On Dec. 3, 2022, gunfire struck two substations — one belonging to a large IOU and the other to an electric cooperative in Moore County, North Carolina. The incident knocked out power for days to about 45,000 members.

In the weeks that followed, the conversations among utility engineers across the region shifted in a way that hasn't shifted back. While they already understood that transformers can be damaged by storms, wildlife, age or simple mechanical failure, Moore County forced a different question.  Once a large power transformer begins losing oil rapidly — whether from a bullet, a failed gasket or a cracked radiator fin — what actually happens next, and how much of it is within their control?

For most utilities, the honest answer has been not much beyond dispatching a crew and hoping the unit holds until they arrive. That gap — between detecting an oil-loss event and physically stopping it — is what led to the development of the Automated Transformer Radiator Isolation System (ATRIS). This utility engineer-developed automation platform is covered under recently issued U.S. Patent 12,693,194 B2.

The Gap Between Monitoring and Mitigation

Transformer protection has advanced considerably over the past two decades. Digital relays, online dissolved gas analysis, moisture-in-oil sensing, thermal imaging and SCADA-integrated alarming have all improved the ability to see problems developing. But nearly all of that instrumentation shares a limitation: it tells us something is wrong without doing anything about it. Once a radiator section develops a significant leak — from mechanical damage, corrosion, vibration fatigue or an intentional strike — the transformer continues losing oil until a crew arrives to isolate valves manually, perhaps after damage has already progressed beyond field repair.

Physical security incidents affecting substation equipment have also become harder to treat as edge cases. The Department of Energy has documented a rising trend in physical attacks on grid infrastructure over the past several years, and Moore County was simply the event that made that trend impossible to ignore in the region. Whatever the cause of a rapid oil-loss event — ballistic damage, storm-driven debris or routine equipment failure — the physics of the problem, and the response required, are largely the same.

ATRIS: Monitoring and Responding to Oil Loss

ATRIS is not another monitoring layer stacked on top of what utilities already operate. It is designed to close the loop between detection and physical response.

The system combines nitrogen flow monitoring, oil level supervision, protective relay logic, motor-operated radiator isolation valves and cybersecurity interlocks to detect an abnormal oil-loss event and attempt to automatically isolate the affected radiator section before it can drain the main tank.

Most sealed power transformers already maintain a nitrogen blanket over the oil to limit moisture and oxygen ingress. That existing system turns out to be a useful and reliable signal source. When the transformer develops a significant oil leak anywhere, the resulting oil loss is accompanied by a measurable change in nitrogen consumption as the blanket system works to maintain tank pressure. ATRIS monitors that flow alongside oil level and feeds both into logic running on an SEL platform (for this specific application), a protection-class environment utilities already trust for time-critical automation.

The logic filters out normal operational variation and sensor noise that would otherwise risk nuisance operation, so it issues isolation commands only when the pattern is consistent with a genuine oil-loss event.

Depending on the installation, the transformer monitor may be housed in its own small cabinet as shown here, integrated into the existing control cabinet or replaced with a station RTU communicating to remote I/O modules at the transformer.

Upon first alarming for sustained nitrogen flow, ATRIS is also designed to sound a local horn and siren at the substation, independent of whether automatic isolation is enabled for that unit. The primary intent is to alert personnel and trigger a documented response; whether an audible alarm also discourages someone already engaged in deliberate damage is harder to say, but it's a reasonable secondary benefit.

ATRIS was developed primarily with smaller, often rural, substation transformers in mind — units that typically fall outside the Bulk Electric System and don't carry the budget for underground radiator vaults, redundant cooling systems or hardened perimeter walls that larger transmission-class stations can justify. That segment of the fleet also tends to favor the equipment ATRIS is targeting: sealed, nitrogen-blanketed tanks rather than conservator-style designs and natural oil flow with forced-air cooling (ONAF) rather than pumped, directed oil circulation.

Retrofit Engineering

An early design question was whether ATRIS would be viable only on new transformer purchases or could be retrofitted onto the fleet utilities already operate. Few cooperatives can justify replacing serviceable transformers solely to add a protection feature, so the retrofit path had to work on units already in service, without requiring an extended outage.

The current approach targets transformers already equipped with individual isolation valves on each radiator section, since ATRIS automates existing valves rather than adding new penetrations into the tank. For fleets without individual radiator valves, a variant using a single bottom-and-top valve pair per radiator bank is a natural extension of the same architecture and one worth evaluating for future development.

That constraint drove the development of an adjustable mounting bracket designed to accommodate the range of radiator valve types found across a typical utility fleet, rather than requiring a custom fixture for each transformer design.

The upper bracket piece includes slotting for both up-and-down and back-and-forth adjustment. It pairs with one of two lower base plates, selected based on whether the existing valve uses a center-mounted or double-offset stem, each with additional slotting for side-to-side positioning.

Both base plates include four semi-circle slots that allow the installer to rotate the actuator on the mounting face until its electronic closed-limit switch aligns with the valve's true mechanical closed position — ensuring the control system's indicated status actually corresponds to a sealed valve.

Installation Discipline

Retrofitting energized equipment means the installation itself cannot introduce new risk. That consideration mattered as much as the automation logic itself.

Mounting the bracket requires replacing the factory flange bolts with longer ones to leave clearance for the bracket hardware. Before removing a bolt from a flange that has been torqued and sealed for years, sometimes decades, temporary C-clamps secure the joint, one bolt at a time, so the flange never loses compression during the swap.

Each bolt is replaced individually, clamps holding the joint tight until the new extended bolt is seated and properly torqued. Repeated across both bolts on the flange, this approach keeps the joint sealed throughout the retrofit — no outage required, and no leak introduced, on a transformer that remains in service the entire time.

With the bracket and extended bolts in place, the motor-operated actuator mounts directly to the valve stem, ready for commissioning and integration with the ATRIS control logic.

Configurable by Design

Every utility runs its own philosophy on what warrants automatic action versus a supervised alarm, and ATRIS was intentionally built to be configurable rather than prescriptive.

Some utilities may want fully automatic isolation on a confirmed event; others may prefer the system raise an interim alarm and require operator confirmation before valves close, particularly on units where an unnecessary isolation carries real operational cost. That flexibility extends to commissioning: an engineering team can enable selective automation triggers incrementally as it builds confidence in the system's behavior on a specific transformer, rather than committing to full automatic isolation from day one.

That supervised mode plays out in the field roughly as follows. A dispatcher monitoring an ATRIS alarm, whether from field reports or camera coverage, would first confirm which radiator section is affected.

Next, the dispatcher checks the transformer's current loading against a derating chart to confirm the unit can tolerate the loss of that section and remotely closes the isolation valve on the damaged radiator bank. The radiator fans can then be switched to manual and run at full capacity to help recover a portion of the lost cooling capacity.

Within a few minutes, nitrogen flow at the monitor should taper as the isolated section stops drawing from the blanket system, confirming the leak has been contained.

Isolating a radiator section changes more than total cooling capacity — it also alters internal oil circulation, which can shift where a hot spot develops relative to the transformer's original thermal design. In an active leak event, the immediate priority is arresting further oil loss and keeping the unit in service at a conservatively derated rating, which may be further reduced to address any hot spot concerns depending on which radiator section is to be closed. Rather than tripping offline entirely, the transformer stays in service, closely monitored, until permanent repairs can be scheduled.

Cybersecurity was a design requirement from the outset rather than an afterthought. Because ATRIS commands physical valve operation, its interlocks and communication architecture were built around the same hardwired protection-class security expectations utilities already apply to many relay platforms, rather than as a separate, less-scrutinized control path added alongside them.

Where This Fits

ATRIS is not intended to replace existing protection and condition monitoring. Dissolved gas analysis, moisture sensing and thermal imaging remain valuable for identifying developing problems long before a rapid oil-loss event occurs.

ATRIS addresses a narrower and, in my experience, largely unaddressed problem: what happens in the minutes after a leak becomes severe, whatever the cause.

It's also worth considering alongside broader substation automation strategies many utilities are already investing in, including FLISR, since the underlying platform and remote I/O architecture can, in many cases, share infrastructure already in place for other automation functions.

With average power transformer lead times now stretching well past two years at many manufacturers, protecting the units already in service has become, in practical terms, as important as specifying new ones well. A transformer that survives an oil-loss event with an isolated radiator section, rather than a fully drained tank, may be the difference between a repair measured in weeks and a replacement measured in years.

Editor's Note: Additional technical detail, including licensing information for utilities and transformer manufacturers interested in evaluating the system, is available at 52bsolutions.com. Note that the author of this article, a utility engineer, designed ATRIS not as a one-size-fits-all product, but rather a way to close the gap and keep transformers and customers in service.