Overview
This reference explains how to wire a WinCC v6.0 SP4 graphical control button (running on a SICAM PAS CC configuration) to an IEC 61850 circuit breaker logical node using the standard double-command control object C_DC_NA_1 (Common Data Class DPC – Double Point Controllable, type identifier 46) and the single-point status with transient bit M_SP_TA_1 (CDC SPS with d-quality transient detection, type identifier 2). The solution described uses the legacy PAS internal C function PAS_Command_Integer_V500 bound to the Mouse Click event of a WinCC button, together with the IEC 61850 Select-Before-Operate (SBO) two-step control model required by most protection IEDs.
The same conceptual model also applies to the modern Siemens TIA Portal documentation for the WinCC Unified Button object, where the action handler is configured through the engineering interface rather than C scripting. The PAS-specific function calls in this article remain valid for SICAM PAS CC V5.00 / V5.10 and WinCC V6.0 SP4 projects.
Prerequisites
- SICAM PAS CC V5.00 or V5.10 runtime installed and licensed on the HMI station, with the PAS CC – Configuration add-on.
- WinCC V6.0 SP4 (or compatible SP5) development environment with a project connected to the same PAS database.
- IEC 61850 IED data model already imported via SCL/ICD file; the controlled breaker logical node is exposed (e.g.,
CB_1withPoscontrollable double point andXCBRstatus). - The internal tag pointing to the command object exists in WinCC and is bound to the IEC 61850 data attribute
Pos.ctlValof the DPC instance. Verify with PAS UI Configuration → Tag Browser. - WinCC Global Script C editor enabled (Project Properties → Options → "Global Script Runtime" / "C-Script").
- User authorization class with rights Operation – Switching assigned, otherwise the command is rejected by PAS security with qualifier object-not-selected.
Operate against the substation IED. Use the PAS "Test Mode" tag qualifier and a simulated IEC 61850 server (e.g., IEDScout) during development. The procedure below is written for normal production runtime.
IEC 61850 Control Object Reference
| Element | IEC 61850 Type ID | CDC | Functional Constraint | Used For |
|---|---|---|---|---|
C_DC_NA_1 |
46 | DPC – Double Point Controllable | CO (Control) | On / Off command (00 intermediate, 01 OFF, 10 ON, 11 Bad-data) |
M_SP_TA_1 |
2 | SPS with d (transient) |
ST (Status) | Back-indication (breaker position feedback) |
SBO |
— | Operate-Once / SBOes | CO | Select-Before-Operate first step |
Operate |
— | DPC Oper
|
CO | Second step that executes the selected command |
Cancel |
— | DPC Cancel
|
CO | Aborts a pending SBO |
Per IEC 61850-7-2 §10.4, the SBO control model requires the client to first send a Select with Check, receive Select-+ with ctlVal mirrored, and then send Operate within the SBO timeout defined by the IED (default 30 s, configurable through Loc.stSeld or the CBOpCap settings).
Command Qualifiers (ctlModel / orCat / SBO)
The qualifier bits placed in ctlVal and the originator category determine which control model the IED will accept. For PAS CC the third parameter of PAS_Command_Integer_V500 encodes both the qualifier (SBO, Operate) and the originator category used for the LastAppAt timestamp.
| PAS Qualifier (Param 3) | Meaning (IEC 61850-7-2) | Typical Use |
|---|---|---|
| 0 | Not used / placeholder | Reserved |
| 1 | Direct-with-normal-security (single-step) | Quick commands, no interlocking check |
| 2 | SBO-with-normal-security (select) | First step of SBO |
| 3 | Direct-with-enhanced-security | Single-step with enhanced security |
| 4 | SBO-with-enhanced-security (select) | First step of SBO, enhanced |
| 10 / 12 | Operate (normal) | Second step of SBO |
| 14 | Operate-with-enhanced-security | Second step of SBO, enhanced (PAS common value) |
The fourth parameter is the originator category (orCat) used for the Last-Application-At timestamp; in PAS the value 0 = not-supported, 1 = bay-control, 2 = station-control, 3 = remote-control, 4 = automatic-station, 5 = automatic-remote, 6 = maintenance, 7 = process. Use 2 for an HMI operator.
PAS_Command_Integer_V500 Function Reference
Function prototype exposed by SICAM PAS CC to the WinCC Global Script C runtime:
long PAS_Command_Integer_V500(
LPCTSTR szTagName,
long nCommandValue,
long nCommandQualifier,
long nCheckFlag
);
| Parameter | Type | Description |
|---|---|---|
szTagName |
LPCTSTR | Fully qualified WinCC tag name including the ".Value" property. Example: "CB1_Pos_ctlVal.Value". |
nCommandValue |
long | For DPC: 0 = intermediate, 1 = OFF, 2 = ON, 3 = bad-data. For SBO select first step: typically 0 (no real value, the IED accepts the SBO reservation). |
nCommandQualifier |
long | Encoded qualifier / SBO state. See table above. |
nCheckFlag |
long | 0 = normal command, 1 = set originator from extra parameter, 2 = set timestamp, 4 = forced, 8 = blocked-by-PAS — values may be OR-combined in some PAS builds. |
| Return | long | 0 = success, negative = internal error, positive IEC 61850 AddCause (e.g., 1 = object-not-selected, 11 = blocked-by-switching-hierarchy). |
Step-by-Step WinCC Button Configuration
Step 1 – Place the Button Object
- In the WinCC Graphics Designer, open the picture that represents the single-line diagram of the bay.
- Insert a new Button object from the standard palette (Object Palette → Windows Objects → Button).
- Set the caption to e.g.
CB1 – ON. Duplicate the button for the OFF command. - Note the configured Object Name (default:
Button1,Button2) – required by the C action.
Step 2 – Bind the Status Indication Tag
- Open the Property dialog of the button and select the Background Color or Flashing attribute.
- Bind it to the internal tag that mirrors the IEC 61850 data object
CB1_Pos_stVal(the value reported by the breaker auxiliary contact via the DPCstVal). - Typical mapping: 0 = intermediate (gray), 1 = OFF (green), 2 = ON (red), 3 = bad-data (yellow flash).
Step 3 – Add a Mouse-Click C Action
- Select the ON button → Properties → Events → Mouse → Mouse Action (or "Mouse Click").
- Choose "C-Action" instead of "Direct" or "Dynamic Dialog".
- Paste the following C code. Replace
CB1_Pos_ctlValwith your real tag name (right-click on the tag in the WinCC Tag Management and select "Copy Tag Name").
// ----- SBO SELECT (first step) -----
long lRet;
lRet = PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 0, 4, 0);
if (lRet != 0)
{
// Select failed, do not proceed
printf("SBO Select failed, AddCause = %ld\r\n", lRet);
return;
}
// ----- OPERATE (second step) -----
lRet = PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 2, 14, 0);
if (lRet != 0)
{
printf("Operate ON failed, AddCause = %ld\r\n", lRet);
}
For the OFF button, change the second call to command value 1:
lRet = PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 1, 14, 0);
Step 4 – Single-Step Variant (Direct-with-Normal-Security)
Some simple IEDs (e.g., a SIPROCESS busbar) accept the old "single-step" control model. In that case, replace the two calls with a single call:
// ON
PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 2, 3, 0);
// OFF
PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 1, 3, 0);
Qualifier 3 = direct-with-enhanced-security. The SBO first step is not required.
Step 5 – Add the Cancel Button (Optional)
During commissioning it is common to expose a Cancel button that aborts a pending SBO. PAS does not expose a dedicated PAS_CancelCommand; instead send an Operate with ctlVal=0 and qualifier 11:
PAS_Command_Integer_V500("CB1_Pos_ctlVal.Value", 0, 11, 0); // Cancel
Step 6 – Confirmation Dialog and Authorization
- Right-click the ON button → Properties → Events → Mouse Action and prepend a call to
SSMGetLevel/PWRTCheckPermissionto verify the operator class. - If authorization is insufficient, return before calling
PAS_Command_Integer_V500and pop a message box viaMessageBox(C runtime).
Verification and Commissioning
- Compile the C action (Graphics Designer → File → Compile → C-Actions). The output window must show 0 errors, 0 warnings. If you see unresolved external for
PAS_Command_Integer_V500, the PAS header is missing; in the C-Editor settings add%PAS_PATH%\includeand link againstPAScmd.lib. - Activate WinCC Runtime. Open the picture; the status field should reflect the current
stValfromM_SP_TA_1/DPC.stVal. - Click the ON button. Within 1 s the breaker should close. The internal
stValof the DPC object becomes 2 (ON). - Click the OFF button. Breaker opens,
stValbecomes 1 (OFF). - Verify the SBO timeout: do Select only (i.e., simulate a single call with qualifier 4) and wait 35 s. The IED will release the reservation; the next Operate will return AddCause object-not-selected (1).
- Open the PAS Message List and confirm a Command Operation entry with the configured orCat and orIdent.
Mapping Table – IEC 61850 ↔ PAS Function Call
| Operator Action | MMS Service (61850-8-1) | PAS Qualifier (Param 3) | ctlVal (Param 2) | Behavior |
|---|---|---|---|---|
| Click ON – Step 1 | SelectWithValue (SBOes) | 4 | 0 (or 2) | Reserves the controllable object |
| Click ON – Step 2 | Operate | 14 | 2 | Closes breaker |
| Click OFF – Step 1 | SelectWithValue (SBOes) | 4 | 0 (or 1) | Reserves the controllable object |
| Click OFF – Step 2 | Operate | 14 | 1 | Opens breaker |
| Cancel | Cancel | 11 | 0 | Releases SBO |
| Direct ON (no SBO) | Operate | 3 | 2 | Single-step close |
| Direct OFF (no SBO) | Operate | 3 | 1 | Single-step open |
Troubleshooting Matrix
| Symptom | Likely Cause | Corrective Action |
|---|---|---|
| Function returns 1 ("object-not-selected") | Operate issued without prior Select, or SBO timeout elapsed | Ensure qualifier sequence 4 → 14; keep the time between calls < SBO timeout |
| Function returns 11 ("blocked-by-switching-hierarchy") | Authorization class too low or another operator holds the tag | Check PAS user management and tag reservation list |
| Function returns -17 (linker error) | C-Action compiled in WinCC script editor without PAS header | Add %PAS_HOME%\include to include path; relink |
| Breaker does not move but no error | IEC 61850 subscription not active on WinCC side; the command goes to the IED but the status update is delayed | Verify Pos.stVal update via PAS data inspector |
| CtlModel = 0 in IED | Control model is configured to status-only | Change the IED configuration to CtlModel = 2 (SBOes) or 4 (Direct) |
| AddCause = 27 ("interlocking-error") | Bay-level interlock blocks the operation | Check SICAM PAS interlocks or IED local interlock logic |
| Stale back-indication after operation | M_SP_TA_1 reported with q.validity=0
|
Inspect MMS Report dataset and quality flags |
| Tag value jumps to 3 (bad-data) immediately | IED reports intermediate state during operation | Use DPC stSeld for stateful interlock visualization |
Migrating to WinCC Unified (TIA Portal V20)
If the same functionality must be reproduced in a modern TIA Portal project, the C scripting layer is replaced by the WinCC Unified Button object. Configuration steps:
- Insert a Button in the Unified screen.
- Open Properties → Events → Click.
- Add a system function or JavaScript action that calls the IEC 60870-5-104 / IEC 61850 command function block exposed by the HMI tag connection.
- Under Security define the required operator authorization level.
The conceptual mapping is identical: Click → SelectWithValue → Operate, with the same ctlVal encoding (0/1/2/3) and the same AddCause handling. The Unified runtime exposes the AddCause code in the system tag LastError of the command connection.
Field-Proven Cautions
- Always re-issue a Select before Operate; do not rely on the IED retaining the SBO reservation across long script sequences (network round-trip, GC pause, etc.).
- Do not embed
MessageBoxin the same C-action that fires the command – it can stall the MMS thread and cause PAS to drop the report. Use a separate trigger tag to flash an alarm on failure. - When two operators click simultaneously, PAS arbitrates via the tag reservation mechanism. The losing client receives AddCause object-already-selected (10).
- Configure
cbOpCap.stSeldvisualization on the button to show whether a tag is currently selected – this prevents ambiguous operation. - In multi-monitor stations, scope the tag name to the project prefix; the same picture opened on a redundant server may otherwise use the wrong tag.
Glossary of Acronyms
| Term | Expansion |
|---|---|
| DPC | Double Point Controllable (CDC for ON/OFF commands) |
| SPS | Single Point Status (CDC for binary status) |
| SBO | Select-Before-Operate (IEC 61850-7-2 control model) |
| SBOes | SBO with Enhanced Security |
| orCat | Originator Category |
| AddCause | Additional Cause diagnostic value returned by the IED |
| PAS | Power Automation System (Siemens SICAM PAS) |
| CC | Configuration Component (PAS CC = control center configuration) |
| MMS | Manufacturing Message Specification (transport for IEC 61850-8-1) |
Which IEC 61850 function qualifier must I pass to PAS_Command_Integer_V500 for an SBO close command?
Use qualifier 4 for the Select step and qualifier 14 for the Operate step. The ctlVal argument is 2 for ON and 1 for OFF. The fourth parameter is the originator category (e.g., 2 for station control).
What is the difference between C_DC_NA_1 (type 46) and M_SP_TA_1 (type 2)?
C_DC_NA_1 is a controllable double-point command object used to drive the breaker (CDC DPC). M_SP_TA_1 is a single-point status object with a transient detection bit used as the back-indication (CDC SPS with d quality). They share the same logical node but belong to different Functional Constraints (CO vs ST).
Why does my command return AddCause 1 (object-not-selected)?
The IED never received the SBO Select step, or the SBO timeout (default 30 s) elapsed before the Operate was issued. Verify that the first call uses qualifier 4 and that the second call follows within the IED's SBO timeout. Add a small delay (200-500 ms) between the two calls if the network is slow.
Can I issue a single-step direct command without SBO?
Yes. Use qualifier 3 (direct-with-enhanced-security) and pass ctlVal 2 for ON or 1 for OFF in a single call. Only do this if the IED's ctlModel attribute is set to 3 or 4; otherwise the command is rejected with AddCause control-model-incompatible.
How do I reproduce this configuration in WinCC Unified TIA Portal V20?
Add a Button object to the Unified screen, attach a Click event that calls the IEC 61850 command script function exposed by the tag connection, and pass the same qualifier and ctlVal mapping. Configure operator authorization in the button's Security property. The C-script version of PAS_Command_Integer_V500 is replaced by the Unified JavaScript API, but the conceptual sequence (Select → Operate) is unchanged. See the Siemens WinCC Unified Button documentation for the exact API surface.