Configuring Profibus to IEC 104/61850 Protocol Conversion

1. Overview: Profibus to IEC 104/61850 Conversion on S7-400 Systems

Industrial substations and process plants that historically relied on PROFIBUS field networks must often expose their data to external SCADA, EMS (Energy Management Systems), or DMS (Distribution Management Systems) using the IEC 60870-5-104 (commonly called IEC 104) telecontrol protocol or the IEC 61850 substation communication standard. A typical scenario involves a Siemens S7-400H redundant station (CPU 414-4H with CP 443-1 Ethernet communications processor) wired in a ring topology that must publish its process image, alarms, and measurands to a third-party control center speaking IEC 104 over TCP/IP.

Direct conversion inside the PLC firmware is not possible with stock S7-400 firmware. The standard, manufacturer-supported approach is to deploy a protocol gateway — most commonly SICAM PAS (Siemens Power Automation System) — that sits between the S7-400 station and the IEC 104/IEC 61850 network. The gateway runs on a Windows server, reads the S7 process image using S7 OPC or SIMATIC NET Softnet with a CP 1613/CP 1623, and republishes the values on the IEC 104 / IEC 61850 side.

2. Protocol Stack Fundamentals

2.1 PROFIBUS DP / S7 Communication

PROFIBUS DP is a master/slave fieldbus running on RS-485 (copper) or fiber optics at rates from 9.6 kbit/s to 12 Mbit/s. The S7-400H station typically integrates PROFIBUS DP via the CP 443-5 Extended module. The CP 443-1 (Ethernet) provides the upstream LAN connection for OPC/Softnet and for IEC 104 traffic.

2.2 IEC 60870-5-104

IEC 60870-5-104 is the network-access layer variant of the IEC 60870-5 series, running over TCP/IP (default port 2404). It uses a balanced/unbalanced client-server model. The gateway is the controlled station (server); the upstream control center is the controlling station (client). ASDUs carry M_SP_NA_1 (single-point information), M_DP_NA_1 (double-point), M_ME_NC_1 (measured value, short floating point), and M_IT_NA_1 (integrated totals). Refer to IEC 60870-5-104:2016 (Webstore).

2.3 IEC 61850

IEC 61850 is the international standard for substation communication (IEC 61850-1:2013). Data is structured as Logical Devices (LD) → Logical Nodes (LN) → Data Objects (DO) → Data Attributes (DA). Engineering is done with SCL (Substation Configuration Language) files; the gateway's IEC 61850 server uses the SCL ICD/SSD file describing the IED.

3. Required Hardware and Software

4. Reference Architecture: SICAM PAS Gateway in Ring Topology

The S7-400H station and the SICAM PAS gateway are deployed in a redundant ring — typically MRP (Media Redundancy Protocol) with SCALANCE XC-200/XB-200 managed switches, or HRP (High-availability Seamless Redundancy) when using SCALANCE XR-300. The CP 443-1's four-port switch (EX30) can also be used in stand-alone ring configurations. The IEC 104 control center sits on a separate upstream network segment reached via a router or firewall.

Engineering and runtime traffic: PROFIBUS DP at 1.5 Mbit/s carries process data from the CP 443-5 to the I/O. The CP 443-1 publishes S7 variables to the SICAM PAS OPC server over ISO-on-TCP (port 102). The OPC tags are mapped 1:1 to IEC 104 information objects and to IEC 61850 data objects.

5. Alternative Path: S7-400 / PCS 7 with Added Software Packages

When a separate Windows gateway is undesirable, the conversion logic can be embedded in the S7-400 itself using:

• SIMATIC PCS 7 with the SIMATIC PCS 7 TeleControl option package and the IEC 60870-5-104 master/slave blocks (FB TELECONTROL_104). This requires PCS 7 V9.0 or later and a CP 1243-1 / CP 1542SP-1 for ET200 stations; the S7-400 uses CP 443-1 plus PCS 7 add-on.
• SIMATIC S7-400 + AddOn IEC 61850 via the S7-400 IED configured with SICAM SCC or third-party IED configurators. The CPU 414-4H cannot run the IEC 61850 stack directly; a sub-station controller (RTU 8x70, SICAM A8000) is required.

For the topology described (ring of S7-400H with a single IEC 104 control center), the SICAM PAS gateway is the lowest-risk path. It keeps the S7 firmware stock, decouples protocol changes from PLC code, and supports both IEC 104 and IEC 61850 from one platform.

6. CP 443-1 Configuration for the Gateway

6.1 STEP 7 / TIA Settings

Open the CP 443-1 properties in HW Config (STEP 7 V5.6) or in the device configuration (TIA Portal V17) and assign the following parameters:

7. SICAM PAS Engineering Workflow

7.1 Step 1 — Install and License

1. Install SICAM PAS V8.20 (or current release) on a Windows Server 2019 / 2022 machine. ISO 27001 hardening is recommended for control-center facing deployments.
2. Apply the license key for: SICAM PAS Core, IEC 60870-5-104 Server, IEC 61850 Server, S7 OPC Client.
3. Install SIMATIC NET PC software V17 with Softnet-S7 Lean/Standard. The CP 1613 / CP 1623 driver binds the S7 protocol to the dedicated NIC.

7.2 Step 2 — Build the S7 OPC Project

1. Launch SICAM PAS Manager → Project → New. Add an S7 OPC channel.
2. Configure the S7 connection to CPU 414-4H: rack 0, slot 3 (CPU), MPI/PROFIBUS or ISO-on-TCP. Use S7 HMI connection for redundancy.
3. Browse the S7 symbol table or import the STEP 7 project export (XML via SIMATIC Manager → Options → Export to Other Tools). Each DB bit/word is exposed as an OPC item, e.g. S7:[S7-400H_CPU414]DB100,BYTE0.

7.3 Step 3 — Map OPC Items to IEC 104 Information Objects

Open SICAM PAS IEC 104 Editor and create the data points. Example mapping table:

Configure IEC 104 common address (CA), link address, originator address, and a Scan Period of 1000 ms for measurands and 200 ms for status. Enable General Interrogation (GI) on startup so the control center receives the full process image after connection establishment.

8. IEC 61850 Server Modeling

For the IEC 61850 server, define an SCD/ICD file with one Logical Device per CPU. Logical Nodes mirror the data model:

<LDevice inst="LD_A">
  <LNode lnClass="LLN0" inst="">
    <DO name="Mod" type="OPC_OpSt/OpSt_t/>
    <DO name="Beh" type="ENS/>
  </LNode>
  <LNode lnClass="XCBR" inst="1">
    <DO name="Pos" type="DPC/>            <!-- from DB100.DBX0.0 -->
  </LNode>
  <LNode lnClass="MMXU" inst="1">
    <DO name="TotW" type="MV/>            <!-- from DB100.DBD6 -->
    <DO name="PhV" type="WYE/>            <!-- A/B/C phase -->
  </LNode>
  <LNode lnClass="PIOC" inst="1">
    <DO name="Str" type="ACT/>            <!-- from DB100.DBX0.1 -->
  </LNode>
</LDevice>

Upload the ICD to SICAM PAS, bind each Data Object to the OPC item using the IEC 61850 Binding Editor, and enable MMS over TCP (default port 102) or dedicated port 102 for IEC 61850. Bind DAItems with FCDA references.

9. Ring Topology and High-Availability Settings

9.1 MRP (preferred for IEC 104/61850 LAN)

1. Configure one SCALANCE switch as MRP manager and all others as MRP clients in the Web-Based Management interface.
2. Set the Reconfiguration time to < 200 ms. SCALANCE XC-200 defaults to ~50 ms; verify in the log.
3. Connect CP 443-1 ports in the ring only if MRP is enabled on the CP 443-1 EX30 firmware ≥ V3.x. Otherwise keep the CP 443-1 in star.

9.2 HRP (when the gateway is also redundant)

Use HRP if the SICAM PAS node is a fault-tolerant pair with two network adapters. HRP supports seamless reconfiguration (< 300 ms) and is the recommended redundancy for the IEC 104 LAN in transmission substations.

10. Data Throughput and Timing Considerations

End-to-end latency for one measurand: S7 acquisition (≤ cycle time) + OPC read (cycle / 2) + IEC 104 ASDU build (≤ 50 ms) + LAN delay. Typical total: 600 ms – 1.5 s for cyclic measurands on a healthy ring.

11. Commissioning and Verification

1. Step 1 — S7 reachability. From the gateway PC, run ping 192.168.10.1 and ping 192.168.10.2. Open SIMATIC NET Diagnostics and confirm both CPUs visible.
2. Step 2 — OPC browse. Use SICAM PAS OPC Test Client to browse the S7 server. Verify a known value, e.g. DB100.DBW2 for line voltage, returns the expected raw value.
3. Step 3 — IEC 104 connection. From a control-center simulator (e.g. PCM600 / ITT600), initiate a TCP connection to port 2404 of the gateway. The log should show STARTDT act / con exchange within 15 s.
4. Step 4 — General Interrogation. Trigger Interrogation GI (cause of transmission = 20). The gateway must respond with all configured data points using the configured ASDU types.
5. Step 5 — Spontaneous events. Force a status change in the S7 program; verify an M_SP_NA_1 with cause 3 (spontaneous) arrives at the control center within 1 s.
6. Step 6 — IEC 61850 MMS association. Use IEC 61850 client (e.g. Siemens SICAM SCC) to associate. Browse the data model; verify all logical nodes and the live values.
7. Step 7 — Failover test. Power down CPU A. Verify the OPC connection fails over to CPU B in < 1 s and that no GI / data is lost on the IEC 104 channel.
8. Step 8 — Ring break test. Disconnect one ring cable. Confirm MRP reconfiguration completes (LEDs on SCALANCE) and IEC 104 reports STARTDT remains connected.

12. Troubleshooting Matrix

13. Security and Hardening Checklist

• Place the gateway on a DMZ between the S7 LAN and the IEC 104 WAN; restrict source IP in the firewall.
• Use IEC 62351-3 for TLS-secured IEC 104 channels where supported by the control center (SICAM PAS supports TLS 1.2 for IEC 104 in V8.20+).
• Disable unused S7 ports on the CP 443-1 (S7, FETCH/WRITE) once OPC is stable.
• Restrict Windows RDP access to the gateway to a maintenance VLAN.
• Enable logging to a central SIEM; configure NTP from a trusted source.
• Patch the gateway OS quarterly and follow Siemens ProductCERT advisories.

14. Long-Term Operation Notes

During operation, monitor:

• OPC subscription quality and resync count.
• IEC 104 message rate (control center typically expects stable throughput; spikes indicate bursts).
• MRP reconfiguration counters on SCALANCE switches.
• Gateway host CPU and RAM (PAS is single-threaded; OPC + 104 + 61850 typically needs < 4 GB RAM and one core).

Plan for firmware updates: CP 443-1 EX30 firmware V3.0.28 or later is recommended for stability with the OPC bridge; check the latest release in Siemens Support entry 109749628. SICAM PAS follows a yearly release cadence; track SICAM PAS release notes.