Context: When One Asset Becomes a Systemic Risk
Large power transformers installed in underground or confined environments represent a unique class of infrastructure risk.
In pumped-storage hydropower plants and other underground energy facilities, transformers operate with:
- very high installed power levels,
- large oil volumes,
- limited physical space for pressure dissipation,
- and no direct atmospheric venting.
In such configurations, a single internal transformer failure can escalate beyond asset loss, threatening:
- the integrity of the underground structure,
- the availability of adjacent units,
- and the continuity of critical grid services.
Why Conventional Protection Was Not Sufficient
In the project examined, conventional protection measures were already in place and fully compliant with applicable standards:
- electrical protection and relays,
- fire detection systems,
- gas-based fire suppression.
However, engineering analysis demonstrated a fundamental limitation:
Fire suppression systems cannot function effectively if the transformer tank ruptures violently before extinction can occur.
In confined underground environments, the rapid generation of gas during an internal arc fault can lead to:
- extreme dynamic pressure rise,
- tank rupture within milliseconds,
- uncontrolled release of oil and gases into tunnels or caverns.
Once this sequence begins, fire protection systems act too late.
Engineering Constraints Driving the Decision
The decision framework was shaped by non-negotiable physical constraints:
- Response time: protection had to act within milliseconds, not seconds.
- Pressure management: gases had to be redirected in a controlled manner.
- Passive reliability: no reliance on electrical detection or logic systems.
- Integration: protection had to be embedded within the transformer design and validated with the OEM.
The objective was not only to limit fire consequences, but to prevent explosive escalation at its source.
Decision Rationale: Prevention Before Mitigation
The final protection strategy was selected based on a clear engineering principle:
In confined environments, explosion prevention is a prerequisite for any effective fire protection strategy.
The chosen solution focused on:
- rapid mechanical depressurisation of the transformer tank,
- controlled evacuation of gases,
- preservation of structural integrity,
- enabling downstream fire mitigation systems to function as intended.
This approach shifted the protection philosophy from reactive mitigation to preventive containment of failure dynamics.
What Made the Decision Defensible
The solution selection was not based on product claims, but on demonstrable engineering evidence:
- prior full-scale or representative testing,
- validation under conditions representative of real internal faults,
- documented field references in critical infrastructure environments,
- acceptance by insurers and independent engineering reviewers,
- integration and validation with a major transformer manufacturer.
The decision was made to ensure that, in the event of a real failure, the protection strategy could be technically justified to operators, insurers, and authorities.
Transferable Insight for Critical Infrastructure Operators
This case highlights a broader lesson applicable across industries:
When physical constraints prevent safe dissipation of fault energy, protection strategies must address failure mechanisms — not only consequences.
In high-energy, confined installations, explosion prevention should be considered a governance decision, not merely a technical option.
SERGI’s Role
SERGI supports infrastructure operators, insurers, and authorities in making technically defensible protection decisions for rare, high-impact transformer failure scenarios.
By combining:
- multiphysics engineering,
- independent validation,
- and long-term field experience,
SERGI helps ensure that protection architectures perform when failure actually occurs — not only on paper.
Talk to an Engineering Expert
Discuss whether explosion prevention is required in your specific operating context.
