Interlocking

Interlocking logic continuously evaluates the real-time topology of a substation bay. It reads the open/close status of all relevant circuit breakers, disconnectors, and earthing switches via GOOSE messages or hardwired binary inputs. The logic prevents a disconnector from opening or closing if the associated circuit breaker is still closed, enforcing the fundamental rule that disconnectors must not interrupt load current. This evaluation is typically implemented in the bay controller IED and operates with deterministic speed.

Beyond individual bays, interlocking extends across the entire substation to manage complex configurations like busbar transfers and bus coupler operations. For example, when transferring a feeder from one busbar to another, the logic ensures the bus coupler and associated disconnectors are in a safe sequence before any operation is permitted. This station-wide view prevents operators from accidentally isolating a bus section or creating an unsafe parallel connection between different voltage sources.

In modern IEC 61850 substations, interlocking signals are exchanged between IEDs using GOOSE (Generic Object Oriented Substation Event) messages over the station bus. This replaces hundreds of copper wires with a single fiber-optic network. Key characteristics include:

• Publisher-subscriber model: A circuit breaker IED publishes its status; all bay controllers subscribe to it
• Sub-millisecond latency: Critical for operational safety
• Continuous supervision: GOOSE messages include a heartbeat, so any communication failure is detected immediately and triggers a fail-safe state

Interlocking is tightly integrated with the Select-Before-Operate (SBO) control sequence. When an operator selects a switching device via the HMI or SCADA, the interlocking logic evaluates the current topology and returns either a release or block signal. Only if the interlocking conditions are satisfied does the SBO sequence proceed to the operate step. This two-step process provides a critical defense against both human error and software glitches.

Interlocking systems are designed with a fail-safe principle: any loss of communication, power supply failure, or IED malfunction must result in a blocked state, never a false release. This is achieved through:

• Default block on timeout: If a GOOSE message from a critical circuit breaker is not received within its time-to-live, the interlocking logic assumes the worst case
• Redundant communication paths: Using PRP or HSR protocols to eliminate single points of failure
• Hardwired backup: For the most critical interlocks, a direct copper connection may supplement the digital logic

Interlocking logic must be rigorously tested before commissioning. Engineers use Substation Configuration Language (SCL) files to define the expected behavior and then validate it through Hardware-in-the-Loop (HIL) simulation. The HIL simulator injects GOOSE messages representing various breaker and disconnector states, and the test system verifies that the bay controller's interlocking outputs match the expected results for every possible topological combination, including fault scenarios.