The Research, Realization and Application of IEC61850 Control Model for HVDC Project

2019 International Conference on Artificial Intelligence, Control and Automation Engineering (AICAE 2019) ISBN: 978-1-60595-643-5

The Research, Realization and Application of IEC61850 Control

Model for HVDC Project

Yu-yong ZHOU

, Zi-peng ZHANG, Yi LIU, Guan-hua ZHAO,

Dong-jie ZHAO and Gui-ju LI

XJ Group Corporation, 1298# XJ Avenue, Xuchang City, Henan Province, China *Corresponding author

Keywords: IEC61850, ACSI, SCSM, MMS, CONTROL CLASS MODEL.

Abstract. IEC61850 uses the abstract communication service interface (ACSI) and specific communication service mapping (SCSM) definition method. Most of data structure and communication service are mapping to Manufacturing Message Specification (MMS), but MMS has high abstraction, many 61850 ACSI services are mapping to one mms service [6]. At the same time there are many fuzzy definitions even mapping deviation phenomena, different vendors may have inconsistent understanding to the standard, this is harmful to the conformance and interoperability. The Control Class Model is an important functions in IEC61850 ,this paper provide analysis and comparison to the 61850 Control Class model and based on these, for the first time gives realization based on mms-ease-lite of SISCO Company , detailed explanations of actual telegram which is helpful to eliminate understanding difference and achieve interoperability. System test uses popular software to simulate as server, and the widely used network protocol analyzer software Omicron IED Scout is used to capture packets, the result verifies our implementation satisfy the functionality, conformance and interoperability.

Introduction

Substation Automation Systems (SASs) are widely used in substations to improve the reliability of power systems [1]. The success of a Substation Automation System (SAS) relies on the use of an effective communication system to link the various protection, control, and monitoring elements within a substation [2].

There are large numbers of protocols for communication, a matter that has lead to the problem of devices from different manufacturers and even devices from different generations of the same manufacturer cannot be able to communicate with each other [3]. IEC 60870-5-103 was published by IEC in 1997 aimed to interoperability, but it failed [4].Then, IEC 61850, an international standard for universal communication, was published completely by International Electro technical Commission's Technical Committee 57 (TC57) in 2005[4]. Unlike previous communication protocol, IEC61850 uses the abstract communication service interface (ACSI) and specific communication service mapping (SCSM) definition method. The most abstract data structure and abstract communication service are mapping to Manufacturing Message Specification (MMS), however MMS has high abstraction, and many 61850 ACSI services are mapped to one mms service [5]. At the same time there are many fuzzy definitions even mapping deviation, different vendors may have inconsistent understanding to the standard, this is harmful to the conformance and interoperability.

There are some researches about IEC61850 Control Class Model [6-7], Reference [6] gives some research about the 61850 control class model; Reference [7] gives some research about the SBO control with enhanced security and its application, but not providing other three types of control model; Both Reference [6] and Reference [7] do not provide the actual realization, engineers can not have a clear and precise understanding to the realization.

actual packets and application of control class model, which is helpful to eliminate understanding difference and achieve conformance.

The Definition of 61850 ACSI Services

Control class model includes six kinds of services, they are Select, SelectWithValue, Oper, TimeOper, Cancel and CommandTermination. IEC 61850-7-2 [8] gives the ACSI definition of these services.

Specific Communication Service Mapping to MMS

IEC 61850 does not define frame formats, it use Specific Communication Service Mapping (SCSM) method. IEC 61850-8-1 [9] gives the SCSM to MMS.

The Realization of 61850 ACSI Service

According to Table II, the ACSI services of control class model are mapping to three kinds of mms services, Read, Write and informationReport as shown in Table I. We give the realization of these services in the following paragraph.

Table 1. IEC 61850 Control Class Model Mapping to MMS Service.

IEC-61850 ACSI MMS

Select Read

SelectWithValue Write

Cancel Write

Operate Write

TimeActivatedOperate Write

CommandTermination InformationReport

The Realization of Select

According to reference [8], the service Select has one parameter: ControlObjectReference; the parameter ControlObjectReference shall contain the ObjectReference of the controllable DATA (defined in IEC 61850-7-4) to be accessed, for example, BayControllerQ/QD1CSWI4.Pos.SBO[CO] is one ObjectReference. Table III shows the Mapping of Select service parameters. When mapping to MMS read, the ControlObjectReference are mapping to variableAccessSpecification; the LD name of ControlObjectReference will to be the domainId, and other parts compose the itemId. For example, the ControlObjectReference BayControllerQ/QD1CSWI4.Pos.SBO[CO] is mapping to domainId BayControllerQ and itemId QD1CSWI4$CO$Pos$SBO when sending MMS read request. The realization based on mms-ease-lite is shown in TABLE IV.

The following is an example of actual MMS telegram for the Select request of BayControllerQ/QD1CSWI4.Pos.SBO [CO].

The raw bytes of MMS telegram are: a0 34 02 01 0d a4 2f a1 2d a0 2b 30 29 a0 27 a1 25 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 1a 13 51 44 31 43 53 57 49 34 24 43 4f 24 50 6f 73 24 53 42 4f,

which is hex.

The Realization of Oper

The realization of Oper is more complex than Select, because Oper is mapping to MMS write which is complex. The mapping of ControlObjectReference is the same with ControlObjectReference of Select. For example, the ControlObjectReference BayControllerQ/XCBR5.Pos.Oper[CO] will be substituted to domainId BayControllerQ and itemId XCBR5$CO$Pos$Oper when sending MMS write request. And the data will be the actual data of Oper struct. For the client, there are two ways to get definition of Oper struct. The first way is that the client read the definition of Oper struct from the SCL file that the IED supply; the second way is that get the definition by sending the GetDataDefinition request. The second way is more reliable to prevent data mapping error. The realization based on mms-ease-lite is shown in TABLE II.

The following is an example of actual MMS telegram for the Oper request of BayControllerQ/QD1CSWI4.Pos.Oper [CO] and control command Val is on.

The raw bytes are a0 54 02 01 02 a5 4f a0 29 30 27 a0 25 a1 23 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 1a 11 58 43 42 52 35 24 43 4f 24 50 6f 73 24 4f 70 65 72 a0 22 a2 20 83 01 01 a2 07 85 01 01 89 02 f0 ff 86 01 00 91 08 54 6a b2 71 00 00 63 ff 83 01 00 84 02 06 00, which is hex.

The analysis is a0 54 (confirmed-RequestPDU) 02 01 02 (invokeID: 2) a5 4f (confirmedServiceRequest: write (5))a0 29 (variableAccessSpecificatn: listOfVariable (0)) 30 27 (asn.1 squence)a0 25(name)a1 23(domain-specific) 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 (domainId: BayControllerQ)1a 11 58 43 42 52 35 24 43 4f 24 50 6f 73 24 4f 70 65 72 (itemId: XCBR5$CO$Pos$Oper) a0 22(listOfData: 1 item) a2 20(Data: structure (2)) 83 01 01(Data: boolean (3)val: True) a2 07 (Data: structure (2), 2 items) 85 01 01(Data: integer (5), val: 1) 89 02 f0 ff (Data: octet-string (9) , val: f0ff)86 01 00(Data: unsigned (6) , val: 0) 91 08 54 6a b2 71 00 00 63 ff (Data: utc-time (17),utc-time: Nov 18, 2014 02:44:01.000005900 UTC)83 01 00(Data: boolean (3)val: False) 84 02 06 00 (Data: bit-string (4), Padding: 6, bit-string: 00).

Table 2. The realization of Select and Oper.

The realization of Select The realization of Oper READ_REQ_INFO *req;

VARIABLE_LIST *vl; MVL_REQ_PEND *reqCtrl; req ->spec_in_result = SD_FALSE; req >va_spec.var_acc_tag= VAR_ACC_VARLIST;

req ->va_spec.num_of_variables = 1; vl = (VARIABLE_LIST *) (req_info + 1);

vl->alt_access_pres = SD_FALSE; vl->var_spec.var_spec_tag = VA_SPEC_NAMED;

vl->var_spec.vs.name.object_tag = DOM_SPEC; vl->var_spec.vs.name.domain_id= “BayControllerQ”; vl->var_spec.vs.name.obj_name.vmd _spec= ” QD1CSWI4$CO$Pos$SBO”; ret = mvla_read_variables (net_info,req_info,1,

&parse_info,&reqCtrl);

ST_INT oper_type_id; ST_RET ret=SD_SUCCESS; ST_CHAR oper_data_buf [256];/* "Oper" data */ char domName[]=” BayControllerQ”;

char varName []=” XCBR5$CO$Pos$Oper”; oper_type_id= domvar_type_id_create(clientNetInfo, (char*)domName, (char*)varName);

ret=mvl_get_runtime(oper_type_id, &rt_ctrl.rt_first,&rt_ctrl.rt_num);

if (ret == SD_SUCCESS) {

ST_INT data_offset = 0;

memset (oper_data_buf, 0, sizeof (oper_data_buf)); for (j=0; j < rt_ctrl.rt_num; j++)

{

RUNTIME_TYPE *rt_type = &rt_ctrl.rt_first[j];

if (strcmp (ms_comp_name_find(rt_type), "operTm") == 0) {

MMS_UTC_TIME *utc_time;

utc_time=(MMS_UTC_TIME*)(oper_data_buf+data_offset); utc_time->secs = (ST_UINT32) time(NULL);

}

else if (strcmp (ms_comp_name_find(rt_type), "ctlVal") == 0) {

*(ST_INT8 *)(oper_data_buf+data_offset) = ctrlVal; }

else if (strcmp (ms_comp_name_find(rt_type), "orCat") == 0) {

*(ST_INT8 *)(oper_data_buf+data_offset) = orCatVal; }

data_offset += rt_type->el_size; } /* end "for" */ }

ret = named_var_write(clientNetInfo, (char*)varName, DOM_SPEC, (char*)domName, oper_type_id, oper_data_buf, timeOut);

The Realization of Select with Value

The realization of SelectWithValue is the same with Oper, and also is mapping to mms write except that the itemId will be <LDname>/<LNname>$CO$SBOw, and the data will be the actual data of SBOw struct.

The raw bytes of MMS telegram are a0 57 02 01 02 a5 52 a0 2c 30 2a a0 28 a1 26 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 1a 14 51 41 31 43 53 57 49 31 24 43 4f 24 50 6f 73 24 53 42 4f 77 a0 22 a2 20 83 01 00 a2 07 85 01 01 89 02 f0 ff 86 01 00 91 08 54 64 6b 20 00 00 63 ff 83 01 00 84 02 06 00, which is hex.

The analysis is a0 57 (confirmed-RequestPDU) 02 01 02 (invokeID: 2)a5 52 (confirmedServiceRequest: write (5))a0 2c (variableAccessSpecificatn: listOfVariable (0)) 30 2a (asn.1 squence)a0 28(name) a1 26 (domain-specific)1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 (domainID: BayControllerQ)1a 14 51 41 31 43 53 57 49 31 24 43 4f 24 50 6f 73 24 53 42 4f 77 (itemID: QA1CSWI1$CO$Pos$SBOw) a0 22(listOfData: 1 item) a2 20(Data: structure (2)) 83 01 00(Data: boolean (3)Val: False) a2 07 (Data: structure (2), 2 items) 85 01 01(Data: integer (5), val: 1) 89 02 f0 ff (Data: octet-string (9) , val: f0ff)86 01 00(Data: unsigned (6) , val: 0) 91 08 54 64 6b 20 00 00 63 ff (Data: utc-time (17),utc-time: Nov 13, 2014 08:26:08.000005900 UTC)83 01 00(Data: boolean (3)Val: False) 84 02 06 00 (Data: bit-string (4), Padding: 6, bit-string: 00).

The Realization of Time Activated Operate

The realization of TimeActivatedOperate is the same with Oper, and also is mapping to MMS write except the data of Oper Struct will contain operTime and operTime must not be 0.

The following is an example of actual MMS telegram for the TimeActivatedOperate request of BayControllerQ/XCBR2.Pos.Oper [CO], operTime is Nov 13, 2014 08:41:10.000005900 UTC and control command Val is off.

The raw bytes are a0 5e 02 01 4b a5 59 a0 29 30 27 a0 25a1 23 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 1a 11 58 43 42 52 32 24 43 4f 24 50 6f 73 24 4f 70 65 72 a0 2c a2 2a 83 01 00 91 08 54 64 6e a6 00 00 63 ff a2 07 85 01 01 89 02 f0 ff 86 01 00 91 08 54 64 70 33 00 00 63 ff 83 01 00 84 02 06 00, which is hex.

The analysis is a0 5e (confirmed-RequestPDU) 02 01 4b (invokeID: 75) a5 59 (confirmedServiceRequest: write (5)) a0 29 (variableAccessSpecificatn: listOfVariable (0)) 30 27 (asn.1 squence)a0 25(name)a1 23(domain-specific) 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 (domainID: BayControllerQ)1a 11 58 43 42 52 32 24 43 4f 24 50 6f 73 24 4f 70 65 72 (itemID: XCBR2$CO$Pos$Oper)a0 2c (listOfData: 1 item) a2 2a (Data: structure (2))83 01 001(Data: boolean (3)Val: Off) 91 08 54 64 6e a6 00 00 63 ff (Data: utc-time (17), Nov 13, 2014 08:41:10.000005900 UTC) a2 07 (Data: structure (2), 2 items) 85 01 01(Data: integer (5), val: 1) 89 02 f0 ff (Data: octet-string (9) , Val: f0ff)86 01 00(Data: unsigned (6) , val: 0) 91 08 54 64 70 33 00 00 63 ff(Data: utc-time (17), Nov 13, 2014 08:47:47.000005900 UTC)83 01 00(Data: boolean (3)val: False) 84 02 06 00 (Data: bit-string (4), Padding: 6, bit-string: 00).

For the response, the raw bytes are a1 07 02 01 4b a5 02 81 00 and the analysis is a1 07(confirmed-ResponsePDU) 02 01 4b (invokeID: 75) a5 02 (confirmedServiceResponse: write (5)) 81 00(write: 1 item, success (1)).

The Realization of Cancel

The realization of Cancel is the same with Oper, and also is mapping to MMS write except that the itemId will be <LDname>/<LNname>$CO$Cancel, and the data will be the actual data of Cancel struct.

The following is an example of actual MMS telegram for the TimeActivatedOperate request of BayControllerQ/ QA1CSWI1.Pos. Cancel [CO], and Val is off.

The raw bytes are a0 55 02 01 0c a5 50 a0 2e 30 2c a0 2a a1 28 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 1a 16 51 41 31 43 53 57 49 31 24 43 4f 24 50 6f 73 24 43 61 6e 63 65 6c a0 1e a2 1c 83 01 00 a2 07 85 01 01 89 02 f0 ff 86 01 00 91 08 54 64 6b a1 00 00 63 ff 83 01 00.

51 (domainId: BayControllerQ) 1a 16 51 41 31 43 53 57 49 31 24 43 4f 24 50 6f 73 24 43 61 6e 63 65 6c(itemId: QA1CSWI1$CO$Pos$Cancel) a0 1e(listOfData: 1 item) a2 1c (Data: structure (2)) 83 01 00(Data: boolean (3)val: false) a2 07(Data: structure (2), 2 items) 85 01 01 (Data: integer (5), Val: 1)89 02 f0 ff (Data: octet-string (9) , val: f0ff 86 01 00 (Data: unsigned (6) , val: 0) 91 08 54 64 6b a1 00 00 63 ff (Data: utc-time (17),utc-time: Nov 13, 2014 08:28:17.000005900 UTC)83 01 00(Data: bit-string (4), Padding: 6, bit-string: 00).

The Realization of CommandTermination

CommandTermination is mapping to MMS informationReport service. The mapping of ControlObjectReference is the same with ControlObjectReference of Select. For a success informationReport, listOfAccessResult is filled with actual data. The mms-ease-lite supply the realization of this function, mvl61850_ctl_command_termination, users calls it with corresponding parameters.

The following is an example of actual MMS telegram for the CommandTermination request of BayControllerQ/Oper, and Val is off.

The raw bytes are a3 42 a0 40 a0 1c 30 1a a0 18 a1 16 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 1a 04 4f 70 65 72 a0 20 a2 1e 83 01 00 a2 05 85 01 01 89 00 86 01 00 91 08 54 64 6b 2b 00 00 63 ff 83 01 00 84 02 06 00.

The analysis is a3 42 (unconfirmed-PDU) a0 40(unconfirmedService: informationReport (0)) a0 1c (variableAccessSpecificatn: listOfVariable (0)) 30 1a (asn.1 squence)a0 18 (name)a1 16 (domain-specific) 1a 0e 42 61 79 43 6f 6e 74 72 6f 6c 6c 65 72 51 (domainId: BayControllerQ)1a 04 4f 70 65 72 (itemId: Oper) a0 20 (listOfAccessResult: 1 item ,AccessResult: success (1)) a2 1e (Data: structure (2)) 83 01 00(Data: boolean (3)val: False) a2 05 (Data: structure (2), 2 items) 85 01 01(Data: integer (5), val: 1) 89 00 (Data: octet-string,NULL)86 01 00(Data: unsigned (6) , val: 0) 91 08 54 64 6b 2b 00 00 63 ff (Data: utc-time (17), utc-time: Nov 13, 2014 08:26:19.000005900 UTC)83 01 00(Data: boolean (3)val: False) 84 02 06 00 (Data: bit-string (4), Padding: 6, bit-string: 00).

Function Test and Conformance Test

We use the anvil [12] of TriangleMicroworks company as the simulator server, the version is 3.5.35.We test eight case, including:

(1)Case1:Direct control with normal security without time; (2)Case2:Direct control with normal security and time; (3)Case3:SBO control with normal security without time; (4)Case4:SBO control with normal security and time; (5)Case5:Direct control with enhanced security without time; (6)Case6:Direct control with enhanced security and time; (7)Case7:SBO control with enhanced security without time; (8)Case8:SBO control with enhanced security and time

The server supply a demo ICD file TMWsample.icd, there are six control objects in this file, the control mode is shown in TABLE VI. In order to finish the test of eight cases, we add other four control objects in the ICD file.

Omicron IEDScout4 [13] is used as the conformance testing tools, Omicron IEDScout4 supply sniffer functions to parse the 61850 ACSI packets. The network protocol analyzer Wireshark 1.10.7 [14] is also used to get the online telegram and as another auxiliary MMS analyze tool in the tests. The test content include on and off every breaker, for SBO control, the on and off cancel are also tested.

We develop the client base on mms-ease-lite. For GUI, we use QT.

Figure 1. The Test Result Based on Omicron IED Scout 4.0.

Conclusion

This paper provide analysis of IEC61850 control class model, based on these analysis, for the first time gives implementation using the mms-ease-lite of SISCO Company, application control class model and detailed explanations of actual telegram; with the analysis, realization and actual telegram software developers and engineers can have a more clear understanding to the IEC61850 control class model; and based these they can do their own realization. The research is helpful to eliminate understanding difference and achieve interoperability. System test uses popular software as servers, and the widely used network protocol analyzer software Omicron IEDScou is used to capture packets, the result verifies our implementation satisfy the functionality and conformance.

References

[1] Kingo Koshiishi, Keiichi Kaneda, Yasumasa Watabe Interoperability experience with IEC 61850-based Substation Automation Systems Transmission and Distribution Conference and Exposition (T&D), pp.1 - 5, 2012.

[2] T. S. Sidhu, M. G. Kaanabar, and P. Parikh, “Implementation issues with iec61850 based substation automation systems,” in Proceedings of the 15th National Power Systems Conference (NPSC '08), 2008.

[4] Tianqi Xu, Hui Hou, Hongwei Yu, Dahai You, Xianggen Yin, and Yangguang Wang: Analysis on IEC 61850 interoperability support IEEE Power Engineering Society General Meeting pp. 1-6, 2007.

[5] Lin Hai.Realization of ACSI model based on IEC61850 [J].Telecommunications for Electric Power System, 2009, 30(4):30-33.

[6] Liu Dong, JIN Hui-hua. The research of control model about IEC61850[J]. Electrotechnical Application, 2008, 27 (12):64-70.

[7] Li Xinchao, Yang Yu, Fan Chen, et al Research and application of control model of IEC61850 in protection and control devices [J], Power System Protection and Control,2010, 38(10): 96-100.

[8] Communication networks and systems in substations-part 7-2: basic communication structure for substation and feeder equipment-abstract communication service interface (ACSI) [S] IEC 2003.

[9] Communication networks and system in substations-part 8-1: specific communication service mapping (SCSM)-Mapping to MMS[S] IEC 2003.

[10] X.680: ITU-T Recommendation X.680 (2002) | ISO/IEC 8824-1:2002, Information Technology - Abstract Syntax Notation One (ASN.1): Specification of Basic Notation

[11] The International Organization for Standardization. ISO/FDIS9506-1 Industrial automation systems -manufacturing message specification part 1: service definition [S]. ISO, 2002.

[12] http://www.trianglemicroworks.com/

[13] https://www.omicron.at/