Oil-Immersed Transformer Protection: Buchholz Relay, Overcurrent and Differential Specs Buyers Should Know

A procurement manager for a Chilean mining contractor called us in July with a question we hear more often than buyers expect: if he ordered a 15 MVA oil immersed transformer from our factory, did protection come included, or did he have to source it separately? The short answer is both. Tank-mounted devices ship with the unit, but relay settings, CT ratios and trip logic are decided together with the buyer's protection engineer — and most field failures we get called about trace back to that handover, not to the transformer itself.

Protection exists for one reason: an internal fault produces energy the tank was not designed to contain forever. With a typical 7% percent impedance, a bolted fault at the terminals can drive current to more than fourteen times the nameplate rating. A winding short inside the tank pushes that energy into the oil in milliseconds. The protection scheme's job is to detect the event early — electrically, hydraulically or thermally — and disconnect the unit before the tank ruptures or the oil ignites.

 

What Protection Actually Ships on an Oil-Immersed Transformer

Transformer protection on an oil immersed transformer divides into two groups. First, devices mounted on the tank itself: the Buchholz gas relay on the pipe between the main tank and the conservator, a pressure relief device on the tank cover, oil temperature and winding temperature indicators with alarm contacts, and an oil level gauge. Second, external protection relays in a cubicle or substation panel: overcurrent, differential and earth-fault functions that trip the breaker on the primary side.

That split matters for buyers. The tank-mounted devices are part of the transformer scope — the factory installs, wires and tests them. The external relay scheme is usually defined in the project protection philosophy, and its settings belong to the utility or the EPC's protection engineer. The most common gap we see: the buyer assumes the factory scope covers relay coordination, and the protection engineer assumes the transformer arrived with a fully wired protection panel. Both end up wrong, and commissioning stalls.

 

The Buchholz Relay: The Only Device That Looks Inside the Tank

The Buchholz relay sits in the pipe connecting the main tank to the conservator, full of oil in normal service. It catches two different signatures of trouble. Slow faults — insulation ageing, a loose connection, small partial discharges — generate gas that rises and collects in the relay chamber. When the gas volume reaches the first-stage threshold, a float drops and closes the alarm contact. Violent faults, like a phase-to-phase short between windings, push a surge of oil through the pipe. The surge tilts a baffle and closes the trip contact almost instantly, far faster than any electrical measurement downstream can respond.

In our test bay, every Buchholz relay is bench-tested before mounting. We inject air through the oil inlet to verify the alarm float operates at the specified gas volume, then run a surge test to confirm the trip contact closes and the wiring reaches the marshalling box. The contact wiring is photographed and filed into the FAT documentation, because on a remote site a wrongly wired alarm contact costs a technician a full day of tracing. It sounds like a small thing. It is the kind of small thing that decides whether a first fault is an alarm or an unnecessary trip.

Installation detail is where gas relays earn their reputation. The relay must be mounted level, with its arrow pointing toward the conservator — oil flows that way in normal service, and gas travels the same route. We once visited a site where the relay had been fitted with flange gaskets trapping a visible air pocket; the alarm operated within a week on accumulated gas that had never come from a fault. The oil sampling point and the relay's test valve are the two fittings worth locating before the unit is boxed, because both get used within the first year of operation.

 

Overcurrent and Differential Protection: What the Device Numbers Mean

External relay protection speaks in ANSI/IEEE device numbers, and the three you will meet on almost every distribution-class order are 50, 51 and 87T. 50 is instantaneous overcurrent: it trips fast on fault current far above load. 51 is time-delayed overcurrent: it coordinates with downstream devices so a fault on a feeder clears at the feeder, not at the transformer. 87T is transformer differential protection: it compares current entering the primary winding with current leaving the secondary, measured through CTs on both sides, and trips when the two stop matching — the fastest reliable way to detect winding faults inside the tank.

The IEEE guide for protecting power transformers (IEEE C37.91-2021) states its scope as three-phase units above 5 MVA rated capacity operating above 10 kV, and recommends a full scheme — including differential — at that level. Below it, fuses or coordinated overcurrent relays are common practice, which is why a small distribution unit rarely carries differential while a 15 MVA power transformer should. If your protection engineer has not asked for differential on a unit above that size, ask why. The guide is public reference material and worth a read before your next RFQ.

Setting philosophy is a subject of its own, but one number belongs in every buyer's vocabulary: transformer inrush. When an oil immersed transformer is energized, magnetizing current can reach eight to twelve times rated current for the first few cycles before decaying. An instantaneous overcurrent element set below that level trips the unit on every normal energization. That is why 50 elements are set above inrush or briefly blocked at closing, why 51 elements coordinate with downstream feeder protection, and why differential relays use harmonic restraint — they ignore the inrush while still seeing a true internal fault. Your supplier does not choose these settings; your protection engineer does. What the transformer factory must deliver is the test data — impedance, saturation curve, no-load loss — that makes the coordination study possible.

 

Pressure Relief, Temperature and Oil Level: The Rest of the Scheme

Three more tank-mounted devices deserve a line in your spec. The pressure relief device vents the tank if internal pressure rises faster than the gas relay can respond — think of it as the mechanical safety valve of the scheme. The oil temperature indicator and winding temperature indicator carry alarm and trip contacts, typically set against the top-oil temperature that corresponds to a 65 K average winding rise design. And the oil level gauge with a low-level alarm catches the slow leaks a gas relay cannot, because a conservator draining empty is usually a maintenance problem before it becomes a protection event.

One RFQ point here: ask for the contact list. Specify how many spare alarm and trip contacts each device must carry, whether contacts are rated for your panel's DC control voltage (24, 48, 110 or 220 V DC are the common ones), and whether the marshalling box includes terminal blocks, a heater and gland plates. Retrofitting contacts after delivery is disproportionately expensive. Specifying them costs one line in the RFQ.

 

Factory Tests That Prove the Protection Works

Protection is only as good as the wiring behind it, so we test twice. First come the routine electrical tests under IEEE C57.12.00: ratio, polarity, winding resistance, no-load and load loss, impedance, and dielectric tests. Then the protection checks that never appear on a standard routine test list: CT polarity and ratio verification, continuity from every alarm contact through to the marshalling box terminals, and a primary injection test where we drive current through the CTs to prove the relay sees the correct magnitude and direction.

 

 

Last year a client's third-party inspector asked to witness a primary injection on a 20 MVA unit bound for Southeast Asia. The test caught one CT secondary wired with reversed polarity inside the marshalling box. Caught in the factory, it was a two-hour fix. Caught on site, it would have meant a differential misoperation on first energization — and a claim conversation nobody wants to have. That is why the FAT protection section deserves the same attention as the loss figures in the test report.

Numerical relays now do the work that used to require a wall of electromechanical units, and many projects pull relay data over Modbus or IEC 61850 instead of a dry contact alone. Whatever protocol you choose, the factory question stays the same: has the protection loop been tested end to end, from the CT terminals to the breaker trip coil? A relay can be perfectly configured and still fail to trip if a CT secondary is open or a trip wire is landed on the wrong terminal — which is why end-to-end testing at FAT is cheaper by an order of magnitude than the same test on site.

 

Six Questions to Put in Your RFQ

1. Which protection devices are factory-mounted and wired, and which ship loose?
2. Buchholz relay: brand and model; are alarm and trip stages bench-tested, with photos in the FAT file?
3. CTs: ratio, accuracy class (a protection class such as 5P20), and polarity diagram included in the drawings?
4. Do temperature, oil level and pressure devices carry spare contacts for future SCADA connection?
5. Does the factory test report include CT primary injection and contact continuity, or only routine electrical tests?
6. What protection documentation ships with the unit — wiring diagrams, relay manuals, test certificates?

Here is why this matters in practice. A utility buyer we work with in the Middle East standardizes every substation order on one relay platform and one set of contact specifications. On our side, that standardization means the same wiring schedule, the same test procedure and the same spare parts list for every unit, which shortens FAT and makes the handover to his commissioning team predictable.

Ryan Electric has built distribution and power transformers since 2007 in a 120,000 m² facility, and the partnership with Eaton that began in 2023 keeps our component sourcing and FAT discipline aligned with what global utilities expect. Thirty-seven patents and UL, CSA, IEEE, DEKRA and CNAS certifications back the routines above — none of which replaces your protection engineer's settings, and all of which make his job easier.

If you are specifying an oil immersed transformer for a utility, mining or industrial project, send us your load data, system voltage and protection philosophy with your inquiry. Our engineers will confirm the protection scope, the test program and the documentation package before you commit to a purchase order. Use our contact page or request a quote directly, and we will come back with answers, not a brochure.

About the Author: This guide was written by the engineering and export team at Ryan Electric, a China-based transformer manufacturer founded in 2007. The team supports utility, EPC and industrial buyers across North America, Southeast Asia, the Middle East and Africa with application engineering, certification support and factory test documentation.