Ethical Pressure to Sign Off an Untested Protection Upgrade
You are the graduate electrical engineer on a substation refurbishment. A contractor has installed new numerical relays on four 11 kV feeders and a new IEC 61850 station bus. The commissioning plan requires secondary injection tests on every relay, a point-to-point verification of every GOOSE message, and a full scheme test before energisation. The project is two weeks behind and the client's operations manager wants the feeders back in service for a peak demand event. The contractor's test engineer says the relays were factory-tested and offers to 'sign off' the injection tests from the factory certificates without site testing; the GOOSE verification was only partially completed because two merging units were not available. Your supervisor, the project manager, asks you to countersign the commissioning certificate so the energisation can go ahead, saying 'it's just paperwork, the relays are new'.
1. Identify the ethical and technical issues, state what you should do, and explain the consequences of signing.
Read the worked answer
The core issue is that signing the certificate asserts that the commissioning tests were performed and passed. They were not: secondary injection was not done on site, and the GOOSE verification is incomplete. Factory certificates do not cover site wiring, CT/VT polarity, trip-circuit integrity, or the IEC 61850 configuration, which is exactly where commissioning failures occur. Signing would be a false statement, and it would breach the duty to hold public safety paramount, since these feeders protect the public supply.
I should refuse to countersign, state the reasons in writing, and escalate to the supervisor's manager and the client's authorised engineer. I should propose a reduced-scope path: complete the injection tests on the available feeders, complete the GOOSE verification once the merging units arrive, and energise only the feeders that are fully tested, with the others left isolated or on temporary protection. I should document the decision and the residual risk.
Consequences of signing: if a feeder fails to trip, the result can be equipment damage, fire or injury; the certificate would be the evidence that I certified untested protection, exposing me to disciplinary action, loss of professional registration, and possible criminal liability. The short delay is far less costly than that risk.
2. The project manager says the client will not accept a delay and asks for a compromise. Propose a defensible compromise and explain how to record it.
Read the worked answer
A defensible compromise is partial energisation with explicit conditions. Complete the secondary injection tests on the feeders whose merging units are available and energise only those. For the two incomplete feeders, keep them isolated or transfer load to the tested feeders, and set a firm date for the missing tests. If the client insists on energising all feeders, require a written instruction from the client's authorised engineer accepting the residual risk, with the specific untested items listed, and record it in the project risk register. Even then, I must not sign a certificate stating that tests were completed.
Record the compromise in a formal commissioning exception note: what was tested, what was not, by whom, the date, the residual risk, the mitigation (temporary settings, operational restrictions, standby crew), and the date by which the outstanding work will be completed. Circulate it to the client, the contractor and the supervisor. This protects the public and gives an auditable trail. If the client's instruction would require me to certify something untrue, I decline and escalate; a written client instruction cannot make a false certificate acceptable.