Transformer Protection Explained: Differential, REF, Overcurrent and More

A transformer is one of the most expensive single items in a substation, and a fault inside it can destroy it in seconds while threatening everything around it. Protection is what stands between a fault and a catastrophe: it detects the fault, identifies it as internal, and removes the transformer from service fast enough to limit the damage. This guide explains transformer protection in plain language — the main schemes, what each one watches, why several overlapping schemes are used instead of one, and how they are coordinated and tested. It is written for engineers, technicians and students who want to understand protection schemes, not just memorise their names.

As with everything on this site, always work to your project specification, the manufacturer's instructions and your site safety rules; the general guidance here never overrides those documents. Protection testing involves secondary injection and trip-circuit operation, and it is carried out only by competent persons under permit, with the plant made safe. If you are new to transformer testing as a whole, start with our power transformer testing and commissioning guide, which puts protection in context alongside the routine and type tests.

The job of protection: fast, selective, dependable

Good protection has three qualities, and they pull against each other, which is why protection design is a discipline in its own right. It must be fast, because fault energy grows with time and a transformer fault that burns for seconds does far more damage than one cleared in a fraction of a second. It must be selective, because tripping the wrong equipment — or everything — for an external fault turns a local problem into a blackout. And it must be dependable, meaning it operates when it should, and secure, meaning it does not operate when it should not. Every scheme below is a different trade-off between those qualities, which is exactly why transformers carry several of them at once: no single scheme is fast, selective and dependable for every kind of fault.

Protection is also layered by zone. Each scheme watches a defined zone — the transformer windings, one winding, the tank and oil system, or the connected circuits — and schemes overlap at their boundaries so that no part of the plant is left unwatched. When a fault occurs, the scheme whose zone contains it should operate first, and backup schemes should operate only if the primary scheme or its breaker fails. Understanding a protection scheme therefore always starts with the same question: what zone does it watch, and what symptom does it look for?

Differential protection: comparing what goes in with what comes out

Differential protection is the principal electrical protection for a power transformer, and its idea is beautifully simple. Current transformers on each side of the transformer measure the current entering and the current leaving. Under healthy conditions, after allowing for the transformer's ratio and vector group, those currents balance: what goes in comes out, allowing for the small magnetising current. When an internal fault occurs — a winding short circuit, a turn-to-turn fault, an earth fault inside the zone — current is diverted or an extra path appears, the balance breaks, and the relay operates. Because it compares currents rather than measuring their size, differential protection can be both very fast and very sensitive, detecting internal faults that overcurrent protection would take far longer to see, if it saw them at all.

Making that simple idea work in practice takes care, and the classic problems are worth knowing. The currents on each side differ in magnitude because of the transformer ratio, and in phase because of the vector group, so the relay or its current transformer connections must compensate for both — modern numerical relays do this in software, with the vector group and ratio entered as settings. Tap changer position changes the ratio slightly, producing a small standing differential current that the relay must tolerate through a bias or percentage characteristic: the more current flows, the larger the differential current needed to trip. And energisation draws a magnetising inrush current that flows on one side only, looking exactly like an internal fault; relays deal with this by detecting the second-harmonic content that characterises inrush and restraining or blocking the trip while it is present. A differential relay that trips on every energisation has not failed — it has been set or wired wrong, and the fix is in the compensation, bias or harmonic restraint settings, not in disabling the protection.

Restricted earth fault protection: guarding one winding closely

Restricted earth fault protection, usually abbreviated REF, watches a single zone: one winding of the transformer and its neutral connection. It compares the sum of the winding phase currents with the current in the neutral, and it operates when they do not balance, indicating an earth fault within that zone. Its value is its sensitivity where differential protection is weakest. An earth fault close to the neutral point of a star winding produces only a small fault current, limited by the small number of turns involved and by any neutral earthing resistor, and differential protection may not see it at all. REF, watching that one winding closely, sees it clearly.

REF is fitted to windings where that sensitivity matters — typically the star winding of a large transformer, and often both windings on very large or critical units. It must be stable for faults outside its zone: an external earth fault can drive large currents through the neutral, and the relay must not operate for those, which is achieved by its connection arrangement and by restraint. Testing REF means proving both sides of that behaviour: that it operates for a simulated fault inside the zone, including near the neutral, and that it remains stable for a simulated external fault. Like differential protection, it is checked by secondary injection at commissioning and at planned intervals, with the trip circuit proved through to the breaker.

Overcurrent and earth fault protection: the backup layer

Overcurrent and earth fault protection are the workhorses of the backup layer. Overcurrent relays operate when current exceeds a set threshold for a set time, with inverse-time characteristics that trip faster for larger currents. Earth fault relays do the same for the residual current — the imbalance between phase currents that indicates current flowing to earth. They are simple, robust and well understood, and they protect against faults that the main schemes miss, as well as providing backup if a main relay or breaker fails. Their weakness is speed and sensitivity for internal faults: they must be set above normal load, above inrush, and above the largest external fault current they should ignore, which limits how fast and how sensitively they can respond to a fault inside the transformer.

Coordination is the art of making this layer work with everything else. Overcurrent settings are graded with upstream and downstream devices so that the device nearest the fault operates first, and time grading gives each device its chance in turn. On the transformer itself, overcurrent protection also provides a form of overload awareness, although sustained overload is primarily a temperature matter handled by temperature alarms and trips. Earth fault protection on the neutral, sometimes called standby earth fault, watches the whole earthed system from the transformer neutral and is typically time-delayed so that feeder earth fault protection clears its own faults first. The pattern is consistent: fast, sensitive schemes for internal faults, slower graded schemes as backup, and each scheme's settings justified by calculation, not by habit.

Non-electrical protection: Buchholz, pressure and temperature

Not all transformer protection is electrical. The Buchholz relay watches gas and oil surges in the pipe to the conservator, alarming on slow gas accumulation and tripping on a sudden surge — the physical signature of an internal fault, including slow overheating that electrical schemes may not see until late. The pressure relief device guards the tank itself: a severe internal fault generates gas and pressure very fast, and the relief device vents that pressure before the tank ruptures, while its operation contact trips the transformer. Sudden pressure relays detect the rate of pressure rise rather than the absolute pressure, and operate faster than a relief device alone for violent faults.

Temperature protection guards the slow enemy: overheating. Winding temperature indicators, derived from top-oil temperature and load current, raise alarms at one level and trip at a higher level, protecting the insulation from accelerated ageing and from damage during overloads. Top-oil temperature does the same for the oil system, and is also the input to cooling control, starting fans and pumps in stages. These devices are sometimes dismissed as mere alarms, but they prevent more transformer damage over a lifetime than any trip, because they catch overloads, cooling failures and abnormal loading early, while the fix is still load reduction or a fan motor rather than a repair.

Coordination, testing and the human factor

A protection scheme is only as good as its settings, its wiring and its testing, and all three deserve attention. Settings come from fault studies and from the transformer and current transformer data: ratios, vector groups, earthing arrangements, fault levels and grading margins all feed into them, and every setting should be traceable to a calculation. Wiring is proved by primary injection where practicable — actually passing current through the primary circuit and confirming that each relay sees what it should — because secondary injection alone cannot catch a current transformer wired to the wrong phase or with reversed polarity. Trip circuits are proved through to the breaker, including lockout relays, so that a relay operation genuinely takes the transformer out of service.

Finally, protection depends on people treating operations seriously. Every trip is investigated, not just reset: the event record, fault record and relay targets are read, the fault is identified or excluded, and the transformer is tested before re-energisation. A relay that operated correctly and is reset without investigation may be hiding a developing fault; a relay that operated incorrectly and is reset without investigation will do it again. The best protection schemes in the world are defeated by the habit of resetting first and asking questions later. The discipline is simple: read the evidence, find the cause, fix it, test it, and only then re-energise.

Frequently asked questions

Why does a transformer need differential protection as well as overcurrent protection?

Overcurrent protection responds to how much current flows, so it must be set above normal load and inrush, which makes it slow for internal faults. Differential protection compares the currents entering and leaving the transformer, so it can detect an internal fault quickly and sensitively while ignoring load and external faults.

What is restricted earth fault protection?

Restricted earth fault protection watches only a defined zone, usually one winding and its neutral, by comparing the winding phase currents with the neutral current. It is highly sensitive to earth faults inside that zone, including faults near the neutral that differential protection can miss.

Why do transformers sometimes trip on energisation, and how is that prevented?

Energising a transformer draws a large magnetising inrush current, rich in second-harmonic content, which can look like a fault to a differential relay. Modern relays restrain or block on second harmonic during energisation, so inrush is tolerated while a genuine internal fault, which has little second harmonic, still trips.