In short. Protection systems fail in two ways: failing to operate when needed, and operating when not needed. A failure-mode review lists each link in the chain, how it can fail, what the consequence is and what detects or tolerates it.
The protection chain
Sensor (CT or VT), wiring, relay, DC supply, trip circuit, breaker, and the settings and people that configure and maintain them. A weakness at any point defeats the rest.
Failure modes
| Link | Failure mode | Detect or mitigate |
|---|---|---|
| CT | Saturation, open circuit, wrong ratio or polarity | Correct class, commissioning tests, CT supervision |
| VT | Fuse blown, wrong phasing | VT fail detection, blocking |
| Relay | Hardware failure, firmware fault, wrong settings | Self-supervision, redundancy, settings control |
| DC supply | Battery degraded, charger failure, earth fault | Monitoring, load tests. See DC systems |
| Trip circuit | Open coil, broken wire, blown fuse | Trip circuit supervision |
| Breaker | Mechanism stuck, slow operation | Maintenance, breaker-failure scheme. See breaker failure |
| Settings | Incorrect, changed or lost | Version control, periodic comparison |
| Communication | Link loss for interlocks or schemes | Fallback modes, hard-wired backups |
| Human | Bypass left in place, links not restored | Procedures, checklists, permits |
Analysis method
- Draw the chain for each protected zone.
- For each link, list failure modes and effects.
- Rate severity, likelihood and detectability.
- Define mitigation: redundancy, supervision, testing, procedures.
- Review after incidents and changes.
Resilience measures
- Redundancy: two relays or two independent trip paths for critical zones.
- Diversity: different principles or manufacturers to avoid a common-cause fault.
- Supervision: monitor CTs, VTs, trip circuits, DC.
- Fail-safe states: define what happens if a relay fails (trip, block or alarm).
- Testing: periodic functional tests of the whole chain.
- Training and procedures.
Illustrative example
A review of a generator panel finds the trip path depends on a single fuse in the DC circuit that serves several relays. If the fuse blows, no relay can trip the breaker. The mitigation is separate fusing per protection group, with a supervision alarm, and a second trip coil on the breaker for backup protection.
Failure modes of a protection scheme
| Failure | Consequence | Mitigation |
|---|---|---|
| Fails to operate | Fault persists, wider damage | Backup protection, breaker failure scheme, testing |
| Operates incorrectly | Unnecessary outage | Review settings, filters, coordination |
| Loss of DC supply | No tripping at all | Redundant DC, supervision, alarms |
| CT or VT fault | Wrong measurements | Supervision functions, checks |
| Wiring or setting error | Hidden disabled function | Commissioning tests, change control |
| Software or communication fault | Loss of control or visibility | Local manual operation, watchdog alarms |
Analysis method
- List each protection function and what it protects.
- For each, list how it could fail and how that would be noticed.
- Decide what backs it up.
- Close gaps with design change, supervision or test.
Hidden failures
The dangerous failure is the one nobody knows about until a fault arrives. Self-supervision, periodic tests and alarms on loss of supply make hidden failures visible.
Human factors
- Clear labels and procedures reduce wrong switching.
- Controlled access to settings.
- Training for staff on emergency response.
See breaker failure protection and lifecycle testing.
Common mistakes
- Focusing on relay settings and ignoring supply and trip circuits.
- Common-mode failure paths.
- No fallback when communication fails.
What to send us
Send protection schematics and the single-line diagram. Send your application details. See also electrical FMEA.
Questions engineers ask
What is a common-cause failure?
One event or defect disabling both a primary and its backup, such as a shared supply.
Is redundancy always needed?
Not everywhere. Match it to consequence and criticality.
How can I detect hidden failures?
With supervision functions and periodic functional tests.
What should a relay do if it fails?
That is a design choice. Define it, test it, and alarm it.
This guide gives general principles. Reviews should be made by qualified engineers.