity may be affected by charging current and channel asymmetry, when transmit and
receive propagation delays are not equal.
In addition, different variations of the relay system operating principles are important in system testing.
Variations of the line current differential protection include alignment of phasors from all terminals,
number of data packets transmitted per power cycle, availability of charging current compensation,
differential principle (restrained or unrestrained) employed, phase segregated or mixed operating mode, and
so on. Depending on the relays selected, application and testing might be slightly different.
The performance of the line current differential relays is dependent not only on the protection algorithms
but also on the ability to handle communication channel impairments properly. Channel impairments
affecting line current differential relaying include communication noise, which can be continuous or bursts
of noise; channel interrupts; channel jitter; variable channel delays due to switching on the higher order
system; channel asymmetry; or an external loopback. The communication channel can be over direct fiber
or over multiplexed channels on the synchronous optical network (SONET)/synchronous digital hierarchy
(SDH) rings. Channels over direct fiber are considered more secure, but the cost is higher relative to the
bandwidth utilization. In applications where channel redundancy has been applied, the relay system
performance over both primary and alternative channels should be validated.
Most of the communications-related testing could be done in the laboratory during relay evaluation testing
and by using special equipment to reproduce the channel impairments. Refer to IEC 60834-1-1999 [B11]
for more information.
The protective relay capability and user selectable features used, operating principle, and the relay system
set points will determine the extent of system testing. When channel redundancy is applied, it is critical that
each channel is fully and independently tested.
For field commission testing, both external monitoring and/or, in the case of more modern relays, the relay
monitoring tools can be used in order to prove the integrity of the communications channel. The
performance of the line current differential relays can be quantized by the following categories:
Dependability: the probability of not having a failure to trip operation.
Fault clearing time: time interval between fault inception and issuing a trip command to open
breakers.
Security: the probability of not having an unwanted operation.
Channel impairments handling: ability to handle properly channel noise, channel interrupts,
channel switching, channel asymmetry, channel loopback, and so on without sacrificing security
and dependability.
Accuracy of differential restraint characteristics: includes both static and dynamic testing.
Ability to handle line charging current and accuracy of charging current compensation if any.
Ability to handle properly stub bus configuration when one of the line terminals is taken out of
service by the opening of the line disconnect switch while other terminals remain in service.
Ability to send and receive a direct transfer trip (DTT) signal properly for any possible topology
of the protection system and protected line.
Ability to detect faults on line energization and limits to detect high-resistive faults.
Ability to handle properly outfeed and infeed fault current conditions and operate correctly at
any fault inception angle during external and internal faults.
Ability to handle properly line energization and switching of series and shunt compensation.
35
IEEE Std C37.233-2009

Similar to many protection systems, line load testing is an important test prior to placing line current
differential protection in service, as secondary injection cannot validate that CT polarity or ratio. Also,
secondary injection testing cannot reproduce natural line distributed capacitance or shunt reactors
inductance.
Taking the aforementioned into account, further details on the follow-up commissioning and periodic
maintenance can be found in Annex B.
6.2.1.2.7 Direct transfer trip
The DTT is used to transfer a tripping signal from a protective device to a circuit breaker located at a
remote area. This may be necessary for several reasons, including:
Absence of a circuit breaker at the local station such as line terminated with a transformer
without a circuit breaker at the high-side side of the transformer.
Sending DTT as a result of bus protection operation or a breaker failure at the local station to
ensure high-speed interruption of the fault current supplied from all remote sources.
For a backup, to prove that remote terminal is open for a system fault.
The term DTT can be divided into the following categories:
Equipment transfer tripwhen the tripping signal is initiated from station protection such as
bus protection, transformer protection, or as a result of a breaker failure.
Line transfer tripwhen line protection at one terminal detects the fault and sends DTT to
either accelerate protection operation at the remote end, such as DUTT, or as a backup in case of
the line current differential described above.
In the case of line differential protection, the equipment transfer trip and line transfer trip can be combined
together over the current differential channel. This means that DTT can be initiated from either 87L
operation (sometimes referred as internal DTT) or from external breaker failure or bus protection relay
(referred as external DTT). However, it is desirable to have a clear distinction by the receiving DTT relay
of what initiated DTT in order to block reclosure in case of external DTT.
6.2.1.2.8 Automatic reclosing schemes
Automatic reclosing is a control scheme for quick reclosing of circuit breakers of a transmission line after
clearing a fault. The application of automatic reclosing scheme is generally required to maintain system
stability. For the scheme to succeed, sufficient outage time must be allowed for the fault path to deionize
before reclosing. The deionizing time is dependent on the system voltage, but it normally takes place
between 10 and 30 cycles.
6.2.2 Transmission-line relay testing
Throughout the life cycle of a relay, the relay is subjected to a certification or factory acceptance test,
application test, commissioning test, and preventive maintenance test.
36
IEEE Std C37.233-2009

6.2.2.1 Certification test

Certification tests may be conducted in the relay supplier factory or at another independent facility to verify
the performance of the relay against established parameters and specifications.
6.2.2.2 Application test
The application test typically involves bench testing of the relay to confirm that its elements are in working
order for a given application before the relay gets installed at a substation. Relay schemes and logic can
also be tested in the laboratory prior to field implementation.
Transient tests using digital simulators have been developed mainly to emulate the traditional model power
system concept in order to evaluate protective relay response to power system transients. Nonpilot as well
as communication-based transmission-line relaying schemes (i.e., current differential, DCB, etc.) can be
tested in a laboratory by injecting simulated voltage and current waveforms into relays under test. Relay
input signals are generally derived from transient simulation software tools. Transient simulation
techniques provide also tools for evaluating the overall performance of protective relaying schemes because
they assist in testing the hardware, relay algorithms, settings, configuration, speed of operation, and
transient performance of the scheme.
Transmission-line relay evaluation is based on line topology and lengthshort-line, medium-line, and
long-line models. All three transmission-line models may have similar topology and may consist of parallel
lines to introduce mutual coupling between them. Simulation of a strong source at one end with a relatively
weak source at the remote end will assist in comparing relay performance under different conditions.
Relays are required to be tested for internal and external faults during a maximum power flow situation.
Faults at different inception angles will demonstrate relay performance under different dc offset conditions.
Likewise, varying fault resistances will also validate relay response. Relays are also to be tested for
evolving faults and current reversal conditions. It is desirable to evaluate relay performance under stressed
conditions, such as CT saturation and CCVT transients.
Relays designed for the series-compensated line are often tested with system models incorporating a seriescompensated line with the metal-oxide varistor (MOV) and bypass breaker. It is desirable to verify the
performance of communication-dependent relay systems with degraded or corrupted communication
networks. Some of the commonly practiced methods include the injection of noise in audio-tone
communication systems or introduction of bit-error rates in digital communications networks.
Real-time or model power system testing provides a measure for evaluating the overall dependability and
security of the scheme. In the case of transmission-line protection performance evaluation, these tests can
be used to validate performance on heavily loaded long lines, series capacitors, and shunt reactors,
especially for bulk transmission applications. Model power system testing is practiced where the response
of the schemes cannot be evaluated analytically or by conventional test methods due to the complex
interaction of various power system components during faults and the high-speed communications schemes
required. In addition, model power testing provides a means of thoroughly investigating the transient
performance of the relay system without subjecting the system to primary fault condition (such as stage
tests).
Model testing also simplifies variations as follows:
Fault location, type, and incidence angle
Fault impedance.
Source impedance magnitudes.
Source impedance ratios; Z1/Z0, X/R, etc.
37
IEEE Std C37.233-2009

System configuration
System hardware performance, stuck breaker, etc.
System loading conditions
For the model testing, the power system parameters, as viewed from the relay terminals, should be as close
a representation of the actual system as practicable. Some components needed for model power testing are
as follows:
a)
Source impedance: positive, negative, and zero sequences. Different system conditions can be
set up, for example, normal system and unusual configurations for weak feed scenarios if
applicable.
b) Line impedances: series and shunt; positive and zero sequences.

c)
Distributed parameters for long lines.
d) Series capacitors: location, reactance, gap flashing, and reinsertion magnitudes and times; refer
to IEEE Std C37.116TM.
e)
Shunt reactors: location, reactance, and excitation characteristics.
f)
Mutual coupling between lines.
g) Steady-state active and reactive power flows:

1) Power circuit breaker dissymmetry. Breaker timing for each phaseif variances
between phases (for tripping and for closing, respectively) are indicated by the
manufacturer, the model may be set at maximum specified by the manufacturer.
2) Power circuit breaker with stuck pole.
h) Phase impedance dissymmetry:
1) Untransposed lines.
2) Unsymmetrical series capacitor gap flashing.
3) ne phase out of service in a three-phase bank of shunt reactors.
It is important that the instrument transformers used in the model have accuracy class such that the relay
system burdens do not cause errors in the magnitudes or distortion of waveforms of the currents and
voltages of the model during testing. This does not preclude changes to permit investigation of performance
on saturated waveforms.
Transient simulation tools such as the Electromagnetic Transient Program (EMTP), the Alternative
Transient Program (ATP), or the EMTDC allow the user to prepare relay signal playback via power
amplifiers in automated fashion repeatedly and with varying system conditions (i.e., fault resistance, fault
inception angle, etc.) if desired. Development of an adequate transient model is required to generate signals
for different applications.
Operation of relay output contacts (trips, alarms, etc.) may be monitored and recorded by the simulator
computer in order to help to evaluate relay response during simulation. Transient tests are sometimes
referred to as dynamic or application tests. Figure 8 shows an example of an open-loop digital simulator
configuration that can be used in the laboratory environment for testing communication-based
transmission-line relaying schemes.
38
IEEE Std C37.233-2009

Figure 8 Example of application test setup using open-loop digital simulator

For more thorough or complete application tests, closed-loop digital simulators can be used. Closed-loop
tests require transient model and power system simulation where output signals from the simulation are
used as inputs to the relaying system under test. Relay outputs responding to these signals can then be fed
back to the simulated power system, in turn changing the model configuration. This mechanism provides
the means for testing both the relay systems response to power system disturbances as well as the modeled
power systems response to the relay operation. Therefore, closed-loop tests can provide a realistic testing
environment for a relaying system but require hardware to handle exchange of many input and output
signals during a simulation. Closed-loop simulator software tools must also provide adequate means for
accurate transient modeling, simulation control, and reporting results.
6.2.2.3 Commissioning test
The commissioning test involves the comprehensive testing of the transmission-line relay protection
system. The relay protection system of a transmission line encompasses instrument transformers, wires and
cables, relays, test switches, control switches, and communication equipment and channels. During the
commissioning test, each device of the protection system is functionally tested. Currents and voltages are
applied at the primary side of current transformers and voltage transformers, respectively, to verify proper
ratio and phasing. The wires connecting the relays and other control devices are checked out end-to-end
against schematic diagrams. Communication channels are separately tested for proper levels and
frequencies. Relay tripping and alarm outputs are checked out, and tripping of power circuit breakers as
well as proper alarm annunciation are proved. Finally, a system test of the protective relaying scheme is
conducted.
39
IEEE Std C37.233-2009

6.2.2.4 Preventive maintenance test

This test involves periodic testing of a relay protection system of a transmission line. The test may not be as
comprehensive as the commissioning test; however, it covers checking out all critical functions of the
relays.
Steady-state tests are widely used for relay periodic maintenance and involve the use of current and voltage
phasor injection to test individual relay operating characteristics and settings. Output contacts also need to
be checked to verify they remain healthy.
6.2.3 Transmission-line relay protection system test
6.2.3.1 Staged fault test
For many years, a staged fault test was used for comprehensive testing of a transmission-line relay
protection system. It is considered the ultimate test because instrument transformers are covered in the test.
However, conducting a staged fault test is costly, laborious, and inherently dangerous to personnel
involved, and it puts the transmission system components under tremendous electrical stress.
The test involves generating an actual fault at a specified location within the line section or immediately out
of the section. The responses of the protective relays at both ends and clearing times are then observed and
noted. Associated alarms are checked out. Relays protecting adjacent transmission lines are also verified to
ensure the relays do not trip on external faults.
6.2.3.2 End-to-end testing by secondary injection method
An alternative to staged fault testing of transmission-line relays is the GPS-synchronized secondary
injection method. In this method, secondary currents, voltages, and their respective phase angles,
simulating prefault, fault, and postfault conditions, are simultaneously injected into the line relays. The
simultaneous injections of simulated events are synchronized by using GPS clock receivers. The secondary
injection method only verifies the secondary circuits of instrument transformers; however, with the use of
good fault data, it has become a reliable method for testing protective relaying schemes of transmission
lines.
The technological advances of microprocessor-based relay test sets, portable computers, GPS clock
receivers, breaker simulators, and application programs have made the dynamic-state testing of line relays
possible. Under the simulated conditions, the relays at the line terminals are injected with currents and
voltages in pure sine waves. These quantities are derived by conducting fault studies involving application
of different types of faults at various locations of the transmission line. For example, the types of faults
simulated include single-phase to ground, single-phase to ground fault with fault impedance, two-phase-to
ground, multiphase faults. Types of faults typically include internal faults (e.g., 10%, 50%, and 90% of line
length from one terminal), external faults, and current reversals. All current and voltage quantities
representing the prefault, simulated fault, and postfault conditions are compiled into test modules and
downloaded into the test sets prior to the execution of the test.
Modern relay test sets are capable of generating transient waveforms that include dc offsets and harmonics.
Transient fault data are more desirable in testing relaying schemes of series-compensated transmission
lines. These data can be produced in COMTRADE files from playbacks of actual recorded faults by digital
fault recorders (DFRs) if they are available and from fault studies using EMTP, ATP, or other similar tools.
Transmission-line system modeling and running of EMTP or ATP application programs could take from 1
to 4 weeks. Modern programmable test sets generally support test modules composed of COMTRADE
files.
40
IEEE Std C37.233-2009

A complete end-to-end relay test setup at each terminal is shown in Figure 9. A key component is the
programmable relay test set. The test set is supported by computers, a GPS clock receiver, a circuit breaker
simulator, and a SER or DFR. The SER may be an inherent function of the protective relay under test or
may be implemented in an external device. One portable computer is used to control the relay test set and
the ancillary devices while the other computer is used to control and monitor the relay being tested. The
latest relay test set models may incorporate the GPS clock receiver, breaker simulation, and event recording
functions. The tests are initiated by synchronizing signals at all line terminals.
Figure 9 Typical setup for end-to-end testing by secondary injection

Test preparation involves the selection of types of faults (e.g., 1LG, 1L-G with fault impedance, L-L, and
3L-G faults) to be simulated and their locations that are internal and external to the protection zone.
Additional faults may be required for special test applications (e.g., series compensated line). The line is
first modeled using a commercially available fault study software program. A prefault condition is
assumed, which is typically the normal loading condition of the line. Once the prefault data are established,
an iterative process of running the fault study application takes place. For each predetermined internal and
external fault, the preselected fault types are simulated. If necessary, the postfault condition is simulated
and solved by running a load flow program. The fault data are then used in constructing the test file for the
end-to-end relay protection system test.
In Figure 9, two computers are shown. The first computer hosts the automated software program for the
relay test set, test files, and control applications for the auxiliary box devices. The second computer is used
primarily to monitor the relay and to store relay fault data. A GPS antenna with flexible coaxial cable is
installed for the GPS clock receiver. The antenna is run to the outside of the relay building and can be
easily mounted on top of a parked vehicle or on any support structure or platform. In addition to setting up
the test equipment, voice communication has to be established between terminals typically by telephone or
radio. The relay technicians have to coordinate the time to trigger a fault in their respective relay test set.
In the second phase of the test, the test file is preloaded into the relay test set. The time agreed on is entered
into the GPS clock receiver using the first computer. When the event trigger time arrives, the GPS clock
receiver time stamps the sequence event recorder and triggers the relay test set to initiate the prefault
injection into the relay. After a user-defined prefault interval, the relay test set automatically injects the
fault quantities into the relay. When the relay trips, it opens the circuit breaker or triggers the circuit
breaker simulator and sequence event recorder. For a complete end-to-end test where proper operation of
circuit breaker and integrity of communication channel have to be verified, the circuit breaker simulator
may not be used. Instead, the power circuit breaker is allowed to be tripped by the relay. The purpose of the
breaker simulator is to minimize unnecessary circuit breaker operation. As different protective devices have
41
IEEE Std C37.233-2009

different operating principles, the prefault duration may be affected by the type of device under test. For
example, some relays may need a longer initial condition in order to identify properly the normal system
state after start of test versus a switch-on-to-fault event. Likewise, user-defined algorithms should be
considered when setting up for simulation testing.
After the fault duration expires, the relay test set automatically injects the postfault quantities for a certain
period and then terminates the injection. When reclosing is incorporated as part of the scheme control
function, end-to-end tests may be set up to cover performance evaluation of the reclosing function. The
second computer is used to monitor and evaluate the response of the relay. The test results displayed on the
computer screen or printed out are immediately evaluated and compared with expected values.
The posttest phase involves more in-depth analysis of the test results, which is typically performed when
the results do not meet expectations. This is a situation when protection engineers are involved in reviewing
the fault study and in investigating causes of discrepancies. In this phase, the test results are documented
and the reports are prepared when required.
It is common practice to use the same type and style of test equipment for all terminals when coordinating
end-to-end testing to simplify troubleshooting and setup. However, using different types of test sets is
possible. For example, different types of equipment may be used to test the protection system of a tie line
between different power companies.
To synchronize the test equipment properly between different vintages or manufacturers, the factors
influencing the response of the test sets should be addressed. For example, test equipment produced by
different vendors may have different time delays after trigger. Therefore, the prefault time period may be
different. To ensure that the triggering of fault injections is properly coordinated, the time delay after
trigger of the relay test sets must be accurately measured and compensated for prior to the actual end-to-end
test. The difference in time durations must be factored in the synchronization of secondary data injections.
It is important to note that the delay time after trigger may be different for state sequence playback and for
DFR playback on each vendor. Refer to Annex E for additional information.
6.2.4 Impact of high-impedance faults to protective relay performance and system testing
High-impedance faults create certain challenges for line protection. The magnitude of the ground fault
current on the given line is influenced by several factors: system neutral arrangement; fault arc resistance;
fault ground path (return) resistance, which depends on the soil resistivity and tower footage ground
impedance; extension of resistive zone caused by MOV action in series-compensated lines; and system
equivalent impedances.
It is important to detect ground faults in order to minimize equipment damage and reduce system exposure.
Undetected ground faults may lead to overvoltages and overheating of the equipment. This may evolve into
phase-to-phase or three-phase faults carrying large fault currents and leading to a system stress.
The requirements and methods used to detect ground faults are different on solidly grounded, high- or lowimpedance grounded, and ungrounded systems. Usually, single-line-to-ground (SLG) faults generate less
ground fault current than other types of the faults, which means they are the most challenging for
protection. Many of these faults are tree contacts, which can be of high impedance, particularly in the
winter time when the soil is frozen. Refer to Annex C for more details.
42
IEEE Std C37.233-2009

6.3 Transformer protection

6.3.1 Transformer protection schemes
For transformer protection, several types of protective schemes are commonly applied, including current
differential, time overcurrent, overexcitation, and sudden pressure. The transformer protective relay
location and technology applied may also influence the type of protection design and testing. For example,
consider a two-windings transformer when some level of protection for each high-voltage winding is
located in the respective control building, and the buildings are large distances apart. Fiber optics may be
used as a means of interface between protective devices in the different buildings to communicate decisions
or information between the devices. There are also transformers that are part of a transmission line, and
testing may involve communication equipment; see 6.3.4 for additional information. When redundant
equipment of communication interfaces is designed, testing often is conducted with one complete system at
a time.
6.3.2 Transformer differential protection testing
During commission testing, company personnel conduct visual inspections of the relays, wire connections,
and design schematics. There are also several different current transformer tests performed in order to
verify proper CT condition and connections. These tests are done when the transformer is out of service. By
applying voltage and current, several tests are performed including ratio, polarity, and saturation. A Megger
ground test is performed to check for undesired grounds.
Relay testing is done by applying settings and verifying the desired outcome. Typical tests include
differential/slope, harmonic, minimum pickup, voltage protection, and sudden pressure. For the
differential/slope test, two current sources are used to inject current into single-phase relays or three-phase
relays with no vector compensation. It is suggested that for three-phase numerical transformer differential
relays that have vector compensation settings, especially those that involve zero-sequence removal, threephase current injection into both two relay windings be performed. The restraint coil is tested by applying a
low mismatch current to see whether the restraint coil blocks the relay from tripping. A high-mismatch
current is then applied to the operate coil to verify it trips the external devices. A harmonic test includes
simulating a second and a fifth harmonic current to verify the relay(s) will not operate for overexcitation or
inrush current. Relays that employ waveform recognition, for example, to block the differential function
from operating during inrush conditions, can be tested by use of COMTRADE files or real-time simulation
techniques. Similar types of test file cases could generally be applied to devices without harmonic
waveform recognition.
For relays with internal compensation, three-phase testing will simplify the evaluation of the relay
performance.
For minimum pickup tests, a current source is used to inject current into the overcurrent relay(s) to verify
the threshold for tripping. The timing of the overcurrent relay in a transformer protection scheme is
typically slower and is used as a backup protection to the current differential relay.
Voltage tests verify operation for voltage-dependant elements. Where overexcitation is applied, system
testing may involve the testing of threshold set points under steady-state conditions as an initial set of tests
followed by simulated volts/Hertz (V/Hz) conditions using transient simulation tools or use of
COMTRADE files from system events to verify the overexcitation performance for a generator step-up
transformer or for a true power system condition with high magnitudes of volts/Hertz. The sudden pressure
relay is tested by applying pressure to the pressure switch and observing the alarm and trip contacts for
proper operation. A manual trip is initiated to test the auxiliary and lockout relays for proper operation of
the above relay schemes. Also, SCADA tests are applied to ensure all alarms and targets are operating
properly.
43
IEEE Std C37.233-2009

Maintenance tests for transformer protection may need to be conducted with the transformer energized.
Therefore, the proper isolation of the elements under test is critical. It is important to keep some levels of
overlapping protection in service when maintenance tests are performed with the transformer energized.
The tests involve periodic testing of the transformer protective scheme. The tests may not be as
comprehensive as the commissioning test; however, it covers checking out all critical functions of the
protection system. Steady-state tests are widely used when applicable for relay periodic maintenance and
involve the use of current and voltage elements. Output contacts are also verified for proper functioning.
6.3.3 Power transformer thermal protection
In order to assess dynamically the transformers real power operating margins, especially in the presence of
overload conditions, a commonly adopted method is thermal protection. Thanks to the adoption of these
facilities, it is possible to use the full capacity of the transformer, which implies lower lost revenues or
costly upgrades.
Thermal protection of power transformers requires an accurate prediction of the evolution of the hot-spot
temperature in the top or in the center of the high- or low-voltage winding in order to verify that it is lower
than the maximum allowable threshold temperature. Refer to IEEE Std C57.91TM.
The knowledge of the windings hot-spot temperature depends on the following:
Ambient temperature
Top oil rise over ambient temperature
Winding hottest spot rise over top oil temperature.
The winding hot-spot identification is of critical importance for the development of the transformer
overload protection. Because an increase of the hot-spot temperature produces an acceleration in thermal
aging of the transformer, the monitoring of this temperature is essential to evaluate the loss of insulation
life and to indicate the existing risk that free gas bubbles evolve at the hot-spot site in the presence of an
emergency condition that dictates an abrupt change of load. See Lahoti and Flowers [B29] and
IEEE Working Group K3 [B31].
Some of the power transformer thermal protection methods are realized as follows:
An overcurrent relay that produces an inverse time-current characteristic by integrating a

function of current F(I) with respect to time. The overcurrent characteristic emulates the shape
of the transformer thermal characteristic and should be closely coordinated with it. The inputs
for this coordination process are the load curves and ambient operating temperature conditions,
assuming a fixed conservative profile for them. See Zocholl and Guzman [B38].
A microprocessor-based relay starting from the acquisition of easily measurable variables (such
as the environmental temperature, the transformer top oil temperature, and the load current)
solves the transformers heating equations determining the corresponding hot-spot temperature
evolution (commonly referred to as indirect protective systems).
A protective system employing a direct hot-spot temperature acquisition module that measures
the winding temperature profiles in several internal points by a fiber optical temperaturesensing-based technology.
Overcurrent relay-based thermal protective systems process only the transformers load current. They are,
therefore, not subject to sensors faults, measuring errors, and corrupted data.
Because the coordination process between the relays overcurrent characteristic and the transformers
thermal characteristic is realized on the basis of the specific transformer thermal parameters, which can
vary considerably from one transformer to another and drift for aging, it could become susceptible to
44
IEEE Std C37.233-2009

parameter variations. To manage these uncertainties, overly conservative factors are applied, and the
transformers are underutilized to keep suspected hot-spot portions of the conductor from overheating and
failing prematurely.
Indirect protective systems acquire a set of routinely measured variables and identify the unknown
evolution of the hot-spot temperature profile by solving the transformer thermal model. Thus, they could be
subject to sensors faults, measuring errors, and corrupted data.
Moreover, because these methods are based on a built-in thermal equivalent model that requires some
specific transformer data, which could be affected by various uncertainties, they could become susceptible
to parameter variations. Large uncertainties come from several sources such as the oil time constant and the
winding hot-spot time constant; oil viscosity and winding resistance are functions of the load pattern, the
ambient temperature, aging, constructive tolerances, and so on. These uncertainties affect obviously the
accuracy of the calculations, and considering that the loss of life is an exponential function of hot-spot
temperature, the adoption of actual thermal models can produce errors in determining the real-time
transformer overloadability rating.
Direct thermal protective systems acquire the hot-spot temperature profile by a distributed winding
measuring system. They could, therefore, be subject to sensors faults, measuring errors, and corrupted
data.
6.3.3.1 Testing procedure
To test the performances of power transformers thermal protective systems based on indirect or direct
methods, it is possible to adopt the test setup reported in Figure 10. It simulates, by an electronic load, the
stress from realistic operation and acquires, through a measurement station, the load current, the
transformer top oil temperature, the weather conditions, and the corresponding windings hot-spot
temperature computed by the device under test (DUT).
All sensors are interfaced with a data acquisition unit, which is used also for controlling the programmable
electronic load, and a data logging system to record, with a time period of 5 min, the entire set of measured
variables.
With the above-mentioned measurement station, the test program, starting from a cold thermal state,
simulates a realistic daily loading pattern characterized by several overload conditions. The gathered data
are then organized into two different sets: one containing the hot-spot temperature profile computed by the
DUT and another containing the corresponding hot-spot temperature profile computed by solving a suitable
transformer thermal model using the available external variables acquired (load current, top oil
temperature, environmental temperature, etc.).
If these two profiles appear incoherent, especially during the overload conditions, then the DUT operation
appears not reliable. Obviously, small variations between these profiles could be considered admissible
because they could depend on the accuracy of the thermal model adopted.
The same test station could also be employed to test the performances of overcurrent-relay-based thermal
protective systems. In this connection, the measured variables could be adopted to compute the maximum
hot-spot temperatures that trigger the overcurrent relay operation.
As far as the load pattern adopted during the test procedure, the profile reported in Figure 11 could be
adopted. This profile is expected to be representative of the different operating conditions of the
transformer as it contains both situations of normal load and an overload condition of about 4 h (around the
7th hour of functioning).
45
IEEE Std C37.233-2009

Figure 10 Test setup for noninvasive thermal protection systems
1,4
Load current [p.u.]
1,2
1,0
0,8
0,6
0,4
0,2
10
15
20
time [h]
Figure 11 Test load current profile
The same concepts could also be extended to test the performances of power transformers thermal
protective systems during their normal operation. In this case, the load current is imposed by the electrical
network, and it is only necessary to acquire the observable variables for daily operation in order to make
the testing procedure less sensitive to the initial transformer thermal state. These data could be then
46
IEEE Std C37.233-2009

processed in order to compare the thermal state returned by the DUT and the thermal state assessed by
solving the transformer thermal model. Refer to Annex D for additional information.
6.3.4 Lines with series transformers as part of the line
When a power transformer is part of a transmission line, the line breakers are the source for both the line
and the transformer. Figure 12 shows a line/transformer configuration, each equipped with redundant
protection.
In this configuration, several system tests, as well as interlocking tests between line protection and
transformer lockout conditions, may need to be verified. The transformer is shown with multiple levels of
protection, and all transformer protection, including the sudden pressure and low oil detection, initiates the
trip signal to the source location. Once the trip is activated for transformer troubles or faults, breaker
closing may be blocked. In such applications, telecommunication protection is applied. When the
transformer protection detects a problem, transfer trip signals are transmitted to the station to open the
source breakers and block reclosing as applicable.
In addition to the listed transformer protective functions, there may be other devices that would initiate the
trip signals to isolate the transformer. Examples include low-voltage transformer protection or the lowvoltage winding breaker failure condition, where low side winding is equipped with a breaker. Likewise,
breaker failure protection of the source breakers (transmission-line breakers) would need to isolate the
transformer lower voltage windings if the lower voltage windings have sources. Proper performance and
interlocking for each of these schemes need to be verified as part of the overall line/transformer
configuration.
Because bus configuration at the source may be different for different installations, the tests should be
adjusted accordingly to reflect the appropriate levels of tests. Figure 13 shows one example where the
source to the transformer is a double bus (or Main/Aux) configuration with a substitute breaker. In this
application, the substitute breaker can be used to allow the transformer to remain in service. When the
transformer protection detects a problem, transfer trip signals are transmitted to the station to open the
source breakers and block reclosing as applicable. Therefore, the scheme testing should include steps that
would verify the substitute breaker will isolate transformer faults and perform associated interlocking
similar to the main breaker normally supporting the transformer at a distance location.
Additional scheme performance testing is required when the application includes some level of intelligence
to differentiate line faults near the transformer, low-voltage winding breaker failure versus transformer
trouble. For example, if the scheme design allows for reclosing after line faults, then the interlocking with
transformer lockout devices may need to be verified.
Where multiple levels of telecommunication routes to the source breakers are used, the scheme should be
repeated for the alternative path. In addition, maintenance flexibility should be verified as part of the
overall performance evaluation.
For fused transformers such as distribution transformers, a sensitive negative sequence relay or a neutral
transformer protective relay can be applied, in which case system testing is extended to include this
application. Also, where a transfer trip is applied as part of the transformer protection scheme, testing
would validate functionality.
47
IEEE Std C37.233-2009

Figure 12 Typical protection for power transformer included in transmission-line

zone of protection, line with a series transmission transformer with transformer
part of the line (using redundant communication paths)
48
IEEE Std C37.233-2009

Figure 13 Line with a series transformer-source bus configured as a double

bus and a substitute breaker
6.4 Distribution protection

Similar to transmission protection, testing of modern distribution devices and schemes requires the
availability of a set of tools that will simplify the testing process, and at the same time, it will prove the
high quality of the testing process.
The functionality of modern state-of-the-art distribution feeder protection relays includes the following:
Basic fault protection
Advanced protection schemes
Abnormal system conditions protection
Load-shedding
Automation
Monitoring
Recording
Analysis
49
IEEE Std C37.233-2009

6.4.1 Protective device functions and testing

The key function for a microprocessor-based device used in distribution protection is to detect and clear
short-circuit faults that can damage substation equipment or create conditions that affect sensitive loads.
This is achieved through the use of instantaneous, definite, or inverse time-delayed overcurrent elements
operating on phase, negative, or zero-sequence currents.
The overcurrent protection elements may be directional or nondirectional and, in some cases, can have
additional voltage supervision.
The functions in the relay have a hierarchy that needs to be considered for the testing of the device (see
Figure 14). First of all, the secondary currents and voltages that are applied to the distribution protection
relay are filtered and processed in the analog input module and provide instantaneous sampled values to the
internal digital data bus of the microprocessor-based device. These sampled values can be recorded when
an abnormal system condition is detected or used to calculate the different measurements or current and
voltage phasors used by the different protection functions.
Figure 14 Distribution protection block diagram

The outputs of the measurement elements become inputs to protection or other functional elements of the
device. Each basic protection element operates based on a specific measured valuephase or sequence
current, voltage, frequency, and so on. The measurements of active, reactive, and apparent power or power
factor are also usually available from the relays if required in the substation automation system.
When a protection function element detects an abnormal condition, it may operate and issue a trip
command to clear a fault. It may also interact with other protection elements in an advanced distribution
protection scheme used for acceleration or adaptation of the relay to changing configuration or system
conditions.
Some of the most common distribution protection logic schemes are as follows:
Cold load pickup
Fuse saving scheme
Feeder blocking scheme
Sympathetic trip logic scheme
Selective overcurrent scheme
50
IEEE Std C37.233-2009

Distribution bus protection scheme

Backup selective tripping scheme
Breaker failure protection scheme
The multifunctional distribution protection relays also perform automatic functions such as multishot
reclosing and local backup protection such as breaker failure protection.
Several distribution feeder relay functions can be used for load shedding during wide area disturbances or,
in the case of islanding parts of the system, where the feeder or feeders are located. These include
frequency, rate-of-change of frequency, or average rate of change of frequency or voltage functional
elements.
The successful detection and clearing of any abnormal system conditions is affected by the correct
configuration and operation of the protection functional elements. It needs healthy secondary current and
voltage circuits as well as breaker trip or close circuits. This allows the relays to perform monitoring
functions such as trip circuit supervision, current and voltage circuit supervision, or different breaker
monitoring functions.
Last, but not least, the relays are also used as the first level in the hierarchy of a substation or system
analysis function. Based on the prefault and fault currents and voltages, they calculate the location of the
fault, the magnitude and angle of the currents and voltages before and after the fault, the duration of the
fault, and other parameters.
6.4.2 Testing of multifunctional distribution protection devices
The testing of modern multifunctional distribution protection devices requires the use of advanced test
equipment and software tools that can simulate the different system conditions and status of primary
substation equipment or other multifunctional microprocessor-based devices. The test system should be
able to replay COMTRADE files from disturbance recorders and/or produced by transient simulation tools.
It should be able to apply user-defined current and voltage signals with settable phase angles as well as to
execute a sequence of predefined prefault, fault, and postfault steps (Figure 15).
Figure 15 Test system block diagram
51
IEEE Std C37.233-2009

These test values can be used as part of both commission testing as well as routine maintenance testing.
The testing of the different microprocessor-based device elements has to start from the bottom of the
functional hierarchy and must end with the most complex logic schemes implemented in the device.
Protective relays with such schemes operate based on the state of multiple monitored signals such as
blocking signals, breaker status signals, and relay status signals. Time coordination of these signals and
synchronization with the prefault and fault analog signals is required in order to perform adequate testing of
these types of schemes.
Figure 16 shows a simplified way for the test device to properly simulate the distribution protection
environment shown in Figure 14 as well as to monitor the operation of the relay under the simulated
conditions.
Figure 16 Testing of distribution protection microprocessor-based device

6.4.3 Testing of distribution protection schemes
The testing of distribution protection schemes is the final step in the testing of a distribution relay, and it is
based on the assumption that all individual protection elements have already been tested and proven to be
operating correctly.
The conventional test process requires the programming of the test device (test set) to perform prefault,
fault, and postfault steps in the simulation of the changing power system parameters in order to evaluate the
performance of a distribution protection device with advanced scheme logic.
There is a need for different options for testing of distribution protection logic schemes based on the
purpose of the test. Three typical cases are as follows:
Complete evaluation: All logic schemes are selected in a point-and-click manner, and the test
software automatically executes a series of predefined tests, measures the relays response,
analyzes the results, and prepares the test report.
Testing of a specific logic scheme: This scheme automatically executes all tests required for the
selected logic scheme, measures the relays response, analyzes the results, and prepares the test
report.
52
IEEE Std C37.233-2009

Testing of a specific logic scheme for a specific condition: This scheme automatically executes
a single test required for the selected logic scheme, measures the relays response, analyzes the
results, and prepares the test report.
Different signals required by the distribution protection logic schemes in modern protective relays have to
be considered in the process of defining what tests should be performed in order to verify the functionality
and the correct settings of such schemes.
The simulation of the relay environment is also affected by the location of the fault if it is on a downstream
section of the protected feeder or on an adjacent feeder.
6.4.3.1 What is commonly tested?
The testing of distribution protection schemes is intended to evaluate their performance under different
fault, system, and breaker conditions.
Different tests are designed to monitor the relay operation for fault conditions, such as follows:
Faults on the protected feeder
Faults on an adjacent feeder
Distribution bus faults
No fault
Because the distribution protection logic and schemes are tested in this condition, the relay reaction to the
receiving of correct control signals under the above-listed fault conditions is tested as well. These test
values can be used as part of both commission testing and routine maintenance testing.
6.4.3.2 How are the tests performed?
Tests of distribution protection logic schemes are generally performed in a way to mimic closely real power
system conditions. The sequence of steps in a test varies based on the function of the specific scheme and
possibly under different power system operating conditions.
For example, if the test is for a distribution bus protection scheme and the test condition is a distribution
bus fault, the sequence will include only the following three steps:
Prefault with breaker in a closed position, nominal voltage and normal load current conditions
Bus fault condition
Posttrip condition with the low side transformer breaker opened and no current
When a more complex scheme (for example, a fuse-saving scheme) is tested, the number of steps will
increase accordingly. Figure 17 shows the waveform recorded by the tested relay simulated system
conditions for an unsuccessful reclosing.
53
IEEE Std C37.233-2009

Figure 17 Unsuccessful reclosing simulation

6.4.3.3 Test results analysis
The results from each performed test are automatically analyzed by the test software. The analysis is based
on an expert system comparing the operating time of a combination of monitored protection elements that
operated during the test.
The expected operating time of the monitored protection elements is defined based on the protective relays
technical specifications. The results are displayed in a graphical format in the user interface and in detail in
an automatically generated test report.
The test result analysis is often used for both commission testing and evaluation of scheme performance
during maintenance tests.
6.4.3.4 Steps in testing
There is a sequence of steps related to the scheme testing that depend on the goals of the test and the level
of knowledge of the relay under test and its operating principles.
First, the user has to become familiar with the principles of operation of the test object (in this case, a
microprocessor-based distribution feeder protection relay with preprogrammed logic schemes) and the
sequence of events that result in an accelerated or time delayed trip while implementing a specific logic
scheme. This information is usually available in the users manual of the tested relay. Animations based on
the typical distribution protection schemes principles showing the sequence of events and the operation of
relay function elements can help the user easily achieve this goal (Figure 18).
54
IEEE Std C37.233-2009

Figure 18 Scheme animation for user training

If the goal of the test is a benchmark test of the distribution protection logic schemes of a new to the utility
distribution relay, the user should use the multiple scheme test mode. It executes a series of tests selected
by the user, evaluates the relay operation for each of the individual tests after their execution, and displays
the result in a graphical format (Figure 19). The overall performance of the relay is evaluated after all
selected tests have been completed and a report, including the operating times of monitored functions, is
generated.
Figure 19 Multiple schemes test mode

When the task is to test only a specific distribution logic scheme, the single scheme test mode should be
used (Figure 20).
55
IEEE Std C37.233-2009

Figure 20 Single scheme test mode

Maintenance tests for distribution systems may need to be conducted under energized conditions.
Therefore, proper isolation of the elements under test is critical. The tests involve periodic testing of the
protective scheme or evaluation of captured events from an actual fault on the system. The tests may not be
as comprehensive as the commissioning test; however, it covers checking out all critical functions of the
protection system. Output contacts are also verified for proper functioning.
6.5 Shunt capacitor protection

Testing of relays for shunt capacitor banks is not much different than testing normal overcurrent relays.
Some smaller banks are fused for fault protection. Depending on the size and configuration of the bank,
there may be an electronic controller or separate relays installed to accomplish some of the following
functions:
Bank unbalance detection due to failed capacitors
Bank bus fault protection
Under/over voltage to automatically switch the bank on and off
Capacitor discharge timer
The testing of these functions for a new installation or for periodic maintenance is quite similar.
Commissioning tests will be described with the differences noted.
6.5.1 Bank unbalance
Unbalance protection will consist of neutral overvoltage or overcurrent relays to detect failed capacitors.
The settings are typically designed to alarm at the first threshold and trip at the second. In the initial
commissioning tests, failed capacitors are simulated by shorting or disconnecting capacitor cans one at a
56
IEEE Std C37.233-2009

time until the alarm and trip threshold settings are exceeded. The process of shorting or removing capacitor
cans may require several switching steps to allow the capacitors to be discharged, and proper grounding
procedures are followed to access the capacitor platform. For maintenance, the trip levels are simply
checked without removing capacitors. For fuseless or internally fused capacitor banks where partial unit
failures are monitored, capacitor removal may not fully test all the protection threshold setpoints. As design
and capacitor bank configuration vary based on specification, users often consult with capacitor
manufacturers for additional guidance on threshold setpoint verification methods.
6.5.2 Bank bus fault
This is typically overcurrent protection. Testing consists of testing the trip threshold level and timing to
actually trip the breaker and verify the trip circuit. This can be done every time the relays are tested.
6.5.3 Automatic bank switching
For undervoltage and overvoltage automatic bank switching, the pickup threshold of each device is
verified. The bank can be actually switched ON and then OFF using secondary injection of the voltage
signals to verify operation. If a discharge timer is used, the scheme can be verified by proving that the bank
cannot be switched back until the timer has timed out to allow for capacitor discharge. It should also be
verified that the timer does not start until the bank is switched from ON to OFF.
6.5.4 Synchronous closing tests
Synchronous closing is often associated with reducing potential for large transient voltages where lightning
arrestors or other station equipment (e.g., transformer bushings) may need to withstand such voltage
momentarily. One such example involves shunt capacitor installations when closing a switch to energize a
capacitor may generate transient overvoltages beyond rating of some of the equipment at the station if
proper measures are not accounted for and employed during engineering phases.
When preparing for shunt capacitor protection and interlocking system testing, knowledge of components,
switching sequence, functional performance desired, types of system studies conducted, and type of
switches or breakers used in advance of the tests is useful.
Shunt capacitor installations are referenced in segments, banks, or steps based on the reactive support of the
respective step once energized. Each capacitor step is controlled by a circuit switcher or circuit breaker. For
the purpose of capacitor control switch testing, both types of installations (circuit switcher or circuit
breakers) are addressed similarly. Therefore, only references are made to the circuit breaker beyond this
point.
Some of the methods for capacitor reinsertion are as follows:
Preinsertion resistors
Synchronously controlled breaker
To minimize the transients associated with the energization of the capacitor steps, breakers having the
ability to close synchronously at zero voltage are used. Because the energization sequence of different steps
may produce different percentages of overvoltage, transient studies are performed in advance to determine
whether additional measures need to be taken. For example, preinsertion resistors may be needed in
addition to the synchronous closing.
In the case of circuit breaker installations where preinsertion resistors are not utilized, the transients
associated with the energizing capacitors synchronously controlled breakers may be used to assist in
closing the breaker at or near zero voltage. Energizing the first capacitor segment may produce higher
transients in the substation than when switching remaining segments. Because the sequence for closing of
57
IEEE Std C37.233-2009

capacitor segments may vary, all switches are usually rated and designed to withstand the worst transient
voltages.
When inherently restrike-free circuit breakers are used, to minimize potential for a restrike, tests should
show that it will not cause the operation of the existing arresters at the station.
There are some contingency conditions that could result in the operation of an arrester in a distribution
substation because of a restrike.
When a capacitor control breaker is used, the breaker may have additional preinsertion resistors beyond the
ability to close synchronously at zero voltage.
The switches (or breakers) that are used for shunt capacitor insertion are designed to withstand transient
recovery voltages at the substation and are designed based on transient study results. When breakers are
used for each segment, the breaker can function as a means of the capacitor protection as well as of the
capacitor insertion.
Therefore, system testing involving synchronous closing may include measurements of transient voltages at
the station as well as one station away with the capacitor switches opened and closed several times. In
stations with multiple capacitor steps, variations of switching step sequence of different steps should also
be considered.
Other factors related to capacitor breaker applications include studies of transient recovery voltage (TRV)
rate and the rate of rise of recovery voltage. The TRV for the capacitor breakers for faults between the
series reactors and capacitors is dependent on the various stray capacitances in the vicinity, such as the
capacitance in the breaker bushings and the capacitance to ground of the high-voltage bus between the
breaker and the reactor.
Maintenance tests for shunt capacitor protection involve testing of the shunt capacitor protection described
above. Depending on the complexity and levels of protection applied, some tests may be conducted with
the shunt capacitor banks energized. Some tests such as unbalance protection may require the capacitor
bank to be removed from service. The tests may not be as comprehensive as the commissioning test;
however, it covers checking out all critical functions of the protection system. Output contacts are also
verified for proper functioning. Refer to IEEE Std C37.99TM for shunt capacitor protection applications and
additional information regarding maintenance testing.
6.6 Bus protection

By virtue of the application, bus differential protection can be tested at a single location. A bus differential
protection scheme can be represented as summation differential using simple nondirectional
electromechanical induction disk-phase time overcurrent relays (instantaneous elements are generally not
used). Another scheme includes the solid-state high-impedance differential. The most recent practice has
been to use microprocessor-based multifunction relays, enabling the phase time overcurrent (TOC)
elements emulating an electromechanical induction disk relay.
The tests performed on the phase TOC installations are as follows:
Physical examination of each individual relays components (control spring, contact condition).
Calibration tests including minimum pickup and timing tests.
Functional tests, manually initiating trip contacts to operate the auxiliary lockout relay.
Phasing tests to verify the current transformer connections, including a check to make sure the
current in each phase is zero with all feeder contributions from the bus included; then checking
58
IEEE Std C37.233-2009

each feeders contribution by removing its contribution, one at a time, and verifying that its
contribution shows up in each phase.
For the high-impedance bus differential, the tests are as follows:
Physical examination.
Voltage pickup, taking care to avoid leaving voltage applied to the relay for longer than
10 s.
High-set overcurrent unit, when applicable.
Functional tests by manually firing the internal SCR to operate the auxiliary lockout relay.
Shorted bus differential CTs circuits. The bus differential scheme design may have provisions to
disable the bus differential protection on short-circuit detection.
The following tests may also be necessary:
Accuracy pick-up current (certification test, acceptance test, and commissioning test).
Accuracy operating characteristic (certification test and acceptance test).
Influence frequency and harmonics on accuracy pickup current and operating characteristic
(certification test).
Operating times (certification test, acceptance test, commissioning test, and application tests).
Stability for load current and through current faults (certification test, acceptance test,
commissioning test, and application test).
Influence CT saturation with and without remanence on operating time, including different
types of transformers in the bays (certification tests and application tests).
Influence CT saturation with and without remanence on stability for through current faults,
including different types of transformers in the bays (certification tests and application tests).
Influence evolving faults and evolving external to internal faults on stability and operating times
(certification test and acceptance test).
Verifying correct operation of breaker failure protection (certification test, acceptance test, and
commissioning test).
Selectivity bus section operation (certification test, acceptance test, and commissioning test).
Other types of bus differential protection schemes, such as those that use paralleled CT connections as
input to the bus differential, and most low impedance schemes that use individual restraint inputs, can also
be verified for open and shorted CT connections.
Additional commissioning and maintenance testing considerations are included in IEEE Std C37.103TM2004 [B22].
6.7 Breaker failure protection and control

Circuit breakers can fail to trip for various reasons. When this happens, breaker failure protection detects
the continued presence of the fault and trips adjacent breakers to isolate the fault after a predetermined
length of time. Breaker failure protection is used in transmission and distribution systems where delayed
backup clearing can threaten system stability or cause outage of too many circuits because of remote
backup. Fast fault clearance and minimization of outages also improves power quality.
59
IEEE Std C37.233-2009

Breaker failure protection, when properly designed, applied, tested, commissioned, and maintained,
enhances power system reliability and stability. However, when it misoperates, it can easily have disastrous
consequences; hence, the security of the breaker failure protection system is of paramount importance, and
comprehensive testing is required for any breaker failure protection system. Refer to IEEE Std C37.119TM.
The testing of any protection function should be performed in a way that matches as closely as possible
real-life power system conditions. The sequence of steps in a test is a function of the requirements for the
specific scheme and system condition. This is especially important in the case of breaker failure protection
because of the importance of this function as well as because it can be implemented in many different
ways.
Breaker failure protection testing requires a good understanding of the operating principles that are used in
developing the function implemented in the protection under test. Before going into the testing
requirements, the next section provides a brief description of the basic breaker failure principles and more
common breaker failure protection schemes.
6.7.1 Breaker failure protection schemes
The arrangement of the station bus and circuit breakersstraight bus, ring bus, breaker-and-a-half bus, or
main-and-transfer businfluences the implementation of the breaker failure protection. Breaker failure
protection can be implemented as an individual protection scheme dedicated to a specific breaker, as a
built-in auxiliary function in a multifunction relay (such as a numerical distance relay), or as a centralized
breaker failure protection system for an entire bus. The latter could also be implemented as an integral part
of a bus-protection system. The logic used in breaker failure protection schemes ranges from simple to
complex.
The main principle employed in breaker failure protection is based on monitoring the current through the
circuit breaker. After a protective relay trips because of a fault, it initiates a timer, and, if there is still fault
current after it times out, it declares a breaker failure condition; otherwise, the scheme resets. Two common
breaker failure schemes are shown in Figure 21.
60
IEEE Std C37.233-2009

Figure 21 Common breaker failure (BF) schemes

In scheme 1, the timer is started only when both the protective relay and the fault current detector 50 BF
have operated. If the breaker successfully clears, then 50 BF resets and the timer resets as well. If the
breaker fails to interrupt the fault, the current detector remains picked up and the timer times out and issues
a breaker fail output (BF Aux) and backup tripping occurs. Depending on design philosophy, the number of
required contacts, the interrupting rating of the output contacts, or the relay targeting requirements,
auxiliary devices may be used. Often, a lockout relay (86 BF) is used as an auxiliary device to trip adjacent
breakers and to prevent closing of affected breakers.
In scheme 2, the timer is started and operated by the protective relay initiating signal. When the timer times
out, only then is the current detector enabled. If the fault was successfully cleared, the current disappears
and the current detector does not pick up; if the breaker fails, the current detector picks up and initiates
backup tripping.
A third common scheme used in applications where there is no current or the current is not sufficient to
operate the current detector, such as in transformer applications, tripping on unloaded long line on
overvoltage conditions, generator applications, and so on. A tripping or lockout relay supervised by a
breaker auxiliary contact can be used in a breaker failure scheme after a time delay. Because of uncertain
reliability of the breaker auxiliary contacts, both 52a and 52b contacts are usually used in the scheme. In
case of a discrepancy, it can be arranged to issue a time delayed alarm or indication.
It should be noted that many other variations of BF protection scheme logic do exist. Modern breaker
failure schemes include such features as a control timer, BF initiate seal-in, use of separate current
detectors, and timers for three-phase faults for ground faults, and for low-level currents with breaker
auxiliary contact supervision. Re-tripping of the circuit breaker is sometimes used; this is usually routed via
a separate circuit and dc supply to the second trip coil of the circuit breaker, either with or without
61
IEEE Std C37.233-2009

additional time delay. The use of single-pole tripping and auto-reclosing modifies the logic of the breaker
failure scheme.
Recent breaker failure relays include other functions such as pole-discordance protection and breaker
condition monitoring. Numerical relays also allow users to implement customized breaker failure
protection scheme logic within a distance relay, transformer relay, and so on. Such logic can use digital
inputs from other protective relays, breaker auxiliary contacts from one or more breakers, instrument
transformer inputs, and arrange an internal Boolean logic with internal timers to implement a breaker
failure scheme. The development of the IEC 61850 protocol with high-speed peer-to-peer communications
has made it easier to implement breaker failure schemes over substation local area networks.
This guide provides only a brief description of more common schemes and general comments on other
possible schemes that may be available. For a more complete coverage and description of breaker failure
schemes, please see IEEE Std C37.119.
6.7.2 Testing breaker failure protection
The type and coverage of testing varies significantly for functional and performance tests, commissioning
tests, and routine maintenance tests.
The following testing guidelines apply to conventional BF schemes, in which the BF relay is in a physically
separate device from the initiating protective relays. Schemes where the BF function is part of a protective
relay could also follow these guidelines as part of an overall relay calibration/functional test procedure. BF
protection implemented over a substation LAN requires additional scrutiny, and the best policy would be to
consult with the manufacturer to determine appropriate testing methods.
6.7.2.1 Functional and scheme performance tests
The goals of functional and scheme performance tests are to verify that the complete breaker failure
protection system functions correctly and performs satisfactorily even under the most unfavorable
conditions (i.e., it should trip the adjacent breakers within the required backup time when the concerned
circuit breaker fails to interrupt the fault and it should not trip when the circuit breaker operates normally).
Before doing the performance testing, the settings and functional operation of the protection scheme should
first be verified. This includes testing the current detector pickup and dropout levels, operating times of
timer relays, auxiliaries, and lockout relays. These simple tests can aide in analyzing problems later.
Performance testing should simulate prefault, fault, and postfault conditions including expected low to high
range of load current and normal voltage (where required).
Testing should be done using sinusoidal currents as well as simulation of periodic transient currents. When
a breaker interrupts the primary fault current, it is possible that a decaying dc current, called a CT
subsidence current, still flows through the CT secondary circuit including the relay. This can substantially
delay the dropout of the current detector and cause a misoperation or may need a longer reset time setting
in the coordination timing diagram. While numerical relays employ algorithms to reject this dc decaying
current or use fast dropout algorithms when dc decaying current is present, it is recommended that the relay
be tested under these conditions.
The magnitude of the fault current affects the current detector pickup and dropout times. Low-level
currents result in slower pickup, and high-level currents result in slower dropout. The level of dc auxiliary
power supply also affects the performance of the relay and should be considered in some test cases.
For the breaker failure scheme 1, where the logic relies heavily on the dropout of the current detector to
confirm that the breaker has tripped, it is important that the current detector dropout behavior and timing be
62
IEEE Std C37.233-2009

thoroughly tested using signals that simulate CT subsidence current. Figure 22 shows such type of
simplified waveform.
Figure 22 CT subsidence current

Transient files with such current waveforms can be played back using test systems that support this type of
testing. The pickup time of current detectors should be faster than the initiating protective relay.
For the breaker failure scheme 2, which relies on the pickup of the current detector and where reset time
does not influence the scheme logic, it is not required to test reset characteristics under subsidence current.
However, the current detector operating time at currents slightly above the set pickup level should be
verified as it has to be added to overall breaker failure backup time.
Because many breaker failure logic schemes exist, the actual relay logic should be well understood when
testing a particular relay scheme. Some relays even allow the user to implement custom BF scheme logic.
The overall breaker failure protection system is typically tested by starting from a prefault state and then
applying the fault to the breaker failure trip initiation of the backup breakers. This type of test verifies that
the required minimum backup timing margin and maximum tripping time are satisfied. Testing fault current
detector levels that result in maximum reset and pickup times of the current detector includes the
simulation of CT subsidence current. The maximum expected circuit breaker clearing time is used because
breakers can interrupt the current one cycle slower at currents below 25% of the maximum rating.
Furthermore, the interrupting time may be longer on close-open duty.
The contact bounce of the protective relay and BF initiate signal can make the timer reset or run slower,
further delaying backup tripping. Some relays implement input conditioning circuits to fill in the gaps.
Some relays also provide a seal-in of the breaker failure initiate signal in case a line protective relay resets
for close in faults with very low voltages. These conditions may be tested using test instruments that have
high-speed (<1 ms) digital outputs to simulate contact bounce and control the outputs with high precision
and can playback waveforms as shown in Figure 23. This type of testing will test the overall breaker failure
timing accuracy and consistency for backup tripping.
63
IEEE Std C37.233-2009

20
I (A)
10
0
-10 0
10
20
30
40
50
60
70
80
90
100
-20
-30
t (ms)
Figure 23 Current waveform and protective relay contact bounce

If the breaker failure protection is used in applications where it is supposed to operate even when current is
low or nonexistent, such as on overvoltage conditions, transformer sudden-pressure trip, or Buchholz relay
trip, it should be tested accordingly for stability when the breaker trips and for positive operation if the
breaker fails. Failure of the circuit breaker auxiliary contacts should also be tested.
Depending on the design and logic implemented in the breaker failure protection scheme being tested,
additional tests may be required. Such tests may include testing the control timer and retrips, simulating
three-phase faults that require faster tripping than single-phase faults, testing breaker failure trip on lowlevel fault currents and current redistribution in multiple-breaker arrangements, evolving faults starting
from one phase and spreading to two or three phases, use of circuit breaker auxiliary contacts instead of or
in addition to current detectors, and so on.
It will also be necessary to test for stability of the breaker failure scheme in cases when it is used in an
auto-reclosing scheme to ensure that the timing and stability are not compromised. Some of these tests may
require a prefault condition, two or more sequential fault conditions, conditions during the dead time, and a
postfault condition. When the breaker failure protection is used in single-pole tripping applications, the
testing concept is similar but the conditions are more complicated to simulate; however, testing is even
more necessary. Testing should verify that the breaker failure protection does not misoperate during the
reclosing time when one pole is open even when the load current is high.
For breaker failure schemes that are implemented as an internal function of multifunction relays, the above
tests should be done for initiation by the internal protective function, such as a distance function, and also
for external initiation by other relays if they are connected as such.
For a centralized multibreaker failure protection system implementation, especially where switching of the
current circuits and trip circuits are invoved, the complete system logic must be verified by comprehensive
testing at the factory, as field changes during commissioning can cause delays and can be very costly. If a
utility implements a nonstandard special breaker failure scheme logic, it should first be tested thoroughly in
a laboratory environment before being deployed out in the field.
If the test equipment does not meet the requirements for automatic analysis of the operation of the tested
breaker failure protection system for the more complex tests, a fault recorder, if one is available, may be
required to monitor all the voltages, currents, relay contacts, and simulated contacts (from the test set). This
will demonstrate that the test results are properly analyzed for correct operation and are within expected
performance requirements for stability when the associated circuit breaker successfully clears the fault.
64
IEEE Std C37.233-2009

6.7.2.2 Commissioning tests

The main goal of commissioning tests is to prove that the breaker failure protection system is implemented
in accordance with the design for that specific application and to ensure that it will actually function
according to the design and settings. When commisioning BF schemes that are add-ons to an existing
station, it is imperative that drawings be thoroughly reviewed and understood because of the additional
risks of dropping of loads, interrupting mutiple transmission lines, tripping remote breakers, and causing
system instability.
Commissioning breaker failure protection systems should include thorough checking and testing the wiring
in accordance with the station drawings in addition to the relays and auxiliaries. The following should be
verified and tested:
Check that all isolating switches for initiates and trips are properly wired and functioning.
CT ratios and complete circuit from the switchyard to the BF relay.
All BF initiates from all protective relays and other control trip initiates that are connected to the
breaker failure protection.
All BF trips and retrips to all breakers involved as well as transfer trips.
All BF auxiliary and lockout functions that prevent closing of affected breakers.
Actual tripping of circuit breakers involved, including remote breakers, whenever possible.
Physical inspection of individual relays (for electromechanical relays, additional mechanical

inspection).
Breaker 52a and 52b auxiliary signals, if used, by operating the circuit breaker and verifying
connections at the BF relay.
SF6 gas pressure indication if used.
BF initiate auxiliary relay, if used, and BF initiate seal-in. Verify that the BF initiate auxiliary
relay will properly reset after the main breaker trips with the trip circuit supervision relays and
that other parallel trip initiates and other monitoring equipment are connected.
All other breaker failure protection circuits for related features that are used such as selective
initiation for three-phase faults and single-phase faults and per-phase initiation for single-pole
reclosing applications.
Verify connections to and the operation of all annunciation and monitoring equipment.
Apply all BF relay settings specified by the protection engineer.
Current detector pickup and dropout levels.
Current detector pickup and dropout times.
Timer values.
Overall BF timing starting from BF initiation until:

1) Relay resets, in case of breaker successful interruption
2) BF auxiliary trip and transfer trip in case of breaker failure to trip
65
IEEE Std C37.233-2009

When commissioning breaker failure schemes, perform tests with fault conditions that test the entire BF
system. Commissioning tests should include the following:
Inject voltages and currents into the main protective relays and the BF relays to simulate internal
as well as external fault conditions. The simulation should include prefault, fault, and postfault
conditions. In some situations, the main relays and BF relays may use different current circuits
and may even be located far from each other. This will require modern test systems to allow the
overall system testing to be performed. Such requirements may include six or more current
sources with high burden capability and/or three-phase test sets that are capable of being
synchronized to provide simultaneous injection of test currents.
Simulate an internal fault and failure of the breaker to trip and perform the following:
1) Allow tripping through the retrip circuit, if used; measure the retrip delay and verify that
the BF system is stable with this additional delay.
2) If there is no retrip feature, allow breaker failure to trip the BF auxiliary relay and measure
the overall fault interruption time as well as the BF time to trip the adjacent breakers.
Simulate low load current and BF initiation that fails to reset after the control timer delay
expires and then increase the current above the current detector setting; verify that the control
timer prevents the BF scheme from operating incorrectly.
Other more complex features such as selective initiation for three-phase fault and single-phase
faults, per-phase initiation for single-pole tripping and reclosing applications, pole discordance
logic, and so on, should be simulated and tested, if applicable, using appropriate fault
conditions. This should test and verify the various timing and interlocking functions.
Other circuits that cannot be directly operated for multiple times, such as circuit breakers (52a
contact effect on BF protection) and other relay BF initiates, can be simulated using the test set
digital outputs. However, these circuits should have been verified beforehand as mentioned
above.
Scheme testing with increasing circuit breaker tripping time (an extended fault current) until the
BF false trips should also be performed to measure the total time margin.
In the final testing, simulate breaker failure conditions that will allow actual tripping of the
adjacent breakers at least once. The tests may be repeated several times to trip only one adjacent
breaker at a time as allowed by system operators, including tranfer trip of remote breakers.
The operation of annunciation and monitoring equipment should be verified during these tests. All these
test cases should be monitored using DFRs and SERs to verify correct timing and operation. The test
results should be analyzed to verify that adequate margins are met. The protection engineer should be
involved in the analysis of the test results to see whether any setting adjustments are necessary.
6.7.2.3 Routine maintenance tests
After a breaker failure protection scheme is commissioned and already in operation, depending on the
scheme complexity, the number of initiating devices and adjacent breakers to be tripped, testing the entire
scheme may require a comprehensive and coordinated plan to minimize the potential impact of inadvertent
operation during the tests. Therefore, it is advisable to isolate the corresponding circuit breaker during
testing and to coordinate BF scheme routine maintenance and testing with maintenance or outages of the
circuit breaker and other main equipment and relays. Also, see the cautionary note in 6.10.1 for testing with
the entire scheme isolated.
In addition to relay settings, the commissioning test results as well as the as built scheme drawings are
needed for reference during the testing process. The portion of the protection system being tested should be
isolated completely in order to prevent initiation of other relays and possible tripping of adjacent breakers.
66
IEEE Std C37.233-2009

Breaker failure scheme tests should include the initiating protective relays up to the trip isolation points to
the concerned breaker and the backup breakers. When breaker failure re-trip is implemented, tripping the
breaker once by breaker failure protection is recommended. A selected subset of the commissioning test
routines that covers the overall protection system should be performed; it should include prefault, fault, and
postfault conditions. The test conditions should include faults that result in the breaker failure scheme to
operate as well as verify that the scheme remains stable for a fault that does not require the breaker failure
scheme to operate. Testing of pickup, dropout, and timing of individual relays is not required, except for
electromechanical relay models.
If available, a history of recent and previous trips of the main protective relays and initiation of the breaker
failure protection may be the best demonstration of its reliability and assurance of the stability of the
breaker backup scheme. This may allow delaying routine maintenance or reducing the number of tests to
avoid potential risks involved in testing.
When testing other protective relays with the breaker failure protection in service, the breaker failure
initiate signals from the protective relays should be properly isolated to prevent initiation of the breaker
failure protection in order to avoid unwanted operation. Whenever possible, it is best to test both at the
same time.
6.7.3 Test equipment requirements
Based on the tests described in 6.7.2.3, the test system should meet the following requirements:
Be able to simulate the three-phase currents and voltages with the required number of states
(prefault, fault 1, breaker opening time, dead-time condition (including any unbalances during
one pole open condition), fault 2, postfault).
Have a sufficient number of digital outputs to simulate the state of the breaker auxiliary contacts
and protection trips to intiate BF.
Have sufficient number of digital inputs to monitor the operation of all trips, retrips, reclose, and
other important parts of the breaker failure protection scheme.
Be capable of playing COMTRADE files for performance testing in order to simulate transient
voltages and currents and to simulate digital outputs (with 0.1 ms resolution and accuracy).
Be able to record and report all the test results, including the current and voltage waveforms, as
well as the input and output digital signals, to provide a better picture and analysis of the entire
test.
Have the capability of synchronizing two or more three-phase test sets when required to test a
protection system that has the main protection relays far away from the breaker fail relays.
Use DFR, if available, to record the test sequences.
6.8 Reactor protection

Reactor protection has generally consisted of one or more protection functions. The protection type chosen
is generally a selection based on the size of the reactor and importance of the reactor to the power system.
Typical protection schemes include high-impedance current differential, current differential, phase
overcurrent, negative sequence overcurrent, ground overcurrent, voltage unbalance, overvoltage,
Volts/Hertz, and distance relays. In addition to specific functions provided by the relays, some reactors
have a pole disagreement scheme to ensure all three phases are energized. Pole disagreement schemes can
be provided through a combination of overcurrent elements and breaker contact logic. Reactor protection
and control schemes may be integrated with an automated trip and insertion scheme to aid system operators
67
IEEE Std C37.233-2009

with the burden of managing system voltage. Refer to IEEE Std C37.109TM-2006 [B24] for shunt reactor
protection guide.
Testing of the reactor protection will be similar regardless whether it is a voltage control, current limiting,
or a line reactor. The most thorough testing is completed at the time of energizing new equipment. The
testing should include all the equipment that the relay is wired to or can be expected to impact. Because the
relay action is based on currents and voltages, it is imperative that the relay input sources are tested and the
performance characteristics of the sources (i.e., current transformers and potential transformers or CCVTs)
are known. A wide range of simulation tests covering common to uncommon faults as well as various
operating conditions should be performed. If the power system configuration or conditions will allow, all
breakers energizing the reactor should be tripped at least once to verify the continuity of the trip path.
6.8.1 Reactor protection testing
The basis for a complete relay system test is to verify that the relays and control schemes respond as
designed. Testing of the reactor protection system should verify relay settings and the control scheme
action of the relay outputs.
Fault simulations should be applied to test operation of the protection systems of the reactor bank. The
protection schemes employed are similar to the transformer protection and should be tested in a similar
fashion. Special protection requirements such as a reactor without a breaker requiring a direct transfer trip
to a remote breaker will require testing of the direct transfer trip systems. Other protection schemes include
a sudden pressure relay generally disconnected on important load-carrying transformers.
If voltage control is implemented, then a range of voltage simulations should verify that the desired
operating points are achieved and that hysteresis is provided to prevent cycling of the bank. For example,
verify the reactor breaker opening angle is at peak voltage.
The simulations should be designed to test the relay systems at its expected operating boundaries. The test
results should be documented and include verification of the following:
Relay algorithm operation and operate times. This includes all protection used to protect the
reactor bank.
SCADA alarms.
SER point operation.
DFR triggering.
Relay fault report triggering.
Relay fault record retrieval.
Relay targeting.
Relay communications.
Reactor breaker operation.
6.9 Generator protection

Generators are a key part of a power system. It is most critical that generator protection systems operate
properly to clear faults and trip the machine for abnormal operating conditions. Refer to
IEEE Std C37.102TM-2006 [B21] for an ac generator protection guide.
68
IEEE Std C37.233-2009

Calibration testing is generally done with the generator offline. It is generally advisable to perform
preventive maintenance of the generator protection system during scheduled unit outages. Most generators
are on a 2- or 3-year outage cycle.
Table 5 presents typical generator protection functions that can be tested statically.
Table 5 Generator protection functions
ANSI function
21
24
32
40
46
51V
50/27
50 BF
59
59 N/27 TN
60 FL
64 F
81
87
Description
Backup distance
Overexcitation (V/Hz)
Reverse power
Loss of field
Negative sequence
Voltage restrained overcurrent
Inadvertent energization
Breaker failure
Phase overvoltage
Stator ground fault protection
Fuse loss
Field ground
Abnormal frequency
Phase differential
Wide area schemes that employ generator tripping should include that function in the testing of the overall
scheme, preferably at times when the generator is offline.
The following elements will require phasing checks with the machine at some load level to allow checks of
the phase angle between voltage and current: 21 V, 32 V, 40 V, and 51 V. It should be noted that many
microprocessor-based generator protection relays will allow this check to be done using a computer
connected to the relay, with the appropriate software, to allow the user to observe what quantities the relay
is measuring. This precludes the need to use external equipment (phase angle meter, etc.) connected to test
facilities (switches, blocks, etc.) to verify phasing.
In addition to static tests (minimum pickup, slope, etc.), differential elements should be tested according to
IEEE Std C37.103-2004 [B22].
The preferred method to verify performance of the out-of-step protection function (device 78) is dynamic
testing. If studies are available, it is also preferable to test loss-of-field elements (device 40) dynamically.
Extreme caution should be used when testing generator protection on a machine that has a generator
breaker between the generator step-up transformer (GSU) and the transmission system to avoid
unnecessarily tripping the GSU by any backup elements. Considering that there are different methods of
terminating a generator to the power system, different protection and interlocking strategies are applied.
For example, if the generator is unit connected, the GSU is connected to the generator and is likely shut
down when the associated protection is being tested. When there is a generator breaker between the
generator and the GSU, different zones of protection are often applied. In any case, the test procedures
often incorporate considerations of any protection that overlaps with protection between the GSU and the
power system. Some protection schemes may include breaker failure, bus differential and generator load
reduction logic, and any trip blocking scheme that blocks generator protection from tripping switchyard
breakers when the isolation device is open.
Testing of the lockout relays (LORs) associated with generator protection is common practice. Initial tests
generally include allowing the LOR to trip all intended devices (generator breakers, field breakers, turbine
stop valves, etc.). Some generator protective functions may perform some control action other than tripping
the machine (e.g., volts/Hertz operates voltage regulator to reduce excitation) and should be allowed to
perform this action at least on initial testing.
69
IEEE Std C37.233-2009

Reverse power protection can involve interlocks with turbine stop valve limit switches. Testing this scheme
can include online testing, during which the turbine is tripped just prior to taking a machine offline, waiting
for the stop valves to close and the machine to motor briefly, and then allowing the reverse power relay to
trip the machine (of course, with an operator standing by in case the protection does not operate). This
provides a good test of the overall operation of the reverse power protection as an entire scheme.
6.10 Trip circuit logic scheme

The trip circuit logic scheme includes the logic and circuits needed to trip the required breakers in a
substation in order to clear a fault. In some cases, the reach of this scheme is not confined to the substation
but also to the remote substations.
Typically, this scheme can be found in bus and breaker failure protection. When these two protections exist
in the same substation, it is not unusual that the trip circuit logic scheme is shared.
Suppose in the breaker-and-half substation configuration of Figure 24 that a bus fault occurs on Bus I. The
local bus protection detects the fault and trips all Bus I breakers. The trip circuit logic scheme selects the
only breakers needed to clear the fault. Testing the scheme means to test the selectivity of only sending a
trip command to the Bus I breakers and not to any other substation breakers. It also means to confirm that
the trip path from the bus protection to each breaker is in good condition.
In the event that breaker A does not open because of a malfunction, the breaker failure protection will be
requested to operate by retripping all Bus I breakers plus breaker B and sending an intertrip command to
the remote Feeder 1 breaker.
The trip circuit logic scheme selects the backup breakers needed to clear the fault. Testing this scheme
means to test the selectivity of only sending a trip command to Bus I breakers, to breaker B, and to the
remote Feeder 1 breaker. It also means to test if the trip path from the breaker failure protection to each
breaker is in good condition. The communication link from this substation to the remote substation of
Feeder 1 plus the remote trip circuit also needs to be confirmed.
BP
Bus I
BF
Feeder 1
A
TCL
B
Bus II
Figure 24 Single-line breaker-and-half bus configuration with a fault on Bus I
In a different topology like the one in Figure 25, which represents a double bus bar with bus coupler
configuration, the bus protection decision of which breakers are needed to clear a bus fault depends on the
substation layout at that moment. In substation layout of this figure, a Bus I fault is cleared by tripping the
bus coupler breaker plus all feeders breakers that are connected to this bus.
70
IEEE Std C37.233-2009

At the same time, a fault in Feeder 1 that is not cleared because of the breaker malfunction requires breaker
failure action to be cleared. The breaker failure will trip the bus coupler and all the feeders breakers that
are connected to Bus II.
Bus I
Bus II
BF
Feeder 1
TCL
BP
Figure 25 Single-line example of a double bussingle breaker bus configuration

with a fault on Bus I
In both situations, the trip circuit logic contains not only the trip path from each protection, bus protection,
or breaker failure protection, but also the substation replica to trip the required breakers selectively. The
substation replica is achieved with the help of the isolators and breakers positions.
To achieve a high degree of security, for the isolators position, information is needed on the open position
and the closed position. For the open position, this information can be obtained using three normal close
(NC) contacts in series. For the close position, it uses three normal open (NO) contacts in series or in
parallel depending on the utility practice.
Figure 26 shows isolator replica status and its relation to the isolator movement.
Open
Close
High voltage contacts
NO
Close status
NO
NC
Open status
Figure 26 Isolator replica with normally closed and normally open positions
71
IEEE Std C37.233-2009

Only when the opened and closed position agree, the isolator position is considered plausible. In case both
disagree, different meanings for the isolator status can be chosen. Refer to Table 6.
Table 6 Example of open and closed position definitions
Not plausible
Status
Opened
Closed
1
1
Loss of auxiliary voltage
Meaning
Consider the isolator close. An alarm is given.
Keep the old isolator position or consider the isolator close.
In both cases an alarm is given.
Testing the trip circuit scheme

Because of the large complexity of the trip circuit scheme, its testing should be first divided into separated
parts before the overall final test. The scheme can be divided in three parts: a trip circuit, an isolator replica,
and an overall scheme.
Trip circuitIt is the physical medium used by the protection to send a trip command to all possible
breakers plus its correct operation. The physical medium typically is made of wiring but can be any other
medium such as radio frequency, optical fiber, Ethernet, and so on.
Isolator replicaIt is the correct acquisition of all isolators in the substation by the tripping logic and the
proper processing of this information. This logic consists of a substation replica with the isolators status as
the input and/or output, the trip condition used by the bus protection, or the breaker failure scheme to
activate trip command to the appropriate breakers.
Overall schemeIt is the combination of all parts working as a system.
6.10.1 Trip path test
When testing the trip circuit, the integrity of the entire circuit from the protection output trip contact to the
trip coils of all the breakers that are part of the respective scheme is verified. For bus protection, trip circuit
testing of centralized or decentralized (distributed) bus protection schemes require proper functionality.
Trip circuit in a centralized bus protection
In a centralized bus protection, a number of trip outputs exist, one for each bus protection zone or one for
each breaker. In Figure 24 and Figure 25, there are two buses; therefore, two protection zones exist, and
consequently, the bus protection has at least two trip output contacts, one for each protection zone, or six
trip output contacts equal to the number of breakers.
As part of the initial installation, trip circuit integrity verification can include operating the circuit breakers
included in the bus differential zone. Complete trip checking includes activation of bus differential relay
contacts to the corresponding breakers.
Trip circuit in a decentralized bus protection
In a decentralized bus protection, the protection consists of one central unit where most of the protection
decisions are made, linked by optical fiber to a number of bay units spread along the substation panels
where the current, isolator and breaker status are acquired. The trip outputs are also distributed along the
bay units.
From each trip output contact in each bay unit to the corresponding breakers, the circuit integrity has to be
checked, preferably by live opening of all breakers.
72
IEEE Std C37.233-2009

Trip circuit in breaker failure scheme

In the breaker failure scheme, the trip circuit can be shared with the bus protection or it can be independent.
In case it is shared, the testing is equivalent to testing the bus protection trip circuit. In case it is
independent, a proper test to this circuit has to be done.
The circuit consists in the trip path from the breaker failure trip output contact to the device that contains
the trip logic plus all trip circuits from this device to all breakers as shown in Figure 27. The integrity of
these circuits has to be checked. The circuits connected to the breakers preferably should be checked by
live opening.
Figure 27 A simplified diagram depicting breaker failure scheme independent of bus

differential trip circuitry
NOTEAt times, for maintenance or troubleshooting, the entire bus differential or the breaker failure scheme may
need to be disabled depending on the scheme design. When the breaker failure trip scheme is part of the bus differential
trip and lockout scheme, it is important to be able to isolate either the bus differential or the parts of the breaker failure
scheme without completely removing the scheme out of service, to allow partial testing of the scheme while the
remaining part of the bus differential remains functional and operational. Also, it is important that test personnel are
aware of proper test methods so that isolated trip circuits do not remain energized for extended time periods when
testing isolated circuits, as damage may occur to the part of the system under test.
6.10.2 Isolator replica test

The isolator replica test consists of verifying that the isolator opening and closing status correctly arrives to
the logic. For this purpose, a static test to verify simply that when the isolator position is open, the logic
gets the open and not closed information, and when the isolator position is closed, it gets the not open and
close information, is not enough.
The monitoring of these two statuses has to be done during the isolator closing and opening movements.
This test prevents an alarm from being sent when, during the movement, the isolator is neither open nor
closed. It also confirms that the auxiliary contact used to receive this information corresponds to the bus
protection requirements. For example, the opening contact only occurs at the end of the close to open
movement. Similarly, the close contact immediately appears in the beginning of the close to open
movement.
6.10.3 The loss of voltage and the nonplausible situation also have to be checked
That means this situation is correctly taken care of by the logic. For this purpose, the two cases need to be
forced and their behavior has to be analyzed.
6.10.4 Overall test
A final test is done to see that both trip circuits and the isolator replica are working as a system.
73
IEEE Std C37.233-2009

Ideally, this test should be performed by forcing the bus protection or the breaker protection to trip freely
all correct breakers. When it is not possible to schedule an outage of the entire substation, it is common
practice to isolate all the trip circuits at the last point that can be verified before the breaker coils.
For this, several substation configurations are simulated and for each of them the trip circuit logic is used
by the bus protection or the breaker failure. All circuit breakers that were supposed to trip would receive a
trip command from the logic, and at the same time, circuit breakers that were not supposed to trip would
not receive a trip command. This last concern is important because it proves that the system has the desired
selectivity.
7. Protection system communication testing
7.1 Power-line carrier testing

Power-line carrier equipment is used in many protection and control applications; refer to IEEE Std 643TM.
The most common applications include pilot transmission-line protection, such as blocking or unblocking
schemes, direct transfer tripping, and phase comparison. Other less common applications include voice and
data traffic in addition to protection, based on the bandwidth a trap is designed for, or the type of coupling
(single phase or multiple phase) to the transmission line. For the purpose of system testing, the following
discussion covers single-phase coupling. The same techniques are used in phase-to-phase and three-phase
coupling.
The types of tests covered in this clause include the following:
Line trap
Carrier transmit measurement terminated and bridged
Carrier receive measurement terminated and bridged
Measurement specification
Amplifier impact of power-line carrier testing
7.1.1 Line trap

This test requires the transmission or distribution line to be deenergized. Figure 28 shows a typical test
setup. The trap tuning (resonant frequency set point) is verified by checking impedance versus frequency.
In Figure 28, the center frequency is tuned to the maximum impedance, which is measured using the
impedance meter and signal generator. When verifying the trap frequency set point or points, it is best to
use the highest impedance possible for the used spectrum. The typical minimum impedance value for wide
band traps is 600 . For single-frequency traps, the acceptable minimum impedance value may be 1000 .
These ohmic values are examples. The manufacturers instruction manuals provide the minimum
acceptable impedances.
74
IEEE Std C37.233-2009

OHMS
1000 OHMS
Minimum
Frequency (kHz)
CF
WAVE TRAP
Signal Generator
Impedance Meter
Figure 28 Power-line carrier wave trap frequency set point verification

Table 7 describes the general connection terminals between test and measurement equipment.
Table 7 Typical connection terminals between test and measurement equipment
for wave trap frequency set point verification
Wave trap frequency set point verification connections
Signal generator output
(high-level very low frequency (VLF)
signal source]
Reflected frequency (RF) out
Impedance magnitude (level) meter

Signal input from the RF generator
High-impedance inputs
(Hi Z and Gnd)
Connected to wave trap
7.1.2 Carrier transmit and receive measurement terminated and bridged

This test verifies that the transmitted power from the power-line carrier equipment is efficiently coupled to
the line. The test measures the standing wave ratio (SWR) and/or the reflected power. Note that the ratio
mismatch would be excessively high and recognizable for defective or poorly adjusted equipment. It is
possible not to achieve a precise 1:1 ratio match, for example, for multitap transmission lines. Also, care
should be exercised for multitap transmission lines at the tap points to allow signals not to be attenuated
excessively at the tap point and for the signals to get through to all the remote station terminals of the line.
In the transmit mode, the test equipment is connected to the carrier transmitter, as shown in Figure 29. In
the bridge test, the impedance matching transformer of the line tuner is used to match the impedance of the
carrier equipment to the impedance of the line. These measurements generally identify the types of
problems that can produce improper readings, such as failed coax cable, misadjusted line tuner, or failed
component. Also, it is important to verify on either side of the frequency spectrum in the case of hybrid
arrangement.
With the carrier receive test, the signal level received from the remote terminal is verified. In the receive
mode, the test equipment is connected to the line tuner.
75
IEEE Std C37.233-2009

Figure 29 Setup for power-line carrier testingequipment setup for

transmit test (bridged) reflected power and SWR
Table 8 describes the general connection for measuring the power-line carrier transmit signal.
Table 8 Typical connection for measuring and testing transmit frequency for Figure 29
Set-up transmit measurement using automatic VLF power standing wave ratio (SWR) test set
SWR meter
Frequency selectable voltmeter
Voltage sampling coaxial
Internal attenuator
terminal (e.g., 20 db signal)
RF in
PLC output
RF out (transmitter)
Line tuner input
The proper connections

As is the case for any type of test, proper connections and verification prior to turning on any test
equipment are critical. In the case of power-line carrier measurement test equipment, it is also important to
realize that at times power amplifiers may be used or to be aware of equipment limitations to minimize
potential damage to equipment or the calibration of the test sets. For example, the user should be careful to
connect the PLC transmitter output to the SAMPLE 20 dB connector in the case of the SWR meter. In
most cases, this output port can only tolerate a small power (in the range of 100 mW) before blowing a
protective fuse. Once the fuse is blown, the sample port becomes inoperative and the voltage sample
feature is lost until the fuse is replaced. Damage to the instrument may be limited to the blown fuse if a
protective fuse is provided.
7.1.3 Example for typical measurement specification for protection communication using
power-line carrier
The following values illustrate the types of frequency ranges for different power-line carrier applications:
a)
Permissive carrier output = 10 W or +40 dbm
b)
Blocking carrier output = 100 W or +50 dbm
76
IEEE Std C37.233-2009

c)
Carrier receive level = 1 W or +30 dbm
d)
Percentage of reflected power = 5% (or SWR of 1.6:1)
e)
Wavetrap impedance 1000 at carrier frequency.
These numbers are examples only. The maximum permissible PLC can be 100 W, the minimum line trap
impedance can be less than 1000 , and the maximum reflected power of 5% may be difficult to obtain on
short lines, maybe closer to 20%.
For multiple signals coupled to the same line or to different phases (multiphase coupling), additional tests
may be needed to determine that a given receiver is not subject to interference from other signals and to
validate proper frequency selection. Additional interference may be caused by other carrier transmitters
connected to adjacent lines connected to the bus or on the same right of way. Interference from a parallel
circuit on the same tower is a notable example. Misadjusted or failed traps can cause elevated levels of
interference to other carrier channels, as well as the reduction of the signal strength at the intended receiver.
7.2 Functional testing of IEC 61850-based substation automation systems

Distributed protection applications are being implemented based on high-speed peer-to-peer
communications defined initially in UCA2 and now part of the international standard IEC 61850. Testing
of distributed protection applications and protection functions that participate as publishers or
subscribers are quite different from what was traditionally used in the conventional world of testing.
The testing issues are further complicated by the fact that there are different types of data being
communicated that need to be considered, simulated, and monitored:
Client/server communication (IP traffic/multimedia messages)
Real-time communication, event-driven [GOOSE, (GSSE)], also referred to as substation bus

(IEC 61850-8-1 [B12])
Real-time communication, periodic (sampled values), also referred to as process bus

(IEC 61850-9-2 [B15])
The test procedures for IEC 61850 protection applications will assume that the tested devices conform to
the standard and should concentrate on the functional testing, including the following:
Functional testing of IEC 61850-compliant protection microprocessor-based devices
Functional testing of bay-level distributed protection applications
Functional testing of substation-level distributed protection applications
Functional testing of protections requiring remote terminal information (two-ended)
One of the key advantages of IEC 61850 is that it delivers not only a set of data models with predefined
semantics and a number of application specific protocols, but also it is a new approach to engineering,
which (if fully implemented) allows automatic configuration of test plans for local and distributed
functions. This will be based on the availability of the various files defined in the substation configuration
language (SCL).
7.2.1 IEC 61850 system testing
In the course of linking IEC 61850 object models together through logic and GOOSE communications,
there is a need to be able to test the functionality of the resultant system. IEC 61850 defines several test
modes; however, the interaction between the test modes and GOOSE communications is not defined. This
subclause proposes a test and response methodology when using the test modes defined in IEC 61850.
77
IEEE Std C37.233-2009

7.2.2 IEC 61850 data organization and test modes

IEC 61850 organizes information in a device through the concept of logical nodes (LNs) and logical
devices (LDs). An LN is the smallest entity in which data is organized and is typically designed around a
specific function such as an overcurrent element (PIOC, PTOC) or a distance element (PDIS). As a number
of LNs are required to perform a specific protection or control function, LNs performing an ensemble of
functions can be grouped into an LD.
Each LD and LN has a data item called behavior. This data item describes the operating mode of the
respective LD or LN. There are five states of behavior that can describe a device, as follows:
OFFthe LD or LN is out of service.
ONThe LD or LN is in service.
Blockedthe LD or LN is in service but blocked from issuing an output.
Testthe LD or LN is under test.
Test and blockedthe LD or LN is in test mode and all outputs are blocked.
Note that when the behavior of an LD is changed, all LNs that are part of that LD inherit the changed
behavior of the LD. When an LD is placed in test mode, the test bit in the quality flags of all data attributes
are to be set to test. Likewise, if the LD is placed in Test and Block mode, both the test and the block
quality flags for all data attributes are to be set in all LNs contained in the respective LD.
Each LN can individually be placed in test or test and blocked mode. As such, the quality flags of all
attributes in that LN should have their test and/or blocked quality flags set.
7.2.3 Mapping of test status into GOOSE
If a data attribute that is in test or test/blocked mode is mapped into a GOOSE message, then the test bit in
the transmitted (published) GOOSE message is to be set. A device receiving (subscribing) a GOOSE
message with the test bit set is to respond in one of two ways, as follows:
When the receiving device is not in a test or test/blocked state and a test mode is initiated, all
LDs in the device can be configured to transition automatically to the test/blocked mode of
operation. In this mode, no outputs are issued and the test and blocked bits in any quality flag
are to be set.
When the receiving device is in either test or test/blocked mode, the receiving device is to
respond as per its setting. For example, when the receiving device is in test mode, any outputs
resulting from the received GOOSE message are to be issuedwith the corresponding test bit
set in the respective quality flags. Similarly, if the receiving device is in the test/blocked mode
of operation, the receiving device shall execute any logic. However, any outputs resulting from
the execution of the logic are to be blocked from issuing an output. Additionally, the respective
test and blocked bits in any data quality flags are to be set.
7.2.4 GOOSE performance testing

IEC 61850 defines GOOSE performance based on internal timings of a device. However, IEC 61850 does
not define methods for performance testing. In order to make the performance measurable, a back-to-back
GOOSE Echo test is proposed. In this test mode of operation, relays of the same manufacturer and relay
type are to be connected back-to-back through an Ethernet switch (see Figure 30). Relay 1 is to send a
GOOSE message to relay 2. Relay 2 is to receive the message and immediately echo the message back to
relay 1. Another alternative is to use a test set capable of publishing and subscribing to GOOSE messages,
for performance testing of a relay. GOOSE performance time is defined as follows:
Performance = (t GOOSE_In t GOOSE_Out ) / 2
78
IEEE Std C37.233-2009

GOOSE has been designed with explicit sets of timing requirements as a benchmark for performance.
Delays can be caused by improper switch configuration that does not include prioritization of GOOSE
message. Excessive network traffic is often monitored in order to determine the adverse impact on the
application of the GOOSE messages.
Figure 30 GOOSE performance test

7.2.5 Configuration requirements for testing of distributed protection applications
One of the key requirements for testing of IEC 61850-based protection devices and distributed applications
is verification of interoperability. Interoperability is defined as the ability of two or more microprocessorbased devices from the same or different vendors to exchange information and use that information for
correct internal/external operation. For a device to be acceptable for integration in an IEC 61850 system, it
first has to be properly type tested. This will verify that it is compliant with the definitions of the standard
and will likely interoperate with other certified microprocessor-based devices in the system.
Before the functional testing of a device or distributed function is started, they need to pass the
conformance tests defined in the standard (Part 10 of IEC 61850 defines these requirements). Part 6 of the
standard defines the SCL and provides some tools that can be very helpful in performing automatic
functional testing. One difficulty is to determine the functionality of the tested device and its configuration
(which functional elements are enabled and what are their settings). Help in automating this process will
result in significant time savings.
The SCL is basically a system specification of the substation equipment connections in a single line
diagram. It also documents the allocation of logical nodes (functional elements such as overcurrent and
distance) to devices and equipment of the single line to define functionality, access point connections, and
subnetwork access paths for all possible clients.
What is of specific interest for the automatic test configuration is the data exchange among the system
configuration tool, the tested microprocessor-based device configuration tools, and the test system
configuration tool shown in Figure 31.
The overall functionality of any IEC 61850-compliant device is available in a file that describes its
capabilities. This file has the extension ICD, meaning intelligent electronic device (IED) capability
description. The system specification tool supplies to the system configuration tool information such as the
single-line diagram of the substation and the required logical nodes. The file extension for this file is SSD,
meaning system specification description.
The system configuration tool then provides information to the microprocessor-based device configuration
tools regarding all microprocessor-based devices, communication configuration, and substation description
sections. This information is in a file with the SCD extension, meaning substation configuration
description. This information also needs to be provided to the functional testing tools in order to allow it to
configure the set of tests to be performed.
79
IEEE Std C37.233-2009

IE D
DB
IE C 61850
S tandard S ystem
C onfiguration T ool
IE C 61850
S tandard IE D
C onfiguration T ool
IE C 61850
F unctional
T esting
T ool
T est D evice
IE C 61850
B ased
IE D
Figure 31 Functional testing configuration process

The IEC 61850 configuration tool sends information to the microprocessor-based device upon its
instantiation within a substation automation system (SAS) project. The communication section of the file
contains the current address of the microprocessor-based device. The substation section related to this
microprocessor-based device may be present and shall have name values assigned according to the projectspecific names. This file has an extension of CID, meaning configured IED description. Additional
standards are needed in order to expand the content of this file to include all settings, thus providing the
required configuration data for the microprocessor-based device itself and for the functional testing tool.
All the information on the substation, SAS, and microprocessor-based device configuration are required to
configure the test procedures properly for the functional elements and local/distributed protection functions.
However, even this is not sufficient for automating the process. Another important requirement is to
provide test cases on how each of the functional elements or local/distributed functions should be tested
and what is the expected behavior of the test object under defined test conditions.
Based on this information and the system/microprocessor-based device configuration data, a functional
testing tool can generate and execute the necessary test sequences. Such a formal definition of the test cases
for the functional elements and other complex functions is not part of the standard today. Making
functional test case definitions part of the standard will require a significant effort, but it will allow the
development of new tools for automatic functional testing of IEC 61850-based microprocessor-based
devices and SASs.
7.2.6 Functional testing of IEC 61850-based applications
The testing of conventional functions in substation protection and control systems has some similarities and
some differences with the IEC 61850 communications-based solutions. In the case of the conventional
testing, the test device has to simulate the substation process using a hard-wired interface between the
analog and binary outputs of the test device and the analog and binary inputs of the test object. A typical
test process requires the test device to output a simulation or event that will trigger a measurable response
from the test object. The timing of the test objects input/output change-of-state events for defined test
cases determines proper operation.
By comparison, communications-based distributed functions utilize the IEC 61850 GSSE or GOOSE
messages replacing the hard-wired connections. In the case of Figure 32, all devices with communications
interface have to be connected to the substation network switch to exchange data.
80
IEEE Std C37.233-2009

The expected communications-based performance should be similar to the conventional hard-wired

interface; it is a good idea to include a test case that compares the operation of a wired relay output and a
GOOSE message driven by the same functional element in the microprocessor-based device logic.
Ethernet
Switch
Laptop
Computer
Ethernet
GOOSE
or GSSE
IEC 61850
Based IED
GOOSE
or GSSE
Trip
IEC 61850
Based Test
Device
Ethernet
Figure 32 IEC 61850 GSSE- or GOOSE-based microprocessor-based device (IED)

functional testing
Another difference between the conventional testing and the IEC 61850 GOOSE-based functional testing is
the requirement for the change-of-state process simulation using GOOSE messages from the test device to
the test object. An example is to indicate the opening of the auxiliary contact 52a of the circuit breaker
monitored by the microprocessor-based device under test.
Distributed protection applications based on IEC 61850 merging units (MUs) that send sampled values
over the substation LAN will need a test setup similar to the configuration shown in Figure 33.
In this case, the analog signals from the test device will be wired to the MU. The distributed function will
be performed by the IEC 61850-based microprocessor-based device that will send a GOOSE message to an
IEC 61850 input/output unit (IOU) that will operate a physical relay output to trip the circuit breaker. The
test device will subscribe and capture this message and also detect the operation of the binary output of the
IOU. It monitors different elements of the distributed function and can analyze their performance, as well
as the systems overall operating time.
Laptop
Computer
Ethernet
Switch
GO O SE
or GSSE
GO OSE
or GSSE
IEC
61850
Based
MU
V
Ethernet
IEC
61850
Based
IOU
I
IEC
61850
Based
IED
Trip
IEC 61850 Based

Test Device
Figure 33 IEC 61850-based microprocessor-based device functional testing results

If the tested IEC 61850-based microprocessor-based device also has a binary output, the test device can
monitor it as well. This can provide valuable information in the overall evaluation of process performance.
81
IEEE Std C37.233-2009

The binary output of the IOU interface unit will give the total distributed protection function operating time
for the case of a complete IEC 61850 communications-based solution.
7.3 Wireless communication

7.3.1 Wireless data link testing
The increase in the growth of information and communication technology (ICT) is raising the penetration
of wireless communications units based on global system for mobile, general packet radio service, and low
earth satellites-based technologies in power systems.
These communication units provide real-time, low-cost, bidirectional data-exchange solutions for power
system communication. In particular, they could support several tasks of SCADA applications for electric
utility industry use, such as the following:
Capture polled, scheduled, and event-driven data
Report on power outages
Monitor or remotely control the following:

1) Capacitor bank monitors
2) Voltage regulators
3) Power components
4) Load management
Communications services employed to support these tasks handle, typically, the following two kinds of
data connections:
Packet: over the Internet or other TCP/IP packet-switched networks
Asynchronous: routed through the public switched telephone network (PSTN) to a modem
destination
In packet data mode, the communication unit lets the application device (i.e., the protective system or the
microprocessor-based device) originate or receive a packet data call via standard AT commands. It
establishes a peer-to-peer protocol session, connects to the Internet, and then establishes a session with a
host server.
In asynchronous data mode, the communication unit lets the application device originate or receive an
asynchronous data call. It can dial or be dialed to a modem at the host server, connecting through the
wireless communications system and the PSTN.
7.3.2 Testing procedure
To evaluate the suitability of a wireless communication unit to support the designed protective and
monitoring functions set, it is necessary to evaluate the main figures of merit characterizing the
communication data link performance.
They comprise, in particular, the connection times, the degradation of services, and the data latency. To
evaluate experimentally these parameters, it is necessary to do the following:
a)
Install the device under test in the substation
82
IEEE Std C37.233-2009

b)
Submit multiple queries to the remote device by a host server
c)
Measure the characteristic parameters
7.3.2.1 Connection times evaluation

Regarding the connection times, the communication protocol involves several activities once a module
originated packet data call is set up. They comprise, typically, the system setup, the physical layer setup,
the encryption, and the service option negotiation. Several field trials should be necessary to assess this
parameter.
7.3.2.2 Degradation of service
As far as the degradation of the service, the frame error rate (a measure of the radio link quality) should be
evaluated.
7.3.2.3 Data latency
The data latency is the time delay caused by getting a network message from the host server to the remote
DUT and getting a response back again. This time delay can be made larger by the following processes:
Propagation delay
Transmission delay
Router delays
Packet loss, recovery, and retransmission
The data latency of the data link could be estimated measuring, for a fixed time period, the packet roundtrip times at the transport level of the ISO/OSI stack. In this connection, it is important to underline that this
value is expected to be highly random because it is influenced by several drive factors, such as
communication links congestion, communication protocols, and data link quality. To deal with these
phenomena, the worst-case scenario, characterized by higher expected levels of data link congestion,
should be considered for the measurements.
8. SIPS test requirements

System integrity protection schemes (SIPS), which are also called RASs or SPSs, serve to ensure security
and prevent propagation of disturbances for severe system emergencies caused by unplanned operating
conditions. They stabilize power systems for equipment outages related to N-2 criteria or beyond by
preventing overloading of the lines, arresting voltage decline, initiating preplanned separation of the power
system, and so on. System integrity protection schemes, armed for predefined outages, initiate preplanned,
automatic, and corrective actions. Their design is based on studies of predefined outages for a variety of
conditions.
Figure 34 shows the overall structure of a scheme, comprising input facilities, electric, and status variables;
a decision process; and output action orders.
83
IEEE Std C37.233-2009

Disturbance
Electric Variables
Power system
Direct Detection
System Integrity Protection Scheme

Action
Decision
Process
Input
Figure 34 Simplified overview of SIPS structure
Figure 35 shows a typical architecture for a wide area scheme. Depending on the intent of the scheme,
several control areas or systems may be interconnected.
Figure 35 Physical architecture of a redundant SIPS

Such schemes are complex due to the following reasons:
Selection of various equipment
Identification of monitoring points
Types of alarms and priority classification
Various contingencies associated with equipment abnormal conditions
Types and availability of real-time data
Considerations for various categories of inputs and output tests
Development of the test scenarios, coupled by provisions for automated testing
84
IEEE Std C37.233-2009

Furthermore, wide area protection schemes may involve many different entities with different backgrounds
and practices.
This complexity requires very stringent and detailed test procedures to confirm both security and
dependability of those schemes.
System variables
Depending on the purpose of the SIPS, different quantities have to be derived at different speed and
accuracy levels. On the one hand, to counteract certain disturbances (e.g., to prevent loss of synchronism),
remedial actions have to be effective within fractions of a second. On the other hand, actions against
thermal limitations or long-term voltage instability can be allowed to take more time, seconds to tens of
seconds.
In preparing for test setups, the test coordinator and the test program need to consider the various elements
of the SIPS design, including utilized variables. The variables can be either directly measured (such as
voltage level, frequency, power flow, and current) or derived from the measurements using more or less
complex algorithms.
A more general variable set is achieved from a power system state calculation, based on complete
observability by PMUs, from which any type of index can be derived. Also, faster than real-time
simulations, based on the state calculation, may be possible.
Below are some examples of input variables for various applications.
Measurement inputs
Power system voltages

1) Voltagesynchronized to local measurements in the same substation
2) Voltagewide area synchronized
3) Voltage phasors (i.e., magnitude and phase angle)
Power system currents

1) Currentsynchronized to local measurements in the same substation
2) Currentwide area synchronized
3) Current phasors (i.e., magnitude and phase angle)
Control signals
1) Continuous
i)
Generator/synchronous condenser AVR
ii)
Generator PSS (power system stabilizer)
iii)
Generator governor
iv)
HVDC converters, SVC, FACTS, TCSC, D-VAR, etc., controllers
2) Binary
i)
Increase/decrease, according to the following predecided steps:

A)
Transformer tap changer
B)
Tie-line transfer
C)
Reactive power compensation

85
IEEE Std C37.233-2009

ii)
Trip/close: circuit breaker (line disconnect, generator rejection, load shedding, etc.)
iii)
Relay protection trip order
Status
1) Circuit-breaker position
2) Tap-changer position
3) Generator field current limiter activated
4) Generator armature current limiter activated
5) Predefined thresholds reached
6) Various alarm signals
7) Relay protection start signals
8) Disturbance recorder start signals
Types of tests when implementing SIPS

The ultimate success of the implementation solution depends on a proper testing plan. Each application
would need to be evaluated on a case-by-case basis. It is advisable to create a detailed test plan as part of
the overall implementation. A combination of the logical architecture, logic design, and the physical
architecture could be used in preparation of the test plan.
The complexity of the scheme, its purpose, space availability, and other factors may drive some of the
decisions associated with the scheme applied and the levels of tests to be performed. A proper test plan
should include the following components:
Proof-of-concept/laboratory testing
Field commissioning testing
Detailed system-wide performance testing
Validation through state estimation
Automatic and manual periodic testing of the entire scheme
8.1 Proof-of-concept testing

Prior to the implementation of the design, proof-of-concept (laboratory) testing is practiced to evaluate the
performance and functionality of the scheme and to determine whether additional developments are needed
to meet the desired specifications. Laboratory testing is designed to validate the overall scheme in a
controlled environment. Laboratory tests permit controlled inputs from numerous sources with frequent
checks of the output at every stage of the testing process. The laboratory tests ensure that the desired results
are accomplished in the laboratory environment in contrast to costly and time-consuming field debugging.
For example, in a group of three devices, a laboratory test could be simulated to check wide area
communications (fiber, copper, and Ethernet), average message delivery and return time, unreturned
messages count and CRC failure count (under simulated noise conditions), and back-up communication
switching timings.
86
IEEE Std C37.233-2009

8.2 Field commissioning tests

Field commissioning tests should be carried out to check the performance of the SIPS against the realistic
abnormal system conditions. The telemetry data and the dynamics of various power system configurations
need to be tested. Examples are as follows:
Breaker close and bypass contacts
Changing the selectivity of the current transformer inputs
Total trip timing over the implemented communications between devices and the central control
station
Possible scenarios of unavailability of devices at the time of execution of a command signal in a

given station
In general, every input point and every logic condition needs to be validated against expected results.
Additionally, the effect of dc transients on line outage needs to be tested thoroughly in the field before
putting the scheme into service.
8.3 System-wide performance testing during maintenance intervals

Proper implementation requires a well-defined and coordinated test plan for performance evaluation of the
overall system during agreed maintenance intervals. The maintenance test plan, also referred to as
functional system testing, should include inputs, outputs, communication, logic, and throughput timing
tests. The functional tests are generally not component-level testing, rather overall system testing. Some of
the input tests may need to be done ahead of overall system testing to the extent that the tests affect the
overall performance. The test coordinator or coordinators need to have full knowledge of the intent of the
scheme, isolation points, simulation scenarios, and restoration to normal procedures.
The concept is to validate the overall performance of the scheme, including the logic where applicable, to
validate the overall throughput times against system modeling for different types of contingencies, and to
verify scheme performance as well as the inputs and outputs.
The overall system testing may include electrical supervisory provisions from a central dispatch for added
security. Some key elements of test setup are as follows:
Test units connectivity to the devices with communication interface for communicating with
the field devices
Supervisory process (dispatch permission)
Test signal (test person)
Frequency, voltage, and other power system conditions that need to be simulated
Outages (input test)
Trips (output tests)
Enable/disable functions of the field devices
Automatic restoration enable/disable
Functional tests
Overall timing results
87
IEEE Std C37.233-2009

Figure 36 shows an example of a simulator system setup for testing redundant controllers A and B. Once
overall performance tests for various scenarios are completed on one system, the simulator can be utilized
for the redundant system (B) performance testing. Other test methods are possible; for example, once a
particular scenario is completed on system A, the test coordinators repeat the test on system B to compare
performance between the two systems and administer any corrective actions.
Figure 36 Simulator setup for testing a redundant SIPS

The overall functionality of the SIPSs is validated against the system studies. The total throughput of the
system during commissioning and scenario testing stages should measure significantly less than the
throughput time identified in systems studies to allow for system changes and in case other stringent
contingencies are identified in the future.
8.4 Validation through state estimation

For schemes that involve transmission constraints and stability limits, data from the state estimator can be
used to determine different preoutage flows within the power grid. The preoutage flows are loaded into the
controller as precontingency conditions. The controller, or simulator portion of the controller, would then
be programmed for various outage, underfrequency, and/or undervoltage status scenarios to perform overall
system performance evaluation.
State estimator data could also be used to develop case scenarios representing future flows and load
patterns for further system performance evaluations or to make adjustments where necessary.
8.5 Automatic and manual periodic testing of the entire scheme

Maintenance engineers should have a library of system-wide test cases. A proper test plan to simulate line
outage on the monitored transmission/distribution lines in the respective substations and tripping of the
88
IEEE Std C37.233-2009

lines should be conducted on a periodic basis to test the contingency plans and as a learning curve for the
better understanding of the SIPS application.
Those tests should be conducted without disabling any inputs. Only trip output contacts or auxiliary
tripping devices are disabled opening (isolating) the trip or possibly the close path (in case of capacitor
bypass or reactive insertion).
A critical consideration in implementing wide area monitoring and control schemes is the development of
automated test scenarios. Such test cases could be prepared based on the type and the intended application
of the scheme, and these tests should include provisions for ease of updating case studies as system
conditions change.
Technology advancements in communication and computers have provided opportunities to simplify
implementation of wide area protection and control systems. Computer-based devices can communicate
power system information both with central controllers as well as with each other. This in turn facilitates
the deployment of overall system-wide protection and control schemes. With an information infrastructure,
it is possible to connect all the monitoring, control and protection devices together through an information
network. An example of such a scheme is shown in Figure 37.
Figure 37 Redundant SPS or RAS system with central controllers at different

physical locations with different communications interface/protocol options
Using peer-to-peer connectivity
A typical test setup to test overall performance and throughput timing measurements is presented in
Figure 38. The test units and simulator are connected to the controllers to test a scheme shown in Figure 38.
89
IEEE Std C37.233-2009

Figure 38 Typical test setup for overall performance testing and throughput
timing measurements
In conclusion, overall system performance tests and automated and intelligent system testing need welldeveloped test plans. These tests may require the scheme to be unavailable during tests while the redundant
system continues to provide the safety net.
9. Testing protection and control systems with unconventional voltage and

current sensing inputs
9.1 Testing inputs to relays and microprocessor-based devices with low-level

analog inputs per IEEE Std C37.92TM-2005 [B19]
The purpose of IEEE Std C37.92-2005 [B19] is to define a low-level standard interface between relays and
unconventional sensors that cannot easily generate the high-level signal outputs like those of familiar CTs
and VTs. The sensors are typically designed with analog electronic signal generating circuits operating at
less than 15 V and delivering signals to relatively high-input impedances of electronic circuits in the
relays. Other types of sensors, such as Rogowski coils, have passive low-energy outputs that are also
compatible with these same high-impedance electronic inputs. This clause discusses testing of the relays
and their inputs. Testing the sensor outputs is covered in IEEE Std C37.92-2005 [B19].
Relays and other microprocessor-based devices with low-level analog inputs per IEEE Std C37.92-2005
[B19] are typically microprocessor based, with analog electronic input circuits interfaced to analog-todigital converters. Beyond the low-energy input circuits for voltage and current signals, these relays are
identical to those designed for conventional instrument transformer secondary signal inputs of 69 V or
120 V and 5 A. The overall functional testing or verification strategy is the same.
90
IEEE Std C37.233-2009

Instrument transformer standards IEC 60044-7 [B9] and IEC 60044-8 [B10] specify similar types of lowlevel interfaces for voltage and current signals, although these standards list several normal values in lieu of
a single standard value. The testing approaches are the same.
The major design difference is that the input isolating transformers are wound differently (or deleted
entirely) for the following reasons:
The relay has a high-impedance input (50 000 typical) and accepts a low-energy signal of
about 200 mV RMS to represent a primary current corresponding to 1 per unit primary load.
This is scaled so that the instantaneous peak of a 20 per unit fault current fully offset will be
slightly more than 11 V and within amplification range of commonly used operational amplifier
circuits.
The relay has a high-impedance input and accepts a low-energy signal of about 4 V RMS to
represent a primary voltage of 1 per unit.
It is important to note that with this type of low-level interface, primary current signals are represented by a
voltage signal. This is fundamentally different from conventional relays, whose current inputs require a CT
secondary current proportional to primary power system current.
Such a relay can be tested via injection testing methods that are used for conventional relays, except that
the signals must be scaled to these lower standard levels and the current input signal must be converted to
voltage across a burden resistor. If the test set is based on microprocessor or computing technology, the
modification may include removing or bypassing the power amplifier needed to drive conventional relays
needing large signal inputs from the low-level electronic signal sources in the test set.
It is easy to test these relays using a conventional relay test set with a simple transformer-based adaptor.
Transformers and interface circuits similar to or exactly like those installed in the front end of a
conventional microprocessor relay can be used to build the adaptor. The normal voltage signal of 69 V
RMS is scaled with a small wound transformer or a resistive divider to the 4 V signal used by the relay with
IEEE C37.92-2005 [B19] voltage interface. The 5 A current signal is passed through a small current
transformer with a resistive burden, such that the voltage developed across the burden is 200 mV.
Alternatively the test set 5 A current output can be directly connected to a 40 milliohm burden resistor, if
such an accurate burden resistor is available. It is similarly easy to scale signals to several of the many
alternative low-energy signal levels given in IEC 60044-7 [B9] or IEC 60044-8 [B10].
Test signals for a relay having this interface are also easy to generate with a personal computer and a lowlevel electronic analog outputeven a small electronic amplifier connected to a sound card could produce
adequate energy to simulate faults. Real-time digital simulators can be connected to these relays without
power amplifiers.
Some optical current and voltage sensors with electronic analog outputs offer the user the convenience of
operating in a test mode generate 50 Hz or 60 Hz standard signals that can verify connections from the
sensor to the relay and relay measurement accuracy. More details are provided in 9.2.
9.2 Testing inputs to relays with digital interfaces per IEC 61850-9-2-2004 [B15]
process bus
IEC 61850-9-2-2004 [B15] defines a mechanism for transmitting sample data streams from process
equipment (such as voltage and current measurement equipment) to relays and other consumers of sampled
data information, as shown in Figure 39.
91
IEEE Std C37.233-2009

Figure 39 Process bus test architecture overview for testing inputs with digital
interface using GPS clock synchronization
In this architecture, one or more MUs provide sampled data to the relay either through an Ethernet switch
or through a direct Ethernet connection. The testing of this architecture requires the ability to inject the
necessary streams of data into the Ethernet switch or directly into the relay. Figure 40 shows the test
architecture where a test merging unit (TMU) is introduced. In this figure, the TMU is shown connected to
the process bus Ethernet switch and is synchronized via the same clock used throughout the substation. In
this example, the TMU must be capable of generating the multiple streams of sampled data required by the
relay being tested. In the example shown, the TMU must be able to supply MU1 and MU2 data streams.
Note that, alternatively, some test sets may be capable of generating sampled values that can be used in
place of TMU sampled data streams. Note that sampled value streams are used instead of injection of
analog secondary signals into the device under test.
Figure 40 Process bus test architecture using test merging units

GPS clock synchronization
92
IEEE Std C37.233-2009

In general, testing can take three primary paths as discussed in 9.2.1 through 9.2.4.
9.2.1 Auxiliary TMU
In this test configuration, a set of spare MUs located in the control house (as shown in Figure 40) are
connected to the relay either through an Ethernet switch or direct connected (as dictated by the
implemented process bus architecture). Current, voltage, and status signals are then injected into the MU in
the appropriate form (standard analog signals or low-level analog signals) and the TMUs then process the
inputs and stream them accordingly to the connected relay under test (RUT). Note that the TMUs must be
appropriately synchronized.
If mapped in the data set, the test bit in the quality flag shall be setindicating to the RUT that the data
being received are test data. If the RUT is also in test mode, it shall process the received data and provide
protections and measurement values as if connected to the real system. Outputs to controls are to be
executed as defined in IEC 61850.
9.2.2 PC-based test TMU
This path uses a standard PC either connected to the Ethernet switch or directly connected to the RUT
(Figure 40). Note that in the latter configuration, the PC may be required to support multiple Ethernet
ports/data streams to the RUT. The PC would either need to be able to play back stored waveforms or be
able to generate and output the data streams dynamically as required by the RUT. An alternative to
dynamic playback is the option of locally generating stored data files and playing back the generated files.
As the PC has the ability to generate/play back synchronized data, the clock input to the PC is optional.
Another method is the simulation of Sampled Values using test sets, described in 9.2.
Similar to the Auxiliary TMU option previously described, if mapped, the test bit shall be set and the RUT
shall respond as defined in IEC 61850.
9.2.3 Primary/secondary injection
The third possible test mode is primary or secondary signal injection. In this mode of testing, a signal is
injected either into the inputs of the existing MU or injected at the high-voltage interface of the process
equipment.
When injecting into the secondary of the MU, a test set must be provided that can mimic the input type of
the MU. In the case of an optical CT or PT, this signal is, by definition, an optical signal and requires
special equipment. If the interface is through standard CT and PT interfaces, injection is possible through
the use of standard test equipment; however, multiple synchronized test setslocated in the fieldwould
be required to effect testing in this mode.
The capability of producing high-voltage signals is required when performing primary testing. See 9.2.4 for
more details.
9.2.4 GOOSE testing
It should be noted that although the process bus is designed primarily for communication from a MU to a
relay, there is a need to send control signals (e.g., breaker trip and close signals) from the relay to the MU.
In this circumstance, it is logical that the IEC 61850 GOOSE mechanism be used over the same physical
medium. GOOSE messages would contain status values that would be mapped into output contacts in the
MU.
93
IEEE Std C37.233-2009

The RUT should provide a mechanism whereby each output in the MU can be exercised through the
toggling of a bit in the transmitted GOOSE message. Outputs can be tested in the following two modes:
message received and executed and message received and noted.
In the first mode of operation, an output bit is set in the GOOSE message, and it is observed that the
respective output of the MU operates. Operation may be observed by actions such as a breaker actually
opening or closing or the operation of an auxiliary relay.
In the second mode of operation, the test bit in the GOOSE is set. In this mode of operation, the test
GOOSE is sent and the MU sets a sequence of events message to the effect that a test GOOSE was received
for a particular output contact. The contact, however, is not operated. Refer to IEC 61850 for details.
9.3 Testing outputs of unconventional sensors

The standard method for verifying the accuracy of an unconventional sensor is the same as that used for
conventional CTs and PTsa primary injection test with accurate measurement of the output using
accurate instruments or the relays and meters connected to its outputs. In general, such injection testing is
used only during commissioning or apparatus-outage maintenance.
For a typical installation of an optical sensor, the optical losses of all fibers are measured along with the
losses of the optical columns, using, for example, a handheld optical power loss meter. After connecting the
fibers with the optical columns and the electronics, the losses are measured by means of the electronics
itself. If both measurements are within acceptable levels, the unit is commissioned. Calibration is set at the
factory, but a field recheck is conducted with primary injection as for a conventional CT.
Primary injection with some vendors optical current transformers may be easier than for conventional CTs.
The effective transformation ratio of the optical CT can be changed onsite via software so that a lower
primary current injection can be used to achieve target output signal levels. This allows testing the
protection and instrument transformer together with more compact primary-source current generators.
Another testing advantage with some unconventional current sensors is that the measuring head has a
window for the current-carrying power conductor rather than being a closed assemblyin some ways like
a low-voltage window CT, even though the sensor is designed for operation at 765 kV ac or 800 kV dc.
The position of the current conductor in the window has no effect on accuracy. For injection testing, a test
primary can be created by winding several turns through the primary window, proportionally reducing the
current required for the test.
For example, Figure 41 shows how a three-turn test primary is wound through the window of an EHV
optical current sensor. The normal primary conductor need not be removed as long as it is isolated from the
rest of the power system by breakers or disconnect switches (so that no other currents besides the test
current can flow through the window).
94
IEEE Std C37.233-2009

Figure 41 Three-turn test primary in window of current sensor

Some unconventional sensors with electronic interfaces have a user access port that permits the user to read
primary values, even if no relay or meter is connected. This is helpful for initial checks and for
troubleshooting measurement problems.
Unconventional sensor technology provides tools for convenient independent calibration testing. Some of
the technologies employed today include the following:
Accurately wound fiber current sensors that can be safely installed on a live circuit as a portable
calibration reference for a conventional or unconventional device to be verified.
All-dielectric voltage sensors that can be safely elevated to contact a live circuit for a referenceaccuracy voltage check.
Line-mounted temporary high-precision current sensors that can be installed on a live circuit
and communicates its reference measurements via a wireless network data link to a personal
computer operating in the vicinity.
Subsystems of unconventional sensors can also be verified with procedures specified by the manufacturer
of the particular sensor type.
Examples of test and maintenance features in commercial optical sensors are as follows:
a)
Self-monitoring of optical light levels, light source drive currents, internal chassis voltage
levels, and temperatures. The parameters are logged automatically at startup for future
comparison. These include automatic measurement of fiber cable length and optical losses of
each channel. An alarm is raised for problems.
b)
Sensor electronics test mode generates an internal digital signal (50 Hz or 60 Hz) representing
rated current or voltage. This data stream is passed through the sensors analog-to-digital
converter if the IEEE Std C37.92-2005 [B19] interface is used or through the MU interface if
IEC 61850-9-2-2004 [B15] is used. The user checks the relay or meter reading to see if the rated
secondary value is being received.
c)
Sensor electronics store trends of key sensor parameters for analysis.
95
IEEE Std C37.233-2009

9.4 Verification by condition-based maintenance

In a CBM program, the correct operation of the unconventional (or conventional) sensor and relay are
observed as a system in a normal power system operation. This can be done if the measurements are read
from relay metering displays or gathered by a data concentrator via a substation communications network
and transmitted to SCADA and nonoperational maintenance centers. Control center or maintenance center
computers compare relay and microprocessor-based device metered values with those originating from
other sensors or instrument transformers and relays connected to the same power system quantities.
Alternatively, the currents added around a bus can verify the measurement on a particular feeder, and
remote voltages can be compensated to verify local values. A state estimator at the control center can report
measurements with inconsistencies or gross errors.
A condition-based maintenance program covering unconventional sensors offers the following compelling
advantages over periodic testing:
a)
Checks the whole relay and sensor system as an operating system.
b)
Avoids human intervention that could disrupt or disable a properly operating system.
c)
Reports failures as soon as they occur for quick repairs. If the utility depends only on periodic
testing, then some failures will be found when a fault is incorrectly relayed before a scheduled
test points out the failure.
d)
Saves the cost and outage for testing.
If the utility has installed PMUs or PMU-enabled relays, the precise synchrophasor values are particularly
effective for spotting measurement errors in the sensors or instrument transformers supplying the signals
from which they are computed.
New utility industry maintenance standards coming in the future are likely to recognize CBM as a
legitimate maintenance program that reduces the need for periodic time-based field testing by technicians.
96
IEEE Std C37.233-2009

Annex A
(informative)
Bibliography
[B1] ANSI C93.1-1999, American National Standard Requirements for Power-Line Carrier Coupling
Capacitors and Coupling Capacitor Voltage Transformers (CCVT).6
[B2] ANSI C93.4-1984, American National Standard for Power-Line Carrier Line-Tuning Equipment.
[B3] ANSI C93.5-1997, American National Standard Requirements for Single Function Power-Line
Carrier Transmitter/Receiver Equipment.
[B4] CIGR Working Group 12.09, Thermal Aspect of Transformers, A Survey of Facts and Opinion on
the Maximum Safe Operating Temperatures under Emergency Conditions, Paris, 1995.
[B5] CIGR Working Group 12.09, Thermal Aspect of Transformers, Survey of Power Transformer
Overload Field Practices, No. 161, 1995.
[B6] CIGR Working Group 34.10, Analysis and Guidelines for Testing Numerical Protection
Schemes, 2000.
[B7] Das, R., Real-Time Simulation for Relay Performance Evaluation, Proceedings of the IEEE Power
System Conference and Exposition (PSCE), New York City, October 1013, 2004.
[B8] Elmore, W. A., Applied Protective Relaying. St. Louis, MO: ABB Power T&D Company, 1994.
[B9] IEC 60044-7-1999, Instrument TransformersPart 7: Electronic Voltage Transformers (also see
IEC 60044 set). 7
[B10] IEC 60044-8-2002, Instrument TransformersPart 8: Electronic Current Transformer (see also IEC
60044 set).
[B11] IEC 60834-1-1999, Teleprotection Equipment of Power Systems, Performance and TestingPart 1:
Command Systems.
[B12] IEC 61850-4-2002, Communication Networks and Systems in SubstationsPart 4: System and
Project Management.
[B13] IEC 61850-6-2004, Communication Networks and Systems in SubstationsPart 6: Configuration
Description Language for Communication in Electrical Substations Related to IEDs.
[B14] IEC 61850-8-1-2004, Communication Networks and Systems in SubstationsPart 8-1: Specific
Communication Service Mapping (SCSM)Mapping to MMS (ISO 9506-1 and ISO 9506-2) and to
ISO/IEC 8802-3.
6
ANSI publications are available from the Sales Department, American National Standards Institute, 25 West 43nd Street, 4th Floor,
New York, NY 10036, USA (http://www.ansi.org/).
7
IEC publications are available from the Sales Department of the International Electrotechnical Commission, Case Postale 131, 3 rue
de Varemb, CH-1211, Genve 20, Switzerland/Suisse (http://www.iec.ch/). IEC publications are also available in the United States
from the Sales Department, American National Standards Institute, 11 West 42nd Street, 13th Floor, New York, NY 10036, USA.
97
IEEE Std C37.233-2009

[B15] IEC 61850-9-2-2004, Communication Networks and Systems in SubstationsPart 9-2: Specific
Communication Service Mapping (SCSM)Sampled Values Over ISO/IEC 8802-3.
[B16] IEEE PSRC Committee Report, Summary update of practices on breaker failure relaying, IEEE
Transactions on Power Apparatus and Systems, vol. PAS-101, no. 3, pp. 555563, Mar. 1982.
[B17] IEEE Std C37.2TM-2008, IEEE Standard for Electrical Power System Device Function Numbers,
Acronyms, and Contact Designations.8,9
[B18] IEEE Std C37.91TM-2008, IEEE Guide for Protecting Power Transformers.
[B19] IEEE Std C37.92TM-2005, IEEE Standard for Analog Inputs to Protective Relays from Electronic
Voltage and Current Transducers.
[B20] IEEE Std C37.94TM-2002 (Reaff 2008), IEEE Standard for N times 64 Kilobit per Second Optical
Fiber Interfaces between Teleprotection and Multiplexer Equipment.
[B21] IEEE Std C37.102TM,-2006, IEEE Guide for AC Generator Protection.
[B22] IEEE Std C37.103TM-2004, IEEE Guide for Differential and Polarizing Relay Circuit Testing.
[B23] IEEE Std C37.104TM-2002 (Reaff 2008), IEEE Guide for Automatic Reclosing of Line Circuit
Breakers for AC Distribution and Transmission Lines.
[B24] IEEE Std C37.109TM-2006, IEEE Guide for the Protection of Shunt Reactors.
[B25] IEEE Std C37.111TM-1999, IEEE Standard for Common Format for Transient Data Exchange
(COMTRADE) for Power Systems.
[B26] IEEE Std C37.113TM-1999, IEEE Guide for Protective Relay Applications to Transmission Lines.
[B27] IEEE Std C37.115TM-2003, IEEE Standard for Standard Test Methods for Use in the Evaluation of
Message Communications Between Intelligent Electronic Devices in an Integrated Substation Protection,
Control and Data Acquisition System.
[B28] IEEE Std C37.231TM-2006, IEEE Recommended Practice for Microprocessor-Based Protection
Equipment Firmware Control.
[B29] IEEE Working Group K3 (Transformer Thermal Overload Protection), Adaptive transformer
thermal overload protection, IEEE Transactions on Power Delivery, vol. 16, no. 4, pp. 516521, Oct.
2001.
[B30] Jodice, J. and Harpham, S., End-to-end transient simulation for protection system performance
testing, Developments in the Use of Global Positioning Systems, pp. 6/16/5 London, Feb. 8, 1994.
[B31] Lahoti, B. D. and Flowers, D. E., Evaluation of transformer loading above nameplate rating, IEEE
Transactions on Power Apparatus and Systems, vol. PAS-100, no. 4, pp. 19891998, Apr. 1981.
[B32] Mozina, C., et al., Commissioning and maintenance testing of multifunction digital relays, IEEE
Industrial and Commercial Power Systems Technical Conference, pp. 8291, May 26, 2004.
IEEE publications are available from the Institute of Electrical and Electronics Engineers, 445 Hoes Lane, Piscataway, NJ 08854,
USA (http://standards.ieee.org/).
9
The IEEE standards or products referred to in this clause are trademarks owned by the Institute of Electrical and Electronics
Engineers, Incorporated.
98
IEEE Std C37.233-2009

[B33] North
American
Electric
Reliability
ftp://www.nerc.com/pub/sys/all_updl/standards/rs/PRC-005-1.pdf.
Corporation
(NERC):
[B34] North
American
Electric
Reliability
Corporation
(NERC):
ftp://ftp.nerc.com/pub/sys/all_updl/pc/spctf/Relay_Maintenance_Tech_Ref_approved_by_PC.pdf.
[B35] Schreiner, Z. and Kunter, R., Remote Controlled Testing of Communication Schemes for Power
System Protection Using Satellite (GPS) Synchronization and Modern Communication Technology: A
New Approach. Houston, TX: Omicron Electronics, 2001. http://www.omicron.at/en/literaturevideos/papers/.
[B36] Thompson, M., Fundamentals and advances in breaker failure protection, 53rd Annual Georgia
Tech Protective Relaying Conference, Atlanta, GA, May 57, 1999.
[B37] Tziouvaras, D., et al., The effects of conventional instrument transformer transients on numerical
relay elements, Proceedings of Western Protective Relay Conference WPRC 01, Spokane, WA, Oct. 23
25, 2001.
[B38] Zocholl, S. E. and Guzman, A., Thermal model in power system protection, Proceedings of
Western Protective Relay Conference WPRC 99, Spokane, WA, Oct. 2528, 1999.
99
IEEE Std C37.233-2009

Annex B
(informative)
Suggested line current differential scheme testing procedure
Current differential (87L) channel monitoring
Once the communication channel(s) is supplied to the relay, the following has to be checked in the relay
diagnostic menu:
The channel status should be continuously healthy. Interruptions in the channel indicate a
problem with a channel and have to be investigated. Possible problems might include
inadequate received signal level, loose connections, and communication noise. Communication
noise is quantified by bit error ratio (BER) and can cause corruption of the 87L packet,
potentially leading to 87L misoperation. Generally, a channel with BER less than 1 104 is
considered appropriate for the 87L application.
An important indication of channel health is the lost packet count. Packets can be lost due to
corruption because of the noise, channel switching, or channel fading; packets can also be lost if
clocking of the communication system is not configured properly. If there is an increase, it
indicates that channel is not healthythis has to be further investigated and addressed.
Protection 87L function should be fully enabled.
Channel delay should be steady and within reasonable margin. Typically, a multiplexed channel
can introduce 2 ms through 12 ms (sometimes even more) of the external round-trip delay
compared to a dedicated fiber channel.
Channel asymmetry can be checked by injection of 1 per unit through current using GPS
synchronized test sets and monitoring the differential current. A differential current close to zero
indicates that there is no channel asymmetry on that particular channel. Maximum possible
asymmetry has to be determined by creating worst-case communication path on the
SONET/SDH ring and measuring differential current again. Channel asymmetry checks are not
required in direct, single-fiber channel applications.
All channel-related problems have to be solved in coordination with the communications department.
At one terminal, a communication channel has to be interrupted by temporarily removing/replacing, for a
short period of time, either the fiber connector or just the wire in case of galvanic interface. The relay
records should be checked to indicate channel interruptions, possible lost or corrupted packets count,
disabling and then enabling of the differential enabling, and disabling of the backup protection. The timing
should be checked in accordance with the manufacturers specifications. When a redundant channel is
involved, timing to switch from main to backup communications path and vice versa should be checked.
Some relays operate in a primary-hot standby mode while others operate in a primary-alternate mode.
Appropriate tests have to be performed according to the design.
Verification of the relay ID is generally performed; relays applied over multiplexed channels are usually
programmed to check whether the packets are received from the correct device. This eliminates
misoperations when the channel is inadvertently looped back and the relay is measuring twice as much
differential current as expected. By changing the ID temporarily to a wrong one, a check is performed to
determine whether the relays 87L function is blocked.
100
IEEE Std C37.233-2009

87L blocking
When this feature is used, the following two types of blocking elements may be applicable to 87L relaying:
a)
The entire 87L protection system is taken out of service or returned to service after maintenance
or troubleshooting. Testing should confirm that if at any terminal, block signal is applied to the
87L relay, current injection is above pickup set point of the relay and the relay does not produce
a differential trip.
b) When the 87L protection system is applied in a dual-breaker configuration (breaker-and-a-half

or ring bus) and a line disconnect switch is open, it creates a so-called stub bus zone. The
local 87L relay blocking element stops transmission of phasor quantities. As illustrated in
Figure B.1, when the line disconnect switch is open at the Station A but both breakers are still
closed, thus maintaining power exchange between Station A buses, a stub bus zone between the
breakers and the disconnect switch is created. Although the stub bus zone is not part of the line
anymore but rather is an element of the bus, it has to still be protected by either line protective
relay or some auxiliary relay energized for this condition only. During normal power flow
between two buses, the currents through both breakers are placed in opposite directions and
cancel each other out ideally to zero in the relay. If, however, a fault occurs in the stub bus zone,
the sum of the two currents is not equal to zero anymore. If care is not taken to force transmitted
current to zero, then erroneous differential current can cause tripping by remote relay(s).
Figure B.1Stub bus and 87L relaying

Typically, current differential relays have provisions to stop phasor transmission to a remote end once line
disconnect switch is open, to block local relay differential element, and to enable stub bus protection
providing tripping for stub bus zone breakers only, when a fault occurs in the stub bus zone.
The testing for stub bus condition should confirm that, once the line disconnect switch is open, any
injection in this relay is not causing either remote or local relay differential operation. On the other hand, it
should also confirm that stub bus protection becomes active and provides fault clearing by tripping local
breakers.
101
IEEE Std C37.233-2009

87L differential characteristics

Once the 87L channel(s) has been tested succesfully and is in service, 87L relay operation can be tested.
Using GPS synchronized test sets, a multiple of pickup of continuous through three-phase/one-phase
current is applied to both relays, for example, 5 pickup. In case of three-terminal line, 10 pickup of
infeed current at one terminal and 5 pickup of outfeed current at two other relays can be applied.
Basically, a minimum of four points of differential characteristics have to be captured, as follows:
Maintaining the same current at one terminal 87L relay, the current at another terminal is
reduced until relays at all terminals operate. The operating values are recorded and currents are
returned back to the initial values.
Maintaining the same current at one terminal 87L relay, the current at another terminal is
increased until relays at all terminals operate. The operating values are recorded and currents are
returned back to initial values.
Maintaining the same current at one terminal 87L relay, the angle of the current at another
terminal is increased until relays at all terminals operate.
Maintaining the same current at one terminal 87L relay, the angle of the current at another
terminal is decreased until both relays at all terminals operate.
Captured operating points of differential characteristics are checked against manufacturer published
characteristics or equations, and appropriate circuit breaker tripping operation is verified when test points
enter the operating region of the 87L characteristics. If required, the operating times of 87L relay can be
monitored and recorded.
87L through fault security
Using GPS synchronized test sets, a multiple of pickup (for example, 10 pickup) of continuous through
three-phase/one-phase current is applied to both relays. In the case of a three-terminal line, 10 pickup of
infeed current at one relay and 5 pickup of outfeed current at two other relays can be applied. The
differential current observed should be literally zero. The relays percent differential restraint is checked to
be in accordance with manufacturer specifications for a given injection and settings. Then, the angle at one
relay carrying 10 pickup current is increased to the point when differential operates checked to find an
edge between operate and restraint zones. The angle is pulled back by 10 into the restraint zone, and then
the channel(s) is broken/reconnected several times to verify that each relays differential operation occurs.
Relay records should show a channel failure leading to an 87L block and then enabling differential back in
service without any operation.
Transient simulations are often performed when the line differential performance, under CT saturation,
infeed/outfeed conditions, and so on, is a concern.
87L internal fault dependability
Similar to the test above, the same test values would be applied but for the solid internal fault when all
currents are in phase. The differential current observed should be high, 20 pickup current, for example.
Percent differential relays restraint is checked to be according to manufacturer specifications for a given
injection and settings. Then, the angle at one relay carrying 10 pickup current is increased to the point
when differential drops off. The angle is pulled back by 10 into the restraint zone, and then the channel(s)
is broken/reconnected several times to verify that each relays differential operation is performing
correctly. Relay records should show channel failure leading to 87L operation; the timing is measured by
how long it takes to bring the 87L into service and operate.
102
IEEE Std C37.233-2009

87L minimum pickup and timing

A three-phase/single-phase current is injected into one relay and is increased until all the 87L relays
operate. The pickup current would then be compared with the manufacturers specifications. Then the
three-phase/one-phase current 5 pickup is injected into only one relay and the operating time is measured.
87L direct transfer trip
When such a feature is available, typically 87L differential relays operate simultaneously at all terminals of
the protected line, as all of them measure the same differential current. However, a differential channel can
be used to send a DTT signal from external breaker failure relay (as an example). Another important
consideration is a three-terminal (or multiterminal) system when a communication path is broken between
two peers. In such case, relays not having a complete phasor set of data due to channel failure are blocked.
However, the relay, which has all channels intact, is still capable of making a differential decision and
sending a DTT to peer relays. Therefore, it is important to test that DTT is getting through to the remote
end(s) when it is configured to do so.
87L supervision
Traditionally, 87L functions were supervised by the fault detector to ensure that operation did not occur as
a result of channel impairments, such as packet corruption (due to noise, data misalignment, etc.). Usually,
a current disturbance detector was used for that purpose. In some cases, such as weak-infeed terminal,
supervision may prevent a differential trip. This can be overcome by supervising 87L function from either a
local disturbance detector or received from the peer 87L relay over communication channel using direct
relay-to-relay bits. Such an approach is also beneficial for DTT.
87L and single-pole tripping
When the 87L relay is applied for single-pole tripping, tripping and reclosing functionality has to be
additionally checked. Particularly, for the SLG fault, the faulted phase should be only tripped. If the 87L
relay is using current sequence-components for differential function, then elements using these components
should be blocked in a timely manner. When a fault evolves from SLG to LLG or when a 3PH fault is
detected, then a three-pole trip should be initiated with possible blocking of the auto reclosure. Everything
but SLG faults should be causing three-pole tripping operations.
87L on-load tests
It is common practice to put the 87L device in service after the on-load check. Reading of the local terminal
phase currents, remote terminal(s) phase currents, and differential currents in all three phases should agree
with metering from other devices and expected values. The differential current should be equal to the line
charging current compensated by shunt reactors.
If charging current compensation is applied in the 87L relay, then compensated charging current should be
significantly less and in accordance with manufacturer specifications. Typically, overhead transmission
lines between 230 kV and 345 kV exhibit 0.7 A to 1.4 A of primary charge current per mile; for
underground cables, these values might be seven to ten times greater. When shunt reactors are used on the
line, the expected charging current value is reduced. The expected steady-state differential current value
can be estimated by using the following formula:
I diff
VN
3( XC1 -XR1 )
where
VN
is the line nominal phase-to-phase voltage.

103
IEEE Std C37.233-2009

XC1
is the line total positive-sequence shunt capacitive reactance.
XR1
is the total inductive reactance differential zone.
The differential current above the expected value indicates problems associated with either the CT
circuitry, ratio matching, or channel asymmetry present on the communication link.
104
IEEE Std C37.233-2009

Annex C
(informative)
Impact of high-impedance faults to protective relay performance and
system testing
Fault impedance can be approximated by two different formulas:
where l is the arc length in meters and I is a current in amperes in the arc.
where l is the arc length in feet and I is a current in amperes in the arc.
Actual arcs are variable, tending to start at a low value, build up to a high value, and then break over,
returning to a lower value of resistance. Tower footing resistance is also variable, which can range from
1 to several hundred ohms. Many studies were carried out over the years on wet soil, rocks, asphalt,
concrete, and so on with variable and unpredictable results. Thus, with so many variables, common practice
is to neglect tower footing resistance in fault studies and to assume fault arc resistance being purely
resistive.
Traditionally, zero-sequence and negative-sequence components of the currents and voltages not affected
by the load current were used to detect high-impedance faults. Setting such protection too sensitive may
expose ground protection to misoperations because, due to the unbalance in the phase currents and
voltages, distortions in the phase currents and voltages due to harmonics, off-nominal frequency conditions,
CT saturation, and so on. Therefore, in performance testing, sensitivity of protection setpoints between
fault resistance coverage, and security for distorted waveforms during high-fault current should be
evaluated.
Solid grounding is usually used on the utility subtransmission and transmission systems 69 kV and up.
Magnitude of the ground fault vary with fault location and is typically enough to apply different types of
protection. Ungrounded, resonant grounded, and high-impedance grounded systems are employed for
utility distribution and industrial service 33 kV and below where high-service continuity is required.
Ground fault current may be less than 10 A primary, which makes locating the ground faults a difficult
task.
One of the elements included in performance evaluation of line protective devices is fault location. Fault
currents during SLG faults are capacitive and depend on the phase to ground capacitance of the whole
network supplied from distribution transformer(s).
Low-impedance grounding typically limits the ground fault current to 50 A to 600 A. The faults can be
classified, in terms of fault resistance, as follows:
a)
Low resistance, when the primary value of fault resistance is less than 10 .
b)
Medium resistance, when the primary value of fault resistance is less than 50 but greater than
10 .
c)
High resistance, when the primary value of fault resistance is greater than 50 . Some
regulations may entail a direct requirement for sensitivity for the ground fault (e.g., the ability to
detect ground fault of 600 A primary).
105
IEEE Std C37.233-2009

The protection has to be selected based on such requirement and system impedances. The following types
of protection are used to detect ground faults:
Negative-sequence and zero-sequence TOC and instantaneous overcurrent, which is usually
used as a primary protection on distribution feeders and as a backup protection on the
transmission systems for ground faults. This type of protection can be made directional by
directional zero or negative elements and can typically detect low-resistance and sometimes
medium-resistance faults. Due to coordination between adjacent lines, it does not allow for a
sensitive setting. This method is used on solidly grounded or low-impedance grounded systems.
The limits of sensitivity can be easily estimated analytically or by fault studies and proved by
testing. When directional elements are used, they should be confirmed by fault studies that there
is enough polarizing quantity for the protected zone coverage during a high-resistance fault.
Ground distance with quadrilateral characteristic is typically able to detect low-resistance
ground faults. Usually, resistive reach is not recommended greater than three to five times the
reactive reach so as to prevent overreaching due to a possible shift of the line reactance during
an external high-resistance fault. For short lines, distance resistive coverage is inherently
limited. Ground distance is used primarily on the solidly grounded and sometimes on the lowimpedance grounded systems. The line reactance can be polarized by zero-sequence, negativesequence, or phase current. Depending on the relay and distribution of the zero-sequence and
negative-sequence current, high-resistance faults superimposed on the load current may expose
relay to overreaching or underreaching effects.
The apparent impedance seen by the relay is as follows:
Z APP =
VA
I
= m Z1 L + RF F
I AG
I AG
The mZ1L term is a measure of the distance, and the RF
IF
is an error term or the added fault
I AG
impedance as explained in Figure C.1.
The physical fault resistance is amplified in the apparent impedance equation if the local current is lower
I
than the total fault current at the fault point ( F > 1 ). Under a strong remote terminal and weak sourced
I AG
local terminal, the physical fault resistance may be amplified considerably.
106
IEEE Std C37.233-2009

X
Z1L
Distance relay
may underreach
RF
mZ1L
RF
IF
IAG
Distance relay
may overreach
ZAPP
Figure C.1Impact of the added fault impedance on effective relay reach

Real-time simulations, short-circuit fault studies, or transient programs are all recommended tools to
generate test cases for ground distance function performance during resistive faults.
A line current differential is capable of detecting high-resistance faults with a typical differential pickup
setting of 0.2 p.u. The limit of resistive coverage is dictated by the value of the fault current supplied by an
equivalent source during such fault. The benefit of this protection is that all terminals contribute to
differential current and increasing sensitivity of protection. As the value of resistive fault currents is easily
available from the short-circuit studies, testing is easy to perform with the test set(s). Attention should be
paid to the case when the line is energized from one end only.
A line phase comparison is also capable of detecting high-resistance faults. The limit of resistive coverage
is dictated by the ability to set the fault detectors above the load current. These considerations are similar to
the line current differential above.
Pilot schemes can be set most sensitive using negative-sequence or zero-sequence directional elements. An
advantage of this protection is that no coordination is needed between adjacent lines; however, for a
specific blocking scheme, coordination is required for peer relays at the opposite ends of the line. Reverselooking element at one end should be more sensitive (typically, 23 times lower than forward-looking
element at the opposite end of the line). As it was mentioned above, these directional elements may be
exposed to malfunctions during high-fault currents leading to CT saturation. To secure protection, it is
possible to use two sets of directional elements, one set being more sensitive for low-fault currents and the
other being more sensitive responding to high-fault currents. During the high-fault current, the most
sensitive directional element is blocked. Testing of the pilot scheme requires synchronous injection of the
fault quantities at all terminals of the line. Because of that, using GPS synchronized test sets with
prerecorded resistive faults waveforms (COMTRADE files) is the preferred way of testing. Attention
should be paid in the case when the line is energized from one end only and when at least one terminal is
weak.
Sensitive zero-sequence power (watt-metric) is used on the isolated, compensated, or high-impedance
grounded systems to detect ground faults. The magnitude of the resistive ground fault current depending on
the network capacitance, neutral arrangement, and value of fault resistance has to be evaluated analytically
or with a short-circuit program. As usual, the magnitude of the fault current is small, but testing should
confirm that the relay has enough sensitivity for such currents, and it should determine resistive ground
faults correctly.
107
IEEE Std C37.233-2009

Annex D
(informative)
Transformer oil and winding temperature computational methods
The instantaneous evolution of the winding hot-spot temperature at the top or in the center of the high- or
low-voltage winding of a power transformer can be estimated by solving the analytical model described in
IEEE Std C57.91. The transformer loading guidelines are also described in Lahoti and Flowers [B31] and
IEEE Working Group K3 [B29].
The simplifying assumptions adopted in the formulation of such a model are as follows:
The oil temperature profile inside the winding increases linearly from bottom to top.
The difference between the winding temperature and the oil temperature is constant along the
winding.
The hot-spot temperature rise is higher than the temperature rise of the conductor at the top of
the winding, introducing a conservative correction factor.
The ambient temperature drives the oil temperature up and down with the same time constant as
the winding temperature does.
The solar flux incidence is neglected.
Such assumptions led to the adoption of the temperature profile inside the transformer, as depicted in
Figure D.1.
winding
hot spot rise
TO
top oil rise
Figure D.1Temperature profile assumed in the IEEE loading guide

Once these assumptions are made, the hot-spot temperature can be calculated as the sum of two
components, the top oil temperature and the hot-spot rise above top oil temperature, as expressed in the
following equation:
H =TO + H
(D.1)
108
IEEE Std C37.233-2009

As reported by IEEE Working Group K3 [B29], the evolution of such variables can be estimated by the
following physical model:
dTO
TO dt =[TO,U + A ]TO
d H
H dt =H,U H
e2
2
= I L R +1
TO, R
TO,U
R +1
= I 2e1
H, R L
H,U
where
is the ambient temperature, C
TO
is the top oil temperature, C
is the hot-spot winding temperature, C
H ,R
is the rated hot-spot winding temperature, C
is the hot-spot temperature rise above top oil, C
TO,U
is the ultimate top oil temperature rise, C
TO, R
is the rated top oil temperature rise over ambient, C
H ,U
is the ultimate hot-spot temperature rise over top oil (for a given load current), C
H , R
is the rated hot-spot temperature rise over top oil (for rated load current), C
TO
is the top oil rise-time constant, h
is the hot-spot rise-time constant, h
IL
is the load current normalized to rated current, p.u.
is the ratio of rated-load loss to no-load loss at applicable tap position
e1 , e2
are the two empirically derived exponents, dependent on the cooling method
109
IEEE Std C37.233-2009

Annex E
(informative)
Measuring and compensating for time delay after trigger for performing
end-to-end testing using different relay test sets
Using different types of relay test sets is possible. Test equipment produced by different vendors may have
different time delays after trigger. Therefore, the prefault time period may be different. To ensure that the
triggering of fault injections is properly coordinated, the post-trigger time delay of relay test sets must be
accurately measured prior to the actual end-to-end test. The difference in time durations must be factored in
the synchronization of secondary data injections.
It is important to note that the delay time after trigger for state sequence playback and for DFR playback
may vary for different test equipment manufacturers.
Simultaneous secondary injections are accomplished by synchronizing the event triggers on the relay test
sets using GPS satellite clock receivers (Figure E.1). The GPS clock receivers, with programmable trigger
outputs, are programmed to trigger the relay test sets within a microsecond of each other. This provides the
synchronized outputs of multiple relay test sets at terminals that can be hundreds of miles apart.
Once the trigger pulse is received, the relay test set has to process the signal in order to activate the analog
outputs (V, I). Each vendor has different electronic components and algorithms to process the received
signal. This difference causes the signal to be processed differently between vendors.
The difference in time durations (compensation time) must be factored in the synchronization of secondary
data injections.
Figure E.1Setup for measuring the delay time after trigger

In order to define the compensation time between two different relay test set vendors, a digital recorder tool
such as an oscilloscope, a digital fault recorder, a digital relay, or equivalent is required. Figure E.1 shows a
proposed setup to measure the delay time after trigger prior to the actual end-to-end test.
In this test setup, a state sequence is preloaded into each relay test set. An agreed time is entered into the
GPS clock receiver of each vendor. When the event trigger time arrives, the GPS clock receivers trigger the
relay test sets to initiate the prefault injection into the digital recorder.
110
IEEE Std C37.233-2009

Figure E.2Data from digital recorder

Figure E.2 shows an oscillographic record that can be saved using a digital recorder. The record shows the
difference in time delay after trigger between the two relay test sets, which can be calculated as follows:
Tc = A - B
Tc may be different for state sequence playback and for DFR playback due to differences in the algorithm
of each vendor. It is recommended to execute this test for either state sequence or DFR playback.
There are two methods to correct for this difference in time. One is to add Tc onto the prefault time delay
of the test set with the shortest delay after trigger so that the faults from both units occur approximately at
the same time. The other method is to adjust the trigger time programmed in the GPS receivers by
subtracting Tc to the test set with the longest delay after trigger.
In order to illustrate these two methods, consider the following data:
Prefault time vendor A = 128 ms
Prefault time vendor B = 128 ms
Trigger vendor A @ 12:00:00:000
Trigger vendor B @ 12:00:00:000
Using the digital recorder, the delay time after trigger for the two test sets was determined to be as follows:
A = 23.7 ms
B = 32 ms
Tc = 8.3 ms
Using the first method, 8.3 ms should be added to the prefault time of vendor A in order to ensure that the
triggering of fault injections is properly coordinated. The new values will be as follows:
111
IEEE Std C37.233-2009

Prefault time vendor A = 136.3 ms

Using the second method, 8.3 ms should be subtracted from the trigger time of vendor B in order to ensure
that the triggering of fault injections is properly coordinated. The new values will be as follows:
Prefault time vendor A = 128 ms
112

IEEE Guide For Power System Protection Testing

Uploaded by

Copyright:

Available Formats

IEEE Guide For Power System Protection Testing

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IEEE Guide For Power System Protection Testing

Uploaded by

Copyright:

Available Formats

What is the document about?

What is the document about?

What testing approaches are discussed?

What testing approaches are discussed?

IEEE Power & Energy Society

IEEE Guide for Power System

IEEE Std C37.233-2009

IEEE Std C37.233TM-2009

IEEE Guide for Power System

IEEE Power System Relaying Committee

The Institute of Electrical and Electronics Engineers, Inc.

Laws and regulations

Updating of IEEE documents

8. SIPS test requirements...................................................................................................................................83

IEEE Guide for Power System

IEEE Std C37.233-2009

1.4 Types of applications

IEEE Std C37.233-2009

1.5 Types of tests

IEEE Std C37.233-2009

1.5.2 Commissioning tests (at installation site)

To verify that factory-supplied connections are correct and complete.

1.5.3 Periodic maintenance tests

Assume the design requires no additional verification.

IEEE Std C37.233-2009

Consider correctness of logic, characteristics, and set points.

Make and verify needed changes to the periodic test procedures.

1.6 Applications for systems, schemes, and multistation testing

Directional comparison pilot protection

Tapped line configuration

Line switching equipment integration

Current differential or comparison

Integrated relaying communications monitoring

IEEE Std C37.233-2009

Integrated automatic reclosing and voltage/synch check

Conditional single-pole tripping and reclosing

Overload protection with distributed thermal inputs

Distributed winding measurement or data acquisition systems

Integrated load, life, and condition monitoring systems

Predictive, acoustic, or partial discharge detection systems

Distributed measurement and control

Configuration dependent protection zones and switching

Postfault closing lockout

Shunt capacitor protection

Wide area special protection schemes

Generator or tie outage reconfiguration or load shedding

Plant load or tie rejection

Voltage collapse protection and restoration

Out of step, synchrophasor-triggered, or phasor measurement unit (PMU)-based protection

Distributed load shedding schemes

Frequency or voltage-based load shedding that is dependent on centralized system conditions or

IEEE Std C37.233-2009

1.7 Considerations for testing and scheme self-monitoring

IEEE Std C37.233-2009

1.7.2 Drive for scheme and test simplicity

1.7.3 Test from the bottom up

IEEE Std C37.233-2009

1.7.5 Make use of in-service experience

For transient control messages, such as a control command, it is important to define a