Research on interlocking CILO
based on IEC 61499/62351
1 1
Jiaqi Pan , Bin Duan
1
College of Information Engineering,
Xiangtan University, Xiangtan, 411105, P.R.China
2
CSR ZHUZHOU ELECTRIC CO.,LTD.
Zhuzhou, 412001, P.R.China
E-mail: seven-eleven1989@hotmail.com
Abstract: Function Blocks method which meets the standard IEC
61499 is applied to the implementation of specific details of the
digital substation interlocking CILO in the IEC 61850, making
the static structures of CILO executable. Digital substation
mapping architecture is established which making the designed
function block can be compatible with both IEC 61850 and IEC
61499. The CILO interlocking communication module is given in
the paper. Moreover, safety expansion for the communication
GOOSE message and security GOOSE message is designed based
on IEC 62351-6, which not only meets the demands of real-time
communication, but also have a high safety degree. The
communication of interlocking and security authentication
process is described.
Index Terms: Digital Substation; IEC 61499; IEC 61850; CILO;
IEC 62351; interlocking
I. INTRODUCTION
Grid network fault is a threat to the safety and stability of
electric power system that causes the loss of economic assets
and even a threat to human life. We can avoid power
dispatching error and human error operating of substation
through protective mechanisms. But these technologies seem
not compatible with digital technology recently. Digital
substation technology is to establish the uniform digital model
communication platform of substation based on IEC 61850
and implement digital communication between primary
equipment and secondary equipment to ensure interoperability
of IED (intelligent electronic device). In digital substation
following IEC 61850, it apply allowance and forbiddance of
blocking technology on device switches to prevent error
operation [1][2].
Applying FB function block method of distributed
industrial process measurement and control system(IPMCS)
which meet the IEC 61499 to solve logical node problems of
IEC 61850, and mapping logical node ,logical device of digital
substation to basic and composite function block of
IEC61499[4-7]. Therefore, the function of logical node and
logical device can be implemented by FB function block. But,
few studies have been done for the security of internal
implementation details, such as internal algorithms, data flow
as well as specific implementations.
IEC 61850 standard defines an intelligent architecture which
978-1-4577-0547-2/12/$31.00 ©2012 IEEE
2 1
, Chaowu Qiu , Guojing Li
contains protection, monitoring, control and automation
functions and it’s widely used in the power industry. However,
one area was intentionally left blank: IEC 61850 does not
standardize the representation of combinatorial, sequential,
rule-based power system control and automation logic.
Usually, different suppliers use different and incompatible
hardware platforms. Therefore, the interoperability can not be
achieved. The IEC 61499 standard can fill this gap that it can
be used to define the algorithms for a wide range of control
and automation functions [4-7].
In digital substation, the messages need to be transmitted
within 4ms and encryption or other security measures which
affect transmission rates are not acceptable. Therefore,
authentication is the only security measure included, and IEC
62351-6 provides a mechanism that involves minimal compute
requirements for these profiles to digitally sign the messages
[8].
The interlocking security communication of real-time in
digital substation needs the following properties: 1) Integrity,
network transmission is not subject to any modification,
deletion, insertion or retransmission. 2) Availability, the
information can be accessed by legitimate users and use in
accordance with requirement of the order.
In this paper, we design security GOOSE message to
implement security interlocking communication of digital
substation, and propose a CILO composite function block
model which meets the standard IEC 61499 and IEC 61850.
II. CILO INTERLOCKING ARCHITECTURE
Figure 1 shows a basic circuit diagram of 220KV Chayuan
substation. It includes dual-bus and three bays, and each bay
including input and output line, switching electrical device,
ground wire and connection wires among devices.
From above picture, we get entire processing of substation
security interlocking function achievement which shows in
figure 2. The logical nodes it contains are: switching controller
(CSWI), interlocking (CILO), man-machine interface (IHMI),
isolating switch (XSWI), circuit breaker (XCBR). And the
specific procedures are as follows [9]:
• The interlocking principles are installed to prevent
 maloperations of disconnectors and earthing switches, e.g.
disconnectors shall not be opened or closed on-load.
Figure 1. Single diagram of 220KV Chayuan substation
• When IHMI need to cut the line, that is, disconnect the
circuit breaker, it send MMS(Manufacturing Message
Specification) message(Pos.ctlVal) to CSWI.
• Start CILO interlocking module, the required switch
state data is obtained from real-time database, the
database is updated through security GOOSE
message, which ensures the real-time ability and
security of the data. The switch device of process level
sent GOOSE message such as information flow (3,4).
The security conditions of interlocking rules are
updated by the MMS message sent to real-time
database (5).
Figure 2. Security interlocking instance flow chart
• CILO integrate interlocking module to get logical
value, sent interlocking information to control logical
node CSWI (6).
• After received interlocking information which allows
disconnecting, CSWI sent control command to XCBR
to controlling its trip by MMS message (7). When the
circuit breaker state(XCBR.Pos.stVal) changes from
“on” to “off”, XCBR send security GOOSE message
(8) to CILO for update real-time database
immediately, and report new state (XCBR.Pos.stVal)
to CSWI (9) using MMS message. Then CSWI report
its state to station level host IHMI (10).
III. DESIGN OF CILO FUNCTION BLOCK ACCORDING TO IEC
61499
A. Application the control function block in resource
The mapping relation of substation bay level to function
block of IEC 61499 is shown in figure 3.
Figure 3. bay level resource model
CILO function block is exchanged data with function
block of local resources or remote resources or physical device
I/O point through service interface function block(SIFB) and
communication mapping and process mapping between
resources. It subject to resource scheduling to ensure its
function blocks coordinated operation in the correct order.
And the data exchange between CSWI or other function block
in the same resource is through event flow and data flow
directly.
B. Establishment of CILO blocking composite function block
model
In composite function block types, the event inputs and
outputs of the component function blocks can be
interconnected with that of the composite function block to
represent the sequencing and causality of function block
invocations. As shows in figure 4, the structure of proposed
CILO composite function block is indicated.
Figure 4. FB_CILO composite function block model
There are five basic function blocks in the composite
block, corresponding to five kinds of function block types,
each block is specified as follows:
• FB_CILO_Init function block: Provide the
initialization command, initialize “INIT” event, and
then trigger other function blocks of composite block
to initialize when reset start and equipment of resource
change.
• FB_Message_Deal1 function block: It is the type of
function block instance to calculate processing
determine. Its major role is to identify and process
 received message after the initialization. When it’s
running, its event output will inform FB_Data_Array
block to receive switching device name.
• FB_Data_Array function block: It is the type of
function block instance to storage and computing
processing determine. Its main role is to store all
relevant devices’ real-time value. Calculate
reachability matrix P of the entire substation full map
by calling for internal algorithm, according to all
switching device names and state values. Compute
control matrix E in current running state of substation
by “mis-operation prevention” rule.
• FB_Rule_CILO function block: is a type of storage
and computing processing discriminate function block
instance. Its main role is to analysis the safety
performance of blocking request from switching
device, to generate logic blocking result after
computing and processing and produce output event
“EO_SENTEN”. It sampling and reading information
data from external block to storage or update logic
blocking rule deduced from substation’s primary
wiring diagram when initialization. After received all
blocking rule parameters from FB_Data_Array, the
block calls internal algorithm to start the analysis of
safety performance of request switching device.
• FB_Message_Deal2 function block: is a type of
compute and process discriminate function block
instance. Its main role is opposite to
FB_Message_Deal1 that it packages logic blocking
result outputted by FB_Rule_CILO function block
after initialization and generates a responding response
message(such as GOOSE) event
“SWITCH_SENTENCE”. And sent to other function
blocks(such as CSWI function block) within the
resource by the form of BYTE data type or sent to
other resources like remote device resource through
service interface function block(SIFB).
IV. DIGITAL SUBSTATIONINTERLOCKING
SECURITY COMMUNICATION
As security standard of peer-to-peer communication
protocol, IEC 62351-6 recommend applying authentication to
ensure the safety of substation information exchange. The IEC
62351-6 standard[8] includes the security extension of peer-to-
peer communication protocol of IEC 61850. In this paper,
security GOOSE message of interlocking communication is
designed based on data and communication security standard
IEC 62351-6.
through two reserved bits and expansion PDU. Reserved1 has
two bytes, the first byte is used to record the length of the
ExtensionPDU. The second byte is reserved for future
expansion. This arrangement makes security message and
original message to be compatible in the communication
system of automation substation. Reserved2 introduces 16
bytes CRC(Cyclic Redundancy Check) to certificate
ExtensionPDU. This is the most critical of authentication and
is the core to ensure data security. Security GOOSE message
is responsible for the establishment of the interlocking IED
authentication. It can end interlocking data to each other after
authentication.
Figure 5. Ethernet frame structure of security GOOSE message
B. Security certification process of GOOSE expansion
message
The extension of SCL configuration is shown as paper[11].
Security authentication process that calculated based on MAC
(Message Authentication Code) is proposed and shown in
Figure 6.
1) XCBR get the APDU value of the message to be sent,
including GOOSEPDU and ExtensionPDU.
2) Calculating hash value to APDU with MD5 algorithm to
get 128-bits message digest MD1, then take the first four
bytes of MD1 to be MAC1. One-way hash function is
Calculating hash value to APDU with MD5 algorithm to
get 128-bits message digest MD1, then take the first four
bytes of MD1 to be MAC1. One-way hash function is
adding secret value SV before the hash operation and
removes it before transmission. The secret value is kept
by both side, and can be set and updated by the system
configurator.

A. Frame structure of designed security GOOSE message

From the analysis on section I, it is clear that the integrity
and availability of information of digital substation is the key
to obtain security and stable operation and interlocking
security of power system.
Figure 6. Security certification process of interlocking information
Figure 5 is one extension frame of data link layer frame of transmission
IEC 61850 GOOSE message, it is in line with the standard
IEC 62351-6. The security GOOSE message is achieved 3) Pad MAC1 to ExtensionPDU, namely
 AuthenticationValue, and send the security GOOSE
message via multicast.
4) CILO receive the GOOSE message, and get MAC1 and
APDU byte stream from ExtensionPDU.
5) Use the same approach as XCBR sender to do with
APDU and get message abstract MD2，then take the first
four bytes of MD2 for MAC2.
6) Compare MAC1 and MAC2, if they are the same, it
means get through XCBR security authentication, then get
XCBR status value(XCBR.Pos.stVal) from GOOSEPDU,
and go on with subsequent processing.
V. CONCLUSION
CILO composite function block based on IEC 61499 is
established in the paper. This is the exploration of applying
industrial control system standard IEC 61499 to digital
substation technology. And the achievement of security
GOOSE message assures the integrity and availability of
interlocking information, which ensures the safety of
interlocking communication.
Future development will be focused on adding security
communication processing into CILO composite function
block as a component, and using FBDK(Function Block
Development Kit) to modeling new function blocks for farther
simulation.
ACKNOWLEDGMENT
This work is supported by National Nature Science
Foundation of China (No. 61170191), Provincial Natural
Science Foundation of Hunan (No.09JJ8004).
REFERENCE
[1] IEC 61850‐5, Communication networks and systems in substation‐Part
5: Communication requirement for functions and device models[S].
Geneva: IEC, 2003.
[2] IEC 61850‐7‐1, Communication networks and systems in substation‐Part
7‐1: Basic communication structure for substation and feeder equipment-
principles and models[S].Geneva: IEC, 2003.
[3] Neil Higgins, Valeriy Vyatkin, Nirmal‐Kumar C Nair and Karlheinz
Schwarz. Distributed Power System Automation with IEC 61850, IEC
61499 and Intelligent Control, IEEE International Conference on
Systems, 2008.
[4] IEC 61499-1, Function blocks for industrial-process measurement and
control systems – Part 1: Architecture[S]. Geneva, IEC, 2005.
[5] IEC 61499-2, Function blocks for industrial-process measurement and
control systems – Part 2: Software tools requirements[S]. Geneva, IEC,
2005.
[6] IEC 61499-3, Function blocks for industrial-process measurement and
control systems – Part 3: Tutorial informsation[S]. Geneva, IEC, 2004.
[7] IEC 61499-4, Function blocks for industrial-process measurement and
control systems – Part 4: Rules for compliance profiles[S]. Geneva, IEC,
2005.
[8] IEC 62351-6 Power systems management and associated information
exchange: data and communications security: Part 6: Security for IEC
61850[S]. Germany, IEC, 2007.
[9] Duan Bin, Chen Guoqi, Lin Yuanyuan. On-Line Interlocking
Implementation Based on Process Bus Communication of Digital
Substation. Power System Technology, 2009, 33(19):37-43.
[10] Yang Lei, Xu Rongping. IEC 61499‐the New Phase of Industrial Control
Technology Development[J]. Computer Automated Measurement &
Control, 2002, 10(11):723‐ 724.
[11] Chen Guoqi. GOOSE Message and Its Application in Power System[D].
Xiangtan University (XTU), 2010.06.