A process bus moves the interface between primary switchgear and protection/control from many dedicated copper circuits to engineered digital measurements, statuses and commands. The benefit is not “fewer wires” alone. A successful MV design must allocate measurement, I/O, time, network, test isolation, redundancy, cybersecurity and maintenance functions with the same rigor previously applied to CT shorting links and trip circuits.
This article develops practical architectures for air-insulated, gas-insulated and sensor-equipped MV switchgear, explains merging-unit and IED roles, compares implementation choices and provides a complete failure-mode, FAT/SAT and lifecycle framework.
1. Functional definition
In an IEC 61850 process-bus architecture, information at the process level is digitized or represented by an intelligent process interface close to the primary equipment. Sampled Values (SV) carry current and voltage samples; GOOSE carries fast status, interlocking and commands; MMS is normally used for supervisory/client-server services. Time synchronization supports sample alignment and event chronology.
- Merging unit (MU): acquires analogue inputs or sensor signals, samples and publishes SV.
- Process interface unit (PIU)/breaker I/O: acquires contacts and executes outputs; may publish/subscribe GOOSE.
- Protection/control IED: subscribes to SV/GOOSE, runs algorithms and publishes trip/control/status.
- Time system: grandmaster and network clock functions provide required synchronization.
- Ethernet system: switches, PRP/HSR nodes, fibers/copper, VLANs and management.
- SCL/toolchain: defines IEDs, datasets, streams, subscriptions, communications and process associations.
2. Four practical MV architectures
| Architecture | Arrangement | Best fit / concern |
|---|---|---|
| Bay MU + conventional CT/VT | Short analogue runs from switchgear transformers to an MU; SV to relays | Retrofit/transition projects; preserve CT/VT safety and burden discipline |
| Integrated LPIT + MU | Rogowski/LPCT/LPVT outputs connect to integrated or nearby electronics | Wide dynamic range and compact design; interface/calibration/vendor dependence |
| Combined MU and breaker I/O | One process device publishes SV/status and receives trips | Low device count; larger common-mode failure and maintenance impact |
| Distributed dedicated interfaces | Separate measurement and trip/status devices, often with redundant paths | Higher independence; more devices, ports, power and engineering |
Architecture should follow protection dependability, maintainability and outage philosophy—not a generic digital-substation diagram. A simple feeder may accept a combined unit; a bus differential zone or critical incomer may need independent measurement, I/O, power and networks.
3. Measurement input design
- For conventional CTs, define ratio, class, knee-point/accuracy-limit behavior, secondary resistance, burden, earthing, shorting/test links and safe open-circuit prevention.
- For conventional VTs, define ratio, burden, secondary protection, ferroresonance/earthing and safe isolation.
- For LPCT/Rogowski, match rated output, integrator/function, cable/connector, loading, phase response, dynamic range and power-frequency/transient immunity.
- For LPVT, match divider technology, interface impedance, cable capacitance, grounding, bandwidth and insulation/EMC requirements.
- Record calibration factors, phase corrections and their ownership—sensor, MU, IED or engineering tool.
- Define whether one sensor channel feeds one or several MUs and analyze resulting loading/common mode.
- Trace polarity and phase from primary marking to SV dataset position.
4. Merging-unit specification
- Input technology, number of channels, rated quantities, overload/dynamic range and protection accuracy.
- Sampling/profile options, nominal frequency, ASDUs per frame and supported SCL model.
- End-to-end measurement latency, channel-to-channel skew, jitter and phase error.
- Time synchronization interfaces/profile, holdover and behavior on time degradation.
- SV stream count, dataset/channel order, quality model, ConfRev and diagnostics.
- PRP/HSR or dual-network capability, duplicate handling and supervision.
- Power-supply range, inrush, redundancy, monitoring and ride-through.
- IEC 61850-3 environmental/EMC qualification appropriate to installation location.
- Cybersecurity features, firmware signing, access roles, logs and secure configuration.
- Replacement/calibration procedure and guaranteed support life.
5. Breaker I/O and the trip path
Digital transmission cannot reduce the final breaker trip to software. The complete path remains: protection decision → GOOSE publisher → network → process I/O subscriber → output contact/electronic output → DC trip circuit → coil → mechanism → contact separation → arc interruption.
- Specify output making/breaking duty, pulse/latched behavior, pickup/release time and galvanic isolation.
- Retain trip-circuit supervision appropriate to open/closed breaker states and dual coils.
- Decide whether hardwired backup trip, independent second digital path or both are required.
- Define safe output state on device reboot, communication timeout, configuration mismatch and DC dip.
- Physically and functionally separate Trip Coil 1 and 2 where the protection philosophy claims redundancy.
- Ensure test mode cannot energize a live trip coil without explicit controlled authorization.
- Measure complete relay-to-current-interruption time; do not accept packet latency alone.
6. Status and interlocking inputs
- Map breaker 52a/52b, disconnector, earthing switch, spring charged, truck service/test position, gas/pressure and local/remote states.
- Use complementary contacts and discrepancy timing where available; do not synthesize every state from one contact.
- Specify wetting voltage/current, debounce, contact travel sequence and timestamp source.
- Define quality for chatter, impossible combinations and input-module failure.
- Interlocking should fail to a known state: normally reject unsafe control when position data is invalid.
- Retain local mechanical/electrical interlocks required by switchgear safety even when station logic is digital.
- Test slow/mechanically intermediate states, not only ideal binary changes.
7. SCL and signal ownership
The master SCD is the system configuration source of truth. It must associate MU/PIU logical nodes with the correct primary bay and define SV/GOOSE datasets, control blocks, addresses and subscriptions. Device vendor files alone cannot demonstrate the final scheme.
| Object | Typical owner | Independent check |
|---|---|---|
| Sensor/MU channel allocation | Primary + protection engineer | Wiring, polarity and dataset index |
| SV/GOOSE datasets | System/protection engineer | Function and cause-effect matrix |
| MAC/APPID/VLAN/priority | Network/system engineer | Address register and switch config |
| ExtRef subscriptions | System + IED engineer | Semantic SCL and end-to-end test |
| Time profile/domain | Time/network engineer | All MUs/subscribers and failure states |
| Released SCD/CIDs | Configuration authority | Hash, approval and loaded-device match |
8. Network design
- Calculate bandwidth from actual SV frame rates/sizes, GOOSE bursts, PTP, MMS, management and redundancy overhead.
- Evaluate every egress queue and HSR ring segment, not only aggregate backbone utilization.
- Separate traffic through engineered VLANs and QoS while avoiding hidden dependencies on one trunk or switch.
- Use multicast filtering supported and tested for SV/GOOSE; confirm behavior after reboot and firmware update.
- Choose PRP/HSR/RSTP or independent radial paths according to required recovery and failure tolerance.
- Route redundant fibers, DC supplies and network devices separately.
- Provide out-of-band or controlled network management, logs and time-stamped alarms.
- Specify spare capacity, port count and future bays without exceeding deterministic performance.
9. Time architecture
- Derive maximum time error from differential/synchronism/measurement functions, not a generic clock specification.
- Define grandmaster sources, redundancy, PTP profile/domain, boundary or transparent clock roles and GNSS-loss strategy.
- Specify MU holdover and sample-quality indication.
- Supervise identity, offset, path delay and clock-quality changes.
- Analyze a common time error affecting all MUs versus differential error between MUs.
- Test time step, drift, grandmaster changeover, link asymmetry and recovery.
- Use event chronology requirements separately from real-time sample-alignment requirements.
10. Protection and network redundancy
“Redundant network” is only one layer. For each protected element, draw a dependency diagram including sensor, input, MU, time, network A/B, subscriber, output, trip DC and breaker coil. Mark shared components. Then confirm that the stated N-1 or fail-safe objective is actually met.
- One sensor + one MU + PRP protects only against a single LAN failure, not measurement failure.
- Two relays subscribing to one MU share the same sampled-data source.
- Two MUs powered from one MCB or connected through one terminal adapter are not independent.
- Two time masters sharing one GNSS antenna or switch can fail together.
- Dual trips into one output module or one trip coil share a final common path.
- Common SCD/template errors can defeat otherwise independent hardware.
11. Failure-mode design
| Failure | Possible consequence | Required mitigation/test |
|---|---|---|
| Sensor/analogue channel | Wrong or missing current/voltage | Quality/plausibility, independent backup, injection test |
| MU hardware/firmware | All bay samples lost/corrupted | Diagnostics, redundancy philosophy, fail-safe function response |
| Wrong channel/SCL | Correct packets from wrong primary source | Primary injection and semantic independent review |
| Time loss/error | Phase error or differential operation | Holdover, quality, block/fallback and time-failure test |
| Network overload/filter | Loss/jitter of SV or GOOSE | Capacity/QoS, monitoring and loaded-network FAT |
| Process I/O output | Failure to trip or unwanted output | Output supervision, redundant trip path and physical test |
| DC supply/common MCB | Multiple digital components fail | Independent feeds, selectivity and ride-through |
| Cyber/configuration change | Hidden communication/function change | Access control, signed releases and regression test |
12. Test and maintenance isolation
Digital isolation must be as visible and controlled as physical test blocks. The scheme should support test/simulation quality, subscription blocking where implemented, output isolation, test connectors/ports and unmistakable HMI indication. A technician must be able to test one bay without injecting a simulated stream into a live bus zone or leaving a trip disabled.
- Define an approved test-state matrix for publisher, subscriber and physical outputs.
- Use lockout/tagout and physical trip isolation where personnel/plant risk demands it.
- Separate live and simulated/test traffic and verify subscriber acceptance rules.
- Alarm every test/block condition and include it in shift handover.
- Provide a restoration checklist with independent confirmation.
- Record who changed mode, when, why and the released configuration.
13. Cybersecurity and maintainability
- Use least-privilege accounts, protected engineering ports and audited tool access.
- Disable unused services/ports and control removable media/test laptops.
- Monitor unauthorized multicast publishers, duplicate addresses and traffic storms.
- Coordinate IEC 62351 measures and switch security with GOOSE/SV latency and interoperability.
- Require supported firmware, vulnerability notification, configuration backup and rollback.
- Keep spare MU/PIU hardware and exact loadable files; prove replacement before commissioning.
- Ensure maintainers can diagnose with SCL, packet captures and device events without vendor-only knowledge.
14. Factory acceptance testing
- Freeze the architecture, dependency matrix, SCD, settings, firmware and switch/time configurations.
- Validate XML/schema and application semantics for every SV/GOOSE path.
- Inject all analogue channels; verify scaling, polarity, phase order, neutral/residual and dynamic range.
- Measure protection operating and complete trip-output time.
- Operate every status/input/output and test contact discrepancy/interlocks.
- Inject invalid/test/questionable quality, lost streams, stale GOOSE and ConfRev mismatch.
- Fail each power supply, MU/PIU, network link, switch, redundancy node and time source as specified.
- Apply worst credible network load/event burst and repeat timing tests.
- Test cyber controls, reboot/update recovery and rollback.
- Archive calibrated results, captures, relay events and approved punch-list closure.
15. Site acceptance and energization
- Inspect sensor/MU/PIU installation, earthing, DC and independent fiber routes.
- Verify device identity/firmware and hashes of loaded files.
- Primary-inject each bay and prove no cross-bay mapping.
- Operate actual breaker/disconnector mechanisms and complete trip circuits.
- Test LAN A/B, time-source loss and installed alarm paths.
- Check HMI/process topology associations against physical labels.
- Clear all simulation/test/block conditions with independent sign-off.
- Capture a healthy baseline for measurements, timing and network diagnostics.
- Reconcile site changes into the master SCD and final as-built package.
16. When process bus is the right choice
Process bus is strongest where integrated sensors, modular switchgear, high copper reduction, flexible multi-IED sharing, improved test access or standardized digital interfaces create lifecycle value. Conventional wiring can remain preferable for small/simple installations without trained support, stable tool governance or adequate redundancy/cyber maintenance. A hybrid architecture is legitimate when its boundaries and test methods are explicit.
References and further reading
- IEC 61850-9-2 consolidated edition — Sampled values
- IEC 61850-8-1 consolidated edition — MMS and GOOSE mapping
- IEC 61850-3:2013 — General requirements
- IEC 61850-6 consolidated edition — SCL
- IEC 62439-3:2021 — PRP and HSR redundancy
- IEC TS 60255-216-1:2025 — Functional/interoperability tests for SV and GOOSE protection
- IEC 62351-6:2020 — Security for IEC 61850 protocols
Engineering note: A process bus changes the location and observability of failure; it does not remove it. Acceptance should be based on a proven protection-and-control function from primary sensor to breaker, with defined behavior for every dependency failure.