IEC 61850: data models, MMS, GOOSE and SCL

A device sold as "IEC 61850 compliant" may support MMS reporting and nothing else, or GOOSE and nothing else. IEC 61850 is a series of standards with three parts that matter to an integrator: a data model of the equipment, the Substation Configuration Language (SCL) for engineering tools, and three communication services, MMS, GOOSE and sampled values. Name the services a project needs before you ask for files, and test each one separately.

This guide is part of the IEC 60870 and IEC 61850 series.

The data model

An intelligent electronic device (IED), such as a protection relay or a bay controller, exposes a hierarchy:

IEC 61850-7-4 defines the logical node classes, so MMXU is a measurement unit and XCBR is a circuit breaker on every compliant IED. A client can browse an unfamiliar relay and find its total active power without a vendor point list. The vendor still chooses the optional data objects and the instance numbers.

The full reference starts with the logical device name, which is the IED name followed by the logical device instance. In an IED named FDR1, total active power is FDR1LD0/MMXU1.TotW.mag.f, read with the functional constraint MX. MMS carries the same value as the variable MMXU1$MX$TotW$mag$f in the domain FDR1LD0. Phase A current is one level deeper, because A is a WYE object with a sub-object for each phase: MMXU1.A.phsA.cVal.mag.f.

The functional constraint (FC) is part of the address. ST holds status, MX measured values, CO control, CF configuration, SP set points and DC descriptions. One data object has attributes under several FCs: XCBR1.Pos has stVal, q and t under ST, and ctlModel under CF. A client that asks for Pos.stVal under MX gets an error, not a value. The MZ Automation client tutorial shows reads with explicit FCs.

Every status and measured value has a quality (q) and a timestamp (t). The quality has a validity (good, invalid or questionable), detail bits such as oldData and overflow, a source (process or substituted), a test flag and an operatorBlocked flag. A relay under test can send a normal stVal with q.test set. A gateway that forwards stVal and drops q passes that test value on as a real one.

A dataset is an ordered list of data objects or attributes, each with its FC. Reports and GOOSE send datasets, not single points. Take the model and the datasets from the configured IED or its CID file, not from a similar product or an older firmware.

The communication services

GOOSE and sampled values do not use IP, so a working MMS connection proves nothing about them. IEC TR 61850-90-5 defines routable versions (R-GOOSE and R-SV) over UDP/IP for wide-area use. Plain GOOSE and sampled values stay inside one layer-2 network. IEC TR 61850-90-4 gives network engineering guidance for substation LANs.

MMS reports

A report control block sends a dataset to one client. A buffered block (BRCB, FC BR) keeps events while the client is disconnected. An unbuffered block (URCB, FC RP) discards them. The client sets TrgOps to choose the triggers: data change (dchg), quality change (qchg), data update (dupd), integrity period and general interrogation (GI). IntgPd sets the integrity period, which sends the whole dataset. BufTm sets how long the server collects changes before it sends a report. The client writes RptEna last, to start the block. An IED has a fixed number of instances of each block, so assign one to each client in the SCD. Two clients must not use the same instance.

After a reconnect, the client of a buffered block writes the last EntryID it received, then sets RptEna. The server then sends the entries that follow that one. If the buffer overflowed during the outage, the next report has BufOvfl set. The client must then run a general interrogation to rebuild its state. Size the buffer for the event rate multiplied by the longest expected outage. Test the overflow: keep the client disconnected for longer than the buffer lasts, then check that it flags the gap and interrogates.

GOOSE

A GOOSE publisher sends its dataset as a multicast frame to a destination MAC address from 01-0C-CD-01-00-00 to 01-0C-CD-01-01-FF. The frame has an APPID from 0x0000 to 0x3FFF and usually a VLAN tag with priority 4. IEC 61850-5 requires a transfer time of 3 ms or less for type 1A trip messages in performance classes P2 and P3, which apply to transmission. The distribution class P1 allows 10 ms. The transfer time runs from the publishing application to the subscribing application, so it includes both IEDs' processing, not only the network. That budget is the reason GOOSE does not use TCP/IP.

GOOSE has no acknowledgement. The publisher repeats each message instead. When a value changes, stNum increments and the message goes out immediately. Repeats follow at short intervals that increase to a steady heartbeat, within the MinTime and MaxTime of the GSE element in the SCL. sqNum counts the repeats and restarts at each new stNum. Each frame carries timeAllowedToLive, the time within which the next frame must arrive.

A subscriber accepts a stream only when its GoCBRef, dataset reference and confRev match the subscriber's configuration. A configuration change at the publisher increments confRev. If the subscriber is not updated, it ignores the stream, and it may show only a diagnostic flag. If timeAllowedToLive expires with no new frame, the subscriber marks the stream as lost and its inputs take their configured fallback values. Test both cases. Change a value and measure the response at the subscriber. Then disconnect the publisher, and check the fallback and the alarm.

Edition 2 frames carry a simulation bit. A subscriber accepts simulated frames only when its LPHD.Sim is set. A test set can then inject values without a live trip.

Sampled values

A merging unit digitises CT and VT signals at the switchgear and publishes them as sampled values, to destination MAC addresses from 01-0C-CD-04-00-00 to 01-0C-CD-04-01-FF with APPIDs from 0x4000 to 0x7FFF. The UCA implementation guideline IEC 61850-9-2LE set 80 samples per cycle for protection, which is 4000 Hz on a 50 Hz network, and 256 samples per cycle for metering. IEC 61869-9 replaces those rates with fixed ones: 4800 Hz for protection and general measurement, and 14 400 Hz for power quality.

Each sample carries a counter, smpCnt, that restarts every second. Functions that compare currents from several merging units, such as busbar differential protection, need all of them on one time reference. IEC/IEEE 61850-9-3 defines the Precision Time Protocol (PTP) profile for power utilities. Monitor the synchronisation state of every merging unit, and define what the relay does when one loses it.

SCL files

Record the tool that produced each file, the edition, the date and the configuration revision. The SCL root element states the schema version: Edition 2 files carry version 2007 with a revision letter, and Edition 2.1 files carry 2007B4. An Edition 1 tool or client can reject an Edition 2 file, or ignore the logical node classes and data objects that Edition 2 added.

Decide which tool owns the SCD. A change made in an IED's own tool and not returned through an IID is lost at the next SCD export. A file that imports cleanly has not yet proved that the subscriptions and reports work.

IEC 61850 compared with IEC 60870-5-104

Many utilities use both: IEC 61850 inside the substation, and IEC 104 from the substation gateway to the control centre. The IEC 101 vs 104 guide describes the telecontrol side.

Mapping IEC 61850 values to IEC 104

A common integration task is a substation gateway that reads IEDs over MMS and serves the control centre over IEC 104. IEC TS 61850-80-1 is the guideline for this mapping. Take FDR1LD0/MMXU1.TotW from the example above. The gateway receives mag.f, q and t in a report. It sends a short floating-point measured value with a time tag (type 36, M_ME_TF_1) at an agreed information object address.

The quality needs a decision for each flag. The IEC 104 quality descriptor has five flags. A typical mapping sends invalid validity to IV, oldData to NT, a substituted source to SB, operatorBlocked to BL and overflow to OV. A questionable value with none of those details has no exact equivalent, so agree whether it becomes IV or NT. The descriptor has no test flag, so decide whether the gateway forwards values with q.test set.

The timestamp also needs a decision. IEC 61850 time is UTC, with a time-quality field that flags clock failure and loss of synchronisation. CP56Time2a has millisecond resolution and one invalid bit, and the two ends must agree whether it carries UTC or local time. When the source flags its clock as unsynchronised, set the invalid bit in the time tag. The timestamps and quality guide describes the IEC 104 side.

Test the mapping from the IED to the control centre display. Substitute a value at the IED and check for SB at the control centre. Put the IED in test mode and check what the gateway does with the value.

Control

IEC 61850-7-2 defines direct control and select-before-operate (SBO), each with normal or enhanced security. The CF attribute ctlModel states which one an object uses. With SBO and enhanced security, the client writes SBOw (select with the intended value), then Oper. A positive response to Oper means only that the IED accepted the command. The IED then sends a CommandTermination. It is positive when the equipment reaches the end position, and negative, with an AddCause, when it does not reach it before the operate timeout.

Normal-security models send no CommandTermination, so the client must watch XCBR1.Pos.stVal. Pos is a double point: intermediate state, off, on or bad state. Treat a breaker that stays in intermediate state after its travel time as a failed operation.

Agree the control model, the authority (local or remote, and the originator category orCat), interlocks, timeouts and feedback before any write. The local control guide lists the failure cases to test for each command.

Security

IEC 62351 specifies the security for IEC 61850. Part 3 applies TLS to TCP/IP profiles, part 4 covers MMS, part 6 covers GOOSE and sampled values, part 8 defines role-based access control and part 9 covers key management. A device that supports IEC 61850 may implement none of these parts. GOOSE authentication adds processing inside the trip transfer-time budget, so get the vendor's timing figures before you enable it on a trip path. Ask which security functions are available and enabled, and who manages the certificates and keys.

What to ask for before an integration

• The IED model, the firmware, and the IEC 61850 edition of its model and SCL files.
• The services in scope: MMS reads, reports, control, GOOSE publish or subscribe, sampled values.
• The ICD file, and the IID or SCD if the IED is already in a system.
• The datasets, the report control block instance for each client, and the buffer sizes.
• For GOOSE and sampled values: APPID, destination MAC address, VLAN ID and priority, confRev, MinTime and MaxTime.
• The time source and its accuracy at each IED.
• How quality and time reach the final record.
• The enabled security functions and the network design.

An IEC 61850-10 conformance certificate covers the services and model in its declared test scope, for one firmware version. It does not replace site acceptance of the configuration, the network and the failure cases.

Substations and EpiSensor systems

Edge does not include an IEC 61850 interface. EpiSensor systems do not take part in substation IEC 61850 networks. They measure and control the customer site behind the connection point: circuit-level metering with the ZEM electricity monitor, and 100 ms under-frequency response with the ZDR demand response controller.

A large site can own its own high-voltage substation, with relays that report to the network operator over IEC 61850 or IEC 104. If a project needs one of those values in Edge, one route is a protocol converter that serves it over a protocol Edge reads, such as Modbus TCP. Modbus registers carry no quality or timestamp, so agree how the converter shows an invalid or stale value before you use it.