Configuring WinCC PAS CC Button for IEC 61850 Breaker Control

David Krause11 min read
SiemensTutorial / How-toWinCC
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

This reference explains how to wire a WinCC v6.0 SP4 graphical control button (running on a SICAM PAS CC configuration) to an IEC 61850 circuit breaker logical node using the standard double-command control object C_DC_NA_1 (Common Data Class DPC – Double Point Controllable, type identifier 46) and the single-point status with transient bit M_SP_TA_1 (CDC SPS with d-quality transient detection, type identifier 2). The solution described uses the legacy PAS internal C function PAS_Command_Integer_V500 bound to the Mouse Click event of a WinCC button, together with the IEC 61850 Select-Before-Operate (SBO) two-step control model required by most protection IEDs.

The same conceptual model also applies to the modern Siemens TIA Portal documentation for the WinCC Unified Button object, where the action handler is configured through the engineering interface rather than C scripting. The PAS-specific function calls in this article remain valid for SICAM PAS CC V5.00 / V5.10 and WinCC V6.0 SP4 projects.

Prerequisites

  1. SICAM PAS CC V5.00 or V5.10 runtime installed and licensed on the HMI station, with the PAS CC – Configuration add-on.
  2. WinCC V6.0 SP4 (or compatible SP5) development environment with a project connected to the same PAS database.
  3. IEC 61850 IED data model already imported via SCL/ICD file; the controlled breaker logical node is exposed (e.g., CB_1 with Pos controllable double point and XCBR status).
  4. The internal tag pointing to the command object exists in WinCC and is bound to the IEC 61850 data attribute Pos.ctlVal of the DPC instance. Verify with PAS UI Configuration → Tag Browser.
  5. WinCC Global Script C editor enabled (Project Properties → Options → "Global Script Runtime" / "C-Script").
  6. User authorization class with rights Operation – Switching assigned, otherwise the command is rejected by PAS security with qualifier object-not-selected.
Safety: The command will issue an actual Operate against the substation IED. Use the PAS "Test Mode" tag qualifier and a simulated IEC 61850 server (e.g., IEDScout) during development. The procedure below is written for normal production runtime.

IEC 61850 Control Object Reference

Element IEC 61850 Type ID CDC Functional Constraint Used For
C_DC_NA_1 46 DPC – Double Point Controllable CO (Control) On / Off command (00 intermediate, 01 OFF, 10 ON, 11 Bad-data)
M_SP_TA_1 2 SPS with d (transient) ST (Status) Back-indication (breaker position feedback)
SBO — Operate-Once / SBOes CO Select-Before-Operate first step
Operate — DPC Oper CO Second step that executes the selected command
Cancel — DPC Cancel CO Aborts a pending SBO

Per IEC 61850-7-2 §10.4, the SBO control model requires the client to first send a Select with Check, receive Select-+ with ctlVal mirrored, and then send Operate within the SBO timeout defined by the IED (default 30 s, configurable through Loc.stSeld or the CBOpCap settings).

Command Qualifiers (ctlModel / orCat / SBO)

The qualifier bits placed in ctlVal and the originator category determine which control model the IED will accept. For PAS CC the third parameter of PAS_Command_Integer_V500 encodes both the qualifier (SBO, Operate) and the originator category used for the LastAppAt timestamp.

PAS Qualifier (Param 3) Meaning (IEC 61850-7-2) Typical Use
0 Not used / placeholder Reserved
1 Direct-with-normal-security (single-step) Quick commands, no interlocking check
2 SBO-with-normal-security (select) First step of SBO
3 Direct-with-enhanced-security Single-step with enhanced security
4 SBO-with-enhanced-security (select) First step of SBO, enhanced
10 / 12 Operate (normal) Second step of SBO
14 Operate-with-enhanced-security Second step of SBO, enhanced (PAS common value)

The fourth parameter is the originator category (orCat) used for the Last-Application-At timestamp; in PAS the value 0 = not-supported, 1 = bay-control, 2 = station-control, 3 = remote-control, 4 = automatic-station, 5 = automatic-remote, 6 = maintenance, 7 = process. Use 2 for an HMI operator.

PAS_Command_Integer_V500 Function Reference

Function prototype exposed by SICAM PAS CC to the WinCC Global Script C runtime:

long PAS_Command_Integer_V500(
    LPCTSTR szTagName,
    long    nCommandValue,
    long    nCommandQualifier,
    long    nCheckFlag
);
Parameter Type Description
szTagName LPCTSTR Fully qualified WinCC tag name including the ".Value" property. Example: "CB1_Pos_ctlVal.Value".
nCommandValue long For DPC: 0 = intermediate, 1 = OFF, 2 = ON, 3 = bad-data. For SBO select first step: typically 0 (no real value, the IED accepts the SBO reservation).
nCommandQualifier long Encoded qualifier / SBO state. See table above.
nCheckFlag long 0 = normal command, 1 = set originator from extra parameter, 2 = set timestamp, 4 = forced, 8 = blocked-by-PAS — values may be OR-combined in some PAS builds.
Return long 0 = success, negative = internal error, positive IEC 61850 AddCause (e.g., 1 = object-not-selected, 11 = blocked-by-switching-hierarchy).

Step-by-Step WinCC Button Configuration

Step 1 – Place the Button Object

  1. In the WinCC Graphics Designer, open the picture that represents the single-line diagram of the bay.
  2. Insert a new Button object from the standard palette (Object Palette → Windows Objects → Button).
  3. Set the caption to e.g. CB1 – ON. Duplicate the button for the OFF command.
  4. Note the configured Object Name (default: Button1, Button2) – required by the C action.

Step 2 – Bind the Status Indication Tag

  1. Open the Property dialog of the button and select the Background Color or Flashing attribute.
  2. Bind it to the internal tag that mirrors the IEC 61850 data object CB1_Pos_stVal (the value reported by the breaker auxiliary contact via the DPC stVal).
  3. Typical mapping: 0 = intermediate (gray), 1 = OFF (green), 2 = ON (red), 3 = bad-data (yellow flash).

Step 3 – Add a Mouse-Click C Action

  1. Select the ON button → Properties → Events → Mouse → Mouse Action (or "Mouse Click").
  2. Choose "C-Action" instead of "Direct" or "Dynamic Dialog".
  3. Paste the following C code. Replace CB1_Pos_ctlVal with your real tag name (right-click on the tag in the WinCC Tag Management and select "Copy Tag Name").
// ----- SBO SELECT (first step) -----
long lRet;
lRet = PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 0, 4, 0);
if (lRet != 0)
{
    // Select failed, do not proceed
    printf("SBO Select failed, AddCause = %ld\r\n", lRet);
    return;
}
// ----- OPERATE (second step) -----
lRet = PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 2, 14, 0);
if (lRet != 0)
{
    printf("Operate ON failed, AddCause = %ld\r\n", lRet);
}

For the OFF button, change the second call to command value 1:

lRet = PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 1, 14, 0);

Step 4 – Single-Step Variant (Direct-with-Normal-Security)

Some simple IEDs (e.g., a SIPROCESS busbar) accept the old "single-step" control model. In that case, replace the two calls with a single call:

// ON
PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 2, 3, 0);
// OFF
PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 1, 3, 0);

Qualifier 3 = direct-with-enhanced-security. The SBO first step is not required.

Step 5 – Add the Cancel Button (Optional)

During commissioning it is common to expose a Cancel button that aborts a pending SBO. PAS does not expose a dedicated PAS_CancelCommand; instead send an Operate with ctlVal=0 and qualifier 11:

PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 0, 11, 0); // Cancel

Step 6 – Confirmation Dialog and Authorization

  1. Right-click the ON button → Properties → Events → Mouse Action and prepend a call to SSMGetLevel / PWRTCheckPermission to verify the operator class.
  2. If authorization is insufficient, return before calling PAS_Command_Integer_V500 and pop a message box via MessageBox (C runtime).

Verification and Commissioning

  1. Compile the C action (Graphics Designer → File → Compile → C-Actions). The output window must show 0 errors, 0 warnings. If you see unresolved external for PAS_Command_Integer_V500, the PAS header is missing; in the C-Editor settings add %PAS_PATH%\include and link against PAScmd.lib.
  2. Activate WinCC Runtime. Open the picture; the status field should reflect the current stVal from M_SP_TA_1 / DPC.stVal.
  3. Click the ON button. Within 1 s the breaker should close. The internal stVal of the DPC object becomes 2 (ON).
  4. Click the OFF button. Breaker opens, stVal becomes 1 (OFF).
  5. Verify the SBO timeout: do Select only (i.e., simulate a single call with qualifier 4) and wait 35 s. The IED will release the reservation; the next Operate will return AddCause object-not-selected (1).
  6. Open the PAS Message List and confirm a Command Operation entry with the configured orCat and orIdent.

Mapping Table – IEC 61850 ↔ PAS Function Call

Operator Action MMS Service (61850-8-1) PAS Qualifier (Param 3) ctlVal (Param 2) Behavior
Click ON – Step 1 SelectWithValue (SBOes) 4 0 (or 2) Reserves the controllable object
Click ON – Step 2 Operate 14 2 Closes breaker
Click OFF – Step 1 SelectWithValue (SBOes) 4 0 (or 1) Reserves the controllable object
Click OFF – Step 2 Operate 14 1 Opens breaker
Cancel Cancel 11 0 Releases SBO
Direct ON (no SBO) Operate 3 2 Single-step close
Direct OFF (no SBO) Operate 3 1 Single-step open

Troubleshooting Matrix

Symptom Likely Cause Corrective Action
Function returns 1 ("object-not-selected") Operate issued without prior Select, or SBO timeout elapsed Ensure qualifier sequence 4 → 14; keep the time between calls < SBO timeout
Function returns 11 ("blocked-by-switching-hierarchy") Authorization class too low or another operator holds the tag Check PAS user management and tag reservation list
Function returns -17 (linker error) C-Action compiled in WinCC script editor without PAS header Add %PAS_HOME%\include to include path; relink
Breaker does not move but no error IEC 61850 subscription not active on WinCC side; the command goes to the IED but the status update is delayed Verify Pos.stVal update via PAS data inspector
CtlModel = 0 in IED Control model is configured to status-only Change the IED configuration to CtlModel = 2 (SBOes) or 4 (Direct)
AddCause = 27 ("interlocking-error") Bay-level interlock blocks the operation Check SICAM PAS interlocks or IED local interlock logic
Stale back-indication after operation M_SP_TA_1 reported with q.validity=0 Inspect MMS Report dataset and quality flags
Tag value jumps to 3 (bad-data) immediately IED reports intermediate state during operation Use DPC stSeld for stateful interlock visualization

Migrating to WinCC Unified (TIA Portal V20)

If the same functionality must be reproduced in a modern TIA Portal project, the C scripting layer is replaced by the WinCC Unified Button object. Configuration steps:

  1. Insert a Button in the Unified screen.
  2. Open Properties → Events → Click.
  3. Add a system function or JavaScript action that calls the IEC 60870-5-104 / IEC 61850 command function block exposed by the HMI tag connection.
  4. Under Security define the required operator authorization level.

The conceptual mapping is identical: Click → SelectWithValue → Operate, with the same ctlVal encoding (0/1/2/3) and the same AddCause handling. The Unified runtime exposes the AddCause code in the system tag LastError of the command connection.

Field-Proven Cautions

  • Always re-issue a Select before Operate; do not rely on the IED retaining the SBO reservation across long script sequences (network round-trip, GC pause, etc.).
  • Do not embed MessageBox in the same C-action that fires the command – it can stall the MMS thread and cause PAS to drop the report. Use a separate trigger tag to flash an alarm on failure.
  • When two operators click simultaneously, PAS arbitrates via the tag reservation mechanism. The losing client receives AddCause object-already-selected (10).
  • Configure cbOpCap.stSeld visualization on the button to show whether a tag is currently selected – this prevents ambiguous operation.
  • In multi-monitor stations, scope the tag name to the project prefix; the same picture opened on a redundant server may otherwise use the wrong tag.

Glossary of Acronyms

Term Expansion
DPC Double Point Controllable (CDC for ON/OFF commands)
SPS Single Point Status (CDC for binary status)
SBO Select-Before-Operate (IEC 61850-7-2 control model)
SBOes SBO with Enhanced Security
orCat Originator Category
AddCause Additional Cause diagnostic value returned by the IED
PAS Power Automation System (Siemens SICAM PAS)
CC Configuration Component (PAS CC = control center configuration)
MMS Manufacturing Message Specification (transport for IEC 61850-8-1)

Which IEC 61850 function qualifier must I pass to PAS_Command_Integer_V500 for an SBO close command?

Use qualifier 4 for the Select step and qualifier 14 for the Operate step. The ctlVal argument is 2 for ON and 1 for OFF. The fourth parameter is the originator category (e.g., 2 for station control).

What is the difference between C_DC_NA_1 (type 46) and M_SP_TA_1 (type 2)?

C_DC_NA_1 is a controllable double-point command object used to drive the breaker (CDC DPC). M_SP_TA_1 is a single-point status object with a transient detection bit used as the back-indication (CDC SPS with d quality). They share the same logical node but belong to different Functional Constraints (CO vs ST).

Why does my command return AddCause 1 (object-not-selected)?

The IED never received the SBO Select step, or the SBO timeout (default 30 s) elapsed before the Operate was issued. Verify that the first call uses qualifier 4 and that the second call follows within the IED's SBO timeout. Add a small delay (200-500 ms) between the two calls if the network is slow.

Can I issue a single-step direct command without SBO?

Yes. Use qualifier 3 (direct-with-enhanced-security) and pass ctlVal 2 for ON or 1 for OFF in a single call. Only do this if the IED's ctlModel attribute is set to 3 or 4; otherwise the command is rejected with AddCause control-model-incompatible.

How do I reproduce this configuration in WinCC Unified TIA Portal V20?

Add a Button object to the Unified screen, attach a Click event that calls the IEC 61850 command script function exposed by the tag connection, and pass the same qualifier and ctlVal mapping. Configure operator authorization in the button's Security property. The C-script version of PAS_Command_Integer_V500 is replaced by the Unified JavaScript API, but the conceptual sequence (Select → Operate) is unchanged. See the Siemens WinCC Unified Button documentation for the exact API surface.

Back to blog