Protection reliability is a property of the complete chain, not the relay alone. A certified IED cannot compensate for wrong CT polarity, an open trip link, an unavailable DC supply or a mechanically sluggish breaker. Functional assurance connects the design claim to evidence from every layer.
State the top-level claim
Write a precise claim such as: “For faults within feeder zone F1 and the defined operating envelope, the protection system detects the fault, selects breaker Q1 and interrupts it within the required clearing time; credible single failures produce the specified backup action and alarm.” Vague claims such as “protection tested” cannot drive an adequate test plan.
Decompose the chain
Break the claim into measurement, wiring or network transport, IED algorithm, logic and interlocking, output interface, DC supply, trip coil, mechanism and breaker interruption. For each part, record the required behaviour, failure modes, detection provisions, maintenance evidence and dependencies.
Use FMEA to expose silent failures
Consider loss, delay, incorrect value, incorrect mapping, spurious output and common-mode failure. Examples include CT saturation, VT fuse failure, swapped phase labels, stale Sampled Values, GOOSE subscription error, disabled protection stage, test switch left open, common DC fuse loss, trip-coil open circuit and mechanism seizure. Rate consequence and detectability, not just probability.
Map every claim to evidence
Design evidence includes calculations, approved settings and schematics. Product evidence includes type tests and certificates within their actual scope. FAT proves the assembled panel and configured logic under factory conditions. SAT proves site wiring, communications, polarity, intertrips and breaker operation. Maintenance tests preserve the claim after ageing and change.
Avoid the component-test trap
Testing CT ratio, relay pickup and breaker timing separately does not prove the wired system selects the correct breaker. Include at least one end-to-end test per protection path and operating mode. For schemes with two trip coils, duplicate DC systems or redundant communications, prove independence by deliberately removing each channel.
Define evidence quality
Each result should identify test equipment, calibration status, injected quantities, start/stop events, expected value, tolerance, actual value, pass/fail decision, configuration checksum and witness. Screenshots without context are weak evidence; a structured record that another engineer can reproduce is strong evidence.
Turn failures into design improvement
A failed test is useful when the root cause and correction are controlled. Record whether the failure came from design, manufacture, configuration, documentation, test method or site interface. Update the FMEA and regression-test set so the same class of defect is detected earlier on future panels.
Official sources and revision control
- IEC TS 60255-216-1:2025 official record
- IEC 61850-10 consolidated edition official record
- IEC 62271-200:2021+AMD1:2024 official record
- OMICRON CMC 500 official product page
Technical review date: 16 August 2026. Standards and product capabilities can change; confirm the project-specific edition, firmware, options and ordered configuration before engineering or procurement.