PEFGInvestigated. Engineered. Defensible.
Request Consultation
Dwg PEFG-SVC-02 Entity PEFG, PLLC Rev B
Origin & Cause · Failure Analysis

Forensic Electrical Investigation

Origin-and-cause investigation of electrical fires and equipment failures — more than 400 investigations across transformers, switchgear, generators, breakers, and wind turbine electrical systems.

Jay Prigmore II, Ph.D., P.E., Principal Engineer, PEFG

By Jay Prigmore II, Ph.D., P.E. Last reviewed · Prepared and reviewed by a licensed Professional Engineer

Determining what actually failed, and why

An electrical failure usually destroys much of its own evidence. Arcing consumes the conductor that started it, fire damage obscures the initiating fault, and the equipment most likely to hold the answer is often the equipment most badly damaged. Forensic electrical investigation is the discipline of reconstructing the failure sequence from what survives — physical artifacts, protective device behavior, recorded data, and the physics that constrain what could and could not have happened.

PEFG performs that work directly. Every investigation is conducted by Jay Prigmore, Ph.D., P.E., who has completed more than 400 forensic investigations and led forensic analysis across Google's hyperscale data center fleet.

Equipment and systems investigated

  • Transformers — winding failures, bushing and tap changer faults, dissolved gas analysis interpretation, thermal and overload history.
  • Switchgear and motor control centers — bus faults, insulation breakdown, connection failures, arcing damage patterns.
  • Circuit breakers, relays, and fuses — failure to interrupt, misoperation, incorrect settings, mechanical failure.
  • Generators and rotating machinery — stator and rotor failures, excitation and control system faults, synchronization events.
  • Wind turbine electrical systems — nacelle fires, converter and collector system faults, protection misoperation.
  • UPS, battery, and DC systems — thermal runaway, DC arc faults, bus and connection failures.
  • Conductors and connections — overheating, loose or corroded terminations, insulation failure.

How an investigation is conducted

Evidence preservation comes first

Electrical evidence has a short half-life. Relay event files roll over, SCADA and historian data age out of retention, and damaged equipment gets cleaned, scrapped, or repaired. The first conversation in any engagement is about what needs to be preserved and photographed before anything is disturbed — including data that is not physically at the site.

Documentary and data review

Before or alongside the site inspection, PEFG reviews single line diagrams, protective device settings and coordination studies, relay event and COMTRADE waveform captures, SCADA and operational data, maintenance and testing records, equipment datasheets, and weather data where lightning or environmental cause is in question.

Site inspection and documentation

The inspection documents arc damage patterns, thermal signatures, mechanical evidence, and the condition of protective devices and their settings as found. Where joint inspections involve multiple parties, evidence handling protocols and chain of custody are established in advance.

Laboratory examination, where warranted

When physical evidence requires it, components are examined under controlled conditions — metallurgical and microscopic examination of failed conductors and contacts, insulation analysis, and non-destructive imaging before any destructive testing is authorized.

Analysis and reporting

Findings are assembled into a written report that separates factual observation from engineering opinion, states the methodology and standards applied, documents the reliance list, and identifies any hypothesis that could not be ruled out with the available evidence. Reports are written to be produced in discovery.

Retained by

PEFG is retained by insurers and subrogation counsel, plaintiff and defense counsel, equipment owners and operators, and manufacturers. Investigations frequently begin before litigation is filed, and the same engineer carries the matter through to deposition or trial testimony if it is needed later — which avoids the handoff problem that arises when the investigating engineer and the testifying expert are different people.

Response time

Because engagements are not routed through a staffing process, PEFG can typically complete a conflict check and issue a retention letter within one to two business days. Where evidence is at risk, site attendance can often be arranged more quickly than a standard engagement cycle would allow.

Methodology and standards applied

  • NFPA 921, Guide for Fire and Explosion Investigations — hypothesis development and testing, arc mapping, and the elimination of alternative causes.
  • ASTM E1188, Collection and Preservation of Information and Physical Items by a Technical Investigator, and ASTM E620, Reporting Opinions of Scientific or Technical Experts.
  • NFPA 70 (NEC) — installation compliance as of the edition adopted at the time of the work, not the current edition.
  • NFPA 70B — electrical equipment maintenance, now a standard rather than a recommended practice, which changes how a maintenance-failure argument is framed.
  • IEEE C37 series (switching apparatus) and C57 series (transformers) — for what the equipment was qualified to withstand.
  • National Electrical Safety Code (IEEE C2) — where utility supply or communication facilities are in scope.

A worked example

Illustrative — a breaker that tested fine and still failed to trip

A 15 kV feeder breaker fails to clear a bolted fault. The upstream transformer’s own protection operates instead, an entire zone of coordination is lost, and the equipment damage is far greater than the original fault would have caused on its own. The maintenance file shows the protection was tested eleven months earlier and passed. The question is how a breaker that passed its last test failed to trip when it mattered.

The test record answers the question once it is read for what it actually covered rather than what it says at a glance: the prior maintenance was secondary injection only. Secondary injection drives test current directly into the relay’s current inputs and confirms pickup, timing, and the trip output — but it starts downstream of the current transformer. It proves the relay works. It does not prove the CT, its wiring, or the test switch between them are actually delivering current to the relay under real operating conditions. Primary injection pushes real current through the primary conductor and the CT itself, exercising the full protection chain end to end — which is the only test that catches a reversed CT polarity, an open CT secondary, or a test switch that never returned fully to the closed position after the previous outage.

Here the as-found evidence pointed to the third case: the CT test switch used for the prior secondary injection test was found short of fully seated, isolating the CT secondary from the relay in normal service while still allowing test leads to read a clean relay response on the bench. The relay was never the problem, and the maintenance record was not false — it accurately reported that the relay passed the test that was actually performed. The finding turns on what the test omitted, not on what it recorded, which is why the test procedure itself has to be part of the review, not just its result.

Evidence preservation — act on these in the first week

  • Download relay, meter, and SCADA event records immediately. Rolling buffers overwrite; nothing else on this list is on a clock this short.
  • Do not energize the equipment, even to test it. Re-energizing destroys the as-found state and can create new arc damage indistinguishable from the original.
  • Do not clean, wash, or vacuum the equipment or the scene. Soot patterns and conductive deposits are evidence.
  • Photograph as-found conditions with a scale, before removal, including the interior of every compartment.
  • Preserve the whole assembly where practical, not just the suspected component. Origin arguments frequently depend on what did not arc.
  • Issue a written litigation hold covering maintenance records, test reports, work orders, prior studies, and the as-built one-line.
  • Coordinate a joint inspection protocol before disassembly so no party can argue evidence was altered outside their presence.

Open tools and cross-checks

Where a preliminary calculation would help scope the investigation before a site visit, the open tools at PowerEngCalc are usable directly — the arc flash calculator for incident energy at the suspected location and the transformer thermal life calculator where loading history is in issue. If the matter involves an existing arc flash study whose quality is unknown, Arc Flash Files will run an automated review of it as a low-cost first pass before deciding whether a full expert review is warranted.

Frequently Asked Questions

FAQ

Questions that come up before a retention decision, answered by the engineer who would do the work.

How long does a forensic electrical investigation take?

A site inspection is usually one to three days depending on how much equipment has to be examined and whether disassembly is done on site or at a laboratory. The written report normally follows within three to six weeks of the last piece of evidence being collected. The variable that moves the schedule most is not the engineering — it is waiting for other parties' inspections to be scheduled, and waiting on records that were requested late. Preservation is the urgent step; the analysis can proceed on its own schedule once the evidence is secured.

The equipment was already scrapped. Is an investigation still possible?

Often, but the conclusions are narrower and that limitation belongs in the report. Photographs taken by first responders, the fire department's own investigation file, insurance adjuster documentation, relay and meter records, maintenance history, and the as-built one-line will frequently support an opinion on whether an electrical cause is or is not consistent with the evidence. What is usually lost is the ability to distinguish between two competing electrical causes, because that distinction normally depends on artifact-level examination. An honest investigation says which questions the surviving evidence can and cannot answer.

Can origin and cause be determined from photographs alone?

Sometimes the cause can be excluded from photographs; the cause is much harder to establish from them. Photographs taken by someone not looking for arc severing, globule formation, or notching typically will not have the depth of field, the scale, or the angle needed to distinguish arcing damage from fire damage. Where photographs are all that survives, the useful output is usually a well-supported statement of what the evidence rules out, which can be decisive on its own.

Who should attend a joint inspection?

Every party who might later dispute what was found. The purpose of a joint protocol is to remove any argument that evidence was altered outside another party's presence, so it is worth the scheduling difficulty. The protocol should be written before the inspection and should state what will be photographed, what will be disassembled, what will be removed for laboratory examination, and how the evidence will be stored and by whom afterward.

Is destructive testing ever necessary?

Frequently — metallurgical sectioning, insulation analysis, and teardown of a failed device are often the only way to distinguish a manufacturing defect from an application error. Because the examination cannot be undone, it is performed only under a written protocol agreed by all parties, with full photographic documentation before, during, and after, and with the option for every party to have a representative present. Nothing is cut before that agreement exists.

What does a defensible investigation report contain?

A statement of the assignment, the materials relied on, the methodology followed and the standard that methodology comes from, the observations, the analysis, the hypotheses considered — including the ones rejected and why — and the opinions with the level of certainty stated. It should also state the limitations: what evidence was unavailable, what could not be determined, and what would change the opinion. A report that reads as though every question was answerable is a report that invites a very productive cross-examination.

Preserve the Evidence First

If a failure has just occurred, the highest-value conversation is the one that happens before anything is cleaned up.