Implementing IEC 60870-5-103 Master on S7-300 with SIPLUS RIC

IEC 60870-5-103 and SIMATIC S7 Integration Overview

IEC 60870-5-103 is the protection-equipment companion standard of the IEC 60870-5 telecontrol family, defined for asynchronous, serial communication between a substation control system and protection Intelligent Electronic Devices (IEDs) such as the Siemens 7SR11 series. It sits between IEC 60870-5-101 (basic telecontrol over serial) and IEC 60870-5-104 (networked telecontrol over TCP/IP). Typical substation traffic carried by 60870-5-103 includes:

• Protection start and trip events (ASDU type 1, 2)
• Measurands in real-time (ASDU type 3, 4)
• General Interrogation responses (ASDU type 8, 9)
• Time synchronisation (ASDU type 6)
• Generic classified and unclassified status data (ASDU type 10)
• Command telegrams (ASDU type 20, 21, 22, 30)

For a control room, 7SR11 relays from the Reyrolle line are commonly polled by either a substation HMI/RTU or a SIMATIC-based master. Because 60870-5-103 is not a stock point-to-point protocol in the SIMATIC standard firmware, a SIMATIC S7-300 or S7-400 CPU must be ordered as part of a SIPLUS RIC bundle to acquire the master stack.

Native S7-300 and S7-400 Protocol Limitations

Standard S7-300 and S7-400 CPUs do not include any IEC 60870-5 protocol stack in the operating system. The standard CP 341 (RS232/422/485) and CP 441 (multi-channel serial) communication processors ship with ASCII, 3964(R), Modbus master, Modbus slave, and RK512 drivers, but none of them expose a 60870-5-103 master out of the box. The 60870-5 protocol family belongs to a different product line aimed at telecontrol substations and is delivered as the SIPLUS RIC software library on a special MMC.

For the IEC 60870-5 family on SIMATIC S7, only three master variants are available through the SIPLUS RIC bundles:

• IEC 60870-5-101 - serial, basic telecontrol
• IEC 60870-5-103 - serial, protection equipment
• IEC 60870-5-104 - TCP/IP, networked telecontrol

Per the Siemens support article 109421529 on implementing IEC 60870-5 with S7-300, the SIPLUS RIC libraries are required to expose any of the three protocol variants. This applies equally to a stand-alone S7-300 acting as a telecontrol outstation and to a SIMATIC S7-300 acting as a master to third-party IEDs.

SIPLUS RIC Bundle Architecture

A SIPLUS RIC bundle is a pre-matched kit that delivers the CPU, the SIPLUS RIC MMC carrying the IEC 60870-5-103 master runtime, the SIMATIC CP 341 serial interface, and the SIPLUS RIC program block library under a single order number. Because the runtime is MMC-resident, the bundle guarantees that the firmware, the CP 341 parameter set, and the FBs / FCs / DBs in the SIMATIC project are all aligned to the same V1.5 release of the protocol stack.

Bundle Components

• SIMATIC CPU 31x-2PN/DP (314, 315, 317, or 319) - master CPU, executes the IEC 60870-5-103 master FB
• SIPLUS RIC MMC - 128 KB (or larger, depending on data point count) with the V1.5 runtime and licence
• SIMATIC CP 341 - RS422/RS485 serial communication processor; one per physical IEC 103 line
• SIPLUS RIC program block library - FBs, FCs, UDTs, and a parameter DB template installed in STEP 7 / SIMATIC Manager

The library is compatible with all mutually compatible SIMATIC S7-300 CPU types listed in the bundle matrix, which keeps spare-parts logistics simple in a substation where 7SR11 relays are deployed.

CPU Selection and Data Point Capacity

The SIPLUS RIC IEC 60870-5-103 bundle is offered with four CPU options. The data point count refers to the number of binary or analogue process values that the master can hold in its process image and exchange with the IEDs.

The example part number from the SIPLUS RIC IEC 60870-5-103 family, 6AG6 003-1AC02-6CA0, ships with a CPU 315-2 PN, 128 KB MMC, and a CP 341. The CPU and the CP 341 communicate over the S7-300 backplane; the CP 341 is the only component connected to the IEC 103 RS485 trunk.

CP 341 Serial Interface Configuration

The CP 341 is the physical layer for IEC 60870-5-103. Configure the CP 341 in HW Config for the protocol driver slot used by the SIPLUS RIC library. The driver is loaded from the SIPLUS RIC software, not from the standard CP 341 parameter assignment tool.

Key CP 341 parameters for an IEC 103 multi-drop RS485 line:

• Interface type: RS422 / RS485, 4-wire full-duplex or 2-wire half-duplex
• Baud rate: 9 600 bit/s is the 60870-5-103 default; 19 200 is selectable when the IED supports it
• Character frame: 8E1 (8 data bits, even parity, 1 stop bit)
• Link layer: IEC 60870-5-103 master, fixed link address 255 (the master)
• Time-tag resolution: 10 ms per IEC 60870-5-103 chapter 6

The master always uses link address 255. Each 7SR11 IED on the trunk is given a unique link address in the range 1 to 254 and is addressed in all class-1 (spontaneous) and class-2 (GI, time sync, command) traffic. Termination resistors and line bias must follow IEC 60870-5-103, and stubs should be kept under 10 m to limit reflection at 9 600 bit/s.

ASDU and Link Address Mapping (Parameter DB)

Per chapter 4.1.2 ("ASDU-Address Parameter-DB") of the SIPLUS RIC IEC 60870-5-103 Master V1.5 functional description, the parameter DB is where the application engineer declares which link address (IED) and which ASDU address (data point group inside that IED) participate in cyclic exchange.

Excerpt of the parameter DB structure (DB200 example):

DATA_BLOCK DB 200
TITLE = IEC60870-5-103 Parameter DB
STRUCT
  LinkAddr  : BYTE;   // IED link address (1..254)
  AsduAddr  : WORD;   // ASDU address inside the IED
  PiOffset  : INT;    // Offset in process image
  PiType    : BYTE;   // 0=M_SP, 1=M_DP, 2=M_ME_NC ...
  Class     : BYTE;   // 0=class1 only, 1=GI, 2=both
END_STRUCT
BEGIN
  // IED 1, ASDU 100, binary status @ PIW 0
  LinkAddr := 1;
  AsduAddr := 100;
  PiOffset := 0;
  PiType   := 0;
  Class    := 2;
END_DATA_BLOCK

System-related, the maximum number of link and ASDU addresses is limited only by the DB length (the parameter DB is laid out in work memory). Up to 8 link and ASDU addresses have been tested in V1.5; field deployments above 8 are at the integrator's own responsibility.

Multi-IED Network Architecture for 24-Device Substations

Where a substation has 24 IEDs (for example, 24 bays each with its own 7SR11), the 8-tested-link-address ceiling has to be addressed architecturally. Three common patterns are field-proven:

1. Multiple master S7-300 stations - three SIPLUS RIC masters, each polling up to 8 IEDs through its own CP 341 on its own RS485 trunk, and forwarding the consolidated process image to a SIMATIC PCS 7 or WinCC control centre via PROFINET or Industrial Ethernet.
2. Multiple CP 341 cards in one S7-300 - extend the rack with up to four CP 341 modules, each driving its own RS485 trunk of up to 8 IEDs. The 317 or 319 CPU is required to handle the data point and FB count.
3. Protocol change - replace 103 with 104 (TCP/IP) or migrate the 7SR11 fleet to IEC 61850 MMS, removing the serial trunk limit entirely. This is preferred for new-build but not always possible on brown-field relays.

Topology for option 2 (single master, four CP 341 trunks):

For a 24-bay substation on a single IEC 103 trunk, the polling cycle time must be budgeted. With 8 IEDs and a 50 ms class-1 poll period, the master can keep latency under 400 ms. Beyond 8 IEDs, the master must either drop to slower class-1 polling or split the trunk.

STEP 7 / SIMATIC Manager Configuration Sequence

1. Open SIMATIC Manager with the SIPLUS RIC V1.5 library installed under "SIPLUS RIC IEC 60870-5-103 Master".
2. Insert a new S7-300 station, drag in the CPU from the SIPLUS RIC bundle order number (e.g. 6AG6 003-1AC02-6CA0) to inherit the correct firmware and CP assignment.
3. Open HW Config. Slot the CP 341 in slot 4 to slot 11 of the S7-300 rack. Configure the interface as RS422/485, 9 600 bit/s, 8E1.
4. Insert the SIPLUS RIC driver into the CP 341 (Properties > Protocol > Load Driver). The driver name is shipped with the MMC; do NOT use the standard Modbus driver.
5. Create the parameter DB (DB200 in the example) following chapter 4.1.2 of the functional description. Populate one record per IED per ASDU group.
6. Insert OB1, OB82, OB85, OB100. The SIPLUS RIC master FB is called from OB1. OB100 handles a full re-initialisation on restart.
7. Wire the SIPLUS RIC master FB (FB200-class) with the CP 341 hardware identifier (HW_ID from the CP 341's HW Config tab) and the parameter DB number.
8. Compile, download the project, and perform a SIPLUS RIC cold start. The CP 341 sends a "Reset of process link" command (cause of transmission = 9) to each IED on first scan.

Data Buffering and Non-Retain Memory

The SIPLUS RIC runtime can use the CPU's non-retain (work) memory as a buffer for incoming class-1 message frames. On a transient RS485 disturbance or a CP 341 restart, the master retains the queued spontaneous events in non-retain memory and flushes them once the link is re-established. This is critical for substation applications because IEC 103 events are time-tagged at the IED and must arrive at the control centre in correct chronological order even after a 10 to 30 second communication drop.

Enable non-retain buffering in the parameter DB (bit UseNonRetainBuffer := 1) and size the buffer to the expected worst-case event burst. A typical setting for a 12-bay MV substation is 4 096 bytes of non-retain, which absorbs roughly 1 000 spontaneous events with 10 ms time tags.

Interoperability and Vendor IED Compatibility

Siemens publishes the "SIPLUS RIC IEC on S7 Interoperability list IEC 60870-5-103 Master V1.5", which lists the third-party IEDs that have been conformance-tested against the V1.5 master. Before commissioning, check whether the 7SR11 firmware version in use is on the list. Key fields in the interoperability list:

If the IED firmware is newer than the tested version, contact Siemens Industry Online Support for an updated list. The SIPLUS RIC master is conservative on unknown ASDUs and discards them with an internal error counter increment; this is logged in the diagnostic buffer of the CPU.

PCS 7 TeleControl vs WinCC Integration Paths

For 25 IEDs (or a comparable mid-sized substation), two integration paths are common:

• PCS 7 TeleControl - The PCS 7 telecontrol library wraps the SIPLUS RIC master and exposes 60870-5-103 data to the PCS 7 operator system through a WinCC faceplate. Suitable if the substation is part of a larger PCS 7 plant.
• WinCC OA / WinCC 7.x with the SIPLUS RIC library - A stand-alone WinCC project can call the same SIPLUS RIC blocks directly. The integrator writes a custom mapping from the parameter DB to the WinCC tag database. Suitable for substation-only HMI projects without PCS 7.

For 25 IEDs, PCS 7 TeleControl is generally preferred because the time-tagged event handling, the archive layout, and the GI synchronisation are already wired. A stand-alone WinCC project is only competitive when the project budget is constrained and the user accepts a custom S7-300 / WinCC mapping.

Scaling, Limitations, and Field-Commissioned Caveats

• Link-address ceiling - V1.5 has been tested up to 8 link addresses per master. Beyond 8, integrate a second CP 341 or a second master PLC.
• Polling latency - 8 IEDs at 9 600 bit/s, with 50 ms class-1 polls, fit in approximately 400 ms. For 16 IEDs the budget doubles; budget the GI window accordingly.
• Non-retain battery - if the S7-300 is operated without a backup battery, the non-retain buffer is lost on power down. For buffered substation events, install the battery in the CPU and verify it during FAT.
• CP 341 hot-swap - the SIPLUS RIC driver is hot-plug sensitive. After a CP 341 hot-swap the master FB goes into reconnect and sends a "Reset of process link" (cause of transmission = 9) on re-establishment.
• Time synchronisation - 60870-5-103 supports both master-slave and IED-internal time. Pick one consistent strategy across the substation to avoid time-tag drift between bays.
• Termination - RS485 stubs beyond 10 m at 9 600 bit/s cause frame errors. Use daisy-chained topology with termination only at the two ends.
• Bundle firmware lock - the SIPLUS RIC MMC is matched to a specific CPU firmware. Mixing a V1.5 RIC MMC with a CPU FW newer than the validated range causes the runtime to refuse to start.

Verification and Diagnostics

1. From a serial-line analyser on the trunk, confirm the master is sending FCB toggles and that the IEDs ACK correctly.
2. Force a General Interrogation (GI) via the SIPLUS RIC diagnostic block and verify that all configured ASDUs return ASDU type 8/9 with cause of transmission 20 (GI response).
3. Check the CPU diagnostic buffer for "SIPLUS RIC: link address X timeout" - a sign of a misconfigured CP 341 or a wrong RS485 termination.
4. Verify non-retain buffer fill level through a watch table on the parameter DB; alarms should fire at 80% fill.
5. Inject a transient RS485 break and confirm spontaneous events queue in non-retain memory and are forwarded on reconnection.

Successful verification criteria for a SIPLUS RIC IEC 60870-5-103 V1.5 master are: all configured IEDs in cyclic class-1, GI completes within the agreed window, time-tag drift below 100 ms across the fleet, and zero "link address X timeout" entries in the CPU diagnostic buffer over a 24-hour soak.

FAQ