Transformer Differential Inrush Misoperation Case Study

Transformer differential protection should trip rapidly for internal faults, but it should not trip for normal transformer energization. Magnetizing inrush can be large, asymmetric, and rich in harmonics, so a relay that sees only high differential current can misinterpret energization as a winding fault.

This case study follows a medium-voltage transformer that trips during first energization after maintenance. The case is hypothetical and intended for engineering education. It shows how an electrical engineer should connect transformer full-load current, relay operate and restraint quantities, second-harmonic restraint, CT saturation checks, event records, setting correction, and validation evidence.

The central question is:

Did the differential relay correctly trip for an internal transformer fault, or did it misoperate because the inrush restraint settings did not match the installed transformer behavior?

The correct answer depends on evidence. In this case, the event record supports inrush misoperation, not an internal fault.

Case Context

A 20 MVA, 13.8 kV to 4.16 kV transformer feeds a plant medium-voltage switchboard. After maintenance, the transformer is energized from the high-voltage side with the low-voltage main breaker open. The transformer differential relay trips during energization and locks out the transformer.

Item	Value
transformer rating	20\ \text{MVA}
high-voltage side	13.8\ \text{kV} line-to-line
low-voltage side	4.16\ \text{kV} line-to-line
relay differential pickup	0.30\ \text{pu}
percentage differential slope	35\%
second-harmonic blocking threshold	15\%
measured operate current during trip	I_{op}=5.2\ \text{pu}
measured restraint current during trip	I_{res}=5.5\ \text{pu}
measured second-harmonic ratio	11\%
trip time	42\ \text{ms}

The values are simplified. A real protection review must use the relay manual, CT ratios and accuracy classes, transformer vector group, tap position, through-fault study, energization point-on-wave, harmonic method, restraint definition, differential compensation, and site protection philosophy.

Event Evidence

The first event review separates internal-fault evidence from inrush evidence:

Evidence	Interpretation
trip occurs immediately after high-side breaker close	energization transient is credible
low-voltage main breaker is open	load current is not the source of differential current
current waveform is asymmetric and decaying	magnetizing inrush is plausible
pressure, gas, and temperature alarms are absent	no independent transformer-fault evidence appears
second harmonic is present but below blocking threshold	relay may not be blocking modern low-harmonic inrush
no sustained post-trip fault current is recorded	event does not resemble a persistent internal fault

No single item proves the cause. The decision comes from the full event record.

Transformer Full-Load Current

High-voltage full-load current is:

Use:

Then:

Low-voltage full-load current is:

The relay per-unit quantities are not the raw primary amperes. They are compensated quantities after CT ratio, transformer ratio, vector group, and relay scaling. Full-load current still gives the scale of the equipment and helps check whether recorded currents are plausible for inrush.

Differential Trip Check

Use a simplified percentage differential operating condition:

where m is the slope.

The operating threshold during the event is:

Measured operate current is:

Since:

the differential element is allowed to trip unless a blocking, restraint, or supervision function operates.

Harmonic Restraint Check

The relay is configured to block energization inrush when the second-harmonic ratio exceeds:

The recorded ratio is:

Because:

the harmonic block did not assert. The relay therefore treated the high operate current as an internal-fault condition and issued a trip.

This does not mean the relay was defective. It means the setting did not match the inrush signature observed in the installed transformer and energization condition.

CT Saturation and External-Fault Screen

Current-transformer saturation can also create false differential current during external faults. The event should therefore be checked for an external through-fault signature:

Check	Event result	Interpretation
load-side breaker status	open	not a load-side through fault
sustained symmetrical current	absent	unlike a maintained external fault
restraint current shape	decaying with inrush envelope	consistent with energization
voltage recovery after trip	normal	no persistent downstream fault indicated
protection targets downstream	none	no lower-level fault evidence

CT saturation is still part of commissioning review, but the available evidence points first to magnetizing inrush misclassification.

Engineering Decision

The transformer should not be re-energized repeatedly without review, and the event should not be accepted as a real internal fault without supporting evidence. The immediate decision is:

Hold normal energization, inspect transformer alarm evidence, review the relay event record, verify CT and compensation settings, revise the inrush restraint logic if justified, and re-energize only under a controlled test plan.

The decision basis is:

1. differential operate current exceeded the trip characteristic;
2. second harmonic was present but below the configured block threshold;
3. the event occurred at breaker close with the load side open;
4. independent transformer-fault indicators were absent;
5. waveforms were asymmetric and decaying;
6. no sustained external-fault evidence was present.

This is a protection-quality problem. A nuisance lockout can reduce availability, but over-relaxing differential protection can hide a true internal fault. The correction must preserve both dependability and security.

Corrected Protection Logic

The reviewed correction does not simply disable protection. It changes the supervised inrush blocking logic:

• reduce second-harmonic inrush block threshold from 15\% to 10\% for the energization window;
• apply blocking only for a defined transformer-energization interval after breaker close;
• require breaker close status and voltage recovery to supervise the inrush state;
• retain differential trip for high-current events with low harmonic content;
• verify CT ratios, polarity, vector compensation, and tap compensation;
• test internal-fault and through-fault cases by secondary injection.

Under the corrected setting, the same event would satisfy:

so inrush blocking would assert during the supervised energization window.

For a simulated internal fault, the test record gives:

Test quantity	Value
operate current	2.0\ \text{pu}
restraint current	1.1\ \text{pu}
second-harmonic ratio	4\%
expected action	trip

Trip threshold for that test:

Since:

and:

the relay still trips for the internal-fault test. That is the required outcome.

Controlled Re-Energization

The controlled re-energization plan should specify:

1. transformer inspection status and alarm reset;
2. breaker close sequence and communication protocol;
3. relay setting group in service;
4. event-record capture enabled;
5. expected inrush current and blocking state;
6. stop criteria for abnormal gas, pressure, temperature, or sustained current;
7. post-energization review before loading the transformer.

In the corrected energization test:

Quantity	Corrected energization result
operate current	4.8\ \text{pu}
restraint current	5.1\ \text{pu}
second-harmonic ratio	12\%
inrush block	asserted
differential trip	no trip
post-energization differential current	0.04\ \text{pu}

The post-energization differential current is well below pickup:

This supports release to load, provided all transformer and switchgear checks are normal.

RPN Screen

A simple risk-priority-number screen documents why the corrective action matters:

Before correction:

Factor	Value	Rationale
Severity S	7	Misoperation can lock out a critical transformer and encourage unsafe workarounds.
Occurrence O	3	Energization is infrequent but repeated after maintenance or outages.
Detection D	5	Cause is easy to misclassify without event records and harmonic review.

After setting correction, event-record review, secondary injection, and controlled energization:

Factor	Value	Rationale
Severity S	7	Consequence remains material if protection fails.
Occurrence O	2	Corrected inrush logic reduces nuisance trip likelihood.
Detection D	2	Event records and commissioning tests improve diagnosis.

The RPN does not approve the relay settings. It records why the misoperation mode is better controlled after engineering review.

Validation Evidence

The release package should include:

Evidence item	Why it matters
relay event record	proves operate current, restraint current, harmonic content, and timing
breaker status and voltage record	confirms energization sequence and source state
CT ratio, polarity, and wiring checks	prevents compensation errors from masquerading as relay behavior
transformer alarm and inspection record	distinguishes inrush from internal fault evidence
secondary injection results	proves internal-fault trip and inrush blocking behavior
setting-change approval	documents why the harmonic threshold was changed
controlled re-energization record	proves the corrected logic works in the installed system
loading release note	states when the transformer can return to normal operation

The validation package should preserve both sides of protection performance: security against inrush trips and dependability for internal faults.

Engineering Lessons

The first lesson is that high differential current during energization is not automatically an internal fault. Timing, waveform shape, harmonics, voltage recovery, alarms, and breaker state matter.

The second lesson is that harmonic restraint settings are not universal. Transformer design, residual flux, point-on-wave closing, CT performance, and relay algorithm can change the inrush signature.

The third lesson is that a nuisance trip should not be fixed by disabling protection. The correction must be supervised, tested, and shown to preserve internal-fault tripping.

The final lesson is that relay event records are engineering evidence. Without them, teams may either over-trust a misoperation or over-relax a protection function that is needed for real faults.