Generator Protection at Medium Voltage: Functions, Settings and Trip Matrix

Generator protection at medium-voltage switchgear must protect more
than the stator. The scheme has to distinguish internal electrical
faults from abnormal operating conditions, prime-mover problems,
excitation failures and power-system disturbances—then trip the correct
combination of generator breaker, field breaker, turbine or engine, and
auxiliary supplies.

Design rule: start with damage and process
consequences, not a list of ANSI numbers. Two relays can both include
“87G, 40 and 32”, yet protect different physical zones and initiate very
different shutdowns.

This guide develops a practical protection philosophy for synchronous
generators connected at medium voltage, including CT/VT arrangements,
setting principles, a worked example, trip classes and commissioning
tests.

1. Define the
generator unit and its boundaries

The word “generator” may mean:

• generator terminals to generator breaker;
• generator plus isolated-phase or MV bus duct;
• generator and unit transformer as one differential zone;
• generator, generator step-up transformer (GSU) and unit
  auxiliaries;
• an industrial generator operating in parallel with a utility;
• an islanded generator responsible for both voltage and
  frequency.

Mark the following on the single-line and protection drawings:

• neutral and terminal CTs;
• terminal, neutral and bus VTs;
• generator breaker and any GSU high-side breaker;
• field breaker or excitation shutdown input;
• prime-mover trip and controlled-shutdown inputs;
• neutral grounding transformer/resistor or distribution
  transformer;
• unit and station service transformers;
• synchronism-check points;
• remote intertrip and breaker-failure clearing paths.

The protection zone is determined by sensor locations. A cable
termination outside the 87G CTs is not protected by 87G, even if it is
physically beside the machine.

2. Three classes of
generator problems

Internal electrical faults

These require rapid isolation to limit copper, core and mechanical
damage:

• stator phase-to-phase or three-phase fault;
• stator ground fault;
• fault in terminal leads or bus duct inside the zone;
• interturn fault where dedicated detection is available;
• rotor earth fault, whose urgency depends on whether it is the first
  or second fault;
• GSU or auxiliary-transformer fault within a combined zone.

Abnormal operating
conditions

These may damage the machine without being short circuits:

• unbalanced current and negative-sequence heating;
• overload and inadequate cooling;
• loss of excitation;
• reverse power from prime-mover failure;
• overfluxing or excessive volts per hertz;
• overvoltage, undervoltage, overfrequency and underfrequency;
• out-of-step operation or loss of synchronism;
• inadvertent energisation of a stopped generator;
• prolonged motoring, pole slip, overspeed or loss of field
  cooling.

External faults and system
events

The generator contributes to external faults and must provide
coordinated backup. It may also have to ride through voltage and
frequency excursions under a grid code. Protection settings must
therefore be coordinated with excitation limiters, turbine controls,
governor response, loss-of-mains requirements and system protection.

3. Main protection functions

Function	Purpose	Important design dependency	Typical consequence
87G stator differential	Internal phase faults in CT-defined zone	CT ratio/class, saturation, winding configuration	Fast unit trip
64G/59N stator earth fault	Ground fault in stator winding/terminals	Neutral grounding and voltage distribution	Unit trip; coverage depends on method
100% stator ground	Extends coverage close to neutral	Third-harmonic behaviour or subharmonic injection	Unit trip/alarm per method
64F rotor earth fault	Detects field-winding insulation failure	Excitation system and injection method	First-fault alarm or trip; second fault urgent
46 negative sequence	Protects rotor from unbalanced-current heating	Machine I₂ continuous and I₂²t capability	Alarm/trip
49 thermal/RTD	Stator/bearing temperature and overload	Cooling state, RTDs and thermal model	Alarm or controlled/rapid trip
40 loss of excitation	Detects underexcitation/field loss	Machine reactances, capability curve, limiter action	Trip or rapid unload
32R reverse power	Detects motoring after prime-mover failure	Prime-mover motoring power and measurement error	Close steam/fuel; trip generator
24 V/Hz	Prevents stator/transformer core overfluxing	Generator and GSU withstand curves	Alarm/trip with inverse or staged delay
27/59 voltage	Abnormal terminal voltage	Ride-through requirements and VT supervision	Alarm/trip/field action
81U/81O frequency	Abnormal speed/system frequency	Grid code, load shedding and turbine limits	Alarm/trip
78 out-of-step	Loss of synchronism	System stability study and impedance trajectory	Unit separation/trip
25 synchronism check	Prevents unsafe breaker closing	Valid VTs, slip, angle and voltage limits	Close permissive only
50/51, 51V backup	External/internal fault backup	Generator decrement and voltage restraint	Delayed trip
50BF breaker failure	Generator breaker fails to interrupt	Current and breaker contacts; alternate clearing	Trip bus/GSU/field as designed

ANSI numbers are labels, not full specifications. State the measured
quantities, zone, characteristic and outputs for every element.

4. Stator differential
protection: 87G

87G compares currents at the neutral and terminal ends of each stator
phase. With current polarities directed into the winding, load and
external-fault currents cancel; an internal phase fault produces
operating current.

A typical percentage-restrained principle uses operating and
restraint quantities similar to:

I_operate = |I_terminal +
I_neutral|

I_restraint = (|I_terminal| +
|I_neutral|) / 2

The relay’s actual equation may differ. Minimum pickup must exceed
credible CT and measurement mismatch while remaining sensitive to a
low-current internal fault. Slope must secure the element for the
maximum external fault with unequal CT saturation.

CT considerations

• Use compatible ratios and protection performance at both winding
  ends.
• Calculate secondary lead burden, especially when neutral-end CTs are
  distant.
• Prove phase allocation and polarity by primary tests.
• Check CT performance for generator-source DC offset and long fault
  time constants.
• Where a GSU lies in the zone, apply ratio/vector-group compensation
  and zero-sequence handling.
• Treat split-phase or transverse differential as a distinct scheme
  for interturn sensitivity where the winding design permits it.

An internal ground fault close to a resistance-grounded neutral may
produce too little current for phase differential. That is why 87G does
not replace dedicated stator ground protection.

5. Stator ground-fault
protection

The available method follows the neutral-grounding arrangement.

Fundamental
neutral overvoltage or overcurrent

With a neutral grounding resistor or distribution transformer, a
stator ground fault produces neutral voltage and current. 59N/64G and
51N can provide sensitive protection. However, fundamental neutral
overvoltage tends to have low sensitivity for faults very close to the
neutral because only a small fraction of winding voltage drives the
fault.

The protected percentage is not a universal 95%. It depends on
pickup, neutral grounding, maximum normal neutral voltage, harmonics and
winding voltage distribution.

Third-harmonic methods

The third-harmonic voltage distribution between generator neutral and
terminals changes for a ground fault near either end. Under-voltage,
overvoltage or ratio/differential methods can extend coverage. Their
security depends on the generator producing sufficient, predictable
third harmonic throughout its operating range.

Measure third-harmonic behaviour during commissioning at no load, low
load and representative real/reactive outputs. A method that is secure
at rated power may be blind during startup.

Injection-based
100% stator ground protection

A low-frequency signal injected into the neutral circuit can
supervise the entire stator winding, including shutdown and startup when
the generator produces no fundamental voltage. The scheme must account
for grounding-transformer impedance, coupling equipment, total
capacitance and connected equipment in the protected zone.

6. Rotor ground protection:
64F

The first field-earth fault may not produce destructive current
because the rotor field circuit is normally isolated from earth. It
removes the insulation margin, however; a second earth fault can short
part of the field winding, create magnetic unbalance and cause severe
vibration or rotor heating.

Modern relays use DC or low-frequency injection to measure insulation
resistance. The response may be staged:

• alarm at a high resistance threshold;
• urgent alarm or trip at a lower threshold;
• faster action if vibration, field-current asymmetry or a
  second-fault indication appears.

Choose action with the generator manufacturer and operating risk
assessment. Test across the excitation system’s permitted states,
including standstill if the scheme claims offline coverage.

7. Negative-sequence
protection: 46

Negative-sequence stator current creates a magnetic field rotating
opposite the rotor. In the rotor reference frame it induces
double-frequency currents and rapid heating in retaining rings, damper
structures and the rotor body.

Generator manufacturers commonly express short-time capability with a
relationship of the form:

I₂²t = K

and specify a continuous permissible I₂. The relay
should include:

• alarm or low-set stage for continuous unbalance;
• inverse-time or thermal accumulation for higher
  I₂;
• reset/cooling memory consistent with the machine;
• coordination with open-conductor and system unbalance
  requirements.

Use the manufacturer’s machine-specific K and
continuous limit. A generic table can overprotect one rotor and
underprotect another.

8. Loss of excitation: 40

If field current is lost while connected to the system, a synchronous
generator can absorb reactive power, draw high stator current and
overheat rotor end regions while risking instability. Impedance-based 40
elements commonly use offset mho or lens characteristics in the R-X
plane. Other relays combine reactive power, field voltage/current and
underexcitation logic.

Settings depend on:

• synchronous and transient reactances;
• generator capability curve;
• excitation limiter and underexcitation limiter characteristics;
• system impedance and stable power-swing trajectories;
• loading and operating modes;
• VT fuse-failure supervision.

Use staged operation where justified: a fast zone for severe field
loss and a slower zone for less severe underexcitation. Test the
trajectory dynamically; one static impedance point does not prove
security during stable swings.

9. Reverse power: 32R

When mechanical input is lost, the generator imports real power and
drives the turbine or engine as a motor. Damage mechanisms differ:

• a steam turbine can overheat from loss of cooling steam;
• a hydro turbine may experience cavitation;
• a diesel or gas engine can suffer unburned fuel or mechanical
  stress.

Set pickup from the prime-mover manufacturer’s motoring-power data,
not a generic percentage of MW rating. Include CT/VT errors,
low-power-factor operation and station auxiliaries in the measured power
boundary. A small pickup usually needs a secure time delay and positive
proof of generator-breaker closed status.

Reverse power is not a substitute for overspeed, fuel, steam,
lube-oil or other mechanical trips. It is an electrical indication that
mechanical input has failed or is insufficient.

10. Volts-per-hertz
protection: 24

Magnetic flux in the generator or GSU core is approximately
proportional to voltage divided by frequency. The per-unit quantity
is:

(V/Hz)_pu = (V/V_rated) /
(f/f_rated)

Overfluxing can occur with high voltage, low frequency or both.
Settings should follow generator and transformer withstand curves and
coordinate with the automatic voltage regulator limiter. Use
phase-to-phase or positive-sequence voltage as the relay manual requires
and supervise the VT circuit.

11. Inadvertent energisation

A stopped or slowly turning generator accidentally energised from the
grid behaves like an induction motor with very high current and rapid
rotor heating. Schemes often combine undervoltage and instantaneous
overcurrent, sometimes described as 50/27, with breaker status and
startup logic.

The element must be armed while the unit is offline and remain
dependable if control power or a VT circuit is unavailable. It must also
avoid operating during legitimate synchronising and close-in faults.
Test the transition among stopped, starting, synchronising, online and
shutdown states.

12. Worked 10 MVA, 6.6 kV
example

Consider a 10 MVA, 6.6 kV, 50 Hz generator rated 0.8 power factor
with 1000/1 A CTs.

Rated stator current

I_rated = S / (√3 × V)

I_rated = 10,000,000 / (√3 × 6,600) = 875
A

At rated load the relay secondary current is:

875 / 1,000 = 0.875 A

At 105% stator current:

1.05 × 875 = 919 A primary = 0.919 A secondary

This value helps check current bases and thermal/overcurrent plots.
It does not by itself set 49 or 51; machine capability, cooling mode and
fault-current decrement are required.

V/Hz event

Suppose terminal voltage is 1.10 pu while frequency has fallen to
0.95 pu:

(V/Hz)_pu = 1.10 / 0.95 = 1.158 pu

Plot 1.158 pu on both generator and GSU V/Hz withstand curves. The
faster permissible time governs the coordinated 24 response after
allowing for measurement and breaker time.

Differential operating
points

Assume a through-current test, after polarity alignment, produces
+0.875 A at the terminal input and −0.865 A at the neutral input:

I_operate = 0.010 A

I_restraint = 0.870 A

An internal-fault test with +2.5 A and +1.8 A produces:

I_operate = 4.3 A

I_restraint = 2.15 A

Plot both on the selected relay characteristic, along with minimum
internal faults and the worst external-fault CT-saturation cases.

13. Trip classes and
shutdown matrix

Generator outputs are rarely equivalent. A practical design groups
them by consequence.

Class A: immediate unit trip

Typically used for severe internal electrical faults. It may
trip:

• generator breaker and GSU high-side breaker as applicable;
• field breaker or excitation;
• prime mover;
• unit auxiliary source transfer;
• lockout relay;
• breaker-failure initiation.

Class
B: electrical trip with controlled mechanical action

For some abnormal conditions, the generator breaker and field may
trip while the prime mover follows a controlled shutdown. Exact
sequencing is technology-specific.

Class C: unload then trip

Certain thermal, process or prime-mover conditions may allow rapid
unloading before breaker opening, provided the machine remains within
its capability.

Alarm only

Early-stage rotor earth fault, temperature, vibration or cooling
alarms may be non-trip indications. Every alarm needs an operator
response and time limit.

Initiating element	Generator breaker	Field	Prime mover	Lockout	Typical class
87G internal fault	Trip	Trip	Trip	Yes	A
64G stator earth fault	Trip	Trip	Trip	Usually yes	A
64F first stage	No	No	No	No	Alarm/site-specific
46 severe negative sequence	Trip	Trip or de-excite	Controlled/Trip	Site-specific	A or B
40 loss of excitation	Trip	Trip	Controlled/Trip	Site-specific	A or B
32R reverse power	Trip after approved sequence	De-excite	Fuel/steam trip already expected	Site-specific	B
24 V/Hz	Trip per withstand curve	De-excite	Controlled/Trip	Site-specific	A or B
Generator breaker failure	Trip alternate breakers	Trip	Trip	Yes	A

This table is illustrative. Turbine, engine, excitation and
auxiliary-system vendors must approve the final matrix.

14. Protection-setting
workflow

1. Collect machine data. Obtain reactances, time
   constants, capability curves, negative-sequence limits, thermal data,
   stator/rotor grounding and prime-mover limits.
2. Define zones. Mark CT/VT boundaries and breakers
   for generator, GSU, auxiliaries and bus.
3. Model operating states. Include startup, shutdown,
   synchronising, islanded, grid-connected, weak-grid and emergency
   modes.
4. Calculate faults. Include generator current
   decrement, neutral grounding and minimum internal faults.
5. Set unit protection. Establish 87G and stator/rotor
   ground methods before backup elements.
6. Plot capability and damage limits. Coordinate 46,
   49, 40, 24, voltage and frequency elements with controls and grid-code
   ride-through.
7. Set mechanical-backup elements. Use approved
   reverse-power and process data.
8. Design trip classes. Trace every output to
   breakers, field, prime mover, lockout, auxiliaries and SCADA.
9. Coordinate backup and breaker failure. Ensure
   alternate breakers remove all sources if the generator breaker
   fails.
10. Validate dynamically. Test impedance/power
    trajectories, frequency ramps, V/Hz and state transitions—not only
    steady pickup values.

15. FAT programme

Factory acceptance testing should cover:

• CT/VT ratios, phase rotation, neutral polarity and protected-zone
  mapping;
• 87G characteristic, through-current stability and CT
  saturation;
• fundamental and 100% stator-ground methods over operating
  range;
• rotor-ground resistance thresholds and injection supervision;
• negative-sequence alarm, trip, thermal memory and reset;
• loss-of-excitation trajectories and power-swing security;
• reverse-power direction, pickup, timer and breaker-status
  gating;
• V/Hz points and timing against the approved curve;
• voltage/frequency ride-through and intentional delay logic;
• inadvertent-energisation logic through all generator states;
• synchronism-check angle, slip, voltage limits and VT failure;
• each trip class, breaker failure, lockout and auxiliary
  transfer;
• relay failure, DC supply loss, time synchronisation, IEC 61850 and
  SCADA;
• disturbance records and sequence-of-events resolution.

16. SAT and commissioning
tests

Site tests should prove the complete unit interface:

1. primary CT ratio, polarity and phase identification at neutral and
   terminals;
2. VT ratio, polarity, secondary earth and fuse-failure
   supervision;
3. generator differential stability with primary current or a validated
   end-to-end method;
4. neutral-grounding resistor/transformer values and stator-earth
   inputs;
5. measured third-harmonic levels across the promised operating range,
   if used;
6. rotor-earth injection path with excitation supplier
   participation;
7. RTD channel identity using controlled temperature/resistance
   simulation;
8. real and reactive power direction for 32 and 40 logic;
9. synchronism-check with controlled magnitude, angle, frequency and
   slip;
10. actual trip of generator breaker, field and prime mover for every
    trip class;
11. generator-breaker failure and alternate-source isolation;
12. startup, synchronising, online, islanded and shutdown state
    transitions;
13. SCADA, plant control, SOE and disturbance-record retrieval;
14. as-left settings comparison, drawing redlines and signed trip-matrix
    record.

Any live machine test must be planned with the generator, excitation
and prime-mover specialists. Secondary injection cannot prove mechanical
shutdown sequencing by assumption.

17. Common mistakes

• Copying settings from a generator with a different neutral-grounding
  method.
• Assuming 87G detects every stator ground fault near the
  neutral.
• Setting reverse power from rated MW rather than prime-mover motoring
  data.
• Ignoring generator fault-current decrement when grading overcurrent
  backup.
• Applying a third-harmonic 100% stator-ground method without
  measuring low-load behaviour.
• Coordinating V/Hz only with the generator and forgetting the GSU
  curve.
• Letting VT fuse failure drive false 40, 32, 24 or synchronism
  decisions.
• Tripping the generator breaker but leaving excitation or another
  source feeding an internal fault.
• Failing to arm inadvertent-energisation protection while the unit is
  stopped.
• Treating anti-islanding settings as ordinary machine protection
  without the interconnection study.
• Proving relay pickups but not the actual prime-mover, field and
  auxiliary trip matrix.

18. Design review checklist

The issued scheme should state:

• generator, prime-mover, excitation, GSU and grounding data
  sources;
• CT/VT locations and protection-zone boundaries;
• function equations, settings, firmware and enabled logic;
• machine capability/damage curves and coordination plots;
• grid-code and islanding requirements;
• trip classes and every physical/digital output consequence;
• breaker-failure and remote-clearing paths;
• alarm-response procedures and permitted running time;
• FAT, SAT, live commissioning and periodic test scope;
• settings governance, access control and disturbance-record
  retention.

Conclusion

Effective generator protection combines fast unit protection with
machine-specific abnormal-condition protection and an unambiguous
shutdown philosophy. CTs and VTs define what the relay can see;
generator and prime-mover limits determine when it must act; the trip
matrix determines whether the fault is truly removed. The final proof is
an integrated test that reaches the breaker, excitation, prime mover and
plant controls.

Authoritative
references and further reading

• IEEE
  C37.102, Guide for AC Generator Protection
• IEC 60034 series, Rotating
  electrical machines
• SEL-700G Generator
  Protection Relay
• Hitachi
  Energy REG670 Generator Protection
• Siemens
  SIPROTEC 7UM85 Generator Protection

Application note: Generator protection is machine-
and plant-specific. Obtain manufacturer capability and damage data, use
the contracted standard editions and validate the exact relay
implementation before approving settings or trip logic.

Related engineering guides

• VT Fuse-Failure and Loss-of-Potential Supervision: Logic, Blocking and Testing
• Neutral Grounding Resistor Protection and Monitoring in MV Systems
• Cable Differential Protection (87L): Design, Settings, Communications and Testing
• Medium-Voltage Capacitor Bank Protection: Unbalance, Settings and Testing