Method for Internal Fault Testing of Instrument Transformers with Sectioned Active Parts

Relevant international instrument transformer standards specify internal arc testing to prove the transformer behavior under internal fault conditions. However, the test is defined in a way that does not recognize that it is possible to limit and reduce the total fault energy. For such instances, testing, as currently defined, is mostly inapplicable. The purpose of this paper is to address this issue by presenting a testing sequence that is applicable for verifying the behavior of transformers with sectioned active parts that contain energy-limiting features. Furthermore, the acceptance criteria for the successful completion of the test are also introduced. Every step of the proposed test sequence is discussed in detail and presented on a 145 kV inductive transformer, selected specifically for this purpose. This paper is a part of a continuous broad research with the aim of developing and specifying adequate routine, type and special testing sequences for qualifying paper-oil insulation systems that limit internal arc energy, with the aim of improving the performance of such systems and introducing test methods and criteria that exceed the practices of current standards.


I. INTRODUCTION
One of the most important performance aspects in recent years is the operational safety of the high-voltage apparatus. The most severe loss of operational functionality in an instrument transformer is a fire and explosion failure, which is considered a specific category of a major fault, according to [1]. As stated in the same reference, fire and explosion faults account for approximately 3% of the total faults recorded in instrument transformers, with 80% originating from internal dielectric features, most notably the main insulation (approximately 70%). Slightly different statistics are available for other transformer types, where approximately 70 %-80% of faults are caused by short circuits between turns [2], [3]. Since both statistics are based on individual sets of data, the authors consider both relevant for the context of this study. Fire and explosion failures are typically a consequence of an arc fault, which causes a high power discharge, releasing a large amount of energy in a very short time, sufficient to compromise the withstand of the transformer enclosure, be it tank or bushing [4], [5]. In an attempt to improve the performance in instances that could lead to catastrophic failures, internal arc testing was introduced in relevant international instrument transformer standards during the 2000s [6], [7]. This test remains one of the more controversial in the instrument transformer industry, with the test requirements and criteria a subject of constant debate and improvement since its inception. A comprehensive overview of the controversial points of the test is given in [8]- [10]. The main assumption of the test is that it assumes a highenergy fault, neglecting the impedance of the main insulation system, thus testing only the withstand of the enclosure and pressure relief [11], [12]. Moreover, this type of testing is adequate only for internal faults incepted in the tank portion of an instrument transformer (e.g., head enclosure for inverted-type current transformers or tank for hairpin or eyebolt current and voltage transformers), while the bushing portion remains untested [8]. Furthermore, the main contributors that can cause fire and explosion events (turnto-turn faults, aging, quality control, and design faults) are not addressed by this test [4], [9], [10]. As introduced in [8], [10] and [13], there are instrument transformer designs that are specifically tailored to limit the energy of internal faults by slowing down the fault propagation and reducing the effects of fault escalation. The main prerequisite for energy-limiting design is a sectioned active part, where the loss of a dedicated section does not warrant an immediate line-to-ground fault.
For such designs, testing the internal fault performance according to the requirements given in [6] and [7] is not applicable for two reasons. First, it does not adequately reflect realistic operational scenarios for such units. Second, while performing the test, in order to achieve a full line-toground arc, the arc length itself would have to be several times the insulation thickness, which would inject an unrealistically high energy in the unit, provided it is even possible to supply such energy during the test. This feature is recognized by international standards [6]. However, the actual test method for proving the behavior of such units in an event of an internal fault is still not defined and is a subject of agreement between the manufacturer and the user. Although paper [10] provided a detailed insight into the expected behavior of instrument transformers with sectioned active parts, it did not specify the exact test method and criteria, which is precisely the purpose of this study. In the ensuing chapters, the energy-limiting concept will be described for context, and the appropriate test method will be showcased, including calculations, test object preparation, the test itself, and post-mortem analysis. The testing procedure is demonstrated on a 145 kV inductive voltage transformer. It should be noted that this paper is a part of a broader research with the aim of developing and specifying adequate routine, type, and special testing sequences to qualify and improve the performance of homogenous paper-oil insulation systems [10]. While the majority of considerations in this paper are based on inductive voltage transformers, the procedures and conclusions are applicable to Combined units, Station Service Voltage Transformers, and Star-point reactors that share the same active part concept [14], [15], [16].

II. MAIN PRINCIPLES OF AN ENERGY-LIMITING DESIGN
Inductive voltage transformers with open-core design have a specific active part, which consists of capacitively graded main insulation and sectioned primary winding distributed alongside the transformer height, as shown in Fig. 1(a). A simplified representation of the active part is presented in Fig. 1(b). It can be seen that the active part design allows each section (coil) of the primary winding to be insulated from adjacent sections and is connected to its adjoining capacitive screen from the main insulation [17]. Each coil with its corresponding screen creates an insulated segment of the main active part, as shown in Fig. 1(b). This segmented active part has several purposes, one of which is to localize faults within the active part of the transformer [10]. There are two predominant failure modes for units with sectioned active parts: failure in the main insulation or failure in the primary winding. Both failure modes are shown in Fig.  2. Faults in the primary winding can originate from excessive stress in turn-to-turn or layer insulation, quality deficiencies in either the primary conductor or layer insulation, and gross design errors [1], [3], [8]. Similarly, the faults in the main insulation can originate from local partial discharges, which are typically a consequence of aging, local electric field nonuniformities, high dissipation factor, or other reasons [1], [8].   Regardless of the fault origin, once the fault propagates to the entire section, that section is short-circuited. Depending on the fault severity and other parameters, the fault propagation time is different, but typically long-lasting [8], [9]. The insulation of each primary winding coil is designed to withstand a theoretical loss of half of the sections (n/2 criterion, where n is the total number of sections) [10]. In more practical terms, this criterion entails that the insulation between each coil and its adjacent sections is dimensioned to withstand half of the maximal continuous primary voltage of the unit, taking into account the rated voltage factor. The experience presented in [8] and [13] shows that probable faults remain localized on one section of the active part, with faults encompassing more than one section having an extremely low probability level [10]. Therefore, the imposed n/2 criterion provides a significant safety margin. Once the fault propagates to one segment of the active part, which is short-circuited, the supply voltage is distributed along the remaining sections of the primary winding. This prevents a direct phase-to-ground short circuit and reduces the total fault current. Regarding fault current, there are two main variables to be considered. Their behavior is analogous to the internal turn-to-turn faults in power transformers, as reported in [18] and [19], and conforms to Kirchhoff's current law. The first variable is I CP , the short-circuit current through the faulted segment, the second is I FP , the total fault current through the remainder of the primary winding. As explained in [10], I FP typically reaches the level of 2-4 times the rated current I RP and I CP 10-40 times the rated current. While I FP gradually thermally stresses the entire transformer, I CP causes local thermal overload, oil gassing, and, consequently, an increase in oil volume [10].

FIGURE 3 Proposed test sequence for internal fault testing of units with sectioned active parts
In the case of internal gassing, stainless steel bellows, which ensure oil volume compensation, will expand. After some time, the bellows will push against the bellows cover, and the pressure will start to increase. The bellows cover is mechanically designed to break off the unit at a design value that is several times lower than the mechanical withstand of other structural components. This means that it serves the purpose of a designated pressure-relief device. The detachment of the bellows cover, which carries the primary terminal on top, will momentarily disconnect the unit from the grid and stop further fault progress, thereby preventing mechanical damage that could have more significant consequences for the surrounding equipment [10].

III. PROPOSED TEST SEQUENCE AND CRITERIA
This paper aims to show the test sequence for verification of the design of voltage transformer units with sectioned active parts, considering their safety during operation, as explained in the chapters above [10]. The general schematic representation of the test sequence is shown in Fig. 3 perform initial tests that can be used to verify the state of the unit. In addition to conventional routine tests according to [6] and [7], additional tests are recommended. Examples of such tests are as follows:  Capacitance and dissipation factor measurements,  Winding resistance measurement,  Determination of magnetizing current I RP .
The purpose of these tests is to exclude all other possible faults within the unit, other than the short circuit of the active part segment with the highest fault energy. That being said, other design-specific tests may be added at the volition of the manufacturer. At this point, the unit should be prepared for the test, which includes short-circuiting the selected active part section and implementing any monitoring provisions (pressure, temperature, etc.), after which the unit is closed off and filled with oil. The third step was to perform the test itself. The unit with the short-circuited section should be placed at the rated voltage, and current, voltage, pressure, and other optional signals should be recorded. Because the unit is closed off, making the individual sections inaccessible, I CP measurement is no longer possible. However, I FP can still be easily recorded. Along with I FP , both pressure and time should be recorded to define the point of disconnection of the unit from the rest of the grid, and to obtain the pressure increase rates.
It should be noted that in this step, the test is destructive to the transformer unit. The actual test is followed by the fourth step, which involves detailed diagnostic testing to determine its consequences. This includes the repetition of additional tests from the second step.
In addition, the unit is then disassembled and the active part thoroughly examined in so-called "post-mortem analysis". The aftermath of the test was verified using both diagnostics and post-mortem analysis.
The test is considered successful if the following criteria are met:  The test must end with a controlled and anticipated pressure relief.  There are no violent events (e.g., fire, combustion, or enclosure fracture at any point except for the designated pressure relief).  Diagnostic tests verified that the fault did not extend beyond the section on which it was initiated (residual thermal damage is acceptable).
It should be noted that even though the sectioned active part concept does limit the fault energy, residual thermal damage is to be expected in the vicinity of the short-circuited section, and is therefore allowed. The proposed test sequence is described in detail in the following chapters. As mentioned earlier, all considerations will be based on a 145 kV inductive voltage transformer type VPU-145. The reasons for using this specific unit are disclosed in the later chapters of this paper.

IV. FAULT ENERGY ASSESSMENT
One of the main requirements of the proposed test is that it is performed with a short-circuited section that yields the highest energy generation rate (i.e., the most severe fault). With this in mind, the fault energy assessment is divided into two parts: fault energy calculation and verification of fault energy.

A. CALCULATION OF FAULT ENERGY GENERATION RATE
The finite element method (FEM) is employed for the initial calculation of the fault energy. The entire procedure was first mentioned in [13] and [15] with a more detailed description given in [10]. Similar approaches were used in [2], [3] and [20]. The idea is to model the entire sectioned active part and use 3D time-harmonic calculations to obtain the values for I CP and I FP in the frequency domain. References [3] and [20] used a subdivision of the winding to achieve turn-to-earth and turnto-turn faults, whereas in this case, the subdivision is inherently present because of the active part sections. The model used is shown in Fig 4. All calculations were performed following the methodology from [10], using Mentor Graphics MagNet version 7.7 [21]. A fault vector for the entire unit can be obtained by calculating the fault-current components for each coil. It is then easy to assess the energy generation rate E FP using equation (1), which was disclosed in [10] and [13]. Equation (1) is based on Kirchhoff's current law, only substituting the arc current with I CP , which is relevant for this type of construction [18], [19].
In equation (1), R W is the resistance of the entire winding at the reference temperature, and R C is the initial resistance of the short-circuited coil at the reference temperature.  The fault current vector and energy generation rate for the 145 kV unit are listed in Table I. As indicated in the earlier chapters, fault vectors are typically expressed as ratios of I FP / I RP and I CP / I RP as they make the current increase more visible [10], [13]. All results shown in Table I were obtained with the rated voltage applied to the model. As shown in Table I, a fault in coil number 5 results in the highest energy generation rate, thus making it the worst-case scenario. Moreover, when compared with the results given in [10], it can be seen that this unit exhibits the highest energy generation rate for the entire product range, which is the reason this unit in particular was used for the demonstration of the test results. When the energy generation rate is compared to the data available in the literature [12], [22] and [23], it can be seen that it is several thousand times lower. Similar calculations are used to assess the pressure rise during an arcing event, which is then used for the dimensioning of the tank withstand [18], [19]. In this case, this is less important because the objective is to select the most unfavorable fault location within a unit. The main advantage of the proposed FEM calculation is that it is fast, simple, and accurate, as demonstrated in [10].

B. VERIFICATION OF FAULT ENERGY
While the proposed FEM calculation is an excellent tool to pinpoint the worst-case location, the current magnitudes should still be verified before finalizing preparations of the test object for the actual test. It is convenient to measure both I CP and I FP , as demonstrated in [10]. A typical measurement circuit is shown in Fig. 5. The main idea is to measure the current levels at a reduced voltage, where the measurements are not destructive to the unit. For these measurements, each current path was closed with a 1Ω shunt. Identical, calibrated FLUKE 179 multimeters were used to record the voltage on each shunt. From these values, the exact I CP and I RP levels were obtained. The linear behavior of fault current levels with applied voltage is discussed and proven in [10], this analysis is not repeated here. All measurements mentioned in this chapter were performed on a fully assembled, oil-impregnated active part. While the measurements can be performed on a unit before entering either drying or oil impregnation processes, the authors' recommendation is to perform the measurements on an open unit with fully assembled active part once the drying and oil impregnation processes have been completed.

FIGURE 5 Measurement circuit used for verification of IFP, ICP and EFP levels
The main argument for this approach is the possibility of safely performing measurements at a wider array of applied voltages, which results in a better correlation between the measured and calculated results.
In this particular case, the measurements were performed up to approximately 35% of the rated voltage without any recorded impact on the active part. It should be noted that the initial test should be of limited duration to avoid unnecessary exposure of the considered short-circuited coil to the fault current I CP .
The results of the measured currents I CP and I FP and their comparison with the calculated values are shown in Fig. 6. Fig. 6(a) shows a comparison of the measured and calculated I FP /I RP ratios. Fig. 6(b) shows a comparison of the measured and calculated I CP /I RP ratios. Fig. 6(c) shows a comparison of the measured and calculated energy generation rates E FP . It is obvious from all three figures that the measurement and calculation results are well aligned. A brief analysis of the average and maximal deviations for each of the three parameters is presented in Table II. The main cause for the deviation shown in Table II is the contact resistance of the conductors and shunt used to obtain the I CP value, as shown in Fig. 5. This phenomenon is discussed in detail in reference [10].
The obtained values presented in this paper are in line with those reported in [10], as are the observed energy margins. In addition, the obtained energy levels are in line with those presented in [13], which further validates the proposed approach and provides reassurance that the required energy levels will be accurately determined, which is highly important for the validity of the test itself.

V. TEST PREPARATION
The objective of this chapter is to outline all the recommended tests on the unit before initiating the actual test. In addition, the necessary preparations for the test object are discussed. Even before opening the unit for verification of the fault energy, routine tests were performed on the unit. In this particular case, the unit was manufactured according to the CAN/CSA C60044-2:07 standard, so the list of routine tests was adapted from the said standard [24]. In general, the actual standard according to which the unit is specified is irrelevant for this test. Any specifics in design that pertain to different requirements (e.g., standard or customer requirements) can be expressed and evaluated through energy generation rates, as discussed in the previous chapter. That being said, the actual list of preparatory tests can include a routine test set from any standard as well as any number of customer-specific tests. In addition to routine tests, which were performed on a fully assembled unit, a number of preemptive diagnostic tests were performed to obtain additional data on the behavior of the unit. In particular, one of the objectives of the test is to prove that the fault did not spread to other sections of the active part, so any specific test that can corroborate that can be included. The full list of the preparatory tests is presented in Table III. The results of the tests will be given for comparison during the fault consequence analyses, so they will not be disclosed in this chapter in order to avoid repetition.
After initial tests were performed and once the fault location with the highest energy release was determined and confirmed by experimental verification, the selected section (in this case, coil No. 5) was short-circuited, as shown in Fig. 7, and the transformer was assembled and filled with oil. In addition, the unit was equipped with a calibrated pressure gauge to monitor the pressure during the test. A pressure gauge was selected with respect to the design pressure value for the entire enclosure. Provisions for other diagnostic measurements (e.g., temperature probes, optical sensors, or monitoring systems) can also be included, but are not mandatory for the successful completion of the test. Before the unit was deployed for the actual fault test, several additional tests were performed, as indicated in Table III. The objective of this study was to provide additional insight into the behavior of the unit with the short-circuited coil and its influence on accuracy performance, fault current I FP , capacitance, and dissipation factor. As expected, the value of I FP was virtually identical when measured on a fully assembled unit to that measured with the test circuit shown in the previous section. The same conclusions were obtained in [10]. There was also no measurable influence on the capacitance and dissipation factor measurements, as the majority of the primary winding is shortcircuited during this measurement [13]. On the other hand, the accuracy performance is affected, and coarse errors in both voltage and phase are recorded, which is logical and very useful information for diagnostic purposes.

VI. TEST EXECUTION
The fully assembled transformer was transported to the laboratory where the test took place. The test circuit is illustrated in Fig. 8. Although one of the conditions for successful completion of the test is that the transformer remains intact, due to the safety of the equipment in the laboratory, the measuring circuit was designed in such a way that the transformer was located outside the laboratory. In addition, given the expected disconnection of the transformer from the high-voltage transformer by detachment of the bellows cover, the cover was secured by a rope to keep it within a reasonable circle of the unit. When the test preparation was complete and the test circuit was assembled and calibrated, the rated primary voltage was applied to the high-voltage terminal of the transformer. The primary current I FP was continuously measured for the duration of the test, as was the applied voltage. As the unit was closed, I CP could not be measured because the sections were not accessible. The pressure in the transformer enclosure was recorded using a camera installed on the pressure gauge. All recorded values were time-stamped, as shown in Table IV. Almost instantaneously after applying the voltage, the level of the bellows began to increase, which is visible through the level indicator located on the bellows cover, as shown in Fig.  1(a). Table IV shows that at 2:03 minutes from the start of the test, when the bellows reached their maximum position, the camera recorded the start of the increase in pressure on the pressure gauge. This time stamp was used to represent the recorded oscillograms for the primary voltage, fault current I FP , and state of the test object, as shown in Fig. 9 (a), (b), and (c), respectively. Approximately 3 minutes and 21 seconds from the start of the test, at a pressure of 0.41 MPa, the bellows cover detached from the transformer and the applied voltage was switched off. The conditions of the test object before and after the test escalation are shown in Fig. 6(c) and (d), respectively. The test was completed without any violent events, enclosure fractures, or fire, with the entire volume of generated gas and oil contained within the stainless-steel bellows. The pressure release was compensated by the deformation of the bellows and the detachment of the bellows cover, after which the recorded value of pressure on the pressure gauge was reduced to zero. The behavior this unit exhibited during the test is in line with other tests and in-service experiences recorded on units that share the same fault energy-limiting concept and satisfy the imposed criterion of the test, as explained in Chapter 3 [8], [10], [13]. From the test data, the total energy that the unit was exposed to can be calculated. It amounted to approximately 1.55 MJ for the duration of the test.   When compared to the data available in references [4], [9], [12], [20], [23] and [25] the observed energy of the fault is 2 -20 times lower than typical fault values. Additionally, according to [4], such fault energy will not compromise a typical transformer enclosure, which proved to be true in this case. It can be argued that it is equally important to distribute the fault energy over time, as it is to limit the total quantity. This way, energy dissipation is reduced from a violent burst to a gradual release, which is again proven by this test. This was further confirmed by the measured pressure generation rate, as shown in Fig 10(a). The pressure generation rate of the tested unit was 0.005 MPa/s. When compared to the data available in references [5], [18] and [26], the observed pressure generation rates are 200 times to several thousand times slower. This again points to the principle that in order to make the fault more controllable, it is necessary to slow it down, which is something this transformer concept successfully achieves and the proposed test verifies.

VII. ANALYSIS OF TEST CONSEQUENCES
To successfully conclude the test, the consequences of the internal fault have to be evaluated with the aim of verifying that the fault did not compromise the functionality of any section other than the one it was initiated on. This was verified in two ways: diagnostic tests and post-mortem inspection. The performed array of tests is specified in Table III, Chapter V, while the results are presented in Fig. 10 and 11, as well as in Table V. As shown in Fig. 10(b) and (c), the main parameters of the main insulation system (capacitance between screens of each section and adjoining dissipation factor) remained virtually unchanged, with an average deviation under 1% for capacitance and 6% for dissipation factor. These values clearly indicate the health of the main insulation system, and that its functionality was not compromised. Fig. 10(d) shows a comparison of the measured DC resistances of each coil (section). The average deviation of the results before and after the tests is under 3%, which again shows that no other section was substantially affected or damaged. In addition, each section was tested with 2,5 kV of applied voltage for one minute to verify if coarse damage was present, which could establish a conductive path between adjacent sections. No voltage collapse or any other irregularities were observed during the applied voltage tests. Table V shows the measurement of ratio and phase angle errors of the unit under no-load conditions (at 0 VA) and the I FP /I RP ratio the unit was tested with. As it can be seen from the table, the values before and after the test are virtually identical. From these results, it can be concluded that there is no "dielectric" evidence that any other section was functionally compromised. This has to be substantiated by visual inspection.
An initial visual examination of the complete active part, shown in Fig. 11(a), clearly indicated thermal damage on Coil No. 5, as expected. The conductor used for short-circuiting the coil showed burn traces on its outer insulation, but the conductor itself was not damaged, nor changed its appearance in any way, which means it was adequately selected. The remainder of the active part did not show any damage. All the connections and conductors were undamaged. The same can be said for all fasteners, clamps, and connecting hardware. Black residue was found scattered throughout the examined active part, most notably at the bottom (core clamp and transformer base), where the largest amount of deposit was found, which is a logical occurrence. The secondary winding and transformer core were inspected, and no damage was observed.
After the sectioned primary winding was removed from the active part, contamination was observed on the insulating cylinder, generated by residual heat from the short-circuited coil, as shown in Fig. 11(b). An ensuing thorough teardown showed that none of the capacitive screens from the main insulation were affected. Furthermore, the insulation between all adjacent screens was found to be healthy without any burn marks or residue deposits. This further corroborates the applicability of the capacitance and dissipation factor measurements, as shown in Fig. 10. This proves that the observed burn marks were only esthetic and not functional, as they were limited only to the outside of the cylinder and did not extend beyond that. The next step of the post-mortem analysis of the transformer is a detailed check of all the coils of the primary winding. The check confirmed that the only impaired section was the one that was short-circuited, and the remaining sections did not have any signs of damage from the fault. This can be distinctly seen in Fig. 11(c), showing the damaged fifth coil next to its neighboring coils, the fourth and sixth. Coil No. 5 was severely thermally damaged, with the interlayer insulation being completely blackened or evaporated, and the conductor enamel visibly damaged. This confirms the measurement shown in Fig. 10(d), where it was found that the coil resistance was immeasurable. The coil frame was found blackened only on the inner side, which means that the generated thermal energy was not sufficient to damage it completely and to compromise the dielectric insulation between the adjoining sections. The connection of the coil to its corresponding screen from the main insulation was found in the correct state with a firm galvanic connection with both the screen and the coil. All other sections were found to be completely healthy with no signs of traces on internal or external insulation, undamaged main conductor, and leads. Finally, all the structural components were examined. Apart from the components used for pressure relief, as shown in Fig.  9(d), all the other components were found to be intact. This includes the insulator, transformer base assembly, secondary terminals, and neutral terminal. No arcing signs or thermal damage was found on any of the listed components, meaning that, other than pressure relief, the fault did not extend beyond the active part. VOLUME XX, 2017
Section tgδ Measured Before Section tgδ Measured After

VIII. CONCLUSION
This paper presents an internal fault testing sequence for transformers with an energy-limiting design. The proposed sequence includes all the necessary steps, including the selection of the highest-energy fault location, test object preparation, test execution, and analyses of test consequences. The main benefit of the proposed test method is that it requires inception of the fault in the most unfavorable location, which can be accurately predetermined by calculation, thus removing any room for interpretation on where the fault needs to be initiated. Furthermore, the object preparation is simple and the test execution does not require a comprehensive test setup, meaning that the test does not have to be performed in a specific "top-tier" laboratory, thus making it accessible and repeatable for both qualification and research purposes and activities. In addition, the test methods required to verify the successful completion of the test are simple, easy to perform, and are well known in the industry. Equally important, the test is based on the energy generation rate of a certain transformer design, meaning it is independent of the standard and other outside parameters, such as systemlevel fault current or duration. All listed steps of the proposed testing sequence are described in detail on an example of a 145 kV voltage transformer, which was specifically selected due to the highest energy generation rate of the entire product range. The test object was subjected to a worst-case fault and successfully completed the proposed acceptance criteria of the test, as described in Chapter III. The successful completion of the proposed test sequence verified the energy-limiting behavior of the unit. Specifically, that means that the proposed test confirmed that the design of the unit prevented the incepted fault from extending on more than one active part section, and consequently eliminated a rapid increase in generated energy and pressure, thus preventing a violent conclusion of the test. In addition, information on energy generation rates, pressure generation, fault propagation mechanisms, and post-mortem findings are included in this paper, which provides valuable insights for industry users and researchers alike. Internal failure mitigation is a crucial aspect of instrument transformer design, which is thoroughly addressed in this paper. However, prevention of the fault is equally important, which is why a more comprehensive test portfolio is necessary to adequately address the main contributors to internal faults, and thus reduce the probability of major failures. This paper is a small but significant part of that complex puzzle.