GOOSE Interlocking with CILO and CSWI (IEC 61850)

What changes with IEC 61850

In conventional control, interlocking between bays is hardwired: the auxiliary contacts of a disconnector in one bay travel by cable to the mechanism or the controller of another. In an IEC 61850 substation, those positions travel as data over the station network. Each bay controller publishes the position of its devices in a GOOSE message, and the controllers that need it subscribe to it.

The change is not only the copper saved: the received position arrives with its quality, and the receiver knows at all times whether the data is valid. A cut cable gives no warning; a lost subscription does.

The chain of logical nodes

IEC 61850-7-4 splits the function among several nodes:

• XSWI and XCBR represent the disconnector and the circuit breaker at process level. Their Pos data object is the position of the device.
• CILO is the interlocking node. It has two mandatory data objects: EnaOpn (enable open) and EnaCls (enable close). The standard calls for one instance per switching device, states that at least all related positions must be subscribed, and leaves the algorithm to the implementer.
• CSWI is the switch controller: it receives the operator’s command and passes it to the device only if CILO enables it.

An IEC 61850 control command can also ask for the interlock to be checked: the Check parameter of the command tells the server whether to evaluate the interlocking and the synchronism check. Leaving it disabled makes the controller execute the command without consulting CILO, so the client configuration is also part of safety.

The CILO equations and the GOOSE subscriptions they imply can be generated for each bus configuration with our free interlocking table tool.

Intermediate and invalid position

The position of a device is modeled as a double point. IEC 61850-7-3 gives it four states: intermediate, open, closed and invalid (both auxiliary contacts indicate open and closed at the same time). While the disconnector travels, the position is intermediate; if a contact is damaged, it can stay intermediate or invalid permanently.

The design rule is simple: only “open” or “closed” with valid quality satisfy a condition. An intermediate, invalid or questionable-quality position counts as “not satisfied”, and the permission that depends on it drops. It is fail-safe applied to interlocking.

What happens when the message is lost

Each GOOSE carries a time allowed to live (TAL). The subscriber expects the next message within that time; if it does not arrive, it declares the subscription lost and the data quality goes to invalid. With that, every station permission that depends on that bay drops, while the conditions solved within the bay itself keep working.

That behavior is desirable, but it has operational consequences: a switch failure or a misconfigured VLAN blocks operations in several bays at once. That is why GOOSE interlocking is designed together with the station network, with redundancy where availability calls for it, and the operations still allowed in degraded mode are documented.

Compared with hardwired interlocking

Why testing changes

With wiring, testing an interlock between bays means moving the device and checking the contact at the other end. GOOSE adds cases: loss of the message, invalid quality, data flagged as test, and a configuration revision different from the one expected. At the factory, the positions of neighboring bays are usually simulated by publishing GOOSE from a test set; on site they are checked with the real devices. The link with the IEC 61850 test modes is direct: a message with the test bit must not enable a real operation.

To prepare the subscriptions you can use our free GOOSE and SV addresses tool, which assigns the addresses of each publisher, and review the configuration file with the SCL viewer.

What goes wrong in practice

• Subscription to the wrong position, or to a data object whose quality is not included in the dataset.
• Logic that treats invalid quality as “open”, which turns a loss of communication into a permission.
• Dataset modified without updating the subscribers, which then stop recognizing the message.
• Devices of different editions that handle the test bit and simulation differently.
• Check parameter disabled in the client or the gateway.

Are you migrating hardwired interlocks to GOOSE, or do you need to review those of a digital substation? At Tiza Group we configure the CILO logic, the subscriptions and the network remotely through our remote relay configuration service, and we test them with the real devices in Colombia, or elsewhere on request. Contact us with the equipment of your project.

Related guides

• Interlock testing: what is checked at FAT and SAT
• Select before operate (SBO): how the command works
• IEC 61850 transfer time: classes and measurement
• Disconnect replica for bus differential protection

References

• IEC 61850-7-4, Compatible logical node classes and data object classes (CILO, CSWI, XCBR, XSWI).
• IEC 61850-7-3, Common data classes (double point: intermediate, open, closed, invalid).
• IEC 61850-7-2, Abstract communication service interface (control model, Check parameter).
• IEC 61850-8-1, Specific communication service mapping (GOOSE, time allowed to live).
• CIGRE, Technical Brochure 540, Applications of IEC 61850 standard to protection schemes, WG B5.36, 2013.

Frequently asked questions