Start with evidence preservation
A relay event record can show what the IED measured and decided, but not automatically what physically happened. Preserve the original files before opening or converting them: COMTRADE CFG/DAT and optional HDR/INF, native relay report, settings, logic/configuration, SER/event list, fault locator, firmware version and time-source status. Record who downloaded the data and when.
1. Understand the file set
| File/data | Purpose | Check |
|---|---|---|
| .CFG | Channel names, units, scaling, sample rates, time and format. | Primary/secondary designation, CT/VT ratios, station/channel naming. |
| .DAT | Analogue samples and digital states. | ASCII/binary type, sample count, missing/corrupt data. |
| .HDR / .INF (optional) | Free-text event and device information. | May contain settings/notes; do not assume it is complete. |
| SER / event list | Time-ordered pickup, trip, input/output and breaker events. | Time base, resolution, rollover and synchronization. |
| Native report | Calculated phasors, fault type/location and element variables. | Algorithm-specific; cross-check against waveforms. |
IEEE/IEC C37.111 / IEC 60255-24 defines COMTRADE as an exchange format for stored waveform/event data, not a network-transfer protocol.
2. Verify scaling before interpreting
Check whether analogue values are primary or secondary and RMS or instantaneous. Use CFG coefficients, CT/VT ratio and a known pre-fault load to sanity-check. A 1 A nominal channel mislabeled as primary can make every later conclusion wrong. Confirm phase order and polarity by pre-fault active/reactive power direction or known load phasors.
Check sample rate and anti-alias behavior before examining harmonics or fast transients. A record sampled for protection-frequency analysis may not capture an arc sensor pulse or high-frequency traveling wave accurately.
3. Build a common timeline
Choose fault inception as t = 0 and list: first analogue change, protection pickup, directional decision, trip assert, output contact, breaker 52a/52b change, current interruption, breaker-failure start/reset, autoreclose/ATS action and SCADA event. Correct for devices with different time sources or known offsets.
Relay operate time = fault inception → trip output
Breaker clearing time = trip output/contact path → current interruption
Do not use 52a change as the current-interruption time without checking waveforms; auxiliary contacts can change before or after main contact arc extinction.
4. Analyze pre-fault conditions
- Load current and direction; voltage magnitude/unbalance.
- Frequency and power factor.
- Breaker, tie, setting group and automation mode.
- Standing residual current/voltage.
- Existing alarms, DC voltage and communication quality.
A protection operation may be correct for a different setting group or bus topology than investigators first assume.
5. Determine fault type and direction
Plot phase current/voltage and calculate or inspect positive-, negative- and zero-sequence quantities. A phase-to-earth fault normally produces positive, negative and zero sequence where the network permits; phase-to-phase lacks zero sequence; a three-phase fault is predominantly positive sequence. Transformer vector groups and CT compensation can change relay-side quantities.
Use directional element torque/polarizing variables if available. The sign of P/Q alone is not a universal fault-direction test during depressed voltage and transient conditions.
6. Recognize CT saturation and VT problems
| Signature | Possible cause | Cross-check |
|---|---|---|
| Current waveform flat/clipped with delayed recovery | CT saturation during high asymmetric fault. | DC offset, other phase/bay CTs, differential restraint and CT class/burden. |
| False residual current during phase fault | Unequal phase-CT saturation or wiring error. | Sum primary/secondary channels and CBCT/neutral channel. |
| One voltage collapses without corresponding current event | VT fuse/secondary circuit failure. | Fuse-failure element, other devices and primary voltage. |
| All voltage angles/magnitudes wrong but stable | Scaling, phase mapping or VT connection error. | Pre-fault power/phase rotation and configuration. |
| Time jump or records misaligned | Clock loss, timezone/DST or unsynchronized IED. | Time-quality events and independent reference. |
7. Was the relay operation correct?
Reconstruct each element using the as-found settings and firmware, not the current approved file if it changed. Check pickup quantity, direction, timer integration, blocking/permissive signals and output logic. Determine whether the relay was correct but the system design/setting was wrong, whether input data was wrong, or whether the breaker/control path failed.
Use COMTRADE playback into an identical or validated relay model for complex cases. Preserve test configuration and compare element variables, not only final trip.
8. Example forensic sequence
A feeder record shows IA and IB rising, IC near load, VAB collapsing and negative-sequence current increasing at t = 0. The 67 phase element asserts at 18 ms, trip output at 42 ms, 52a changes at 88 ms and current reaches zero at 104 ms. Total clearing is 104 ms; relay decision/output is 42 ms; the output-to-interruption interval is 62 ms. If the arc-flash study used 42 ms as clearing time, it is wrong. If breaker specification maximum is 80 ms, the measured operation is acceptable but trend it against prior tests.
9. Reporting
A useful incident report contains a verified one-line/topology, event source and file hashes, time-quality statement, waveform plots with units, sequence-of-events table, settings/firmware, protection decision, breaker performance, root cause versus contributing factors, corrective actions and evidence required to close them. Separate facts from inferences.
Related protection guides
Engineering limitation
This guide explains a defensible engineering workflow; it is not a project setting calculation. Final protection functions, settings, wiring and trip logic must be based on the approved single-line diagram, short-circuit and coordination studies, equipment data, grid code, relay manual, and verified commissioning results. Changes require formal protection-management control.
References and further reading
- IEEE/IEC C37.111-2013 (IEC 60255-24) — COMTRADE format for waveform and event data
- IEEE C37.232-2011 — naming of time-sequence data files
- IEC 60255-1:2022 — common protection-equipment requirements
- ABB REF615 Application Manual — disturbance recording and commissioning context
- SEL-751 Feeder Relay — event analysis, fault location and oscillography features
Standards must be applied using the edition required by the project, utility and local law. Standards summaries on public pages are not substitutes for the controlled documents.