Transformer Protection Explained: Buchholz Relay, Sudden Pressure and Differential Protection

Most transformer failures do not happen on the day the unit is switched in. They develop quietly inside a tank where nobody can see them, and then take a week of production with them when they finally let go. That is the gap transformer protection exists to close, and most of the decisions that close it are made when the unit is ordered rather than when it is commissioned.

Start with the failure statistics. The IEEE Power & Energy Society transformer protection application guide reproduces utility failure surveys, and in the 1983-1988 survey period winding failures accounted for 37% of recorded failures while tap changer failures accounted for 22%. Bushing failures, the ones everybody worries about because they are visible, came in at 11%. Terminal board failures were 3% and core failures 1%.

Read those numbers twice. The two failure modes that actually destroy a transformer happen inside the tank, out of sight, and they are exactly the two that a walking inspection programme cannot catch.

Where Transformer Protection Budget Actually Belongs

Protection is not one product. It is a set of devices, each watching a different failure mechanism, and the ANSI device numbers are how a specification talks about them. On a conservator oil-immersed unit a normal package looks like this:

• 87P - phase differential, the main comparison of current in against current out
• 87U - unrestrained differential, the fast element that clears a heavy internal fault
• 87N - ground differential, also called restricted earth fault
• 63 - sudden pressure, tripping on the rate of pressure rise inside the tank
• Gas relay (Buchholz) - gas accumulation alarm and oil-surge trip
• 49 - thermal, normally a top-oil RTD plus winding hot-spot simulation
• 51 / 50 - time and instantaneous overcurrent, the backup layer
• 86 - the lockout relay where the trip signals land

Two devices sit in the oil path, two compare currents through the bushings, one reads temperature, and the rest form the backup layer that steps in when the primary scheme is out of service. A specification that lists protection as a single line item has not decided anything yet.

Order of importance is not order of price. A gas relay costs a fraction of a differential relay, and against the failure data above it covers the failure mode with the largest share.

Buchholz Relay: The Gas and Oil-Surge Watchdog

The Buchholz relay exists only on oil-immersed transformers that have a conservator, and it sits in the pipe between the tank and the conservator. That location is the whole point: it is in the oil path, so it sees what the active part actually does.

Two elements share one housing. A float rises as gas collects at the top of the chamber and closes an alarm contact. A flap sits in the oil stream and trips when oil moves toward the conservator faster than its setting. In our factory the connecting pipe is set with a slight upward slope from the tank so gas travels to the relay instead of pooling in the pipe, and the relay is mounted at a height a technician can reach from the ground without a scaffold.

Alarm and trip are not the same decision, and landing both contacts on one input throws away the most useful signal the device produces. An incipient fault - a hot joint, a partial-discharge site, a slowly developing inter-turn fault - generates gas over hours or days, and the float element reports it while the transformer is still carrying load. That is the window to pull an oil sample and run dissolved gas analysis before a warning becomes an outage. In the first weeks after energization a gas alarm is usually residual air working its way out of the oil rather than a fault. Usually is not the same as certainly, which is why you sample.

Here is the trap that catches project specifications. A sealed-tank design without a conservator has no Buchholz relay at all, and one cannot be added later. If the owner standard assumes a gas relay, it has to be written into the order.

Sudden Pressure Relay: The Fast Trip for Tank Faults

The 63 device does not wait for gas to travel anywhere. A sudden pressure relay responds to the rate of pressure rise inside the tank, so it operates on the first pressure wave from a high-energy internal fault. In the application guide it is grouped with the differential elements as primary fault protection, and it appears twice in the device list because the main tank and the tap changer compartment each get their own device.

There are two mounting families. A gas-space relay sits on the tank top above the oil; an oil-space relay mounts in a valve or a pipe below the oil level. Both are trip-only. That changes how you treat them. A device that can trip but cannot alarm has to be right the first time, because a nuisance lockout takes the unit out of service while you work out whether the problem is the transformer or the setting. Choosing the setting is relay work. Making sure the main tank and the LTC compartment are both covered is buyer work.

Do not confuse it with the pressure relief device. A PRD is a mechanical vent that opens to stop the tank rupturing. It has no trip logic and nothing to set. A specification that asks for sudden pressure protection and receives only a PRD has bought tank protection, not fault detection. On a large power transformer you normally want both, as separate line items.

Differential Protection, 87P and 87N: Where Transformer Protection Specs Go Wrong

The principle takes one sentence: compare the current going into the transformer with the current coming out, and treat the difference as fault current. Making it work takes more. The two sides sit at different voltages and, on a Dyn11 unit, 30 degrees apart in phase. Differential protection cannot make that comparison until CT ratios are normalised and the vector group is compensated.

Inrush is the part most buyers miss. Energizing a transformer draws a large magnetizing inrush with a heavy second-harmonic content, and the measure quoted in the application guide is a classic one: 12 times full load current for 0.1 second. A differential element that cannot tell that apart from a fault will trip the unit every time it is switched in, and the maintenance crew will blame the transformer. Numeric relays separate the two with harmonic restraint or second-harmonic blocking, and they add an unrestrained 87U element set far above the maximum inrush level so that a genuine heavy internal fault still clears fast.

87N, the ground differential element also called restricted earth fault, is the sensitive one. The guide worked example is a pair of 115 kV / 30 MVA transformers with a resistance-grounded 13 kV side limiting ground fault current to about 400 A each. With the neutral impedance holding fault current that low, a plain overcurrent element is too blunt to see a fault near the neutral, and REF is what covers it. An REF scheme is only as good as the current transformers behind it, and their classification and performance requirements for relaying are set out separately in the IEEE C37.110-2023 standards series. Ask for the class, the ratio and the accuracy limit factor, not simply CTs included.

What Arrives With the Unit, and What Does Not

Devices are half of the scheme. The other half is what the manufacturer is asked to build into the transformer, and every row below is locked in at the order stage.

Every row is a transformer-order decision. A differential protection scheme delivered after the unit lands cannot compensate for a vector group that conflicts with the rest of the plant, and a temperature device without a communication output cannot feed the SCADA point the operating team has already written into their procedures. Settle these in the RFQ, next to the rating and the impedance.

One more piece of housekeeping belongs at that stage. Take a dissolved gas analysis baseline on the oil before energization. A DGA result read during an event is close to unreadable without a pre-event sample from the same unit, because you cannot tell whether 300 ppm of hydrogen is new or has been sitting in the oil since the factory test.

Sourcing the Transformer and Its Protection as One Package

Ryan Electric has been building transformers since 2007, from a 120,000 m2 facility with more than 180 sets of production and test equipment and 37 patents behind the designs. Since 2023 the company has operated as an Eaton joint venture partner, which matters more here than on a datasheet page: the protection-relevant documentation - temperature-rise test records, loss data, winding connection diagrams and UL, CSA, IEEE, DEKRA and CNAS test evidence - is written for the same reviewers our North American clients answer to.

The practical advice from our engineers is to send the protection one-line with the RFQ rather than after it. A one-line diagram tells us which devices the owner expects, whether the neutral is impedance-grounded, and what the paralleling arrangement on site looks like. That single page usually catches a vector-group conflict or a missing CT class before the design freezes. Once the design freezes, the same problem becomes a change order.

If you are specifying a unit now and the protection package is still open, send us the rating, the site conditions and your protection one-line through ryan-transformers.com. We will return a transformer protection package in one document set - device schedule, CT data, certification files - so nothing has to be re-ordered after the unit lands.

About the Author: This article was written by the engineering team at Ryan Electric, a transformer manufacturer established in 2007 and an Eaton joint venture partner since 2023, producing oil immersed, dry type, pad mounted, rectifier and energy storage transformers under UL, CSA, IEEE, DEKRA and CNAS certification for clients across North America, Southeast Asia, the Middle East and Africa.