IEEE - C37.119 - 2016 Guide Breaker Failure

IEEE Guide for Breaker Failure
Protection of Power Circuit Breakers
IEEE Power and Energy Society
Sponsored by the
Power System Relaying Committee
IEEE IEEE Std C37.119™-2016

3 Park Avenue (Revision of IEEE Std C37.119-2005)
New York, NY 10016-5997
USA
Authorized licensed use limited to: Universidad Nacional de Colombia (UNAL). Downloaded on August 17,2017 at 18:36:24 UTC from IEEE Xplore. Restrictions apply.
IEEE Std C37.119™-2016
(Revision of IEEE Std C37.119-2005)

Sponsor
Power System Relaying Committee

of the
IEEE Power and Energy Society
Approved 15 May 2016
IEEE-SA Standards Board
Abstract: Methods to protect a power system from faults that are not cleared because of failure of
a power circuit breaker to operate or interrupt when called upon by a protective relay are described
in this guide. The intent is to give the reader a guide in how to detect that a breaker has failed to
clear a fault, and how to electrically isolate the fault after the breaker has failed to clear the fault.
Additionally, schemes that provide primary protection of the power system from performance fail-
ures of the power circuit breaker other than fault clearing failures such as failure to operate, either
tripping or closing, manual or automatic, are also described. Such schemes, when applied, are typ-
ically integrated as a part of the overall breaker failure protection scheme. Also covered are recent
practices that take advantage of new technologies.
Keywords: BFP, breaker failure, breaker failure protection, circuit breaker, fault, IEEE C37.119™,
power system
The Institute of Electrical and Electronics Engineers, Inc.

3 Park Avenue, New York, NY 10016-5997, USA
Copyright © 2016 by The Institute of Electrical and Electronics Engineers, Inc.

All rights reserved. Published 16 July 2016. Printed in the United States of America.
IEEE is a registered trademark in the U.S. Patent & Trademark Office, owned by The Institute of Electrical and Electronics Engineers,
Incorporated.
PDF: ISBN 978-1-5044-2021-1 STD20939

Print: ISBN 978-1-5044-2022-8 STDPD20939
IEEE prohibits discrimination, harassment, and bullying.

For more information, visit http://www.ieee.org/web/aboutus/whatis/policies/p9-26.html.
No part of this publication may be reproduced in any form, in an electronic retrieval system or otherwise, without the prior written permission
of the publisher.
Important Notices and Disclaimers Concerning IEEE Standards Documents
IEEE documents are made available for use subject to important notices and legal disclaimers. These notices
and disclaimers, or a reference to this page, appear in all standards and may be found under the heading “Im-
portant Notice” or “Important Notices and Disclaimers Concerning IEEE Standards Documents.”
Notice and Disclaimer of Liability Concerning the

Use of IEEE Standards Documents
IEEE Standards documents (standards, recommended practices, and guides), both full-use and trial-use, are
developed within IEEE Societies and the Standards Coordinating Committees of the IEEE Standards Asso-
ciation (“IEEE-SA”) Standards Board. IEEE (“the Institute”) develops its standards through a consensus de-
velopment process, approved by the American National Standards Institute (“ANSI”), which brings together
YROXQWHHUVUHSUHVHQWLQJYDULHGYLHZSRLQWVDQGLQWHUHVWVWRDFKLHYHWKH¿QDOSURGXFW9ROXQWHHUVDUHQRWQHFHV-
sarily members of the Institute and participate without compensation from IEEE. While IEEE administers the
process and establishes rules to promote fairness in the consensus development process, IEEE does not inde-
pendently evaluate, test, or verify the accuracy of any of the information or the soundness of any judgments
contained in its standards.
IEEE does not warrant or represent the accuracy or content of the material contained in its standards, and
expressly disclaims all warranties (express, implied and statutory) not included in this or any other document
UHODWLQJWRWKHVWDQGDUGLQFOXGLQJEXWQRWOLPLWHGWRWKHZDUUDQWLHVRIPHUFKDQWDELOLW\¿WQHVVIRUDSDUWLFXODU
purpose; non-infringement; and quality, accuracy, effectiveness, currency, or completeness of material. In
addition, IEEE disclaims any and all conditions relating to: results; and workmanlike effort. IEEE standards
documents are supplied “AS IS” and “WITH ALL FAULTS.”
Use of an IEEE standard is wholly voluntary. The existence of an IEEE standard does not imply that there
are no other ways to produce, test, measure, purchase, market, or provide other goods and services related to
the scope of the IEEE standard. Furthermore, the viewpoint expressed at the time a standard is approved and
issued is subject to change brought about through developments in the state of the art and comments received
from users of the standard.
In publishing and making its standards available, IEEE is not suggesting or rendering professional or other
services for, or on behalf of, any person or entity nor is IEEE undertaking to perform any duty owed by any
other person or entity to another. Any person utilizing any IEEE Standards document, should rely upon his or
her own independent judgment in the exercise of reasonable care in any given circumstances or, as appropri-
ate, seek the advice of a competent professional in determining the appropriateness of a given IEEE standard.
,112(9(176+$//,(((%(/,$%/()25$1<',5(&7,1',5(&7,1&,'(17$/63(&,$/
(;(03/$5<25&216(48(17,$/'$0$*(6,1&/8',1*%87127/,0,7('72352&85(-
0(172)68%67,787(*22'6256(59,&(6/2662)86('$7$25352),7625%86,1(66
,17(55837,21+2:(9(5&$86('$1'21$1<7+(25<2)/,$%,/,7<:+(7+(5,1&21-
75$&7675,&7/,$%,/,7<257257,1&/8',1*1(*/,*(1&(2527+(5:,6($5,6,1*,1
$1<:$<2872)7+(38%/,&$7,2186(2)255(/,$1&(8321$1<67$1'$5'(9(1
,)$'9,6('2)7+(3266,%,/,7<2)68&+'$0$*($1'5(*$5'/(662):+(7+(568&+
'$0$*(:$6)25(6(($%/(
Translations
The IEEE consensus development process involves the review of documents in English only. In the event that
an IEEE standard is translated, only the English version published by IEEE should be considered the approved
IEEE standard.
2I¿FLDOVWDWHPHQWV
A statement, written or oral, that is not processed in accordance with the IEEE-SA Standards Board Operations
0DQXDOVKDOOQRWEHFRQVLGHUHGRULQIHUUHGWREHWKHRI¿FLDOSRVLWLRQRI,(((RUDQ\RILWVFRPPLWWHHVDQGVKDOO
not be considered to be, or be relied upon as, a formal position of IEEE. At lectures, symposia, seminars, or
educational courses, an individual presenting information on IEEE standards shall make it clear that his or her
views should be considered the personal views of that individual rather than the formal position of IEEE.
Comments on standards
Comments for revision of IEEE Standards documents are welcome from any interested party, regardless of
PHPEHUVKLSDI¿OLDWLRQZLWK,(((+RZHYHU,(((GRHVQRWSURYLGHFRQVXOWLQJLQIRUPDWLRQRUDGYLFHSHUWDLQ-
ing to IEEE Standards documents. Suggestions for changes in documents should be in the form of a proposed
change of text, together with appropriate supporting comments. Since IEEE standards represent a consensus
of concerned interests, it is important that any responses to comments and questions also receive the concur-
rence of a balance of interests. For this reason, IEEE and the members of its societies and Standards Coordi-
nating Committees are not able to provide an instant response to comments or questions except in those cases
where the matter has previously been addressed. For the same reason, IEEE does not respond to interpretation
requests. Any person who would like to participate in revisions to an IEEE standard is welcome to join the
relevant IEEE working group.
Comments on standards should be submitted to the following address:
Secretary, IEEE-SA Standards Board

445 Hoes Lane
3LVFDWDZD\1-86$
Laws and regulations
Users of IEEE Standards documents should consult all applicable laws and regulations. Compliance with the
provisions of any IEEE Standards document does not imply compliance to any applicable regulatory require-
ments. Implementers of the standard are responsible for observing or referring to the applicable regulatory
requirements. IEEE does not, by the publication of its standards, intend to urge action that is not in compliance
with applicable laws, and these documents may not be construed as doing so.
Copyrights
IEEE draft and approved standards are copyrighted by IEEE under US and international copyright laws. They
are made available by IEEE and are adopted for a wide variety of both public and private uses. These include
both use, by reference, in laws and regulations, and use in private self-regulation, standardization, and the pro-
motion of engineering practices and methods. By making these documents available for use and adoption by
public authorities and private users, IEEE does not waive any rights in copyright to the documents.
Photocopies
Subject to payment of the appropriate fee, IEEE will grant users a limited, non-exclusive license to photocopy
portions of any individual standard for company or organizational internal use or individual, non-commercial
use only. To arrange for payment of licensing fees, please contact Copyright Clearance Center, Customer Ser-
YLFH5RVHZRRG'ULYH'DQYHUV0$86$3HUPLVVLRQWRSKRWRFRS\SRUWLRQVRI
any individual standard for educational classroom use can also be obtained through the Copyright Clearance
Center.
Updating of IEEE Standards documents
Users of IEEE Standards documents should be aware that these documents may be superseded at any time by
the issuance of new editions or may be amended from time to time through the issuance of amendments, corri-
JHQGDRUHUUDWD$QRI¿FLDO,(((GRFXPHQWDWDQ\SRLQWLQWLPHFRQVLVWVRIWKHFXUUHQWHGLWLRQRIWKHGRFXPHQW
together with any amendments, corrigenda, or errata then in effect.
(YHU\,(((VWDQGDUGLVVXEMHFWHGWRUHYLHZDWOHDVWHYHU\\HDUV:KHQDGRFXPHQWLVPRUHWKDQ\HDUVROG
and has not undergone a revision process, it is reasonable to conclude that its contents, although still of some
YDOXHGRQRWZKROO\UHÀHFWWKHSUHVHQWVWDWHRIWKHDUW8VHUVDUHFDXWLRQHGWRFKHFNWRGHWHUPLQHWKDWWKH\KDYH
the latest edition of any IEEE standard.
In order to determine whether a given document is the current edition and whether it has been amended through
the issuance of amendments, corrigenda, or errata, visit the IEEE-SA Website at http://ieeexplore.ieee.org/xpl/
standards.jsp or contact IEEE at the address listed previously. For more information about the IEEE-SA or
IEEE’s standards development process, visit the IEEE-SA Website at http://standards.ieee.org.
Errata
(UUDWDLIDQ\IRUDOO,(((VWDQGDUGVFDQEHDFFHVVHGRQWKH,(((6$:HEVLWHDWWKHIROORZLQJ85/http://
VWDQGDUGVLHHHRUJ¿QGVWGVHUUDWDLQGH[KWPO8VHUVDUHHQFRXUDJHGWRFKHFNWKLV85/IRUHUUDWDSHULRGLFDOO\
Patents
Attention is called to the possibility that implementation of this standard may require use of subject matter
covered by patent rights. By publication of this standard, no position is taken by the IEEE with respect to the
existence or validity of any patent rights in connection therewith. If a patent holder or patent applicant has
¿OHGDVWDWHPHQWRIDVVXUDQFHYLDDQ$FFHSWHG/HWWHURI$VVXUDQFHWKHQWKHVWDWHPHQWLVOLVWHGRQWKH,(((
SA Website at http://standards.ieee.org/about/sasb/patcom/patents.html. Letters of Assurance may indicate
whether the Submitter is willing or unwilling to grant licenses under patent rights without compensation or
under reasonable rates, with reasonable terms and conditions that are demonstrably free of any unfair discrim-
ination to applicants desiring to obtain such licenses.
(VVHQWLDO3DWHQW&ODLPVPD\H[LVWIRUZKLFKD/HWWHURI$VVXUDQFHKDVQRWEHHQUHFHLYHG7KH,(((LVQRWUH-
VSRQVLEOHIRULGHQWLI\LQJ(VVHQWLDO3DWHQW&ODLPVIRUZKLFKDOLFHQVHPD\EHUHTXLUHGIRUFRQGXFWLQJLQTXLULHV
LQWRWKHOHJDOYDOLGLW\RUVFRSHRI3DWHQWV&ODLPVRUGHWHUPLQLQJZKHWKHUDQ\OLFHQVLQJWHUPVRUFRQGLWLRQV
provided in connection with submission of a Letter of Assurance, if any, or in any licensing agreements are
reasonable or non-discriminatory. Users of this standard are expressly advised that determination of the valid-
ity of any patent rights, and the risk of infringement of such rights, is entirely their own responsibility. Further
information may be obtained from the IEEE Standards Association.
Participants
At the time this IEEE guide was completed, the Breaker Failure Protection of Power Circuit Breakers Working
Group had the following membership:
Roger Whittaker, Chair
Adi Mulawarman, Vice Chair
Jeff Barsch Heather Malson Phil Tatro

Bob Beresh Aaron Martin Dennis Tierney
Brian Boysen Alexis Mezco Michael Thompson
Alla Deronja Dean Miller Ian Tualla
Michael Fleck Roy Moxley Eric Udren
Rick Gamble Pratap Mysore Johan Van Den Berg
Charles Henville Claire Patti Jun Verzosa
Craig Hiemenz Jeff Pope Don Ware
Alex Lee Dan Reckerd Ray Young
Jacob Lien Sam Sambasivan Rich Young
Jeff Long Lubomir Sevov Joe Uchiyama
Don Lukach Charles Sufana John Wang
Bruce Mackie Phil Zinck
The following members of the individual balloting committee voted on this guide. Balloters may have voted
for approval, disapproval, or abstention.
Ali Al Awazi Stephen Grier Bruce Muschlitz

Jay Anderson Randall Groves Dennis Neitzel
Thomas Barnes Nathan Gulczynski Michael Newman
Jeff Barsch Ajit Gwal Joe Nims
G. Bartok Craig Hiemenz James O’Brien
Michael Basler Robert Hoerauf Subhash Patel
Philip Beaumont Jerry Hohn Christopher Petrola
Bob Beresh Richard Jackson Charles Rogers
W.J. (Bill) Bergman Song Jin Thomas Rozek
Martin Best Laszlo Kadar M. Sachdev
Wallace Binder John Kay Bartien Sayogo
William Bloethe Jeffrey Kester Thomas Schossig
Brian Boysen Yuri Khersonsky Lubomir Sevov
Clarence Bradley Gary Kobet Nikunj Shah
Eldridge Byron Jospeph L. Koep¿nger Suresh Shrimavle
Paul Cardinal Boris Kogan Jeremy Smith
Arvind Chaudhary Jim Kulchisky Jerry Smith
Luis Coronado Saumen Kundu Ralph Stell
Randall Crellin Chung-Yiu Lam Michael Swearingen
Randall Cunico Raluca Lascu Michael Thompson
Ratan Das Jeffrey Long Demetrios Tziouvaras
Gary Donner Don Lukach Joe Uchiyama
Michael Dood Soung Hwan Lyu Roger Verdolin
Jerry Earl Bruce Mackie John Vergis
Keith Flowers Omar Mazzoni Quintin Verzosa
Dominick Fontana William McBride Ilia Voloh
Marcel Fortin Walter McCannon John Wang
Dale Fredrickson Dean Miller Kenneth White
Rafael Garcia John Miller Roger Whittaker
Frank Gerleve Jeffery Mizener Philip Winston
David Gilmer Adi Mulawarman Tamatha Womack
Mietek Glinkowski Jerry Murphy Ray Young
Edwin Goodwin Richard Young
6
Copyright © 2016 IEEE. All rights reserved.
When the IEEE-SA Standards Board approved this guide on 15 May 2016, it had the following
membership:
Jean-Philippe Faure, Chair

Ted Burse, Vice Chair
John D. Kulick, Past Chair
Konstantinos Karachalios, Secretary
Chuck Adams Gary Hoffman Mehmet Ulema

Masayuki Ariyoshi Michael Janezic Yingli Wen
Stephen Dukes Joseph L. Koepfinger* Howard Wolfman
Jianbin Fan Hung Ling Don Wright
Ronald W. Hotchkiss Kevin Lu Yu Yuan
J. Travis Griffith Gary Robinson Daidi Zhong
Annette D. Reilly
*Member Emeritus
7
Introduction
This introduction is not part of IEEE Std C37.119-2016, IEEE Guide for Breaker Failure Protection of Power Circuit
Breakers.
This guide is a revision to IEEE Std C37.119-2005. Corrections to timing diagrams describing particular
schemes have been made to improve clarity and accuracy. Precautionary statements have been added to
provide guidance based upon occurrence of recent power system events.
The definition and scope of breaker failure protection has been broadened to provide a more comprehensive
description of breaker failure protection, not only for power circuit breakers applied to transmission lines
but also for generator unit breakers. In addition to breaker failure initiation for fault conditions, initiation
from automatic or manual tripping and closing devices that detect potentially damaging non-fault
conditions is now included.
In addition to the breaker failure logic schemes previously provided by the guide, examples of best
practices of how to interconnect control power to redundant protective relay systems while providing
breaker failure functionality is provided. These methods increase the independence of the primary
protection from the local backup protection and thereby decrease the impact of single points of failure
within the overall protection scheme. Practical considerations are now included that describe application of
breaker failure protection to legacy equipment and modern microprocessor relays, and that describe the
interaction of the breaker failure protection scheme with local and remote controls including automatic
reclosing, lockout, and restoration functions.
Other additions to the guide include descriptions for column ground fault protection, breaker differential
protection, and tandem breaker protection. These protection functions are typically applied as a part of the
overall breaker failure protection scheme.
8
Contents
1. Overview .................................................................................................................................................. 11
1.1 General .............................................................................................................................................. 11
1.2 Scope ................................................................................................................................................. 12
1.3 Purpose .............................................................................................................................................. 12
2. Normative references................................................................................................................................ 12
3. Definitions, acronyms, and abbreviations ................................................................................................ 12

3.1 Definitions ......................................................................................................................................... 13
3.2 Acronyms and abbreviations ............................................................................................................. 13
4. Need for breaker failure protection........................................................................................................... 14
5. Breaker failure modes............................................................................................................................... 17
6. Breaker failure protection schemes .......................................................................................................... 18

6.1 Basic breaker failure scheme ............................................................................................................. 19
6.2 Basic breaker failure with re-trip logic .............................................................................................. 20
6.3 Breaker failure scheme for dual breaker arrangements ..................................................................... 21
6.4 Breaker failure scheme based on 50BF pickup time.......................................................................... 22
6.5 Breaker failure scheme with two-step timing arrangement ............................................................... 23
6.6 Breaker failure initiate seal-in............................................................................................................ 24
6.7 Breaker failure minimal current scheme ............................................................................................ 24
6.8 Dual timer breaker failure scheme with fast breaker auxiliary contact and current detector reset
check ........................................................................................................................................................ 27
6.9 Triple timer breaker failure scheme ................................................................................................... 28
6.10 Single-phase tripping, breaker failure, and re-trip logic .................................................................. 29
6.11 Breaker failure timer bypass scheme ............................................................................................... 29
6.12 Current differential breaker failure protection ................................................................................. 30
6.13 Ground fault breaker failure on both live tank circuit breaker and CT column failure.................... 31
6.14 Series (tandem) breakers.................................................................................................................. 32
6.15 Breaker failure protection for generator applications ...................................................................... 34
7. Breaker failure design considerations ....................................................................................................... 42

7.1 General considerations....................................................................................................................... 42
7.2 Breaker failure current supervision (50BF) ....................................................................................... 45
7.3 Breaker failure as part of the primary protection for an element ....................................................... 45
7.4 Breaker failure initiation .................................................................................................................... 47
7.5 Breaker failure actions ....................................................................................................................... 48
7.6 Practical considerations, applying breaker failure protection to redundant control circuits .............. 48
8. Factors influencing breaker failure protection settings ............................................................................. 57

8.1 General factors................................................................................................................................... 57
8.2 Current detector pickup ..................................................................................................................... 58
8.3 Breaker failure timer .......................................................................................................................... 59
8.4 Total clearing time requirements ....................................................................................................... 60
8.5 Control timer setting for scheme described in subclause 6.4 ............................................................. 60
9. Communications-based breaker failure protection ................................................................................... 61

9.1 Teleprotection in conventional breaker failure protection ................................................................. 61
9.2 High-speed peer-to-peer communications on substation LAN or system WAN ............................... 61
9
10. Breaker failure relay and breaker failure protection scheme testing....................................................... 63
10.1 General ............................................................................................................................................ 63
10.2 BFP scheme testing guidelines and awareness ................................................................................ 63
10.3 Overall system testing...................................................................................................................... 65
Annex A (informative) Bibliography ........................................................................................................... 67
Annex B (informative) Breaker failure setting example............................................................................... 69
10
IMPORTANT NOTICE: IEEE Standards documents are not intended to ensure safety, security, health,
or environmental protection, or ensure against interference with or from other devices or networks.
Implementers of IEEE Standards documents are responsible for determining and complying with all
appropriate safety, security, environmental, health, and interference protection practices and all
applicable laws and regulations.
This IEEE document is made available for use subject to important notices and legal disclaimers. These
notices and disclaimers appear in all publications containing this document and may be found under the
heading “Important Notice” or “Important Notices and Disclaimers Concerning IEEE Documents.”
They can also be obtained on request from IEEE or viewed at
http://standards.ieee.org/IPR/disclaimers.html.
1. Overview
1.1 General
Breaker failure protection (BFP) is a backup protection for the power system that is needed when a power
circuit breaker fails to clear a fault when called upon to do so by a protective relay. The BFP scheme acts to
isolate the fault from the protected power system by removing from service power circuit elements located
electrically adjacent to the failed power circuit breaker.
In general, backup relay protection has been used on power systems for many years. Typically, all parts of
the protection system including the relays, voltage and current transformers, circuit breakers, and control
power source are vulnerable to failure. All of these components are needed to work properly to effectively
clear a fault. To improve protection system reliability, components such as protective relays, power
sources, and instrument transformers are often duplicated. Duplicate systems are designed to operate
independently to ensure complete protection system functionality during failures. Because it is usually too
costly to duplicate the breaker, breaker failure schemes are specifically employed to provide backup
protection in the event that a circuit breaker fails to operate properly during fault clearing.
Primary protection of the power system from performance failures of the power circuit breaker other than
fault clearing failures is sometimes added to breaker failure schemes. These include failure to operate,
either tripping or closing, manual or automatic. Where applied, this protection typically exists as an
addition to, and as a part of, the same overall scheme as the breaker failure backup protection.
The choice and successful application of any BFP scheme depends upon factors such as the local breaker
arrangement and also the relative criticality of protected power circuit elements. There is a delicate balance
11
IEEE Std C37.119-2016
IEEE Guide for Breaker Failure Protection of Power Circuit Breakers
between the risk of damage to unprotected equipment versus the impact of removing adjacent power circuit
elements when the scheme operates.
This guide reviews generally accepted breaker failure schemes used on utility transmission and generation
systems. Many of the characteristics of these schemes also apply to the use of breaker failure on utility
distribution systems. Schemes are carefully examined so that advantages as well as disadvantages can be
compared. Application examples and testing practices are also included.
The guide is written for engineers who have a working knowledge of power system protection but require a
better understanding of breaker failure applications. It can also be used as an evaluation tool when
comparing alternative breaker failure options.
1.2 Scope
This guide describes methods to protect a power system from faults that are not cleared because of failure
of a power circuit breaker to operate or interrupt when called upon by a protective relay. The intent is to
give the reader a guide in how to detect that a breaker has failed to clear a fault, and how to electrically
isolate the fault after the breaker has failed to clear the fault. Additionally, schemes that provide primary
protection of the power system from performance failures of the power circuit breaker other than fault
clearing failures such as failure to operate, either tripping or closing, manual or automatic, are also
described. Such schemes, when applied, are typically integrated as a part of the overall BFP scheme. Also
covered are recent practices that take advantage of new technologies.
1.3 Purpose
This guide is intended to help the relay engineer understand the application considerations when applying
BFP to power circuit breakers.
2. Normative references
The following referenced documents are indispensable for the application of this document (i.e., they must
be understood and used, so each referenced document is cited in text and its relationship to this document is
explained). For dated references, only the edition cited applies. For undated references, the latest edition of
the referenced document (including any amendments or corrigenda) applies.
IEEE Std C37.102™, IEEE Guide for AC Generator Protection. 1, 2
IEEE Std C37.113™, IEEE Guide for Protective Relay Applications to Transmission Lines.
3. Definitions, acronyms, and abbreviations

For the purposes of this document, the following terms and definitions apply. The IEEE Standards
Dictionary Online should be consulted for terms not defined in this clause. 3, 4
1
IEEE publications are available from the Institute of Electrical and Electronics Engineers, Inc., 445 Hoes Lane, Piscataway, NJ
08854, USA (http://standards.ieee.org/).
2
The IEEE standards or products referred to in this clause are trademarks of the Institute of Electrical and Electronics Engineers, Inc.
3
IEEE Standards Dictionary Online subscription is available at:
http://www.ieee.org/portal/innovate/products/standard/standards_dictionary.html.
12
IEEE Std C37.119-2016
3.1 Definitions
backup protection: A protection scheme for the same zone of protection as the primary protection but may
be slower and removes the same or additional equipment from service. Backup protection may be installed
locally, i.e., in the same substation as the primary protection, or remotely.
breaker failure protection (BFP): A form of protection that is designed to detect the failure of a circuit
breaker to operate or to interrupt a fault. Upon detection of a breaker failure during a fault condition the
scheme is designed to take appropriate action to clear the fault. Upon detection of a breaker failure during a
non-fault condition, the scheme may take other appropriate action.
control timer: A timer that limits the amount of time the breaker failure scheme is active after initiation.
This is a time delay on pickup timer.
common-mode failure: A multiple failure attributable to a common cause.
critical clearing time: The longest time that fault conditions may persist before system stability is lost.
local backup protection: A backup protection system that is in the same substation as the primary
protection. However, it may use some of the same equipment, such as transducers, batteries, and circuit
breakers as the primary protection and can therefore fail to operate for the same reasons as the primary
protection.
primary protection: The main protection system for a given zone of protection that operates in the fastest
time and removes the least amount of equipment from service.
remote backup protection: Historically, the first set of backup protection that was installed. It is
completely independent of the relays, transducers, batteries, and circuit breakers of the primary protection
system it is backing up by virtue of its physical location. Its advantage is that there are no common-mode
failures that can affect both systems of protection. Its disadvantage is the fact that remote protection may
remove more system elements than is desirable or necessary to clear a fault. Additionally, as the power
system matured, it became increasingly difficult for remote protection to detect (see) all the faults that the
primary protection could detect.
3.2 Acronyms and abbreviations
The following are a listing of abbreviations used in this guide:
50 instantaneous overcurrent element

50G instantaneous overcurrent ground element
50P instantaneous overcurrent phase element
50BF breaker failure current detector
52a breaker auxiliary contact that is closed when the breaker is closed and open when the
breaker is open
4
It is recognized that these definitions are only intended to facilitate communication so that there is general understanding of the
subject under discussion. They are not to be rigidly applied as if they constituted design specifications. Protection systems are
designed in accordance with accepted engineering principles involving reliability (dependability and security), selectivity, and
coordination. The definitions when applied to individual elements, or to the total protection system, are for specific applications and
may vary with the application. For instance, in a substation without a pilot protection system, time-delay overcurrent or zone 2 relays
are the primary protection for faults in the last 10% to 20% of the line but are the remote backup protection for the adjoining bus and
line section. When a pilot scheme is installed, the time-delay overcurrent and zone 2 relays are then referred to as local backup for the
end-of-line faults and remote backup for the adjoining bus and line section.
13
IEEE Std C37.119-2016
52b breaker auxiliary contact that is open when the breaker is closed and closed when the
breaker is open
52aa breaker auxiliary contact that is closed when the breaker is closed, and opens as soon as
the breaker operate mechanism begins moving from the closed to the open position
62 breaker failure timer, time delay on pickup
86BF breaker failure auxiliary lockout relay
94 auxiliary tripping relay
BFI breaker failure initiate
BFP breaker failure protection
BFR breaker failure relay
CT current transformer
CTR current transformer ratio
DTT direct transfer trip
DUTT direct underreaching transfer trip
EHV extra-high voltage
IED intelligent electronic device
LAN local area network
SCADA supervisory control and data acquisition
WAN wide area network
4. Need for breaker failure protection

Circuit breakers are strategically located in power systems to connect circuits and electrical apparatus.
Circuit breakers are commanded to open and close by protection and control systems that monitor
conditions on the power system. Protective relay systems detect abnormal conditions, most notably, system
faults (short circuits), and direct one or more circuit breakers to open in order to isolate the faulted circuit
or equipment. Protection systems are coordinated so that the circuit breaker(s) nearest the fault are opened
to interrupt or clear the fault with minimum impact to the remainder of the power system. This critical
operation requires that the circuit breaker interrupt, or clear, fault current.
B Fault C
3 4
A
A 1 2 5 6 C
Load Load
7 8
Load
Figure 1 —Local and remote breaker clearing
14
IEEE Std C37.119-2016
While infrequent, circuit breakers occasionally fail to trip, or fail to clear a fault. Depending on the power
system network topology, other circuit breakers are then called upon to trip and isolate the sources
contributing to the fault. Referring to Figure 1, assume a fault exists between breaker 3 and breaker 4.
Protective relays associated with breaker 3 and breaker 4, designed to detect faults on the line between
these breakers, operate and command breaker 3 and breaker 4 to trip. In this example, breaker 3 fails to
interrupt the fault current. Therefore, all sources that continue to supply fault current through breaker 3
need to be interrupted. Assuming sources at stations A and C, breakers 2, 5, and 7 need to be opened
locally, or breakers 1, 6, and 8 would need to be opened remotely.
To implement remote breaker failure backup protection for breaker 3, the protective relays at breakers 1, 6,
and 8 have overreaching elements that sense faults anywhere on the line between breaker 3 and breaker 4,
and operate after a time delay, typically about 0.5 s to 1.0 s. 5 This time delay is required to allow time for
the local line protection on breaker 3 to operate, and for the breaker to successfully clear the fault,
recognizing that the local protective relay scheme on breaker 3 may include time delayed tripping to
coordinate with other protective relays. Remote backup protection does not have the benefit of knowing
exactly when the breaker is commanded to open. Therefore, the remote backup protection needs to have
sufficient time delay to accommodate all possible tripping delays.
Local BFP, on the other hand, receives a signal directly from the line protection relays at the same station
as the impaired breaker, indicating when the trip command is sent to the breaker. The local BFP only needs
to wait for the breaker to successfully clear the fault, typically only 0.1 s to 0.2 s. If local BFP for breaker 3
detects a breaker failure, it commands adjacent local breakers 2, 5, and 7 to trip to clear the fault. In many
cases, if a direct transfer trip (DTT) protection channel is available, it will also command the remote
breaker 4 to trip and lockout. Of course, for a fault on the line between breaker 3 and 4, breaker 4 would
have been tripped by the line protection relays. But, sending DTT will prevent a manual or automatic
reclose of breaker 4.
Remote backup, therefore, has the following disadvantages:
 All tapped loads between breakers 1−2, 5−6, and 7−8 are dropped causing widespread customer
outages.
 The lengthy backup clearing time will cause excessive system voltage dip duration, additional
damage to faulted equipment, possible damage to unfaulted equipment, and may lead to system
instability.
 Due to infeed effects from the other lines, it may be difficult to set the remote relays at 1, 6, and 8
to detect faults on the entire length of the adjacent lines.
 The settings required to provide sufficient reach to detect faults out to the remote ends of the
adjacent lines may be so sensitive that the line is susceptible to tripping under heavy load during
extreme disturbances, which could initiate or exacerbate a wide-area cascading outage.
The advantage of remote BFP is that it is completely independent of protective relays, control systems, and
battery supplies at the station with the failed breaker.
An alternative to remote backup is local backup, and its subset breaker failure relaying. Local BFP
eliminates the disadvantages of remote backup protection. Using the example in Figure 1 again, and
concentrating on breaker 3, when the protective relay on breaker 3 senses a fault on line 3−4 and issues a
trip to breaker 3, local BFP starts a timer. If the timer times out, and the fault is not cleared by breaker 3,
then the local breaker failure scheme sends trip signals to adjacent breakers 2, 5, and 7. The local breaker
failure scheme has several benefits over the remote backup scheme. If there are sources at buses A and C,
5
Throughout this document, where seconds or milliseconds are used as units to describe intentional protection system coordination
delays and/or timer settings, a power system operating at 60 Hz is assumed unless otherwise described.
15
IEEE Std C37.119-2016
tapped loads between breakers 1−2, 5−6, and 7−8 can still be served. The total clearing time for the fault is
reduced substantially compared to the remote backup method. The timer setting for the local breaker failure
scheme is composed of breaker interrupting time plus some margin. Margins may range from less than
0.0167 s to 0.050 s (1 cycle to 3 cycles) as dictated by the critical fault clearing time. Protective relay time
is not included in this time delay. This timer setting is typically less than 0.200 s (12 cycles), compared to
0.5 s to 1.0 s (30 cycles to 60 cycles or more if the tripping has to happen sequentially) for remote backup.
This time difference could mean the difference between a stable and unstable system for some critical
faults and may substantially reduce the extent of damage at the fault, through fault stress on equipment, and
effect of voltage depressions on adjacent loads.
The primary disadvantage of local BFP is that it may suffer from common-mode failure. Station battery
failure, for example, that may be the original cause of the breaker failure condition, may also disable the
local BFP. Likewise, local protective relay malfunction may cause a failure to trip the breaker and also fail
to initiate the local breaker failure timer. For this reason, redundant protective relay systems for each zone
are also often coupled with local BFP systems in a component failure tolerant protection system.
Otherwise, failure to detect a fault and failure to interrupt a fault are considered as the same contingency
that requires backup by overreaching relays tripping different breakers (remote backup). The cost of adding
BFP systems, while once a major consideration, has been significantly reduced as the breaker failure
function has been integrated into modern microprocessor-based protective relay schemes.
There are many things that may cause the failure of a circuit breaker to interrupt fault current. Many are
external to the breaker such as a loss of tripping power, dc battery failure, battery charger failure, dc
breaker tripped or blown fuse, loose wire or shorted trip circuit, etc. If one of these is the cause for the
failure, slow clearing of the fault will probably not cause further damage to the breaker. However, some
common causes for the failure to interrupt are that the breaker mechanism travel is incomplete or the
mechanism is slow; components needed for the interruption: (resistors or capacitors), are faulty; or the
dielectric material in the interrupter is out of specification (low pressure, low temperature) or contaminated.
If these are the causes for the failure to interrupt, the breaker needs protection to prevent further damage.
By the time the remote backup protection has operated, the arcing inside the interrupter will likely cause a
phase-to-ground fault internal to the breaker. These internal faults may lead to explosions and fires. As a
result of the slow clearing of the original fault, what could have been a minor breaker repair project, if the
faulty breaker had been isolated in a timely manner, now may require the replacement of the breaker and
possibly other equipment in close proximity to the faulty breaker.
To summarize, when considering if BFP systems will be applied, the following three fundamental attributes
of the protection system need to be considered:
 Sensitivity: Can the overreaching protective relays in adjacent zones reliably detect faults in 100%
of the zones to be backed up, considering infeed?
 Selectivity: Is it acceptable to trip additional power system elements and loads that may be
otherwise preserved by applying a BFP system?
 Speed: Is delayed clearing from remote backup for a breaker failure event acceptable for system
stability, power quality, equipment through-fault stress, and equipment fault damage?
One final consideration in deciding to rely solely on remote backup is the cost and effort of relay setting
maintenance. The analysis effort required for an even moderately complex networked system to consider
all possible system configurations and current distributions that affect infeed for all possible breaker failure
scenarios is difficult. Assuming that the analysis has been performed adequately, even small changes to the
network may require that all of this effort be repeated to prove that remote backup can be relied upon.
For further information about remote backup, refer to IEEE Std C37.113.
16
IEEE Std C37.119-2016
5. Breaker failure modes

BFP is designed to operate when the protective relaying scheme initiates a circuit breaker trip and that
breaker does not interrupt the fault. BFP will be considered a subset of local backup protection. Breaker
failure can be caused by a variety of situations, as follows:
 Failure to Trip: In failure to trip situations, the breaker contacts do not open after the trip circuit has
been energized by the protective scheme. This could be caused by an open or short in the trip
circuit wiring or in the trip coil. It could also be the result of a mechanical problem in the breaker
that prevents the contacts from opening; this condition is also known as “stuck breaker.”
 Failure to Clear: In these scenarios, the breaker contacts open, but the arc is not extinguished and
current continues to flow. This could be caused by mechanical problems (incomplete opening), or
dielectric problems (such as contaminated oil or loss of vacuum). Failure to clear is significantly
different from failure to trip in that the breaker auxiliary contacts (52a and 52b) will change state,
which indicates breaker opening. Because of this, an auxiliary contact position may not be a
reliable indicator of a satisfactory breaker opening.
Another failure to clear mode can occur in breakers with opening resistors. In this mode the resistor
insertion contact operates successfully, but the main contacts fail. This results in a high impedance to
current flow, but does not interrupt the flow of current.
Both breaker failure modes can occur during high-current and low-current faults, including transfer trip
from remote locations.
There are also situations where a circuit breaker operates incorrectly, but is not classified as a breaker
failure. These situations (as follows) are considered in system design, and may be incorporated within the
breaker failure protective scheme:
 Loss of dielectric during non-fault conditions can prevent satisfactory interruption of current if
called upon, potentially leading to a true breaker failure. Loss of dielectric pressure can be detected
in SF6 breakers using a gas density or pressure monitor. For loss of pressure below a cutoff point,
breaker manufacturers typically recommend blocking the breaker tripping to prevent mechanical or
electrical failure. In this case, the breaker failure scheme delay timer can be bypassed so that the
BFP will operate with no intentional delay if a breaker failure initiate signal is received.
 Loss of mechanism energy storage during non-fault conditions can prevent satisfactory interruption
of current in breakers that require stored energy for the opening stroke, if called upon, potentially
leading to a true breaker failure. Loss of mechanism energy storage can be detected with pneumatic
or hydraulic gauges, micro-switches, or undervoltage relays. For a loss of stored energy below the
rated minimum value, breaker manufacturers typically recommend blocking the tripping and
closing of the circuit breaker to prevent mechanical or electrical failure. In this case, the breaker
failure delay timer can be bypassed so that it will operate with no intentional delay. The breaker
manufacturer might be consulted to verify the loss of energy storage is not a transient condition that
could occur during the normal operation of the circuit breaker.
 Contact flashover in an open breaker can lead to catastrophic failure. This could be caused by a re-
strike of an opening breaker or a surge through an already open breaker that produces dielectric
breakdown across the contacts.
 Failure of a circuit breaker to close when called upon is not traditionally defined as a breaker
failure condition, since it is not associated with a protective relay trip. This can, however, have
significant impact on the power system and may need to be considered in the operating scheme.
Many reclosing schemes include failure to close logic.
17
IEEE Std C37.119-2016
 Failure of a circuit breaker to close in the expected time while attempting to connect a generator to
the system can cause severe damage to the generator and turbine if the breaker eventually closes
when the generator is out of phase with the system. This can occur for a number of reasons, but
especially if the breaker has sat for an extended time in very low ambient temperatures. It is
recommended to isolate the breaker and operate it a few times before the synchronization is
actually attempted. Protection schemes are also available to monitor the closing time of the breaker
and trigger the breaker failure-to-close scheme if the close has not occurred within an appropriate
time following synchronism.
 Non-fault related failures are also possible. An example would be failure to interrupt load current,
or mechanical failure during switching operations. These failures can be addressed within more
complex BFP schemes.
Numeric relays have some ability to identify impending failure of a circuit breaker. This can be
accomplished by identifying degraded performance, such as changes in operate or clearing times. These
schemes can also track predictive quantities such as accumulated interrupted current or number of
operations.
Breakers with single-phase tripping present additional constraints for BFP.
6. Breaker failure protection schemes

This clause describes breaker failure schemes that have received acceptance by the industry and are used in
utility power systems. Common elements of a breaker failure to interrupt scheme include the following:
 Scheme initiation by a breaker trip signal such as a protective relay that has operated to trip the
breaker
 Determination that the breaker has tripped successfully by monitoring reset of an overcurrent
element (50BF) that responds to each measured phase current (50P) and possibly the sum of these
phase currents (50G), monitoring change in state of the circuit breaker auxiliary contact (52a, 52b,
or 52aa), or some combination of these methods
 A timer
 Some means to trip and block closing of adjacent breakers
 Optional: A separate output contact to issue a re-trip signal to the circuit breaker before issuing a
breaker failure output with sufficient margin such that successful opening of the circuit breaker will
prevent an undesired breaker failure output
 Optional: A teleprotection channel to key a DTT and to cancel reclosing of remote circuit breakers
Schemes are illustrated using logic diagrams. Many of the schemes could also be illustrated by using
conventional dc control schematics.
When choosing a scheme it is important that the interactive behavior of the aggregate components is well
understood. Schemes vary in their degree of dependability versus security. Behavior peculiar to a particular
type of relay can affect each scheme differently. Behavior can be impacted by equipment replacements and
firmware upgrades.
Factors to be aware of might include the following:
18
IEEE Std C37.119-2016
 Method of seal-in or latching of the primary relay output after fault detection
 Presence or absence of local current/fault detector supervision of the primary relay
 Sensitivity (pickup and dropout) of the 50BF current detectors
 Interaction of the scheme with local and remote automatic reclosing
 Impacts of credible component failures such as welding shut of relay output contacts
 Reset of the BFP scheme
6.1 Basic breaker failure scheme
Basic BFP provides a means to trip adjacent current sources if a fault is detected by protective relays and
the associated breaker(s) fails to interrupt the fault. Figure 2 is a logic diagram showing a basic breaker
failure scheme. Figure 3 shows a typical timing chart for this scheme.
62-1
50BF
AND Timer Breaker Failure
BFI Scheme Output
Figure 2 —Basic breaker failure scheme
50BF
PROTECTIVE FAULT CLEARED
DROPOUT
RELAY
TIME BREAKER RESET MARGIN
INTERRUPT TIME TIME TIME
94/86
BREAKER FAILURE TIMER TIME – (62-1) TRIP LOCAL BACKUP BREAKER
RELAY INTERRUPT TIME
BFI TIME
TRANSFER TRIP
FAULT OCCURS TIME
REMOTE BACKUP BREAKER
50BF INTERRUPT TIME
TOTAL FAULT CLEARING TIME
Figure 3 —Fault clearing timing chart
The following two conditions are used to monitor proper breaker operation during a fault clearing
operation:
a) The presence of current flow in the breaker (50BF) and

b) A protective relay trip signal (BFI).
The breaker has failed to operate properly if both of these signals are present for a period greater than the
expected breaker clearing time. A delay on pickup timer (62-1) is set to a time delay that exceeds the
breaker normal clearing time with margin. If current is still flowing through the breaker when the timer
times out it is determined that the breaker has failed. If the breaker operates properly, either one or both of
the 50BF or BFI inputs will de-assert and stop the operation of the timer.
19
IEEE Std C37.119-2016
When a breaker failure scheme operates [breaker failure timer (62-1) times out], a number of actions are
initiated by the scheme. Depending on design philosophy, the number of contacts required, the interrupting
rating of the output contacts, or relay targeting requirements, auxiliary devices (94) may be used. Often, a
lockout relay (86BF) is used as an auxiliary device.
6.2 Basic breaker failure with re-trip logic
Re-trip is a separate output contact from the BFP intended to prevent undesired breaker failure operations
and consequent loss of adjacent circuit elements for certain causes such as human error during relay testing,
false initiation of BFP from dc transients induced on control circuit wires, and failure to trip due to loose or
shorted breaker trip circuit wiring or non-functioning trip coils. Re-trip logic is designed to issue the re-trip
signal to the breaker with sufficient margin such that the successful opening of the breaker due to the re-trip
signal will cause the 50BF element to drop out (and the 52a to toggle open) before the breaker failure timer
expires.
The re-trip circuit helps to alleviate a consequence from an easily made but infrequent operating error. The
error occurs while performing relay testing on one of the two sets of line relays while the line is still in-
service. The trip circuit for the relay under test is disabled but the breaker failure initiate circuit is not.
When the test produces a trip output from the relay, the breaker failure initiate circuit could cause a breaker
failure relay (BFR) operation if the load current is above the breaker failure current detector. With a re-trip
circuit, the line breaker will be tripped, but the more serious result of the breaker failure operation is
avoided.
Power circuit breakers with two (or more) trip coils yield the opportunity to provide redundant breaker
actuation using separate, independent trip circuits. Best practices for initiating BFP where two breaker trip
coils are provided are described by 7.6 and illustrated by Figure 29.
Where primary relays are not redundant, or where it might be difficult to separate tripping outputs such as
for legacy electromechanical phase and neutral overcurrent relays, the breaker failure re-trip contact might
be applied to the second trip coil circuit to mitigate for failures of the first trip coil circuit (with the non-
redundant or legacy relays).
Some utilities choose to apply both redundant relays of a protected circuit to a single trip coil and rely on a
separately fused breaker failure re-trip contact to operate the second trip coil to mitigate for failures of the
first trip coil circuit.
Some utilities add a time delay (62-2 of Figure 4) to the re-trip circuit to help identify, by slower measured
overall trip time of the breaker due to the delayed re-trip output, when a failure to trip by the first trip coil
circuit occurs. When the breaker failure scheme has internal sequence of events recording, the information
can be used to determine whether the breaker operation occurred by the re-trip circuit or by tripping on the
initial fault detection, and this might be used to inform maintenance personnel that a breaker inspection
may be beneficial if the breaker successfully opens. For this scheme, the re-trip time-delay-on-pickup
setting (62-2) needs to be coordinated with the breaker failure timer (62-1) to be effective. The operating
speed of the output contacts used for re-trip is accounted for in the overall time-delay settings since slower
speed output contacts may be used for re-trip activation. For inherently slow clearing breakers, the
coordination between the re-trip and breaker failure timers is a consideration. Additional system stability
and protection coordination studies may be required whenever coordination of the re-trip and breaker
failure timers requires the breaker failure timer to be extended.
Figure 4 illustrates the addition of re-trip logic. Most utilities set the 62-2 timer to zero time. The dotted
line illustrates an alternative connection of the re-trip timer to the output of the AND gate, which some
manufacturers might implement for additional security.
20
IEEE Std C37.119-2016
Re-trip logic may not be desirable in some cases for security reasons. For example, the re-trip logic may be
viewed as more of a risk for a false trip than an improvement to reliability in applications with redundant
protection schemes. Avoid re-trip logic that may unnecessarily react to transients or temporary dc grounds.
The contact change-of-state recognition time needs to be greater than the length of any expected dc
transient. A one-quarter cycle delay is typically sufficient. The pickup level of an input circuit needs to be
high enough to be secure for a battery ground situation. An input pickup level greater than one half the
battery voltage is typically sufficient.
The re-trip signal may be for three-phase tripping only or for individual breaker poles for selective single-
phase tripping. If integrated within the same hardware device as the initiating protection function, this trip
signal may be issued via separate output contacts from those with which the device issued the initial trip
output.
62-1
50BF Trip Back-up
AND Timer
BFI Breakers
Alternative 62-2
connection
Re-Trip the
Timer
Breaker
(62-2 Time Delay May be Zero Time)
Figure 4 —Breaker failure re-trip
6.3 Breaker failure scheme for dual breaker arrangements
The logic shown in Figure 2 has a disadvantage in multi-breaker line protection schemes, such as ring bus
and breaker-and-a-half schemes, where current in one breaker may be insufficient to pick up the
current/fault detector until the other breaker trips. The logic shown in Figure 5 permits the breaker failure
timer (62-1) to start timing with only the BFI input, eliminating the delay that might occur if the current
detector input (50BF) were also required to start the breaker failure timer, as in Figure 2. The fault clearing
timing chart for this scheme is the same as shown in Figure 3, except the 50BF pickup may occur later.
The breaker failure scheme shown in Figure 5 allows the breaker failure timer to start on initiate without
the supervising 50BF element asserted. Caution is advised when applying this scheme with protection
schemes that can assert a trip when the breaker is open. One example is line current differential (87L)
protection. In a reclosing sequence, the remote terminal can time out its open interval first and close into a
permanent fault. The 87L relay at the local terminal will assert based on the remote terminal current and
start the timer. Then, when the local breaker’s open interval times out and closes into the fault, the breaker
failure timer is already partially timed out, which may not allow sufficient time for the breaker to
successfully clear the fault. This can result in an inadvertent breaker failure backup trip. Other similar
schemes are shown in Figure 6, Figure 8, and Figure 25.
21
IEEE Std C37.119-2016
62-1
BFI Timer Breaker Failure

AND
Scheme Output
50 B F
Figure 5 —Timer without 50BF supervision
6.4 Breaker failure scheme based on 50BF pickup time
In strong systems and in power plant switchyards where very short critical clearing times are a major
concern, adequate reset time for the 50BF current detector may not be easily achievable when using the
scheme shown in Figure 2.
The scheme of Figure 6 includes an arrow pointing to the 50BF element, which implies that current
detection by the 50BF begins only after the 62-1 timer has timed out. The theory is that current detector
pickup time is generally shorter and more predictable than dropout time; this is especially true with
electromechanical relays. Implementations include using torque control of an electromechanical relay,
using switching of current into the 50BF element of a static analog type relay, or using the measurement of
unfiltered data from a numerical relay.
In microprocessor schemes, the current detector pickup and dropout times are mainly governed by the
current measurement filter window and the difference can be negligible. Depending on certain digital
filtering element dropout characteristics, some designs apply arrangements of timers, level detectors,
current signal gating/enabling, and other waveform analysis and pattern recognition techniques to achieve
fast dropout times.
With this type of scheme, if the breaker has interrupted the current by the time the 62-1 timer times out,
then the reset time of the 50BF is not an issue. Eliminating the 50BF reset time significantly reduces the
margin requirements. If the breaker fails to interrupt the fault current, the 50BF is allowed to pick up and
produce a breaker failure output.
50 B F
Breaker Failure
Enables 50BF AND
Scheme Output
62-1
BFI Timer
Figure 6 —Elimination of 50BF reset time
Figure 7 is a timing diagram for the scheme shown in Figure 6.
22
IEEE Std C37.119-2016
PROTECTIVE
RELAY
FAULT CLEARED
TIME BREAKER MARGIN
INTERRUPT TIME TIME
AUX
BREAKER FAILURE TIMER - (62-1) 50 BF TRIP LOCAL BACKUP BREAKER
PICKUP RELAY INTERRUPT TIME
BFI
TRANSFER TRIP
FAULT OCCURS TIME
REMOTE BACKUP BREAKER
INTERRUPT TIME
TOTAL FAULT CLEARING TIME
Figure 7 —Alternate scheme fault clearing timing chart
An enhancement to this scheme, shown in Figure 8, is a control timer, which increases security by limiting
the window of time for producing a breaker failure output to a short period following a BFI signal. (See 8.5
for setting considerations for this timer.) An alarm, associated with the control timer, might be used for
indication when the BFI is asserted and the output of the control timer has de-asserted to prevent blocking
the scheme for a failed breaker.
Control
timer
50 B F
Enabled only after
Breaker Failure Scheme
62-1 times out AND
Output
62-1
Enable
BFI Timer
Figure 8 —Addition of control timer
6.5 Breaker failure scheme with two-step timing arrangement
Multi-phase faults have a greater adverse impact on power system stability than single phase-to-ground
faults. Critical clearing times and resulting breaker failure time delay requirements for multi-phase faults
are therefore shorter than for single phase-to-ground faults. To reduce breaker failure operating times for
multi-phase faults, and to provide more relaxed breaker failure time delays for single phase-to-ground
faults, some users employ dual-timer breaker failure schemes that distinguish between these two types of
faults. Figure 9 details the logic necessary for this approach. Individual phase current detectors (50BF-A,
50BF-B, and 50BF-C) are connected to two different logic gates. The “2 of 3” AND gate will only allow
operation of the faster 62-1 (multi-phase) timer if at least two phases have been faulted. The 62-2 (single-
phase) timer, generally set with a longer time delay than 62-1, operates for all single-phase and multi-phase
faults. With this approach, the shorter time-delay setting is used only when multi-phase faults have
occurred.
23
IEEE Std C37.119-2016
50BF-A 62-1
50BF-B 2 of 3 AND Timer
Faster Breaker
50BF-C Time Delay Failure
OR
Scheme
62-2
Output
OR AND Timer
Longer
Time Delay
BFI
Figure 9 —Two step timing arrangement
6.6 Breaker failure initiate seal-in
The breaker failure initiate seal-in function provided on modern BFRs can improve dependability if there is
danger of the protection system tripping output not remaining present for the full BFR time delay. This is
often associated with the memory circuit expiring in an electromechanical relay during a zero voltage fault
due to the delayed clearing caused by the failed breaker. Using the seal-in feature can reduce security by
allowing the timer to expire on a transient initiate.
The scheme, shown in Figure 10, requires that the current detector be picked up continuously for the
breaker failure timer (62-1) to time out. Thus, the current detector (50BF) needs to continue to be energized
even if the initiating relay (BFI input) momentarily resets. The breaker failure timer requires sufficient
margin to allow the reset of the current detector for normal breaker clearing.
62-1
50BF Breaker Failure
AND Timer
OR Scheme Output
BFI
Figure 10 —Breaker failure seal-in
6.7 Breaker failure minimal current scheme
Circuit breaker failure operation may be required for conditions where there is little or no measurable fault
current. If sufficient current is not present on initiation to pick up the breaker failure current detector
(50BF), then the circuit breaker can be monitored by auxiliary contacts to establish breaker position.
Breaker failure logic can also be achieved using breaker auxiliary switches to supplement or replace current
detectors. These breaker auxiliary switches are operated by mechanical or hydraulic linkages to indicate the
position of the circuit breaker’s main contacts. Sole use of auxiliary contacts may prove unreliable in cases
where the breaker main contacts physically open but fail to interrupt the current, or if the auxiliary switch
fails to operate because of mechanical problems (broken switch linkage, welded contacts, frozen switch,
etc.). However, breaker failure applications associated with high-impedance power system apparatus, such
as generators, transformers, static var compensators (SVC), and harmonic filters, may have such low
currents associated with internal faults that breaker auxiliary switches provide the only practical method to
24
IEEE Std C37.119-2016
indicate that the breaker is open. Some utilities apply this scheme for the purpose of detecting a breaker
failure where a CT has also failed.
Power devices that have only one source of energy, through the breaker being monitored, such as SVC,
filter banks, or transformers with only load on the other windings may use the presence of voltage as
another indication that the breaker has failed to separate the device from the power system. The threshold
level of the voltage indication and the breaker failure timer need to be coordinated to deal with the decay of
the capacitive charge on the device.
The no (low) current detection option is typically restricted to those conditions where a trip signal is issued
to the circuit breaker when the current is below the circuit breaker failure current detection threshold, e.g.;
weak or zero in-feed trips, overvoltage trips, etc. Current supervision is the most secure and reliable method
of detecting successful opening of the circuit breaker. Circuit breaker auxiliary contact supervision of
breaker failure operation might only be used in those cases where the current is below the set threshold. For
current supervision methods, it is expected that, for all trip outputs from the protection system(s) that
initiate the circuit BFP, the circuit BFP determines the presence of or lack of current. If current is present,
current detection is applied for the full duration of the fault event.
Figure 11 shows a breaker 52a contact that has been added in parallel with the 50BF input. With this
addition, the scheme will operate properly for low-magnitude faults because both the dropout of the 50BF
current detector and the opening of the 52a breaker auxiliary contact are necessary to interrupt the 62-1
breaker failure timer. While operation of the auxiliary switch might properly indicate that the breaker
mechanism has operated, it is not sufficient indication that the circuit breaker has interrupted the fault
current. Timing of the auxiliary contacts and the breaker main contact may be checked at regular intervals
to verify they are within specifications.
62-1
50BF BFI Timer Breaker Failure

AND
OR Scheme Output
52a
Figure 11 —Minimum fault current scheme
A variation of the logic of Figure 11, which adds a seal-in function and is shown in Figure 12, poses a
notable risk, which the user may be able to mitigate in some applications. Subclause 6.6 explains that the
BFI input may be sealed in by the breaker failure logic, particularly to maintain BFI when the BFP is used
with distance relaying functions that may reset in 1−2 cycles for collapsed-voltage faults.
The risk comes from a false BFI input resulting from a maintenance or testing error; a configuration or
setting error in an IED, or in a network control application as described in 9.2; or a dc battery supply
grounding fault as described in 7.4.1. This false BFI will be sealed in only if the lower OR gate of Figure
12 has a TRUE output.
25
IEEE Std C37.119-2016
Seal-in
62-1
OR Breaker Failure
BFI AND Timer
Scheme Output
50BF
OR
52a
Figure 12 —Seal-in with false BFI, this scheme is NOT a recommended practice
Typically, when load current is flowing in the protected breaker, the 50 BF current detector is not normally
picked up during any of the risk situations mentioned previously. In Figure 12, if 50BF is used by itself
without the OR input of the 52a, the accidental BFI is not sealed in, and the BF timer 62-1 input is not
activated. However, with 52a connected to the OR logic of Figure 12, the 52a input is always TRUE as
long as the protected breaker is closed. Thus a false BFI input will be sealed in, which will cause the BF
timer 62-1 to time out, and will cause a BF backup trip that trips the adjacent bus or otherwise fragments
the power system. This is obviously a much more serious and threatening result than accidentally tripping a
single breaker.
Accordingly, the minimal current scheme is recommended only when the minimum fault current in the
breaker is less than a feasible setting of 50BF, or less than maximum load current. A common situation
requiring the use of Figure 11 logic is when the breaker interrupts current to a transformer protected by
differential and/or sensitive ground relays. Faults on adjacent buses or lines, or on the buswork leading up
to the transformer bushings, produce substantial fault current that is above load and can be detected by
50BF. However, a bushing or internal winding or tank fault may yield very low fault current, yet is
dangerous and requires BF protection. When the differential or ground relay initiates breaker tripping, the
52a input is needed in parallel with 50BF because 50BF cannot be set to pick up for such a fault. Note that
this BF protection will initiate backup tripping for a mechanically stuck breaker operating mechanism—the
most frequent failure type—but will not deal with the case of a breaker that opens and fails to interrupt. The
latter breaker failure will likely evolve to a high-current breaker fault and will eventually lead to tripping by
other relays.
Figure 13 shows a variation of the Figure 12 logic that may reduce the risk of BF tripping in the case of
false BFI. The 52a input is ANDed with an 86 indication showing that sensitive transformer relays have
initiated the breaker failure scheme. Only in that case can the 52a input support seal-in and timing of the
breaker trip by 62-1. False BFI at any other moment will be ignored.
Seal-in
62-1
OR Breaker Failure
BFI AND Timer
Scheme Output
50BF
OR
52a
AND
86
Figure 13 —BFI seal-in with 86T supervision of 52a 6
6
Lockout (86) input for this scheme is the primary protection (transformer or generator) lockout. It is not the breaker failure lockout.
26
IEEE Std C37.119-2016
It is critical to note that it is NOT acceptable to use an AND function to join 50BF and 52a (whether 52a
has 86 supervision in Figure 13 or not). Using AND (contacts in series) instead of the OR (contacts in
parallel) shown in Figure 11 will apply logic requiring that the breaker be mechanically stuck AND that
current is above 50BF setting in order for BF protection to take place. This will defeat BF protection for
breakers that open mechanically but fail to interrupt current, even for a high current fault. Using such logic
would disable critical protection that the BF scheme is expected to provide.
6.8 Dual timer breaker failure scheme with fast breaker auxiliary contact and
current detector reset check
Figure 14 depicts a dual timer breaker failure scheme with 52aa and 50BF reset checks. The logic includes
a breaker failure initiate (BFI) input that starts two timers when external fault detecting relays issue a trip
command to the breaker. The scheme operates as follows:
 Timer 62-1 has a short time delay, based on expected breaker mechanism operating time, plus a
safety margin. The timer operation is enabled by a fast 52aa contact that is driven by the breaker
operating mechanism. The 52aa contact is adjusted to open as soon as the breaker operating
mechanism begins its motion to open the breaker. Opening the 52aa contact stops and resets timer
62-1. If timer 62-1 expires because the 52aa contact remains closed, the logic initiates breaker
failure output. The advantage of this part of logic is that this timer might be set without regard to
the reset time of the 50BF element since it is independent of the fault detector. Instead, by
measuring the breaker travel, the breaker failure operating time is reduced when the breaker
operating mechanism fails, at the expense of the reliability of the scheme.
 On breakers with independent operating mechanisms for each pole, where three-phase tripping is
applied, security of the 52aa scheme can be improved by using a series combination of a 52aa
contact from each pole of the breaker. This results in faster operation through timer 62-1 for a
failure of the mechanism on all three poles, and operation through the current detector scheme
when the mechanism on at least one pole has attempted but failed to interrupt current. All three
poles fail for this fast timer scheme to operate.
 Timer 62-2 has an intermediate time delay based on expected breaker current interrupting time plus
a safety margin. The timer operation is enabled by current detectors (50BF) that dropout (reset)
when the breaker contacts interrupt fault current. Current detector dropout stops and resets timer
62-2. If timer 62-2 expires because the current detectors remain picked up, the logic initiates
breaker failure output.
62-1
52 aa AND Timer
1
Breaker
BFI OR Failure
2
62-2 Scheme
50BF AND Timer Output
2
50
OR
50G 1
Figure 14 —Dual timer with 52aa and 50BF reset
27
IEEE Std C37.119-2016
6.9 Triple timer breaker failure scheme
Figure 15 depicts a triple timer breaker failure scheme with 52aa, 50BF, and 52a reset checks. The logic
includes a BFI input that starts three timers when external fault detecting relays issue a trip command to the
breaker. The scheme operates as follows:
 Timer 62-1 has the shortest time delay of the three, based on the expected breaker mechanism
operating time, plus a safety margin. The timer operation is enabled by a fast 52aa contact that is
driven by the breaker operating mechanism. The 52aa contact is adjusted to open as soon as the
breaker operating mechanism begins its motion to open the breaker. Opening the 52aa contact stops
and resets timer 62-1. If timer 62-1 expires because the 52aa contact remains closed, the logic
initiates breaker failure output.
 Timer 62-2 has an intermediate time delay based on expected breaker current interrupting time plus
a safety margin. The timer operation is enabled by current detectors (50BF) that dropout (reset)
when the breaker contacts interrupt fault current. Current detector dropout stops and resets timer
62-2. If timer 62-2 expires because the current detectors remain picked up, the logic initiates
breaker failure output.
 Timer 62-3 has the longest time delay of the three, based on expected overall breaker operating
time, plus a safety margin. The timer operation is enabled by a 52a contact that, preferably, is
driven by a direct link with the breaker interrupting contacts. Opening the 52a contact stops and
resets timer 62-3. If timer 62-3 expires because the 52a contact remains closed, the logic initiates
breaker failure output. This relatively slow breaker failure logic supplements the other two stages
of the breaker failure logic for breaker failure operations where the operating mechanism operated,
but the main contacts did not, and the breaker current was below the pickup on the 50BF current
detectors.
BFI 62-1
AND Timer
52 aa 1
Shortest Delay
62-2
50BF Breaker
AND OR
2 Timer
2 Failure
50 Scheme
OR Intermediate Delay
1 Output
50G
62-3
AND Timer
52 a 3
Longest Delay
Figure 15 —Triple timer with 52aa, 50BF, and 52a reset
28
IEEE Std C37.119-2016
6.10 Single-phase tripping, breaker failure, and re-trip logic
For breakers capable of independent pole operation, and with single-phase tripping protection applied,
monitoring the current or circuit breaker status of only the phase being tripped will give the circuit breaker
failure logic the proper information for operation.
When single-phase tripping is applied, some utilities may choose to use one set of trip coils for single-
phase tripping and another set for three-phase tripping. Both the primary and secondary line protection sets
are connected to trip only one set of trip coils. Breaker manufacturers provide the second set of trip coils as
a redundant means to actuate the breaker tripping mechanism. The re-trip feature is then relied upon to
provide necessary redundancy for control circuit and trip coil failures. The BFR measures a separate initiate
signal for each phase (BFI-A, BFI-B, and BFI-C), each of which is an indication from the protective relay
that a particular phase is being tripped, and provides three individual re-trip outputs. This is illustrated in
Figure 16. Where individual contacts trip the breaker three-phase, such as a lockout relay, then a fourth
initiate input and a three-phase re-trip output may be included in the scheme. On systems where delayed
tripping is undesirable, no intentional delay is added to the re-trip function. Separate output contacts from
each primary relay initiate the breaker failure scheme in a circuit that is separate from either trip coil
circuit.
62-A1
BFI-A
AND Timer Breaker Failure
50BF-A OR Scheme Output
Retrip
Retrip Phase A
Timer
62-A2
62-B1
BFI-B
AND Timer
50BF-B
Retrip Retrip Phase B
Timer
62-B2
62-C1
BFI-C
AND Timer
50BF-C
Retrip Retrip Phase C
Timer
62-C2
Figure 16 —Single-phase BFI with re-trip
6.11 Breaker failure timer bypass scheme
This scheme (see Figure 17) prevents unnecessary delay if prior knowledge of the breaker operating status
is known.
29
IEEE Std C37.119-2016
Gas breakers are blocked from operating when SF6 gas pressure falls below a specified value. A pressure
switch contact, provided by most of the manufacturers, is used in the BFR scheme to indicate the breaker
status. Under block close/trip conditions, the breaker failure initiate contact operates the breaker failure
output without any time delay if the overcurrent element (50BF) is picked up. The pressure contact status
input is delayed to prevent operations due to transients.
Standard breaker failure

BFI scheme
Breaker Failure
OR
Scheme Output
50BF AND
Low Gas
Pressure Timer
contact
Figure 17 —Breaker failure timer bypass scheme
6.12 Current differential breaker failure protection
Current differential protection elements are useful for accurately detecting faults that occur within power
circuit breakers.
A system operator may not be able to correctly diagnose an internal breaker fault if the fault occurs when
the main contacts are open, there is no visible damage, and it is cleared by primary protection devices
before a typical BFR pickup. If the operator does not have a BFR target or alarm, then the time needed to
keep part of the power system out of service to properly identify the faulted breaker may be unreasonably
long. In this case the operator may test the faulted breaker and cause a dangerous and catastrophic failure.
A current differential element supplied from CTs on each side of the breaker (87 BFR of Figure 18) will
operate quickly and act independently of other primary protective devices (87 BUS DIFF and 21 LINE of
Figure 18), thus providing a quick diagnostic to this serious problem.
Once picked up, the breaker current differential element bypasses the breaker failure timer to immediately
declare a breaker failure output.
Note that depending upon operating and dispatch practices this scheme might or might not be determined to
be useful by some utilities. An extra relay scheme is required and this can add cost due to the additional
equipment and maintenance required. Instead of using a differential element, this scheme might also be
implemented by sensing the logical condition that both adjacent zone protections have picked up.
30
IEEE Std C37.119-2016
87
BUS
DIFF
50 21
BFR LINE
87
BFR
Figure 18 —Breaker differential protection
6.13 Ground fault breaker failure on both live tank circuit breaker and current
transformer column failure
Existing on some transmission power systems of 115 kV and above is a type of breaker called a live tank
circuit breaker. It is strictly a current interrupter with the measuring current transformers contained in a
separate stand-alone column adjacent to the breaker. With this arrangement it is not possible for the circuit
protections on each side of the breaker to overlap one another. Faults in the “blind” zone on or between the
live tank breaker and the free-standing current transformer will be detected by the overlapping circuit
protection from one side of the breaker only. The circuit protection for the opposite side of the breaker does
not overlap the breaker and will not detect the fault. Hence, the fault will not be cleared. The most likely
fault in this zone is a column to ground flashover. For this reason, column ground fault protection is added.
The breaker interrupters (one per phase) are physically mounted on the top of an insulated column typically
made of porcelain. The CTs for the breaker are on top of their insulated column in a separate housing.
Mounted at the bottom of each phase of breaker and CT columns are current transformers that are around
the base of each column for measuring ground fault current. In the event of a failure or faulted/short circuit
of the primary of either the breaker column or the CT column to ground, these bottom CTs measure the
fault current through an overcurrent relay. One design is to have the CT column secondary current “A”
phase in parallel with the breaker column CT secondary current “A” phase and then summed into the
current input of a relay. The other phases would follow the same configuration. See Figure 19.
The relay of choice would be any overcurrent type relay, whether electromechanical or microprocessor
type, as long as it provides the necessary 50/51 element. The output of this protective relay would directly
operate the 86BF lock out relay coil, bypassing the BFI input of the BFR. The 86BF would then trip and
lockout all circuit breakers and initiate any DTT around the failed breaker or CT column. For further
information, refer to IEEE Std C37.234™ [B24].
31
IEEE Std C37.119-2016
Free Standing
Current Live Tank
Transformer Breaker
Bus
Interruptors
Insulating
Column
Conductive Insulating
Shield Column
Conductive
Pedestal Column Ground Column Ground
Conductive CT CT
Support Ground
Footing Riser Footing
Strap
Ground
Mat
50 86BF Trip
Column Ground CT of Free Standing
CT, Only one phase shown
Column Ground CT of Live Tank
Breaker, Only one phase shown
Figure 19 —Column ground fault protection
6.14 Series (tandem) breakers
There are instances where two critical transmission lines are installed on adjacent bus sections in a ring bus
system. If a breaker situated between two critical facilities fails to operate, a normal breaker failure scheme
would trip the adjacent breakers, essentially removing the two critical transmission lines from service. In
order to prevent this loss of two adjacent critical transmission lines during a breaker failure condition,
system planners in special critical cases recommend two breakers in series between the adjacent bus
sections. These tandem breaker protection schemes might be designed to be independent from one another,
e.g., separate dc supplies, CT sources, and control cables. In this design, when a trip condition comes up for
one of the critical transmission lines, the protection sends a trip to both of the series breakers. In these
cases, there is no need to install a BFR to be initiated by the line protection relays as one of the series
breakers is expected to operate to clear the fault. Therefore, the adjacent critical transmission line will
remain in service even if one of the breakers fails to operate. Figure 20 shows two series breakers, 2 and 2x,
installed between critical facilities 1 and 2. Note that where tandem breakers are installed, the area between
the series breakers requires its own bus differential scheme with a BFP for these breakers initiated only by
the bus differential scheme, as pictured. Note that other tandem breaker scheme variations exist, not shown,
that might be applied to other breaker arrangements.
In the scheme shown by Figure 20, the 87L relay protecting critical facility 2 trips breakers 3, 2, and 2X
and initiates only the breaker failure scheme for breaker 3 (not shown). The 87L relay protecting critical
facility 1 trips breakers 1, 2, and 2X and initiates only the breaker failure scheme for breaker 1 (not shown).
The 87B relay protecting the bus zone between breakers 2 and 2X trips breakers 2 and 2X. It also initiates
32
IEEE Std C37.119-2016
the BFP for breakers 2 and 2X. When operated, the BFP for breaker 2 would trip breaker 3 and breaker 2X.
The BFP for breaker 2X would trip breaker 2 and breaker 1.
Critical
Facility
2
3 2 2x
50BF 50BF
2 2X
87L
87B
Critical
Facility
87L 1
1
Figure 20 —Tandem breakers scheme
Another case where tandem breakers may be required is where stability studies show that the critical
clearing time is less than the shortest backup clearing time attainable with high-speed BFP schemes. Both
breakers are tripped simultaneously by fully-redundant protection schemes, with independent instrument
transformers, communication channels, DC supplies, and control cables. With this arrangement it is
assumed that at least one of the breakers will interrupt the fault, the total clearing time can be assumed to be
the same as the primary clearing time, and no separate breaker failure scheme is necessary.
A scheme that may be considered for the configuration with two breakers in series, when used for
enhancing clearing time for stability reasons, is to wrap around them the protection of the system elements
such as a line, a bus, or a transformer, to create a protection zone overlap and avoid installing a separate bus
differential with BFP for the breakers. This arrangement is shown in Figure 21. In this example, the
overlapping current differential protection zones for lines 1 and 2 also protect the area between the series
breakers, 2 and 2x. Therefore, there is no need for the separate bus differential protection for this area. The
fault in the area between the series breakers is, typically, a very rare occasion, and both protection zones
operate for this fault, thus indicating the fault location, but both of the critical lines are lost due to one fault.
Additionally, both breakers are tripped simultaneously for a fault on line 1, line 2, or between the breakers
and no BFP is necessary because a practical assumption is that at least one of the breakers will trip. Note
that this simplified application of tandem BFP does not provide the improvement in selectivity to prevent
tripping two adjacent important circuits as the scheme shown in Figure 20.
33
IEEE Std C37.119-2016
Line 2
3 2 2x
87L
Line 1
87L
1
Figure 21 —Tandem breakers scheme without BFP
6.15 Breaker failure protection for generator applications
Designing a breaker failure scheme for a generator application requires somewhat different considerations
than most other breaker applications. The generator is a complex electromechanical system consisting of
the synchronous machine, the dc field, and the prime mover. Many of the protective elements associated
with a generator are for detecting abnormal operating conditions and not for detecting short circuits. Many
of the conditions that can cause severe damage to the generation system are not accompanied with high
currents. Remote backup via overreaching elements cannot be relied upon to supplement the breaker failure
scheme.
The following is a list of application considerations that are somewhat unique to generator applications:
 Breaker flashover due to two per unit voltage across the interrupters when the generator is 180º out
of phase with the system.
 Current continues to flow from the generator to an in-zone fault until the field decays making
location of the CTs used for breaker failure currents sensing critical.
 Many abnormal operating conditions that are damaging to the generator can occur when very low
current is flowing requiring use of mechanical indication of breaker status in addition to current
indication to allow a breaker failure backup trip.
 Generators can be damaged during synchronizing by a slow breaker close that causes the main
contacts to make well after the generator has passed through zero phase difference.
 Because detecting breaker failure during normal shutdown is just as important as for protective
relay trips for generator applications, it is necessary to be sure that the BF scheme is initiated for
normal shutdown trips. Initiation might be from a manual switch or lockout relay, from a controller
device, or from a protective relay sensing reverse power depending upon the unit/prime mover type
and control system design. 7
This clause highlights special breaker failure schemes that address these issues. For further detail about
generator protection schemes that operate the circuit breaker, refer to IEEE Std C37.102.
7
Information on references can be found in Clause 2.
34
IEEE Std C37.119-2016
In addition, there are a number of common breaker arrangements for connecting a generator to the power
system. These arrangements also dictate how the BFP system is designed. Applications with a generator
breaker on the terminals of the generator (low side of the GSU) are becoming more common. The
application considerations for a low-side generator breaker are quite different than for a high-side generator
breaker.
In unit-connected applications, the high-side generator breaker may belong to a transmission system owner
instead of the generation owner. In other cases, the generator breakers are under the jurisdiction of the
transmission system operator when the unit is off line and the generator is isolated from the system by a
disconnect switch and only under the jurisdiction of the generation owner when the unit is on line. In
situations like this, the breaker failure system design may be left to the transmission system owner and not
modified from standard practices used for transmission system circuit breakers. This can result in a breaker
failure scheme that is not adequate to protect the generator from damage if a breaker fails to open when
commanded.
6.15.1 Mechanical indication of breaker status (52a)
Anti-motoring protection is an example of a generator protective element that requires mechanical

detection of a failure to open. In a motoring event where the prime mover is no longer driving the generator
and the generator is driving the prime mover, failure to separate the generator from the power system can
damage the prime mover if this condition is allowed to continue.
The magnitude of the current through the breaker can be very small for a motoring condition. A steam
turbine, for example, has a typical motoring power range of 0.5% to 3.0% of generator rating. Assuming
that the current transformer ratio (CTR) is chosen such that the secondary current is 5 A at 100% of
generator rating, the current seen by the BFR for an anti-motoring trip can be as low as 14 mA. In many
cases, such as a dual breaker arrangement, the breaker CTR is chosen based on the bus rating and not the
unit rating so that the secondary current in the BFRs is even lower.
To overcome this limitation, mechanical indication of the breaker status is added to the breaker failure
scheme, as shown in Figure 11. The breaker failure initiate signal is supervised by two measures that the
breaker is closed; detectable current is flowing OR the breaker mechanical auxiliary contact still indicates
that the breaker is closed. Either of these conditions can indicate that the breaker is closed to declare a
breaker failure event and trip backup breakers.
If reliance on current measurement only is blindly applied to a generator breaker, the scheme may not
protect the generator for all fault and abnormal operating conditions.
6.15.2 CT locations
Caution is advised when selecting the location of the CTs used as an input to the current detectors in a
generator breaker failure scheme. Typically, relay manufacturers show the generator line side CT to be the
input to the current detectors. Generator neutral-side CTs are never appropriate for generator breaker failure
because the generator will continue to supply current to an in-zone fault until the stored energy in the field
dissipates even after the generator breaker successfully opens. This will result in an unnecessary backup
trip. In applications with a low-side generator breaker, using the CTs on the generator terminals can also
cause misoperation for a fault between the CTs and the generator breaker. The risk of faults in this limited
area is small, but the consequences may be severe. Ideally the CTs will be located such that they always
measure the current flowing directly into the generator breaker and thus be located locally to the breaker.
35
IEEE Std C37.119-2016
6.15.3 Open generator breaker flashover protection
Breaker flashover is most likely to occur just prior to synchronizing or just after the generator is removed
from service, when the voltage across the generator breaker contacts approaches twice its nominal value as
the generator voltage slips through 180 degrees out-of-phase with the power system. Although circuit
breakers are rated to withstand this voltage, the probability of a flashover occurring during this period is
increased. Rarely are such flashovers simultaneous three-phase occurrences; thus, most protection schemes
are designed to detect the flashover of one or two breaker poles.
If one or two poles of a breaker flash over, the resulting current unbalance will generally cause the
generator negative-sequence relay or possibly ground overcurrent backup relays to operate after a time
delay. These elements will initiate tripping of the flashed-over breaker; but the delay will typically be quite
long. Because the flashed-over breaker is already open, the generator cannot be isolated by tripping the
breaker so it is necessary to rely on the breaker failure scheme. In this case, the 50BF current detector is set
such that it will operate for the level of current that will occur for this flashover because the 52a
supervisory element will not be asserted.
Modifying the breaker failure scheme, as shown in Figure 22, decreases breaker flashover detection time.
For high-side generator breakers (designated “1” in Figure 22), an instantaneous overcurrent relay (50G) is
connected to the neutral of the generator step-up transformer. The relay output is supervised by the
generator breaker open (52b) status and provides an additional initiate to the breaker failure scheme. When
the generator breaker is open and one or two poles of the breaker flash over, the resulting transformer
neutral current is detected by the 50G relay without the delay that would be associated with negative-
sequence or ground backup relays. Again, the 50BF element is set with sufficient sensitivity to detect this
flashover condition to allow a breaker failure trip.
36
IEEE Std C37.119-2016
RELAY CONNECTIONS
50G
RELAY LOGIC DIAGRAM
52b 62
Breaker 50G
BFI BFT
Open
GSU X0 Bushing
Generator Protective Trip Breaker
Current Detector
Breaker Fail Initiate BF Timer Failure
52a Trip
Breaker 50BF
Closed
Current
Detector
Figure 22 —Modified breaker failure logic for breaker flashover
Inadvertent energization schemes and pole disagreement schemes can also be used to supplement the
breaker failure scheme to detect a flashover. However, these often only re-trip the breaker that has flashed
over, requiring the breaker failure scheme to provide backup tripping to isolate the generator.
6.15.4 Breaker arrangements, unit-connected generator with high-side breakers
The circuit breaker arrangement is also an important consideration. Figure 23 and Figure 24 show typical
arrangements for a unit-connected generator. Figure 23 shows a unit-connected generator with a single
breaker connecting it to a straight bus. This arrangement is fairly straightforward. The generator breaker
separates the generator zone from the bus zone. The breaker failure scheme can be designed with only the
generator zone in mind. Faults in the bus zone will trip breakers 1, 2, 3, and 4. The breaker failure scheme
for breaker 1 has to trip these same breakers.
37
IEEE Std C37.119-2016
A B
G1 1 3 5
Generator
Protection Zone
G2 2 4 6
Figure 23 —Unit-connected generator directly connected
Figure 24 shows a unit-connected generator connected to a ring bus. This example applies to other double
breaker arrangements such as breaker-and-a-half and double-bus double-breaker. The generator breakers
separate the generator zone from an adjacent zone that can be a line or transformer instead of a bus. In this
example, breaker 1 will be called upon to trip for a fault on line A−B in addition to generator trips. To
isolate the failed breaker 1, breakers 2, 3, and remote breaker 5 is tripped. A DTT scheme is necessary to
open the remote breaker because the relaying at station B will not be able to detect and trip via remote
backup for many of the abnormal operating conditions for which the generator protection may trip breakers
1 and 2.
38
IEEE Std C37.119-2016
1 3
G1 A G2
Generator
Protection 2 4
Zone
Figure 24 —Unit-connected generator, ring bus connected
In these applications, it is recommended to modify the 52a supervision logic such that it only allows a
breaker failure trip for generator trips. Figure 25 shows the basic logic for breaker 1. Timer 62BF is
initiated for both line trips (21L) and generator trips (86G). If the initiate is from 21L, the current detector,
50BF, is asserted when the timer times out for breaker failure trip (BFT) to assert. If the initiate is from
86G, either the 50BF or the 52a is asserted for BFT to assert. This scheme only uses the less dependable
mechanical indication of failure to open for generator trips instead of for all trips.
39
IEEE Std C37.119-2016
62BF
21L
BFI
Line BFT
A-B Breaker Failure
Trips Initiate Breaker
Breaker 1 Failure
86G
50BF Trip
All
Generator Breaker
Trips Failure
Current Detector
52a
Breaker
Mechanical
Status
Figure 25 —Modified breaker failure scheme for dual breaker applications
6.15.5 Breaker arrangements, generator low-side breaker
Figure 26 shows a generator with a low-side breaker. This arrangement is becoming more common. The
generator breaker separates the generator zone from the isophase bus, generator step up transformer, and
the main auxiliary power transformer. For faults in the zone on the system side of breaker G, the short-
circuit contribution from the generator is removed by the following:
a) Tripping the generator circuit breaker “G”

b) Opening the generator field breaker
c) Isolating the energy source that drives the prime mover.
To isolate the failed breaker G, breakers 1 and A are tripped.
In this application, typically the GSU is delta connected on the low-side and some form of high impedance
grounding is utilized on the generator to limit stator ground fault currents. As a result of this configuration
there is less likelihood of a flashover in a low-side breaker. Figure 11 shows the basic logic for a breaker
failure trip on a low-side breaker. For all generator trips (86G lockout) the scheme is enabled and timer
62BF is initiated. For a breaker fail trip to be asserted, either the current detector (50BF) or breaker status
(52a) is asserted for the duration of the 62BF timer setting time.
Initiation of the high side breaker failure scheme, breaker 1 of Figure 26, for lo-side generator (G) breaker
failures, is often practiced by utilities with a philosophy that generator protection, including breaker failure,
is treated by the high-side breaker protection as any other protection trip. See 7.6.2 for further discussion
about utility philosophies for initiation of the BFP for adjacent breaker failures.
40
IEEE Std C37.119-2016
A B
G1 G 1 3 5
Generator
Protection Zone
A C
4 6
Figure 26 —Generator low-side breaker
6.15.6 Generator breaker failure to close protection
It is desirable that a generator be synchronized carefully to the power system. Generator synchronizing
systems are built to verify that the speed difference (slip rate), voltage difference, and angular difference
between the generator and the bus are small when the synchronizing breaker is closed, thus limiting the
mechanical and electrical stresses to well within the rated capabilities of the turbine-generator set.
Faulty synchronization can cause severe damage to the mechanical system of the generator and prime
mover and to the windings of the stator and associated step-up transformer. If the angle difference is large
between the generator voltage and the system voltage at the time of breaker closing, large transient torques
will occur to snap the generator rotor and prime mover into phase with the power system. In addition,
transient currents during a faulty synchronization can be in excess of the three-phase bolted fault current for
which the electrical windings are designed, resulting in winding failures.
A synchronizing system is designed to cause the generator synchronizing breaker’s main contacts to make
at the instant when the angle difference across the breaker is as near to zero degrees as possible. However,
if the breaker mechanism is slower than expected, the generator rotor angle will continue past zero and the
angle difference will start increasing. Depending on how slow the breaker is to close, the angle can increase
to a point that severe damage can be expected if the breaker main contacts eventually do close.
If the operator is fortunate, the breaker may fail to close at all. However, once a close command is issued to
the breaker, it cannot be recalled. A slow breaker may be caused by friction in the operating mechanism or
other issues that allow it to eventually close at an undetermined time, likely after the rotor angle has moved
significantly out of phase with the system voltage. To prevent this possible out-of-phase close, the BFP
system can be used to isolate the synchronizing breaker such that, if the breaker closes, the bus side of the
breaker has been de-energized and the generator safely closes into a dead bus.
Figure 27 shows the generator synchronizing breaker failure to close protection system logic. The logic is
very similar to other breaker failure logic schemes in that there is an initiate that indicates that the breaker
has been commanded to change state and a supervising condition that indicates if the command was
successful. In this case, the supervising condition is monitoring the angle difference between the generator
and the bus. If the close is successful, the angle difference will be zero. If the close is delayed long enough
for the angle to advance into the close fail region, AND gate 1 will be satisfied resulting in a SYNC
41
IEEE Std C37.119-2016
CLOSE FAIL assertion. The SYNC CLOSE FAIL assertion is used to trip the 86BF lockout relay for the
synchronizing breaker.
To improve security, it is recommended to make the CLOSE FAIL INITIATE input to the logic an
indication that the close coil is energized. Thus, instead of initiating the scheme on a contact from the
manual control switch or automatic synchronizer, the CLOSE FAIL INITIATE input would monitor the
presence of a voltage signal at a point in the close circuit nearest the actual close coil, thereby monitoring
the lockout relay, synchronism check, and other blocking contacts. This would typically be done by wiring
a contact sensing input programmed for scheme initiate to the last terminal before the close command wire
leaves the panel to go to the breaker.
The CLOSE FAIL INITIATE is sealed in until the breaker closes or the window of opportunity timer
expires. The window of opportunity timer is provided to disarm the scheme for the case where the breaker
actually closes but the breaker status indication (52a) fails to change state. Without this timer, the scheme
would be armed and a BF trip could occur when the generator comes off line. This window of opportunity
timer would be set longer than the time it takes to slip into the close fail region. For example, at 50 mHz
slip and the close fail angle set to 30°, it would take 100 cycles, (1.67 s) to travel from 0° to 30°.
0° Safe Close
Angle
Close Fail
Region
ANGLE IN
CLOSE FAIL SYNC
REGION 1 CLOSE
FAIL Trip
86BF
CLOSE CLOSE PU
COIL FAIL 2 Sec
0
ENERGIZED INITIATE
sec
BREAKER
CLOSED
Figure 27 —Synchronizing breaker failure to close tripping logic
7. Breaker failure design considerations
7.1 General considerations
BFP schemes are normally activated by the protective relays or systems used for equipment protection such
as bus, line, transformer, or capacitor. The overall performance and proper operation of the local BFP
42
IEEE Std C37.119-2016
scheme is critical in terms of isolating the problem and preventing cascading effects elsewhere in the
system.
Breaker failure schemes are employed wherever failure of a breaker to operate or interrupt has an
unacceptable impact on the system. It traditionally has been applied on the high-voltage system and is
increasingly being applied at all voltage levels.
An ideal backup protection scheme is completely independent of the primary protection, and based on prior
discussion, it can be seen that local backup protection is faster and more effective at limiting damage than
remote backup protection schemes. Where BFP is deemed necessary, good performance of the protection
system is expected. Any one of several component failures such as failure of the relay to detect the fault,
failure of the breaker to interrupt, or failure of the control circuit to communicate the trip signal, might
result in an inability to trip locally. Hence, relays, instrument transformers (CTs), trip coils, and dc sources
supplied through fuses or air circuit breakers are often duplicated. For example, a reasonable level of local
backup protection is accomplished by employing fully duplicated tripping systems, independent and
galvanically isolated, operating in a one-out-of-two tripping arrangement, with each tripping system
initiating circuit BFP. Local breaker backup in the form of BFP can then be depended upon to fulfill the
function of the independent breaker by operating adjacent breakers to clear the fault.
Breaker failure initiation requires some type of interconnection between the primary relays and the BFP
backup scheme. How these interconnections are made can affect the degree of independence of the primary
and backup systems from one another. This clause describes some principles and industry best practices
about how these interconnections might be made so that best performance is achieved.
Whether for green-field projects or for additions or replacements to existing facilities, it is not always
practical to be able to duplicate each protection system component. Depending upon the age of existing
equipment or the date when first installed, duplication may not have been practiced. Judgment is required
when deciding how far to go when comparing the cost of duplication to the desired performance of the BFP
scheme.
Some of the factors influencing the proper operation of the BFP involve the design of the breaker failure
scheme. Typical design considerations for BFP schemes include the following:
 BFP scheme is secure against incorrect operations.
 Any protection operation that trips the breaker initiates the BFP scheme. (Refer to 7.6.2 for one
possible exception to this principle.)
 BFP scheme operation is independent of the types of failures detected in the breaker. For example,
the failure mode of the breaker trip coil (either failed open or shorted) does not affect the scheme’s
ability to detect the failed breaker and to properly isolate it from the power system.
 BFP scheme operation is not impacted by loss of the dc source to the failed breaker.
 Provision of sufficient isolation switches to allow maintenance and overall testing of the scheme.
 Proper application of auxiliary tripping relays, when applicable.
 Selection of properly rated inputs and outputs when the breaker failure is integrated as part of the
equipment protection package and when user selectivity in rating is provided.
 Proper application of dc circuits and avoidance of mixing supply sources. Minimizing the impact of
dc transients.
43
IEEE Std C37.119-2016
 A communication channel might be deployed to trip local or remote breakers. Does the critical
nature of the protected equipment warrant channel redundancy? Is alternate path routing
considered? Does the channel design meet planning requirements for reliability and single points of
failure?
 Prevent reclosing into a failed breaker, either local or remote. Block (cancel) reclosing of all
breakers that have been tripped by the BFP scheme.
 Direct transfer trip resulting from a breaker failure prevents remote reclosing into that failed
breaker.
 Effects of single pole tripping on breaker failure scheme operation is a consideration.
An independent BFP system uses a dc source that is different than the dc source used for the breaker
control. Care is exercised to avoid mixing of dc sources to decrease the impact of floating sources
activating the breaker failure scheme unnecessarily; however, it is not necessary to use a separate station
battery to supply the breaker failure system. The dc source for each of the breaker failure and the breaker
control consists of a separate fused dc circuit.
The breaker failure dc circuit might be monitored to detect loss of the dc supply. The impact of transient
voltages on relays with internal power supplies might also be evaluated in the application of the dc source
for BFRs.
The bus configuration may support sharing of the dc source for multiple BFRs provided that the dc source
is properly selected. The design is such that a single component failure does not result in the loss of the
ability to trip and the loss of BFP.
The breaker failure design can include a re-trip circuit, or re-trip logic in the case of microprocessor
devices. The re-trip function is intended to give the breaker a second chance to open prior to the breaker
failure scheme operating.
The selection and application of breaker failure auxiliary tripping devices is also critical, particularly during
commissioning stages or during maintenance intervals when scheme verification needs to be performed
without tripping energized equipment. The scheme testing procedures and design might allow for the
auxiliary tripping relay coil to be energized with the trip isolation switches open without damaging the
auxiliary relay. Otherwise, care is exercised to isolate the auxiliary tripping relay coil to avoid its failure
during testing.
Factors impacting the overall performance of the breaker failure scheme are carefully examined prior to the
design and implementation. The design minimizes the use of auxiliary components where possible, as these
devices introduce additional failure points and time delays in the scheme. For example, one might use a
dedicated set of breaker auxiliary contacts instead of using an auxiliary relay to multiply contacts that are
already in use.
A breaker failure scheme may be initiated by receipt of a DTT signal for various reasons. For example,
when DTT is part of the line protection or where DTT is used to quickly remove faults on reactors,
capacitors, or transformers that are on the line, the local breaker failure scheme may be initiated by a DTT
signal from the remote terminal. When transfer tripping is used to initiate BFP operation, proper isolation
of the local transfer trip receivers is incorporated to prevent inadvertent breaker tripping and breaker failure
initiation (BFI) during routine maintenance of the DTT transmitters at the remote substation, or when the
communication circuits used for DTT are being tested.
Typically a breaker failure scheme is designed such that manually opening a breaker does not initiate the
breaker failure scheme. However some utilities do initiate BF from the manual switch or supervisory
control and data acquisition (SCADA) trip signal. This can enable isolation of a problematic breaker for
44
IEEE Std C37.119-2016
diagnostic and/or repair purposes. Many utilities prefer not to initiate on a manual trip signal because of
reduced security of the BFP scheme.
7.2 Breaker failure current supervision (50BF)
The purpose of breaker failure current supervision (50BF) is to determine if the system has continued
current flow after the breaker was called upon to open. Current supervision is composed of non-directional
instantaneous relays (or elements) that monitor phase, ground, and residual current or any sequence
component of these currents.
There are two philosophies about how to set current supervision. One method is to set the measuring
element (50BF) as a current detector that picks up for minimum current conditions. Alternatively, the
element might be set to pick up for minimum fault current conditions.
7.2.1 Phase current detectors
Phase current detectors are non-directional overcurrent devices (or elements in a multi-function relay) with
instantaneous pickup and dropout time characteristics. They are typically set either as current detectors or
as fault detectors from minimum tap to 50% of minimum phase-to-phase fault current, depending on the
scheme that is used. In most applications, the level of load current is not an issue in setting the phase
current detectors. If for some reason there is a desire to not have the phase current detector picked up
during high load conditions, the application of a negative sequence current detector in addition to the phase
current detector could be considered. Negative sequence current detectors can be set below load current in
cases where the minimum phase fault current is less than the maximum load current through the breaker.
7.2.2 Ground current detectors
A ground current detector is a non-directional overcurrent device (or element in a multi-function relay)
with instantaneous pickup and dropout time characteristics, which responds to the sum of the phase
currents. Ground current detectors are typically set at about 50% of the minimum phase-ground fault
current available or below the current pickup setting of the ground time overcurrent protective relay.
7.3 Breaker failure as part of the primary protection for an element
Intelligent electronic devices (IEDs), including intelligent multi-function protective relays, are the most
common devices in new installations of substation protection and control systems. Intelligent multi-
function relays typically include a set of primary protective functions required for the protection of the
primary system equipment as well as multiple additional protection or non-protection elements that expand
their functionality. The drawback to employing the breaker failure function in a multi-function device is the
loss of independence of the breaker failure scheme from the primary or backup protective relays. Therefore,
when applying BFP as part of an existing primary or secondary relay, the issue of common-mode failure is
recognized and its effect on the application evaluated. To alleviate this problem, the breaker failure
function may be programmed in both primary and secondary relays, thus eliminating the common-mode
failure.
45
IEEE Std C37.119-2016
7.3.1 Part of feeder, transformer, motor, or transmission line protection devices
One of the most common additional built-in functions present in multi-function relays for the protection of
feeders, transformers, motors, or transmission lines is BFP. It can vary significantly in the level of
complexity, ranging from a basic single timer to multiple timers and elements, as described in Clause 6.
Following inception of a fault, one or more main protection functions or devices will operate and issue a
trip signal to the fault interrupting device. If the fault condition has not been cleared following a set time
delay after the trip initiation, the BFP will operate.
The BFP element can be configured to operate for trips triggered by protection elements within the relay or
via an external protection trip.
7.3.2 Part of centralized bus protection devices
A centralized bus differential protection system has a number of three-phase current inputs that typically
correspond to the number of elements connected to the protected bus. It will perform the data processing
for all the inputs and calculate the differential current in order to detect a bus fault and issue trip signals to
all breakers connected to the bus. At the same time, it will initiate the breaker failure element that has to
monitor the tripping of all breakers to verify that the fault has been cleared. If any breaker fails to clear the
fault, the bus protection issues a trip signal to all adjacent breakers and to the remote ends of the protected
lines, as applicable.
The trip circuit of the bus differential protection can also be used to trip all breakers on the bus when a
breaker failure occurs when the breaker trip was initiated by the protection of any of the primary system
elements connected to the bus. This may result in significant reduction in the wiring required to trip all
adjacent breakers to the one that failed to clear the fault, at the risk of not having BFP if the bus differential
protection is out of service. This situation needs to be evaluated for each application and may be alleviated
by wiring the bus lockout relay to a different control circuit, separate from the bus differential relay.
7.3.3 Part of distributed bus protection devices
A distributed bus protection system is built up from modules and configured to suit a fixed or changing bus
configuration. The advantage of such a system is that it significantly reduces the wiring, since it consists of
a central module and peripheral modules that are close to the CT locations. The interface between the
central and peripheral units is typically over high-speed fiber optic communication links.
The peripheral modules are the “input” modules for the circuits that are included in the bus configuration.
They accept the inputs from the CTs. In this case, the CTs do not need to be connected with the same ratio.
Any differential current that is caused by a fault on the bus is seen by the central unit and acted on
accordingly. The bus differential system architecture is built around the central unit that collects and
analyzes the information from the peripheral units associated with each bay or CT location. Circuit breaker
failure initiation is accomplished locally at each circuit by its associated peripheral module. A trip signal is
issued by the central unit and is then confirmed by the local peripheral unit. The peripheral unit will then
trip its associated breaker and initiate the breaker failure function. If the peripheral unit detects a failure of
the breaker to trip, it will trip its associated breaker and issue a general bus-zone trip signal via the central
unit to trip all breakers connected to the bus. If the breaker failure function of a peripheral unit is initiated
by an external protection device and it detects that the breaker has failed to trip, the peripheral unit will also
issue a general bus-zone trip signal via the central unit to trip all breakers connected to the bus.
46
IEEE Std C37.119-2016
7.4 Breaker failure initiation
A protection operation of any relay that trips a breaker usually initiates BFP of that breaker. Typically, the
one exception is breaker failure from an adjacent BFP system. The rationale for this exception is that it is
more likely to have a flaw in both breaker failure schemes than to have two breakers failed at the same
time.
Breaker failure initiate (BFI) may originate directly from a protective relay or from a contact on an
auxiliary relay or lockout relay. If originating from a protective relay, the BFI typically resets on breaker
operation and clearing of the fault. If originating from an auxiliary relay, the BFI may not reset once the
fault is successfully isolated. This operating characteristic is addressed in the scheme design.
The breaker failure element in a multi-function relay is initiated by any built-in protective function that
issues a breaker trip signal. An option to initiate it from an external protective device through an optically
isolated input, virtual input, or remote control might be available as well.
7.4.1 False BFI due to accidental dc battery grounding
Positive and negative buses of dc battery supply systems for protective relaying are typically ungrounded,
with high-impedance center-tapped grounding through light bulbs or a ground monitoring circuit in the
charger. If either bus (lead) suffers a ground fault, the dc supply to protection systems is sustained, but the
ground potential suddenly shifts by half the battery voltage.
There have been cases where BFI signals in power plants or substations are conveyed from fault protective
relays to BFRs by long wiring runs, with significant capacitance to ground. When a dc ground fault
accident occurred, the cable capacitance couples the shifted ground voltage to the BFI input. The half-
voltage false BFI signal then decays with a time constant that depends on the impedance of the BFI input of
the BF relay, and the cable capacitance. Capacitance values of 1 μF to 4 μF were reported for very long
runs. Relays with high input impedance and a response threshold below half of dc supply voltage would
seal in and initiate a false backup trip.
Battery grounding is a common single-contingency failure, and BF protection schemes need to be secure
when it happens. It is unlikely that BFI will be falsely energized if any of the following measures are
applied:
 Selecting a relay with a BFI input design that responds only above half of the maximum battery
voltage. Note that for a 125 Vdc battery, the maximum voltage is 140 Vdc, so the input does not
respond below 70 Vdc. It will, of course, respond to the lowest full battery value, which in this case
could be 90 Vdc.
 Selecting a relay whose binary inputs are compliant with IEC 60255-26 [B6] with specific
reference to 7.2.7, Power frequency immunity on dc binary inputs. 8
 Minimizing cable run length and capacitance. Capacitance is generally low for connections
between relays in the same control room.
 Utilizing a data communications-based means for conveying the BFI signal between buildings—a
serial status transfer protocol implemented via the serial ports of many modern microprocessor-
based protective relays, IEC 61850-8-1 [B18] Generic Object Oriented Substation Event (GOOSE)
binary points on optical Ethernet local area network (LAN), or equivalent data connection.
8
IEC 60255-26 has replaced IEC 60255-22-7.
47
IEEE Std C37.119-2016
7.5 Breaker failure actions
Depending on the application and the specific practices of the company or user, a breaker failure operation
can initiate the following actions:
 Trip each electrically adjacent breaker in the same substation regardless of voltage level. This is
accomplished through either a single dedicated breaker failure auxiliary relay or through two
independent auxiliary relays, one or both of whose primary functions may be associated with
another protection scheme (typically a differential scheme). Redundant auxiliary tripping relays
allow a single relay scheme to be unavailable without affecting the operation of the breaker failure
relaying. Also this might be accomplished by using modern microprocessor relays with the
sufficient quantity of outputs, or by using IEC 61850 [B7] GOOSE messages as described by 9.2.
 Key transfer trip, where applicable, to remote, electrically adjacent locations. The transfer trip
signal is extended long enough to assure remote breaker operation. Blocking of automatic reclosing
is maintained as long as the transfer trip is received at the remote location.
 Enable communications-assisted tripping in pilot relay systems to allow for remote tripping of
power circuit breakers associated with the failed breaker. Examples are the stopping of carrier on a
directional comparison blocking relay system or the initiation of the permissive signal in a
permissive overreaching pilot relaying scheme. Although this action may reduce the fault clearing
time, it may also allow the breaker at the remote terminal to reclose onto a failed breaker.
 Block reclosing of selected breakers depending upon existing local breaker reclosing schemes or
substation configuration.
 Initiate an alarm indicating the breaker failure to trip.
 Generate an event record for breaker failure to trip.
 Trip the failed breaker. This action may be considered redundant, particularly if “retrip” logic is
used in the scheme.
 Lock out or block all closing of the breakers tripped. This action may be unacceptable if remote
restoration is desirable. An alternative option is to use an electric reset lockout relay as described in
7.6.1.
7.6 Practical considerations, applying breaker failure protection to redundant

control circuits
Transmission system circuit elements (transmission lines, buses, transformer banks, etc.) are often
protected by locally redundant primary relays (R1X and R2X protecting Circuit Element X of Figure 28)
each measuring the inputs from separate instrument transformer secondary windings, each designed to
provide complete, independent protection for the element. When applying BFP, this redundancy and
independence could be expanded to the breaker control circuits so that a single component failure cannot
disable both the primary and breaker failure backup protection, while still ensuring that each protection
function that trips the breaker can still initiate breaker failure.
48
IEEE Std C37.119-2016
Circuit Element X Circuit Element Y
50BF
R1Y R2Y R2X R1X
Figure 28 —Power circuit breaker common to circuit elements X and Y
The dc supply and control circuit wiring, integral to the breaker operation during a fault, can itself be the
source of protection system failures. Redundancy in breaker control circuits is achieved by specifying two
independent trip coils (TC1 and TC2 of Figure 29) in the circuit breaker with each receiving its dc supply
from separately fused and independent dc circuits. The overall relay system can then overcome a short or
open circuit in either trip coil path.
49
IEEE Std C37.119-2016
CS R1X R1Y R2X R2Y R1X R1Y R2X R2Y BFR
BREAKER
TC1 TC2 BFI FALURE 86
RELAY
A.
CS R1X R1Y R2X R2Y R1X R1Y R2X R2Y R1X R1Y R2X R2Y BFR
BREAKER
RELAY
B.
CS R1X R1Y R2X R2Y R1X R1Y R2X R2Y BFR
BREAKER
RELAY
C.
R1X R2X R1Y R2Y
R1X R2X R1Y R2Y

AUX AUX AUX AUX
R1X R1Y R2X R2Y R1X R1Y R2X R2Y

CS AUX AUX AUX AUX BFR
AUX AUX AUX AUX
BREAKER
RELAY
D.
BFI BFI
CS R1X R1Y R2X R2Y
AUX AUX2 BFR
BREAKER
BFI BFI
AUX AUX2
RELAY
E.
CS R1X R2X R1Y R2Y BFR R1X R2X R1Y R2Y BFR
RETRIP
BREAKER
RELAY
F.
Figure 29 —Methods to initiate BF for circuits X and Y on each side of a PCB 9
9
The above figures describe separately fused control circuits for a single breaker terminal. If a dual breaker scheme is protected, then
there are twice as many (six) control circuits needed, three control circuits for each breaker. For method D, it is noted that for a dual
breaker type switchyard arrangement such as ring bus or breaker-and-one-half scheme, each of the auxiliary relays, R1X, R2X, R1Y,
and R2Y would need a total of four relay output contacts, two contacts to initiate each dual breaker failure scheme separately, and two
contacts to trip each breaker separately. This might also be accomplished by using separate auxiliary relays to initiate breaker failure
from those used to trip the breaker.
50
IEEE Std C37.119-2016
CS R1X R1Y R2X R2Y
BREAKER
BFI BFI FALURE BFR
RELAY
TC1 TC2 86
G.
CS R1X R1Y R2X R2Y BFR1 BFR2
BREAKER BREAKER
TC1 BFI FALURE TC2 BFI FALURE 86
RELAY 1 RELAY 2
H.
Figure 30 —Continuation of Figure 29
Several methods of breaker failure initiation are in practice. In most applications involving redundant
primary relays or primary/secondary relay schemes, the breaker failure function is not duplicated. The key
feature in any scheme is to keep the primary protection as independent of the backup protection as possible
and practical. The examples provided in the remainder of this clause illustrate the application of redundant
protection with a single BFP.
Figure 29 and Figure 30 show several possible ways to initiate BFP for transmission system circuit
elements X and Y on each side of a power circuit breaker with each element protected by redundant relays.
For any of the methods labeled A−H, if applied to a dual breaker arrangement, then another, similar set of
TC1, TC2, and BFI circuits (not shown) are needed for the second circuit breakers that terminate each
element
One method [which is recognized by the North American Electric Reliability Corporation (NERC) [B27]]
is where each primary relaying system operates separate trip coils on the breaker, (R1X on TC1, and
separately R2X on TC2 of Figure 29-A). Here breaker failure is initiated in a separate circuit either by
independent relay contacts from each primary relay or by contacts from an interposing relay used to repeat
the primary relay trip function to the breaker failure initiate circuit. Some utilities place this interposing
relay pickup coil in parallel with the breaker trip coil (see Figure 29-E). The interposing relay is not needed
if separate, electrically-isolated BFI inputs from the BFR itself are available to be placed in parallel with
each trip coil (see Figure 30-G). The practice of using the trip circuit dc supply to initiate the BFP is
generally discouraged as loss of trip circuit dc can be a common-mode failure that results in failure to trip
and failure to initiate the BFP.
The first trip circuit of Figure 29-E includes a steering diode. The purpose of this diode is to prevent
initiation of the breaker failure scheme when the breaker is tripped manually by supervisory control. This
diode enables the sharing of the first trip coil control circuit by both the first set of primary protection and
also the manual controls. It enables each of the redundant primary protections to operate separately on each
trip coil. The steering diode is not needed if there are sufficient contacts from each of the primary relays
that trip the breaker, to initiate the breaker failure sequence in a separate circuit, or where auxiliary tripping
relays are used to multiply the primary tripping contacts so that breaker failure initiation can be done
separately. This may require additional dc supply circuits to drive the interposing relays.
As a variation, each primary relay may operate separately on both trip coils. This method (shown in Figure
29-B) is able to overcome a failure to operate of either primary relay, coincident with a second failure of
trip coil or wiring in either trip coil path. Although not shown, breaker failure re-trip might be added to
either or both of these trip coil circuits for reasons other than trip coil or wiring failures as previously
described in 6.2.
51
IEEE Std C37.119-2016
To reduce the number of control circuits needed, utilities may place the BFI of the BFR in parallel with the
breaker trip coil as shown by Figure 29-C.
The method shown in Figure 29-D uses interposing relays to multiply primary relay functions for breaker
failure initiation and for tripping multiple breakers. Although only one interposing relay is shown for each
relay set, more than one interposing relay might be needed for each set depending upon the number of
contacts available for relays of a given operating speed. Refer to the example of 7.6.1 where one auxiliary
relay is used to trip multiple breakers and a separate auxiliary relay is used to initiate breaker failure.
Figure 29-F illustrates a different method where both the first and second primary relay systems operate the
first trip coil. Separate contacts from both primary protection systems initiate the BFR in a separate circuit.
The re-trip from the BFP scheme then operates on the second trip coil. If the re-trip function is delayed,
then it is possible to identify a failure of the first trip coil circuit when the breaker operates with this extra
delay. Some companies use this method without delaying the re-trip circuit.
For cases where most primary protection functions are redundant but one particular function such as
transfer trip received is not redundant, then the breaker failure re-trip feature might be relied upon to repeat
this function separately to the opposite trip coil path. Care is taken so that the re-trip output circuit does not
seal in through the BFI input circuit without any supervision of re-trip by breaker current. A steering diode
might be applied to prevent this occurrence.
Figure 30-H shows a scheme where two different BFRs are each being initiated by a different primary
protection, R1 or R2. This might be a case where the breaker failure function is applied as an additional
optional function within the primary protective relay or where galvanic isolation is desired. Complete, non-
redundant BFP for the breaker is the aggregate output from both relays.
7.6.1 Example: breaker failure protection with redundant electro-mechanical or static

10
primary relaying
It can be challenging where electromechanical or static protective relays are applied to a transmission
system circuit element where they have only one output contact and have no provision for logic
programming. Particular BFRs might not include multiple inputs for initiation. If the protected element is
served locally by two power circuit breakers then up to six control circuits are involved, one for each trip
coil for each power circuit breaker (4 circuits) and another to initiate breaker failure for each circuit breaker
(2 circuits). It might be tempting to interconnect the different control and initiation circuits of the same or
different power circuit breakers together using diodes, but this might increase exposure of the scheme(s) to
short circuits. Although modern microprocessor relays have sufficient inputs and outputs to provide the
desired electrical isolation for independent operation, even these can be somewhat limited as this I/O might
be needed for functions other than for breaker failure.
Figure 31−Figure 34 illustrate a relay protection and breaker fail scheme that has been commonly
employed in several utilities. The figures describe BFP for breaker #2 of Figure 31. In this scheme, the
protective relay trip contacts are multiplied using high-speed tripping relays (94-1, 94-2, 94-3, and 94-4)
designed specifically for protection applications, used here to trip multiple breakers. Also, separate
auxiliary relays initiate the breaker failure scheme. These relays (62X-1,62X-2, 62X-3, and 62X-4), are
selected to have high enough impedance such that they will not prevent dropout of the electromechanical
relay’s seal-in circuit (not shown), when the 52a toggles open as the breaker opens. In this example the
breaker failure circuit is not redundant.
Not shown in these figures but an important element in any dc protection circuit is dc voltage monitoring.
The circuits shown in Figure 32−Figure 34 would each have their own dc voltage monitoring relay (74dc),
not shown in this example for clarity.
10
This example applies BFP to a legacy type relay system and serves to illustrate basic principles of how to maintain independence of
the primary and backup relay systems from one another.
52
IEEE Std C37.119-2016
The following points are intended to provide more clarity to the circuits illustrated in these figures:
a) This dc tripping and BFP scheme is shown in basic form, for illustration purposes. This schematic
is not intended to convey all required devices and terminations that would accompany an actual,
detailed dc tripping and BFP schematic.
b) Breaker control devices including SCADA control would not be included in those tripping actions
that could initiate breaker failure.
c) 94ET—Early trip (re-trip) relay. This relay initiates a second trip immediately after the first trip as
a “non-time delay second shot”.
d) 50BF—Low-set, fast resetting overcurrent relay, used as current monitor. One of its functions is to
reset the BFP scheme. In this example the 50BF is intentionally shown in the CT circuits for the
second primary relaying (R2, R4).
e) 62BF—Timer delay, on-delay (delay setting as required to maintain system security during a fault
event).
f) 86BF—Lockout relay that is energized upon detection of failure of the breaker to open on a
protective relay trip. The 86BF will trip the adjacent circuit breakers, block-close all affected
breakers and (where applicable) block any automatic reclosing schemes. 11
g) Some electromechanical relays seal in their trip signal through the indication contactor switch or
target relay. In such cases an external provision is necessary to drop out the protective relay coil
once the breakers have operated. Figure 32 shows an example of this feature through the
application of parallel 52a contacts.
h) Sequence of operation: The following sequence is initiated by a fault on Transmission Line #1,
with power being supplied through Breaker #2 (i.e., Breaker #1 has tripped successfully open).
1) A protective relay senses the fault, times out, and sends a trip signal to each power circuit
breaker (Breaker #1 and Breaker #2).
2) Focusing only upon breaker #2: Relay set R1 operates trip coil #1 via interposing relay 94-1
and initiates breaker failure sequence through relay 62X-1 (non-latching). Relay set R2
operates trip coil #2 via interposing relay 94-2 and initiates the breaker failure sequence
through relay 62X-2 (non-latching).
3) Overcurrent relay 50BF-2 also sees fault current in excess of its pickup setting and operates.
This action along with the closure of the 62X-1 and/or 62X-2 contacts results in the following
two actions:
i) Picks up the BF timer relay (62BF-2);
ii) Initiates the fast second trip (94ET-2) to both trip coil #1 and #2 circuits (“re-trip”)
4) If the fault is cleared, then 50BF-2 resets, all interposing relays drop out and the BF sequence
is halted and reset.
5) If 62BF-2 times out, indicating a failure of Breaker #2, the lockout relay 86BF-2 (latching
relay) picks up and initiates trips per point item f) previously.
6) Once the breaker failure mechanism has been identified and corrected, 86BF will need to be
reset before reclosing any affected breakers.
11
For the case where a single pole operated breaker with single phase relaying has failed, then it might also be desirable to have the
86BF relay to initiate a three pole trip to the failed breaker as well.
53
IEEE Std C37.119-2016
To R3,R4 To R1,R2
TL #2 TL #1
BUS 2 BUS 1
BKR BKR BKR

#3 #2 #1
To Bus 2 To Bus 2 To Bus 1 To Bus 1
Relays 50BF- Relays Relays
50BF- Relays 50BF-
2
3 1
R2 R1
R4 R3
62X-4 94-4 62X-3 94-3 62X-2 94-2 62X-1 94-1
Bus 1 Prot # 1 BFI

Bus 2 Prot # 1 BFI Bus 1 Prot # 2 BFI
Bus 2 Prot # 2 BFI
Transmission Line (TL) #2
Transmission Line (TL) #1

94ET 62BF
94ET 62BF 94ET 62BF -1 -1
-3 -3 -2 -2
86BF
86BF 86BF -1
-3 -2
BKR BKR BKR BKR

#6 #7 #4 #5
Figure 31 —Breaker-and-a-half BFP scheme using electro-mechanical/static relays 12
12
R1, R2, R3, and R4 represent relay sets that might include multiple devices with multiple zones protecting all three phases. When
comprised of legacy electromechanical relays, these typically have an indicating contactor switch or dc clapper type device, which,
when operated, seals-in the output of the electromechanical relay until the circuit is broken by opening of the breaker 52a switch as the
breaker opens.
54
IEEE Std C37.119-2016
+125 VDC, cct #1 +125 VDC, cct #2

R1 R1 Transfer R2 R2
R1- R2
Zone Zone Trip Zone Zone
67N 67N
1 2 Received 1 2
94-1 62X 94-2 62X

-1 -2
D2a D2a D2a D2a

BKR#2 BKR#1 BKR#2 BKR#1
-125 VDC, cct #1 -125 VDC, cct #2
94-1 62X-1 94-2 62X-2

Trip Bkr #1, (1) Trip Bkr #1, (1)
Initiate BF (1) Initiate BF (1)
Trip Coil #1 Bkr #1 Trip Coil #2 Bkr #1
Trip Bkr #2, (2) Trip Bkr #2, (2)
Initiate BF (2) Initiate BF (2)
Trip Coil #1 Bkr #2 Trip Coil #2 Bkr #2
Figure 32 —Simplified protective relay dc trip circuit for line #1 of Figure 31
+125 VDC, cct #3 +125 VDC, cct #4
94-1 Control
94-3 94ET 86BF 86BF 94-2 94-4 94ET
Switch
-2 -1 -3 -2
SCADA (to other protection C
control devices)
breaker breaker
internal internal
trip trip
circuit TC1 TC2
circuit
-125 VDC, cct #3 -125 VDC, cct #4
Figure 33 —Simplified trip coil circuits for breaker #2 13
13
This figure employs the method illustrated by Figure 29-A. Note that where single pole breakers exist with single phase tripping
schemes deployed, additional BF trip actions might be needed such as three-pole trip of the failed breaker. This is not only for a failed
breaker to trip but also for a failure to reclose the faulted phase. These schemes are beyond the scope of this example.
55
IEEE Std C37.119-2016
+125 VDC, cct #5 86BF-2

(1)
86BF 86BF 62X 62X 62X 62X 62BF
(8)
3-Pole Trip Bkr #1 Transfer Trip Bkr #6
-1 -3 -1 -2 -3 -4 -2
(9)
50BF (2)
Transfer Trip Bkr #7
BFI Bkr #1
-2
(3) (10)
Cancel Reclose-TL#1
(4)
(11)
TDPU 3-Pole Trip Bkr #3
62BF 94ET 86BF Cancel Reclose-TL#2
XXX -2 -2 -2 (5)
(12)
msec BFI Bkr #3 Block-Close Bkr #1
(6)
-125 VDC, cct #5 (13)
Transfer Trip Bkr #4
94ET-2 (7) (14)
Fast-Trip Bkr #2 (1) Transfer Trip Bkr #5 Block-Close Bkr #3
Trip Coil #1
(2)
Fast-Trip Bkr #2
Trip Coil #2
Figure 34 —Breaker failure dc circuit, breaker #2 14
7.6.2 Breaker failure initiation by an adjacent breaker failure
One of several protection functions that trip the power circuit breaker is the failure of an electrically
adjacent breaker. The choice of whether or not to initiate the breaker failure sequence when an adjacent
breaker fails depends upon philosophy. Concern of possible insecure or cascading inadvertent operations of
the breaker failure scheme might be a reason not to initiate BFP for an adjacent breaker failure. Typically
schemes are designed to overcome a single component failure and therefore protection for the occurrence
of a second breaker failure would go beyond this. However, some utilities apply auxiliary devices with an
output resulting from more than one protection function, for example a bus lockout relay which operates for
either a bus fault or for any bus connected breaker failure. Here, the lockout might also initiate breaker
failure. For dual breaker arrangements, if a second breaker failure occurs, despite the additional delay of the
second BFP timer, tripping the local breakers can remove infeed thereby helping remote relays see the fault
better and also leaving more of the remaining substation intact when the fault is cleared.
For similar reasons a utility might decide to initiate breaker failure upon reception of a DTT signal. This
might also depend upon the applied teleprotection scheme and which type of events cause the DTT for that
circuit element. If DTT is sent only for a breaker failure condition then the utility might choose either to
initiate or not to initiate as previously described. However, if the line is terminated remotely by a power
transformer without a line side breaker, then it is desirable that the local breaker failure scheme be initiated
for the remote transformer fault condition. Direct underreaching transfer trip (DUTT) schemes (often used
in conjunction with POTT or DCB schemes) key a DTT when an underreaching relay senses a zone 1 fault.
For these schemes, some means for differentiating between a reclosable DUTT signal and a non-reclosable
DTT signal is used. Whether or not to initiate BFP on a DTT signal would be based on what keyed the
DTT signal.
Modern microprocessor relays internally monitor the received DTT signal producing a breaker trip output
which is monitored by the BFP to initiate breaker failure. If a utility chooses not to initiate breaker failure
from an adjacent breaker failure, then it is necessary to discriminate between the different remote events,
and to configure the relay to initiate breaker failure with a different logic than that used to trip the breaker.
14
Lockout relay contacts (86BF-1, 86BF-3) initiating the breaker failure scheme shown in Figure 34, depending upon the scheme, are
optional and at the discretion of the utility. For breakers 1 and 3 of the previous example, it is desirable to initiate breaker failure from
the bus fault protection and this might be accomplished using bus lockout relay contacts placed in the breaker failure initiate circuits
for breakers 1 and 3 (not shown).
56
IEEE Std C37.119-2016
7.6.3 Lockout of circuit restoration after breaker failure
Delay or cancellation of manual or automatic restoration is necessary to avoid damage from closing into a
failed breaker.
Typically, a breaker-dedicated lockout relay is used to trip and block closing of electrically adjacent power
circuit breakers that feed the circuit elements on each side of a failed breaker (see Figure 31). To prevent
closing, interlocking contacts, which open when the lockout relay operates, are placed in series with the
breaker close coil. The lockout relay latches indefinitely until it is manually or automatically reset. Some
companies require an inspection of faulted or failed equipment for possible repair prior to restoration, and
only allow manual reset of the lockout relay. Other companies permit an automatic reset of the lockout
relay after a definite delay, usually about 10 s, long enough to inhibit any automatic reclosing attempts.
Circuit-oriented lockout relays trip and close interlock the multiple breakers that surround a circuit element
such as a bus or a power transformer bank. One lockout relay might be common to more than one
protection scheme, such as a bus lockout relay shared by the bus protection and also the BFP of each bus-
connected breaker. A BFR might need to operate more than one lockout relay to clear the adjacent circuit
elements.
Lockout relays work in conjunction with transmission line reclosing relays. Knowledge of how a given
reclosing relay functions is necessary to properly design the breaker failure scheme and ensure that an
unexpected reclose does not occur. Complete cancellation might be preferred to temporary blocking of a
reclosing relay. Typical reclosing relay functions include a “locked out” state where the relay cannot close
its contacts until it is “reset” by the manual closing of the local line terminal breakers. For some reclosing
relays, reclosing is cancelled if the lockout relay blocks the breaker close signal for sufficient duration for
the reclosing relay to cycle to the locked-out state. This is done by using a manual reset or a definite delay
for reset of the lockout relay.
A lockout relay might also activate the “drive to lockout” input of the reclosing relay function. This second
method is typically used to cancel reclosing at the remote substation where a local breaker failure lockout
relay keys a DTT to the remote line terminal breakers and that activates the drive to lockout function of the
remote reclosing relay. Multifunctional relays have self-contained reclosing features that exchange multiple
binary logic variables over a teleprotection channel and one of these variables/functions might be assigned
specifically for a breaker failure occurrence.
Some companies provide motor operators to the disconnect switches that surround each power circuit
breaker. These disconnects are automatically opened upon successful fault clearing by the breaker failure
scheme to further isolate the failed breaker from the remaining power system. These automatic isolation
schemes supervise restoration by preventing automatic reset of the lockout relay until the fault has been
cleared and the disconnects surrounding the failed breaker have been successfully opened.
8. Factors influencing breaker failure protection settings
8.1 General factors
Typical breaker failure schemes include a phase current detector element and an operate timer. In addition,
they might include a ground detector current element. In the typical breaker failure scheme, as shown in
Figure 2, the 50BF element is composed of a phase current measurement in each of the three phases and a
residual ground current measurement, all of which operate a common timer. In some schemes, as in Figure
6, the current measurements are only activated when the assigned breaker is requested to trip, and the
breaker failure timer has timed out. The current will go to zero in the phase and ground current detectors
when the breaker has successfully operated and cleared the fault.
57
IEEE Std C37.119-2016
For a breaker failure scheme to provide the desired response when the protected breaker fails to interrupt
fault current, the current detectors need to be set sensitive enough to respond to any fault condition for
which the protective relays initiate trips to that breaker. There are a few applications in which use of
sensitive current detectors may not be adequate, such as for breakers that are associated with transformers,
static var compensators (SVC), or generators where the protective relays are designed to operate for fault
and abnormal operating conditions that draw little or no current through the breaker. In these cases, the
current detector in the breaker failure scheme will be limited by the minimum sensitivity of the BFR, and
the scheme may need to be supplemented with non-current sensing inputs, such as breaker position status
or the absence of voltage on the medium voltage bus in a SVC.
Setting the circuit breaker failure logic operate timer long enough to permit successful fault clearing by the
circuit breaker, as well as including a safety margin will reduce the possibility of needless operation. This
delay may be independently set for single- and three-phase tripping, or single-phase and multi-phase faults.
The logic need not require that either delay setting be significantly longer than the other.
8.2 Current detector pickup
Criteria for setting the current detectors will vary based on system strength and bus configuration. It is
often desirable to set them above maximum load to reduce the possibility of the current detectors from
being picked up for non-fault conditions. In many cases the maximum load current is significantly lower
than the minimum fault current and the breaker failure current pickup setting may be set above the
maximum load level. For applications where the maximum load current is comparable to or higher than the
minimum fault current, as in the case of extra-high voltage (EHV) long transmission lines, the breaker
failure pickup setting may have to be set to a level lower than the maximum load current. Over time, power
system modifications may change the relative load and minimum fault current levels and it may be
necessary to reevaluate current detector pickups. Subclause 7.2 provides some additional guidance on
setting current detectors.
In multi-breaker configurations, such as ring bus and breaker-and-a-half, it may not be possible to set the
current detector based on maximum load and minimum fault levels. The current split through each breaker
may be difficult to predict for all possible faults and bus configurations. A lower current detector pickup
may be needed for these applications. Also, the current measured by the BFR may change during the course
of the fault as other breakers trip. The BF schemes described in 6.3 and 6.4 account for this change in
current.
Some utilities set the 50BF element(s) as sensitive as possible (minimum tap) regardless of minimum fault
and maximum load level, assuming that when the breaker and or CT fails, it is unknown how well the CT
will perform. A most sensitive setting of the 50BF element might also be applied to generator connected
breakers where protection is applied for non-fault conditions such as loss of field, motoring, and most
especially flashover, where the breaker is open and the 52a input is not useful for detecting the flashover
failure. A sensitive setting might also improve breaker failure performance for the event when a breaker
opens mechanically but does not interrupt the current.
For three-phase tripping applications, a ground current detector in the breaker failure scheme can typically
be set with greater sensitivity than the phase elements. This will provide additional sensitivity for faults that
involve ground. The current magnitude for these faults will be limited by the amount of fault resistance,
which will vary depending on the nature of the fault; however, if the breaker failure ground current detector
is set the same as the most sensitive ground fault detecting relay that trips the breaker, the protection
packages are coordinated.
If either the phase or ground breaker failure current detector cannot be set sensitive enough to facilitate
tripping for all faults that initiate tripping of a breaker, then a scheme like that shown in Figure 11 or Figure
13 may be required. A typical application in which the 50BF breaker failure current detector is
supplemented with the 52a breaker auxiliary contact is for a transformer or generator application where a
58
IEEE Std C37.119-2016
volts per Hertz function or differential operation may operate for a condition or fault that produces very
little current. The implementation of a breaker failure scheme including a 52a breaker auxiliary contact is
usually discouraged as these contacts are considered to have low reliability relative to the rest of the
breaker failure scheme and may lower the overall security of the breaker failure scheme.
An alternative to using either the current detector by itself, or breaker auxiliary contact by itself to sense
whether the breaker has operated successfully, is to use a scheme that “ORs” the current detector with the
breaker auxiliary contact. In this scheme, if either is present, the breaker failure scheme is armed.
Current detector dropout may be delayed by dc current decay present in the CT circuit (known as
subsidence current), which often occurs following breaker primary current interruption with CT saturation.
Current detectors that operate on the magnitude of both ac and dc current are particularly prone to delayed
dropout due to remnant dc decaying current. Current detectors that operate on a change of current over time
principle (dI/dt) can also have a delayed dropout if the current detectors are set sensitively enough that the
dI/dt in the decaying dc is detected. Because the current threshold for this phenomenon is difficult, if not
impossible to determine, sufficient margin needs to be included in the breaker failure timer setting to
account for the added reset delay due to subsidence current. The BFR manufacturer might be consulted to
determine the current detector reset characteristics in the presence of subsidence current. BFRs that
examine current after the breaker failure timer expires are not necessarily immune to the effects of
subsidence current. Digital filters used in microprocessor-based relays typically retain sample data for one
power frequency cycle, so the filter output, which also includes the effect of subsidence current, may still
be sufficient to pick up the current detector, even though the primary current has been interrupted.
8.3 Breaker failure timer
It is important to minimize breaker failure time delay settings, while not jeopardizing the correct operation
or reducing the security of the circuit breaker failure scheme. Minimum breaker failure delay times are
applied for all fault types (single- and three-phase tripping) to enhance system stability, limit equipment
damage, improve coordination of overlapping protection schemes, and to improve quality of supply by
minimizing the duration of power system voltage dips.
Referring to Figure 3, by setting the breaker failure timer greater than the breaker interrupt time (less BFI
pickup as necessary) and the dropout of the 50BF current detector after the fault is cleared; the breaker
failure scheme will not operate for a successful breaker operation. Adequate margin is taken into account to
allow for maximum operate times. It is essential to set the breaker failure timer so that the total fault
clearing time is less than the transient stability time and prevents, or at least limits, damage to major
equipment such as conductors and transformers. An attempt might also be made to prevent shutdown of
major customers’ processes that may be affected by voltage sag. Depending on the sensitivity of these
processes, it may not be possible to reduce the breaker failure clearing time enough for them to ride through
the fault. As can be seen from Figure 3, the breaker failure scheme starts timing when a protective device
requests the breaker to trip. Therefore, there is no need to provide additional delay within the breaker
failure timer for external zones that may operate more slowly than breaker failure. Local backup relay
tripping of the same backup breakers that a breaker failure scheme would operate, before the breaker failure
timer times out, is to be avoided.
Coordination of remote backup protective relays may also be taken into consideration so that the BFP
operates first and with margin. Some relevant factors in determining an appropriate margin for the
coordination of backup protection include the following:
 Impact on clearing time of backup protection for faults in its own protected zone.
 Impact of tripping by the backup protection for a breaker failure situation. In some cases, the zone
protected by the backup protection may have to be cleared anyway for a breaker failure, and there
would be little benefit in slowing down the backup protection to coordinate with the BFP.
59
IEEE Std C37.119-2016
8.4 Total clearing time requirements
The total clearing time of the BFP scheme is the sum of the following quantities (as applicable):
 Relay operate time

 Relay output time
 BFR input recognition time
 Breaker failure timer
 Breaker failure output operate time
 Auxiliary and lockout relay operate times
 Communication delay time
 Backup breaker operate time
 Adequate margin
This time is compared to the transient stability requirements of the system as well as equipment damage
and customer voltage sag requirements.
The critical switching time for stability is one measure to determine how fast a breaker failure scheme
operates. The critical switching time for transient stability is dependent on many factors. Among these
factors are load margin in the system, inertia of the generators, and the type and severity of fault. In
general, the more severe the fault the faster the fault needs to be removed from the system. Also, because
the critical switching time is dependent upon displacement of positive sequence power, a three-phase fault
must be removed faster than a phase-to-phase-to-ground fault, which is cleared faster than a phase-to-phase
fault, which in turn is cleared faster than a phase-to-ground fault. Thus, a three-phase fault might need to be
cleared in breaker failure time much faster than a single phase-to-ground fault. If the breaker failure time,
due to stability requirements, is to be cleared faster than eight cycles, then it may be desirable to set the
breaker failure timer faster for three-phase faults than single phase-to-ground faults. A scheme like that is
shown in Figure 9. The very tight margin of the multi-phase faults is exercised in the rare case of a multi-
phase fault, while the more common single phase-to-ground faults are given additional time to allow
maximum timing margin to reduce the likelihood of extraneous breaker operations.
8.5 Control timer setting for scheme described in subclause 6.4
The control timer setting for the scheme described in 6.4 and shown in Figure 8 is carefully considered on
circuits that have high-speed sync-check reclosing. This is due to the possibility of producing a BF output if
a line relay trip contact fails closed.
For example, consider a line terminal with a BF relay that has the scheme of Figure 8. The breaker failure
timer is set at 7 cycles and the control timer is set at 36 cycles. The phase current detectors are necessarily
set below load so that the BF relay senses all fault conditions seen by primary relays (minimum fault
current below maximum load). The same terminal has a sync-check relay set to close in 15 cycles
following a breaker trip, if the bus and line voltages are in-phase.
Now, consider the situation that would occur if a line relay on this terminal failed with its trip contacts
closed. This stuck contact would provide a BFI input to the BFR, which starts both the breaker failure and
control timers. After three cycles, the breaker trips successfully, but the BFI signal continues due to the
failed line relay contact. Fifteen cycles later, the breaker recloses via the high-speed sync-check, restoring
line load through the breaker. By this time the BF timer has expired and there is current in the breaker, but
60
IEEE Std C37.119-2016
the control timer has not yet expired. Thus an erroneous breaker failure output is produced, tripping the
backup breakers on the bus section and disrupting the transmission system.
A proper control timer setting would coordinate with the sync-check reclosing time delay, and thus limit
the window of opportunity for a breaker failure output. In the specific case above, a control timer setting of
13.5 cycles would have prevented the erroneous breaker failure output while still providing enough margin
to produce a needed breaker failure output for an actual breaker failure condition. A proper setting of the
control timer would result in the line breaker tripping to lockout instead of locking out the entire bus from
an erroneous BF output.
It is necessary to be thoroughly familiar with the method used by a particular breaker failure relay
manufacturer, along with knowledge of the scheme in which the relay is placed, when setting this control
timer.
9. Communications-based breaker failure protection
9.1 Teleprotection in conventional breaker failure protection
Communications are used for BFP to send a DTT signal to a remote line breaker(s) in the event the local
breaker fails to trip. This practice enables high-speed remote clearing for faults that would otherwise be
cleared with some intentional time delay. DTT also avoids fault situations that may not be detected by
remote protection because fault contributions are minimal.
Teleprotection is the term used to describe communication-assisted protection. The teleprotection channel
could operate over leased telephone lines, power line carrier, microwave, or fiber optic paths.
The teleprotection channel needs to be dependable during fault conditions to enable the DTT signal to be
received correctly with minimal time delay. Equally important, the teleprotection channel must not cause
incorrect spurious DTT.
Direct transfer trip systems, as the name implies, are generally designed to trip a remote breaker without
any added supervision. Because of this practice, communication channel security is of great importance.
9.2 High-speed peer-to-peer communications on substation LAN or system WAN
The development of IEC 61850 [B7] and other network-based methods is targeted at reducing the costs and
improving the efficiency of integrated substation protection and control systems by replacing the hard
wiring between the IEDs with high-speed peer-to-peer Ethernet-based communications. Messages based
upon the asynchronous reporting of an IED’s digital outputs status are sent to other peer devices enrolled to
receive these status messages. Since this communication is used to replace the hard wired control signal
exchange between IEDs for interlocking and protection purposes, it is mission sensitive, time critical, and
highly reliable. The associated IEDs receiving the message use the contained information to determine
what the appropriate protection response is for the given state. One such usage of this message scheme is
for breaker failure. A case study (Vonada, et al. [B29]) shows how the wiring for breaker failure and other
protection functions was greatly reduced at a substation that utilizes single pole tripping.
Peer-to-peer communications-based BFP can be designed in different ways, including the following:
61
IEEE Std C37.119-2016
a) As a function in an IED that initiates the BFP when it sees the trip signal from the relay protecting
the faulted power system device; this is essentially a stand-alone BFR as has been used
historically. See Figure 35.
b) As a built-in function in the protection IED (e.g., a line relay) that detected the fault and issued the
trip signal.
9.2.1 Application to initiate breaker failure protection
Figure 35 shows an example of a BFP scheme based on an external device. In this case, the scheme is using
IEC 61850 [B7] GOOSE messaging. This scheme is similar to a conventional breaker failure scheme where
a line relay initiates breaker failure to a separate BFR.
The line relay will detect a fault condition on the protected line and will issue a trip signal in order to clear
the fault. This can be a message indicating the operation of the trip output function of the IED. The service
used for this operation is called a “GOOSE”. The bay controller or designated IED that implements the
distributed BF function will subscribe to this message and, as soon as it is received, will start the breaker
failure timer. If the breaker fails, the BF function will indicate a breaker failure and will send a message
over the substation LAN to trip adjacent breakers and perhaps initiate DTT to any remote substation in
order to clear the fault.
GOOSE
Breaker Failure
Protection
Relay Relay Relay
Fault
Point
Figure 35 —Distributed breaker failure protection
9.2.2 Applications to trip breakers from breaker failure protection
When the BFP function is built into the relay that detects the fault condition, it will detect the breaker’s
failure to clear the fault. It will then issue a message to indicate the breaker failure condition. This is
somewhat similar to what is in 9.2.1 except there is no separate BFR (a virtual BFR). The line relay will
send a message to the substation LAN to trip adjacent breakers and, perhaps, initiate DTT to any remote
substation in order to clear the fault.
62
IEEE Std C37.119-2016
10. Breaker failure relay and breaker failure protection scheme testing
10.1 General
Considering the necessary control actions performed by breaker failure outputs, users exercise caution
when testing these schemes. Results of erroneous BF tripping include dropping local loads, interrupting
multiple transmission paths, tripping remote breakers with the possibility of dropping tap loads, and
tripping or causing instability of generators. However, due to the importance of these schemes and the
possible catastrophic consequences if the scheme fails to operate, initial and periodic testing is
recommended. Note that in addition to testing the BFR itself, the testing of relays that initiate the BFP is
also a concern.
BFR testing consists of verifying that the issued settings from the relay setting engineer are properly
applied to the relay and checked for calibration.
Whether the relays are electromechanical, static, or microprocessor, all relays need to be verified at regular
intervals. Even though relays use various technologies, they all do the same function, which is to operate
for a failed breaker.
The same test equipment is needed for all relays. A three-phase relay tester that provides a source of three-
phase voltage and currents with inputs for sensing the test result is commonly used. A laptop computer is
typically used to run the tester and to collect and record the test results. For microprocessor relays, the
laptop can communicate directly with the relay as well. Additionally, automated test programs can be used
to run test plans or routines that check calibration and generate a complete test report. Breaker failure
solutions based on IEC 61850 [B7] require specialized equipment, such as network monitoring tools and
network-based simulation equipment.
At a high level, this test process is to check the pickup value of the current detectors by ramping test current
to within acceptable test tolerant limits, approximately ±5% of setting value. There is a timer test as well
that is typically 6−12 cycles to be verified. Reset time of the current detectors might also be verified. These
basic current and timer tests are required for the BFR calibration test.
The complete functional test of the relay is accomplished during commissioning with its whole scheme
where each breaker failure initiate point or input is verified. The output contact of the BFR typically
operates a lockout relay. The ultimate confidence in the circuit is achieved by verifying the ability of the
lockout relay to trip and lockout all breakers around the failed breaker and initiate DTT to the line’s remote
end.
10.2 BFP scheme testing guidelines and awareness
This subclause contains general guidelines to be considered when testing BF schemes. Note that these
guidelines apply to conventional BF schemes, in which the BF relay is in a physically separate device from
the existing protective relays. Schemes that use BF logic as part of existing protective relays could also
follow these guidelines as part of an overall relay calibration/functional test procedure. BF protection
implemented over substation LAN or IEC 61850 [B7] requires additional scrutiny, and the best policy
would be to consult with the system designer to determine appropriate testing methods.
 As stated in Clause 7, isolation switches to allow maintenance and testing of the scheme are
required. This is especially true if the breaker failure functions are part of existing primary
protection. Separate BF outputs are wired through isolation switches to facilitate isolation for
testing.
63
IEEE Std C37.119-2016
 Although auxiliary tripping relays have their disadvantages (additional failure point, additional time
delay), it is more difficult to test the BF scheme without them and could necessitate a complete
station outage in order to perform adequate tests.
 While it is possible to test a BF relay with its corresponding breaker in service, it is generally
advisable to isolate the breaker to reduce the possibility of an erroneous trip output (i.e., test the BF
relay when the breaker is out for scheduled maintenance). Testing the BF relay with the breaker in
service can be especially risky if the phase current detectors are set below expected load.
 A thorough review of drawings is necessary to determine all possible BF initiation sources and trip
paths. For example, some schemes trip the bus differential auxiliary relay.
Unless enabling BFP trip outputs for trip checking, BFP trip outputs need to be isolated whenever test
current is passed through the BF relay current coils and/or whenever the relays that provide a BFI signal are
being trip tested. While it may appear possible to perform testing without isolating the breaker failure
scheme output, the following might be considered:
 Some breaker failure schemes only require a protective relay trip initiate, not current, to start the
breaker failure timer. While not an optimal design, upon timeout, the BFR may remain armed,
waiting indefinitely for the current detector to pick up, such as for a remote fault.
 Power system changes over time may change the relative load and minimum fault current levels. If
50BF element have been set based on load or fault currents, the power system conditions need to be
examined each time the protective equipment is tested.
 In multi-breaker applications, such as ring bus or breaker-and-a-half schemes, care should be taken
to validate the current detector set points for each of the breakers if the plan is to retain the breaker
in service while protective equipment is tested.
 The extent and type of protective equipment being tested may affect the fault detector pickup. For
example, the current detector element of the BFR may be inadvertently energized if testing
involves current injection when the breaker failure current elements are in the same CT circuit as
the protective relay that is being tested.
A full set of commissioning tests is recommended prior to placing a new BF relay in service. These tests
include the following:
 Perform initial testing as per the manufacturer’s recommended initial test procedure as found in
instruction manuals and/or application guides. This includes testing phase and ground current
detectors, breaker failure (and any other) timers, and inputs (breaker failure initiate, low SF6 gas
pressure indication, pallet interlocks, etc.).
 Apply relay settings according to the specified settings provided by the protection engineer and test
current detectors and timers according to the desired settings.
 Perform mechanical inspection on electromechanical models—for broken/damaged components,

tight connections, contact gaps/wipe as applicable.
With the relay installed in the current/tripping circuits, the following tests might be performed (with trip
outputs isolated or limited):
 Passing test current from the breaker CT to the relay and reading it in the relay (with external
ammeter and/or with relay display).
64
IEEE Std C37.119-2016
 Test trip paths designed to provide a BFI input, including newer systems, which initiate and trip
using a communication network.
 Test loss-of-dielectric conditions by simulating low SF6 or air pressure (if applicable).
 Test the BF scheme as a system, simulating a fault condition with initiating relays in series with BF
relay; block tripping by the initiating relays and allow the BF relay to provide re-trip for the breaker
as applicable, then allow the BF relay to trip the auxiliary relay.
 During commissioning, allow the BF trip auxiliary relay to trip the breakers, send transfer trip, etc.,
as designed.
 Test the 52a contact input to the BF scheme by operating the protected breaker and monitoring the
auxiliary contact’s status.
 Maintain contact with the manufacturer to keep abreast of bulletins issued covering possible
component or firmware changes.
10.3 Overall system testing
A circuit breaker can be tripped by a number of different protection schemes located on different panels
within the substation. For example, a circuit breaker connected to a bus and a line could be tripped by the
following types of protection:
 Primary bus protection

 Secondary bus protection
 Primary 1 line protection
 Primary 2 line protection
 Backup line protection
 Direct transfer trip (DTT)
It is possible to use synchronized test sets, for example using a global positioning satellite (GPS) system,
within the local substation to test the initiating relay and the BFR. This might enhance determination of
actual operating time of the overall scheme. Other traditional methods might also be used to accomplish
this purpose.
For example, an internal line fault with a breaker failure condition can be simulated using two three-phase
synchronized test sets—one located at the protective relay panel and the other at the BFR panel. For an
internal line fault simulation with a breaker failure condition, the system test would confirm the following:
 Operation of the protective relay breaker failure initiating contact (BFI or 62-X) and the
confirmation of the correct wiring to the BFR
 Operation of the BFR re-trip element if used
 Operation and time delay of the BFR timer
 Blocking of circuit breaker reclosing
65
IEEE Std C37.119-2016
 Operation of the BFR lockout relay
 Operation of local and SCADA alarms
The scheme test can be repeated for an internal line fault with increasing circuit breaker clearing times to
measure the total margin in the BFR timer setting. Different tests might be done to determine overall BF
operate time, for the purpose of testing schemes with multiple timers, and for different fault types and/or
fault locations (close or far away). With this type of test, all the elements affecting the performance of the
BFR are tested simultaneously.
66
IEEE Std C37.119-2016
Annex A
(informative)
Bibliography
Bibliographical references are resources that provide additional or helpful material but do not need to be
understood or used to implement this standard. Reference to these resources is made for informational use
only.
[B1] Altuve, H., Thompson, M., Mooney, J., “Advances in Breaker Failure Protection,” Western
Protective Relay Conference, Spokane, Washington, October 2006.
[B2] An Appraisal of Remote and Local Backup Relaying, Kennedy, L. F., McConnell, A. J., AIEE
Transactions, Vol. 76, pp 735–741, October 1957.
[B3] Dall C., Tierney D., “Generator Breaker Failure Applications,” proceedings of the Western
Protective Relay Conference, Spokane, WA, October 2014.
[B4] Darlington, A. N., Patrick, T. W., “Experience with Local Breaker Failure Protection,” Georgia Tech
Protective Relay Conference, May, 1973.
[B5] Elmore, W., Li, H., Westinghouse Electric Corp., “Breaker Failure Relaying,” Silent Sentinels, RPL
80-1, June 1980.
[B6] IEC 60255-26, Measuring relays and protection equipment—Electromagnetic compatibility
requirements.
[B7] IEC 61850 SER Ed. 1.0 2013, Communication networks and systems in substations, All Parts.
[B8] IEC 61850-3 Ed. 2.0 2013, Communication networks and systems for power utility automation, Part
3, General requirements.
4, System and project management.
5, Communications requirements for functions and device models.
6, Configuration description language for communication in electrical substations related to IEDs.
[B12] IEC 61850-7-1 Ed. 2.0 2011, Communication networks and systems for power utility automation,
Part 7-1, Basic communication structure, principles and models.
Part 7-2, Basic information and communication structure, abstract communication service interface (ACSI).
Part 7-3, Basic communications structure, common data classes.
Part 7-4, Basic communication structure, compatible logical node classes and data object classes.
Part 7-410, Basic communication structure, hydroelectric power plants communication for monitoring and
control.
Part 7-420, Basic communication structure, distributed energy resources logical nodes.
67
IEEE Std C37.119-2016
Part 8-1, Specific communication service mapping (SCSM), mapping to MMS (ISO 9506-1 and ISO 9506-
2) and to ISO/IEC 8802-3.
Part 9-2, Specific communication service mapping (SCSM), sampled values over ISO/IEC 8802-3.
[B20] IEC 62539 (E) 2007, IEEE Std 930™-2004, Guide for the statistical analysis of electrical insulation
breakdown data.
[B21] IEEE Committee Report, “Local Backup Relaying Protection,” 69TP 602-PWR, IEEE Transactions
on Power Apparatus and Systems, Vol. PAS-89, No. 6, July/August 1970.
[B22] IEEE PSRC Report, “Summary Update of Practices on Breaker Failure Protection,” IEEE
Transaction on Power Apparatus and Systems, Vol. PAS-101, No. 3, pp 555−563, March 1982.
[B23] IEEE, PES, PSRC, workgroup I-19 technical paper, Redundancy Considerations for Protective
Relaying Systems.
[B24] IEEE Std C37.234™, IEEE Guide for Protective Relay Applications to Power System Buses.
[B25] Kasztenny B., Thompson M., “Breaker Failure Protection, Standalone or Integrated With Zone
Protection Relays”, proceedings of the 64th Annual Conference for Protective Relay Engineers, College
Station, TX, April 2011.
[B26] Li, H., Protective Relaying Theory and Applications, Backup Protection, New York: Marcel Dekker
Inc., 1994, pp.303−316.
[B27] NERC technical paper, “Protection System Reliability, Redundancy of Protection System
Elements,” January, 2009, North American Electric Reliability Corporation (NERC) System Protection and
Control Subcommittee.
[B28] Thompson, M. J., “Fundamentals and Advancements in Breaker Failure Protection,” 53rd Annual
Georgia Tech Protective Relay Conference, Atlanta, GA, May 5−7, 1999.
[B29] Vonada, D., Condict G., Martin J., Keeney J., Thompson M. J., Bariola J., Pool D., “Case Study:
Using IEC 61850 to Simplify Lockout Circuits in a 345kV Wind Generation Integration Substation,” 2014
Washington State University Power and Energy Automation Conference, March 25−27, 2014.
68
IEEE Std C37.119-2016
Annex B
(informative)
Breaker failure setting example
Figure B.1 shows an example breaker failure timing chart. This example is based on a scheme described in
6.1, the basic breaker failure scheme. Please note that in this example the critical clearing time as
determined by company policy is greater than the critical clearing time as determined by studies, and the
lesser of the two is used to determine the timer setting. Also for a particular type of BF relay applied here in
this example, the 50BF element does not pick up until a BF initiate signal is received from the primary
tripping relay.
3-cycle CB ABC breaker failure and subsequent tripping of 2-cycle

CB XYZ
52a contact for 3 cycle CB
2 Cycle CB
Maximum allowed
86 BF (0.5 cycle) critical clearing time
94 BF (0.25 cycle) determined by
company policy
62-1 (5.625 cycles)
50BF (current detector) picked up Critical clearing
50BF (current detector) Pickup (0.125 cycle) time calculated by
study
50BF (current detector) Drop Out (0.6 cycle)
3 cycle CB
94 (0.5 cycle)
Primary relay (1 cycle)
0 1 2 3 4 5 6 7 8 9 10 11
Cycles
Figure B.1—Setting example timing chart

A breaker that normally clears a fault within 3 cycles fails to open. A two-cycle breaker is the backup. In
this case, studies have determined that the critical clearing time to maintain transient stability is 10 cycles.
There are several times that cannot be changed or set. Characteristics of the applied devices determine the
following maximum operating times:
 Primary relay operate time 1 cycle

 94 trip relay pick up 0.5 cycle
 Primary circuit breaker 3.0 cycles
 BFR current detector (50BF) pick up 0.125 cycles
 BFR current detector (50BF) drop out 0.6 cycles
 86 BF lockout relay pick up 0.5 cycle
69
IEEE Std C37.119-2016
 94 BF pick up 0.25 cycle

 Backup breaker operate time 2 cycles
The only variable is the 62-1 breaker failure timer setting. The setting for the breaker failure timer can be
determined by adding up all the operate times and subtracting this sum from the critical clearing time. In
this case, primary relay + aux relay + current detector pickup + lockout relay + breaker failure relay output
relay + backup breaker clearing time = 1 + 0.5 + 0.125 + 0.5 + 0.25 + 2 = 4.375 cycles. For a critical
clearing time of 10 cycles, the maximum 62-1, breaker failure timer setting is 10 – 4.375 = 5.625 cycles. If
the critical clearing time given does not have any margin built into it, some margin needs to be subtracted
from the breaker failure timer setting calculated.
In this example, the critical clearing time to maintain transient stability is used to determine the breaker
failure timer setting. However, this is not the only means of determining this timer setting. More frequently,
the timer will be set only as long as necessary to provide security of the BFP against misoperation. The
security margin will take into account all variables and uncertainties in the operation of the breaker trip
mechanisms, reset of current detectors, and operating time of auxiliary relays, and will often include a
margin that experience has shown to be secure. This security margin will then determine the setting of the
breaker failure timer independently of the critical clearing time for transient stability purposes. Having
noted the above comments, it is also noted that the transient stability studies to determine critical clearing
times may assume only a single phase of an EHV breaker (with independent pole control operating
mechanisms) has failed to open in its interrupting time. Therefore, the critical clearing time may be based
on the assumption of an initial three-phase fault, cleared in normal time on two phases, and with a breaker
failure to clear the fault on the third phase.
In rare cases, the critical clearing time determined by study does not allow for a secure BFP setting. In this
case, some other scheme might be relied upon for a breaker failure event. One such solution might be
application of a tandem breaker scheme as described in 6.14.
The pickup sensitivities used in this example are just examples. Utilities may have different setting
philosophies as to what the exact percentage to use as set points.
The following are typical short-circuit contingencies setup:
 N-1 contingencies (one circuit or one element out).

 Some utilities may decide to run N-2 contingencies.
Decide whether to use overcurrent pickup set point below or above the maximum load. (Refer to Clause 8
for an explanation on which one to use.)
Pickup of the 50BF element is set to be at least as sensitive as the minimum pickup of the primary relay
initiating BF. This would account for sensitivity for different fault types such as three-phase, phase-to-
phase, phase-to-phase-to-ground, and phase-to-ground.
If set point is below load current:
 Phase Set Point 50 = 50% to 80% of minimum phase-to-phase fault current of the protected zone of
protection that initiates this breaker failure.
 Ground Set Point 50G = 50% of 3I0 of minimum ground fault current. Do not set this higher than
fault detector of devices initiating the breaker failure.
If set point is above load current:
70
IEEE Std C37.119-2016
 Phase Set point 50 = 150% of maximum load current seen by the protected zone of protection that
initiates this breaker failure.
 Ground Set Point 50G = 50% of 3I0 of minimum ground fault current. A lot of utilities set this to
1 amp secondary (assuming 5A CT).
The breaker failure timer is set to twice the nameplate rating of the protected breaker opening time plus a
margin. For three-cycle breaker nameplate rating:
62-1 = 3 cycle × 2 + 1 cycle = 7 cycle
If used,
62-2 = 0 cycle to ≤ 62-1 setting.
(For detail about breaker failure scheme with re-trip logic, see 6.2.)
71
I
EEE
st
andards
.i
eee.
org
Phone:+17329810060 Fax:+17325621571
©IEEE

IEEE - C37.119 - 2016 Guide Breaker Failure

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IEEE - C37.119 - 2016 Guide Breaker Failure

Uploaded by

Copyright:

Available Formats

IEEE Guide for Breaker Failure

Protection of Power Circuit Breakers

IEEE Power and Energy Society

IEEE IEEE Std C37.119™-2016

IEEE Guide for Breaker Failure

Power System Relaying Committee

Approved 15 May 2016

IEEE-SA Standards Board

The Institute of Electrical and Electronics Engineers, Inc.

Copyright © 2016 by The Institute of Electrical and Electronics Engineers, Inc.

PDF: ISBN 978-1-5044-2021-1 STD20939

IEEE prohibits discrimination, harassment, and bullying.

Notice and Disclaimer of Liability Concerning the

Comments on standards should be submitted to the following address:

Secretary, IEEE-SA Standards Board

Laws and regulations

Jeff Barsch Heather Malson Phil Tatro

Ali Al Awazi Stephen Grier Bruce Muschlitz

Jean-Philippe Faure, Chair

Chuck Adams Gary Hoffman Mehmet Ulema

3. Definitions, acronyms, and abbreviations ................................................................................................ 12

4. Need for breaker failure protection........................................................................................................... 14

5. Breaker failure modes............................................................................................................................... 17

6. Breaker failure protection schemes .......................................................................................................... 18

7. Breaker failure design considerations ....................................................................................................... 42

8. Factors influencing breaker failure protection settings ............................................................................. 57

9. Communications-based breaker failure protection ................................................................................... 61

Annex A (informative) Bibliography ........................................................................................................... 67

Annex B (informative) Breaker failure setting example............................................................................... 69

IEEE Std C37.102™, IEEE Guide for AC Generator Protection. 1, 2

3. Definitions, acronyms, and abbreviations

common-mode failure: A multiple failure attributable to a common cause.

3.2 Acronyms and abbreviations

The following are a listing of abbreviations used in this guide:

50 instantaneous overcurrent element

4. Need for breaker failure protection

Remote backup, therefore, has the following disadvantages:

5. Breaker failure modes

Breakers with single-phase tripping present additional constraints for BFP.

6. Breaker failure protection schemes

 Some means to trip and block closing of adjacent breakers

Factors to be aware of might include the following:

6.1 Basic breaker failure scheme

Figure 3 —Fault clearing timing chart

a) The presence of current flow in the breaker (50BF) and

6.2 Basic breaker failure with re-trip logic

(62-2 Time Delay May be Zero Time)

Figure 4 —Breaker failure re-trip

6.3 Breaker failure scheme for dual breaker arrangements

BFI Timer Breaker Failure

Figure 5 —Timer without 50BF supervision

6.4 Breaker failure scheme based on 50BF pickup time

Figure 6 —Elimination of 50BF reset time

Figure 7 is a timing diagram for the scheme shown in Figure 6.

Figure 7 —Alternate scheme fault clearing timing chart

Figure 8 —Addition of control timer

6.5 Breaker failure scheme with two-step timing arrangement

6.6 Breaker failure initiate seal-in

Figure 10 —Breaker failure seal-in

6.7 Breaker failure minimal current scheme

50BF BFI Timer Breaker Failure

Figure 13 —BFI seal-in with 86T supervision of 52a 6

Figure 14 —Dual timer with 52aa and 50BF reset