Control model implementation in WinCC OA

To reduce the number of peripheral addresses required, the WinCC OA implementation maps the attributes of the data structures SBOw and Cancel to one virtual address. Furthermore, User Bits are facilitated for transmitting information required to distinguish between different services and to transfer additional information. The WinCC OA 61850/61400 client interprets the received value and bit pattern and creates the data structure necessary to call the required service.

By default the bits for configuring a control operation are located at User Byte 1. You may use the config entry userByteCommandMode to map these bits to any other User Byte. For selecting a specific service the setting of the first two bits is relevant. In the following example we will only regard these two bits. For a complete description of the command byte please refer to the table below.

Note: The User Byte CommandMode applies to the write direction and does not interfere with User Byte settings used for the receive direction.

The different operations are illustrated in the example of changing the position of a currency switch (CSWI) with the physical address protectionDevice.TestDevice1CTRL/Q1CSWI1$ST$Pos. The addresses used in the example are as defined by the IEC standard.

The value to operate this switch has the physical address

protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$stVal

The data type of stVal depends on the controllable object. In this example it is BITSTRING which can be mapped to e.g. an INTEGER data point element. If the IEC data type of ctlVal is an analog value, the actual data type might be integer or float. In this case the peripheral address would be:

Integer: protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$stVal$i
Float: protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$stVal$f

Virtual Addresses

The IEC 61850 driver uses the following virtual addresses:

protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$operVal - this address is used for sending select and cancel commands
protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$error - this address is used for receiving error and response codes
protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$addCause - this address is used for receiving additional information on errors

Please note that these addresses are virtual addresses used by the WinCC OA IEC 61850 client. They DO NOT exist in the device and therefore do not appear in the browse result. Suggestion: Copy the address string from protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$ctlVal to the address configs of the respective DPEs and manually change the last element of the string.

Configuration requirements:

operVal must get the same data type as ctlVal and must be configured as output address.

error and addCause must be of type INT32 and must be configured as input addresses with receive mode unsolicited. Since these addresses do not exist in the device they MUST NOT be used in any dataset. The values written to these DPEs are read from the response which the driver receives from the device after sending a command or in case a command runs into any kind of timeout.

It is recommended to monitor these virtual addresses since they give precise information on how a device responds to a command issued by the client. By reading the response codes for object selected (50), operation cancelled (51) and command successfully issued (100) an operator can immediately see that the respective command was issued properly.

Configuration Attributes

The attributes listed below characterize a command.

Type of Control Model (ctlModel)

The type of the control model is defined by the value of the attribute protectionDevice.TestDevice1CTRL/Q1CSWI1$CF$Pos$ctlModel. Following values are allowed:


Operation	Value
Direct operation with normal security	1
Select before operate with normal security	2
Direct operate with enhanced security	3
Select before operate with enhanced security	4

For reading this attribute it must be part of a dataset or a poll group.

SBO Time-out (sboTimeout)

The time-out for the Select before operate commands is defined by the value of the attribute protectionDevice.TestDevice1CTRL/Q1CSWI1$CF$Pos$sboTimeout.

This value determines how long a command is operable after it has been selected.

For reading this attribute it must be part of a dataset or a poll group.

Note: This attribute is not always readable and iis optional. In this case the time-out is defined by the manufacturer.

Status Selected (stSeld)

This attribute may be monitored to find out if a Select request was successful. For this you need to read the address protectionDevice.TestDevice1CTRL/Q1CSWI1$ST$Pos$stSeld.

Note: This attribute is optional. If this attribute is TRUE the command is selected but there is no indication which client has selected it. To determine if your Select request was successful you have to evaluate the response to the Select operation.

For reading this attribute it must be part of a dataset or a poll group.

Determine if a request was successful

To determine if an object was successfully selected by a specific client it is necessary to monitor the element OperError. Please refer to response codes for details.

Direct Control with normal and enhanced security

Bit pattern: 00

Operation: Write the required value to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$stVal.

The distinction between normal and enhanced security is done by the configuration of the peripheral device.

Select before operate control with normal security

Bit Pattern: 01

Sequence of Commands:

Write any value to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$operVal.
Wait for protectionDevice.TestDevice1CTRL/Q1CSWI1$ST$Pos$stSeld to transition to TRUE or for receiving the value 50 at the element protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$error
Write the required value to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$ctlVal. If the device accepts the command, the value 100 is written to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$error

Figure 1. Write 1 (off) to the protection device

Select before operate control with enhanced security

Bit Pattern: 11

Sequence of Commands:

Write the required value to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$operVal.

The service actually called is SelectWithValue
Wait for protectionDevice.TestDevice1CTRL/Q1CSWI1$ST$Pos$stSeld to transition to TRUE or for receiving the value 50 at the element protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$error.
Write the required value to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$ctlVal. If the device accepts the command, the value 100 is written to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$error

Figure 2. Write 2 (on) to the protection device

Time activated operation

For initiating a time activated operation use any of the operations described above but also write the time, the operation shall be executed to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$operTm.

Note: Since this must be done in one dpSet you will need a control script for calling this service.

Cancel

Bit Pattern: 10

Operation: Write any value to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$operVal. If the device accepts the cancel command the value 51 is written to protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$error.

Figure 3. Cancel an operation scheduled for the position of the CSWI

Response

For receiving the response from the device you may configure the addresses described in the following. These addresses are also virtual addresses introduced by the WinCC OA implementation. You cannot find these addresses on your peripheral device. Configure these addresses for unsolicited communication.

The response codes are transmitted by a service specific to the control model mechanism. The following two addresses must be configured for unsolicited communication but most not be part of any dataset.

Error codes

Configure: protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$error

In case of an error you will receive the IEC error codes for any operation performed. This address is also used for monitoring positive responses. For further information please also refer to error codes.

Additional information

Configure: protectionDevice.TestDevice1CTRL/Q1CSWI1$CO$Pos$Oper$addCause

This address will only be written if one of the enhanced modes is used. For further information please refer to addCause

CommandMode type definition for bits (1- 8)

Bits

Description

Bit1, Bit2

These two bits represent the type of service in command bits.


BIT1	BIT2	Description
0	0	DO
1	0	Cancel
0	1	SBO
1	1	SBOw

Bit3, Bit4

These two bits represent check condition in command bits.


BIT3	BIT4	Description
0	0	no-check
0	1	synchro-check
1	0	interlocking check
1	1	both

Bit5

This bit represents the test status. The service parameter Test indicates if the client sends a control service for test purposes only. True indicates that the test is performed.

All service requests belonging to one control sequence must have the same test status.

Bit6

This bit represents the automatic mode status.

TRUE: automatic mode is set

FALSE: automatic is not set

This bit modifies the originator category, see also origin.orCat.

Bit7

This bit represents the maintenance status.

TRUE: Maintenance is set

FALSE: Maintenance is not set

If this bit is set, origin.orCat settings are ignored and the originator category is set to maintenance.

Bit8

Bit 8 - periphBlkd indicates "No action" to the client and may be used for testing or engineering.