Interlocking prevents switching that would endanger people or plant — closing an earth switch onto a live line, opening a disconnector under load. With IEC 61850 the positions of other bays arrive by GOOSE, so the logic also has to block when a message is lost, invalid or from a device in test. A misplaced bracket or a '!=' test in one condition can release an operation in hundreds of position combinations that nobody tests by hand. Testing the logic exhaustively before the FAT finds these errors on paper.
Standards followed
IEC 61850-7-4 (CILO interlocking: EnaOpn / EnaCls release; CSWI)IEC 61850-7-3 (Dbpos: intermediate 00, off 01, on 10, bad 11; quality)IEC 61850-8-1 (GOOSE time allowed to live; simulation / test)IEC 61850-10 and IEC 62271 (testing; switchgear interlocking principles)
What it can do
- Conditions in plain notation: QA1 = OFF & QC1 = OFF & (QB2 = OFF | BC_QA1 = ON), with ON / OFF / INT / BAD (also CLOSED / OPEN), &, |, !, AND, OR, NOT, brackets; single points as bare names.
- Evaluates each condition over every combination of its inputs (four states per double point, two per single point, up to 65 536 combinations) with fail-safe logic: a BAD position, an invalid, lost or test input makes its comparison unknown, and unknown never releases.
- Compares the implemented logic with the specification combination by combination: unsafe differences (released where the specification blocks) and restrictive ones.
- Shows where an implementation that ignores quality and GOOSE supervision would still release, where a BAD position satisfies a '!=' test, contradictions and conditions that block nothing; writes test steps (each input changed from a released state, each GOOSE interrupted) as CSV.
Example problem
A double-busbar feeder: bus disconnectors QB1/QB2, line disconnector QB9, earth switches QC1, QC2, QC9 and the bus coupler positions by GOOSE.
- QB1 is written without brackets: '… & QB2 = OFF | BC_QA1 = ON & …'. Because & binds before |, the bus-coupler branch alone releases QB1 — even with QA1 closed or an earth switch closed: 252 unsafe combinations.
- QA1 close uses '!= INT': a BAD (11) position of a disconnector then satisfies it.
- QC9 depends on LINE_V by GOOSE: if the IED does not supervise the GOOSE, a lost message keeps 'no voltage' and releases the earth switch.
One unsafe condition, three '!=' weaknesses and the GOOSE inputs that need supervision — plus a test sheet for the FAT.
The tester checks the logic you write, not the bay controller: transcribe the configured logic exactly (including operator precedence as the tool applies it) and confirm the results in the FAT. Operator precedence here: NOT before AND before OR, as in IEC 61131-3 and most configuration tools — check your tool's rule.