Protection of Dual-Incomer MV Switchgear with a Bus Coupler: Selectivity, Interlocking and ATS Logic

A dual-incomer MV board is safe only when protection and automatic transfer agree on one fact: a dead bus caused by loss of source may be re-energised, but a dead bus caused by an internal fault must remain locked out. Voltage alone cannot make that distinction. The scheme needs source-side measurements, protection/BF/arc lockouts, breaker status/current proof, capacity and motor-residual checks.

This guide develops protection, interlocking and ATS logic for two incomers and one bus coupler. It covers split and paralleled operation, fault trip matrices, directional/overcurrent coordination, state-machine design, open/closed transition, synchronism, failed transfer, commissioning and change control.

Executive rules

Define every legal breaker state and electrical topology before writing Boolean interlocks.
Use source-side and bus-side voltage/status/current to distinguish source loss, incomer failure, VT failure and bus fault.
Block ATS on bus differential, arc, feeder/incomer BF, transformer/source lockout, VT invalid, grounding/test state or protection test.
For open-transition transfer, prove the failed incomer open and current absent before closing the coupler/alternate source.
For closed transition, prove synchronism and that sources, transformer/vector group, grounding, fault duty and utility rules permit paralleling.
Recalculate protection and switchgear duty for coupler-open, coupler-closed, single-source and momentary-parallel states.
Check alternate-source capacity, voltage dip, motor reacceleration and load shedding before transfer.
Use a deterministic state machine with one start, one owner, explicit timeouts and failed-transfer lockout.
Test faults during every sequence step; automation must fail to a safe, diagnosable state.

1. Typical three-breaker arrangement

Source/transformer A feeds bus section A through incomer I-A; source B feeds section B through I-B; bus coupler BC connects the sections. Normal operation is often I-A closed, I-B closed, BC open. After loss of A, ATS opens I-A and closes BC so B supplies both sections. Other plants operate one source for both sections with the alternate incomer open; the state machine and protection groups differ.

I-A	I-B	BC	State	Permitted only if
Closed	Closed	Open	Normal split	Each source supplies its section
Open	Closed	Closed	B supplies A+B	B capacity/fault duty/grounding approved
Closed	Open	Closed	A supplies A+B	A capacity/fault duty/grounding approved
Closed	Closed	Closed	Parallel sources	Explicitly engineered, synchronised and time-limited/continuous as approved
Open	Open	Closed	Both sections dead/tied	Maintenance/restoration logic understands the combined dead bus
Closed	Closed	Invalid/unknown	Topology unknown	Automation blocked; protection uses conservative group/response

2. Required studies

load flow for each source/section, emergency transfer and future growth;
motor starting/reacceleration and residual-voltage decay;
short circuit including parallel transformers/sources, motor/DER contribution and switchgear making/interrupting/withstand;
zero-sequence/grounding paths with one/two sources and coupler states;
protection coordination and bus differential zones for every topology/settings group;
arc-flash/incident-energy and internal-arc protection timing by state;
transformer paralleling: ratio, vector group, tap, impedance, phase sequence and circulating current;
voltage/frequency/synchronism and source stability for closed transition;
DC battery/charger, trip/close coil voltage drop and communication availability;
reliability/FMEA, load criticality, permissible interruption and failed-transfer consequence.

3. Measurement architecture

Measurement/status	Purpose	Critical failure
Source-side VT A/B	Prove source available/unavailable independent of incomer	VT fuse failure mistaken for source loss
Bus VT A/B	Dead/live bus, residual voltage, synchronism	Bus fault or VT isolation mistaken for dead safe bus
Incomer/coupler CTs	Protection, load/capacity, current-zero/open proof, BF	CT saturation/low-current blind spot
52a/52b and rack position	Breaker mechanical state and sequence permissive	Contacts move before current interruption or become invalid in test position
Protection lockouts/starts	Differentiate fault trip from source-loss transfer	Lost/stale signal permits re-energisation of faulted bus
Transformer/source availability	Temperature/gas/mechanical/utility permissive	Electrical voltage present but source unsafe

Use VT-fuse-failure/loss-of-potential logic and independent phase quantities. A single undervoltage bit is not a sufficient ATS initiator. For digital I/O, data quality/staleness and IED/network loss must block or degrade safely.

4. Protection zones and trip matrix

Fault zone	Primary action	ATS response
Outgoing feeder A	Trip feeder; BF escalates I-A/BC if failed	No source transfer for a normally cleared feeder fault
Bus A internal	Trip I-A, BC and all sources/backfeeds into A; lockout	Blocked—never close BC/I-A onto A
Incomer A transformer/source side	Trip/isolate source boundary, possibly upstream transfer trip	Transfer only if bus A proven healthy and failed source isolated
I-A breaker/end zone	Bus/end-zone/BF logic trips required local/upstream sources	Blocked until precise faulted section isolated
BC compartment/CT overlap	Trip I-A, I-B and BC as zone study requires	Blocked on both sections
Transformer A internal/REF	Trip/lockout I-A and HV breaker	May transfer healthy bus A only if design permits and lockout logic distinguishes transformer from bus

The exact matrix follows physical CT positions. A transformer differential trip does not automatically prove the MV bus is faulted, but it does prove source A must remain isolated. Conversely, bus 87B/arc trip must block transfer even if source B is perfect.

5. Protection coordination in split operation

Each incomer 51/51N backs up its section’s feeders; BC is normally open.
Bus differential/arc protection trips that section’s incomer and BC/open sources as required.
Feeder high-set/current grading uses the fault level from its own source.
Incomer directional functions may be unnecessary in a simple radial state but can be enabled/required in parallel/transfer states.
Transformer differential/REF and upstream protection coordinate with MV incomer and NGR duty.
BF of one outgoing feeder trips its section incomer and BC if BC can feed; source B need not trip when BC is securely open.

6. Protection after coupler closes

One source supplies both sections: minimum remote fault may fall, and upstream backup has another coordination step.
Feeder fault from the healthy source flows through BC; BC/incomer elements must not trip before the faulted feeder.
BC current/thermal rating and switchgear bus duty must cover total transferred load and motor restart.
Bus differential zone assignment/check zone must follow BC state; CT locations determine whether two zones merge or remain separate with BC overlap.
BF matrix changes: a failed feeder on transferred section must trip BC and healthy incomer.
Earth-fault current can change if grounding source/neutral arrangement changes; ensure one controlled grounding source or approved parallel path.
Activate a validated settings group or adaptive logic only after topology confirmation; invalid status uses conservative backup.

7. Momentary or continuous parallel operation

With I-A, I-B and BC closed, source impedances are in parallel and fault current may exceed switchgear/CT/breaker ratings. Transformers share load according to voltage ratio/tap/impedance and can develop circulating current. Grounding paths also parallel. Parallel operation therefore requires an affirmative engineering permission, not merely a synchronism relay.

Verify source phase sequence, nominal voltage, frequency, transformer vector group/phase displacement and tap compatibility.
Calculate maximum making/interrupting/short-time/peak duty and CT saturation.
Use 67/67N/differential protection and revised grading for bidirectional contributions.
Obtain utility/generator anti-islanding and parallel-operation approval.
Limit closed-transition overlap with a timer and independent “both incomers + coupler closed” alarm/trip.
Synchronism check (25) must supervise magnitude, angle and slip. Predict angle at main-contact touch using measured breaker closing time where the device supports compensation.
Define failure when the opening breaker does not open—BF/escalation must prevent sustained unintended parallel.

8. ATS state machine for source A loss

IDLE: I-A/I-B closed, BC open; all status/measurements healthy.
START QUALIFICATION: source A undervoltage/underfrequency persists for approved delay, bus A affected, source B/bus B healthy; no VT-failure or protection lockout.
TRIP I-A: issue trip; start timeout/BF monitoring.
PROVE ISOLATED: I-A 52a open/52b closed as applicable, current below threshold and rack/interlock valid. Do not equate auxiliary contact alone with de-energisation.
DEAD/RESIDUAL BUS CHECK: bus A voltage below dead-bus threshold for required time; or synchronism logic for live transfer. Account for motors/generators and trapped voltage.
CAPACITY/SHED: verify B/transformer/BC capacity; shed noncritical load before or immediately after transfer.
CLOSE BC: close with interlocks; start close timeout.
VERIFY TRANSFER: BC closed, bus A voltage/frequency restored, no excessive current/voltage dip/protection start; record success.
LOCKED TRANSFERRED: prevent automatic return unless a separate approved retransfer sequence exists.
FAIL: on any timeout/invalid/protection operation, stop commands, block close, alarm precise cause and require controlled recovery.

9. Start criteria: loss of source versus bus fault

Evidence	Likely condition	ATS action
Source-A VT low + Bus-A low; no fault trip; B healthy	Source loss candidate	Qualify transfer after delay
Source-A VT healthy + Bus-A low + I-A open/tripped	Incomer/control/bus issue	Investigate trip cause; transfer only with healthy-bus proof
Bus 87B/arc/lockout asserted	Internal bus fault	Block/latch ATS
Only one VT phase low/fuse-failure asserted	VT circuit failure	Block auto transfer; alarm
Bus-A residual voltage decays slowly after I-A trip	Motor backfeed/trapped energy	Wait dead bus or use synchronised transfer method
B source voltage healthy but overloaded/transformer alarm	Alternate unavailable	Block or shed load per study

10. Interlocking philosophy

Electrical: normally prevent all three breakers closed unless closed-transition mode and 25 permissive are active.
Mechanical/key: can enforce simple states but may conflict with remote/automatic restoration; document key exchange and maintenance.
Protection lockout: bus/arc/BF/end-zone lockout has highest priority over ATS/close.
Grounding/earthing switch: no close into an earthed section; use direct mechanical/electrical proof, not SCADA alone.
Rack/service: automatic commands only with breaker available in service and secondary plug/closing circuit healthy.
Local/remote/test selector: define command ownership; local maintenance selection blocks remote ATS with alarm.
Hardwired/GOOSE: safety-critical interlocks require deterministic response, supervision and defined loss-of-signal state.

11. Motor residual voltage and reacceleration

MV motors can maintain a decaying bus voltage and frequency after source isolation. Closing an unsynchronised alternate source can produce severe transient torque/current. Select one approved strategy:

Fast transfer: predict phase angle/slip and close before unacceptable separation, requiring precise breaker close time and synchronism logic.
In-phase transfer: wait/predict the next acceptable phase-angle window.
Residual/dead-bus transfer: wait until voltage is below a conservative threshold, then close; longer interruption and reacceleration current.
Sequential restart/load shedding: trip selected motors and restart in stages to protect source voltage/thermal capacity.

The ATS delay is therefore not simply “minimum 0.5 s.” Use motor inertia/load, contactor dropout, residual-voltage model, breaker timing and process constraints.

12. Return/retransfer

Require source A stable for a longer return delay and all lockouts cleared.
Use manual return by default where an unexplained source trip requires investigation.
Choose open or closed transition with the same paralleling/synchronism constraints.
Manage load shedding/restoration and motor restart again; do not assume return is benign.
Prevent oscillating transfers between unstable sources with lockout, attempt counter and minimum dwell.
Record operator authority and exact breaker sequence; failed return leaves the safest supported topology.

13. IEC 61850/PLC/relay implementation

Keep primary protection/BF independent of a general-purpose ATS PLC where consequence warrants.
Assign one state-machine owner; avoid two relays/PLCs issuing competing close commands.
Use explicit state, transition, timeout, lockout and first-out points—not a web of unlabeled latches.
For GOOSE, specify dataset, publisher/subscribers, quality, time allowed, network redundancy and loss response.
Use SCL/configuration version control and regression testing after any IED/PLC/network change.
Absolute time is vital for SOE; protection/control permissives must handle loss of time safely.
Cyber controls must prevent unauthorised mode, bypass or settings-group changes without delaying protection.

14. FAT/SAT scenario matrix

Prove every legal/illegal I-A/I-B/BC/rack/earthing-switch state and interlock.
Simulate source A/B undervoltage, underfrequency, phase loss and recovery at all timer boundaries.
Simulate VT fuse failure/invalid quality; prove no unsafe transfer.
Inject feeder, bus, transformer, incomer/end-zone and coupler faults before/during every ATS step.
Fail I-A to open, BC to close, auxiliary contacts, current detector, trip/close circuit and DC; verify timeouts/BF/lockout.
Test B overload/capacity rejection, load-shed sequence, motor residual voltage and reacceleration.
Test open-transition current-zero/dead-bus criteria and closed-transition 25 angle/slip/voltage plus overlap timeout.
Test coupler-open/closed protection groups, 67 direction, 87B zone replica, ZSI/blocking and BF trip matrix.
Fail GOOSE/network/PLC/relay/redundancy/time and restart devices mid-sequence.
Test restoration/retransfer, unstable source, repeated attempts and manual takeover.
Measure breaker opening/closing and complete transfer interruption; compare with motor/process/study limits.
Archive state traces, SOE/COMTRADE, settings/checksums, SCL/PLC logic, trip matrix and signed scenario results.

15. Commissioning/live checks

verify CT/VT ratio, polarity, phase sequence and source/bus channel mapping;
measure actual breaker open/close time at permitted DC and program synchronism compensation accordingly;
record normal split load flow, power direction, grounding current and bus voltage;
perform controlled source-loss transfer with staged load where permitted;
confirm alternate transformer/source capacity and voltage response;
prove close/ATS blocked by bus lockout, earthing switch, invalid VT and breaker not-service;
verify SCADA mode/state, first-out and alarm text; operators must understand why a sequence stopped.

16. Frequent mistakes

Mistake	Consequence	Correction
Undervoltage alone starts ATS	Transfer onto bus fault/VT failure	Source/bus/protection/quality qualification
52a open proves isolation	Current/backfeed may persist	Contact + current/zone proof
Three breakers interlocked only in PLC	Common logic/power failure permits parallel	Layered deterministic interlock
Coupler state not in settings	Protection miscoordinates	All-topology study/groups
Alternate capacity assumed	Voltage collapse/overload	Load flow, motor and shedding study
No motor residual check	Out-of-phase close/torque damage	Fast/in-phase/dead-bus strategy
Bus trip allows transfer	Faulted bus re-energised	Latched highest-priority block

References and further reading

Engineering note: No generic ATS sequence is safe for every double-ended substation. The approved operating philosophy and studies must define legal states, transfer method, motor/load response, lockouts and failure recovery.