A transformer protection scheme combines fast electrical protection (87T differential and restricted earth fault), the transformer's own mechanical protections (Buchholz, sudden pressure, temperature), backup overcurrent on each winding and a lockout relay 86 that opens every breaker and blocks closing.
What a transformer protection scheme is
The power transformer is one of the most expensive pieces of equipment in a substation and one of the slowest to replace. Its protection scheme has two goals: clear internal faults fast to limit damage, and not trip for what is not a fault (inrush current, transient overexcitation, external faults with CT saturation).
It is one of the substation protection schemes with the most functions. Unlike a line, the transformer has protections of its own that are not electrical relays: gas and pressure detectors, thermometers. The scheme brings both families together.
Which protections make it up and how they are coordinated
Main (electrical) protections:
- Transformer differential 87T: CTs on every winding; trips every breaker of the transformer.
- Restricted earth fault 87N: for grounded-wye windings. A ground fault near the neutral drives a large current through the neutral but very little through the line terminals, so the 87T barely sees it. The 87N compares the neutral CT current with the sum of the phase currents (3I0) of that winding and detects those faults with greater sensitivity.
The transformer’s own protections: Buchholz 63 and temperature 26/49, sudden pressure, pressure relief device, oil level, tap changer protection.
Backup:
- Overcurrent 50/51 on the high side: the 51 also backs up the low-voltage bus; the 50 is set above the maximum through-fault current, so it does not see it.
- Overcurrent 51 on the low side, coordinated with the feeders.
- Neutral overcurrent 51N on the grounding connection.
- Overexcitation (volts per hertz) 24 and thermal overload 49 depending on size.
Output logic: lockout relay 86, breaker failure 50BF for each breaker, and reclose blocking of the lines or feeders that supply the transformer where applicable.
Logic and sequence
For an internal fault, for example between a winding and the tank:
- The 87T measures differential current above its restraint characteristic, with low second-harmonic content, and operates. The Buchholz may act in parallel because of the gas produced. In turn-to-turn faults involving few turns the differential current can be small, and the Buchholz is often the first to detect them.
- Both energize the 86.
- The 86 opens the high- and low-side breakers (and the tertiary breaker if there is one) and blocks their closing.
- The 50BF of each breaker is initiated.
- The transformer stays out of service until it is inspected and the 86 is reset.
- 01DetectionThe 87T operates with low second harmonic; the Buchholz may act in parallel
- 02Lockout relay 86Both protections energize it
- 03OpeningHigh-side, low-side and tertiary breakers, with closing blocked
- 0450BFBreaker failure of each breaker is initiated
- 05Out of serviceUntil the transformer is inspected and the 86 is reset
For an external fault on the low-voltage bus, the 87T must not operate; the bus protection clears it or, failing that, the low-side 51, with the high-side 51 as the last backup.
Variants by voltage level
- Extra-high voltage: often autotransformers with a tertiary; two independent differentials, or differential plus restricted earth fault in separate relays, bushing and breaker CTs with zones that overlap the bus.
- High voltage: differential, restricted earth fault, mechanical protections and overcurrent backup on each side.
- Medium voltage and distribution: fuses or overcurrent on the primary, mechanical protections and, depending on the rating, differential.
- Industry and generation: plant and generator step-up transformers; on the latter an overall differential covering generator and transformer is common, in addition to each one’s own. See the generator protection scheme.
Design criteria
- CT location: with bushing CTs the zone ends at the transformer; with breaker CTs the zone includes the connecting cables or bus. The zones must overlap those of the bus.
- Vector group and ratio compensation: in numerical relays it is done by settings; in electromechanical relays, with the CT connection and auxiliary CTs.
- Stability on energization and overexcitation: harmonic restraint or blocking, depending on the relay.
- Mechanical trips independent of the numerical relay, according to the owner’s philosophy.
- Backup coordinated with feeders and bus according to the coordination study.
IEEE C37.91 guides which protections to apply according to the size and importance of the transformer; it does not set universal settings.
How each manufacturer implements it
The most widely used transformer relay families are Siemens SIPROTEC 5 (DIGSI 5), SEL (AcSELerator QuickSet), Hitachi Energy Relion 670 and ABB Relion 615/620 (both with PCM600), GE Vernova Multilin UR (EnerVista) and Schneider Electric MiCOM / Easergy (MiCOM S1, Easergy Studio). What changes is how the windings and their vector group are described, how the 87T is combined with restricted earth fault and the overcurrent elements on each side, and how the trip latch is programmed when the 86 is a logic function rather than an electromechanical relay.
Why it fails or misoperates
- Trip on energization: inrush current with low second harmonic in modern cores, or an unsuitable blocking setting.
- Trip for an external fault: CT saturation, wrong ratios or vector group entered, reversed polarity.
- Buchholz trip with no fault: air after an oil filling, vibration, wiring with moisture.
- The 86 does not reset or does not block: supervision wiring, damaged auxiliary contact.
- Backup that does not coordinate with the feeders after a transformer replacement.
Check the oscillography first: differential current, harmonic content and which protection reached the 86 first.
How it is tested
The functions are tested by secondary injection: 87T slope, harmonic blocking, 87N, overcurrent elements. The scheme is checked by tripping from each protection, electrical and mechanical, and verifying that the 86 opens every breaker and blocks its closing. At commissioning, CT polarity is verified under load. Complement it with power transformer testing.
Did your transformer trip and it is not clear which protection caused it? Our team reviews the events and settings remotely. See remote relay configuration or contact us.
References
- IEEE C37.91-2021, Guide for Protecting Power Transformers.
- IEEE C37.119-2025, Guide for Power System Circuit Breaker Failure Protection.
- IEEE C37.2, Standard for Electrical Power System Device Function Numbers, Acronyms, and Contact Designations.
- J. L. Blackburn and T. J. Domin, Protective Relaying: Principles and Applications.
Frequently asked questions
Why is the transformer locked out after a differential trip?
Because the differential and the mechanical protections usually trip through the lockout relay 86, which holds the trip command and blocks closing of the breakers until someone resets it. That way nobody re-energizes a transformer with an internal fault without inspecting it first.
Is the Buchholz wired to the numerical relay or directly to the 86?
It depends on the design. It is common to wire the mechanical trips directly to the 86 or to the trip coils, so they do not depend on the numerical relay, and also to a relay input for the event record.
Does a small distribution transformer need differential protection?
Not always. At lower ratings, fuses or overcurrent plus the mechanical protections are usually enough. Differential protection is justified by the rating, the importance of the transformer and the owner's philosophy; IEEE C37.91 guides that decision.