How to Analyze a Fault from the Oscillography Record

Short answer

An oscillography record says what the relay saw, not why it acted. To analyze a fault with it, first validate that the record is reliable, align the records of all devices in time, classify the fault by its quantities and calculate what each protection should have seen. The cause is confirmed when it explains all the records, not just that of the relay that tripped.

Short answer

An oscillography record is the most objective evidence of a fault, but it only answers what the device that recorded it saw. The analysis consists of four steps: check that the record is reliable, put it on the same timeline as the others, classify the fault by its quantities, and compare what was recorded with what each protection should have seen. This guide explains that method. How to read the waveforms is in how to read an oscillography record and the complete process, from the trip to the report, in electrical fault analysis.

First, is the record reliable?

Before interpreting a waveform, rule out that the problem lies in the record itself. Records are exchanged in COMTRADE format, defined by IEC/IEEE 60255-24 (also published as IEEE C37.111); the format and its files are in COMTRADE files. The configuration file holds the scales of each channel, and the first checks come from there:

Primary or secondary. If the channel is in secondary, the real current is the value read multiplied by the CT ratio. A scale error makes the whole analysis wrong.
Which channel is which. A channel labeled phase B but connected to phase C produces false sequences. The sum of the three phase currents must match the neutral channel, when there is one; if it does not match under normal conditions, there is a labeling, polarity or scale error.
Sampling rate and duration. A record with few samples per cycle does not show harmonics or saturation; one that is too short does not include the prefault or the reset.
CT saturation. A current that distorts or falls to zero during the fault may be saturation and not the real current. It is recognized as described in how to read an oscillography record and can be studied with the free CT saturation tool.

When the CT saturates, the recorded current is no longer faithful; the guide CT saturation teaches how to recognize it.

Then, a single timeline

Each device records with its own clock. If all are synchronized to the same source, the time stamps can be used as they are. If not, the records are aligned on an event they all saw, such as the voltage drop or the start of the fault current, and the applied offset is noted. An impossible order of events, such as a reclose before the trip, points to an offset clock and not to a network phenomenon. Synchronization is explained in time synchronization in substations.

With the timeline, the sequence is built: fault inception, pickup of each function, trip command, opening of each pole, extinction of the current, reclose if there was one. The times between one event and the next are what is later compared with the settings.

The phasors in the record are interpreted as explained in Phasor diagram.

Classifying the fault

With the channels validated, the classification comes from a few quantities:

What is observed	What it indicates
Current increase in one phase, with voltage drop in that phase and neutral current	Single-phase-to-ground fault
Increase in two phases, no neutral current	Phase-to-phase fault
Increase in two phases, with neutral current	Two-phase-to-ground fault
Increase in all three phases with very low voltages	Three-phase fault
Change from one phase to another during the record	Evolving fault
High current with nearly normal voltage in all three phases	Overload, motor start or energization; not a fault

Two more pieces of data complete the classification. The first is the fault resistance: with voltage that barely drops and moderate current, the fault is resistive and may fall below the pickup of some functions. The second is the direction: the angle between voltage and current says whether the fault was forward or reverse of the measuring point, which decides which directional protections should have operated.

First reading order of a fault record

Is the channel correctly scaled and labeled?
- No: Correct the channel configuration before interpreting
- Yes: Does the voltage drop and the current rise?
  - No: Not a fault in the zone; check overload, motor start or energization
  - Yes: Is there neutral current?
    - Yes: Fault involving ground: one phase or two phases to ground
    - No: Phase-to-phase fault: two phases or three-phase

The analysis changes with the equipment; see Fault analysis in lines, Fault analysis in transformers and Fault analysis in generators.

Comparing with what the protection should have seen

This is the step that turns the record into a diagnosis. With the quantities from the record, what each function should have measured is calculated outside the relay and compared with its setting:

For an overcurrent element, the current value and the resulting point on its time curve.
For a differential, the operating current and the restraint current at the instant of the fault.
For a distance element, the apparent impedance and the zone it falls in.
For a directional element, the measured angle against the characteristic.

The result classifies the operation. If the fault was in the zone and the function tripped in the expected time, the operation was correct. If it tripped without the fault being in its zone, it was a misoperation and the reason is sought. If it did not trip and a backup cleared the fault, there was a failure to operate, and the comparison shows whether the cause was the setting, the logic, a wrong measurement from the CT or the voltage transformer, or the blocking logic itself. The classes of operation are in electrical fault analysis.

The breaker time is also measured: from the trip command until the current is extinguished in each phase. A slow pole changes the conclusion and may have started the breaker failure 50BF.

How the cause is confirmed

A cause is confirmed when it explains all the records. If the hypothesis is a wrong setting or logic, the record is replayed in the relay with a secondary injection test set and it is verified that it repeats the operation. If the hypothesis lies in the field, the CT, the voltage transformer, the wiring or the breaker are tested. To review a COMTRADE file without installing software, our COMTRADE viewer is a free tool. This is complemented by analyzing fault records with SIGRA.

Common mistakes

Analyzing only the record of the relay that tripped. The other end of the line or the backup relay often shows what the first did not see.
Editing or trimming the original file. Always work on a copy and keep the original as evidence.
Trusting the device clock without checking it.
Giving a cause before calculating what the relay should have seen. Without that calculation, the cause is an opinion.
Not saving the settings in force at the time of the fault: without them there is nothing to compare against.

When to call us

If you have the records of a fault and the sequence does not add up, send them to us together with the settings and the time of the event. We quote the trip analysis and deliver the reconstructed sequence and the documented cause. If the conclusion lies in the settings, our team corrects them with the remote relay configuration and verifies them with secondary injection.

References

IEC/IEEE 60255-24:2013 (IEEE C37.111-2013), Common format for transient data exchange (COMTRADE) for power systems.

Frequently asked questions

Is a single oscillography record enough to give the cause of a trip?

Almost never. A record shows what one device saw at one point of the network. To conclude you need the records from the other end or the other relays, the event log with its time stamps and the settings that were loaded. With a single record you can classify the fault, but not confirm why a protection operated or failed to operate.

Why don't the currents in the record match those of the short-circuit study?

For several reasons that are ruled out in order: the record may be in secondary values rather than primary, the channel's transformation ratio may be misconfigured, the CT may have saturated and distorted the current, or the fault resistance and the network configuration at that moment may differ from the study. First confirm the channel scale; then discuss the network.

What do I do if the device clocks were not synchronized?

The records are aligned on a common event, for example the instant the voltage drops at both substations or the start of the fault current, and the applied offset is noted. The analysis remains valid for the order of events, but not for absolute times between devices; it is advisable to correct the synchronization before the next event.