Sensor-to-Trip Functional Assurance for MV Switchgear

Protection is successful only when the complete chain detects the intended fault, decides securely, delivers trip energy and the breaker interrupts current within the required clearing time. A tested relay element does not prove CT polarity, sampled-value mapping, output duty, DC voltage, trip coil, mechanism or breaker-failure escalation. Sensor-to-trip assurance treats them as one function with traceable performance and failure coverage.

This guide applies to conventional CT/VT hardwired schemes and digital substations using LPIT/sensors, merging units, sampled values and GOOSE. It defines requirements, latency/security budgets, independence, test layers, evidence and in-service monitoring for MV switchgear.

Executive rules

Define the protected zone, credible faults, sensitivity, dependability, security and maximum clearing time before selecting devices.
Budget time and uncertainty across sensor, conversion, communication, algorithm, logic/output, coil/mechanism and arcing—not only relay operate time.
Trace each requirement to settings/logic/wiring/SCL and an end-to-end test.
Analyse CT/VT saturation/failure or digital SV/GOOSE/time/network quality as functional inputs.
Keep redundant channels independent through sensors, power, IEDs, network, terminals, cables, coils and breaker mechanism limits.
Supervision detects some failures; it does not replace functional tests or a safe fallback.
Test internal and external faults, borderline conditions, failures and restoration using realistic dynamic waveforms.
Use disturbance records, SOE, breaker timing and health signals to maintain the assurance case in service.

1. Standards and evidence hierarchy

Reference	Use
IEC 60255-1:2022	Common requirements for measuring relays/protection schemes; includes merging units/communications and digital interfaces in scope
IEC TS 60255-216-1:2025	Requirements/tests for protection functions using SV, GOOSE and time inputs/outputs
IEC 60255-26:2023 / IEC 60255-27:2023	EMC and product safety for protection equipment
IEC 61869-1:2023 and relevant specific parts	Instrument-transformer/sensor requirements and performance
IEC 61850-5/6/7/8/9 series	Functional communication requirements, SCL/data models and GOOSE/SV mappings
IEC 62271-100:2021+AMD1:2024	Circuit-breaker operation, making/breaking and mechanism context
System studies/manufacturers	Fault quantities, CT/sensor performance, relay algorithms, network, coil and breaker-time data

Product conformance and communication conformance are necessary evidence, but functional interoperability and project-specific system performance still require engineering and end-to-end verification.

2. Define the function, zone and success criteria

primary equipment/zone boundaries and every energising source;
internal fault types/locations/resistance and minimum/maximum current/voltage;
external/through-fault, load, inrush, motor start, transformer energisation and switching cases;
required sensitivity, operating characteristic and selectivity;
maximum permitted operate/clearing time and breaker-failure initiation;
acceptable false-trip/security risk and blocking conditions;
single-failure/redundancy and common-mode criteria;
maintenance/test/out-of-service and degraded operating modes;
trip destinations, lockout, remote trips, load shedding and restoration;
required records, alarms, self-monitoring and test evidence.

3. Complete functional chain

Primary phenomenon: fault current/voltage/frequency/arc or equipment condition.
Sensor: CT, VT, CBCT, LPCT/LPVT, optical/arc or other transducer.
Signal conversion/path: analogue wiring/test block or merging unit/SV stream.
IED acquisition: scaling, phasor/filter/sampling, quality and time.
Protection algorithm: measured function characteristic, restraint/direction and timers.
Scheme logic: intertrips, blocking, zone replica, breaker failure, lockout.
Output transport: binary contact/interposing wiring or GOOSE publisher/network/subscriber.
Trip energy path: battery/DC distribution, MCB/fuse, contacts, cable, plug and coil.
Breaker response: release, mechanism motion, contact separation and arc interruption.
Confirmation/escalation: current/position proof, TCS, breaker failure and upstream/adjacent clearing.

Draw this chain for every trip channel and breaker. Mark power sources, common points, quality/supervision and test boundary at each block.

4. Time and uncertainty budget

A useful worst-case engineering model is:

t_clear = t_{sensor/interface} + t_acquisition + t_algorithm + t_logic/output + t_transport + t_{coil/mechanism opening} + t_arc.

Use guaranteed/verified maximums and tolerances for the specified fault and environmental/control-voltage conditions.
Include analogue filters, SV window/alignment, GOOSE transfer and I/O/interposing delays.
Separate protection operate, breaker opening, arcing and total clearing time.
Breaker opening time at reduced control voltage may differ from nominal; specify/test if the study depends on it.
Include breaker-failure timer margin above successful clearing evidence, yet below equipment/system damage constraints.
Analyse fastest false inputs/security as well as slowest dependable operation.

5. Conventional CT/VT measurement chain

Select ratio/class/burden/transient performance for minimum fault sensitivity and maximum through-fault saturation.
Calculate complete hot secondary loop and connected relay/meter burden.
Verify P1/P2, S1/S2, phase, ratio tap, star point and single intentional earth.
Use CT short-before-open test hardware; never open an energised secondary.
For VT, coordinate fuses/MCBs, one earth, burden/voltage drop and source/backfeed isolation.
Check residual/broken-delta/CBCT connection, cable-screen/earth route and scaling.
Test ratio, polarity, phase and end-to-end primary/secondary path; live-load phasors validate final wiring.

6. Digital sensor, merging unit and SV chain

Sensor/LPIT rated primary range, accuracy, bandwidth, interface and power.
Merging-unit channel mapping, ratio/scaling, phase, polarity, sampling and quality.
SV stream identity, dataset, multicast/VLAN/priority, sample rate and SCL configuration.
Time/synchronisation class, clock source, holdover and loss-of-time behaviour.
IED subscription, quality acceptance, stream-loss/sequence handling and fallback/blocking.
Network topology, PRP/HSR redundancy, bandwidth/load and switch/power failure domains.
Cyber/configuration control and prevention of test/simulation streams entering service logic.
Functional interoperability tests beyond protocol conformance, including malformed/lost/duplicate/delayed/invalid samples as supported by approved test methods.

7. Algorithm and setting assurance

Derive settings from approved study cases and actual CT/VT/sensor ratios.
Specify characteristic, pickup/dropout, timing curve, directional polarisation, restraint and memory behaviour.
Check influence of frequency, harmonics, DC offset, CT saturation, CVT/VT transients and power swings where applicable.
Coordinate instantaneous/time-delayed/earth/directional/differential elements and backup.
Review logic equations, masks, setting groups, latches, blocking and test modes independently.
Control firmware/algorithm version and manufacturer performance documentation.
Use dynamic COMTRADE/playback or real-time simulation for complex/transient cases; steady ramp tests alone are insufficient.
Verify settings converted/imported into the exact device and extract final checksum/report.

8. Trip logic and output transport

Hardwired output	GOOSE output
Contact DC inductive duty, common/isolation, output delay and weld/open failure	Data semantics, dataset/control block, retransmission, quality/test/simulation and subscriber logic
Cable/terminal/interposing voltage drop and segregation	VLAN/priority/network/PRP-HSR path, latency and loss supervision
End-to-end TCS may cover wiring/coil in breaker states	Network/GOOSE supervision plus downstream DC/coil supervision required
Physical test link/injection/isolation	Controlled test/simulation and SCL/configuration boundary

For either technology, define fail state, common modes and maximum transfer time. A GOOSE trip still needs dependable DC output/coil/mechanism at the subscriber; hardwired copper still needs semantic and logic traceability.

9. DC trip path and breaker

battery/charger minimum and maximum conditions plus simultaneous busbar/BF trips;
DC MCB/fuse interrupting/selectivity and remote fault-clearing capability;
hot cable, contact, test link, terminal, plug and 52a/52b voltage drop;
coil min/max terminal voltage, current/energy and pulse/duty;
output/auxiliary contact interruption and suppression effect;
breaker opening/closing/travel/pole scatter and arcing performance;
mechanism stored energy, pressure/spring/motor and auxiliary contact validity;
trip-circuit supervision coverage for breaker open/closed/test/service states;
breaker-failure current/position criteria, retrip and escalation destinations.

10. Dependability, security and common-mode FMEA

Failure	Detection/fallback question
CT/VT open, short, saturation or fuse failure	Alarm/block/backup without false trip?
Sensor/MU/SV stream/time failure	Quality detected; redundant stream/backup function independent?
IED hardware/firmware/settings failure	Watchdog and independent protection channel?
GOOSE/network/SCL error	Supervised end-to-end; fail state and alternate trip path?
Output/contact/cable/terminal open	TCS coverage and second coil/channel?
DC feeder/common/battery failure	Independent source/path and actionable alarm?
Coil/mechanism/breaker failure	Breaker failure trips correct adjacent/upstream breakers?
Test/bypass left active	Visible, alarmed, governed and restoration-checked?

Assess independence physically and logically. Two relays fed from the same CT core, merging unit, DC MCB, network switch, terminal common or breaker mechanism are not fully redundant against that shared failure.

11. Verification layers

Design analysis: studies, settings, CT/sensor/DC/time/network and FMEA.
Product evidence: type/conformance/interoperability reports and firmware applicability.
Static build checks: BOM, wiring, terminals, SCL/settings/logic comparison.
Component tests: CT/VT, IED inputs/outputs, DC, coil and breaker timing.
Secondary injection: each element and trip output with correct scaling/phase.
Dynamic scheme test: COMTRADE/real-time faults, logic, GOOSE/SV and timing.
Primary injection/live-load: sensor-to-IED ratio/polarity/direction and whole chain where feasible.
End-to-end trip: actual output/coil/breaker operation and current interruption simulation/controlled plant test.
Failure insertion: sensor, quality, network, DC, output, coil and breaker failure.
Operational baseline: records, phasors, times and health indicators retained for comparison.

12. End-to-end FAT/SAT test matrix

minimum internal fault at zone boundary and maximum/high-DC-offset fault;
external/through fault with CT saturation or stream disturbance;
phase/earth/high-resistance/directional/reverse cases as applicable;
load, motor start, transformer inrush, switching and frequency variation security;
each setting group/mode/topology and breaker open/closed/test/service;
simultaneous protection elements and first-out/trip matrix;
loss/wrong phase/polarity/ratio, bad quality and VT fuse failure;
GOOSE/SV delay/loss/duplicate/test/simulation/network A/B failure;
minimum/maximum DC, open trip path, failed coil/mechanism and breaker failure;
power-cycle/watchdog/recovery, temporary bypass and restoration;
end-to-end timing captured from injected fault to output, coil current, contact travel and final status.

13. Continuous functional assurance

IED self-supervision, settings/firmware/SCL checksum and unauthorised change alarms.
CT/VT/SV/GOOSE/time/network quality and redundancy health.
Trip-circuit/DC battery/charger/MCB earth-fault supervision.
Breaker operation time, coil current, travel, contact wear and mechanism energy trends where validated.
Disturbance record/SOE review after every operation: pickup, trip, current extinction and BF margin.
Periodic primary/secondary/end-to-end tests risk-based on hidden failure coverage.
Controlled bypass/out-of-service with compensating protection and expiry.
Lessons from operations/near misses fed into settings/design/test baselines.

14. Assurance case and evidence pack

requirement-to-design-to-test traceability matrix;
approved study and settings calculation/report;
CT/VT/sensor/MU/relay/breaker/DC/network manufacturer evidence;
single-line, functional chain, schematics, I/O/trip matrix and SCL/network drawings;
FMEA/common-mode and degraded-mode decisions;
FAT/SAT/primary/end-to-end test results with instruments/waveforms;
as-built settings/logic/SCL/firmware checksums and physical red-line closure;
operational limits, alarm responses, test intervals and bypass procedures;
baseline timing/phasor/coil/breaker records and acceptance margins.

15. Frequent mistakes

Mistake	Consequence	Correction
Relay element test equals scheme test	Wiring/DC/coil/breaker defects missed	Full-chain verification
Average timings summed	Worst-case clearing margin overstated	Guaranteed/tolerance budget
Protocol conformance equals interoperability	SV/GOOSE quality/mapping failure	Functional end-to-end digital tests
Two IEDs called redundant	Shared sensor/DC/network remains	End-to-end failure-domain mapping
TCS assumed covers all states	Hidden open path remains	Coverage matrix/fault insertion
Low coil voltage only proves operation	Timing may exceed study assumption	Specify/test timing versus terminal voltage
No post-trip review	Degraded margin/trends persist	Operational record assurance

16. Design-release checklist

Zone/fault cases/success criteria approved?
Total clearing and uncertainty budget demonstrated?
Conventional or digital measurement performance validated?
Settings/algorithm/logic derived from studies and independently reviewed?
Output transport semantics/duty/latency supervised?
DC/coil/breaker time/duty and BF escalation proven?
Redundant channels independent to required failure scope?
Security as well as dependability tested?
Dynamic/end-to-end and failure-insertion matrix complete?
Time/network/quality degraded modes safe?
As-built configuration and test evidence traceable?
In-service monitoring, operation review and periodic test defined?

References and further reading

Engineering note: Performance limits and test waveforms must come from the project studies, selected function standard, manufacturer evidence and system operating criteria.