Connecting SIPROTEC 4 7SJ6 Relays to WinCC via IEC 61850

Overview

Siemens SIPROTEC 4 7SJ6 multi-function overcurrent/distance protection relays are widely deployed in medium-voltage switchgear and almost always ship with an EN100 Ethernet communication module that supports IEC 61850 (in parallel with optional Profibus DP, DNP3, Modbus, or IEC 60870-5-103). Field crews typically want a touch screen HMI at the switchgear front or in a remote control room so electricians can open and close breakers through the relay's control model from a safe distance rather than walking up to a cubicle.

This reference covers three viable architectures to bring a touch screen into the 7SJ6 control loop:

1. Direct WinCC ↔ 7SJ6 over IEC 61850 using an OPC bridge (e.g., Siemens S7-OPC RedConnect or third-party 61850 stack such as substationGate / KEPServerEX IEC 61850 driver).
2. PLC gateway — an S7-300/S7-400/S7-1500 acts as IEC 61850 client using the S7-61850 Client Library (FB / DB blocks), exposes tags to a WinCC Comfort/Advanced Runtime over S7-MPI/TCP, and the HMI reads/writes those tags.
3. Profibus DP fallback (legacy 7SJ6 builds that have not had EN100 retrofitted) using the on-board Profibus DP port and the WinCC Profibus DP driver — not strictly 61850 but historically the fastest path.

Throughout, the assumption is that a control authority / SBO (Select-Before-Operate) model is enforced so the operator cannot pulse-close a breaker that is currently being synchronised or is in a lockout condition.

SIPROTEC 4 7SJ6 Hardware and Protocol Baseline

The 7SJ6 family (7SJ62 / 7SJ63 / 7SJ64) uses the SIPROTEC 4 firmware platform, configured with DIGSI 4 (the engineering tool) and parameterised off-line. Communication is a function of the plug-in module in the relay's slot C/D:

Verify the actual module by reading the order code (MLFB) on the relay nameplate or in DIGSI under Device → Properties → Communication. The firmware must be at a level that supports the IEC 61850 edition in your IED configurator — SIPROTEC 4 7SJ6 typically supports IEC 61850 Edition 1 with Edition 2 compatibility flags depending on firmware; check the Siemens Industry Online Support portal for the matching IID/CID file and DIGSI 4 version for the device's MLFB.

IEC 61850 Data Model inside the 7SJ6

For the HMI to do anything meaningful, you must know which Logical Nodes (LNs) and Data Objects (DOs) the relay exposes. The mandatory nodes for protection / control per IEC 61850-7-4 are:

The 7SJ6 with EN100 publishes a fixed ICD/CID file that lists every DO, its FC (Functional Constraint — ST, MX, CO, SP, SE, CF), and its CDC (Common Data Class). Control objects use FC = CO with the CDC DPS or ENC, and the relay enforces the standard SBO / DOns / Cancel sequences defined in IEC 61850-7-2 (ACSI).

Architecture Option 1 — Direct WinCC ↔ 7SJ6 over 61850 (via OPC)

WinCC Comfort / WinCC Advanced / WinCC Professional (TIA) do not include a native IEC 61850 client driver. The pragmatic solution is to put a thin OPC DA / OPC UA server in the middle that speaks 61850 to the relay and OPC DA/UA to the HMI. The two production-grade stacks are:

• Siemens S7-OPC RedConnect (ships with STEP 7 / S7-PCT) — historically used for S7 PLCs but will tunnel any 61850-capable device's MMS traffic if configured as a generic MMS peer.
• Third-party IEC 61850 OPC bridge — examples include substationGate from Softing, 6155-OPC, or MatrikonOPC IEC 61850. These import the relay's SCL (ICD/CID) file and expose every DO as an OPC tag.

Wiring

Procedure

1. Import the relay's .icd / .cid into the OPC server. The 7SJ6 ships its IID on the product CD or download from Siemens IOS by searching the MLFB.
2. Set IEDName = PROT1 (or whatever matches DIGSI 4) and bind it to IP 192.168.10.11.
3. Expose PROT1/PROT/CSWI1$CO$Pos$ctlVal and the matching stVal as separate OPC tags.
4. In WinCC (TIA or V7.x), add the OPC channel, browse the server, and drag the tags onto the touch screen objects.
5. Wire the Open / Close buttons to write the ctlVal tag. The OPC server is responsible for the SBO handshake (Select → Operate-with-Privilege).

Architecture Option 2 — PLC Gateway (S7-1500/300 with IEC 61850 Client Library)

The more common and far more flexible path is to use a Siemens PLC as the 61850 client and the WinCC panel as a thin S7 client. The reasons are:

• The HMI gets exactly the data set the SCADA engineer mapped, in a known S7 tag format.
• Interlocking, mode-permissives, and SBO can be handled in PLC code rather than being delegated to a black-box OPC bridge.
• The same PLC can later expose the data to a higher-level WinCC server or PCS 7 via S7 / OPC UA, without touching the relay side.

Required software

Network diagram

PLC configuration steps (TIA Portal)

1. Install the S7-61850 option package (Optional Packages → IEC 61850 Client).
2. Add the 7SJ6 as an IEC 61850 station: Devices & Networks → Add device → Other field devices → IEC 61850 station. Browse the ICD/CID; the 61850 client library creates a typed interface for every DO.
3. Wire the relevant DOs to a process image DB. Typical mapping:

4. Implement the SBO sequence in ladder or SCL. A minimal pattern in SCL:

// Select branch breaker (rising edge of "Sel")
IF SelEdge AND NOT Lockout THEN
    iRet := IEC61850_SBOw(
        sIPAddr   := '192.168.10.11',
        sLDInst   := 'PROT1',
        sLNInst   := 'CSWI1',
        sDOName   := 'Pos',
        sFCC      := 'CO',
        ctlVal    := FALSE,           // no value at Select
        ctlNum    := LOCAL_CTL_NUM,   // 0 = config-defined, otherwise 0..255
        tTimeout  := T#30S);
END_IF;

// Operate (rising edge of "Open" or "Close")
IF OpenEdge THEN
    iRet := IEC61850_Operate(
        sLDInst := 'PROT1',
        sLNInst := 'CSWI1',
        sDOName := 'Pos',
        ctlVal  := FALSE);   // FALSE = open, TRUE = close (DPS encoding)
END_IF;

5. In the WinCC project, add the S7-1500 as the HMI's only connection, and the touch-screen variables become ordinary HMI tags pointing at DB100.

Architecture Option 3 — Profibus DP Fallback

For older switchgear where fitting an EN100 module is not feasible, the 7SJ6 exposes a Profibus DP slave interface. In WinCC you can use the Profibus DP driver on a CP5611/CP5613 card in the engineering PC, but the practical realisation is almost always PLC + Profibus DP master + WinCC S7 connection, not WinCC direct. Profibus DP gives fast, deterministic messaging but does not carry the IEC 61850 SBO model — the application has to enforce SBO in code, including timeouts and Cancel-on-loss-of-Select. Use this path only when the EN100 retrofit is impossible.

Mandatory Configuration in DIGSI 4

Before any of the three paths will work, the relay itself must be told to publish the control points:

1. Open the project in DIGSI 4 → double-click the 7SJ6 → Parameters → Communication.
2. Enable the EN100 module and assign an IP, mask, and gateway. Note: the 7SJ6 only supports 100 Mbit, full-duplex.
3. Open Mapping → IEC 61850 and check that the following data points are mapped to the appropriate LNs:

4. Configure the Control Model per data object. For every CO object: Control model = SBO with enhanced security, Check the interlocking-check and synchrocheck flags where applicable.
5. Export the configuration. In DIGSI 4: Device → Export → IEC 61850 → SCL (ICD/IID). Hand the resulting file to the OPC server engineer or to the PLC 61850 client importer.

Touch Screen Selection

For the HMI itself, Siemens offers two ergonomic families suited to switchgear rooms:

For reference designs of relays with built-in touch for bay control, see the SEL-751 Feeder Protection Relay product page, or the Eaton E-Series IEC 61850 / GOOSE relays — both include integrated one-line mimic displays that can shorten the integration effort if you are open to a non-Siemens primary.

Verification and Commissioning

After configuration, run the following acceptance test before going live with operators:

1. Connectivity — ping the 7SJ6 EN100 IP; from the PLC, read the LPHD1$ST$PhyHealth$stVal (= 1 means OK, 2 means warning, 3 means alarm).
2. Data read — verify MMXU1$MX$A$phsA and XCBR1.Pos.stVal update in the WinCC tag list at the configured report rate (typical 1000 ms).
3. SBO handshake — with the breaker open, perform Select from the HMI, confirm the relay accepts (ctlNum returns non-zero), then issue Operate (close) and verify the breaker actually closes within 1 s and XCBR1.Pos.stVal transitions to 10 (closed).
4. Interlock — force CILO1.EnaCls = 0 in DIGSI and confirm the close command is rejected with the standard Object-access-violation service error.
5. Loss-of-comms — disconnect the Ethernet cable mid-sequence. The PLC should time out the SBO (30 s) and issue a Cancel; the WinCC faceplate must show "Communication fault" and disarm the buttons.
6. GOOSE sanity — if you also subscribe to PIOC1$GO$Trip for a downstream breaker fail initiator, capture a Wireshark trace on the EN100 port to confirm the GOOSE frame with goCBRef matching the relay. Practical GOOSE timing verification procedures are documented in academic / industry references such as the paper "Transfer time measurement for protection relay applications with the IEC 61850 standard".

Troubleshooting Matrix

For background on how 61850 maps onto a typical utility network and what a relay technician should know about the protocol, the Doble "Looking at IEC 61850, Part 1" article is a useful, vendor-neutral overview.

Safety & Operational Considerations

• Maintain the SBO model. Never drive the relay with a direct Operate from the HMI. The Select step is what allows the relay to reserve the breaker and reject conflicting commands from a parallel SCADA master.
• Separate the protection from the control network. The 7SJ6 EN100 is dual-homed only on specific variants; do not route GOOSE multicast onto the same VLAN as the WinCC operator traffic unless a managed switch with IGMP snooping and proper VLAN segmentation is in place.
• Record all operator commands. Enable the relay's Sequence of Events (SOE) buffer and forward SOE to WinCC; without it, an unexplained trip cannot be attributed.
• Test with the actual protection scheme running. A close command to a bus-coupler while the bus is faulted will likely be blocked by the relay's synchrocheck — but verify, do not assume.
• Document the firmware of every relay, OPC server, and panel; this is the only way to reproduce a control failure six months later.

Frequently Asked Questions