Interlocking Testing: What Is Checked at FAT and SAT

Short answer

Interlocking testing checks that each operation is allowed when all its conditions are met and blocked when any of them is missing. It also verifies the handling of intermediate and invalid positions, loss of communication between bays, the bypass, the control levels and the degraded mode. At the factory it is done with simulated positions; on site, with the real devices. The result is a matrix of cases with their evidence.

What is tested and why

An interlock that works badly is almost never noticed in daily operation: normal operations are done in the right order and the logic never has to block. The error shows up the day someone gets the sequence wrong, and on that day the interlock is the only thing between the command and an arc. That is why the test cannot be limited to operating the substation: it has to attempt, deliberately, every forbidden operation.

The test covers every place where the logic lives: the mechanical interlock of each device, the wiring of the disconnector motor drive and the breaker, the logic of the bay controller and, where it exists, the station logic, hardwired or over GOOSE.

The starting point is the project’s interlocking table: for each device and each operation (open, close), the combinations of positions that allow it. The list of test cases comes from that table.

Cases that are checked

Case	What is checked
Positive	With all conditions met, the operation is allowed
Negative per term	With each term negated one at a time, the operation is blocked
Intermediate position	A device in travel, or stopped halfway, blocks the operations that depend on it
Invalid position	Both contacts in the same state are treated as “not satisfied”
Loss of communication	Without the positions of another bay, station operations are blocked
Test data	A position flagged as test does not enable a real operation
Bypass	It is activated only with its key or permission, and it is indicated and logged
Control levels	Each level respects the interlocking the design assigns to it
Degraded mode	Without station interlocking, the intended operations remain available and nothing else

The negative test produces the most cases. A condition such as “close the disconnector if the breaker, the bay earth and the bus earth are open” has one positive case and three negative ones. If the condition has two alternatives (for example, off-load selection or on-load transfer in a double busbar), each alternative has its own, and it must also be checked that a mix of terms from both alternatives does not enable the operation.

From the interlocking table to the test matrix

01Project tableConditions per device and operation, with their alternatives
02CasesOne positive per alternative and one negative per negated term
03Special casesIntermediate, invalid, loss of communication, test, bypass and control levels
04ExecutionAt FAT with simulated positions; at SAT with the real devices
05RecordExpected result, actual result and evidence for each case

The list of cases, one positive per alternative and one negative per condition, can be obtained for each configuration with our free interlocking table tool.

FAT: with simulation

In the factory acceptance test, the controllers are in the panel and the switchyard devices are not there. Positions are simulated with switches on the binary inputs or, in IEC 61850 substations, by publishing the GOOSE messages of the neighboring bays from a test set. The FAT is the place to go through the whole logic matrix, because changing a simulated position takes seconds, and invalid positions and message loss are easy to force.

What the FAT does not test is the field wiring or the real behavior of the auxiliary contacts.

SAT: with the real devices

In the site acceptance test, the cases are repeated with the real devices, with the substation de-energized or the part under test isolated. Other errors appear here: auxiliary contacts that change before the disconnector finishes its travel, wires crossed between open and closed, neighboring bays publishing the position of another device, switchyard controls that do not go through the controller logic. The mechanical interlock of each device and its relation with the electrical one are also checked.

At SAT it pays to test from each control level, because each level may have a different path to the device.

What the record must contain

A useful interlocking test record lets someone else, years later, know what was tested and with what result. As a minimum:

The version of the interlocking table and of each controller’s configuration.
Each case with its expected result (allowed or blocked) and the actual one.
The control level from which it was tested.
How each position was obtained: simulated or real.
The special cases: intermediate, invalid, loss of communication, bypass.
The deviations found and their correction, with the case repeated.

Any later change in the logic, for example when adding a bay, requires repeating the affected cases, including those of the neighboring bays whose station conditions changed.

Reference standards

IEC 61850-4 covers project management for substation automation, including the factory and site test stages, and IEC 61850-10 defines conformance testing of each device against the standard; device conformance does not replace testing the project logic. IEC 62381 describes the FAT, SIT and SAT stages of automation systems. IEC 61936-1 and EN 50110-1 set the safety requirements the interlocking must meet.

What goes wrong in practice

Positive tests only, which leave what protects people unverified.
Interlocking table out of date against the loaded configuration.
FAT without loss-of-communication cases or invalid positions.
SAT that does not repeat what the FAT tested, ignoring the real wiring.
Bypass active during the test, which makes every case pass.
New bays tested on their own, without repeating the station conditions of their neighbors.

Do you need to test the interlocks of a substation that is new, extended or modernized? At Tiza Group we perform and witness interlocking tests at the factory and on site, with hardwired controllers or IEC 61850, for substations and industry at medium, high and extra-high voltage. Site work is done in Colombia, or elsewhere on request. Contact us with the scope of your project.

References

IEC 61850-4, System and project management.
IEC 61850-10, Conformance testing.
IEC 62381, Automation systems in the process industry – Factory acceptance test (FAT), site acceptance test (SAT) and site integration test (SIT).
IEC 61936-1:2021, Power installations exceeding 1 kV AC and 1,5 kV DC – AC.
EN 50110-1, Operation of electrical installations – General requirements.
IEC 61850-7-4, Compatible logical node classes and data object classes (CILO).

Frequently asked questions

Is it enough to test that each operation is allowed?

No. The positive test only shows that the logic does not over-block. What protects people is the negative test: for each condition, each term is negated one at a time and the operation is checked to be blocked.

What changes in the test when interlocking is done over GOOSE?

Cases that do not exist with wiring are added: loss of the message, invalid quality, data flagged as test, and a configuration different from the one expected. In all of them, the operation that depends on another bay must be blocked.

Why repeat on site what was already tested at the factory?

Because at the factory the positions are simulated, and on site they come from the real auxiliary contacts, with their wiring, adjustment and timing. Many errors only show up with the real device: a contact that changes too early, a crossed wire, or a neighboring bay that publishes something else.