Worked Example: Transformer Protection Coordination Study — The Sayano-Shushenskaya Dam Disaster

On 17 August 2009, a catastrophic failure at the Sayano-Shushenskaya hydroelectric dam in Siberia killed 75 workers and destroyed 9 of 10 turbine generators (6,400 MW total capacity). Turbine Unit 2 experienced a turbine cover blowout caused by metal fatigue from years of vibration, launching the 900-tonne rotor assembly through the turbine hall ceiling. The resulting flood destroyed the plant’s entire electrical infrastructure.

The investigation revealed that the plant’s protection systems should have detected abnormal vibrations and tripped the generator months before the catastrophic failure. But protection relay coordination between the generator, step-up transformer, and grid connection was misconfigured. Vibration-induced harmonic currents were not recognised as fault conditions because the protection was set only for fundamental-frequency overcurrent and earth fault — not for the harmonic distortion signature of a mechanically damaged generator.

While the Sayano-Shushenskaya disaster involved generator-class equipment far larger than most engineers will ever design, the protection coordination principle is identical at every voltage level. When a 1,000 kVA distribution transformer feeds an LV switchboard, the same discipline must ensure that a fault on an outgoing circuit trips the local MCCB — not the upstream transformer fuse. Getting this wrong means a localised fault blacks out the entire building instead of just the affected circuit.

Perform a protection coordination study for a 1,000 kVA distribution transformer feeding an LV switchboard with multiple outgoing circuits.

Primary (11 kV) rated current:

I_n1 = S / (√3 × V₁) = 1,000,000 / (√3 × 11,000) — (Eq. 1)

I_n1 = 52.5 A

Secondary (415 V) rated current:

I_n2 = S / (√3 × V₂) = 1,000,000 / (√3 × 415) — (Eq. 2)

I_n2 = 1,391 A

The 11 kV source fault level is 250 MVA. The source impedance referred to the 415 V side:

Z_source = V₂² / S_source = 415² / 250,000,000 — (Eq. 3)

Z_source = 172,225 / 250,000,000 = 0.000689 Ω (0.689 mΩ)

This is the upstream network impedance as seen from the 415 V secondary bus. It is very small compared to the transformer impedance, meaning the transformer dominates the fault current calculation.

The transformer’s impedance referred to the secondary (LV) side, per IEC 60909-0, Clause 6.3:

Z_T = u_k% × V₂² / (100 × S_n) — (Eq. 4)

Crucially, IEC 60076-1 Clause 9.1 allows a manufacturing tolerance of ±10% on the declared impedance. We must calculate at all three values:

The total impedance is the sum of source and transformer impedance. The three-phase symmetrical short-circuit current per IEC 60909-0, Clause 4.2:

I_k” = c × V_n / (√3 × Z_total) — (Eq. 5)

Where c = 1.0 (voltage factor for maximum current calculation per IEC 60909 Table 1, for LV systems).

The LV switchboard and all protective devices must be rated for the maximum prospective fault current, which occurs at minimum transformer impedance:

Switchgear fault rating ≥ 28.4 kA

Standard fault ratings for LV switchgear: 10, 16, 25, 36, 50, 65 kA.

Selected: 36 kA rated switchboard (next standard rating above 28.4 kA).

Protection coordination requires that for any fault current, the device closest to the fault trips first (discrimination). We check four levels of protection:

Level 1: Transformer HV fuse (63 A BS 88)

The HV fuse must be the last device to operate. At 28.4 kA on the LV side, the equivalent HV current is:

I_HV-fault = I_k” × V₂ / V₁ = 28,400 × 415 / 11,000 = 1,071 A (referred to HV side) — (Eq. 6)

BS 88 63 A fuse operating time at 1,071 A: approximately 0.01 s (well within the fuse’s fast-acting region).

Level 2: LV main MCCB (1,600 A, electronic trip)

Settings: Long-time pickup = 1.0 × In (1,600 A), long-time delay = 12 s. Short-time pickup = 3 × In (4,800 A), short-time delay = 0.2 s. Instantaneous = 12 × In (19,200 A).

At 28.4 kA: instantaneous trip in < 0.02 s.

Level 3: Outgoing MCCB (400 A, thermal-magnetic)

Magnetic trip at 10 × In = 4,000 A. At 28.4 kA: instantaneous trip in < 0.01 s.

Level 4: Final MCB (32 A Type C)

Type C magnetic trip at 5–10 × In = 160–320 A. At any fault exceeding 320 A: instantaneous trip in < 0.01 s.

The critical discrimination check is between the LV main MCCB and the outgoing MCCBs. For discrimination (selectivity), the upstream device must have a longer operating time than the downstream device at every fault current level.

At maximum fault current (u_k = 4.5%, I_k” = 28.4 kA):

At minimum fault current (u_k = 5.5%, I_k” = 23.6 kA):

The situation is slightly better because 23.6 kA exceeds the main MCCB instantaneous pickup (19.2 kA), so the main MCCB still trips instantaneously. Discrimination still fails.

For fault currents below the main MCCB instantaneous pickup (< 19.2 kA):

The main MCCB operates on its short-time delay (0.2 s) while the outgoing MCCB operates instantaneously (< 0.01 s). Discrimination margin: 0.19 s. ✓ Discriminates for faults below 19.2 kA.

To achieve full discrimination up to the maximum prospective fault current:

Option A: Increase the main MCCB instantaneous pickup (recommended):

Set the main MCCB instantaneous trip to its maximum: 20 × In = 32,000 A. Since the maximum fault current is 28.4 kA, the main MCCB will never enter its instantaneous region for transformer-fed faults. It will operate on the short-time delay (0.2 s) for ALL faults up to 28.4 kA, providing 0.19 s discrimination margin over the outgoing MCCBs.

Main MCCB settings (revised): Instantaneous = 20 × In (32,000 A) — (Eq. 7)

Option B: Use current-limiting outgoing MCCBs:

Current-limiting MCCBs interrupt the fault within the first half-cycle (5 ms at 50 Hz), limiting the let-through energy (I²t). If the outgoing MCCB’s let-through I²t is below the main MCCB’s non-trip I²t threshold, energy-based discrimination is achieved even when both devices operate in the instantaneous region.

Option C: Use zone-selective interlocking (ZSI):

A restraint signal from downstream MCCBs to the upstream MCCB prevents the upstream device from tripping in its instantaneous region when a downstream device detects the fault. This provides full discrimination at any fault level but requires compatible electronic trip units and interconnecting wiring.

Result: The ±10% impedance tolerance on the 1,000 kVA transformer produces a fault current range of 23.6–28.4 kA. Switchgear must be rated for the maximum (28.4 kA, requiring 36 kA rated equipment). Protection discrimination initially fails because the main MCCB’s instantaneous trip at 19.2 kA overlaps with the fault level range. Adjusting the instantaneous pickup to 20× In (32 kA) resolves the discrimination issue while maintaining short-time delay protection for all transformer-fed faults.

The Sayano-Shushenskaya disaster was caused by metal fatigue from vibration, not protection coordination failure per se. However, the investigation found that better-configured protection systems could have detected the deteriorating condition and tripped the generator before catastrophic failure:

• Always check discrimination at both impedance tolerance extremes — a protection grading study at nominal impedance only is incomplete and potentially dangerous
• Rate switchgear for maximum prospective fault current — use the minimum impedance tolerance (u_k − 10%) when calculating the fault current that switchgear must withstand
• Use the maximum impedance tolerance (u_k + 10%) when checking earth fault protection — higher impedance means lower fault current, which may be insufficient to trip the protective device within the required time
• Implement time-graded discrimination for all cascaded protection devices — the upstream device must have a deliberate time delay (typically 0.2–0.4 s) to allow the downstream device to clear first
• Document the protection study — a time-current grading chart showing all devices should be produced for every new installation and updated whenever protection settings are changed