What this grid protection & interlock panel solves

This page explains why a dedicated grid protection and interlock panel is needed between renewable inverters and the grid, instead of relying only on inverter firmware or a high-level microgrid EMS. The focus is on how the panel consolidates grid-code functions, hardwired interlocks and event logging into a single, auditable hardware layer.

In real projects, multiple trip sources exist at the same time: inverter internal protection, anti-islanding detection, upstream feeder and transformer protection, local emergency stops and remote SCADA commands. Without a dedicated panel, these signals are often wired point-to-point, resulting in inconsistent interlock chains, unclear responsibilities and unsafe reverse-feed conditions during maintenance.

• Only inverter internal protection is used, so grid-code UV/OV/UF/OF thresholds and ride-through behaviour are hidden in vendor firmware and difficult to audit or harmonise across suppliers.
• Trip sources such as anti-islanding, upstream relays and fire/emergency stops do not share a single, well-defined hardware chain, making it hard to prove which condition caused which trip.
• Event logging is fragmented: the inverter may record receipt of a trip signal, but does not label the originating device or grid condition, so acceptance testing and later investigations are time-consuming and inconclusive.

The grid protection and interlock panel addresses these gaps by centralising grid-code functions (UV/OV/UF/OF and phase sequence), collecting trip and block inputs from upstream protection devices, local hardwired interlocks and anti-islanding modules, and combining them into a deterministic hardware chain that drives breakers and inverter enable lines. Every trip reason and origin can be time-stamped and logged for SCADA and compliance.

Typical deployment scenarios include:

• Commercial rooftop PV, where a compact panel combines basic grid protection, inverter interlocks and local emergency stops without overburdening the EMS.
• Utility-scale solar, wind or hybrid plants, where the panel sits at the LV point of connection and coordinates trips from multiple inverters and upstream MV protection relays.
• Offshore wind platforms or remote sites, where the panel enforces hardwired rules for local safety chains and remote commands, and provides reliable trip and reset logging for investigation.

Scope, interfaces and partitioning of the panel

The grid protection and interlock panel sits between renewable inverters or converters and the grid point of connection. It receives grid measurements and trip or block commands from upstream protection, enforces local interlocks and forwards enable or trip signals to inverters and breaker coils. This section clarifies the functional boundary so that the panel does not duplicate inverter control, microgrid EMS logic or dedicated anti-islanding and driver-board functions.

Physically, the panel is usually mounted in the LV switchboard or dedicated point-of-connection cubicle, alongside feeders and main breakers. Logically, it forms a clear interface layer: upstream, it speaks to grid measurement transformers, protection relays and SCADA or EMS; downstream, it drives breakers, contactors and inverter control inputs. This partitioning allows grid-code duties and interlocks to be audited and upgraded independently from inverter firmware or EMS software releases.

Downstream interfaces to inverters and switching devices

• Inverter and converter control inputs: hardwired enable or run commands, trip or fault reset lines and status feedback (ready, fault, derate). The panel adapts levels and isolation so that signals are compatible with vendor-specific digital inputs and safe torque off interfaces where present.
• Breaker, contactor and interlock coil drivers: outputs that energise closing, opening and blocking coils, including anti-backfeed interlocks and auxiliary contacts for position feedback. These outputs implement the combined interlock chain rather than raw SCADA commands.
• Local human–machine interfaces: emergency stop buttons, reset or acknowledge push-buttons and mode selectors for local/remote and test/run modes, plus indication lamps that summarise trip causes at the panel.

Upstream interfaces to grid measurement, protection and SCADA

• Grid measurement inputs: VT and CT secondaries or directly sampled phase voltages provide the panel with the information needed to apply UV/OV/UF/OF thresholds, ride-through behaviour and phase-sequence checks in accordance with the applicable grid code.
• Upstream protection trip and block signals: contacts or optically isolated inputs from feeder, transformer and bus protection relays, which command the panel to disconnect inverters and block reconnection when upstream faults are present.
• SCADA and EMS commands: remote start, stop, open, close, mode selection and, where permitted, parameter changes. The panel turns these high-level commands into safe hardware actions subject to local interlock rules and grid conditions.

Partitioning with anti-islanding, driver boards and EMS

The panel does not implement anti-islanding algorithms or injection waveforms; those functions belong to a dedicated anti-islanding detection AFE, which exposes a trip or status output that the panel treats as one input to the interlock chain. It also does not duplicate inverter power driver board functions such as IGBT or MOSFET gate driving, DC-link monitoring or current sampling. Instead, the panel exchanges only enable, trip and status signals with each inverter or converter.

Similarly, microgrid EMS logic is responsible for deciding when the renewable plant should export, curtail or disconnect based on system-level optimisation. The grid protection and interlock panel accepts the EMS permissive or block commands but enforces them through hardwired interlocks and measured grid conditions. This separation ensures that even if an EMS application is updated or replaced, the underlying protection and interlock behaviour remains deterministic and evidential.

Grid code functions: UV/OV/UF/OF and phase sequence

Grid protection and interlock panels implement the practical side of grid code requirements for voltage, frequency and phase sequence. Grid codes define ranges where generation is allowed to stay connected, ranges where limited ride-through is required and ranges where inverters must disconnect within specified times. These rules can be mapped directly into measurement, threshold and timing chains inside the panel.

Typical functions include:

• Under and over voltage protection with multiple trip bands and voltage ride-through regions.
• Under and over frequency protection, potentially complemented by rate-of-change-of-frequency (ROCOF) detection.
• Phase sequence, phase loss and voltage unbalance detection to avoid damaging operating conditions.
• De-energisation and re-energisation logic, including post-fault restart delays, pre-closing checks and controlled re-closure attempts.

Each function can be described as a chain from measured quantities to trip outputs. For example, phase-to-neutral or phase-to-phase voltages are acquired by AFEs, converted into RMS or peak values, and compared against a set of thresholds by window comparators or an MCU. Frequency is obtained from zero-crossing intervals or metering SoC outputs, then checked against under and over frequency bands and ROCOF limits. Phase sequence and missing phases are detected by dedicated relays or AFE plus MCU logic that evaluates phase angle relations, rather than simply checking for voltage presence.

Simple projects may use purely analogue comparators and RC timing to implement fixed UV/OV/UF/OF thresholds and delay times. This approach offers fast response and predictable failure modes but is hard to adapt to multiple grid codes or changing requirements. Larger plants and multi-country portfolios often require MCU or FPGA participation, so that multiple grid code profiles, detailed ride-through curves and event logging can be configured and maintained over the plant life cycle. In practice, panels often combine fast analogue comparators for extreme conditions with MCU-based timing and sequencing for full compliance and traceability.

AFEs and comparators for voltage, frequency and phase sequence

Reliable grid-code supervision depends on robust analogue front ends and comparators that can see phase voltages, frequency and phase relations under harsh conditions. This section focuses on the AFEs and comparator chains used to feed UV/OV/UF/OF and phase-sequence logic in the panel. The goal is to measure enough for protection and interlock decisions, without drifting into billing-grade metering or energy accounting, which are handled by dedicated metering and REC nodes.

Voltage measurement chain: dividers, isolation and filtering

Phase voltage information can reach the panel through VT secondaries, direct sampling of LV busbars or integrated metering SoCs. VT-based schemes use a conventional instrument transformer to provide a scaled, galvanically isolated secondary voltage, followed by resistive dividers and filtering before the AFE. Direct sampling schemes apply a high-voltage divider network and surge-limited interface to an isolation amplifier or sigma-delta modulator, which transports the signal across the isolation barrier to a low-voltage domain.

In all cases, front-end design must consider surge immunity, overvoltage withstand, creepage and long-term stability. High-value, series-connected resistors share the voltage stress and reduce burden on VT secondaries. RC filters and surge arresters such as MOVs or TVS diodes tame fast transients without excessively distorting 50 or 60 Hz waveforms. Protection functions need accurate fundamental voltage estimation, but do not require harmonic detail on the level of a power quality analyser, so AFE bandwidth can be selected accordingly.

Once the waveform is within the AFE range, panels either use dedicated RMS-to-DC converters, ADCs with MCU-side RMS and peak calculation, or comparator-only schemes for extreme threshold detection. RMS ICs simplify implementation at the cost of some flexibility. MCU plus ADC allows different sampling windows and algorithms to be tailored to each grid code. Comparator-only paths are often reserved for very fast OV or UV trips, while slower and more configurable logic relies on sampled data.

Frequency detection and zero-crossing comparators

Frequency can be derived either from analogue zero-crossing detection or from metering SoC outputs. In a zero-crossing scheme, phase voltages pass through AFEs and then into comparators that generate clean digital edges whenever the waveform crosses a reference level. Timer capture units in the MCU measure the interval between crossings and derive frequency and ROCOF. Comparators in this path need low propagation delay and carefully chosen hysteresis, so that noise is rejected without introducing excessive phase error.

When integrated metering SoCs are used, their internal multi-phase AFEs and DSP engines calculate voltage, current, frequency and phase angle. The panel then treats the SoC as a measurement source, reading frequency and phase data via a serial interface and using those values for UF/OF and ROCOF logic. The SoC does not need to be revenue-grade in this role; protection and interlock decisions dominate the specification.

Phase sequence, phase loss and voltage unbalance AFEs

Phase sequence and phase loss detection can be implemented either with dedicated phase-sequence relays or with AFE plus MCU logic. Traditional relays provide a simple contact that closes only when phase order is correct and all phases are present. The panel reads this contact as a single “sequence OK” input. AFE plus MCU approaches use three-phase voltage measurements to calculate phase angles and sequence components, allowing separate flags for reversed phase order, missing phases and marginal imbalance.

This richer view is useful when dealing with tricky cases, such as a phase that is effectively open but still shows residual voltage through coupling or wiring errors. Simple “voltage present” checks may fail in these conditions, whereas an AFE plus MCU can evaluate phase-angle consistency and negative-sequence magnitude. Voltage unbalance supervision can be derived from negative-sequence components or from the spread between phase RMS values, with thresholds set for alarm, derating and trip as required by the application.

IC role mapping for protection-oriented measurement chains

Protection-oriented AFEs and comparators follow a consistent set of IC roles. Low-drift amplifiers, isolation amplifiers and sigma-delta modulators handle voltage scaling and galvanic isolation. High-speed comparators with defined hysteresis perform zero-crossing detection and fast threshold checks. Window comparators and programmable references map multi-band UV/OV limits into hardware, and metering SoCs or MCU-plus-ADC combinations provide RMS, frequency and phase-angle values for more complex grid code logic. These devices are selected for robustness, isolation and timing behaviour, while high-precision billing, REC accounting and long-term energy reporting are assigned to separate metering and green energy meter nodes in the system.

Relay and SSR drivers, interlock chains and fail-safe design

The grid protection and interlock panel turns a set of safety and grid-code conditions into controlled energisation of breaker and contactor coils. Instead of allowing any single controller to close a breaker directly, the panel builds a hardwired interlock chain where grid quality, upstream protection, local emergency stops, inverter readiness and anti-islanding status must all be healthy before close commands reach relay or SSR drivers. This section focuses on how those conditions are enforced in hardware, how coils are driven and how fail-safe behaviour is maintained when faults or software issues occur.

From conditions to a hardwired interlock chain

A typical interlock path for a point-of-connection breaker or contactor is formed by a series of conditions that all must be true: grid voltages and frequency within acceptable bands, upstream protection relays not issuing block signals, local emergency stops and access interlocks in the normal position, inverters in ready state and anti-islanding detection indicating a valid grid. Each condition is represented by at least one contact, SSR output or driver channel, and these are combined so that any single fault or unsafe condition interrupts the coil supply path.

• Grid healthy status from UV/OV/UF/OF and phase checks enables the interlock chain only when the measured grid matches configured limits.
• Upstream feeder, transformer and bus protection relays supply trip or block contacts that disable coil energisation whenever higher-level protection has operated.
• Local emergency stop buttons, access doors, keys and selector switches form one or more normally closed channels that directly break the interlock path when actuated.
• Inverter ready and anti-islanding OK signals contribute permissive inputs; loss of readiness or an anti-islanding trip forces the panel to open contactors and prevent re-close.

Hardware interlocks versus purely software-based logic

Software in an MCU or PLC can evaluate complex combinations of conditions, implement timers and produce close or trip commands. However, relying solely on software to control coil drivers creates a single point of failure. A robust grid protection panel uses hardware interlocks in the coil supply path so that even if firmware malfunctions, an open emergency stop channel, an upstream block contact or a dedicated safety relay still prevents energisation.

In practice, close requests from MCUs often pass through safety relays or dual-channel interlock circuits that supervise emergency stop loops and contact states. The MCU can request a close, but the last decision to feed a breaker or contactor coil is enforced by hardware that monitors its own channels independently. This combination allows flexible software logic while preserving a deterministic fail-safe path when safety channels are open or diagnoses indicate faults.

Relay, contactor and SSR driver requirements

Coil drivers must supply the inrush and holding current required by breaker and contactor coils, while safely handling inductive energy and line transients. High-side or low-side drivers implement switching of DC or rectified AC coils, with appropriate freewheel diodes, snubber networks or surge arresters to control voltage overshoot and dv/dt. For magnetically latched breakers, drivers must deliver well-defined pulses in both directions, with current and duration tailored to the mechanism.

Integrated protected high-side switches, dedicated relay or valve drivers and discrete MOSFET stages all appear in grid protection panels. These devices often integrate current limiting, thermal shutdown and fault signalling. Selecting drivers with sufficient voltage rating, avalanche capability and EMC robustness is essential because they operate close to the interface between logic and power hardware, and must survive repetitive switching under real fault and inrush conditions.

Diagnostics, auxiliary contacts and fail-safe behaviour

Coil driver channels benefit from built-in diagnostics that detect open circuits, short circuits and over-current conditions. By monitoring driver status bits or sense currents, the panel controller can distinguish between an interlock that permissively blocks a close request and a hardware failure that prevents a coil from responding. This information feeds event logs and maintenance workflows instead of appearing as an unexplained “no close” condition.

Auxiliary contacts on breakers and contactors provide mechanical feedback on the actual position of main contacts. The panel compares auxiliary contact states with issued open or close commands to detect failed closing, failed opening or contact welding. If a mismatch persists beyond a configured window, the panel records a mechanical fault, blocks further automatic attempts and may drop upstream interlocks to force manual intervention before re-energisation.

For higher safety levels, dual-channel emergency stop loops, safety relays or safety controllers are used so that both channels must agree before coil drivers are enabled. Window watchdogs supervise the MCU that coordinates these decisions; on watchdog faults, an independent path triggers removal of coil power. This page focuses on electrical interlocks at the AC point of connection. Mechanical safety chains inside a wind turbine, such as pitch, yaw and local E-stop loops, are covered by the dedicated pitch and yaw safety chain topic.

Coordination with upstream protection and inverter controls

The grid protection and interlock panel operates within a larger protection hierarchy that includes feeder, transformer and bus protection, as well as inverter-level protection. Its role is to enforce grid-code behaviour at the point of connection, cut inverters out of the grid when conditions are unsafe and relay trip origins to SCADA and microgrid controllers. Effective coordination ensures that upstream protection remains the primary defence for network faults, while the panel manages local grid criteria and safe disconnection of inverters.

Coordination with upstream feeder, transformer and bus protection

Upstream relays and breaker protection are responsible for clearing faults on feeders, transformers and higher-voltage buses. Their trip and block contacts are wired into the interlock panel so that whenever upstream protection operates, the panel rapidly disables inverter enable lines and opens the local point-of-connection breaker or contactor. This prevents backfeed into faulted sections and avoids uncontrolled reconnection while the upstream system is still in a disturbed state.

In less severe situations, the panel may detect local voltage, frequency or phase anomalies at the LV point of connection before upstream protection thresholds are reached. In these cases the panel acts as a grid-code guardian: it trips inverters and opens the POC breaker based on UV/OV/UF/OF or phase criteria, while upstream protection remains armed as backup. The panel does not attempt to replace distance or differential schemes on higher-voltage equipment, but provides a fast and transparent disconnect layer on the plant side.

Coordination with inverter internal protection and control

Inverters implement their own protections for semiconductor devices, DC-link capacitors, thermal margins and converter-specific events. When inverters detect internal faults, they usually perform a controlled ramp-down or soft stop and expose a fault or trip contact that is received by the grid protection panel. The panel then withdraws enable signals, opens the point-of-connection breaker if needed and records that the trip origin was inverter-internal rather than a grid violation.

When the panel itself sees serious grid-code violations, such as extreme undervoltage, overvoltage, frequency excursions or islanding, it may command immediate disconnection even before inverter firmware reacts. In this mode, the panel becomes the primary decision-maker for grid compliance and the inverter follows panel enable and trip commands. Internal protections remain as a backup layer, ensuring that equipment is protected even if panel thresholds are misconfigured, but the panel provides the authoritative record of grid-related trips to operators and regulators.

Trip origin tagging, event logs and interaction with EMS

To support post-event analysis and compliance reporting, the panel tags each trip with its origin: upstream protection command, grid-code voltage or frequency violation, phase-sequence fault, local emergency stop, inverter internal fault or anti-islanding trip. Time stamps, basic measured values and breaker statuses are stored and forwarded to SCADA and microgrid controllers so that operators can distinguish between network faults, plant-side issues and equipment failures.

Microgrid EMS logic uses this information, along with its own forecasts and optimisation algorithms, to decide how and when to re-synchronise, curtail or reschedule renewable assets. The grid protection and interlock panel focuses on hard-contact coordination and safe disconnection; it executes enable, block and trip commands and records outcomes. High-level strategies, prioritisation across multiple feeders and coordination between renewables, storage and loads are addressed in the renewables in microgrid EMS topic, which builds on the hardware behaviour described here.

Event logging, remote reset and SCADA integration

A grid protection and interlock panel is not only a real-time protection device; it is also an event source that must explain why inverters were disconnected, which protection operated first and when each transition happened. Structured event logging with accurate time stamps and clear trip origins allows operators, asset owners and regulators to reconstruct disturbance sequences and verify compliance with grid codes and safety procedures.

Trip origins, affected objects and event content

Each trip or protection intervention should be recorded with a stable cause code and a human-readable description. Typical categories include undervoltage and overvoltage trips, underfrequency and overfrequency events, phase sequence or phase loss faults, local emergency stop actions, upstream feeder or transformer protection trips, anti-islanding detections, inverter-internal faults and supply or self-test failures within the panel itself. Using a fixed set of event identifiers makes it easier to analyse logs across multiple sites and generations of hardware.

In multi-inverter or multi-feeder plants, events must also carry an association to the affected object, such as a specific inverter bay, feeder or point-of-connection breaker. A simple naming or ID scheme, combined with panel-side mapping tables, allows the same firmware to serve several switchboards while still producing unambiguous event records that SCADA clients and maintenance teams can interpret without guesswork.

Time stamping and synchronisation

Event records are only useful when their time stamps can be aligned with upstream protection logs and grid operator records. A panel controller therefore needs a reliable real-time clock with battery or supercapacitor backup and a mechanism to synchronise with a station-wide time source. In modern substations this may be a precision time protocol master on the station or process bus; in simpler sites it may be an NTP or SNTP feed from the SCADA or microgrid controller.

For grid protection and interlock purposes, millisecond-level accuracy is usually sufficient, but consistency with feeder and transformer relays is essential. Without a shared time base it becomes difficult to determine whether an upstream relay tripped first and the panel followed, or whether local grid-code logic forced disconnection before upstream protection thresholds were reached.

Local event buffer and non-volatile storage

Because communications links and SCADA servers are not guaranteed to be available at all times, the panel should maintain a local event buffer. A ring buffer structure with a fixed capacity allows new events to overwrite the oldest entries once the log is full, preserving a recent window of disturbances that can be retrieved after a communication outage. To survive loss of auxiliary power, event logs must be committed to non-volatile memory before shutdown.

From an IC perspective, this motivates the use of MCUs or SoCs that integrate an RTC interface and support external FRAM, EEPROM or serial Flash. FRAM is attractive for high write endurance and low latency, while EEPROM or Flash may be reserved for less frequent archival snapshots. The firmware should verify storage integrity at power-up and log any corruption or wear-out as maintenance events, rather than silently losing the ability to record trips.

SCADA and microgrid EMS interfaces

Event logs and real-time status need to reach SCADA and microgrid controllers through interfaces that match the rest of the plant. Typical physical layers include isolated RS-485 or RS-422 for Modbus RTU or serial DNP3, CAN for some wind and solar platforms, and Ethernet for IEC 61850, Modbus TCP or DNP3 over TCP. Transceiver and isolator choices must balance EMC immunity, insulation requirements and power consumption while supporting the necessary data rates.

At the protocol level, the panel exposes event buffers as sequences of time-stamped records while mapping key states to points or data objects. These include breaker positions, inverter enables and trips, grid-code status bits, interlock health, remote reset availability and simple configuration parameters. Security features such as authentication and integrity protection are recommended for control channels that carry reset and unblock commands, especially when those channels traverse shared networks.

Remote reset policies and hardware safeguards

Remote reset improves availability by allowing operators to clear transient grid-code trips and inverter faults without visiting the site, but it must not undermine safety. A clear policy is required that distinguishes trips which may be reset remotely, such as short undervoltage excursions after the grid has stabilised, from trips that always require on-site inspection, such as emergency stop actions, repeated failed close attempts or mechanical breaker problems indicated by inconsistent auxiliary contacts.

Hardware safeguards ensure that no remote command can force an unsafe close. Even if a SCADA or EMS issues a reset and close request, an open emergency stop loop, a safety relay in a fault state or an upstream block contact must physically interrupt the coil supply path. Remote reset should only clear latched logic and permit a new close attempt; actual energisation still passes through the interlock chain described in earlier sections. Each remote reset event should be recorded with the requesting channel, target object and prior trip cause to support later audits.

Design checklist and recommended IC roles

This section brings together the key design considerations for a grid protection and interlock panel into a concise checklist and a mapping between functional blocks and IC categories. It is intended as a review tool for design, verification and specification discussions rather than a detailed bill of materials.

Design checklist for grid protection and interlock panels

• Grid measurement chain: Does the voltage and frequency measurement architecture meet the accuracy and response time required by the targeted grid codes, including fast voltage dips, phase loss and unbalance conditions?
• Are isolation levels, creepage distances and surge withstand ratings of VT interfaces, divider networks and isolation AFEs appropriate for the installation voltage and environment?

• Protection thresholds and timing: Are UV, OV, UF and OF thresholds and delays configurable, and can multiple country-specific profiles be supported without hardware changes?
• Are ride-through bands, instant trips and time-delayed trips implemented according to the relevant grid code, including ROCOF or voltage unbalance criteria where required?

• Interlock chain architecture: Does the coil supply path incorporate all essential interlocks, such as emergency stops, upstream block contacts and anti-islanding outputs, in a way that avoids single-point failures leading to unsafe closure?
• In the de-energised state, does the system default to a safe condition with breakers and contactors open, and are fail-to-open scenarios explicitly analysed?

• Relay, contactor and SSR drivers: Do driver stages supply adequate inrush and holding current for all coils, including magnetically latched breakers where used?
• Are protective elements such as current limiting, thermal shutdown, freewheel paths and snubbers sized for worst-case fault clearing and switching duty cycles?
• Do driver channels provide diagnostic feedback for open coils, shorts and wiring faults?

• Auxiliary contacts and feedback: Are breaker and contactor auxiliary contacts fully used to confirm open and closed positions and to detect failed operations or welded contacts?
• Are suitable timeouts and mismatch criteria defined and logged as mechanical faults rather than generic failures?

• Event logging and time synchronisation: Is local event storage capacity sufficient to cover the expected analysis window in case of communication outages?
• Does the panel have a robust RTC plus an external time synchronisation mechanism, and are time stamps aligned with upstream protection logs?

• Communications and integration: Are RS-485, CAN and Ethernet interfaces dimensioned and galvanically isolated to match the plant topology and EMC environment?
• Do protocol implementations expose relevant measurements, states and event data while providing secure handling of control commands such as remote reset and blocking?

• Safety and fail-safe behaviour: Is the emergency stop channel designed as single or dual channel in line with the safety integrity level and performance level required by the application?
• Are watchdogs, supply supervisors and safety relays arranged so that MCU or firmware failures result in safe de-energisation of dangerous outputs rather than uncontrolled operation?
• Are remote reset policies documented, distinguishing events that may be cleared remotely from those requiring on-site inspection and manual reset?

Recommended IC roles for key functions

The table below maps functional blocks of a grid protection and interlock panel to families of ICs that commonly implement them. Specific brands and part numbers are left open so that designers can optimise for cost, availability and vendor preferences.

• Grid voltage and frequency measurement: isolation amplifiers or voltage transducers, sigma-delta modulators with isolated clocks, energy metering SoCs that expose RMS values and frequency, or high-resolution ADCs paired with MCUs that calculate RMS and ROCOF.
• Phase sequence and unbalance detection: dedicated phase-sequence relays and supervisors, or multi-phase AFEs feeding ADCs with MCU-based algorithms for phase loss and unbalance.

• UV/OV/UF/OF threshold enforcement: high-speed comparators with hysteresis, window comparators combined with precise reference ICs, and MCUs, DSPs or FPGAs that implement time delays and multi-band ride-through curves.
• Advanced grid-code logic and ROCOF: MCUs or DSPs with timer capture units and math libraries, and optionally metering SoCs that offer dedicated ROCOF or angle outputs.

• Relay, contactor and SSR drivers: protected high-side switches with integrated current limiting, thermal shutdown and diagnostic flags; low-side MOSFET drivers for shared supply rails; and specialised driver ICs for magnetically latched breakers or bistable actuators.
• Safety-channel and interlock interfaces: safety relays or safety controllers as external modules, digital isolators and optocouplers for emergency stop, block and ready signals, and isolated input front-ends for auxiliary contacts.

• Event logging and time stamping: MCUs or SoCs with integrated RTC peripherals, external RTC devices with battery backup, FRAM or EEPROM for high-endurance event storage and serial Flash for periodic archival.
• SCADA and EMS connectivity: isolated RS-485 or CAN transceivers, Ethernet PHYs with magnetics, and MCUs or SoCs that provide hardware acceleration for cryptography where secure protocols are required.

• Supervision and watchdog: external watchdog ICs, preferably window watchdogs that detect both frozen and runaway software, combined with supply supervisors and reset generators that enforce clean start-up and brown-out handling.

Application mini-stories: commercial rooftop, utility-scale and offshore

Grid protection and interlock panels are deployed in very different ways across commercial rooftops, utility-scale solar or hybrid plants and offshore wind platforms. The protection principles remain similar, but the role of the panel and the emphasis on measurement, interlocks, event logging and communications change with scale, environment and operational strategy. The following mini-stories highlight how the same design concepts are tailored to three typical scenarios.

Commercial rooftop PV: lean interlock panel around a handful of inverters

A commercial rooftop installation with two to four 30–100 kW string inverters and a single LV point-of-connection cabinet often starts with the assumption that inverter-internal protection is sufficient. In practice, building codes and fire safety requirements introduce additional elements: a fireman switch or emergency stop for the PV system, changeover and bypass operations for backup supplies, and the need to disconnect solar generation cleanly during building maintenance. A lean grid protection and interlock panel at the LV POC focuses on hardwiring these building interfaces into a single coil path for the main contactor or breaker, while still leaving detailed semiconductor and DC-link protection to the string inverters.

In this rooftop scenario, cost and footprint are tightly constrained, so the panel relies on a compact single- or dual-phase metering SoC, such as an ADE7953-class device, or a small Cortex-M MCU with on-chip ADCs and simple resistor dividers to supervise phase presence and basic undervoltage or overvoltage limits. Coil driving is typically handled by protected high-side switches in the TPS27xx-class that can source the 24 V DC inrush current and report open or shorted coils. Event logging is implemented with a low-power MCU and a small I²C FRAM, for example an FM24CLxx-class memory, sufficient to keep a ring buffer of trip causes and timestamps. An isolated RS-485 transceiver in the THVD- or ISO14xx-class then exposes building E-stop, inverter ready and panel trip histories to a simple BMS or building automation system.

Utility-scale solar and hybrid plants: feeder-level guardian with rich logging

In a utility-scale solar farm or a wind–solar–storage hybrid plant, multiple MV feeders collect power from strings of inverter skids or wind turbines and feed step-up transformers. Each feeder has its own protection relay, breaker and point of connection to the collector bus. Here the grid protection and interlock panel is deployed at feeder POC cabinets as a full-featured guardian that supervises local grid voltage, frequency and phase conditions, receives trip and block contacts from feeder and transformer protection, and coordinates enable or trip commands for many inverters and storage converters downstream. During disturbances, operators and asset owners rely on this panel to reveal whether disconnection was driven by upstream protection, local grid-code limits, anti-islanding logic or inverter-internal protection.

To support this role, designers often choose three-phase metering SoCs such as ADE78xx- or AFE03xx- class devices, or multi-channel sigma-delta AFEs in the AMC13xx-class combined with an MCU or DSP to implement precise RMS, angle and ROCOF calculations. Dual-Ethernet controllers with PTP-capable PHYs allow the panel to join IEC 61850 station buses and align event timestamps with feeder and transformer relays. High-current relay and contactor coils are driven by robust low-side or high-side drivers with diagnostics, and auxiliary contacts are isolated through Si86xx- or ADuM-class digital isolators. Event logs are stored in FRAM devices in the FM24Vxx-class or in 16–64 Mbit SPI Flash, providing thousands of records with summary voltages and frequencies. Alongside Ethernet, isolated RS-485 and CAN transceivers connect to local IEDs and skid controllers, making the panel the central point for trip origin tagging at the feeder.

Offshore wind platforms: harsh environment and remote maintenance

Offshore wind turbines and offshore substations combine demanding environmental conditions with very limited access. Salt fog, humidity, vibration and severe lightning exposure make unnecessary trips and failed remote operations extremely costly. A grid protection and interlock panel at the offshore substation or at turbine-level POC cabinets must coordinate not only with grid-tie converters but also with platform SCADA, fire and gas systems, emergency shutdown networks and black-start supplies. The panel receives ESD and safety signals from safety PLCs, enforces dual-channel interlocks for critical breakers and contactors, and provides detailed logs to support root-cause analysis between infrequent service campaigns.

In this offshore context, industrial-temperature MCUs or SoCs, extended-temperature digital isolators and rugged RS-485, CAN and Ethernet transceivers are standard. Safety relays or safety controllers handle dual-channel emergency stop and ESD inputs, with window watchdog ICs such as TPS3813- or ADM831x-class devices supervising the main MCU. Supply supervisors and reset generators manage brown-out and surge recovery so that the panel returns to a defined safe state after lightning or switching events. Secure Ethernet controllers and hardware secure elements store keys and credentials for authenticated, encrypted communications back to shore. Large FRAM or Flash logs capture detailed histories of trips, remote reset attempts and breaker operations between site visits, helping operators decide which faults can safely be cleared remotely and which require technicians on site.

Frequently asked questions about grid protection and interlock panels

Use these questions to check whether your grid protection and interlock panel covers the right functions for your project. Each answer is written from your perspective as a designer or integrator and connects back to the scope, measurement chain, interlocks, event logging and application examples on this page.