Distribution substation and transformer monitoring

At a glance

Item	Typical answer
Problem	Thousands of secondary substations have no telemetry; overloads, blown LV fuses and faults are found through customer calls.
What is connected	LV power analysers on the transformer and feeders, transformer temperature, fault passage indicators, RMU switch positions, kiosk door, flood and temperature.
Who uses it	Network control and outage teams, network planners, field crews, asset managers.
Typical first scope	Twenty to fifty substations on a few MV feeders known for overloads or faults.
Time to first screen	Typically a few days after the first gateways are installed; plan six to ten weeks for a pilot that covers a peak-load period.

The situation

A distribution network operator may run thousands of secondary substations: ground-mounted kiosks and indoor rooms with a ring main unit (RMU), one or two oil-immersed transformers and an LV board with fused feeders. Primary substations are usually on the operational SCADA; most secondary substations are not, because a full remote terminal unit per kiosk has never been affordable.

The gap shows up in three ways. Planners size reinforcements from estimates because they do not know real transformer loading, which is shifting quickly with heat pumps, EV charging and rooftop solar. Outage teams learn about a blown LV fuse when customers call, and spend the first hour finding which feeder it is. Asset managers cannot tell which transformers run hot in summer and age faster than the others.

This blueprint adds a monitoring layer on Hermetry for secondary substations: loading, temperature, voltage and LV outages measured continuously, fault passage indicators reported as they operate, and a single-line view of each site. It sits beside the operational SCADA and outage management systems, not in place of them.

Goals and measures

• Transformer utilisation = apparent power S ÷ rated kVA, in percent; report the peak 10-minute value per day and the number of hours above 100 %.
• Load factor = average load ÷ peak load over a month; low values with high peaks are candidates for load management rather than replacement.
• Phase imbalance = largest deviation of a phase current from the average of the three ÷ the average, in percent. Persistent values above about 20 % to 30 % (agree your own limit) justify rebalancing customers between phases.
• Voltage compliance = share of 10-minute mean voltages within the band your grid code sets (for example ±10 % of nominal), per LV board and week.
• Reverse power hours = hours with net export from LV to MV, a sign of high solar penetration.
• LV outage minutes per feeder = time with feeder voltage lost, from the feeder-side measurement.
• Fault passage count per RMU and month, from the fault passage indicator contacts.
• Thermal exposure = hours with top-oil temperature above an agreed level, as an input to ageing assessment.

Hermetry stores raw readings and keeps one-minute, hourly and daily aggregates with average, minimum, maximum, sum, count and last, so daily peaks, hours above a limit and monthly averages are read from stored data.

Architecture

Each substation gets one licensed gateway running Hermetry Edge, fitted in the LV compartment or a small enclosure. It reads LV power analysers over Modbus RTU on RS485 (or Modbus TCP), wires the fault passage indicators, RMU auxiliary contacts, door and flood switches to its digital inputs, and reads the transformer temperature from a 4-20 mA transmitter on an analog input. It sends everything to Hermetry over MQTT with TLS on one outbound connection, over a licensed 4G or 5G router where there is no other link. See the licensed devices for inputs and links per model.

Component	Role	Notes
Licensed gateway with Edge	Reads analysers and contacts, publishes telemetry	Factory identity and certificate; claimed into your organisation.
Licensed 4G or 5G router	Uplink	Your own SIM and operator.
LV power analyser on the transformer incomer	Voltage, current, power, energy, power factor, harmonics where available	Modbus RTU; CTs sized to the transformer.
Multi-circuit meter or analysers on LV feeders	Feeder currents and energy; feeder voltage after the fuse	Voltage after the fuse is what reveals a blown fuse.
Transformer temperature transmitter	Top-oil temperature	From the transformer's thermometer pocket, 4-20 mA.
Fault passage indicators	MV fault direction and operation	Volt-free output contact per indicator.
RMU auxiliary contacts	Switch and breaker positions	Read-only.
Small DC supply or UPS	Keeps the gateway alive during an outage	Without it, an outage looks like a lost link.
Hermetry	Storage, alarms, rules, dashboards, SCADA	EU, US or Türkiye region, or on premises for operators that keep grid data in house.

Security is part of the design, not an add-on. Gateways dial out only; nothing in the substation accepts connections from the internet. Licensed devices authenticate with certificates from the platform's own authority; revoking a certificate ends its live sessions at once. The device profile requires TLS and can pin the networks devices may connect from, for example the private address range of your operator's APN. Commands are never sent over an unencrypted session. The AI firewall watches sign-ins, API calls and device traffic, blocks abuse and explains every block. More on the security page.

Point list

A substation with one transformer and four LV feeders. Analyser register numbers vary by make; these are illustrative.

Point	Telemetry key	Unit	Source	Interval	Notes
Phase voltage L1-L3	u_l1_v, u_l2_v, u_l3_v	V	Incomer analyser	60 s
10-minute mean voltage L1-L3	u10_l1_v, u10_l2_v, u10_l3_v	V	Analyser, if it computes them	10 min	Basis for voltage compliance.
Phase current L1-L3	i_l1_a, i_l2_a, i_l3_a	A	Incomer analyser	60 s
Neutral current	i_n_a	A	Incomer analyser	60 s	High values point to imbalance and harmonics.
Active power total	p_kw	kW	Incomer analyser	60 s	Signed; negative means export to MV.
Reactive power total	q_kvar	kvar	Incomer analyser	60 s
Apparent power total	s_kva	kVA	Incomer analyser	60 s
Transformer utilisation	tx_util_pct	%	Computed in a flow from s_kva and rated kVA	60 s	Rated kVA is a device attribute.
Power factor	pf		Incomer analyser	60 s
Voltage THD L1-L3	thd_u_l1_pct, …	%	Analyser, if available	10 min
Imported energy	e_import_kwh	kWh	Incomer analyser counter	15 min
Exported energy	e_export_kwh	kWh	Incomer analyser counter	15 min	Solar back-feed.
Feeder n current L1-L3	f1_i_l1_a … f4_i_l3_a	A	Feeder meter	60 s	One set per feeder.
Feeder n voltage present	f1_u_ok … f4_u_ok	bool	Feeder-side voltage	on change	False with the incomer healthy = blown fuse.
Top-oil temperature	tx_oil_c	°C	4-20 mA transmitter	60 s
Thermometer alarm contact	tx_temp_alarm	bool	Transformer thermometer contact, DI	on change	Where fitted.
Fault passage indicator, ring A	fpi_a	bool	FPI output contact, DI	on change
Fault passage indicator, ring B	fpi_b	bool	FPI output contact, DI	on change
RMU transformer switch closed	rmu_tx_closed	bool	Auxiliary contact, DI	on change
Kiosk door	door_open	bool	Reed contact, DI	on change
Flood	flood	bool	Float switch, DI	on change
Kiosk temperature	kiosk_temp_c	°C	Gateway or sensor	5 min
Gateway supply on battery	supply_on_batt	bool	DC supply alarm contact	on change	Distinguishes outage from link loss.

Asset model

Model the network topology that operations and planning share:

• Region and Primary substation (Site) with location.
• MV feeder (free kind) with feeder_code and normal_open_point.
• Secondary substation (Site) with location, time zone, substation_code, type (kiosk, indoor, pole-mounted) and customers_served.
• Transformer (Machine) with rated_kva, vector_group, cooling (for example ONAN), nominal_lv_v, year_built and oil_temp_limit_c.
• LV feeder (free kind) with fuse_rating_a and customers.

Place the gateway on the secondary substation and any separate analyser devices on the transformer or feeder they measure. Add Feeds relations from primary substation to MV feeder to secondary substation, so a board can show every substation of a feeder and planners can sum loading per feeder. Copy the limits that rules need, such as rated_kva and oil_temp_limit_c, onto the device as server attributes; one alarm rule then fits transformers of every size.

Device setup

Profiles and devices

Create one gateway profile per substation type, for example Kiosk, 1 transformer, 4 feeders and Indoor, 2 transformers, 8 feeders. Use the Recent message online rule. Where it helps to treat each analyser as its own device, with its own page and alarms, the gateway can report analysers as child devices over the same connection, up to 500 per gateway by default. Children are named by the gateway and created the first time it reports them; each takes its profile from the type the gateway sends. Commands and settings sent to child devices are in development, which does not matter here: this design is read-only.

Provisioning

Licensed gateways are claimed by scanning their code during installation, so the fitter never types credentials. For a large programme, devices can be imported in batches and placed on their substations from the asset table.

Settings and intervals

Analyser addresses, serial settings, CT ratios where the gateway applies them, and reading intervals are managed with remote device settings. Build a baseline per substation type and apply it with a bulk job; the job runs in waves (1 %, 10 %, then the rest by default), checks that at least 95 % of answering devices applied it and pauses otherwise. Sixty seconds is a good interval for power values; 10-minute mean voltages come from the analyser where it computes them, or from a Statistics block in the profile's root flow.

Derived values

A short root-flow branch computes tx_util_pct from s_kva and the transformer's rated kVA attribute and saves it as telemetry, so alarms and charts can use utilisation directly. A flow Script block can also estimate a hot-spot temperature from top-oil temperature and load with the simplified relation of the transformer loading guide your organisation uses; treat it as an indicator for planning, never as a protection value. Test every flow in the test runner before deploying; each deploy is a version you can roll back.

Time and buffering

Synchronise gateway clocks; event times of fault passage and voltage loss are only useful if they line up across substations. Licensed gateways buffer readings while the link is down, with capacity depending on the model, and send them afterwards with their original time stamps; Hermetry stores them and evaluates alarm rules as a backfill, marked Backfilled, without paging anyone for the past.

Firmware

Signed firmware is assigned to the gateway profile and rolled out in waves, with success gates, a soak time and automatic pause on failures. Start with substations whose loss of monitoring matters least. Gateways on mobile data wait for a download until metered downloads are allowed.

Dashboards

Board	Audience	Widgets
Network map	Control and outage teams	Map of substations coloured by status; table per MV feeder with substations, open alarms and last seen; stat cards for substations with a lost LV feeder and with an operated FPI.
Substation page	Field crews, control	Single-line drawing; gauges for utilisation and top-oil temperature; state cards for each LV feeder; line chart of phase currents and voltages over 7 days; activity feed of events.
Transformer loading	Network planners	Table of transformers sorted by peak utilisation in the last 30 days, downloadable to Excel; heatmap of utilisation by hour and weekday; line chart of daily peak against the same period last year.
Voltage quality	Planning, power quality	Table of LV boards with share of 10-minute means outside the band; line chart of minimum and maximum voltage per day; bar chart of reverse power hours per substation.
Outage log	Outage team, regulators' reporting	Alarm table of LV feeder voltage loss and FPI operation with start, end and duration; bar chart of outage minutes per feeder and month.

One substation page serves all substations through an entity parameter; the map and the tables open it with the substation as the parameter. Key filters narrow lists by live values, for example transformers whose tx_util_pct is above 90, with the threshold editable by the viewer.

SCADA screens

Draw one single-line diagram per substation type with the Power pack, which covers energy, single-line diagrams and energy storage: busbars, circuit breakers (including a variant with a trip input), isolators, fuses, power transformers, current and voltage transformers, protection relays, power analysers, switchgear cabinets, earths and the utility source. See the SCADA library.

• Layout: MV ring cables in and out, RMU switches with the FPIs, transformer, LV incomer with its analyser, LV busbar and the outgoing fuses.
• States: RMU switches show open or closed from their auxiliary contacts; each LV fuse turns red when its feeder voltage is lost while the busbar is live; the FPI symbol blinks when operated.
• Values: the transformer prints utilisation and top-oil temperature as main and second reading; each feeder prints its highest phase current.
• Rules: connections are coloured by energised state; the transformer turns amber above 90 % utilisation and red above 110 %.
• Reuse: attach the drawing to the substation profile through its Views button; every substation gets its own view and bindings. A drawing change that breaks bindings shows a Review line on the affected views.

There are no command buttons on these drawings: switching stays with the operational systems and field procedures.

Rules and alarms

Alarm	Condition	Delay and hysteresis	Severity	Notified	Escalation
Fault passage indicated	fpi_a == true or fpi_b == true	Debounce 1 sample	Critical	Control room, push and in-app; webhook to the outage system	Reminder every 15 min
LV feeder lost	f1_u_ok == false with u_l1_v > 200 (one rule per feeder)	Debounce 30 s raise, 60 s clear	Major	Outage team, push	Reminder every 30 min
Substation de-energised	supply_on_batt == true and all phase voltages < 50	Debounce 60 s	Major	Control room, push	Reminder every 30 min
Transformer overload	tx_util_pct > 100 (Major), > 120 (Critical)	Debounce 1,800 s for Major, 600 s for Critical; hysteresis 5 %	Major / Critical	Network planner e-mail; Critical also control room push	Severity rise notifies again
Top-oil temperature high	tx_oil_c > attribute oil_temp_limit_c	Debounce 600 s; hysteresis 3 °C	Major	Control room, push; asset manager, e-mail	Reminder every 60 min
Voltage out of band	u10_l1_v, u10_l2_v or u10_l3_v outside the band, for example below 207 or above 253 V (any)	Debounce 2 samples	Minor	Power quality engineer, in-app
Phase imbalance	imbalance_pct > 30, computed in the same root-flow branch as utilisation	Debounce 3,600 s	Info	Network planner, in-app
Flood	flood == true	Debounce 30 s	Critical	Control room and field crew, SMS	Reminder every 15 min
Door open	door_open == true	Debounce 60 s	Minor	Control room, in-app
Gateway offline	Inactivity rule, 15 min		Warning	Telemetry team, in-app

Limits per transformer. Rules read oil_temp_limit_c and use utilisation rather than amps, so one rule set serves transformers from 100 kVA to 1,600 kVA. Utilisation limits and temperatures are examples; agree them with your asset management policy.

Feeder trips and floods of alarms. When an MV feeder trips, every substation on it loses supply at once and twenty or thirty alarms open within seconds. Keep per-substation de-energisation at Major and let the outage system, fed by webhooks, group them; Hermetry notifies the same change at most once in five minutes and collects notifications above the storm threshold (20 a minute by default) into a five-minute digest. A battery-backed gateway is what lets you tell this event from a burst of lost cellular links.

Chattering contacts. A thermometer contact or FPI that bounces can open and close an alarm many times a minute. Dampening holds the alarm open while it flips too often, for example more than four changes in ten minutes, until the condition has been quiet for five minutes.

Planned work. Mute a substation for the duration of planned outages and maintenance. Alarms are still recorded, marked muted, and the mute ends by itself.

Automation and integrations

• Outage management: a signed webhook on alarm.created and alarm.cleared sends FPI, LV feeder and de-energisation events to the outage management system with the substation and feeder in the payload, in Hermetry's own JSON envelope or in CloudEvents format.
• Planning tools: planners export loading and voltage history from tables to Excel or read it through the REST API with an API key for load-flow studies.
• Asset management: a monthly export of thermal exposure and peak utilisation per transformer feeds the ageing and replacement plan.
• Field access: for a fault on the gateway itself, an engineer opens a licensed router's web panel through router remote access, without a fixed IP or VPN; sessions are time-limited, capped on metered links and audited.

The operational SCADA, the distribution management system, the outage management system and the GIS remain the systems of record. Hermetry adds measurements where those systems have none.

Roles and access

Who	Access	Can
Control room	User with the IoT operator group	See all substations, acknowledge alarms.
Field crew	User, scoped to their region by policy	See their substations, acknowledge alarms.
Network planner	User with the IoT viewer group	Read all boards and history, export.
Telemetry engineer	Admin	Profiles, alarm rules, flows, settings jobs, firmware waves, mutes, drawings.
Security officer	Admin, audit log read and export	Review sign-ins, sessions and changes.

Sign-in can require two-factor authentication or passkeys, or go through your identity provider with SAML 2.0 or OpenID Connect. Roles plus attribute-based policies decide who may see what, down to a single device. The audit log records sign-ins, role changes, credential rotations, setting jobs, firmware actions and remote panel sessions in a hash chain that can be verified. Each operator or contractor organisation can be its own tenant, kept apart in the database by row-level security.

Sizing and data

As an order of magnitude for 1,000 substations:

• One combined message a minute per gateway: 1,000 × 1,440 = 1.44 million messages a day. If analysers are reported as child devices, count one message per child per reading.
• Contacts and heartbeats: about 50 a substation a day, 50,000 a day.
• Total roughly 1.5 million messages a day, about 45 million a month.
• Values: about 35 analog keys per minute per substation ≈ 50 million a day, around 18 billion a year.

At this scale, intervals and retention matter more than anything else. Options: report feeder currents every five minutes and only the incomer every minute; send 10-minute means instead of minute values for planning-only sites; use the 90 days of raw readings (the most any class keeps) and rely on hourly and daily aggregates (average, minimum, maximum) for multi-year loading studies. Treat the figures as planning estimates and size the deployment with us; for how the pipeline is tested at high message rates, see performance. Operators that must keep grid data in house can run the same platform on premises.

Rollout plan

Phase	Weeks	Work	Exit criteria
0. Design	1-4	Standard kit per substation type; analyser and CT selection; safety method statement for LV and RMU work; agree keys and limits.	Kit and wiring approved by the network owner's engineering standards.
1. Pilot	5-14	Twenty to fifty substations on a few feeders; profiles, flows, drawings, alarm rules; webhook to the outage system in test.	Measured loading agrees with spot checks; LV fuse and FPI alarms confirmed by real events or tests; a peak period recorded.
2. Industrialise	15-20	Installation procedure, batch import, settings baselines, firmware waves.	A crew can install and commission a substation in one visit.
3. Programme	21 onwards	Rollout by region and feeder, prioritised by planning need.	Agreed share of substations reporting; planners using the loading board.
4. Integration	from 15	Outage system and planning exports in production.	LV outages reach the outage system from Hermetry before customer calls in most cases.

Commissioning checklist

1. Gateway claimed, on the right substation-type profile, placed on the right substation; supply backup tested.
2. CT ratios and polarity checked: active power positive on import at a known load; phase rotation correct.
3. Analyser values compared with a clamp meter on each phase of the incomer and of one feeder.
4. tx_util_pct checked against a manual calculation with the rated kVA attribute.
5. Top-oil temperature compared with the transformer's own thermometer.
6. Each FPI tested with its test function; RMU auxiliary contacts checked against the switch positions.
7. One LV fuse removed under the site's safety procedure: the LV feeder lost alarm opens for the right feeder.
8. Door and flood switches operated; alarms reach the right people.
9. Time stamps checked against a known event; time zone set on the substation asset.
10. Uplink interrupted: offline alarm opens and buffered readings arrive afterwards.

Pitfalls

• Gateway without backup supply. An outage then looks like a cellular failure; power the gateway from a battery-backed supply.
• CT polarity errors. Reversed CTs make import look like export; check sign at commissioning.
• Amps instead of utilisation. Alarms in amps need one rule per transformer size; use utilisation with the rated kVA attribute.
• Feeder voltage measured before the fuse. A blown fuse is invisible; measure after it.
• Every alarm Critical on a feeder trip. Group in the outage system and keep per-substation alarms at Major.
• Minute data for everything forever. Choose intervals per use; retention is one class for the organisation, raw readings last at most 90 days, and planning needs aggregates, not every minute for years.
• Unvetted access. Use single sign-on, scoped policies and the audit log from the start; substation data is critical infrastructure data.

What Hermetry does not replace

Hermetry is a monitoring layer. Protection relays, fuses and RMU interlocks keep doing their job locally, and switching remains with the operational SCADA, the distribution management system and field procedures. Hermetry does not send switching commands in this design. Hot-spot and ageing estimates are planning indicators, not protection settings. Safety rules for work in substations are unchanged.