M580 IEC 61850

QGH11908 12/2018

M580 IEC 61850

BMENOP0300 Module
Installation and Configuration Guide
(Original Document)

12/2018
QGH11908.03

[Link]
 The information provided in this documentation contains general descriptions and/or technical
characteristics of the performance of the products contained herein. This documentation is not
intended as a substitute for and is not to be used for determining suitability or reliability of these
products for specific user applications. It is the duty of any such user or integrator to perform the
appropriate and complete risk analysis, evaluation and testing of the products with respect to the
relevant specific application or use thereof. Neither Schneider Electric nor any of its affiliates or
subsidiaries shall be responsible or liable for misuse of the information contained herein. If you
have any suggestions for improvements or amendments or have found errors in this publication,
please notify us.
You agree not to reproduce, other than for your own personal, noncommercial use, all or part of
this document on any medium whatsoever without permission of Schneider Electric, given in
writing. You also agree not to establish any hypertext links to this document or its content.
Schneider Electric does not grant any right or license for the personal and noncommercial use of
the document or its content, except for a non-exclusive license to consult it on an "as is" basis, at
your own risk. All other rights are reserved.
All pertinent state, regional, and local safety regulations must be observed when installing and
using this product. For reasons of safety and to help ensure compliance with documented system
data, only the manufacturer should perform repairs to components.
When devices are used for applications with technical safety requirements, the relevant
instructions must be followed.
Failure to use Schneider Electric software or approved software with our hardware products may
result in injury, harm, or improper operating results.
Failure to observe this information can result in injury or equipment damage.
© 2018 Schneider Electric. All rights reserved.

2 QGH11908 12/2018
 Table of Contents

Safety Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
About the Book . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Chapter 1 Characteristics of the BMENOP0300 Module. . . . . . . . . 15
BMENOP0300 Module Description . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Communication Specifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Standards and Certifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Chapter 2 Installing the BMENOP0300 Module . . . . . . . . . . . . . . . 25
Mounting an Ethernet Communications Module on the Modicon M580
Rack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Chapter 3 Configuring the BMENOP0300 Module . . . . . . . . . . . . . 27
3.1 Creating a Project in Control Expert . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Creating a Project in Control Expert . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Configuring the Module Name . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.2 Introducing the IEC 61850 Configuration Settings . . . . . . . . . . . . . . . 32
Selecting the IEC 61850 Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Using the Modicon IEC 61850 Configuration Tool . . . . . . . . . . . . . . . 35
General Window . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
3.3 Configuring IP Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Assigning Roles and IP Addresses to Ethernet Ports . . . . . . . . . . . . . 42
Configuring the IP Forwarding Service . . . . . . . . . . . . . . . . . . . . . . . . 45
Network Transparency via IP Forwarding Using One BMENOP0300
Module. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Network Transparency via IP Forwarding Using Multiple
BMENOP0300 Modules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
3.4 Ethernet Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Configuring the Rapid Spanning Tree Protocol . . . . . . . . . . . . . . . . . . 53
Configuring Time Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Configuring the SNMP Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Configuring IP Secure Communications . . . . . . . . . . . . . . . . . . . . . . . 61
Configuring Data Rates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Configuring the Syslog Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
3.5 Uploading and Downloading Configuration Settings . . . . . . . . . . . . . . 72
Uploading and Downloading Configuration Settings . . . . . . . . . . . . . . 72

QGH11908 12/2018 3
 Chapter 4 Configuring the IEC 61850 Server . . . . . . . . . . . . . . . . . . 75
Working with Server Configurations. . . . . . . . . . . . . . . . . . . . . . . . . . . 76
Data Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Instantiating Data Objects and Data Attributes . . . . . . . . . . . . . . . . . . 88
Working with Data Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
Configuring Report Control Blocks. . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Publishing GOOSE Control Blocks . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
Working with SOE Data Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
Subscribing to GOOSE Control Blocks from External References . . . 102
Chapter 5 Configuring the IEC 61850 Client . . . . . . . . . . . . . . . . . . . 105
...................................................... 105
Chapter 6 Working with IEC 61850 Data Objects . . . . . . . . . . . . . . . 111
Mapping Data Attributes to PLC Memory. . . . . . . . . . . . . . . . . . . . . . . 112
Working with IEC 61850 Data Objects. . . . . . . . . . . . . . . . . . . . . . . . . 118
PLC State Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
DDT Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
Working with the BMENOP0300 in a PAC Application . . . . . . . . . . . . 140
Chapter 7 Working With Sequence of Event (SOE) Timestamped
Data Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Configuring SOE events in the IEC 61850 Configuration Tool . . . . . . 148
NOP850_EVTS Elementary Function Block Operations for the
BMENOP0300 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 153
T850_TO_T870 and T870_TO_T850 Elementary Functions for the
BMENOP0300 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157
Chapter 8 Explicit Messaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
8.1 Introduction to Explicit Messaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
About Explicit Messaging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162
8.2 Explicit Messaging Using the DATA_EXCH Block . . . . . . . . . . . . . . . . 163
Configuring Explicit Messaging Using DATA_EXCH . . . . . . . . . . . . . . 164
Configuring the DATA_EXCH Management Parameter. . . . . . . . . . . . 166
8.3 Modbus TCP Explicit Messaging Using DATA_EXCH. . . . . . . . . . . . . 168
Modbus TCP Explicit Messaging Function Codes . . . . . . . . . . . . . . . . 169
Configuring Modbus TCP Explicit Messaging Using DATA_EXCH . . . 170
Modbus TCP Explicit Message Example: Read Register Request . . . 172

4 QGH11908 12/2018
 Chapter 9 Diagnostics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
LED Indicators on the BMENOP0300 Module. . . . . . . . . . . . . . . . . . . 176
Modbus Diagnostic Codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
Modbus Diagnostic Codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 189
IEC 61850 Diagnostic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191
Redundant System Switchover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Dual Network Redundancy Diagnostics . . . . . . . . . . . . . . . . . . . . . . . 196
Chapter 10 Firmware Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Firmware Upgrade. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
Chapter 11 Protocol Conformance . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Statement of Protocol Conformance . . . . . . . . . . . . . . . . . . . . . . . . . . 199
Appendices ......................................... 201
Appendix A Detected Error Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Modbus TCP Explicit Messaging Detected Error Codes . . . . . . . . . . . 204
Explicit Messaging: Communication and Operation Reports . . . . . . . 207
Modbus TCP Explicit Messaging Detected Error Codes . . . . . . . . . . . 210
Appendix B Supported Data Model Items . . . . . . . . . . . . . . . . . . . . . 213
Logical Nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Common Data Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
Glossary ......................................... 225
Index ......................................... 229

QGH11908 12/2018 5
6 QGH11908 12/2018
 Safety Information

Important Information

NOTICE
Read these instructions carefully, and look at the equipment to become familiar with the device
before trying to install, operate, service, or maintain it. The following special messages may appear
throughout this documentation or on the equipment to warn of potential hazards or to call attention
to information that clarifies or simplifies a procedure.

QGH11908 12/2018 7
PLEASE NOTE
Electrical equipment should be installed, operated, serviced, and maintained only by qualified
personnel. No responsibility is assumed by Schneider Electric for any consequences arising out of
the use of this material.
A qualified person is one who has skills and knowledge related to the construction and operation
of electrical equipment and its installation, and has received safety training to recognize and avoid
the hazards involved.

BEFORE YOU BEGIN

Do not use this product on machinery lacking effective point-of-operation guarding. Lack of
effective point-of-operation guarding on a machine can result in serious injury to the operator of
that machine.

WARNING
UNGUARDED EQUIPMENT
 Do not use this software and related automation equipment on equipment which does not have
point-of-operation protection.
 Do not reach into machinery during operation.
Failure to follow these instructions can result in death, serious injury, or equipment damage.

This automation equipment and related software is used to control a variety of industrial processes.
The type or model of automation equipment suitable for each application will vary depending on
factors such as the control function required, degree of protection required, production methods,
unusual conditions, government regulations, etc. In some applications, more than one processor
may be required, as when backup redundancy is needed.
Only you, the user, machine builder or system integrator can be aware of all the conditions and
factors present during setup, operation, and maintenance of the machine and, therefore, can
determine the automation equipment and the related safeties and interlocks which can be properly
used. When selecting automation and control equipment and related software for a particular
application, you should refer to the applicable local and national standards and regulations. The
National Safety Council's Accident Prevention Manual (nationally recognized in the United States
of America) also provides much useful information.
In some applications, such as packaging machinery, additional operator protection such as point-
of-operation guarding must be provided. This is necessary if the operator's hands and other parts
of the body are free to enter the pinch points or other hazardous areas and serious injury can occur.
Software products alone cannot protect an operator from injury. For this reason the software
cannot be substituted for or take the place of point-of-operation protection.
Ensure that appropriate safeties and mechanical/electrical interlocks related to point-of-operation
protection have been installed and are operational before placing the equipment into service. All
interlocks and safeties related to point-of-operation protection must be coordinated with the related
automation equipment and software programming.

8 QGH11908 12/2018
 NOTE: Coordination of safeties and mechanical/electrical interlocks for point-of-operation
protection is outside the scope of the Function Block Library, System User Guide, or other
implementation referenced in this documentation.

START-UP AND TEST

Before using electrical control and automation equipment for regular operation after installation,
the system should be given a start-up test by qualified personnel to verify correct operation of the
equipment. It is important that arrangements for such a check be made and that enough time is
allowed to perform complete and satisfactory testing.

WARNING
EQUIPMENT OPERATION HAZARD
 Verify that all installation and set up procedures have been completed.
 Before operational tests are performed, remove all blocks or other temporary holding means
used for shipment from all component devices.
 Remove tools, meters, and debris from equipment.
Failure to follow these instructions can result in death, serious injury, or equipment damage.

Follow all start-up tests recommended in the equipment documentation. Store all equipment
documentation for future references.
Software testing must be done in both simulated and real environments.
Verify that the completed system is free from all short circuits and temporary grounds that are not
installed according to local regulations (according to the National Electrical Code in the U.S.A, for
instance). If high-potential voltage testing is necessary, follow recommendations in equipment
documentation to prevent accidental equipment damage.
Before energizing equipment:
 Remove tools, meters, and debris from equipment.
 Close the equipment enclosure door.
 Remove all temporary grounds from incoming power lines.
 Perform all start-up tests recommended by the manufacturer.

QGH11908 12/2018 9
OPERATION AND ADJUSTMENTS
The following precautions are from the NEMA Standards Publication ICS 7.1-1995 (English
version prevails):
 Regardless of the care exercised in the design and manufacture of equipment or in the selection
and ratings of components, there are hazards that can be encountered if such equipment is
improperly operated.
 It is sometimes possible to misadjust the equipment and thus produce unsatisfactory or unsafe
operation. Always use the manufacturer’s instructions as a guide for functional adjustments.
Personnel who have access to these adjustments should be familiar with the equipment
manufacturer’s instructions and the machinery used with the electrical equipment.
 Only those operational adjustments actually required by the operator should be accessible to
the operator. Access to other controls should be restricted to prevent unauthorized changes in
operating characteristics.

10 QGH11908 12/2018
 About the Book

At a Glance

Document Scope
This guide describes the M580 BMENOP0300 module. The main purpose of this module is to
connect to intelligent electronic devices (IEDs) and supervision control software that utilize the IEC
61850 standard. The module enables PlantStruxure controllers to be easily integrated into an IEC
61850 environment.
NOTE: Any specific configuration settings contained in this guide are for instructional purposes
only. The settings required for your specific application will differ from any examples presented in
this guide.
This document is intended for users with knowledge of:
 IEC 61850 standards, content of services, data model, engineering process, etc.
 Control Expert configuration software, which is the engineering tool for the M580 platform and
the BMENOP0300 module

Validity Note
This document is valid for the M580 BMENOP0300 module when used with
EcoStruxure™ Control Expert 14.0 or later.
The technical characteristics for devices described in this document also appear online. To access
this information online:

Step Action
1 Contact your local Schneider Electric sales representative to obtain the website URL.
2 If more than one reference appears on the website, click on the reference that interests you.
3 Depending on the size of your screen, scroll down to locate the data sheet.
4 To save or print a data sheet as a .PDF file, click Download Product data sheet.

The characteristics that are presented in the present document should be the same as those
characteristics that appear online. In line with our policy of constant improvement, we may revise
content over time to improve clarity and accuracy. If you see a difference between the document
and online information, use the online information as your reference.

QGH11908 12/2018 11
Related Documents

Title of Documentation Reference Number

Modicon M580 Standalone, System Planning Guide for Frequently HRB62666 (English),
Used Architectures HRB65318 (French),
HRB65319 (German),
HRB65320 (Italian),
HRB65321 (Spanish),
HRB65322 (Chinese)
Modicon M580, M340, and X80 I/O Platforms, Standards and EIO0000002726 (English),
Certifications EIO0000002727 (French),
EIO0000002728 (German),
EIO0000002730 (Italian),
EIO0000002729 (Spanish),
EIO0000002731 (Chinese)
Modicon M580 Standalone, System Planning Guide for Complex NHA58892 (English),
Topologies NHA58893 (French),
NHA58894 (German),
NHA58895 (Italian),
NHA58896 (Spanish),
NHA58897 (Chjnese)
Modicon M580, RIO Modules, Installation and Configuration Guide EIO0000001584 (English),
EIO0000001585 (French),
EIO0000001586 (German),
EIO0000001587 (Italian),
EIO0000001588 (Spanish),
EIO0000001589 (Chinese),
Modicon M580 BMENOC0301/11, Ethernet Communication Module, HRB62665 (English),
Installation and Configuration Guide HRB65311 (French),
HRB65313 (German),
HRB65314 (Italian),
HRB65315 (Spanish),
HRB65316 (Chinese)
Modicon M580 BMENOC0321, Control Network Module, Installation NVE24232 (English),
and Configuration Guide NVE24233 (French),
NVE24237 (German),
NVE24240 (Italian),
NVE24239 (Spanish),
NVE24242 (Chinese)

12 QGH11908 12/2018
 Title of Documentation Reference Number
Modicon M580, Change Configuration on the Fly, User Guide EIO0000001590 (English),
EIO0000001591 (French),
EIO0000001592 (German),
EIO0000001594 (Italian),
EIO0000001593 (Spanish),
EIO0000001595 (Chinese)
Modicon M580 Hot Standby, System Planning Guide for Frequently NHA58880 (English),
Used Architectures NHA58881 (French),
NHA58882 (German),
NHA58883 (Italian),
NHA58884 (Spanish),
NHA58885 (Chinese)
Modicon X80, BMXNRP0200/0201 Fiber Converter Modules, User EIO0000001108 (English),
Guide EIO0000001109 (French),
EIO0000001110 (German),
EIO0000001111 (Spanish),
EIO0000001112 (Italian),
EIO0000001113 (Chinese)
Modicon X80, Analog Input/Output Modules, User Manual 35011978 (English),
35011979 (German),
35011980 (French),
35011981 (Spanish),
35011982 (Italian),
35011983 (Chinese)
Modicon X80, Discrete Input/Output Modules, User Manual 35012474 (English),
35012475 (German),
35012476 (French),
35012477 (Spanish),
35012478 (Italian),
35012479 (Chinese)
Modicon X80, BMXEHC0200 Counting Module, User Manual 35013355 (English),
35013356 (German),
35013357 (French),
35013358 (Spanish),
35013359 (Italian),
35013360 (Chinese)
EcoStruxure™ Control Expert, Program Languages and Structure, 35006144 (English),
Reference Manual 35006145 (French),
35006146 (German),
35013361 (Italian),
35006147 (Spanish),
35013362 (Chinese)

QGH11908 12/2018 13
 Title of Documentation Reference Number
EcoStruxure™ Control Expert, Operating Modes 33003101 (English),
33003102 (French),
33003103 (German),
33003104 (Spanish),
33003696 (Italian),
33003697 (Chinese)
Quantum using EcoStruxure™ Control Expert, Hardware Reference 35010529 (English),
Manual 35010530 (French),
35010531 (German),
35013975 (Italian),
35010532 (Spanish),
35012184 (Chinese)
EcoStruxure™ Control Expert, Installation Manual 35014792 (English),
35014793 (French),
35014794 (German),
35014795 (Spanish),
35014796 (Italian),
35012191 (Chinese)

You can download these technical publications and other technical information from our website
at [Link]

14 QGH11908 12/2018
 M580 IEC 61850
BMENOP0300 Module Characteristics
QGH11908 12/2018

Chapter 1
Characteristics of the BMENOP0300 Module

Characteristics of the BMENOP0300 Module

Introduction
This chapter describes the BMENOP0300 module linking IEC 61850 and Ethernet networks in an
M580 system.
This chapter includes physical characteristics, port descriptions, and agency specifications for the
BMENOP0300 module.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
BMENOP0300 Module Description 16
Communication Specifications 19
Standards and Certifications 24

QGH11908 12/2018 15
BMENOP0300 Module Characteristics

BMENOP0300 Module Description

Introduction
The BMENOP0300 module is installed on the local rack of an M580 system. The module provides
interfaces for IEC 61850 communication.

Functionality
The main purpose of the BMENOP0300 module is to provide connection with IEC 61850 IED
devices as well as device management software that utilizes the IEC 61850 standard.
The BMENOP0300 module is mounted on the local rack and supports communication as:
 IEC 61850 server
 IEC 61850 client
 GOOSE publisher
 GOOSE subscriber
 Modbus TCP server and client

The BMENOP0300 module also provides high network availability by supporting:

 RSTP protocol
 IP forwarding capability
 M580 redundant functionality
 SNTP, SNMP, and Syslog
 Data modeling in IED configurator and DDDT representation in Control Expert
 Dual-bus backplane (X Bus and Ethernet)
 Cyber security

The maximum number of BMENOP0300 modules that can be mounted on a local rack is
determined by your choice of CPU. The maximum numbers of communication modules, including
BMENOP0300 modules, supported by M580 CPUs are as follows:

CPU Maximum Number of Communication Modules

BMEP581020 2
BME•5820•0 2
BMEP5830•0 3
BME•5840•0 4
BMEP585040 4
BME•586040 4

16 QGH11908 12/2018
 BMENOP0300 Module Characteristics

External Features
BMENOP0300:

eNOP0300

1 commercial reference (module name)

2 LED display
3 Ethernet port (ETH 1)
4 Ethernet port (ETH 2)
5 Ethernet port (ETH 3)

NOTE: To help prevent dust from entering the unused Ethernet ports on this module, cover the port
with the stopper:

QGH11908 12/2018 17
BMENOP0300 Module Characteristics

External Ports
The BMENOP0300 module has three external Ethernet ports, whose IP addresses can be
configured in the Communication Settings → IP Setting tab.

Port Description
ETH 1 The ETH 1 port allows the diagnosis of Ethernet ports and provides access to external
tools and devices (Control Expert, ConneXium Network Manager, HMI, etc.). The port
supports these modes:
 port mirroring: In this mode, you can connect to a PC and use packet sniffing software
to analyze the traffic traveling through one or more of the other module ports.
 access port (default): In this mode, you can connect an Ethernet device (for example,
HMI, PC with Control Expert installed, PC with ConneXium Network Manager tool) to
communicate the PLC/CPU, the BMENOP0300 module, or other devices connected
to the M580 network.
 extended network: In this mode, you can connect the ETH 1 port to another existing
DIO network that you wish to communicate with your M580 EIO network.
NOTE: In port mirroring mode, the ETH 1 port acts like a read-only port. You cannot
access devices (ping, connect to Control Expert, etc.) through the ETH_1 port.
To configure this port, refer to the Configuring the Service/Extend Port topic
(see page 42).
Backplane The Backplane port, located on the back of the module, allows you to connect to an
Ethernet backplane The port supports this mode:
 access port (default): In this mode, you can connect an Ethernet device (for example,
HMI, PC with Control Expert installed, PC with ConneXium Network Manager tool) to
communicate the PLC/CPU, the BMENOP0300 module, or other devices connected
to the M580 network.
ETH 2 and These 2 copper ports provide:
ETH 3  connections for Ethernet services
 star, loop, or mesh topology
 support for RSTP

NOTE: Only ETH 2 and ETH 3 ports support RSTP.

18 QGH11908 12/2018
 BMENOP0300 Module Characteristics

Communication Specifications

Introduction
The following specifications describe the capacities of the BMENOP0300 module.

Data In versus Data Out

The terms data in and data out, as used in this topic, refer to the flow of data from the point of view
of the BMENOP0300 module, and vary depending on the role of the device as client or server.
 Data In: The BMENOP0300 module receives a data update from its connected devices, then
synchronizes data with the CPU:
 As server: The BMENOP0300 module receives a command from a control object or GOOSE.
 As client: The BMENOP0300 module receives a report/GOOSE response to a previous read
request.
 Data Out: The BMENOP0300 module receives a data update from the CPU, then propagates
the data among its connected devices:
 As server: The BMENOP0300 module sends a buffered report, unbuffered report, or
GOOSE.
 As client: The BMENOP0300 module issues a control object or polling command, a
command for a buffered report, unbuffered report, or GOOSE.

IEC 61850 Messaging Specifications

The BMENOP0300 module presents the following IEC 61850 messaging features:

Feature Client Server

maximum number of concurrent 32 —
IED connections
maximum number of words for 4,0001,2,4 4,0001,2,4
data in flow variables
maximum number of words for 4,0002,3 4,0002,3
data out flow variables
maximum number of simultaneous — 16
client connections
maximum number of data sets — 68
maximum number of data — 256
attributes per data set
1. The maximum number of input words includes the sum of client and server input words.
2. The maximum number of variables depends on the data types included in the application (see page 120)
because the lengths of different data types varies.
3. The maximum number of output words includes the sum of client and server output words.
4. Module memory contains the most current (real-time) value for data in flow.

QGH11908 12/2018 19
BMENOP0300 Module Characteristics

Feature Client Server

maximum number of virtual logical — 16
devices within an IED
maximum number of report control — 64 total buffered plus unbuffered
blocks within an IED report control block instances
maximum number of instances of a — 8 (serving 8 clients)
single buffered control block
maximum buffer size of each — 16k bytes
buffered control block
maximum number of control blocks — 4 control blocks
for GOOSE publishing
maximum number of GOOSE — 32 for both server/client
control block subscriptions
minimum interval of GOOSE — 20 ms
publishing
maximum number of inputs in a — 256
GOOSE data set
time stamping resolution — 1 ms
1. The maximum number of input words includes the sum of client and server input words.
2. The maximum number of variables depends on the data types included in the application (see page 120)
because the lengths of different data types varies.
3. The maximum number of output words includes the sum of client and server output words.
4. Module memory contains the most current (real-time) value for data in flow.

Explicit Messaging Specifications

The BMENOP0300 module presents the following Modbus TCP explicit messaging features:

Feature Capacity
Client
maximum number of simultaneous connections 16 connections
maximum number of concurrent requests 16 requests
Server
maximum number of concurrent requests 12 requests
maximum number of simultaneous connections 32 connections
Maximum Message Size
read 250 bytes (125 words) excluding header
write 240 bytes (120 words) excluding header

20 QGH11908 12/2018
 BMENOP0300 Module Characteristics

Comparing Standard Data Types: Control Expert and IEC 61850 Data Types
The following list presents IEC 61850 standard data types and the comparable data type used by
Control Expert:

Control Expert Standard Comparable IEC 61850 Standard

Data Type Data Type Support by
Server Client
WORD BITSTRING √ √
BOOL 1 BOOLEAN √ √

WORD CODED ENUM √ √

WORD Dbpos/Tcmd √ √
WORD ENUMERATED √ √
REAL FLOAT √ √
INT INT8 √ √
BYTE INT8U √ √
INT INT16 √ √
UINT INT16U √ √
DINT INT32 √ √
UDINT INT32U √ √
Timestamp TIME_850_FORMAT √ √
1. In Control Expert, a BOOL occupies one BYTE.

BITSTRING
IEC 61850 supports trigger, option, coded enum, and quality report elements in BITSTRING
format. Control Expert maps BITSTRING to the WORD data type. In each of the following
structures, Bit0 is the most significant bit.
Trigger option of report structure: The following bits indicate the stated trigger value when equal to
1:

Bit0 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7

Reserved Data- Quality- Data- Integrity General- 0 0
change change update interrogation

QGH11908 12/2018 21
BMENOP0300 Module Characteristics

Option field of report structure: The following bits indicate the stated option value when equal to 1:

MSB Bit0 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7

Reserved Sequence- Report- Reason for Data-set- Data- Buffer- EntryID
number timestamp inclusion name reference overflow
LSB Bit8 Bit9 Bit10 Bit11 Bit12 Bit13 Bit14 Bit15
Conf- Segmen- – – – – – –
revision tation

Quality element structure: The following bits indicate the stated quality value when equal to 1:

MSB Bit0 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7

Validity: Overflow Out-of- Bad- Oscillatory Detected Old-data
00 = good range reference failure
01 = invalid
10 = reserved
11 = questionable
LSB Bit8 Bit9 Bit10 Bit11 Bit12 Bit13 Bit14 Bit15
Inconsis- Inaccurate Source: Test Operator- – – –
tent 0 = process blocked
1 = substituted

CODED ENUM
Coded Enum definition from IEC 61850-8-1, only low byte is valid for DPS/DPC:

MSB Reserved
LSB 0x00 = Intermediate state
0x40 = Off
0x80 = On
0xC0 = Bad-state

Coded Enum definition from IEC 61850-8-1, only low byte is valid for BSC/BAC:

MSB Reserved
LSB 0x00 = Stop
0x40 = Lower
0x80 = Higher
0xC0 = Reserved

22 QGH11908 12/2018
 BMENOP0300 Module Characteristics

Dbpos/Tcmd
Dbpos (double position) definition from IEC 61850-8-1:

MSB Reserved
LSB 0x00 = Intermediate state
0x40 = Off
0x80 = On
0xC0 = Bad-state

Tcmd definition from IEC 61850-8-1:

MSB Reserved
LSB 0x00 = Stop
0x40 = Lower
0x80 = Higher
0xC0 = Reserved

Custom Data Types

The BMENOP0300 module also provides the following custom data types, which are used to
support module DDTs (see page 153):
 IED_ERT_BUF
 IIED_EVT_M
 IED_EVT_Q
 IED_RPT
 TIME_850_FORMAT

Refer to the presentation of each custom data type elsewhere in this document for a description of
its structure.

QGH11908 12/2018 23
BMENOP0300 Module Characteristics

Standards and Certifications

Online Help
From the Control Expert online help, you can access the standards and certifications that apply to
the modules in this product line by referring to the Modicon M580, M340, and X80 I/O Platforms,
Standards and Certifications guide.

Download
Click the link that corresponds to your preferred language to download the standards and
certifications (PDF format) that apply to the modules in this product line:

Language
English Modicon M580, M340, and X80 I/O Platforms, Standards and Certifications
French Modicon M580, M340, and X80 I/O Platforms, Standards and Certifications
German Modicon M580, M340, and X80 I/O Platforms, Standards and Certifications
Italian Modicon M580, M340, and X80 I/O Platforms, Standards and Certifications
Spanish Modicon M580, M340, and X80 I/O Platforms, Standards and Certifications
Chinese Modicon M580, M340, and X80 I/O Platforms, Standards and Certifications

24 QGH11908 12/2018
 M580 IEC 61850
Installing the BMENOP0300 Module
QGH11908 12/2018

Chapter 2
Installing the BMENOP0300 Module

Installing the BMENOP0300 Module

Mounting an Ethernet Communications Module on the Modicon M580 Rack

Introduction
Use these instructions to install an Ethernet communications module in a single slot on the
Ethernet backplane.
NOTE: Fitting operations (installation, assembly, and disassembly) are described below.

Before Installing a Module

Before installing the Ethernet communications module, remove the protective cap from the module
connector on the rack.

Selecting a Backplane
Install the Ethernet communications module in a single slot on a BMEXBP•••• Ethernet backplane.

Installing the Module on the Rack

Mount the module in a single slot on the backplane:

Step Action
1 Turn off the power supply to the rack.
2 Remove the protective cover from the module interface on the rack.
3 a: Insert the locating pins on the bottom of the module into the corresponding slots in the rack.

b: Use the locating pins as a hinge and pivot the module until it is flush with the rack. (The twin
connector on the back of the module inserts into the connectors on the rack.)

QGH11908 12/2018 25
Installing the BMENOP0300 Module

Step Action
4 Tighten the retaining screw to hold the module in place on the rack:

Tightening torque: 1.5 N•m max. (1.11 lb-ft)

Grounding Considerations

DANGER
ELECTRICAL SHOCK HAZARD
 Switch off the power supply at both ends of the PAC connection, and lock out and tag out both
the power sources.
 In case lock out and tag out are not available, ensure that the power sources cannot be
inadvertently switched on.
 Use suitable insulation equipment when inserting or removing all or part of this equipment.
Failure to follow these instructions will result in death or serious injury.

Do not apply power to the Ethernet communications module until connections are made at both
ends of the Ethernet cable. For example, connect the cable to both the module and another device
(adapter module) or a DRS before you turn on the power.
Refer to your system hardware reference manual for details about the DRSs.
Use fiber-optic cable to establish a communications link when it is not possible to equalize the
potential between the two grounds.
NOTE: Refer to the ground protection information provided in the Grounding and Electromagnetic
Compatibility of PLC Systems, Basic Principles and Measures, User Manual and Control Panel
Technical Guide, How to protect a machine from malfunctions due to electromagnetic disturbance.

Replacing a Module
Any Ethernet communications module on the rack can be replaced at any time with another module
with compatible firmware. The replacement module obtains its operating parameters over the
backplane connection from the CPU. The transfer occurs immediately at the next cycle to the
device.

26 QGH11908 12/2018
 M580 IEC 61850
Configuring the BMENOP0300 Module
QGH11908 12/2018

Chapter 3
Configuring the BMENOP0300 Module

Configuring the BMENOP0300 Module

Introduction
This chapter shows you how to use Control Expert programming software, including the Modicon
IEC 61850 Configuration Tool, to select and configure the BMENOP0300 module on the local rack.
You can download and install the IEC 61850 configuration tool package from the DVD provided or
from [Link].
NOTE: The instructions presented in this chapter may include specific choices made for a sample
project. Your Control Expert project may include different choices that are appropriate for your
specific configuration.

What Is in This Chapter?

This chapter contains the following sections:
Section Topic Page
3.1 Creating a Project in Control Expert 28
3.2 Introducing the IEC 61850 Configuration Settings 32
3.3 Configuring IP Addresses 41
3.4 Ethernet Services 52
3.5 Uploading and Downloading Configuration Settings 72

QGH11908 12/2018 27
Configuring the BMENOP0300 Module

Section 3.1
Creating a Project in Control Expert

Creating a Project in Control Expert

Overview
This section shows you how to add modules, including the BMENOP0300 module, to your project,
using Control Expert.
NOTE: For detailed information about how to use Control Expert, refer to the Control Expert online
help.

What Is in This Section?

This section contains the following topics:
Topic Page
Creating a Project in Control Expert 29
Configuring the Module Name 31

28 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Creating a Project in Control Expert

Introduction
You may have already created a project in Control Expert and installed a power supply. If so, jump
to the instructions for Adding a BMENOP0300 Module (see page 30). If not, the following pages
show you how to create a new Control Expert project and add the following components:
 a CPU
 a power supply
 a BMENOP0300 module

NOTE: Design your network so that IEC 61850 GOOSE transmissions and M580 EIO
transmissions are not carried by the same media.

Creating and Saving a New Control Expert Project

The following steps describe the creation of a project in Control Expert:

Step Action
1 Open Control Expert.
2 In the Control Expert main menu, select File → New....
Result: The New Project window opens, displaying a list of Schneider Electric PLCs.
3 In the New Project dialog, expand the Modicon M580 node and select both a CPU (see page 16)
and a rack.
4 Click OK.
Result: The Project Browser window opens.
5 To save the project, select File → Save.
Result: The Save As dialog opens.
6 In the Save As dialog:
1. Enter a File name (the name of your Control Expert project).
2. Select the .STU or .STA extension in the Save As field.
3. Click Save.

QGH11908 12/2018 29
Configuring the BMENOP0300 Module

Adding a Power Supply

Control Expert automatically adds a power supply to the PLC bus. If you want to replace the
chosen supply:
 Click the power supply in your application and press Delete on your keyboard.
— or—
 Right-click the power supply and select Delete Module.

Continue with the following steps to add a different power supply:

Step Action
7 In the Project Browser, double-click PLC Bus. Control Expert displays the:
 PLC bus dialog with the selected CPU in the second position
 Hardware Catalog displaying the PLC bus tab

8 Expand the Supply node in the Hardware Catalog. Select the desired module (in this example, a
140 CPS 111 00) and drag it into the slot 1 position in the PLC bus.
9 Click File → Save.
NOTE: Schneider Electric recommends that you periodically save your changes as you make
edits.

Adding a BMENOP0300 Module

Add a BMENOP0300 module to your project.

Step Action
10 In Control Expert, expand the Communication node in the Hardware catalog and drag a
BMENOP0300 module to any open slot in the PLC bus.
11 Click File → Save.

30 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Configuring the Module Name

Overview
Use the Configuration tab of the BMENOP0300 module properties window to configure the module
name.
The following steps present one example of how to configure the module name. Your own project
configuration may differ.

Naming the Module

Follow these steps:

Step Action
1 Double-click the BMENOP0300 module in the PLC bus window or right-click the module and
select Open Module.
Result: The BMENOP0300 configuration dialog opens.
2 Select the respective channel in the left pane and select the Configuration tab.
3 Enter a Module name: an ASCII string up to a maximum of 10 characters.
NOTE: The beginning character cannot be an Arabic numeral.
4 Click the Validate icon in the Toolbar.
Result: A message opens informing you that the module name cannot be edited after validation.
5 Click OK to close the message.
Result: The Module name becomes read-only.

The maximum size of all BMENOP0300 module memory items is 8,000 words. The actual size is
determined by the specific module configuration.
Refer to the topic Working with IEC 61850 Data Objects (see page 118) for information about the
data items automatically created by Control Expert when you click Update application.

QGH11908 12/2018 31
Configuring the BMENOP0300 Module

Section 3.2
Introducing the IEC 61850 Configuration Settings

Introducing the IEC 61850 Configuration Settings

Introduction
This section introduces the IEC 61850 configuration settings.

What Is in This Section?

This section contains the following topics:
Topic Page
Selecting the IEC 61850 Edition 33
Using the Modicon IEC 61850 Configuration Tool 35
General Window 38

32 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Selecting the IEC 61850 Edition

Overview
After configuring the module name and IP address settings for the module, create an IEC 61850
project, then select the IEC 61850 standard supported by your BMENOP0300 module.

Selecting the IEC 61850 Edition

To select the edition of IEC 61850 supported by your module, follow these steps:

Step Action
1 In the Configuration tab, click the IEDCT Configuration button.
Result: The Modicon IEC 61850 Configuration Tool opens, displaying the Create Project dialog.
NOTE: Only one instance of the Modicon IEC 61850 Configuration Tool can be open at a time.
2 In the Create Project dialog, select one of the following:
 Create New Project
 Open Project

NOTE: A Recover Project selection appears when the Control Expert application is uploaded
from the PLC, but it has lost the IEC 61850 configuration. In this case, Control Expert sends the
recovered project to the configuration tool, which asks you to locate a backup project to restore
the module's settings. If you have not yet backed up your project, create a new project for the
module.
3 If you selected Open Project:
1. Click the ellipsis button to open the Open dialog.
2. Navigate to and select an existing project (.prj) file.
3. Click Open.
Result: The Open dialog closes, and the selected project and path are displayed in the
Create Project dialog.
4. Click OK.
NOTE:
 Because the saved project file already contains an edition selection setting, the IEC
61850 Edition Selection dialog (described below) does not appear. Instead, the General
window opens.
 If the previously saved IEC 61850 configuration cannot be found, the tool asks you to
navigate to and select the IEC 61850 configuration file to open. If you do not select a saved
configuration, you need to create and configure a new project.
4 If you selected Create Project → OK, the IEC 61850 Edition Selection dialog opens.

QGH11908 12/2018 33
Configuring the BMENOP0300 Module

Step Action
5 Select the edition, or version, of the IEC 61850 protocol that applies to your module:
 Edition1
 Edition2

NOTE: Schneider Electric recommends that you use the BMENOP0300 module only in IEC
61850 networks where all devices support the same edition of the IEC 61850 protocol. The IEC
61850 configurator editions support the following schema versions:
 Edition1: supports schema V1.6
 Edition2: supports schema V3.1

6 Click OK.
Result: The General window opens.

NOTE: When Control Expert displays IEC 61850 configuration settings, it presents one of the
following collections of module data:
 For a new IEC 61850 project, the General window displays default settings.
 For a project created using an existing IEC 61850 project file, the General window displays the
saved configuration settings.

34 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Using the Modicon IEC 61850 Configuration Tool

Introduction
The IEC 61850 configuration interface in Control Expert is the exclusive tool for configuring IEC
61850-based properties of the BMENOP0300 module.
Use the Modicon IEC 61850 Configuration Tool to perform the following tasks:
 Configure the BMENOP0300 module as an IEC 61850 server or client
 Configure the IP address settings for the module
 Configure Ethernet services for the module, including:
 RSTP
 SNTP
 SNMP
 Security
 Switch settings (baud rates for the Ethernet ports)
 Syslog

Workbench
The workbench is the parent window of the IEC 61850 interface. It presents:
 the toolbar
 one or more configuration windows, each on its own tab

Toolbar
The configuration toolbar has the following functions:

Icon / Name Description

Saves edits made to configuration settings.
Save
NOTE: If you have configured a project backup folder, a copy of the IEC 61850
configuration is saved to that location.
Performs a validation check of the configuration.
Validate
NOTE: If one or more configuration errors are detected, a message opens
describing one of the detected errors. Click this button after each configuration error
is fixed, until the message indicates no detected errors.

Undo Reverses the previous edit.

Redo Repeats a text edit that was reversed via the Undo command.

Removes and saves selected text.

Cut
Copies selected text.
Copy

QGH11908 12/2018 35
Configuring the BMENOP0300 Module

Icon / Name Description

Inserts text that was cut or copied.
Paste
Toggles the size of the Modicon IEC 61850 Configuration Tool: normal size or full
Full Screen
screen.

Saving and Backing Up your IEC 61850 Project

When you identify a project backup folder, a copy of the project file is saved to the specified location
each time you click Save.
To specify a project folder, follow these steps:

Step Action
1
In the upper left corner of the configuration tool, click the icon.
Result: The Application Preferences page opens.
2 Click Backup.
3 Click the ellipsis button (...) to open Browse For Folder window.
4 Navigate to and select the folder where you want to store project backup files, then click OK.
3 Close the Application Preferences page.

36 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Breadcrumb Navigation
A breadcrumb navigation bar sits at the top of each tab, and describes the path to the displayed
page, starting with the General window:

Click a breadcrumb item to move to that window.

You can also click a breadcrumb item to display a context menu containing the available child
windows. For example, right-click on the black arrow in the IEC 61850 Server breadcrumb item to
display the following menu:

Click the name of a child window to open it.

Exiting the Modicon IEC 61850 Configuration Tool

When you close the Modicon IEC 61850 Configuration Tool and Control Expert, it continues to run
in the background on your PC.
To exit the Modicon IEC 61850 Configuration Tool, follow these steps:

Step Action
1 Click the close button (with the red “x”) at the upper right corner of the Modicon IEC 61850
Configuration Tool.
2 In the Confirm dialog, indicate if you want to save data before closing (Yes or No).

QGH11908 12/2018 37
Configuring the BMENOP0300 Module

General Window

Introduction
After you select an IEC 61850 edition, the General window opens when you start up the Modicon
IEC 61850 Configuration Tool.
Use the General window to:
 Edit module information.
 Select the Ethernet port used for GOOSE publication.
 Enable and disable the embedded IEC 61850 server.
 Enable and disable the embedded IEC 61850 client.
 Open the following windows where you can continue to configure BMENOP0300 module
functions:
 communication settings
 server settings
 client settings

Editing Module Information

Use the Module Information section to edit the name of the module, and to view settings that
describe the module commercial reference and protocol edition.
The Module Information section presents the following settings and commands:

Setting Description
Module Name A read-only string of ASCII characters. This value is entered in the module
Configuration tab when the module is added to the Control Expert project.
(see page 31)
NOTE: Control Expert uses this setting as the base string for naming module
variables.
IEC 61850 Edition A previously selected (see page 33), read-only description of the edition of the IEC
61850 protocol supported by the BMENOP0300 module
Reference The read-only commercial reference, or product name, for the BMENOP0300 module.
PDU Size The size of the manufacturing message specification (MMS) protocol data unit (PDU),
from 4K bytes to 64K bytes. Default = 16K bytes.

38 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Setting Description
Communication Opens the Communication Settings window, which consists of the following tabs:
Settings  IP Setting, where you can assign roles and IP addresses to the four Ethernet ports
(see page 42) of the module.
button  RSTP, where you can enter settings to configure the embedded Ethernet switch to
be part of a redundant, loop-free logical Ethernet network.
 SNTP, where you can configure the internal clock of the module to synchronize with
a network time server.
 SNMP, where you can configure the SNMP client service in the module that allows
access to module diagnostic and management information.
 Security, where you can restrict access to the module via TCP port 502.
 Switch, where you can set baud rates for the four Ethernet ports.
 Syslog, where you can log security events

Selecting GOOSE Publication Port

Use the Goose Publish area to specify the Ethernet port or ports used to transmit GOOSE control
blocks.
The Goose Publish area presents the following settings:

Setting Description
Ethernet Port Select the port used for GOOSE publication:
 ETH Port 1
 ETH Port 2&3

NOTE: GOOSE publication occurs if the Ethernet cable to the selected port is
connected or disconnected. GOOSE diagnostic codes (see page 191) are
unaffected by the cable being connected or disconnected to the port.
Auto Enable Indicate if a GOOSE transmission is sent on start-up or re-start:
 Selected: A GOOSE transmission is enabled.
 De-selected: A GOOSE transmission is not enabled.

QGH11908 12/2018 39
Configuring the BMENOP0300 Module

Enabling and Disabling the IEC 61850 Server

Use the controls in the Server Function section to enable and disable the IEC 61850 server.
The Server Function section presents the following settings:

Setting Description
Enable IEC 61850 Server  Select the check box to enable the IEC 61850 server.
 De-select the check box to disable the server (default).

NOTE:
 When this setting is selected, the IEC 61850 Server Settings button is
enabled.
 If you enable and configure the IEC 61850 server; and then disable the
server, your server configuration settings are saved. The saved server
settings are re-applied when you later select this setting and enable the
server.
IEC 61850 Server Settings Opens the Server Settings window, where you can complete the configuration of
button server settings.
NOTE: This button is enabled only when Enable IEC 61850 Client is selected.

NOTE: Enabling the server does not complete the server configuration. After enabling the server,
click the IEC 61850 Server Settings button to open the IEC 61850 Server window where you can
complete the server configuration.

Enabling and Disabling the IEC 61850 Client

Use the controls in the Client Function section to enable and disable the IEC 61850 client.
The Client Function section presents the following settings:

Setting Description
Enable IEC 61850 Client  Select the check box to enable the IEC 61850 client.
 De-select the check box to disable the IEC 61850 client (default).

NOTE: When this setting is:

 Selected: The IEC 61850 Client Settings button is enabled.
 De-selected: All previously configured client configuration settings for this
module are permanently deleted.
IEC 61850 Client Settings Opens the Client Settings window, where you can complete the configuration of
button client settings.
NOTE: This button is enabled only when Enable IEC 61850 Client is selected.

40 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Section 3.3
Configuring IP Addresses

Configuring IP Addresses

Introduction
This section shows you how to assign an IP address to each Ethernet port on the BMENOP0300
module.

What Is in This Section?

This section contains the following topics:
Topic Page
Assigning Roles and IP Addresses to Ethernet Ports 42
Configuring the IP Forwarding Service 45
Network Transparency via IP Forwarding Using One BMENOP0300 Module 47
Network Transparency via IP Forwarding Using Multiple BMENOP0300 Modules 50

QGH11908 12/2018 41
Configuring the BMENOP0300 Module

Assigning Roles and IP Addresses to Ethernet Ports

Introduction
Use the Communication Settings → IP Setting tab to assign roles and IP address settings to the
three ports of the BMENOP0300 module.
After changing any IP address setting in this tab, click Apply to confirm and retain your edits before
clicking another Communication Settings tab. Alternatively, you can click Cancel to delete your
edits on the current tab and restore the previous setting.

Port Roles
The BMENOP0300 module includes three Ethernet ports and supports three different IP
interfaces. These ports can be configured as the following port types:

Type Description Available

Port 1 Ports 2/3 Backplane
(ETH 1) (ETH 2/3) Port
Access Port Diagnostic information is available via explicit √ √ √
messaging (Modbus) or via SNMP.
NOTE: A port set to Access Port type uses the IP
address of the network that is set for Ports 2/3.
Extended You can extend the device network by adding another √ √ √
Network network to this port.
Port Mirroring You can connect to this port via a PC and use packet √ – –
sniffing software to analyze the traffic traveling
through one or more of the other module ports.
Dedicated Ports 2 and 3 (ETH 2 and ETH 3) share a single IP – √ –
Network Ports address and are dedicated connections.
NOTE: Ports 2 and 3 (ETH 2 and ETH 3) support
RSTP (see page 53).
√ The port type is available for this port.
– The port type is not available for this port.

The module includes an IP forwarding service that handles and forwards packets among the
three IP interfaces.

Ethernet Frames
The BMENOP0300 module supports the Ethernet II frame type. The module supports the IEEE
802.3 frame type only for RSTP.

42 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Assigning IP Address Settings

All IP addresses settings need to be manually assigned in this window as part of module
configuration.
The IP Setting tab presents separate configuration areas for Port 1, Port 2/3, and the Ethernet
Backplane Port. To configure each port, enter values for the following settings.
The BMENOP0300 module supports IP V4 only.

Setting Description
Type Select the role to assign to the port. Selections include:
 Port 1:
 Access Port
 Port Mirroring
 Extended Network

 Ports 2/3: Please configure IP settings of Ports 2/3 in Control Expert.

 Backplane Port
 Access Port

IP A 32-bit IP address assigned to the port, including both network and host components.
Sub-Network Mask A 32-bit value used to mask the network portion of the IP address and reveal the host
address.
Default Gateway For ports 2/3, the IP address of the IP forwarding service that is the access point to a
remote network.
NOTE: [Link] is a valid setting.

NOTE:
 If the IP address for a port is not configured, the BMENOP0300 modules automatically assign
that port a MAC address-based IP address (see page 44).
 If the IP address for a port is not valid (for example, a malformed or duplicate IP address), the
module LEDs indicate the invalid IP address status.

QGH11908 12/2018 43
Configuring the BMENOP0300 Module

Configuring Port Mirroring

You can configure Port 1 (ETH 1) to serve as a mirroring port. A copy of Ethernet packets traveling
through other selected ports is sent to Port 1, where you can use a packet sniffer to monitor and
analyze network traffic.
When port mirroring is enabled, Port 1 becomes a read-only port. There is no access to network
devices via this port while port mirroring remains enabled.
To configure Port 1 (ETH 1) for port mirroring, follow these steps:

Step Action
1 In the Port 1 area, select Port Mirroring as the port Type.
The check boxes at the bottom of the Port 1 area are enabled.
2 Select the ports whose traffic is mirrored and sent to Port 1:
Enable Internal Port Select this to send a copy of traffic passing through the internal port
(between the module’s IP forwarding service and the CPU) to Port 1.
Enable ETH 2 Select this to send a copy of traffic passing through Port 2 (ETH 2) to
Port 1.
Enable ETH 3 Select this to send a copy of traffic passing through Port 3 (ETH 3) to
Port 1.
Enable Backplane Port Select this to send a copy of traffic passing through the backplane port to
Port 1.
3 Click Apply to confirm your edits.
4 Click Save to save your edits.

Determining Port Default IP Addresses

If one or more Ethernet ports on the BMENOP0300 module are not manually assigned an IP
address, the module automatically assigns default IP addresses that are based on the MAC
address, as follows:
 When IP forwarding is disabled:
 [Link]

 When IP forwarding is enabled:

 [Link] for ETH_2 and ETH_3
 [Link] for ETH_1

Where:
 ‘xxx’ represents the fifth octet of the module MAC address.
 ‘yyy’ represents the sixth octet of the module MAC address.

However, if the sixth octet of the module MAC address is 0xff or 0x00, ‘yyy’ is reset to 0xfe (254)
to avoid the generation of an invalid IP address.

44 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Configuring the IP Forwarding Service

Introduction
The BMENOP0300 module includes an IP forwarding service. The IP forwarding service provides
transparency between networks in a PlantStruxure system and can route packets among a
maximum of two subnetworks that each has its own distinct broadcast domain.
The IP forwarding service is supported by the following versions:
 BMENOP0300 firmware version ≥ V2.0
 Modicon IEC 61850 Configuration Tool ≥ V3.0

NOTE: Only one of the following functions can be enabled at any time: the IPsec protocol
(see page 61), the Ethernet backplane port, or the IP Forwarding service.
Use the configuration tool to configure the IP forwarding service by assigning unique IP address
parameters (including the IP address and subnetwork mask) for the BMENOP0300 module to
facilitate communications.
You can also identify the default gateway for the BMENOP0300 module. (Refer to the description
of the role of the default gateway (see page 43).)
NOTE: The default gateway is the IP address of the control network router. Usually this router is a
device that connects the control network to other networks higher up in the Ethernet infrastructure.

Displaying the IP Forwarding Service Parameters

To display the IP Forwarding page and access the parameters:

Step Action
1 Click the IP Setting tab in the navigation tree in the left panel of the Device Editor.
Result: The Services page opens.
2 In the IP Setting page, set the IP Forwarding field to Enabled. Then click Apply.
Result: The IP Forwarding service appears in the navigation tree.
3 Click IP Forwarding in the navigation tree.
4 Enter IP addressing parameters for the IP Forwarding service.
5 Click Apply to save changes and leave the window open, or click OK to save changes and close
the window.

QGH11908 12/2018 45
Configuring the BMENOP0300 Module

Configuring the IP Forwarding Service

When configuring the IP forwarding service, how IPsec and the Ethernet backplane are defined
affects the use of the IP forwarding service.

# IPsec Ethernet Backplane IP Forwarding Service

1 enabled by user disabled (grayed, cannot be disabled (grayed, cannot be
NOTE: A window displays in the enabled enabled)
configuration tool: When IPsec is
enabled, the ETH Backplane port
and the IP Forwarding service
will be disabled automatically.
2 disabled by user no change (not grayed, can be no change (not grayed, can be
enabled) enabled)
3 disabled (grayed, cannot be disabled (grayed, cannot be enabled by user
enabled) enabled) NOTE: A window displays in the
configuration tool: When the IP
Forwarding service is enabled,
the IPsec and ETH Backplane
port will be disabled
automatically.
4 no change (not grayed, can be no change (not grayed, can be disabled by user
enabled) enabled)
5 no change (not grayed, can be enabled by user no change (not grayed, can be
enabled) enabled)

46 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Network Transparency via IP Forwarding Using One BMENOP0300 Module

Introduction to Transparency
You can segregate a network into multiple subnetworks to limit user access and increase
performance. This usually means that devices in different subnetworks are not able to
communicate directly.
You can, however, use the IP forwarding functionality (see page 45) to enable Ethernet network
transparency to facilitate seamless communications between devices in different subnetworks.
This topic describes an example of IP forwarding supported by the BMENOP0300 module.

Before You Begin

Before you start this example, change your Control Expert configuration to facilitate the use of the
IP forwarding service:

Step Action
1 Enable the IP forwarding service (see page 45).
2 Configure the service port (ETH1) (see page 42) as an extended network port.

IP Forwarding Example
Suppose you want to provide transparency between two networks:
 On network 1, with the network address of [Link], host A (a PC) uses the IP address
[Link].
 On network 3, with the network address [Link], host C (an IED) uses the IP address
[Link].
To facilitate communications between hosts A and C, connect the networks 1 and 3 both physically
and logically. The IP forwarding service in the BMENOP0300 module is the interface for these
network connections.

QGH11908 12/2018 47
Configuring the BMENOP0300 Module

In the following sample architecture, the IP forwarding service in the BMENOP0300 module
provides transparency between these two networks. Host A in subnetwork [Link] (blue) can
communicate with host C in subnet [Link] (purple) because the BMENOP0300 module is
configured with an IP address in each of the two networks.

1 A BME•58•••• CPU connects the local rack to the main ring.

2 A BMENOP0300 Ethernet communication module is connected to the CPU over the Ethernet backplane
(and is therefore on the same network at the CPU).
3 The IP forwarding service of the BMENOP0300 Ethernet communication module has IP addresses in two
subnetworks: network 1 ([Link]) and network 3 ([Link]).
4 Network 1, in subnetwork [Link], includes a PC (host A).
5 Network 3, in subnetwork [Link], includes IEDs.

48 QGH11908 12/2018
 Configuring the BMENOP0300 Module

In this example, the IP forwarding service of the BMENOP0300 module has two interfaces with
different IP addresses in two subnetworks:

IP Forwarding Service
Network IP Address Sub-Network Mask Network Address Ethernet Interface
network 1 [Link] [Link] [Link] ETH 2, ETH 3
network 3 [Link] [Link] [Link] ETH 1

Now that you have established the IP forwarding service, add the IP address forwarding
information to the PC (host A), the IEDs (host C), which allows the hosts to send packets beyond
their own subnetworks by utilizing the IP forwarding service of the BMENOP0300 module.
 Configure the IEDs (host C) to forward all traffic that is destined for outside its subnetwork to the
BMENOP0300 module. That is, confirm that all traffic for networks other than [Link] is
forwarded to the appropriate interface of the BMENOP0300 module.
 Also configure the PC (host A) in a similar way. However, in a PC environment, it is possible to
configure distinct rules about communications. To facilitate communications between the
example PC in the network 1 and the devices in network 3, set the IP address of the
BMENOP0300 module in network 1 as the route for traffic that is destined for network 3.
NOTE: The connections of network 1 and network 3 to the BMENOP0300 module, could be
swapped, depending on which network requires the RSTP protocol.

QGH11908 12/2018 49
Configuring the BMENOP0300 Module

Network Transparency via IP Forwarding Using Multiple BMENOP0300 Modules

IP Forwarding Example
You can enable IP forwarding in an M580 system with multiple BMENOP0300 modules.
 On network 1 (control network), with the network address of [Link]/24, the PC (SCADA)
configures the following IP addresses in each of the three BMENOP0300 modules:.
 NOP 1 (ETH1): [Link]
 NOP 2 (ETH2): [Link]
 NOP 3 (ETH3): [Link]

Set a Static Route

The PC (host A) resides in network 1, and can communicate with each of the BMENOP0300
modules in the local rack via the module’s network 1 IP address. For the PC to communicate with
devices in networks 2, 3, and 4, set the IP address of each respective BMENOP0300 module in
each respective network (2, 3, and 4) as the route for traffic.
 For the PC (A) to communicate with intelligent electronic devices (IEDs) in network 2, add a
static route to the PC:
c:\route ADD [Link] mask [Link] [Link]
 [Link] is network 2.
 [Link] is the IP address of the BMENOP0300 module in network 2.

 For the PC (A) to communicate with IEDs in network 3, add a static route to the PC:
c:\route ADD [Link] mask [Link] [Link]
 [Link] is network 3.
 [Link] is the IP address of the BMENOP0300 module in network 3.

 For the PC (A) to communicate with IEDs in network 4, add a static route to the PC:
c:\route ADD [Link] mask [Link] [Link]
 [Link] is network 4.
 [Link] is the IP address of the BMENOP0300 module in network 4.

50 QGH11908 12/2018
 Configuring the BMENOP0300 Module

On each of networks 2, 3, and 4, each IED configures the direct connection to each BMENOP0300
module’s IP address as its gateway.

Network NOP IP Address IED IP Address IED Gateway IP Address

(ETH2/3)
2 [Link]/24 [Link]/24 – [Link]/24 [Link]
3 [Link]/24 [Link]/24 – [Link]/24 [Link]
4 [Link]/24 [Link]/24 – [Link]/24 [Link]

1 A BME•58•••• CPU connects the local rack to the main ring.

2 A BMENOP0300 module is connected to: A) the control network (network 1) via port ETH1 and 6)
network 2 via port ETH3.
3 A BMENOP0300 module is connected to: A) the control network (network 1) via port ETH1 and 7)
network 3 via port ETH3.
4 A BMENOP0300 module is connected to: A) the control network (network 1) via port ETH1 and 8)
network 4 via port ETH3.
5 On network 1 (control network), with the network address of [Link], a PC uses the IP
address [Link]/24.
6 network 2 with the address [Link]/24
7 network 3 with the address [Link]/24
8 network 4 with the address [Link]/24

QGH11908 12/2018 51
Configuring the BMENOP0300 Module

Section 3.4
Ethernet Services

Ethernet Services

Overview
This section describes the Ethernet services supported by the BMENOP0300 module.

What Is in This Section?

This section contains the following topics:
Topic Page
Configuring the Rapid Spanning Tree Protocol 53
Configuring Time Synchronization 54
Configuring the SNMP Agent 57
Security 59
Configuring IP Secure Communications 61
Configuring Data Rates 69
Configuring the Syslog Service 70

52 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Configuring the Rapid Spanning Tree Protocol

Introducing RSTP
Ethernet ports 2 and 3, located on the front of the BMENOP0300 module, support the Rapid
Spanning Tree Protocol (RSTP). RSTP is an OSI layer 2 protocol defined by IEEE 802.1D 2004.
RSTP performs two services:
 Creates a loop-free logical network path for Ethernet devices that are part of a topology that
includes redundant physical paths.
 Automatically restores network communication, by activating redundant links, in the event the
network experiences an interruption of service.
NOTE: RSTP can take up to 50 ms to restore network communication in case of a service
interruption. During this time, Ethernet packets may be dropped.
RSTP software, operating simultaneously in all network switches, obtains information from each
switch, which enables the software to create a hierarchical logical network topology. RSTP is a
flexible protocol that can be implemented on many physical topologies, including ring, mesh, or a
combination of ring and mesh.
Use the RSTP tab of the Communication Settings window to configure RSTP for the embedded
Ethernet switch in the BMENOP0300 module. After you make your selection, click Apply to
preserve your edit.
NOTE: RSTP can be implemented only when all network switches are configured to support RSTP.

Configuring RSTP Settings

The following setting can be viewed and edited in the Communication Settings → RSTP tab:

Setting Description
RSTP Operational State: Select one of the following RSTP roles for the module:
Bridge Priority  Root (0)
 Backup Root (4096)
 Participant (32768) (default)

NOTE: Network switches running RSTP software periodically exchange

information about themselves using special packets called Bridge Protocol
Data Units (BPDUs), which act as a heartbeat. The Bridge Priority value is
contained in the BPDU and establishes the relative position of the switch
in the RSTP hierarchy.

QGH11908 12/2018 53
Configuring the BMENOP0300 Module

Configuring Time Synchronization

Introduction
The simple network time protocol (SNTP) synchronizes the clock in the BMENOP0300 module to
that of the network time server. Typical time service configurations utilize redundant servers and
diverse network paths to achieve high accuracy and reliability.
Use the time service for:
 recording events (sequence events)
 synchronizing events (trigger simultaneous events)

Time Synchronization Service Features

Features of the time synchronization service include:
 periodic time correction obtained from the reference-standard time server
 automatic switch-over to a backup time server if communication with the primary time server is
interrupted
 availability of a function block for application programs that can read the accurate clock, and let
project events or variables be time stamped
 configurable local time zone, including daylight savings time

NOTE: Broadcast frames for clock synchronization are not supported.

Time Synchronization Process

The NTP client sends requests to the NTP server in the network to get the reference time for
synchronizing the local time of the Ethernet communication module:

Stage Description
1 Through an Ethernet network, an NTP client requests a time synchronization signal from an
NTP server.
2 The NTP client calculates the correct time and stores the value.

On an Ethernet network, confirm that all controllers are synchronized with the same NTP server.

54 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Power Up
To establish the accurate Ethernet system network time, the system performs the following at
power-up:
 The BMENOP0300 module powers up.
 The BMENOP0300 module obtains the time from the NTP server.
 The service requires the requests to be sent periodically to obtain and maintain accurate time.
Your Polling Period configuration partially determines the accuracy of the time.
After the accurate time is received, the service sets the status in the associated time service
diagnostic.
The time service clock value starts at 0 until fully updated from the BMENOP0300 module.

Model Starting date

Modicon M580 with Control Expert January 1st 1970 00:00:00.00

Stop or Run PLC

 Stop and run have no effect on the accuracy of the clock.
 Stop and run have no effect on the update of the clock.
 A transition from one operating mode to another has no effect on the accuracy of the Ethernet
system network time.

Download Application
The status clock value associated with the time service register in the CPU is re-initialized after an
application is downloaded or after an SNTP server swap.
There will be two polling periods before the time is accurate.

QGH11908 12/2018 55
Configuring the BMENOP0300 Module

Time Synchronization Configuration Settings

The Communication Settings → SNTP tab presents the following configuration settings:

Setting Action
NTP Server Configuration:
Primary NTP Server IP Enter a valid IP address.
Address
Secondary NTP Server IP Enter a valid IP address.
Address
Polling Period The polling period is the time (in seconds) between updates from the SNTP
server. To obtain optimal accuracy (and if your network allows), reduce the
polling period to a small value. The default is 5 seconds.
Valid values include:
 minimum = 1 s
 maximum = 120 s

Time Zone:
Time Zone Select the desired time zone from the drop-down list. The default value is your
current system time zone (as found in Windows). You can also select Custom
Time Zone.
Time Zone Offset If you select Custom Time Zone, enter a value in the range of (24 hours *
60 minutes - 1) [1-minute step].
Daylight Saving:
Automatically adjust clock  De-select (default): If you do not want the clock to automatically adjust for
for daylight saving change daylight saving, do not select the check box. In the Start Daylight Saving and
End Daylight Saving fields, enter the month, day of week, and occurrence
range from the respective drop-down lists.
 Select: If you do want the BMENOP0300 module to automatically adjust for
daylight saving, select the check box. The Start Daylight Saving and End
Daylight Saving fields are disabled because their times are automatically
changed in the spring and fall every year.
Start Daylight Saving If you do not select the automatic daylight saving check box, select values for:
 Month: January to December
 Day of Week: Sunday to Saturday
 Occurrence: 1 to 5
 Hour: 0 to 23

End Daylight Saving If you do not select the automatic daylight saving check box, select values for:
 Month: January to December
 Day of Week: Sunday to Saturday
 Occurrence: 1 to 5
 Hour: 0 to 23

When you finish editing time synchronization configuration settings, click Apply to save your edits.

56 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Configuring the SNMP Agent

Description
The BMENOP0300 module includes an SNMP v1 agent. An SNMP agent is a software component
running on the BMENOP0300 module that allows access to the module diagnostic and
management information via the SNMP service. The SNMP tab is disabled by default in the
Modicon IEC 61850 configuration tool.
SNMP browsers, network management software, and other tools typically use SNMP to access
this data. In addition, the SNMP agent can be configured with a maximum of two IP addresses,
typically from PCs running network management software, to be the target of event driven trap
messages. These trap messages inform the management device of events such as cold start and
unauthorized access.
Use the Communication Settings → SNMP tab to configure the SNMP agent in the BMENOP0300
module.
The SNMP agent can connect to and communicate with up to 2 SNMP managers as part of an
SNMP service. The diagnostic information provided by the SNMP service is Standard SNMP
MIB 2.

QGH11908 12/2018 57
Configuring the BMENOP0300 Module

Viewing and Configuring SNMP Properties

The following settings can be viewed and edited in the Communication Settings → SNMP tab:

Setting Description
IP Address Managers:
IP Address Manager 1 The IP address of the first SNMP manager to which the SNMP agent
sends notices of traps.
Default IP address: [Link]
IP Address Manager 2 The IP address of the second SNMP manager to which the SNMP agent
sends notices of traps.
Default IP address: [Link]
Agent:
Location The device location (32 characters maximum)
Contact Information describing the person to contact for device maintenance
(32 characters maximum)
SNMP Manager If this is:
 Selected: the Location and Contact information are not editable
 De-selected: Location and Contact settings are editable

Community Names:
Get Password required by the SNMP agent before executing read commands
from an SNMP manager (default = public).
Set Password required by the SNMP agent before executing write commands
from an SNMP manager (default = private).
Trap Password that an SNMP manager requires from the SNMP agent before
the manager accepts trap notices from the agent (default = alert).

When you finish editing SNMP property settings, click Apply to preserve your edits.
NOTE: The sysName SNMP parameter is not editable or visible in the Modicon IEC 61850
Configuration Tool. By default, sysName is set to BMENOP0300.

58 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Security

Restricting Access to the BMENOP0300 Module

Using the Modicon IEC 61850 Configuration Tool, you can open Communication Settings →
Security tab and restrict access to the module by:
 disabling the module FTP service
 disabling the module SNMP service
 disabling the module IPsec service
 specifying the Ethernet devices that may make TCP port 502 connections with the module

Enabling and Disabling the FTP, SNMP, and IPsec Services

The BMENOP0300 module uses the FTP service to support firmware upgrades, and uses the
SNMP service to provide access to diagnostic information for the module.
You can enable and disable these services using the Modicon IEC 61850 Configuration Tool in the
Security tab of the Communication Settings window:
 Select Enable FTP to enable the FTP service. De-select it to disable the service.
 Select Enable SNMP to enable the SNMP service. De-select it to disable the service.
 Select the Enable IPsec check box to enable the IPsec service. Then, enter a 16-ASCII-
character string in the Pre-Shared Key field. De-select the Enable the Enable IPsec check box
to disable the service.
When you finish editing the services, click Apply to preserve your edits.

Configuring Access Control

You can also use the Security tab of the Communication Settings window to specify the Ethernet
devices that may make FTP, Port 502, and IEC 61850 connections with the module, in its role as
server. When you select Access Control, add the IP addresses of the devices that may open a
connection with the module.
When you enable access control, consider adding the following devices to the list of
Authorized Addresses and Subnet mask so that they may communicate with the module:
 any client device that may send a request to the BMENOP0300 module, in its role as IEC 61850
Server
 your own maintenance PC so that you can communicate with the PLC via Control Expert to
configure and diagnose your application
 any target device to which the BMENOP0300 module may be accessed

QGH11908 12/2018 59
Configuring the BMENOP0300 Module

Adding and Removing Devices in the Authorized Address List

To add a device to the Authorized Addresses list:

Step Description
1 In the Access Control area, select the Access Control check box.
2 In the Access Control editable table, select an empty field in the IP Address column and enter
the appropriate IP address.
3 Enter the respective subnet mask address for each IP address in the Subnet mask column.
4 For each IP address you add, select Yes or No in the Subnet column.
5 For each of the IP addresses you entered:
 Select the check box for each parameter to enable that functionality.
 De-select the check box for each parameter to disable that functionality.

Parameters:
 FTP
 Port 502
 IEC 61850 Server
 SNMP

6 Repeat steps 2 through 5, for each additional device to which you want to grant access to the
BMENOP0300 module.
NOTE: Add an IP address only once. Duplicate IP addresses are not allowed.
7 When you finish making access control edits, click Apply to save your edits.

NOTE: You can authorize access control for a maximum of 128 devices.

60 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Configuring IP Secure Communications

Introduction to IPsec
The Internet Engineering Task Force (IETF) developed and designed Internet Protocol Security
(IPsec) as an open set of protocol standards that make IP communication sessions private and
secure. The IPsec functionality of the BMENOP0300 module supports the data integrity and origin
authentication of IP packets.
Follow the steps below to create a specific IPsec configuration on a Windows 7 PC. For more
information about IPsec, refer to the Internet Engineering Task Force website ([Link]).
Client-initiated communications are not supported from the BMENOP0300 module when IPsec is
enabled. For example, peer-to-peer (BMENOP0300-to-BMENOP0300) communications are not
supported when IPsec is enabled.
NOTE: You cannot enable the IPsec protocol and the IP Forwarding service at the same time. (You
cannot build a Control Expert project when both are enabled. Refer to the table for using different
services and protocols.)

Process Overview
Configure IPsec communications in these stages:

Stage Name Description

1 Policy Create an IPsec policy (see page 62).
2 Rule Tunnel Endpoint: no tunnel (transport mode) (see page 63)
Connection type: network connections or local area network (see page 63)
IP Filter List (see page 63):
 IP filter:
 address: IP address of the first BMENOP0300 module
 protocol: Any
 description: BMENOP0300 module 1

 IP filter 2:
 address: IP address of the second BMENOP0300 module
 protocol: Any
 description: BMENOP0300 module 2

NOTE: Repeat these steps for each BMENOP0300 module in your

configuration.
IP Filter Actions (see page 64):
 action: block, permit, negotiate
 method: SHA-1 (no encryption)
 key expiration: 86400

Authentication Method (see page 65): pre-shared key

QGH11908 12/2018 61
Configuring the BMENOP0300 Module

Stage Name Description

3 General Properties Security policy name and description
(see page 65) Policy change timeout
Key exchange settings:
 PFS
 authentication timeout (2879 min.)
 Internet Key Exchange (IKE) security methods
 key exchange encryption: 3DES
 Integrity: SHA1
 Diffie-Hellman group: 1024 - medium (2)

4 Enable/Disable Enable or disable the IPsec policy (see page 66).

5 Configuration Tool Configure the pre-shared key (see page 66).

Before You Begin

Configure IPsec manually for each PC that supports IPsec:
 These directions are for PCs that run Windows 7.
 Confirm that you have administrative privileges to configure IPsec.
 Harden the PC that hosts the IPsec client to decrease the attack surface and observe the
defense-in-depth concept. Refer to Schneider Electric’s guidelines to harden your PC to reduce
the surface of vulnerability.

IP Security Policy
Create an IPsec policy to define the rules for secure communications within the IPsec protocol:

Step Action
1 On a Windows 7 PC, open the Administrative Tools from the Control Panel.
NOTE: Consult your Windows 7 documentation to access the Administrative Tools.
2 Double-click Local Security Policy to open the Local Security Policy window.
3 In the left pane, expand Security Settings and double-click IP Security Policies on Local Computer.
4 In the right pane, right-click and scroll to Create IP Security Policy ... to open the Policy Wizard.
5 In the IP Security Policy Wizard, select the Next button:
a. Assign a name to a new Security Policy in the Name field.
b Provide a description of the new policy in the Description field. (This step is optional).
6 Select the Next button to proceed to the Requests for Secure Communication window.

62 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Step Action
7 De-select the check box (Activate the default ...) and select Next to open the Completing the IP
Security Policy Wizard.
8 De-select the Edit properties check box and select Finish.

NOTE: The new security policy appears in the right pane of the IP Security Policies on Local
Computer window. You can double-click the security policy at any time to access its Properties
window.

IP Security Rule
Configure an IPsec rule to enable an IPsec configuration to monitor traffic between the application
layer and the network layer:

Step Action
1 In Windows 7, double-click the policy to open the Properties window.
2 Select the Rules tab.
3 Select Add... to open the Create IP Security Rule Wizard.
4 Select Next to configure the Tunnel Endpoint.
5 Select This rule does not specify a tunnel to use the Transport mode within the IPsec protocol.
6 Select Next to configure the Network Type.
7 Select the All network connections option button to apply the policy to local and remote connections.
8 Select Next to access the IP Filter List configuration.
NOTE: The IP Filter List identifies the traffic that is processed through the IPsec rule.

IP Filter List
IPsec uses packet filters to evaluate communication packets according to their connections to
various services. Packet filters are located between the endpoints of a peer-to-peer connection to
verify that the packets adhere to the established administrative rules for communications.
Every IP filter in a single IP filter list has the IP address of the same source of the communications
packets. The IP addresses for the destinations of communications packets (BMENOP0300
modules) are different.
Create a filter list that contains the IP addresses for the BMENOP0300 modules that can
communicate with the source (PC):

Step Action
1 In Windows 7, in the IP filter lists table of the Security Rule Wizard, click Add to create a new IP filter
list:
a. Assign a name to a new Filter List in the Name field.
b. Provide a description of the new Filter List in the Description field. (This step is optional.)
2 Select Add to open the IP Filter Wizard and select Next.

QGH11908 12/2018 63
Configuring the BMENOP0300 Module

Step Action
3 Provide an optional description of the new IP Filter in the Description field.
4 Select the Mirrored check box to communicate in both directions (source and destination).
5 Select Next to configure the IP Traffic Source.
6 Select My IP Address to designate the PC at one endpoint of the secure communications.
7 Select Next to configure the IP Traffic Destination.
8 Select a specific IP Address or Subnet and enter the IP address of the BMENOP0300 module in your
configuration. (The BMENOP0300 module is the only destination for this traffic.)
9 Select Next to configure the IP Protocol Type and select Any to allow traffic from the trusted IP address.
10 Select Next to view the Completing the IP Filter Wizard window.
11 De-select the Edit properties check box, and select Finish to return to the IP Filter List.
12 Select OK to exit the IP Filter List.

IP Filter Actions
Configure filter actions:

Step Action
1 In Windows 7, in the Name column of the IP Filter List, select the option button for the newly created
IP filter list and click Next to configure the Filter Action.
2 Select the Use Add Wizard check box.
3 Select Add to open the Filter Action Wizard.
4 Select Next to configure the Filter Action Name:
a. Enter a name for the Filter Action in the Name field.
b. Provide an optional description of the new Filter Action Name in the Description field and Select
Next.
5 Select Negotiate security and Next.
NOTE: The source and destination addresses agree on a method for secure communication before
packets are sent.
6 Select Do not allow unsecure communication, and select Next.
7 Select Custom in the IP Traffic Security window, and select Settings to customize the settings:
a. Select Data and Address integrity without encryption, and select SHA1 in the list to use secure
hash algorithm 1.
b. De-select the Data integrity with encryption check box to disable the Encapsulating Security
Payload (ESP)..
c. Select the Generate a new key every check box, and enter 86400 in the seconds field to specify
that the IKE expires in 86400 seconds.
d. Select OK to return to the IP Traffic Security configuration.
8 Select Next.
9 Select the Edit properties check box, and select Finish.

64 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Step Action
10 Do not select the Use session key perfect forward secrecy (PFS) check box.
11 Select OK.

Authentication Method
Source and destination devices can agree to use a secret text string before communications begin.
In this case, the string is called a pre-shared key.
Configure the authentication method to use a pre-shared key:

Step Action
1 In Windows 7, in the Name column of the Filter Actions, select the option button for the newly created
IP filter list, and click Next to configure the Authentication Method.
2 Select the Use this string to protect the key exchange (preshared key) check box.
3 In the text field, use any 16 ASCII characters to create a case-sensitive name for the pre-shared key.
NOTE: At the end of this process, you will configure an identical pre-shared key to create a
connection between a specific IP address and the BMENOP0300 module.
4 Select Next.
5 De-select the Edit properties check box, and select Finish.

IP Security Policy General Properties

Configure the general properties:

Step Action
1 In Windows 7, in the Properties window, select the General tab.
2 Click Settings to open the Key Exchange Settings window.
3 Do not select the Master key perfect forward secrecy (PFS) check box.
4 In the minutes field, enter 2879 to set the key lifetime to 2879 minutes (47 hours and 59 minutes).
5 Click Methods... to open the Key Exchange Security Methods window.
6 Click Edit to open the IKE Security Algorithms window.
7 In the three lists, make these selections:
 Integrity algorithm: SHA1 (Secure Hash Algorithm 1)
 Encryption algorithm: 3DES (Triple Data Encryption Algorithm)
 Diffie-Hellman group: Medium (2) (Generate 1024 bits of master key material.)

8 Select OK to return to the Key Exchange Security Methods window.

9 Select OK to return to the Key Exchange Settings window.
10 Select OK to return to the Properties window.
11 Select OK to close the Properties window.

QGH11908 12/2018 65
Configuring the BMENOP0300 Module

Enable and Disable the Policy

Assign or un-assign a local security policy to enable and disable secure communications:

Step Action
1 In Windows 7, open Local Security Policy in Administrative Tools.
2 Right-click the name of the new local security policy in the Name column and make a selection:
 Assign: Assign the local security policy to enable communications to the IPsec-enabled PC.
 Un-assign: Un-assign the local security policy to disable communications to the PC.

The IPsec policy agent does not run if you see this message: The service cannot be started. In that
case, configure the service to start automatically:

Step Action
1 In Windows 7, expand (+) Administrative Tools.
2 Double-click Services to access the local services.
3 Double-click IPsec Policy Agent to open its properties.
4 Select the General tab.
5 In the Startup type list, select Automatic.
6 In the Service status, select Start.
NOTE: When Start is grayed out, the service is already running.
7 Select OK to apply the changes and close the window.

NOTE: When you enable IPsec, the Ethernet backplane port of the BMENOP0300 module is
disabled. This isolates the IPsec network (control room network) from the device network. (Refer
to the table for using different services and protocols.)

Configure IPsec in the Configuration Tool

Enable IPsec and set the pre-shared key:

Step Action
1 Open your Control Expert project.
2 In the configuration tool, double-click the name that you assigned to the BMENOP0300 module to open
the configuration window.
NOTE: You can also right-click the module and select Open to open the configuration window.
3 Select Security to view the configuration options.
4 In the IPsec menu, select Enabled.
5 In the Pre-Shared Key field, enter the 16-character name of the pre-shared key.
NOTE: The ASCII characters in the case-sensitive pre-shared key match the 16-character pre-shared
key that you defined earlier.

66 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Step Action
6 Select the Apply button to save the configuration.
7 Rebuild the project and download the application to apply these settings to the BMENOP0300 module.

Troubleshooting IPsec Communications

Use the standard Windows 7 IPsec diagnostic tools to troubleshoot IPsec communications. For
example, these steps use the Microsoft Management Console (MMC) service for management
applications:

Step Action
1 In Windows 7, create a console that includes an IP Security Monitor.
2 Click a server name.
3 Double-click Quick Mode.
4 Double-click Statistics to see the number of authenticated bytes that are sent and received.

NOTE:
 You cannot reset the values. To refresh the count values, relaunch the Microsoft Management
Console.
 Disable IP Forwarding (see page 45) before you enable IPsec. IPsec applies to a single IP
address.
Use a Wireshark network analyzer to confirm that IPsec communications have started for an
established IKE session. IPsec packets have an authentication header instead of the normal
protocol header. This table shows an example of a network trace of a successful IKE session that
was established by a ping request between a Windows 7 PC (source) and BMENOP0300 module
(destination):

Number Time Source Destination Protocol Length Information

1 0 [Link] [Link] ISAKMP 342 Identity Protection
(Main Mode)
2 0.00477 [Link] [Link] ISAKMP 126 Identity Protection
(Main Mode)
3 0.012426 [Link] [Link] ISAKMP 254 Identity Protection
(Main Mode)
4 1.594495 [Link] [Link] ISAKMP 270 Identity Protection
(Main Mode)
5 1.598533 [Link] [Link] ISAKMP 110 Identity Protection
(Main Mode)
6 1.603296 [Link] [Link] ISAKMP 110 Identity Protection
(Maine mode)
7 1.612634 [Link] [Link] ISAKMP 366 Quick Mode

QGH11908 12/2018 67
Configuring the BMENOP0300 Module

Number Time Source Destination Protocol Length Information

8 3.202976 [Link] [Link] ISAKMP 374 Quick Mode
9 3.207794 [Link] [Link] ISAKMP 102 Quick Mode

Use these solutions to facilitate communications when IPsec is enabled:

Behavior Explanation
There is no communication Explanation: The IPsec policy agent is not running.
with the BMENOP0300 Solution: Configure IPsec to start automatically.
when IPsec is enabled on
Explanation: IPsec is not enabled on the BMENOP0300.
the Windows PC. Solution: Enable IPsec on the Security tab of the configuration tool.
Explanation: IPsec is not configured properly in Windows.
Solution: See NOTE 1 (below).
Control Expert cannot Explanation: IPsec is not enabled on both the BMENOP0300 and the Windows
connect to the PC.
BMENOP0300 via Ethernet. Solution: See NOTE 2 (below).
Explanation: IPsec is not configured properly in Windows.
Solution: See NOTE 1 (below).
Explanation: The power to the BMENOP0300 module was recently cycled.
Solution: See NOTE 3 (below).
Unity Loader is not able to Explanation: IPsec is not enabled on both the BMENOP0300 and the Windows
connect to the PC.
BMENOP0300 via Ethernet. Solution: See NOTE 2 (below).
Explanation: IPsec is not configured properly in Windows.
Solution: See NOTE 1 (below).
Explanation: The power to the BMENOP0300 was recently cycled.
Solution: See NOTE 3 (below).
Explanation: The IKE and IPsec ports may be blocked by a firewall or another
program associated with antivirus applications.
Solution: See NOTE 4 (below).
NOTE 1: Confirm that the parameters in the Windows configuration match those in the IPsec implementation:
 Double-check the pre-shared key.
 Double-check the IP address of the BMENOP0300 module in the configuration tool.
 Disable Perfect Forward Secrecy for both communication endpoints in Windows.

NOTE 2: Verify that the configuration and the Local Security Policy are enabled for IPsec.
NOTE 3: Choose a solution:
 Wait 5 minutes for the Windows security associations to timeout.
 Unassign then reassign the local security policy in Windows to force the security associations to be reset.

NOTE 4: Verify that the IKE port (UDP 500) and IPsec Authentication Header port (51) are open on any
firewall between the PC application and the PAC, including the firewalls associated with antivirus applications
(like McAfee or Symantec).

68 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Configuring Data Rates

Introduction
The embedded switch in the BMENOP0300 module includes four Ethernet ports. Use the
Communication Settings → Switch tab to specify the data rate and duplex setting for each port, or
you let each port auto-negotiate these settings with the connected device.

Configuring Baud Rate Settings

Select the Enable check box next to the respective port, and choose the desired setting in the Baud
Rate drop-down list:

Port Available settings

ETH1 Select one of the following settings:
ETH2  100 Mbits/sec Full duplex
ETH3  100 Mbits/sec Half duplex
 10 Mbits/sec Full duplex
 10 Mbits/sec Half duplex
 Auto 10/100 Mbits/sec (default)

Backplane 100 Mbits/sec Full duplex

After you finish editing baud rate settings, click Apply to save your edits.

QGH11908 12/2018 69
Configuring the BMENOP0300 Module

Configuring the Syslog Service

Introduction
The syslog service is used to log events regarding cyber security. The BMENOP0300 module acts
as a syslog client to synchronize security events with a remote syslog server.
The syslog service is disabled by default by the BMENOP0300 module firmware.
NOTE: The service is not available when IPsec (see page 61) is enabled.
Configure the syslog service in Control Expert. Select Tools → Project Settings → General → PLC
diagnostics. Select the Event Logging check box to edit the following features:

Event Logging Type Action

SYSLOG server address Enter a valid IP address.
Default: [Link]
SYSLOG server port number Use the up/down arrows to select a value between 0 and 65535.
Default: 601
SYSLOG server protocol This field is disabled.
Default: tcp

Click Apply to save your edits. Click OK to close the Project Settings window.

Syslog Service Operation

Cyber security events are logged to a minimum of 100 messages before the oldest events are over
written by newer events. Cyber security events are logged even when the BMENOP0300 module
is operating at maximum configuration.
The BMENOP0300 module detects the following security events:
 TCP lack of connection due to Access Control list (where IEC 61850 was implemented)
 Communication services were enabled/disabled via the ETH_PORT_CTRL elementary
function. NOTE: If FTP is enabled in the Modicon IEC 61850 Configuration Tool, it can be
disabled/enabled via ETH_PORT_CTRL.
 Ethernet port link up/down events
 RSTP topology change
 Configuration download of communication services
 Program operating mode change of communications (Run, Stop)
 FTP events
 Unsuccessful and successful FTP login (for firmware update)

70 QGH11908 12/2018
 Configuring the BMENOP0300 Module

These events are currently supported in Unity Pro 12.0:

Events Related to . . .
Security/Authorization Changes in the System (Log Audit)
Unsuccessful connection from the configuration tool Application or configuration download from the
or the BMENOP0300 module (unsuccessful BMENOP0300 module
connection due to ACL, unsuccessful login, Application or configuration upload to the
unsuccessful TCP connection if not logged in) BMENOP0300 module (including online changes)
Communication parameters run time change outside Program operating mode change (Run, Stop, Init)
of the configuration (enable/disable of communication
services: FTP)
Baud rate changes: port link up and down
Any topology change detected: RSTP (port role
change, root change)

NOTE: Unity Pro is the former name of Control Expert for version 13.1 or earlier.

Syslog Service Diagnostics

The BMENOP0300 module provides the following diagnostics for the syslog service:
 EVENT_LOG_STATUS bit in scanner DDDT
 EVENT_LOG_STATUS bit is set to 1 if the event log service is operational or disabled.
 EVENT_LOG_STATUS bit is set to 0 if the event log service is not operational.
 LOG_SERVER_NOT_REACHABLE bit in DDDT
 LOG_SERVER_NOT_REACHABLE bit is set to 1 if the syslog clients does not receive an
acknowledgement of the TCP messages from the syslog server.
 LOG_SERVER_NOT_REACHABLE bit is set to 0 if the syslog client does receive an
acknowledgement of the TCP messages from the syslog server.

QGH11908 12/2018 71
Configuring the BMENOP0300 Module

Section 3.5
Uploading and Downloading Configuration Settings

Uploading and Downloading Configuration Settings

Uploading and Downloading Configuration Settings

Introduction
When you finish entering configuration settings for the BMENOP0300 module, perform the
following tasks:
 Update the application.
 Build the project.
 Transfer the built project to the CPU.

After the built application is transferred to the CPU, the CPU transfers configuration settings to the
BMENOP0300 module.
NOTE: Configuration settings do not take effect until they are successfully downloaded from your
PC to the CPU and from the CPU to the BMENOP0300 module.

Updating the Configuration

After you input configuration settings for the BMENOP0300 module, update the configuration as
follows:

Step Action
1 Close the Modicon IEC 61850 Configuration Tool.
Result: The Confirm dialog opens.
2 Click Yes to save your edits.
Result: The Confirm dialog closes. In the Configuration tab of the BMENOP0300 module
Properties window, the Update application button is enabled.
3 Click the Update application button.

Clicking Update application button creates variables that display the following information and
commands for your Control Expert project:
 the status of the IEC 61850 server and client
 the IEC 61850 data model mapped into PLC memory

Compiling the Project

To compile the updated project, in Control Expert select either Build → Build Changes or Build →
Rebuild All Project. Check the Output window to confirm the process succeeded.

72 QGH11908 12/2018
 Configuring the BMENOP0300 Module

Downloading the Application Program

After the application has been compiled, connect Control Expert to the CPU (PLC → Connect),
then download the application to the CPU (PLC → Transfer Project to PLC).
To transfer the compiled application program from Control Expert to the CPU, follow these steps:

Step Action
1 Connect Control Expert to the CPU: Select PLC → Connect.
2 Stop CPU operations if the CPU is executing an earlier version of the application: Select PLC →
Stop.
3 Download the application to the CPU: Select (PLC → Transfer Project to PLC.

On next power-up, the BMENOP0300 module compares the configuration in the CPU against the
one stored in the module.
 If the configurations are different or if there is no configuration program in the module, the CPU
downloads the configuration to the BMENOP0300 module. The module stores the new
configuration in its non-volatile memory and loads it on start-up.
 If the configurations are the same, the module loads the configuration stored in its non-volatile
memory.

Uploading the Application Program

To transfer the current application program from the CPU to Control Expert, follow these steps:

Step Action
1 Connect Control Expert to the CPU: Select PLC → Connect.
2 Stop CPU operations if the CPU is executing an earlier version of the application: Select PLC →
Stop.
3 Upload the application to the CPU: Select (PLC → Transfer Project from PLC.

NOTE: Uploading the application program does not also upload the IEC 61850 settings of the
BMENOP0300 module. To apply IEC 61850 settings, confirm that you have saved these settings
in a .prj file during a previous configuration. For instructions on how to apply saved IEC 61850
settings, refer to the topic Selecting the IEC 61850 Edition (see page 33).

Archiving the Application Program

To archive the application in Control Expert, do one of the following:
 Select File → Save As, then save the file as an .STU file type.
 After building the project (Build → Build Changes/Rebuild All Project), select File → Save
Archive... and save the file as an .STA file type.
NOTE: Saving your application as an .STA or .STU file type saves the entire Control Expert project,
including the IEC 61850 project file. If you export the application as a .ZEF file type, the IEC 61850
project file is not saved.

QGH11908 12/2018 73
Configuring the BMENOP0300 Module

74 QGH11908 12/2018
 M580 IEC 61850
IEC 61850 Server
QGH11908 12/2018

Chapter 4
Configuring the IEC 61850 Server

Configuring the IEC 61850 Server

Introduction
This chapter shows you how to configure the module as an IEC 61850 server.
Before configuring server properties, enable the IEC 61850 server function in the General window
(see page 38). After you enable the IEC 61850 server function, click the
IEC 61850 Server Settings button to open the Server Settings window. (see page 76)
NOTE: The IEC 61850 configurator editions support the following schema versions:
 Edition1: supports schema V1.6
 Edition2: supports schema V3.1

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Working with Server Configurations 76
Data Model 81
Instantiating Data Objects and Data Attributes 88
Working with Data Sets 90
Configuring Report Control Blocks 93
Publishing GOOSE Control Blocks 97
Working with SOE Data Sets 100
Subscribing to GOOSE Control Blocks from External References 102

QGH11908 12/2018 75
IEC 61850 Server

Working with Server Configurations

Introduction
Use the IEC 61850 Server window to perform the following functions for the BMENOP0300
module:
 View and edit server information, including:
 IP address

 Create a new IEC 61850 server that is:

 an empty IED server, then modeling
 based on an external ICD or CID file
 based on an external SCD file

 Delete an IEC 61850 server.

 Export an IEC 61850 server file to:
 a CID/ICD file
 an Excel spreadsheet file

 Open one of the following windows, where you can configure server functions:
 Data Model (see page 81)
 Application Settings (see page 88)
 Data Set (see page 90)
 Report Control (see page 97)
 GOOSE Control (see page 93)
 SOE Data Set (see page 100)
 External Reference (see page 102)

Before configuring server properties, enable the IEC 61850 server function in the General
(see page 38) window. After you enable the IEC 61850 server function, click the IEC
61850 Server Settings button to open the IEC 61850 Server window.

76 QGH11908 12/2018
 IEC 61850 Server

Viewing Server Information

When a server is created, the Server Information area displays the following server settings:

Setting Description
IED Name The read-only server name. By default, it is the same as the Module Name in the General
window (see page 38).
Description The configurable description of the server. By default, it displays the description provided by
the ICD template.
IP Select an IP address for the IEC 61850 server. IEC 61850 clients use this IP address to access
the server.
NOTE: The list can contain up to 3 IP addresses. IP addresses are added to the list in the
Communication Settings window.

NOTE: Before you create a new IEC 61850 server, the Server Information settings are empty and
disabled. After you create a new server instance, these settings display their default values.

Creating an Empty IED Server

To create a new empty IED server, follow these steps:

Step Action
1 When the IEC 61850 Server window opens, the Create IED Server dialog opens, presenting three
selections:
 Create an empty IED server.
 Select an external Schneider Electric ICD / CID file.
 Select an external Schneider Electric SCD file.

NOTE: If you cancel the Create IEC 61850 Server window, click the Create IEC 61850 Server
button to re-open it.
2 Select Create an empty IED server.
Result: The OK button is enabled.
3 Click OK.
Result: The Input IED Name dialog opens.
4 In the Input IED Name dialog, accept the default name or enter a new name for this IED.
NOTE: Use a maximum of 16 characters for the IED name.
5 Click OK.
Result: The new server is created.
6 Save the new server.
NOTE: A new empty IED server contains no predefined functions. Create all the functions your new
IED server requires.

QGH11908 12/2018 77
IEC 61850 Server

Creating a New Server from an External Schneider Electric ICD / CID File
You can create a new server instance from an ICD or CID file that was previously created and
saved using the Modicon IEC 61850 Configuration Tool. To create a new server from an external
ICD or CID file, follow these steps:

Step Action
1 When the IEC 61850 Server window opens, the Create IED Server dialog opens, presenting three
selections:
 Create an empty IED server.
 Select an external Schneider Electric ICD / CID file.
 Select an external Schneider Electric SCD file.

NOTE: If you cancel the Create IEC 61850 Server window, click the Create IEC 61850 Server
button to re-open it.
2 In the Create IED Server dialog, select Select an external ICD / CID file.
Result: The file path field and browse button are enabled.
3 Click the browse button beneath your selection.
Result: The Open dialog opens.
4 In the files of type list, select the type of file you want to select:
 ICD file (*.icd)
 CID file (*.cid)

5 Navigate to and select an ICD or CID file, then click Open.

Result: The dialog closes, and the name of the selected file appears in the path box.
6 Click OK.
Result: The Input IED Name dialog opens.
7 In the Input IED Name dialog, accept the default name or enter a new name for this IED.
8 Click OK.
Result: The new server is created.
9 Save the new server.

78 QGH11908 12/2018
 IEC 61850 Server

Creating a New Server from an SCD File

The Modicon IEC 61850 Configuration Tool can create a new server from an IED file contained in
an external SCD file. To create a new server from an external SCD file, follow these steps:

Step Action
1 When the IEC 61850 Server window opens, the Create IED Server dialog opens, presenting three
selections:
 Create an empty IED server.
 Select an external Schneider Electric ICD / CID file.
 Select an external Schneider Electric SCD file.

NOTE: If you cancel the Create IEC 61850 Server window, click the Create IEC 61850 Server
button to re-open it.
2 In the Create IED Server dialog, select Select an external SCD file.
Result: The file path field and browse button are enabled.
3 Click the browse button beneath your selection.
Result: The Open dialog opens.
4 Confirm that in the files of type list, SCD file (*scd) is selected.
5 Navigate to and select the appropriate SCD file, then click Open.
Result: The dialog closes:
 The name of the selected SCD file appears in the path box.
 The Select IED to Import list is populated with IEDs associated with the selected SCD file.

6 In the Select IED to Import list, select the appropriate IED file, then click OK.
Result: The Input IED Name dialog opens.
7 In the Input IED Name dialog, accept the default name for this IED.
NOTE: Schneider Electric recommends you do not change the default IED name.
8 Click OK.
Result: The new server is created.
9 Save the new server.

Deleting an Existing Server

You can delete the IEC 61850 server instance that is currently displayed in IEC 61850 Server
window. To delete the server, follow these steps:

Step Action
1 Open the server you want to display in the IEC 61850 Server window.
2
Click the Delete this server configuration button .
Result: The Confirm dialog opens and asks if you are sure you want to delete the server.
3 In the Confirm dialog, click Yes.
Result: The server is deleted, and the Create IEC 61850 Server button is enabled.
4 Save your edits.

QGH11908 12/2018 79
IEC 61850 Server

Exporting the Server to a CID or ICD File

You can export the IEC 61850 server instance that is currently displayed in IEC 61850 Server
window, as a CID or ICD file. To export a server, follow these steps:

Step Action
1 Click the Export toolbar button .
Result: The Save As dialog opens.
2 In the Save As dialog:
 Navigate to the location where you want to save the exported file.
 Select a file type: CID or ICD (or IID for Edition 2.0).
 Click Save.

Exporting the Server to an Excel Spreadsheet File

You can export the configured IEC 61850 server that is currently displayed in IEC 61850 Server
window, as an Excel 97-2003 spreadsheet file. To export a server, follow these steps:

Step Action
1 Click the Export to Excel button.
Result: The Save As dialog opens.
2 In the Save As dialog:
 Navigate to the location where you want to save the exported file.
 Click Save.

The exported Excel spreadsheet file populates the following fields with configured server data:
 Reference: the path and name of the data item
 BasicType: the data type of the item
 FC: the functional constraint value of the data item
 DO/DA: the type of item: data object (DO) or data attribute (DA)
 Initial Value: The initialized value assigned to the data item

All other fields in the spreadsheet are not populated.

Opening Additional Server Property Windows

To continue configuring properties for the IEC 61850 server open in the IEC 61850 Server window,
click one of the following:
 Data Model
 Application Settings
 Data Set
 Report Control
 GOOSE Control
 SOE Data Set
 External Reference

80 QGH11908 12/2018
 IEC 61850 Server

Data Model

Introduction
Use the Data Model window to view, add, remove, and edit the IEC 61850 data model for the
BMENOP0300 module IED.
The Data Model window displays:
 a data model navigator (on the left), which you can use to move through the data model and
select individual data items
 a data model editor, which you can use to view, add, remove, and edit the data items associated
with the item selected in the data model navigator
 a file path display, which indicates the object path of the editing element

NOTE: The Modicon IEC 61850 Configuration Tool supports flexible data modeling. You can
manage name space assignments in the application to meet your application needs. The Modicon
IEC 61850 Configuration Tool does not manage name space designations by default.
The data model editor presents a different interface, depending on the item selected in the data
model navigator. In the data model editor, you can add and remove optional data items. Mandatory
data items are automatically added by default, and cannot be removed.
Expand the navigation tree control and select a data item to display its related data items in the
data editor:

In the data model navigator, select a... ...to display the following items in the data model editor...
Module IED Logical devices
Logical device Logical nodes
Logical node Data objects
Data object Sub data objects and data attributes

QGH11908 12/2018 81
IEC 61850 Server

Working with Logical Devices

A module IED can include up to 16 logical devices. The System logical devices node is mandatory.
It is included by default and cannot be removed.
Each logical device includes the following parameters:
 Instance:
the name of the logical device, up to 16 characters long
 Description:
the editable description for a logical device
To add a logical device, follow these steps

Step Action
1 In the data model navigator, select the module IED.
Result: The data model editor displays a list of logical devices.
2 Click Add.
Result: The Input Logical Device Instance Name dialog opens.
3 Enter a logical device name of up to 16 ASCII characters.
4 Click OK.
Result: The dialog closes, and the new logical device is added to the data model editor.
5 (Optional) In the data model editor, type in a Description for the new logical device, then click Enter.
6 Save your edits.

To remove an optional logical device, select it in the data model editor, then right-click and select
Delete. When the item disappears from the list, click Save.

Working with Logical Nodes

The logical node table displays a list of logical nodes for the selected logical device. LLN0 is
mandatory for each logical device; LPHD is mandatory for each system logical device. They are
included by default and cannot be removed. Refer to the appendix for a list of logical nodes
(see page 214) supported by the BMENOP0300 module IED.
Each logical node includes the following parameters:
 Name:
the read-only name of the logical node
 Prefix:
an optional prefix to the logical node, for ASCII “x” characters long, editable only when a new
logical node is instantiated (Thereafter it is read-only.)
 LnClass:
the read-only name of the logical node class
 Instance:
a read-only sequential number automatically assigned to a new logical node, “y” characters
long, which, when more than one instance of a logical node class is added, this value
increments by a value of 1
NOTE: The combined length of the Prefix plus Instance (x + y) cannot exceed 12 characters.

82 QGH11908 12/2018
 IEC 61850 Server

 Type:
the name (an editable value of up to 64 ASCII characters) of the logical node template, which is
composed of several data objects. You can create several instances of logical node with the
same type (logical node template).
For example, a logical node type of class ARIS begins with “SE_ARIS_”.
 If you input text that matches this naming convention, (for example, "SE_ARIS_12345") the
Modicon IEC 61850 Configuration Tool uses the input text as the Type setting.
 If you input text that does not match this naming convention, the Modicon IEC 61850
Configuration Tool adds the expected prefix to your input text. (for example, if you input the
text "V001”, the value is edited to "SE_ARIS_V001".
 Description:
an editable text field you can use to describe the logical node
To add a logical node, follow these steps:

Step Action
1 In the data model navigator, select a logical device.
Result: The data model editor displays a logical node table, a logical node group selector, and a
logical node class list.
2 In the logical node group selector, select a logical node alphabetical group.
Result: The logical node class list displays items for the selected group.
3 Drag an item from the logical node class list to the logical node table.
Result: The Add Logical Node dialog opens.
4 In the Add Logical Node dialog, accept the default Prefix setting, or enter a new value.
In the Add Logical Node dialog:
 Accept the default Prefix (SE), or enter a value.
NOTE: if you enter a different prefix value, it will be added to the Name string. However the
Type value will be the concatenation of the prefix “SE” and the LnClass value.
 Enter a Type value.

LnClass and Instance values are automatically generated.

5 Click OK.
Result: The new logical node is added to the table.
6 Save your edits.

To remove an optional logical node, select it in the logical node table, then right-click and select
Delete. When the item disappears from the list, click Save.

QGH11908 12/2018 83
IEC 61850 Server

Working with Data Objects

The data object table displays a list of data objects for the selected logical node. The collection of
available data objects for each logical node is pre-defined by the IEC 61850 protocol. Mandatory
data objects are included by default and cannot be individually removed.
NOTE: Mandatory data objects for an optional logical node can be removed only by removing the
optional logical node.
Each data object includes the following parameters:
 Name:
the name of the data object:
 read-only for default data objects
 editable for extended data objects

NOTE: For data objects that can be added to a logical node more than once, the name includes
a numerical instance suffix. For example, Ind1 represents the first instance of the Ind data object
of the GGIO logical node.
 Common Data Class (CDC):
the read-only IEC 61850 protocol-specified group to which the data object belongs
NOTE: Refer to the appendix for a list of CDCs (see page 222) supported by the BMENOP0300
module IED.
 Mandatory:
a read-only indicator that, when selected, indicates the data object is required for the logical
node and cannot be removed
 Type Name:
an editable value that defines data objects inside a logical node, whose type is derived from and
extends a common data class
For example, a type name of the common data class SPS begins with “SE_SPS_”.
 If you input text that matches this naming convention, (for example, "SE_SPS_12345") the
Modicon IEC 61850 Configuration Tool uses the input text as the Type Name setting.
 If you input text that does not match this naming convention, the Modicon IEC 61850
Configuration Tool adds the expected prefix to your input text. (for example, if you input the
text "V001”, the value is edited to "SE_SPIS_V001".
There are two ways to add a data object:
 Add an optional data object.
 Extend a data object for the editing logical node.

NOTE: When you add a data object to a logical node, the data object is added not only to the logical
node instance, but to the underlying structure of the logical node object itself. Therefore, if a logical
node can be added to a logical device more than once (for example, LDevice → GGIO) every
instance of that logical node contains the newly added data object.

84 QGH11908 12/2018
 IEC 61850 Server

To add a new data object, follow these steps

Step Action
1 In the data model navigator, select a logical node.
Result: The data model editor displays a data object table and a data object list.
2 Drag an item from the data object list to the data object table.
Result: The Edit Data Object dialog opens.
3 In the Edit Data Object dialog, enter or select a Type. The text you enter or select is concatenated
with the prefix “SE” and the CDC value to form the Type Name.
4 Clock OK to close the dialog. The new data object appears in the data object table.
NOTE: If the data object can be added to the table:
 Only once, it is removed from the data object list.
 More than once, the data object remains in the list and a numerical instance suffix is added
to the data object name in the table.
5 Save your edits.

To add a new extension object, follow these steps

Step Action
1 In the data model navigator, select a logical node.
Result: The data model editor displays a data object table and a data object list.
2 Click Add Extension Object.
Result: The Edit Data Object dialog opens.
3 In the Edit Data Object dialog:
 Enter a Name of the new data object, up to ten ASCII characters.
NOTE: Verify that the first character of the value is a capital letter.
 Select a Common Data Class value.
 Enter or select a Type. The text you enter or select is concatenated with the prefix “SE” and
the CDC value to form the Type Name.
4 Clock OK to close the dialog. The new data object appears in the data object table.
5 Save your edits.

To remove an optional data object, select it in the data object table, then right-click and select
Delete. When the item disappears from the list, click Save.

QGH11908 12/2018 85
IEC 61850 Server

Working with Data Attributes

The data attribute table displays a list of data attributes for the selected data object. The collection
of available data attributes for each data object is pre-defined by the IEC 61850 protocol.
Mandatory data attributes are included by default and cannot be individually removed.
NOTE: A logical device can support up to 10000 data attributes.
Each data attribute includes the following parameters:
 Name:
the read-only name of the data attribute
 BasicType:
the read-only IEC 61850 protocol-specified data type for the data attribute
 Mandatory:
a read-only indicator that, when selected, indicates the data attribute is required for the data
object and cannot be removed
 FC: the functional constraint group of the data attribute
 Type: a text string describing the data attribute with the following BasicType values:
 a pre-determined, non-editable value = The Type setting is not displayed.
 a variable type, specified at the time of creation = The value is displayed.

NOTE: When you add a data attribute to a data object, the data attribute is added not only to the
data object instance, but also to the underlying structure of the data object. Therefore, if a data
object can be added to a logical node more than once (for example, LDevice → GGIO → Beh →
stVal)) every instance of that data object contains the newly added data attribute.
To add a data attribute, follow these steps

Step Action
1 In the data model navigator, select a data object.
Result: The data model editor displays a data attribute table and a data attribute list.
2 Drag an item from the data attribute list to the data attribute table.
Result: The data attribute is added to the table.
NOTE: If the data object can be added to the table:
 Only once, it is removed from the data object list.
 More than once, the data object remains in the list and a numerical instance suffix is added
to the data object name in the table.
3 For some data attributes the Select Type of Data Attribute dialog opens:
 For some attributes of the Struct BasicType, specify the attribute type.
 For some attributes of the Enum BasicType, select from a list of existing Type values. For
example: LDevice → SEMSTA1 → Beh → stVal).
In these cases, select a Type value, and click OK.
4 After the new data attribute appears in the data attribute table, Save your edits.

To remove an optional data attribute, select it in the data attribute table, then right-click and select
Delete. When the item disappears from the list, click Save.

86 QGH11908 12/2018
 IEC 61850 Server

Working with a Data Object that includes Sub Data Objects

The structure of some data objects includes sub data objects (for example, LDevice → MHAI →
HPhV). When you add a data object that includes sub data objects, the data model editor displays
both a data object editor and a data attribute editor. You can use these editors to add and remove
optional data sub objects and data attributes for this kind of data object.
Both the data object editor (see page 84) and the data attribute editor (see page 86) work in the
same manner as described above.

QGH11908 12/2018 87
IEC 61850 Server

Instantiating Data Objects and Data Attributes

Introduction
Use the Application Settings window to:
 Display IEC 61850 server data objects and data attributes.
 Instantiate data attributes and data objects by assigning an initial value to data attributes.

Before you can use the Application Settings window, first enable the IEC 61850 server
(see page 38) resident in the BMENOP0300 module; then create a new server instance
(see page 76) for the module.
NOTE:
 Assigning an initial value to a data attribute instantiates both that attribute and the associated
data object. An instantiated data attribute is indicated by the DAI object designation; an
instantiated data object is indicated by the DOI object designation (or SDI for sub data objects).
 Attributes with a value set to an empty string are not instantiated by the application. If values for
all data attributes of a data object are set to an empty string, the application does not instantiate
the data object.
 For data attributes of the functional constraint CF, the initial value remains constant after the
configuration is instantiated. For data attributes of other function constraint items, the initialized
value is the default value if not included in I/O mapping; otherwise, the functional constraint item
is not instantiated.
 For data out flow variables, an assigned initial value takes effect only if a variable is not mapped
to PLC memory. If a variable is mapped to PLC memory, its value comes from PLC memory.

Adding Data Objects and Data Attributes

The Application Settings window presents a Data Object Filter and a data table. Use the
Data Object Filter to select data objects and data attributes of the IEC 61850 server, then drag
them onto the data table. The data table displays the data objects and data attributes you add to it
in the following nested order:
LDevice → LNode → Data Object → Data Attribute
To add data objects and data attributes to the data table, follow these steps:

Step Action
1 In the Data Object Filter, select a logical device in the LDevice list.
Result: The contents of the LNode filter presents logical nodes of the selected logical device.
2 In the LNode list, select a logical node.
Result: The contents of the FC list presents functional constraint items of for the selected logical
node.
3 In the FC list, select a functional constraint item.
Result: The Data Object Filter displays the data objects and nested data attributes associated with
the selected functional constraint item.

88 QGH11908 12/2018
 IEC 61850 Server

Step Action
4 Do one of the following:
 Drag a data object or data attribute in the Data Object Filter and drop it onto the data table to
add it to the list.
 Click the Add All button to add all of the displayed data objects and data attributes to the list.

5 (Optional) Type in a text Description for each data object added to the list.
6 Repeat steps 1...5 for each data object or data attribute you want to add to the data table.
7 Save your edits to preserve the structure of the data table you created.

Instantiating Data Attributes and Data Objects

Assigning an initial value to a data attribute instantiates both that attribute and the associated data
object. To edit the initial value of a data attribute, follow these steps:

Step Action
1 In the data table, expand the LDevice, LNode, and data object rows until the associated Data
Attribute Instance items are visible.
2 In the Initial Value column, enter or select a value for the data attribute.
3 Repeat steps 1 and 2 for each data attribute you want to instantiate.
4 Save your edits.

Removing Data Attributes and Data Objects from the Data Table
To remove a data attribute from the data table, select the data attribute, then do one of the
following:
 Click the right mouse button and select Delete.
 Click the Delete key.

If you delete all attributes of a data object, that data object is removed from the data table.

QGH11908 12/2018 89
IEC 61850 Server

Working with Data Sets

Introduction
A data set is a collection of data attributes and data objects that can originate with many different
logical devices and logical nodes. Data sets can provide an efficient method of viewing and
transferring data. The IEC 61850 server can include up to 68 data sets and up to 256 basic type
data attributes. Furthermore, I/O events that are produced by an ERT module, to which the ERT
data set is dedicated, can be mapped to an IEC 61850 report directly.
Use the Data Set window to:
 Create a new data set.
 View the list of existing data sets.
 Edit the contents of a new or existing data set by adding data attributes to, or removing data
attributes from the data set collection.
 Remove a data set from the IEC 61850 server.

Before you can use the Data Set window, first enable the IEC 61850 server (see page 40) resident
in the BMENOP0300 module; then create a new server instance (see page 76) for the module.
After you create a data set, you can add it to GOOSE control blocks (see page 97) and also to
Report control blocks (see page 93).
NOTE:
Schneider Electric recommends that:
 When you add a stVal or cVal attribute, also add its companion q (quality) data attribute. The q
attribute contains valuable data information for your application.
 You do not add a t attribute to a GOOSE data set. To do so is not an efficient use of control block
space.

Creating a Data Set

To create a new data set, follow these steps:

Step Action
1 In the General → IEC 61850 Server → Data Model window, create the data model for your
module.
2 In the General → IEC 61850 Server → Data Set window, in the Data Set list, click the + button.
Result: A new data set appears in the data set list, with the default name ‘NewDatasetn’ (where n
represents the sequential number of the data set).
3 Do one of the following:
 Accept the default data set name.
 Double-click the default name, then type a new name and press Enter.

4 In the Description area, do one of the following:

 Accept the default data set description, which is the reference path to the data set.
 Type in a different description.

90 QGH11908 12/2018
 IEC 61850 Server

Step Action
5 In the Data Object Filter, use the filtering lists to navigate to the data attribute you want to add to
the data set. Make filtering selections for:
 LDevice: Select an IEC 61850 server logical device.
 LNode: Select a logical node associated with the selected logical device.
 FC: Select a functional constraint.

Result: The data attribute list, located below the filtering lists, presents the data attributes that
satisfy the selected filtering criteria.
6 Add data attributes to the data set in one of the following ways:
 Drag a data object node from the data attribute list and drop it on the FCDA table.
NOTE: When you add a data object, all of its data attributes are also added, even though they
are not visible in the list.
 Drag a single data attribute from the data attribute list and drop it on the FCDA table. Only the
selected data attribute is added to the data set.
Result: The FCDA table displays the data set in nested groups, as follows:
LDevice → LNode → Data Object → Data Attribute
7 Repeat steps 3 and 4, above, until all data attributes are added to the data set.
8 Save your edits.

Editing an Existing Data Set

To edit an existing data set, follow these steps:

Step Action
1 In the Data Set list, select an existing data set.
Result: The data attributes of the selected data set appear in the data set list.
2 To add data attributes, follow steps 3 to 5 in Creating a Data Set (see page 90) (above).
3 To remove data attributes, select one or more data attributes in the FCDA table, right click, then
select Delete from the context menu.
4 Save your edits.

Viewing Data Set Contents

To display the data attributes assigned to a data set, select the data set in the Data Set list. The
data attributes appear in the FCDA/FDC table.

QGH11908 12/2018 91
IEC 61850 Server

Removing a Data Set from the IEC 61850 Server

To remove a data set from the IEC 61850 Server, follow these steps:

Step Action
1 In the Data Set list, select an existing data set.
Result: The data attributes of the selected data set appear in the data set list.
2 Click the – button.
Result: The data set is removed from the list.
3 Save your edits.

92 QGH11908 12/2018
 IEC 61850 Server

Configuring Report Control Blocks

Introduction
Use report control blocks to transmit the information contained in data sets. Configure each report
control block to specify how the IEC 61850 server that resides in the BMENOP0300 module
transmits event data to IEC 61850 clients.
There are two kinds of report control blocks:
 Buffered (BRCB): Internal events (triggered by data-change and quality-change) cause one of
the following:
 the immediate transmission of a report
 the buffering of a report (within practical limitations) for later transmission

A report is buffered so that data object values are not lost due to transport flow control
constraints or a connection interruption. A buffered report control block provides sequence-of-
events (SOE) [Link] buffer size of a buffered report control block is fixed at 16k bytes
for each report control block instance.
 Unbuffered (URCB): Internal events (triggered by data-change and quality-change) cause the
immediate transmission of a report on a "best effort" basis. If no association exists, or if the
transport data flow is not fast enough to support the transmission, report data may be lost.
The IEC 61850 server in the BMENOP0300 module supports:
 up to 64 buffered or unbuffered report control block instances within a single IED
 up to 8 instances of a single buffered control block, which can be transmitted to 8 clients, upon
the occurrence of possibly different triggering conditions
Before you can use the Report Control Block window, confirm that you have done the following:
 Enable the IEC 61850 server (see page 40) resident in the BMENOP0300 module.
 Create a new server instance (see page 76) for the module.
 Create a data set incorporating data attributes from this BMENOP0300 module (see page 16).

NOTE:
 The BMENOP0300 module stores report control blocks in the LDevice System, at the
LNode LLN0.
 Although the BMENOP0300 module cyclically scans the data status in the M580 CPU, the
module’s scan cycle is not synchronize with PAC scan cycle. If the amount of data scanned by
the BMENOP0300 module is large, and if the PAC scan cycle is short, some changes to data
values may not be detected by the BMENOP0300 module.
 Minor changes in the value of an analog input can cause the generation of unnecessary reports.
The BMENOP0300 module supports the creation of a deadband value range for analog data
attributes (DA). Schneider Electric recommends that you use the deadband feature to limit
unwanted report generation. If the analog input change is less than the deadband magnitude,
no report is generated.

QGH11908 12/2018 93
IEC 61850 Server

Report Control Settings

Every report control block presents the following configuration settings:

Setting Description
Identification area:
Buffered Do one of the following:
 Select this check box to enable buffering for this report control block.
 De-select this check box to disable buffering.

This check box is de-selected by default.

ReportCB Name Enter a 10-character maximum report control name.
Description The editable description of the report control block, from 0...50
characters long.
Data Set Select the data set to include in the report control block.
Report ID A string value, 0...129 characters long, used as the source identifier in
report control block transmissions.
Conf Rev The read-only revision number for the report control block. The initial
value is 10000.
NOTE: This setting is increased in increments of 10000 each time one
of the following changes occurs:
 The identity of the data set associated with this control block
changes.
 Content of the associated data set changes.

Parameters area:
Buffer Time (ms) The time interval in milliseconds for the buffering of internal notifications
caused by data-change (dchg) or quality-change (qchg) by the BRCB
for inclusion into a single report.
Integrity Period Enter a value, in milliseconds, to periodically force the transmission of
all values in the data set. Using this setting synchronizes data values in
all clients that receive the transmission.
Indexed Do one of the following:
 Select this check box to enable indexing of this report control block.
 De-select this check box to disable indexing.

This check box is selected by default.

NOTE: The module supports up to 8 instances of indexed report
control blocks.
Index Number Select an index number for the report control block.
Trigger Conditions area:
Data Change Select this check box to transmit a report upon a change in value for an
item in the data set.
Quality Change Select this check box to transmit a report upon a change in quality for
any item in the data set.

94 QGH11908 12/2018
 IEC 61850 Server

Setting Description
Period Select this check box to transmit a report of all data set values upon
expiration of the Integrity Period.
NOTE: The integrity report is not available in a standby BMENOP0300
module in a redundant M580 network.
General Interrogation Select this check box to transmit a report, in response to a request from
a client, containing values for all data items in the data set.
NOTE:
 All buffered events are transmitted before the general-interrogation
report is transmitted.
 If the IEC 61850 server receives a request for a general interrogation
report while executing a previous general interrogation request,
execution of the current request stops. The server instead begins to
execute the new general interrogation request.
Report Content area:
Sequence Number Select this check box to include an auto-generated transmission
sequence number to the report control block transmission. This lets the
client determine if all transmissions have been received.
Report Timestamp Select this check box to include a time stamp in the report control block
transmission.
Reason for inclusion The reason for sending this report, for example:
 data change
 quality change
 general interrogation
 periodic transmission

Data Set Name Select this check box to include the configured data set name in the
report control block transmission.
Data Reference The name of the data set referenced in the report.
Buffer Overflow Select this check box to include the buffer overflow in the report content.
This check box is de-selected by default.
Entry Id Select this check box to include the entry ID in the report content.
This check box is de-selected by default.
Configuration Revision Select this check box to include the Configuration Revision setting of
the report control block in the transmission.

QGH11908 12/2018 95
IEC 61850 Server

Creating a New Report Control Block

To create a new report control block, follow these steps:

Step Action
1 In the Report Control list, click the + button.
Result: A new report control block appears in list, with the default name report_n (where n
represents the sequential number of the control block).
2 Enter values for the Identification, Parameters, Trigger Conditions and Report Content settings.
Refer to the description of Report Control Settings (above).
NOTE: To enter a setting value, click Enter or move your cursor and click outside the setting input
field.
3 Save your edits.

Editing an Existing Report Control Block

To edit an existing report control block, follow these steps:

Step Action
1 In the Report Control list, select an existing control block.
Result: The settings for the selected report control block appear in the Identification, Parameters,
Trigger Conditions and Report Content areas.
2 Enter values for the Identification, Parameters, Trigger Conditions and Report Content settings.
Refer to the section Report Control Settings (above).
NOTE: To enter a setting value, click Enter or move your cursor and click outside the setting input
field.
3 Save your edits.

Removing a Report Control Block

To remove a report control block from the IEC 61850 Server, follow these steps:

Step Action
1 In the Report Control list, select an existing control block.
Result: The settings for the selected report control block appear in the Identification, Parameters,
Trigger Conditions and Report Content areas.
2 Click the – button.
Result: The control block is removed from the list.
3 Save your edits.

96 QGH11908 12/2018
 IEC 61850 Server

Publishing GOOSE Control Blocks

Introduction
The BMENOP0300 module can publish module event data via GOOSE control blocks. Each
control block references a data set with data attributes that can describe module status and value
information. The module sends GOOSE control blocks in the form of multicast transmissions over
a VLAN. Other devices that subscribe to the VLAN receive the transmitted data.
Use the GOOSE Control Block window to:
 Create a new GOOSE control block.
 View the list of existing GOOSE control blocks.
 Edit the contents of a new or existing GOOSE control block.
 Remove a GOOSE control block from the IEC 61850 server.

Before you can use the GOOSE Control Block window, confirm that you have done the following:
 Enable the IEC 61850 server (see page 40) resident in the BMENOP0300 module.
 Create a new server instance (see page 76) for the module.
 Create the data set (see page 90) you want to add to, and be published by, a GOOSE control
block.
NOTE: The BMENOP0300 module stores GOOSE control blocks in the LDevice System, at the
LNode LLN0.

GOOSE Control Settings

NOTE: When publishing GOOSE transmissions:
 You can use the GooseSimulation element of the MODULE_STATE DDT to publish either
normal (0) or simulated (1) GOOSE transmissions.
 The relative diagnostic information of each GOOSE transmission is collected in a dedicated
DDT instance.
Every GOOSE control block includes the following settings:

Setting Description
Parameters area:
Conf Rev The read-only revision number for the GOOSE control block. The initial value is
10000.
NOTE: This setting is increased in increments of 10000 each time one of the
following changes occurs:
 The identity of the data set associated with this control block changes.
 Content of the associated data set changes.

Description The editable description of the GOOSE control block, up to 50 characters long.
1. This setting is enabled only if GOOSE Publishing is selected. Otherwise, it is disabled and contains no
value.

QGH11908 12/2018 97
IEC 61850 Server

Setting Description
GOOSE ID An editable string value, from 1...128 characters long, used as the source identifier
in GOOSE message transmissions. The default value is the reference path of this
GOOSE control block, in the form of: IED name / logical device name / logical node
[Link]
Data Set Select the data set (see page 90) to include in the GOOSE control block.
NOTE: Data set size cannot exceed 1496 bytes.
Publishing area:
MAC Address1 Enter the multicast address for GOOSE filtering. Valid values include:
01-0C-CD-01-00-01 ... 01-0C-CD-01-01-FF
VLAN ID1 Enter the VLAN ID for the GOOSE control block. A 3-character value that can
include 0...9, and A...F. GOOSE subscribers use this to filter received messages
based on VLAN identity. Default = 000.
NOTE: A setting of 000 indicates no VLAN ID is required. Switching equipment
drops the VLAN tag when VLAN ID is set to 000.
APP ID 1 Enter the APP ID for the GOOSE control block. A 4-character value that can
include 0...9, and A...F. GOOSE subscribers use this to filter received messages
based on the application configuration. Default = 0.
VLAN Priority1 Select the priority, 0...7, to be applied to VLAN transmissions of the GOOSE control
block. Ethernet switches that manage the VLAN use this value to prioritize
messages in their packet transmission queues.
Min. Time (ms)1 Enter the minimum time, from 20...1000 ms, between VLAN transmissions
containing this GOOSE control block. Confirm that minimum time is less than
Max. Time.
Max. Time (ms)1 Enter the maximum time, from 20...1000 ms, between VLAN transmissions
containing this GOOSE control block. Confirm that maximum time is greater than
Min. Time.
1. This setting is enabled only if GOOSE Publishing is selected. Otherwise, it is disabled and contains no
value.

98 QGH11908 12/2018
 IEC 61850 Server

Creating a New GOOSE Control Block

To create a new GOOSE control block, follow these steps:

Step Action
1 In the GOOSE Control list, click the + button.
Result: A new GOOSE control block appears in list, with the default name goosectrln (where n
represents the sequential number of the control block).
2 Enter values for the Parameters and Publishing settings. Refer to the section GOOSE Control
Settings (see page 97) (above).
NOTE: To enter a setting value, click Enter or move your cursor and click outside the setting input
field.
3 Save the new GOOSE control block.

Editing an Existing GOOSE Control Block

To edit an existing GOOSE control block, follow these steps:

Step Action
1 In the GOOSE Control list, select an existing control block.
Result: The settings for the selected GOOSE control block appear in the Parameters and
Publishing areas.
2 Enter values for the Parameters and Publishing settings. Refer to the section GOOSE Control
Settings (see page 97) (above).
NOTE: To enter a setting value, click Enter or move your cursor and click outside the setting input
field.
3 Save your edits.

Removing a GOOSE Control Block

To remove a GOOSE control block from the IEC 61850 Server follow these steps:

Step Action
1 In the GOOSE Control list, select an existing control block.
Result: The settings for the selected GOOSE control block appear in the Parameters and
Publishing areas.
2 Click the – button.
Result: The control block is removed from the list.
3 Save your edits.

QGH11908 12/2018 99
IEC 61850 Server

Working with SOE Data Sets

Introduction
You can use the Modicon IEC 61850 Configuration Tool to create a data set in the IEC 61850
server of the BMENOP0300 module that links to data produced by an SOE module. After the SOE
data set is created, you can use it to populate the data fields of a report control block.
Use the SOE Data Set window to:
 View the list of existing SOE data sets.
 Create a new SOE data set.
 Edit the contents of a new or existing SOE data set by:
 adding data attributes to, or removing data attributes from the data set collection
 assigning an Event ID value to each data attribute in the collection

 Remove an SOE data set from the IEC 61850 server.

Before you can use the SOE Data Set window, confirm that you have done the following:
 Enable the IEC 61850 server (see page 40) resident in the BMENOP0300 module.
 Create a new server instance (see page 76) for the module.

Creating an SOE Data Set

To create a new SOE data set, follow these steps:

Step Action
1 In the Data Set list, click the + button.
Result: A new data set appears in the data set list with the default name ‘dataset_n’ (where n
represents the sequential number of the data set).
2 Do one of the following:
 Accept the default data set name.
 Double-click the default name, type a new name, and select Enter.

3 In the Description area, do one of the following:

 Accept the default data set description, which is the reference path to the data set.
 Type in a different description.

4 In the Data Object Filter, use the filtering lists to navigate to the data attribute you want to add to
the data set. Make filtering selections for:
 IED: Select the IED name of the IEC 61850 server.
 LDevice: Select an IEC 61850 server logical device.
 LNode: Select a logical node associated with the selected logical device.
 FC: Select a functional constraint.
 DA: Select a data object with the same functional constraint in the selected logic node.

Result: data attribute list, located below the filtering lists, presents the data attributes that satisfy
the selected filtering criteria.

100 QGH11908 12/2018

 IEC 61850 Server

Step Action
5 To add data attributes to the data set, drag a data object node from the data attribute list and drop
it in the FCDA table.
Result: The FCDA table displays the data set in nested groups, as follows:
LDevice → LNode → Data Object → Data Attribute
6 Input an Event ID for the data attribute you added to the data set.
NOTE:
 For a Quantum ERT, Event Id is the channel number (1...32).
 For Mx80 SOE, the Event Id is the channel number (0...15).
 For an Mx80 CRA, the Event ID is generated by Control Expert.

7 Repeat steps 3, 4, and 5 until all data attributes are added to the data set.
8 Save your edits.

Editing an Existing SOE Data Set

To edit an existing SOE data set, follow these steps:

Step Action
1 In the Data Set list, select an existing SOE data set.
Result: The data references of the selected data set appear in the FCDA table.
2 To add data references, follow steps 3 to 5 in Creating an SOE Data Set.
3 To remove data references, select one or more data reference items in the FCDA table and right
click Delete.
4 Save your edits.

Viewing Data Set Contents

To display the data references assigned to an SOE data set, select the SOE data set in the
Data Set list. The data attributes appear in the FCDA table.

Removing a Data Set from the IEC 61850 Server

To remove a data set from the IEC 61850 Server, follow these steps:

Step Action
1 Confirm that the data set you want to remove has not been added to the data model
(see page 81).
2 In the Data Set list, select an existing SOE data set.
Result: The data references of the selected data set appear in the FCDA table.
3 Click the – button.
Result: The SOE data set is removed from the list.
4 Save your edits.

QGH11908 12/2018 101

IEC 61850 Server

Subscribing to GOOSE Control Blocks from External References

Introduction
You can configure the IEC 61850 server in the BMENOP0300 module to subscribe to GOOSE
published by external IEDs.
The method of subscribing to remote GOOSE data is different for the IEC 61850 client and server:
 For the IEC 61850 server, use the External Reference window to map the data attributes of a
remote IED to the data attributes of the local IED. The data attributes of the local IED are
updated with changes when the server receives the GOOSE published by remote IED.
 For the IEC 61850 client, use the Control Block tab of the I/O Mapping window to subscribe to
GOOSE data configured in a remote IED. Map the related data attributes in I/O mapping so that
you can locate the data attributes that are updated after receiving data.
In the External Reference window, the BMENOP0300 module adds the data attributes (DAs)
subscribed from the external IED to PLC memory, then updates the values of the subscribed DAs
as they change. The BMENOP0300 module performs this update when operating in either normal
or simulation mode.
For GOOSE subscriptions in simulation mode, it is possible to control [Link] to receive
or reject GOOSE data attribute for the server. Note that the client does not support simulation
mode and will ignore all GOOSE that are marked as simulation.
When the BMENOP0300 module receives a GOOSE update, the relative diagnostic information is
collected with dedicated DDT instances of IED_GOOSE.
LGOS is not supported automatically when subscribing to GOOSE, but it is possible to manage
LGOS in your PLC application using GOOSE diagnostic information.
Use the External Reference window to:
 Create mapping items that associate data attributes of the local BMENOP0300 module to data
attributes contained in GOOSE messages published by an external module.
 Edit mapping items you previously created.
 Remove mapping items you previously created.

Before you can use the External Reference window, confirm that you have done the following:
 Enable the IEC 61850 server (see page 40) resident in the BMENOP0300 module.
 Create a new server instance (see page 76) for the module.

102 QGH11908 12/2018

 IEC 61850 Server

Mapping Internal Data Attributes to GOOSE External References

Follow these steps to map the internal data attributes (that you want to receive and store external
data) to the external data attributes in a GOOSE transmission:

Step Action
1 In the External panel, click the Import SCD / CID button.
Result: The Importing external IED dialog appears.
2 In the Importing external IED dialog, click the ellipsis button.
Result: The Open dialog displays.
3 In the Open dialog, navigate to and select an SCD or CID file; then click Open.
4 In the Select IED to Import list, select the IED that publishes the data you want to import, and click
OK.
NOTE: Because all imported IEDs are managed in the same space, confirm that each imported
IED has a unique name. The software will not import IEDs with same name as previously
imported IED.
5 In the GOOSE list, select the control block that contains the data you want to import.
Result: The external reference list, located below the External filtering selections, presents the
external references that satisfy the selected filtering criteria.
6 In the External panel, select a data attribute from the external references list, then drag it to the
area marked Drag external information here to create mapping. A row is added to the Mapping
table, and the data attribute you added appears on the left side of the newly added mapping item.
Result: Select the right box of the data item in the Mapping table to which you want the external
reference mapped.
Repeat this step as many times as there are mapping items to populate.
7 In the Internal data panel, use the filtering lists to select the data attribute you want to add to PLC
memory. Filtering items include:
 IED: the read-only name of the module
 LDevice: Select an IEC 61850 server logical device.
 LNode: Select a logical node associated with the selected logical device.
 FC: Select a functional constraint.

Result: The data attribute list, located below the filtering selections, presents the data attributes
that satisfy the selected filtering criteria.
8 Use your cursor to select a data attribute in the Internal Data Objects data attribute list, and drag
it to the right box of the data item in the Mapping table to which you want the internal data item
mapped.
NOTE: When you select an internal data attribute, confirm that it is the same data type as the
data item to which it is mapped. If you attempt to map data items of different types, a message
box opens indicating the attempted mapping is not permitted.
Repeat this step as many times as there are mapping items to populate.
9 When you finish adding mapping items, Save your edits.

QGH11908 12/2018 103

IEC 61850 Server

Editing Mapping Items

After a mapping item is created, by adding both an internal data attribute and an external reference,
you can edit the item by replacing the internal data attribute.
To edit the internal data attribute, follow these steps:

Step Action
1 In the Internal Data Objects filter, navigate to the data attribute you want to add.
2 Select the replacement internal data item, and drag it to the right box of a mapping item. The new
internal data item overwrites the old one.

Deleting a Mapping Item

To delete an item from the mapping list, select the item in Mapping panel, then right click and select
Delete.

104 QGH11908 12/2018

 M580 IEC 61850
IEC 61850 Client
QGH11908 12/2018

Chapter 5
Configuring the IEC 61850 Client

Configuring the IEC 61850 Client

This chapter includes the following topics:

 Introduction (see page 105)
 Importing an IED (see page 106)
 Displaying IED Information (see page 106)
 Configuring theIEC 61850 Client (see page 107)
 Deleting IEDs (see page 110)

Introduction
Use the IEC 61850 Client window to import IEDs into, and delete IEDs from, your project. After you
add an IED to your project, you can:
 View basic information (including the IP address) and the data structure describing the IED.
 Use the I/O Mapping window to map data objects and data attributes from the IED server to PAC
memory addresses.
 Use the Parameter tab to map data object and data attributes from the IED model to a PAC
memory address. The mapping data could be updated via report, GOOSE or polling. Report
is recommend for it has high performance.
 Use the Control Block tab to map a report control block, GOOSE control block or Dons/
SBOns/Does/SBOes control block from the IED model to PAC memory address. The related
DDT (see page 128) will be generated.
 Write PAC program to control the Report, GOOSE, polling and Dons/ SBOns/Does/SBOes
control block to trigger the BMENOP0300 to communicate with the remote IED.
To use the IEC 61850 Client window, enable the IEC 61850 client (see page 40) resident in the
BMENOP0300 module.

QGH11908 12/2018 105

IEC 61850 Client

Importing an IED
To import an IED into your project, follow these steps:

Step Action
1 In the IEC 61850 Client window, click the Import IEDs button .
Result: The Import IED dialog opens.
2 In the Select CID/SCD file area, do the following:
1. Click the browse button. An Open dialog opens.
2. Navigate to and select the CID or SCD file that contains the IEDs you want to add.
3. Click OK to close the dialog.
Result: The Select IED to Import list populates.
3 Select one or more IEDs from the Select IED to Import list.
4 Click OK to close the Import IED dialog.
Result: Each selected IED is displayed in its own tile in the IEC 61850 Client window, with the
IED name appearing in the tile header.
5 Save your edits.

Displaying IED Information

After importing an IED, you can use the IEC 61850 client window to view basic information and the
data structure of the IED. Basic information for the imported IED server includes the following read-
only settings:

Setting Description
Originator Category The basis for changing values and IEC 61850 control services:
 Bay Control: control operation issued from an operator using a client located at
bay level
 Station Control: control operation issued from an operator using a client located
at station level
 Remote Control: control operation from a remote operator outside the
substation (for example: network control center)
 Automatic Bay: control operation issued from an automatic function at bay level
 Automatic Station: control operation issued from an automatic function at
station level
 Automatic Remote: control operation issued from an automatic function outside
of the substation
 Maintenance: control operation issued from a maintenance/service tool
 Process: status change occurred without control action (for example: external
trip of a circuit breaker or detected failure inside the breaker)
Originator Identification The configurable address of the originator that caused a change of a controllable
value. If NULL, the originator of a particular action is not known or not reported.
IP an editable 32-bit IP address assigned to the server in the imported IED, including
both network and host components

106 QGH11908 12/2018

 IEC 61850 Client

Configuring the IEC 61850 Client

Configuring the IEC 61850 client includes the following tasks:
A . View Basic IED Information
Use the IEC 61850 client window to display basic IED information (see page 106). This information
is used in the control operation and can be edited:

QGH11908 12/2018 107

IEC 61850 Client

B. Use I/O Mapping

Use the I/O Mapping window to map data objects and associated data attributes from the IED
server to the PAC DDT. Achieve this through the following steps:
1. In the General window, click the I/O Mapping button:

The I/O Mapping window, in step 2. below, opens.

108 QGH11908 12/2018

 IEC 61850 Client

2. In the I/O Mapping window, click the Client button to display the client I/O mapping interface
(because the default interface is for server mapping). The client I/O mapping interface displays
3 tabs: Parameters, Control Block, and System:

3. Configure the parameters and control block settings. Click the Parameters and Control Block
tabs to toggle between these frames. When configuring parameters, you can drag parameters
from the Data Object Filter to the Parameters frame. If you want to configure a series of
parameters, you can select these parameters in the Data Object Filter, then click the Add button
in the Parameters frame, and all the selected parameters will be mapped:

In the control block frame, you can configure the Control and Report control block.

QGH11908 12/2018 109

IEC 61850 Client

The FC drop-down menu presents four items. If you select:

 CO, you can see the Control control blocks under the current LNode.
 GO, you can see the GOOSE control block under the LNode.
 BR, you can see the BRCB block under the LNode.
 UR, you can see the URCB block under the LNode.

To configure the Polling Group control block, in the I/O Mapping frame select the parameters
you want to poll, and in the Polling Group column select the group you want to set. The default
is Not Poll.
C. Using the Control Block
The block will not work until you change the Cmd of the block. To send out a request or command
to a server, first enter values for the block’s other attributes, and only then change the value of the
Cmd. For example, if you want to enable a report, follow these steps:
1. Set the Index value of the Report Block. Before setting the value, you need know if the Report
Block is indexed. If not, accept the default Index value of 0. Otherwise set this to a value
between 1 and the maximum value (which can be found in the server’s model file).
2. Set the Attribute value. If you want to enable the Report, set the value to 1. Otherwise set the
value to 0.
3. Change the Cmd value.

Deleting IEDs
To delete an IED that has previously been imported into the IEC 61850 client, follow these steps:

Step Action
1 Click the Delete IED button located in the upper right corner of each IED tile,
Result: The Confirm dialog opens asking you if you are sure you want to delete the IED.
2 Click Yes.
Result: The IED is removed from the collection.
3 Save your edits.

110 QGH11908 12/2018

 M580 IEC 61850
I/O Mapping
QGH11908 12/2018

Chapter 6
Working with IEC 61850 Data Objects

Working with IEC 61850 Data Objects

Overview
This chapter shows you how to map data attributes to PLC memory using the I/O Mapping window;
then shows you how to use the new data objects in your program logic.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Mapping Data Attributes to PLC Memory 112
Working with IEC 61850 Data Objects 118
PLC State Management 119
DDT Data Structures 120
Working with the BMENOP0300 in a PAC Application 140

QGH11908 12/2018 111

I/O Mapping

Mapping Data Attributes to PLC Memory

Introduction
You can use the I/O Mapping window to link IEC 61850 client and IEC 61850 server data items to
memory locations in the PLC. You can access data items by navigating through the IEC 61850
protocol data structure:
IED → LDevice → LNode → Functional Constraint (FC)
The I/O Mapping window supports the following functional constraints:

FC Server Client Description

BR – √ Buffered report control block
CF – – Configuration value
CO √ √ Process control service command or status
DC – – Description attribute
GO – √ GOOSE report control block
MX √ √ Process measurement value
RP – √ Unbuffered report control block
ST √ √ Process status value
√ The FC is supported.
– The FC is not supported.

There are three groups of data items:

 System items contain the operating status of a module. System data items, for both the client
and server, are automatically mapped to the PLC. You cannot add items to, or delete items from,
the system data table is fixed.
 Parameter items can originate with either the client or the server. No parameters are mapped
to the PLC by default. You can add both client and server data objects and data attributes to the
mapping table.
 Control block items contain data provided by the following control blocks and services:
 unbuffered report control blocks (RP)
 buffered report control blocks (BR)
 GOOSE control blocks (GO)
 process control service command (CO)
 polling group service

NOTE: Polling group service data items are not displayed by the Modicon IEC 61850 Configuration
Tool. Instead, they are included in the data structure created by Control Expert when you click the
Update application button in the Configuration tab of the BMENOP0300 module Properties
window.

112 QGH11908 12/2018

 I/O Mapping

Viewing System Data Items

To view system data items, follow these steps:

Step Action
1 In the I/O Mapping window, select one of the following:
 Server to display data items for the IEC 61850 server
 Client to display data items for the IEC 61850 client

2 Click the System tab.

The mapping table displays system data items for the module in its role as server or client.

Adding Parameter Data Items

To add parameter data items, follow these steps:

Step Action
1 In the I/O Mapping window, select one of the following:
 Server to display data items for the IEC 61850 server
 Client to display data items for the IEC 61850 client

2 Click the Parameters tab.

The Data Object Filter presents data objects associated with the selected tab.
3 In the Data Object Filter, make the following selections:
1. In the IED list, select an IED.
NOTE: If you selected Server in step 1, the server IED is pre-selected.
2. In the LDevice list, select a device.
3. In the LNode list, select the logical node object that contains the data object (attributes) you
want to map to an address in the PLC.
4. In the FC list, select the functional constraint for the data attributes you want to map to an
address in the PLC.
The Data Object Filter displays the associated data objects and data attributes.
4 Select a data object or data attribute in the Data Object Filter, and then drag it to the mapping
table in the Parameters tab. If you selected a:
 Data object: The data object and all its associated data attributes are added to the table.
 Data attribute: Only the selected data attribute is added to the table.

NOTE: The data object order of data mapping depends on the structure defined in the
data model (see page 81).
5 If you selected Client in step 1, expand the mapping table to display each data attribute, then edit
the Polling Group setting for the attribute. Settings include:
 Not Poll: Indicates client can update data via control block (default)
 Group-1
 Group-2
 Group-3
 Group-4
 Group-5

QGH11908 12/2018 113

I/O Mapping

Step Action
6 Repeat steps 2...5 for each data object or data attribute you want to add to map to a located
memory address in the PLC.
7 Save your edits.

When you finish configuring the BMENOP0300 module, close the Modicon IEC 61850
Configuration Tool, then click Update application in the Configuration tab of the module Properties
window. Control Expert creates DDT variables for each data attribute (see page 118) and displays
each new DDT variable in the Control Expert Data Editor.

Adding Control Block and Service Data Items

To add data attributes from remote IEDs to the BMENOP0300 module in its role as IEC 61850
client, follow these steps:

Step Action
1 In the I/O Mapping window, click Client.
Result: The Data Object Filter presents the IEDs associated with the module in its role as IEC 61850
client.
2 In the I/O Mapping window, click Control Block.
Result: The Data Object Filter presents data objects associated with the selected tab.
3 In the Data Object Filter, drill down to the data attributes you want to add, by making the following
selections:
1. Select an IED.
2. Select an LDevice object.
3. Select an LNode object.
4. Select an FC object. Depending on the specific IED content, you can select:
 BR: buffered report control block
 RP: unbuffered report control block
 CO: process control value service
 GO: GOOSE control block

Result: The Data Object Filter displays the associated data objects and data attributes.
4 Select a item in the Data Object Filter, and then drag it to the mapping table in the selected tab.
5 Repeat steps 2...4 for each data item you want to add to map to a located memory address in the
PLC.
6 Save your edits.

Each block you add displays the following columns:

 Element:
the name of the control block, up to thirteen ASCII character (If the original name exceeds the
maximum length, a dialog asks you to edit and shorten this value.)
 Variable:
the concatenation of the Element value and the device DDT

114 QGH11908 12/2018

 I/O Mapping

 Type:
the type of mapping item: a control block or elementary variable
 Device DDT:
the device DDT of the mapped item in the PAC
 IED:
the name of the IED to which the mapped item belongs
 Reference Path:
the IEC 61850 protocol reference path to the control block or data object
 Array:
a check mark indicating this element is an array
 Length:
for array elements, the number of items in the array
When you finish configuring the BMENOP0300 module, close the Modicon IEC 61850
Configuration Tool, then click Update application in the Configuration tab of the module Properties
window. Control Expert creates DDT variables for each data attribute (see page 118) and displays
each new DDT variable in the Control Expert Data Editor.

Removing Data Attributes from the Mapping Table

To remove one or more data attributes from a mapping table, follow these steps:

Step Action
1 In the mapping table, select an item you want to delete.
2 Click the right mouse button to open a context menu.
3 Click Delete to remove the selected data items from the mapping table.
4 Repeat steps 1...3 for each item you want to delete.
5 Save your edits.

Export I/O Mapping File for Server IED

To export an I/O mapping file for the server IED, follow these steps:

Step Action
1 In the I/O Mapping window, select Server.
2 Confirm that the mapping table of the server is not empty.
3 Click Export.
4 In the Save As dialog:
 Navigate to the location where you wish to save the mapping file.
 (Optionally) Change the file name.
 Click Save.

The file, with a .map extension, is saved to the target location.

QGH11908 12/2018 115

I/O Mapping

Import I/O Mapping File for Server IED

To import an I/O mapping file for the server IED, follow these steps:

Step Action
1 In the I/O Mapping window, select Server.
2 Confirm that the mapping table of the server is not empty.
3 Click Import.
4 In the Open dialog:
 Navigate to and select the mapping file to be imported.
NOTE: Confirm that the name of the selected mapping file is the same as the name of the
server IED name.
 Click Open.

5 The Confirm dialog opens and asks if you want to import the selected mapping file. Click Yes.
6 If you selected a mapping file with a name different than the server IED name, an Error message
displays asking you to confirm the mapping file name. Click OK and return to step 4, above.
7 If you selected a mapping file with the correct name and format, all the pre-existing mapping
items in the server IED are removed, and the items in the mapping file are imported.

Export I/O Mapping File for Client IED

To export an I/O mapping file for the client IED, follow these steps:

Step Action
1 In the I/O Mapping window, select Client.
2 In the Data Object Filter, select the name of the IED to be exported, and confirm that the mapping
table of the client is not empty.
3 Click Export to generate a mapping file for the selected client IED.
4 In the Save As dialog:
 Navigate to the location where you wish to save the mapping file.
 (Optionally) Change the file name.
 Click Save.

The file, with a .map extension, is saved to the target location.

116 QGH11908 12/2018

 I/O Mapping

Import I/O Mapping File for Client IED

To import an I/O mapping file for the client IED, follow these steps:

Step Action
1 Confirm that the target client IED file to be imported exists.
2 In the I/O Mapping window, select Client.
3 Click Import.
4 In the Open dialog:
 Navigate to and select the mapping file to be imported.
NOTE: Confirm that the name of the selected IED name exists in the current project.
 Click Open.

5 The Confirm dialog opens and asks if you want to import the selected mapping file. Click Yes.
6 If you selected an IED name that does not exist in the current project, an Error message displays
asking you to confirm the IED name. Click OK and return to step 4, above.
7 If you selected an IED with the correct name and format, all the pre-existing items in the client
IED are removed, and the mapping file is imported for the target client IED.

Understanding the Relationship Between the PAC Scan Time and the Quantity of I/O Data
The BMENOP0300 module cyclically exchanges data with the PAC controller. The data included
in this cyclical exchange depends on the PAC scan time and the amount of data to be exchanged.
You will want to apply a PAC scan time that is sufficiently long to permit the exchange of all data
between the module and the controller. The following formula applies:
PAC scan time > Max[10 ms, (DataSum/150) ms]
In this formula, DataSum is the amount of input data, in bytes, that is available in the module
memory of the IEC 61850 configurator.
The following examples apply the above formula to determine a minimum recommended PAC scan
time:

Example DataSum (input data to be exchanged, in bytes) Minimum Recommended PAC Scan Time
1 300 10 ms
2 3000 20 ms

QGH11908 12/2018 117

I/O Mapping

Working with IEC 61850 Data Objects

Introduction
After you select data items in the I/O Mapping window, click Update application. Control Expert
creates the following data objects for each BMENOP0300 module in your project:
 a DDT located variable structure, including:
 {Module_name}_MOD_INFO
 {Module_name}_MOD_CONTROL
 {Module_name}_{IED name}

 a Device DDT unlocated variable structure that follows the IEC 61850 data model:
Module → IED → DataModel → LD → LN → DO → <SDO> → DA
You can access the data stored in variables using the dot addressing notation of the IEC 61850
data model, for example: “[Link]”.

Working with Device DDT Variables

In the Variables tab of the Data Editor window, the Type column displays values as follows:
 The top-most node displays the module name.
 Leaf (or end) nodes are of the data type, and point to the located variable identified in the Value
column.

Working with Located Variables

Control Expert creates unlocated variables for each data attribute mapped in the I/O Mapping
window. Click the Variables tab of the Data Editor to view the located address of each variable.
The IEC 61850 data model and Control Expert support different collections of data types
(see page 21). When Control Expert creates new located variables from IEC 61850 data attributes,
it assigns each new variable a data type supported by Control Expert.

118 QGH11908 12/2018

 I/O Mapping

PLC State Management

IEC 61850 Server

The BMENOP0300 module stops detecting events (report/GOOSE) when the PLC is stopped.
However, any report could be triggered by an animation table. In this case, the GOOSE publishing
continues with the last information. Integrity reports continue. The BMENOP0300 does not update
its value of GOOSE subscription into the PLC.
All the quality of the data object (DO) are invalid in the response to a read request from SCADA
when the PLC stops. In addition, the BMENOP0300 module supports the management of the
PhyHealth data object (DO) in the LPHD node of each logic device. When the PLC stops, the
PhyHealth stVal is set to "warning" and returns to "OK" when the PLC again begins to run. When
the PLC is stopped, the BMENOP0300 module denies all control operations.

IEC 61850 Client

When the PLC stops, the BMENOP0300 module does not update its value of GOOSE subscription
into the PLC; it disconnects with the remote IEDs.

IEC 61850 Roles and Functions

Depending on the state of the PLC, the following functions are supported:

IEC 61850 PLC State

Role/Function Run Stop
Server:
 buffered and unbuffered reporting X X
 GOOSE X X
 control commands X –
Client:
 buffered and unbuffered reporting X –
 GOOSE X –
 control commands X –
X: supported
–: not supported

QGH11908 12/2018 119

I/O Mapping

DDT Data Structures

Introduction
If you enable the IEC 61850 server, enable the client, and create one or more report and GOOSE
control blocks, Control Expert adds the following DDT data structures to your project:
 module information
 module control
 module diagnostic
 module state
 server state
 client state
 GOOSE control block
 control objects
 buffered report control block
 unbuffered report control block
 polling control block

Module Information
The {Module_name}_MOD_INFO DDT presents information for the module, IED server, and IED
client states, as well as the module control status, the names of which are the prefix of the DDT:

Element Type Description

MODULE_STATE {Module}_STATE global status of the BMENOP0300 modules
SERVER_STATE {Module}_SERVER_STATE server diagnostic information
CLIENT_STATE {Module}_CLIENT_STATE client diagnostic information

Module Control
The {Module_name}_MOD_CONTROL DDT presents information for module control for dual
network redundancy, the name of which is the prefix of the DDT:

Element Type Description

DualModuleDiag 1 ARRAY[0...8] module diagnostic. Its content is reserved for system usage
of UDINT and is not displayed by default in Control Expert. Its contents
is a copy of {Module_name}_MOD_DIAG.

ModDiag1 MOD_DIAG module diagnostic

ModuleControl2 WORD module mode control, one bit per functions

1
read only
2 read write

120 QGH11908 12/2018

 I/O Mapping

Element Type Description

SimulateMode 2 BOOL Bit 0: Effect on GOOSE publish

 0: normal mode
 1: simulation mode

ClearDiag2 BOOL Bit 1: Clear diagnostic information of IEC 61850

 1: clear, take effect on raise edge
1
read only
2 read write

Module Diagnostics
The {Module_name}_MOD_DIAG DDT presents read-only information for module diagnostics,
the name of which is the prefix of the DDT. This data is updated by the IEC 61850 server:

Element Type Description

HeartBeat UDINT the counter of heart beat, increment per PAC cycle
ScanCount UDINT the counter of I/O data scan
CurEntryID ARRAY [0...3] of current entry ID
WORD
TimeStamp TIME_850_FORMAT time entry
ScanState WORD scan status
 0: idle
 1: on-going

ModelSig UDINT module signature

QGH11908 12/2018 121

I/O Mapping

Module State
The {Module_name}_MODULE_STATE DDT presents diagnostic information for the IEC 61850
module, the name of which is the prefix of the DDT (all read only):

Element Type Bit Description

EthStatus WORD – Ethernet status
Port1Link BOOL 0 link up/down for Ethernet port 1
Port2Link BOOL 1 link up/down for Ethernet port 2
Port3Link BOOL 2 link up/down for Ethernet port 3
EthBkpPortLink BOOL 3 link up/down for Ethernet backplane port
NetworkStatus BOOL 6 0: Traffic overload detected (example: broadcast
storm). Check your network topology and
configuration.
1: No traffic overload detected.
GlobalStatus BOOL 7 0: One or more services not operating normally.
1: All services operational.
ServiceStatus WORD – one bit for each user-observable feature
RstpService BOOL 0 0: Service not operating normally.
1: Service operating normally or disabled.
Port502Service BOOL 1 0: Service not operating normally.
1: Service operating normally or disabled.
SnmpService BOOL 2 0: Service not operating normally.
1: Service operating normally or disabled.
MainIpAddressStatus BOOL 3 main IP address status (0 in the case of duplicate
IP or no IP assigned)
IedServer BOOL 6 0: Service not operating normally.
1: Service operating normally or disabled.
IedClient BOOL 7 0: Service not operating normally.
1: Service operating normally or disabled.
SntpClient BOOL 8 0: Service not operating normally.
1: Service operating normally or disabled.
FirmwareUpgrade BOOL 9 0: Service not operating normally.
1: Service operating normally or disabled.
FtpServer BOOL 10 0: Service not operating normally.
1: Service operating normally or disabled.
LldpService BOOL 11 LLDP service status
EventLogStatus BOOL 12 0: Event log service not operating normally.
1: Event log service operating normally or
disabled.
LogServerNotReachable BOOL 13 0: Acknowledgment received from the syslog
server.
1: No acknowledgment received from the syslog
server.
SNtpServerNotReachable BOOL 15 0: Service not operating normally.
1: Service operating normally or disabled.

122 QGH11908 12/2018

 I/O Mapping

Element Type Bit Description

EthPort1Port2Status BYTE – Ethernet port 1 and 2 status
Port 1 function – 0...1 0: disabled
1: access port
2: mirror port
3: network port
(Reserved) – 2...3 –
Port 2 function – 4...5 0: disabled
1: access port
2: mirror port
3: network port
RSTP Role – 6...7 0: alternate
1: backup
2: designated
3: root
EthPort3BkpStatus BYTE – Ethernet port 3 and backplane port status
Port 3 function – 0...1 0: disabled
1: access port
2: mirror port
3: network port
RSTP Role – 2...3 0: alternate
1: backup
2: designated
3: root
Eth Bkp Port function – 4...5 0: disabled
1: access port
2: mirror port
3: network port
(Reserved) – 6...7 –
FirmwareVersion WORD – MSB: major revision
LSB: minor revision
ServiceStatus2 WORD – One bit for each user-observable feature
Network3MainIpAddressStatus BOOL 2 Network 2 IP Address Status (0 if duplicate IP
address or no IP address assigned)
Reserved1 UDINT – reserved
InPackets UINT – number of packets received
InErrors UINT – number of inbound packets that contain detected
errors
OutPackets UINT – number of packets sent
OutErrors UINT – number of outbound packets that contain
detected errors
ConfSig UDINT – Signature of configuration file

QGH11908 12/2018 123

I/O Mapping

Server State
The {Module_name}_SERVER_STATE DDT presents diagnostic information for the IEC 61850
server in the module, the name of which is the prefix of the DDT:

Element Type Description

Active BOOL server status:
 0 = disabled
 1 = enabled

Health BOOL server health:

 0 = not operational
 1 = operational

ProtoEd BYTE IEC 61850 protocol edition:

 0x10 = 1.0
 0x20 = 2.0

ActiveConn BYTE number of established server connections

VariableRd UDINT count of read variable requests received by the server
VariableRdErr UDINT count of rejected MMS read variable requests
VariableWrt UDINT count of write variable requests received by the server
VariableWrtErr UDINT count of rejected MMS write variable requests
ReportsTx UDINT count of information report messages sent by the server
GooseTx UDINT count of GOOSE messages transmitted by the server
GooseRx UDINT count of GOOSE messages received by the server
GooseErr UDINT count of invalid GOOSE messages received by the server
ErrorCode (low word) WORD
InvalidConf BOOL low word:
 0x0001: invalid configuration
StackInitErr BOOL
 0x0002: stack init error detected
ConfInitErr BOOL  0x0004: config init error detected
BpCommErr BOOL  0x0010...0x00F0: BP comm error detected
DbBindErr BOOL  0x0100: DB binding error detected

ErrorCode (high word) WORD

ClockNotSyn BOOL high word:
 0x1000: clock not synchronized
DefaultIp BOOL
 0x2000: default IP
IPNotAvailable BOOL  0x4000: IP not available

RptEntity IED_RPT[x] report diagnostic information

(see page 150)
GooseEntity IED_GOOSE[x] report diagnostic information
(see page 102)

124 QGH11908 12/2018

 I/O Mapping

Client State
The {Module_name}_CLIENT_STATE DDT presents diagnostic information for the IEC 61850
client in the module, the name of which is the prefix of the DDT:

Element Type Description

Active BOOL client status:
 0 = disabled
 1 = enabled

Health BOOL client health:

 0 = not operational
 1 = operational

ProtoEd BYTE IEC 61850 protocol edition:

 0x10 = 1.0
 0x20 = 2.0

ActiveConn BYTE number of established server connections: 0...16

IEDHealth1 WORD IED connection status:
 0 = disconnected
 1 = connected

NOTE: Each bit represents one IED in the same order as

the sequence of IEDs in the SCL file.
{IED_HEALTH} BOOL Bit-0
{IED_HEALTH} BOOL Bit-1
... BOOL ...
{IED_HEALTH} BOOL Bit-15
IEDHealth2 WORD IED connection status:
 0 = disconnected
 1 = connected

NOTE: Each bit represents one IED in the same order as

the sequence of IEDs in the SCL file.
{IED_HEALTH} BOOL Bit-0
{IED_HEALTH} BOOL Bit-1
... BOOL ...
{IED_HEALTH} BOOL Bit-15
VariableRd UDINT count of read variable requests received by the server
VariableRdErr UDINT count of rejected MMS read variable requests
VariableWrt UDINT count of write variable requests received by the server
VariableWrtErr UDINT count of rejected MMS read variable requests
ReportsRx UDINT count of information report messages received by the
client

QGH11908 12/2018 125

I/O Mapping

Element Type Description

GooseRx UDINT count of GOOSE messages received by the client
GooseErr UDINT count of invalid GOOSE messages received by the client
ErrorCode (low word) WORD
InvalidConf BOOL low word:
 0x0001: invalid configuration
StackInitErr BOOL
 0x0002: stack init error detected
ConfInitErr BOOL  0x0004: config init error detected
BpCommErr BOOL  0x0010: BP communication detected error
DdtRdErr BOOL  0x0020: data dictionary disabled
 0x0100: DB binding error detected
DbBindErr BOOL
 0x1000: Report ID mismatch detected
RptidMismatch BOOL
Error Code (high word) WORD
ClockNotSyn BOOL High word:
 0x0001...0x00FF: configuration inconsistent (index of
DefaultIp BOOL
IED in SCL)
IPNotAvailable BOOL  0x1000: clock not synchronized
 0x2000: default IP address
 0x4000: IP not available

GooseEntity IED_GOOSE[x] report diagnostic information

GOOSE Diagnostics
The {Module_name}_IED_GOOSE DDT presents GOOSE control block diagnostic information
for the IEC 61850 module, the name of which is the prefix of the DDT:

Element Type Description

Service BYTE  0 = publish
 1 = GOOSE subscribe for server
 2 = GOOSE subscribe for client

Status BOOL  true = active

 false = not active

NdsCom BOOL The Need Commission attribute has a value of TRUE if the GoCB
requires further configuration when:
 The attribute DataSet has a value of NULL.
 The number or size of values being conveyed by the elements in
the DatSet referenced data-set exceeds constraint determined by
the SCSM or the implementation.
Simulation BOOL A value of True indicates Sim messages are received and accepted.
LastStNum UDINT the last state number
LastSqNum UDINT the last sequence number

126 QGH11908 12/2018

 I/O Mapping

Element Type Description

LastError UINT the last detected error:
 1: MAC not consist with configuration.
 2: AppID not consist with configuration.
 3: GOOSE data set not consist with configuration.
 4: initAddr is missing.
 5: GOOSE not received after Time to Alive expired.
 6: stNum is out of order.
 7: sqNum out of order.
 8: GOOSE ConfRev not consistent with configuration.
 9: Decoding GOOSE data error detected.
 10: Other unknown detected errors.
 11: NdsCom = True.
 12: Go Ref is incorrect.

Reserve UINT <reserved>

DDT Overview for Server

The {Module}_{IED name DDT overview for the IEC 61850 server data structure is as follows:

Element Type Trigger Definition

Freshness BOOL - 0: data is not fresh
1: data is fresh
When there is no IEC 61850
connection or backplane
communication, this element is
set to 0 (FALSE).
-DataModel
-{LD} {LD_Type} - This definition can be viewed in
-{LN_Type} the IEC 61850 Configuration
-{DO_Type Tool by navigating to IEC61850
-{DA_Type} Server → Data Model.
{LD_Type}
-{LN_Type}
-{DO_Type
-{DA_Type}
-{LD} {LD_Type} - This definition can be viewed in
-{LN_Type} the IEC 61850 Configuration
-{DO_Type Tool by navigating to IEC61850
-{DA_Type} Server → Data Model.
{LD_Type}
-{LN_Type}
-{DO_Type
-{DA_Type}
... ...

QGH11908 12/2018 127

I/O Mapping

Element Type Trigger Definition

-DatasetSOE {ERT_BUF} - It is used to transfer external
-{SOE DS name} events to the BMENOP0300
-{SOE DS name} module.

DDT Overview for Client

The {Module}_{IED name DDT overview for the IEC 61850 client data structure is as follows

Element Type Trigger Definition

Freshness BOOL - 0: data is not fresh
1: data is fresh
When there is no IEC 61850 connection
or backplane communication, this
element is set to 0 (FALSE).
ConenctCtrl BOOL - 0: Auto connect
1: disconnect
-Data Model
-{LD} {LD_Type} - This definition can be viewed in the IEC
-{LN_Type} 61850 Configuration Tool by navigating
-{DO_Type to IEC61850 Server → Data Model.
-{DA_Type}
{LD_Type}
-{LN_Type}
-{DO_Type
-{DA_Type}
-{LD} {LD_Type} - This definition can be viewed in the IEC
-{LN_Type} 61850 Configuration Tool by navigating
-{DO_Type to IEC61850 Server → Data Model.
-{DA_Type}
{LD_Type}
-{LN_Type}
-{DO_Type
-{DA_Type}
-PollBlock Polling control for each IED
POLL_GRPx {Module}_POLLING_CTRL -
X= 1...5

128 QGH11908 12/2018

 I/O Mapping

Element Type Trigger Definition

-ControlBlock General control
-{LD} {LD_Type} -
-{LN_Type}
-{DO_Type
-{CB_Type}
{LD_Type}
-{LN_Type}
-{DO_Type
-{CB_Type}
-ReportBlock Report control
{report cb name} {LD_Type} -
-{LN_Type}
-
{Module}_Report_BRCB }
-
{Module}_Report_URCB }
... ...
{LD_Type}
-{LN_Type}
-
{Module}_Report_BRCB }
-
{Module}_Report_URCB }
-GooseBlock Goose control
{goose cb name} {LD_Type} -
-{LN_Type}
-
{Module}_GOOSE_CB }
... ...
{LD_Type}
-{LN_Type}
-
{Module}_GOOSE_CB }

QGH11908 12/2018 129

I/O Mapping

Buffered Report Control Block

The data structure of the buffered report {Report_name}_REPORT_BRCB of the client function:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Option BYTE - option: operation selection, whose values include:
 1: set RptEna
 2: set BufTms
 3: set IntgPd
 4: set ResvTms
 5: set TrgOps
 6: set OptFlds
 8: set EntryID
 9: set RptID
NOTE: Execute option value 9 once before enabling the report
control block in the server to receive report information.
 10: set DataSet
NOTE: For set RptID and set DataSet commands, the source is
the SCL file and cannot be set dynamically in PLC memory.
 11: set GI
 12: set Purge buffer
 101: get RptEna
 102: get BufTms
 103: get IntgPd
 104: get ResvTms
 105: get TrgOps
 106: get OptFlds
 108: get EntryID
 120: get ConfRev
 121: get SgNum

Index BYTE - buffer index number: 1...99

NOTE: If the Index element is set to 0 (false), indexing is not used
for this report. In this case, leave the element value at 0.
AutoEna BYTE - How is report enabled?
 0 = enable on demand
 1 = auto enable

NOTE: Auto-enable is recommended so the report is enabled in

case of redundant switchover.

130 QGH11908 12/2018

 I/O Mapping

Element Type Trigger Definition

Attribute DWORD - common area for read/write of attribute, depending on the selected
option:
 BufTms DWORD
 IntgPd DWORD
 ResvTms DWORD
 ConfRev DWORD
 TrgOps low WORD of attribute
Refer to the BITSTRING topic (see page 21) for the bit detail of
trigger option.
 OptFlds low WORD of attribute
Refer to the BITSTRING topic (see page 21) for the bit detail of
option field.
 SgNum low WORD of attribute
 RptEna low WORD (bit 0) of attribute
 GI low WORD (bit 0) of attribute
 PurgeBuf low WORD (bit 0) of attribute

Entry_ID UINT[4] - entry ID reported in the last response

NOTE: Supported only by buffered report control blocks (BRCB).
RptStatus WORD -  low byte: index of report control block (1...99)
 high byte:
 bit 0 = ConfRev change
 bit 1 = buffer overflow

Status WORD - Status of command execution:

 low byte: same as command trigger
 high byte:
 bits 6..7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

AddCause Detected Error Codes

The following is a list of report and control object detected AddCause error codes:

Code Short Description Explanation of IEC 61850-7-2

1 Not-supported Not supported.
2 Blocked-by-switching-hierarchy Not successful, because one of the downstream Loc switches
like in CSWI has the value TRUE.
3 Select-failed Canceled due to an unsuccessful selection (select service).
4 Invalid-position Control action is aborted due to invalid switch position (Pos in
XCBR or XSWI).
5 Position-reached Switch is already in the intended position (Pos in XCBR or
XSWI).
6 Parameter-change-in-execution Control action is blocked due to running parameter change.

QGH11908 12/2018 131

I/O Mapping

Code Short Description Explanation of IEC 61850-7-2

7 Step-limit Control action is blocked because tap changer has reached
the limit
EndPosR or EndPosL in YLTC).
8 Blocked-by-Mode Control action is blocked because the LN (CSWI or
XCBR/XSWI)is in a mode (Mod) which doesn t allow any
switching.
9 Blocked-by-process Control action is blocked due to some external event at
process level that prevents a successful operation for example
blocking indication (EEHealth in XCBR or XSWI).
10 Blocked-by-interlocking Control action is blocked due to interlocking of switching
devices (in CILO attribute [Link]= FALSE or
[Link]= FALSE).
11 Blocked-by-synchrocheck Control action with synchrocheck is aborted due to exceed of
time limit and missing synchronism condition.
12 Command-already-in-execution Control select or cancel service is rejected because control
action is already running.
13 Blocked-by-health Control action is blocked due to some internal event that
prevents a successful operation (Health).
14 1-of-n-control Control action is blocked because another control action in a
domain (for example substation) is already running (in any
XCBR or XSWI of that domain the [Link]= TRUE).
15 Abortion-by-cancel Control action is aborted due to cancel service.
16 Time-limit-over Control action is terminated due to exceed of some time limit.
17 Abortion-by-trip Control action is aborted due to a trip (PTRC with [Link]
= TRUE).
18 Object-not-selected Control action is rejected because control object was not
selected.
19 Object-already-selected Select action is not executed because the addressed object is
already selected.
20 No-access-authority Control action is blocked due to lack of access authority.
21 Ended-with-overshoot Control action executed but the end position has overshoot.
22 Abortion-due-to-deviation Control action is aborted due to deviation between the
command value and the measured value.
23 Abortion-by-communication-loss Control action is aborted due to the loss of connection with the
client that issued the control.
24 Blocked-by-command Control action is blocked due to the data attribute
[Link] is TRUE.
25 None Command not successful due to Unknown causes.

132 QGH11908 12/2018

 I/O Mapping

Code Short Description Explanation of IEC 61850-7-2

26 Inconsistent-parameters The parameters between successive control services are not
consistent for example the ctlNum of Select and Operate
service are different.
27 Locked-by-other-client Another client has already reserved the object.

Detected Error Codes

The following is a list of detected error codes for operations (polling, report control, GOOSE control
and general control):

Function Code Short Description Explanation of IEC 61850-7-2

Control 1...27 AddCause Refer to AddCause (see page 131) detected
point errors.
61 Disconnected Offline with remote IED
63 Input parameter error detected Input parameter in data block is incorrect. For
example, a CtlVal is out of range.
Polling 61 Disconnected Offline with remote IED
62 Polling did not succeed One or more DOs or DAs are missing in
remote IED. Polling will continue if this error is
detected.
63 Input parameter error detected Input parameter in data block is incorrect.
Report 60 Auto-enable did not succeed A report was not enabled after going online.
Control Check the AutoEna element setting of the
control block.
61 Disconnected Offline with remote IED
63 Input parameter error detected Input parameter in data block is incorrect.
GOOSE 0 GOOSE disabled GOOSE control block is disabled
Control
1 GOOSE enabled GOOSE control block is enabled
61 Disconnected Offline with remote IED

QGH11908 12/2018 133

I/O Mapping

Unbuffered Report Control Block

The data structure of the unbufferred report {Report_name}_REPORT_URCB of the client
function:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Option BYTE - option: operation selection, whose alues include:
 1: set RptEna
 2: set BufTms
 3: set IntgPd
 5: set TrgOps
 6: set OptFlds
 7: set ResvUrcb
 9: set RptID
 10: set DataSet
NOTE: For set RptID and set DataSet commands, the source
is the SCL file and cannot be set dynamically in PLC memory.
 11: set GI
 101: get RptEna
 102: get BufTms
 103: get IntgPd
 105: get TrgOps
 106: get OptFlds
 107: get ResvUrcb
 111: get GI
 120: get ConfRev
 121: get SgNum

Index BYTE - buffer index number: 1...99

NOTE: If the Index element is set to 0 (false), indexing is not
used for this report. In this case, leave the element value at 0.
AutoEna BYTE - How is report enabled?
 0 = enable on demand
 1 = auto enable

NOTE: Auto-enable is recommended so the report is enabled in

case of redundant switchover.

134 QGH11908 12/2018

 I/O Mapping

Element Type Trigger Definition

Attribute DWORD - common area for read/write of attribute, depending on the
selected option:
 BufTms DWORD
 IntgPd DWORD
 ConfRev DWORD
 GI low WORD of attribute
 TrgOps low WORD of attribute
Refer to the BITSTRING topic (see page 21) for the bit detail
of trigger option.
 OptFlds low WORD of attribute
Refer to the BITSTRING topic (see page 21) for the bit detail
of option field.
 SgNum low WORD of attribute
 RptEna low WORD (bit 0) of attribute
 UrcbResv low WORD (bit 0) of attribute

RptStatus UINT -  low byte: index of report control block (1...99)

 high byte: bit 0 = ConfRev change

Status STATUS - Status of command execution:

 low byte: same as command trigger
 high byte:
 bits 6..7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

GOOSE Control Block

The data structure of the {Module_name}_GOOSE_CB DDT:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Option BYTE - option: operation selection:
 0 = GOOSE disable
 1 = GOOSE enable
 2 = Get GoCB

Status WORD - status of command execution:

 low byte: same as command trigger
 high byte:
 bits 6..7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

QGH11908 12/2018 135

I/O Mapping

Polling Control Block

The data structure of the {Module_name}_POLLING_CTRL DDT:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Option BYTE - Not displayed.
Status WORD - status of command execution:
 Busy: command is executing
 OK: command is successful
 Unsuccessful: one of the following events occurred:
 the client received a negative response.
 a timeout occurred before the client received a
response.

NOTE: If a polling command detects an error for a DO, the Status element for that DO displays a
detected error code (see page 133), and the polling process continues for the next DO.

OPER Control Objects

The OPER control object presents alternative structures, depending on the data type: BOOLEAN,
INT8, INT32, ENUM, or ANA. An example of each DDT structure follows for the OPER control
object:
The data structure of the {Module_name}_CO_OPER_BOOL control object DDT:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Check BYTE -  bit 0...1: operation type:
 0 = operate
 1 = select
 2 = cancel
 3 = auto (select & operate)

 bit 2...4 = reserved

 bit 5: synchrocheck: whether to perform synchrocheck
 Bit 6: synchrocheck: whether to check for interlocking
condition
 Bit 7: test

CtVal BYTE - bit 0: ctlVal; value to control

Resv BYTE - reserved for alignment
Status WORD - Status of command execution:
 low byte: same as command trigger
 high byte:
 bits 6..7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

136 QGH11908 12/2018

 I/O Mapping

The data structure of the {Module_name}_CO_OPER_INT8 control object DDT:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Check BYTE -  bit 0...1: operation type:
 0 = operate
 1 = select
 2 = cancel
 3 = auto (select & operate)

 bit 2...4 = reserved

 bit 5: synchrocheck: whether to perform synchrocheck
 Bit 6: synchrocheck: whether to check for interlocking
condition
 Bit 7: test

CtVal INT - value to control

Resv BYTE - reserved for alignment
Status WORD - status of command execution:
 low byte: same as command trigger
 high byte:
 bits 6...7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

The data structure of the {Module_name}_CO_OPER_INT32 control object DDT:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Check BYTE -  bit 0...1: operation type:
 0 = operate
 1 = select
 2 = cancel
 3 = auto (select & operate)

 bit 2...4 = reserved

 bit 5: synchrocheck: whether to perform synchrocheck
 Bit 6: synchrocheck: whether to check for interlocking
condition
 Bit 7: test

CtVal DINT - value to control

Status WORD - status of command execution:
 low byte: same as command trigger
 high byte:
 bits 6...7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

QGH11908 12/2018 137

I/O Mapping

The data structure of the {Module_name}_CO_OPER_FLOAT and

{Module_name}_CO_OPER_FLOAT control object DDTs:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Check BYTE –  bit 0...1: operation type:
 0 = operate
 1 = select
 2 = cancel
 3 = auto (select & operate)

 bit 2...4 = reserved

 bit 5: synchrocheck: whether to perform
synchrocheck
 Bit 6: synchrocheck: whether to check for
interlocking condition
 Bit 7: test

CtlVal_i UDINT – value to control int32 point

CtlVal_f REAL – value to control float point
Status STATUS – status of command execution

The data structure of the {Module_name}_CO_OPER_ENUM control object DDT:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Check BYTE -  bit 0...1: operation type:
 0 = operate
 1 = select
 2 = cancel
 3 = auto (select & operate)

 bit 2...4 = reserved

 bit 5: synchrocheck: whether to perform synchrocheck
 Bit 6: synchrocheck: whether to check for interlocking
condition
 Bit 7: test

CtVal DINT - value to control

Status WORD - status of command execution:
 low byte: same as command trigger
 high byte:
 bits 6...7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

138 QGH11908 12/2018

 I/O Mapping

The data structure of the {Module_name}_CO_OPER_ANA control object DDT:

Element Type Trigger Definition

Cmd BYTE Dchg trigger: effective on change
Check BYTE -  bit 0...1: operation type:
 0 = operate
 1 = select
 2 = cancel
 3 = auto (select & operate)

 bit 2...4 = reserved

 bit 5: synchrocheck: whether to perform synchrocheck
 Bit 6: synchrocheck: whether to check for interlocking
condition
 Bit 7: test

CtVal_i DINT - value to control

CtVal_f REAL - value to control
Status WORD - status of command execution:
 low byte: same as command trigger
 high byte:
 bits 6...7: 1 = OK; 2 = error detected
 bits 0...5: detected error code

QGH11908 12/2018 139

I/O Mapping

Working with the BMENOP0300 in a PAC Application

Introduction
This topic describes the following operations for the BMENOP0300:
 control operation as server
 control operation as client
 connection operation as client

Control Operation as Server

The BMENOP0300 module supports four kinds of control models:
 Direct Operate normal security mode (Dons)
 Select before Operate normal security mode (SBOns)
 Direct Operate enhanced security mode (Does)
 Select before Operate enhanced security mode (SBOes)

According to IEC 61850 standard, the control operations present dependencies that call for some
programming in the PAC application.
Task 1 / PAC state: control operation is allowed only when the PAC is in RUN state.

Item Status Behavior How to configure?

PAC state STOP The Oper is rejected. Use Control Expert to manage the PAC state.
PAC state RUN The Oper is operational.

Task 2 / Control model: control operation is not allowed when control model is status only:

Item Status Behavior How to configure?

Control Model Status only The Oper is rejected. Set it in
Control Model Direct-with-normal-security / The Oper is operational. “Application setting”.
Sbo-with-normal-security /
Direct-with-enhance-security /
Sbo-with-enhance-security

Task 3 / LN/[Link]: Logic node’s beh status determines if this control operation is allowed. This
can be managed in the PAC as needed:

Item Status Behavior How to configure?

LN/[Link] OFF (5) The Oper is rejected. Set it in “Application setting” if it is not
mapped in I/O mapping, or manage it in PAC
LN/[Link] ON (1) The Oper is operational.
application if it is mapped in I/O mapping.

140 QGH11908 12/2018

 I/O Mapping

Task 4 / Does/SBOes mode is a much more secured control operation compared to the normal
model. The BMENOP0300 module checks DO's status from the PAC when the operation is
executed. Because each CDC has a different definition for control command and status, follow the
recommended programming logic (as described below) in your PAC application to manage DO
status:
 The BMENOP0300 module checks the status updating of data objects during the operation and
sends one negative response if the DO status is not expected.
 The BMENOP0300 module determines whether the DO status is updating according to the time
stamp of DO status. Therefore, the time stamp attribute is needed for the enhanced control
model. Consequently, you will need to manage both status and time stamp in the PAC
application to provide the control status for enhanced mode.
 In a PAC application, you could identify the control operation by means of the control number,
which needs to be managed in the PAC application. When the control number is incremented,
it indicates a new operation has begun. Add program logic to your application to manage DO
status as described in the following table. Your program logic will include two actions:
 Update the DO's status according to the control value.
 Update DO's time stamp, which is configured in UTC format.

 Note that each CDC presents different behavior, according to its specifications, as described in
the following table.

CDC Status of DO Expected status

SPC stVal stVal should be equal to ctlVal.
t Time stamp should update accordingly.
[Link] Control number should increase after each operation.
DPC stVal stVal is ON when ctlVal is TRUE.
stVal is OFF when ctlVal is FALSE.
t Time stamp should update accordingly.
[Link] Control number should increase after each operation.
INC stVal stVal should be equal to ctlVal and within range.
t time stamp should update accordingly.
[Link] Control number should increase after each operation.
ENC stVal stVal should be equal to ctlVal and within range.
t Time stamp should update accordingly.
[Link] Control number should increase after each operation
ISC [Link] [Link] should be equal to ctlVal and within range
t Time stamp should update accordingly.
[Link] Control number should increase after each operation.

QGH11908 12/2018 141

I/O Mapping

CDC Status of DO Expected status

BSC [Link] When ctlVal is STOP:
[Link] should have no change.
When ctlVal is HIGHER:
[Link] should become bigger.
When ctlVal is LOWER:
[Link] should become smaller.
t Time stamp should update accordingly.
[Link] Control number should increase after each operation.
APC mxVal.i / mxVal.f mxVal.i or mxVal.f should be equal to ctlVal and within range.
t Time stamp should update accordingly.
[Link] Control number should increase after each operation.
BAC mxVal.i / mxVal.f When ctlVal is STOP:
mxVal.i and mxVal.f should have no change.
When ctlVal is HIGHER:
mxVal.i or mxVal.f should become bigger.
When ctlVal is LOWER:
mxVal.i or mxVal.f should become smaller.
t Time stamp should update accordingly.
[Link] Control number should increase after each operation.

NOTE: The BMENOP0300 module supports the operation of one point set to the same value for
many successive iterations. Use the control number in PAC logic to determine if control operation
is executing.

Control Operation as Client

The BMENOP0300 module supports one dedicated data block that can trigger a request for a
report block, GOOSE block, control block, or a polling operation. SE recommends that you create
a manually enabled report after module start up to confirm the report functions as intended.
The data block for each command is composed of three elements: command trigger, options, and
status. The option type and content depends on the type of command, but the trigger and status
are same type with different content:
 Command: Triggers the sending of a request. (The detailed operation information is contained
in the Option element.)
 Option: Indicates the kind of command requested.
 Status: Contains the Command trigger value, the status of the command, and any detected
error code.

142 QGH11908 12/2018

 I/O Mapping

The data structure for all commands is the DATA_BLOCK_TEMPLATE data structure, set forth
below:

Element Type Trigger Definition

Cmd BYTE Dchg Command trigger: The BMENOP0300 module
sends one command if this value has changed.
Option BYTE - Request option
Option Type depends on control block - Request option
Status WORD - Low byte:
Same as trigger command.
High byte:
Bit6~bit7:
0: Busy
1: OK
2: Error detected
Bit0~Bit5: Detected error code. Refer to error
code for the specific function type.

Status detected error codes

Function Code Meaning Possible reason

Control point 1~27 AddCause Refer to the AddCause (see page 131) detected
error descriptions, defined by the IEC 61850
standard.
61 Disconnected Offline with remote IED.
63 Input parameter error Input parameter in data block is incorrect. Such as
detected input CtlVal is out of range.
Polling 61 Disconnected Offline with remote IED.
62 Polling is not Some DOs or DAs is missing in remote IED.
operational Polling will contnue if this error is detected.
63 Input parameter error Input parameter in data block is incorrect.
Report Control 60 AutoEna is not The report was not enabled after going online.
operational This error code depends on the AutoEn setting in
the Report Control block.
61 Disconnected Offline with remote IED.
63 Input parameter error Input parameter in data block is incorrect. For
detected example, index is out of range.
GOOSE Control 0 GOOSE disabled GOOSE control block is disabled.
1 GOOSE enabled GOOSE control block is enabled.
61 Disconnected Offline with remote IED.

QGH11908 12/2018 143

I/O Mapping

Example 1: REPORT_URCB displaying a normal structure:

Element Current Value Next Value Remark

Cmd 0 -> 1 The change of value triggers the operation of a single
request.
Option 0 1 Sets the report enable attribute.
Index 0 3 Indicates the 3rd instance of this report.
AutoEna 0 0 -
Attribute 0 1 1 indicates the report is enabled.
RptStatus - 3 Report instance number.
Status - 0x4001 This operation is executed successfully.
Italics and bold text indicates elements to be completed by the application.

Example 2: REPORT_URCB displaying an abnormal structure:

Element Current Value Next Value Remark

Cmd 0 -> 5 The change of value triggers the operation of a single
request.
Option 0 1 Sets the report enable attribute.
Index 0 3 Indicates the 3rd instance of this report.
AutoEna 0 0 -
Attribute 0 1 1 indicates the report is enabled.
RptStatus - 3 Report instance number.
Status - 0xBF05= This operation is not executed successfully.
{ 0x8000: error
0x8000 + 0x3F00: error code 63, incorrect input parameter
0x3F00 + (e.g., index could be out of range).
0x0005 0x0005: command trigger
}
Italics and bold text indicates elements to be completed by the application.

Example 3: {Module}_CO_BOOL displaying a normal structure:

Element Current Value Next Value Remark

Cmd 0 -> 2 The change of value triggers the operation of a single
request.
Check 0 0 Operate directly.
CtlVal 0 1 Set point as TRUE.
Status 0 0x4002 This operation is executed successfully.
Italics and bold text indicates elements to be completed by the application.

144 QGH11908 12/2018

 I/O Mapping

Example 4: {Module}_CO_BOOL displaying an abnormal structure:

Element Current Value Next Value Remark

Cmd 0 -> 3 The change of value triggers the operation of a single
request.
Check 0 0 Operate directly.
CtlVal 0 1 Set point as TRUE.
Status 0 0xBD03= This operation is not executed successfully.
{ 0x8000: error
0x8000 + 0x3D00: error code 61, remote IED is not connected.
0x3D00 + 0x0003: command trigger
0x0003
}
Italics and bold text indicates elements to be completed by the application.

Connection Operation as Client

The BMENOP0300 client DDT supports connection control to the remote IED with ConnectCtrl.
The module attempts to connect with the remote IED by default after start up. The status of the
connection can be checked via the health status in client state, or by the Freshness element of the
client DDT, as shown below for a {Module}_{IED name client:

Element Type Definition

Freshness BOOL 0: Data is not fresh
1: Data is fresh
When there is no IEC 61850 connection or backplane communication, set
it as FALSE.
ConenctCtrl BOOL 0: Auto connect
1: Disconnect
Data Model – –
PollBlock – Polling control for each IED
ControlBlock – General control
ReportBlock – Report control
GooseBlock – GOOSE control

QGH11908 12/2018 145

I/O Mapping

146 QGH11908 12/2018

 M580 IEC 61850
SOE timestamped data sets
QGH11908 12/2018

Chapter 7
Working With Sequence of Event (SOE) Timestamped Data Sets

Working With Sequence of Event (SOE) Timestamped Data

Sets

Overview
The BMENOP0300 module supports the transfer of data objects from external devices – including
the BMXERT1604, BMXCRA31210, and the 140ERT854x0 – via report control block to
management tools such as SCADA. Each data object presents the data value, quality, and a
timestamp. The report control block provides a consistent sequence of events (SOE) time stamped
at the source.
This chapter describes how to:
 Configure timestamped SOE data sets and report control blocks.
 Program the operations of elementary functions (EFs) and elementary function blocks (EFBs)
to support the configuration, including:
 NOP850_EVTS
 T850_TO_T870
 T870_TO_T850

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Configuring SOE events in the IEC 61850 Configuration Tool 148
NOP850_EVTS Elementary Function Block Operations for the BMENOP0300 153
T850_TO_T870 and T870_TO_T850 Elementary Functions for the BMENOP0300 157

QGH11908 12/2018 147

SOE timestamped data sets

Configuring SOE events in the IEC 61850 Configuration Tool

Introduction
The BMENOP0300 module supports the transfer of external events originated by ERT and CRA
modules to SCADA via a buffered report control block. The BMENOP0300 module cyclically
detects data objects in CPU memory and includes them in a report control block with each data
object's status value, quality and timestamp data.

Configuring SOE Events

To preserve memory mapping and retain the SOE timestamping that originated with the source
ERT or CRA module, the BMENOP0300 module provides a single dedicated channel for the
transfer of external events.
The BMENOP0300 module supports the creation and use of a single dedicated data set that can
contain data objects of the single point setting (SPS) class and data object (DO) functional
constraint. Each DO instance represents a single ERT/CRA channel, and includes the status value
(stVal), quality (q), and timestamp (t) data attributes.
When configuring the Data Set, you need to link all DOs, and then associate a single buffered
report control block (BRCB) with this Data Set. The DO instances included in the report can
originate from any kind of logical node (LN). When adding a DO instance to the Data Set, you need
to specify the link with the channel (Event ID), as shown below
When configuring the Data Set, you need to include all DOs. The DO instances included in the
report can originate from any kind of logical node (LN). When adding a DO instance to the Data
Set, you need to specify the link with the channel (Event ID), as shown below:

148 QGH11908 12/2018

 SOE timestamped data sets

Next, you need to associate a single buffered report control block (BRCB) with this data set, as
shown below:

After mapping the DO into PAC variables, two DDT instances are automatically created and added
to the application:
 IED_RPT is the DDT that contains report’s diagnostic information.
 IED_EVT is the event data transferred via the selected channel from PAC, which presents two
different structures, depending on the source platform:
 IED_EVT_M for Mx80 devices
 IED_EVT_Q for Quantum devices

NOTE: The BMENOP0300 module can add these events into a buffered report control block,
according to the configuration. Because the Quantum ERT uses local time, whereas the Mx80 ERT
uses UTC time, the BMENOP0300 module can manage the Quantum ERT time conversion from
60870 local time to 61850 UTC time. No such time conversion is required for Mx80 ERT/CRA.

QGH11908 12/2018 149

SOE timestamped data sets

Data Type Structure: IED_RPT

Element Type Description

Status WORD Report status:
 bits 0...7: Report enabled/disabled. Each bit represents one report instance:
 0 = disabled
 1 = enabled

 bits 8...15: buffer overflow:

 0 = no buffer overflow
 1 = overflow

DaChgCnt WORD A counter value that increments each time a report is generated.

Data Type Structure: IED_EVT_M

This structure describes the format of events used by Mx80 devices using the IEC 61850 format:

Element Type Description

Reserv BYTE <reserved>
Value BYTE Input value
EventID WORD An event identifier, which can be one of the following:
 the channel number
 a user-defined value

SecondSince DWORD The interval, in seconds, from 1970-01-01 00:00:00 UTC to the present.
Epoch
FracOfSec_L WORD The fraction of the current second when the value element, above, has been
determined. The fraction of second is calculated as:
FracOfSec_H BYTE
(SUM from i = 0 to 23 of bi*2**–(i+1) s).

150 QGH11908 12/2018

 SOE timestamped data sets

Element Type Description

TimeQuality BYTE TimeQuality describes provides information regarding the sending IED, and
consists of the following attributes:
Bits Attribute Type Description
0...4 TimeAccuracy CODED The accuracy class of the time
ENUM source. Only the value of 10 = 1 ms is
supported.
5 ClockNotSynchronized BOOL When set to 1, this indicates the time
source of the sending IED is not
synchronized with external UTC time.
6 ClockFailure BOOL When set to 1, this indicates the time
source of the sending IED is
unreliable.
7 LeapSecondsKnown BOOL When set to 1, this indicates that
SecondSinceEpoch value includes
all leap year seconds. When set to 0,
this indicates leap seconds are not
included and seconds are calculated
from the current date assuming a
constant day length of 86400 s.

Data Type Structure: IED_EVT_Q

This structure describes the format of events used by Quantum devices using the IEC 61850
format:

Element Type Description

Reserv BYTE <reserved>
Value BYTE Input value
Event ID WORD An event identifier, which can be one of the following:
 the channel number
 a user-defined value

Reserved BYTE <reserved>

Month BYTE Month
Year BYTE Year
Ms_Lsb BYTE Time in milliseconds (least significant byte)
Ms_Msb BYTE Time in milliseconds (most significant byte)
Min BYTE Invalid time/minutes
Hour BYTE Summer time/hours
Day BYTE Weekday/day of the month

QGH11908 12/2018 151

SOE timestamped data sets

Data Type Structure: IED_ERT_BUF

Element Type Description

NewTS BYTE Time stamp of the new event
EvtSrc BYTE Event source:
 0 = Quantum
 1 = Mx80

EventEntity WORD[6] Event entity, which can be one of the following:

 IED_EVT_Q
 IED_EVT_M

152 QGH11908 12/2018

 SOE timestamped data sets

NOP850_EVTS Elementary Function Block Operations for the BMENOP0300

Introduction
Use the NOP085_EVTS elementary function block (EFB) to:
 Manage and synchronize the transfer of external events from an ERT or CRA into the memory
of the BMENOP0300 module.
 Manage the transfer external events between a PLC and the BMENOP0300 module.

Representation in FBD

NOTE:
 When the timestamped event originates at a Quantum platform, the time stamp is local time
(UTC+TimeZone). The BMENOP0300 firmware converts this local time into UTC and includes
it in the outgoing report control block. The time zone depends on the BMENOP0300 SNTP
configuration in Modicon IEC61850 Configuration Tool.
 When the timestamped event originates at an M80 platform, the time stamp is UTC time and
BMENOP0300 firmware includes it in the outgoing report control block without conversion.

QGH11908 12/2018 153

SOE timestamped data sets

Input Parameters

Input parameter Type Description

ENABLE BOOL Start transferring
ERT BYTE ERT type:
 0 = Quantum ERT
 1 = Mx80 ERT
EVT One of the following: Event description, including value, quality, time stamp, ID,
 IED_EVT_Q DDT, and IED_EVT_x
(see page 151)
 IED_EVT_M
(see page 150)
RPT IED RPT Report information. DDT IED_RPT
(see page 150)
TIMEOUT INT Time threshold in 100 ms increments for triggering an event
(a value greater than 0)

Output Parameters

Output parameter Type Description

DONE BOOL A value of 1 (true) indicates the function block completed
successfully.
ACTIVE BOOL A value of 1 (true) indicates execution of the function block
is in progress.
ERROR BOOL A value of 1 (true) indicates the function block detects an
execution error.
STATUS INT Identifies the detected error:
 1 = Input parameter is not valid.
 2 = <Reserved>
 3 = Time format is not valid.
NOTE: Only dates after January 01, 2000 are valid.
 4 = time out occurrence (default 10 s)
 5 = parameter change during runtime
 6 = Data change counter of report is abnormal
NOTE: This EFB restarts if a time out (4) or abnormal
data change counter event (6) occurs.
RPT_BUFF IED ERT BUF Raw buffer containing event time stamp entities.
(see page 152)

154 QGH11908 12/2018

 SOE timestamped data sets

Quantum ERT FBD Example

QGH11908 12/2018 155

SOE timestamped data sets

Mx80 ERT FBD Example

156 QGH11908 12/2018

 SOE timestamped data sets

T850_TO_T870 and T870_TO_T850 Elementary Functions for the BMENOP0300

Introduction
The BMENOP0300 module is a device that sends and receives data timestamped according to the
IEC 61850 protocol. Some Mx80 ERT devices send and receive data timestamped according to
the IEC60870 protocol.
To enable data transfer between devices that support different timestamp structures, you can use
the following elementary functions in your program logic:
 T850_TO_T870: This EF takes IEC60870 timestamped data (for example, data generated by
the BMXNOR0200 module) and converts it to the more easily readable IEC 61850 format.
 T870_TO_T850: This EF takes IEC 61850 timestamped data generated by the BMENOP0300
module and converts it to the IEC60870 format where it can be used by other Mx80 ERT
devices.

T850_TO_T870 Representation in FBD

The following graphic depicts the T850_TO_870 function:

T850_TO_T870 Parameters

Parameter Type Description

Input parameters:
IN TIME_850_FORMAT the IEC 61850 timestamp format
Output parameters:
OUT TIME_870_FORMAT the IEC 60870 timestamp format

QGH11908 12/2018 157

SOE timestamped data sets

T870_TO_T850 Representation in FBD

The following graphic depicts the T870_TO_T850 function:

T870_TO_T850 Parameters

Parameter Type Description

Input parameters:
IN TIME_870_FORMAT the IEC 60870 timestamp format
Output parameters:
OUT TIME_850_FORMAT the IEC 61850 timestamp format

Data Type Structure: TIME_850_FORMAT

Element Type Description

Seconds DWORD seconds since 01-01-1970
NOTE: Only dates after January 01, 2000 are valid.
Ms_Quality DWORD milliseconds in IEC 61850 format in low three bytes (Highest
byte manages quality.)

158 QGH11908 12/2018

 SOE timestamped data sets

Data Type Structure: TIME_870_FORMAT

Element Type Description

ms WORD from 0...59999 ms
min BYTE Numerical minute reference: 0...59. The highest bit
indicates time validity:
 0 = valid time
 1 = invalid time

hour BYTE numerical hour reference: 0...23

NOTE: SU (summertime) is not supported.
day BYTE numerical day reference: 1...31.
NOTE: Day of week is not supported.
mon BYTE numerical month reference: 1...12
year BYTE numerical year reference: 0...99
reserved BYTE <reserved>

QGH11908 12/2018 159

SOE timestamped data sets

160 QGH11908 12/2018

 M580 IEC 61850
Explicit Messaging
QGH11908 12/2018

Chapter 8
Explicit Messaging

Explicit Messaging

What Is in This Chapter?

This chapter contains the following sections:
Section Topic Page
8.1 Introduction to Explicit Messaging 162
8.2 Explicit Messaging Using the DATA_EXCH Block 163
8.3 Modbus TCP Explicit Messaging Using DATA_EXCH 168

QGH11908 12/2018 161

Explicit Messaging

Section 8.1
Introduction to Explicit Messaging

Introduction to Explicit Messaging

About Explicit Messaging

Overview
The BMENOP0300 module supports explicit messaging through the Modbus TCP protocol.
Modbus TCP: Use the DATA_EXCH function block or WRITE_VAR and READ_VAR function blocks
in application logic to create a Modbus TCP explicit message.
NOTE: A single Control Expert application can contain more than 16 explicit messaging blocks, but
only 16 explicit messaging blocks can be active at the same time.
This chapter describes how to configure Modbus TCP explicit messages through these
mechanisms:
 DATA_EXCH function block (in application logic)
 Control Expert interface

162 QGH11908 12/2018

 Explicit Messaging

Section 8.2
Explicit Messaging Using the DATA_EXCH Block

Explicit Messaging Using the DATA_EXCH Block

Overview
Use this overview of the DATA_EXCH function block to configure Modbus TCP explicit messages.
These instructions describe the configuration of the DATA_EXCH function block’s management
parameter, which is common to both Modbus TCP explicit messaging.
In a redundant system, the primary BMENOP0300 module sends the explicit message. Even when
a switchover occurs and the primary becomes the standby, the module can run the active sections.

What Is in This Section?

This section contains the following topics:
Topic Page
Configuring Explicit Messaging Using DATA_EXCH 164
Configuring the DATA_EXCH Management Parameter 166

QGH11908 12/2018 163

Explicit Messaging

Configuring Explicit Messaging Using DATA_EXCH

Overview
Use the DATA_EXCH function block to configure Modbus TCP explicit messages.
The Management_Param, the Data_to_Send, and the Received_Data parameters define the
operation.
EN and ENO can be configured as additional parameters.

FBD Representation

Input Parameters

Parameter Data type Description

EN BOOL This parameter is optional. When this input is set to one, the block
is activated and can solve the function blocks algorithm. When
this input is set to zero, the block is deactivated and won’t solve
the function block algorithm.
Address Array [0...7] of INT The path to the destination device, the content of which can vary
depending on the message protocol. Use the Address function
as an is input to the block parameter ADR.. Refer to a description
of the Address parameter
ActionType INT The type of action to perform. For Modbus TCP protocols, this
setting = 1 (transmission followed by await reception).
Data_to_Send Array [n...m] of INT The content of this parameter is specific to the protocol.
Refer to Control Expert online help.

164 QGH11908 12/2018

 Explicit Messaging

Input/Output Parameters
The Management_Param array is local:

Parameter Data type Description

Management_Param Array [0...3] of INT The management parameter, consisting of four words

Do not copy this array during a switchover from a primary to a standby CPU in a redundant system.
De-select the Exchange On STBY check bocx in Control Expert when you configure a redundant
system.
NOTE: Refer to the description of redundant system data management and the T_M_ECPU_HSBY
DDT in the M580 Hot Standby System Planning Guide.

Output Parameters

Parameter Data type Description

ENO BOOL This parameter is optional. When you select this output
you also get the EN input. ENO output is activated upon
successful execution of the function block.
Received_Data Array [n...m] of INT the Modbus TCP response, of which the structure and
content depends upon the specific protocol

QGH11908 12/2018 165

Explicit Messaging

Configuring the DATA_EXCH Management Parameter

Introduction
The structure and content of the management parameter of the DATA_EXCH block is common to
Modbus TCP explicit messaging.

Configuring the Management Parameter

The management parameter consists of four contiguous words:

Data source Register Description

High Byte (MSB) Low Byte (LSB)
Data managed Management_Param[0] Exchange number Two read-only bits:
by the system  Bit 0 = Activity bit
 Bit 1 = Cancel bit

Management_Param[1] Operation report Communication report (see page 207)

(see page 208)
Data managed Management_Param[2] Block timeout. Values include:
by the user  0 = infinite wait
 other values = timeout x 100 ms, for example:
 1 = 100 ms
 2 = 200 ms

Management_Param[3] Length of data sent or received:

 Input (before sending the request): length of data in the
Data_to_Send parameter, in bytes
 Output (after response): length of data in the
Received_Data parameter, in bytes

166 QGH11908 12/2018

 Explicit Messaging

Activity Bit
The activity bit is the first bit of the first element in the table. The value of this bit indicates the
execution status of the communication function:
 1: The bit is set to 1 when the function launches.
 0: The bit returns to 0 upon the completion of the execution. (The transition from 1 to 0
increments the exchange number. If an error is detected during the execution, search for the
corresponding code in the operation and communication report (see page 207).)
For example, you can make this declaration in the management table:
Management_Param[0] ARRAY [0..3] OF INT
For that declaration, the activity bit corresponds to this notation:
Management_Param[0].0
NOTE: The notation previously used requires configuration of the project properties in such a way
as to authorize the extraction of bits on integer types. If this is not the case,
Management_Param[0].0 cannot be accessed in this manner.

QGH11908 12/2018 167

Explicit Messaging

Section 8.3
Modbus TCP Explicit Messaging Using DATA_EXCH

Modbus TCP Explicit Messaging Using DATA_EXCH

Overview
This section shows you how to configure DATA_EXCH function block parameters for Modbus TCP
explicit messages.

What Is in This Section?

This section contains the following topics:
Topic Page
Modbus TCP Explicit Messaging Function Codes 169
Configuring Modbus TCP Explicit Messaging Using DATA_EXCH 170
Modbus TCP Explicit Message Example: Read Register Request 172

168 QGH11908 12/2018

 Explicit Messaging

Modbus TCP Explicit Messaging Function Codes

Overview
You can execute Modbus TCP explicit messages using either a Control Expert DATA_EXCH
function block or the Modbus Explicit Message Window.
NOTE: Configuration edits made to an Ethernet module are not saved to the operating parameters
stored in the CPU and, therefore, are not sent by the CPU to the module on startup.

Function Codes
The function codes supported by the Control Expert graphical user interface include the following
standard explicit messaging functions:

Function Code (dec) Description

1 Read bits (%M)
2 Read input bits (%I)
3 Read words (%MW)
4 Read input words (%IW)
15 Write bits (%M)
16 Write words (%MW)

NOTE: You can use the DATA_EXCH function block to execute any Modbus function, via program
logic. Because the available function codes are too numerous to list here, refer instead to the
Modbus IDA website for more information about these Modbus functions, at
[Link]

QGH11908 12/2018 169

Explicit Messaging

Configuring Modbus TCP Explicit Messaging Using DATA_EXCH

Introduction
When you use the DATA_EXCH block to create an explicit message for a Modbus TCP device,
configure this block the same way you would configure it for any other Modbus communication.
Refer to the Control Expert online help for instructions on how to configure the DATA_EXCH block.

Configuring ADDM Block Unit ID Settings

When you configure the DATA_EXCH block, use the ADDM block to set the DATA_EXCH block’s
Address parameter. The ADDM block presents the configuration format
ADDM(‘[Link][ip_address]UnitID.message_type.protocol’) where:

Parameter Description
rack the number assigned to the rack containing the communication module
slot the position of the communication module in the rack
channel the communication channel (set to a value of 0)
ip_address the IP address of the remote device (for example, [Link])
Unit ID the destination node address, also known as the Modbus Plus on Ethernet Transporter
(MET) mapping index value
message_type the three-character string TCP
protocol the three-character string MBS

The Unit ID value in a Modbus message indicates the destination of the message.
Refer to the Modbus diagnostic codes.

170 QGH11908 12/2018

 Explicit Messaging

Contents of the Received_Data Parameter

The Received_Data parameter contains the Modbus response. The length of the response
varies, and is reported by Management_Param[3] after the response is received. The format of
the Modbus response is described, below:

Offset (words) Length (bytes) Description

0 2 First word of the Modbus response:
 High byte (MSB):
 if successful: Modbus Function Code
 if not: Modbus function code + 16#80

 Low byte (LSB):

 if successful: depends on the request
 if not: Modbus exception code

1 Length of the Remainder of the Modbus response: depends on the specific

Received_Data Modbus request)
parameter – 2

NOTE:
 Structure the response in little endian order.
 In some cases of detected errors, Received_Data is also used to judge the type of detected error
along with Management_Param.

QGH11908 12/2018 171

Explicit Messaging

Modbus TCP Explicit Message Example: Read Register Request

Introduction
Use the DATA_EXCH function block to send a Modbus TCP explicit message to a remote device at
a specific IP address to read a single word located in the remote device.
The Management_Param, the Data_to_Send, and the Received_Data parameters define the
operation.
EN and ENO can be configured as additional parameters.

Implementing the DATA_EXCH Function Block

To implement the DATA_EXCH function block, create and assign variables for the for following:

Configuring the Address Variable

The Address variable identifies the explicit message originating device and the target device. Note
that the Address variable does not include the Xway address elements {[Link]} because
you are not bridging through another PAC station. Use the ADDM function to convert the following
character string to an address:
ADDM(‘0.1.0{[Link]}[Link]’), where:
 rack = 0
 module (slot number) = 1
 channel = 0
 remote device IP address = [Link]
 message type = TCP
 protocol = Modbus

Configuring the ActionType Variable

The ActionType variable identifies the function type for the DATA_EXCH function block:

Variable Description Value (hex)

ActionType Transmission followed by wait for response 16#01

172 QGH11908 12/2018

 Explicit Messaging

Configuring the DataToSend Variable

The DataToSend variable contains the target register address and the number of registers to read:

Variable Description Value (hex)

DataToSend[0]  High byte = Most significant byte (MSB) of register address 16#15 16#1503
(21 decimal)
 Low byte = function code: 16#03 (03 decimal)

DataToSend[1]  High byte = Most significant byte (MSB) of the number of registers 16#000F
to read: 16#00 (0 decimal)
 Low byte = Least significant byte (LSB) of register address: 16#0F
(15 decimal)
DataToSend[2] CIP request instance information: 16#0001
 High byte = not used: 16#00 (0 decimal)
 Low byte = Least significant byte (LSB) of the number of registers to
read: 16#01 (1 decimal)

NOTE: For detailed information about M580 network topologies, refer to the Modicon M580
Standalone System Planning Guide for Frequently Used Architectures and Modicon M580 System
Planning Guide for Complex Topologies.

QGH11908 12/2018 173

Explicit Messaging

Viewing the Response

Use a Control Expert Animation table to display the ReceivedData variable array. Note that the
ReceivedData variable array consists of the entire data buffer.
To display the Modbus TCP response, follow these steps:

Step Action
1 In Control Expert, select Tools → Project Browser.
2 In the Project Browser, select the Animation Tables folder, and click the right mouse button.
Result: A pop-up menu appears.
3 Select New Animation Table in the pop-up menu.
Result: A new animation table and its properties dialog open.
4 In the Properties dialog, edit the following values:
Name Type in a table name. For this example: ReceivedData.
Functional module Accept the default <None>.
Comment (Optional) Type your comment here.
Number of animated Type in 100, representing the size of the data buffer in words.
characters
5 Click OK to close the dialog.
6 In the animation table’s Name column, type in the name of the variable assigned to the databuffer:
ReceivedData and press Enter.
Result: The animation table displays the ReceivedData variable.
7 Expand the ReceivedData variable to display its word array, where you can view the CIP response
contained in the ReceivedData variable.
NOTE: Each array entry presents 2 bytes of data in little endian format. For example, ‘03’ in word[0]
is the low byte, and ‘02’ is the high byte.

174 QGH11908 12/2018

 M580 IEC 61850
Diagnostics
QGH11908 12/2018

Chapter 9
Diagnostics

Diagnostics

Overview
This chapter describes the diagnostics for the BMENOP0300 module.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
LED Indicators on the BMENOP0300 Module 176
Modbus Diagnostic Codes 179
Modbus Diagnostic Codes 189
IEC 61850 Diagnostic Codes 191
Redundant System Switchover 194
Dual Network Redundancy Diagnostics 196

QGH11908 12/2018 175

Diagnostics

LED Indicators on the BMENOP0300 Module

Display
These LEDs are on the front of the BMENOP0300 module:

eNOP0300

LED Display Panel Indicators

Use the LEDs on the front panel to diagnose module conditions, as follows:

LED RUN ERR MS (module status) NS, NS1, NS21 (network

status)
Condition Green Red Green/Red Green/Red
power OFF OFF OFF OFF OFF
during power up LED indicator test
1. All indicators OFF
2. RUN ON for 0.25 seconds, then OFF
3. ERR ON for 0.25 seconds, then OFF
4. MS green ON for 0.25 seconds, then red ON for 0.25 seconds, then green ON
5. NS green ON for 0.25 seconds, then red ON for 0.25 seconds, then OFF
6. All indicators OFF
1 The NS, NS1, and NS2 LEDs indicate the network status of their respective subnets.
NOTE:
 NS1 is reserved and is always OFF.
 NS2 indicates Network 3 status when IP forwarding is enabled.

176 QGH11908 12/2018

 Diagnostics

LED RUN ERR MS (module status) NS, NS1, NS21 (network

status)
Condition Green Red Green/Red Green/Red
not configured or in OFF flashing flashing green OFF: If no IP address
default has been assigned to the
configuration module
flashing green: Module
configured and in steady ON OFF if no fault steady green if
normal operational (regardless of module is operating has an IP address, but
no 61850 connections
state with no fault CPU in correctly
RUN/STOP or are established.
configured and in flashing: If there flashing red: If there steady green: At least
module in fault)
normal operational is an X Bus is a recoverable one 61850 connection is
state with fault promptness minor fault. established.
fault(*). (Duplicate IP is a steady red: Its IP
steady ON: If recoverable minor address is already in use
there is another fault.) (duplicate IP).
fault (non-X Bus steady red: If there is
promptness a non-recoverable
fault). major fault (example:
firmware detected
error, self-test
detected error,
checksum detected
error, or RAM test
detected error at
power up).
OS update flashing OFF steady red steady red
1
The NS, NS1, and NS2 LEDs indicate the network status of their respective subnets.
NOTE:
 NS1 is reserved and is always OFF.
 NS2 indicates Network 3 status when IP forwarding is enabled.

QGH11908 12/2018 177

Diagnostics

Ethernet Port LED Indicators

Use the Ethernet port LEDs to diagnose the status of the respective Ethernet port:

Name Color Status Description

LINK (link/speed) green ON 100 Mbits link detected
yellow ON 10/100 Mbits link detected
— OFF no detected link
ACT green blinking active link (transmit or receive detected)
ON detected but inactive link
OFF no detected link

178 QGH11908 12/2018

 Diagnostics

Modbus Diagnostic Codes

Introduction
BMENOP0300 IEC 61850 modules in M580 systems support the diagnostic codes in the following
tables.

Function Code 3
Some module diagnostics (I/O connection, extended health, redundancy status, FDR server, etc.)
are available to Modbus clients that read the local Modbus server area. Use Modbus function code
3 with the unit ID set to 100 for register mapping:

Type Offset Modbus Size

Address (Words)
Basic Networks Diagnostic Data 0 39
Ethernet Port Diagnostics Data (Internal port) 39 103
Ethernet Port Diagnostics Data (ETH 1) 142 103
Ethernet Port Diagnostics Data (ETH 2) 245 103
Ethernet Port Diagnostics Data (ETH 3) 348 103
Ethernet Port Diagnostics Data (backplane) 451 103
Modbus TCP/Port 502 Diagnostic Data 554 114
Modbus TCP/Port 502 Connection Table Data 668 515
SNTP Diagnostics 1218 57
QoS Diagnostics 1275 11
IEC 61850 Server Diagnostic 2025 20
IEC 61850 Client Diagnostics 2047 20

IEC 61850 Server Diagnostics

Address MS Byte LS Byte Modbus Comments

Type
Offset Active Health WORD Active: 1 = configured
Health: 1 = Service is operational.
Offset + 1 ProtoEd ActiveConn WORD ProtoEd: IEC 61850 Edition version
ActiveConn: Number of connections established
with this server
Offset + 2 MSW - MSB MSW - LSB UDINT a counter that increments each time the server
LSW - MSB LSW - LSB receives a read variable request

Offset + 4 MSW - MSB MSW - LSB UDINT the number of rejected MMS read variable
requests
LSW - MSB LSW - LSB

QGH11908 12/2018 179

Diagnostics

Address MS Byte LS Byte Modbus Comments

Type
Offset + 6 MSW - MSB MSW - LSB UDINT a counter that increments each time the server
LSW - MSB LSW - LSB receives a write variable request

Offset + 8 MSW - MSB MSW - LSB UDINT the number of rejected MMS write variable
requests
LSW - MSB LSW - LSB
Offset + 10 MSW - MSB MSW - LSB UDINT a counter that increments each time the server
LSW - MSB LSW - LSB sends an information report message

Offset + 12 MSW - MSB MSW - LSB UDINT a counter that increments each time the server
sends a goose
LSW - MSB LSW - LSB
Offset + 14 MSW - MSB MSW - LSB UDINT a counter that increments each time the server
LSW - MSB LSW - LSB receives a goose

Offset + 16 MSW - MSB MSW - LSB UDINT a counter that increments each time the server
receives an invalid goose
LSW - MSB LSW - LSB
Offset + 18 MSW - MSB MSW - LSB DWORD detected error code
LSW - MSB LSW - LSB
Offset + 20 MSW - MSB MSW - LSB DWORD internalErr
LSW - MSB LSW - LSB

IEC 61850 Client Diagnostics

Address MS Byte LS Byte Modbus Comments

Type
Offset Active Health WORD Active: 1 = configured
Health: 1 = Service is operational.
Offset + 1 ProtoEd ActiveConn WORD ProtoEd: IEC 61850 Edition version
ActiveConn: Number of connections
established with this server
Offset + 2 MSW - MSB MSW - LSB UDINT IED connection status
LSW - MSB LSW - LSB
Offset + 4 MSW - MSB MSW - LSB UDINT reserved
LSW - MSB LSW - LSB
Offset + 6 MSW - MSB MSW - LSB UDINT a counter that increments each time the client
receives a read variable request
LSW - MSB LSW - LSB
Offset + 8 MSW - MSB MSW - LSB UDINT the number of rejected MMS read variable
requests
LSW - MSB LSW - LSB

180 QGH11908 12/2018

 Diagnostics

Address MS Byte LS Byte Modbus Comments

Type
Offset + 10 MSW - MSB MSW - LSB UDINT a counter that increments each time the client
LSW - MSB LSW - LSB sends a write variable request

Offset + 12 MSW - MSB MSW - LSB UDINT the number of rejected MMS write variable
requests
LSW - MSB LSW - LSB
Offset + 14 MSW - MSB MSW - LSB UDINT a counter that increments each time the client
LSW - MSB LSW - LSB sends an information report message

Offset + 16 MSW - MSB MSW - LSB UDINT a counter that increments each time the client
receives a goose
LSW - MSB LSW - LSB
Offset + 18 MSW - MSB MSW - LSB UDINT a counter that increments each time the client
LSW - MSB LSW - LSB receives an invalid goose

Offset + 20 MSW - MSB MSW - LSB DWORD detected error code

LSW - MSB LSW - LSB
Offset + 22 MSW - MSB MSW - LSB DWORD internalErr
LSW - MSB LSW - LSB

Modbus Register Mapping of NTP Diagnostics Data

Address MS Byte LS Byte Modbus Comments

Type
Offset + 0 MSW - MSB MSW - LSB Uint32 primary NTP server IP address
Offset + 1 LSW - MSB LSW - LSB
Offset + 2 MSW - MSB MSW - LSB Uint32 secondary NTP server IP address
Offset + 3 LSW - MSB LSW - LSB
Offset + 4 MSW - MSB BYTE Uint8 polling period (in seconds)
Offset + 5 MSW - MSB BYTE Uint8 update CPU with module time
Offset + 6 MSW - MSB MSW - LSB Uint32 time zone
Offset + 7 LSW - MSB LSW - LSB
Offset + 8 MSB LSB Int16 time zone offset (in minutes
Offset + 9 Unused BYTE Uint8 daylight saving time bias (in minutes)
Offset + 10 Unused LSB Uint8 daylight saving start date - month

QGH11908 12/2018 181

Diagnostics

Address MS Byte LS Byte Modbus Comments

Type
Offset + 11 Unused LSB Uint8 daylight saving start date - week #, day of
week
MS 4-bits: occurrence # (1 = first occurrence,
2 = second occurrence, ..., 5 = fifth or last
occurrence)
LS 4-bits: day of the week (0 = Sunday, ..., 6
= Saturday)
Offset + 12 MSW - MSB MSW - LSB Uint32 daylight saving start time (seconds elapsed
from midnight)
Offset + 13 LSW - MSB LSW - LSB
Offset + 14 Unused LSB Uint8 daylight saving end date - month
Offset + 15 Unused LSB Uint8 daylight saving end date - week #, day of
week
Offset + 16 MSW - MSB MSW - LSB Uint32 daylight saving end time (seconds elapsed
from midnight)
Offset + 17 LSW - MSB LSW - LSB
Offset + 18 Unused BYTE Uint8 SNTP mode
Offset + 19 Unused BYTE Uint8 reserved
... – – – –
Offset + 32 Unused BYTE Uint8 reserved
Offset + 33 MSW - MSB MSW - LSB UDINT network time service status
Offset + 34 LSW - MSB LSW - LSB
Offset + 35 MSW - MSB MSW - LSB UDINT link to NTP server status
Offset + 36 LSW - MSB LSW - LSB
Offset + 37 MSW - MSB MSW - LSB UDINT current NTP server IP address
Offset + 38 LSW - MSB LSW - LSB
Offset + 39 MSW - MSB MSW - LSB UDINT NTP server type
Offset + 40 LSW - MSB LSW - LSB
Offset + 41 MSW - MSB MSW - LSB UDINT NTP server time quality
Offset + 42 LSW - MSB LSW - LSB
Offset + 43 MSW - MSB MSW - LSB UDINT number of NTP requests sent
Offset + 44 LSW - MSB LSW - LSB
Offset + 45 MSW - MSB MSW - LSB UDINT number of communication errors
Offset + 46 LSW - MSB LSW - LSB
Offset + 47 MSW - MSB MSW - LSB UDINT number of NTP responses received
Offset + 48 LSW - MSB LSW - LSB
Offset + 49 MSW - MSB MSW - LSB UINT last error

182 QGH11908 12/2018

 Diagnostics

Address MS Byte LS Byte Modbus Comments

Type
Offset + 50 MSW - MSB MSW - LSB UDINT current time
Offset + 51 LSW - MSB LSW - LSB
Offset + 52 MSW - MSB MSW - LSB UINT current date
Offset + 53 MSW - MSB MSW - LSB UDINT daylight saving status
Offset + 54 LSW - MSB LSW - LSB
Offset + 55 MSW - MSB MSW - LSB DINT time since last update
Offset + 56 LSW - MSB LSW - LSB

Modbus Register Mapping of QoS Diagnostic Data

Address MS Byte LS Byte Modbus Type Comments

Offset MS Byte LS Byte UINT 802.1Q tag enable/disable
Offset + 01 MS Byte LS Byte UINT reserved for DSCP PTP event
Offset + 02 MS Byte LS Byte UINT reserved for DSCP PTP general
Offset + 03 MS Byte LS Byte UINT reserved for DSCP EIP urgent
Offset + 04 MS Byte LS Byte UINT reserved for DSCP EIP scheduled
Offset + 05 MS Byte LS Byte UINT reserved for DSCP EIP high
Offset + 06 MS Byte LS Byte UINT reserved for DSCP EIP low
Offset + 07 MS Byte LS Byte UINT reserved for DSCP EIP explicit
Offset + 08 MS Byte LS Byte UINT reserved for DSCP Modbus IO scanner
(same as DSCP EIP high)
Offset + 09 MS Byte LS Byte UINT DSCP Modbus client/server (same as
EIP explicit)
Offset + 10 MS Byte LS Byte UINT DSCP SNTP
Offset + 11 MS Byte LS Byte UINT DSCP IEC 61850 client

Get Status Summary: Request

Modbus function code 8 / sub-function code 21: request

Field Length (bytes) Value (hex)

function code 1 08
sub-function code hi 1 00
sub-function code low 1 15
operation code hi 1 00
operation code low 1 76

QGH11908 12/2018 183

Diagnostics

Get Status Summary: Response

Modbus function code 8 / sub-function code 21: response

Field Length (bytes) Value (hex)

function code 1 08
sub-function code hi 1 00
sub-function code low 1 15
operation code hi 1 00
operation code low 1 76
byte count 1 depends on product
number of LEDs 2 depends on product
each LED color [1] 2 0 = off
1 = on green
2 = on red
each LED status [1] 2 LED status number (see LED Status
table)
name string [1] N LED name (null terminated)
... – –
number of services 2 depends on product
each service color [1] 2 0 = off or N/A
1 = green
2 = red
each service status [1] 2 service status number (see Services
Status table)
name string [1] N service name
... – –

LED Status
Modbus function code 8 / sub-function code 21: LED status

LED Status Number (hex) Description

1 ready for operation
2 not ready for operation
3 fault detected
4 no fault detected
5 in operation
6 duplicate IP address
7 waiting for address server response

184 QGH11908 12/2018

 Diagnostics

LED Status Number (hex) Description

8 default IP address in use
9 IP address configuration conflict detected
A not configured
B recoverable fault detected
C connections established
D –
E connections error detected
F running
10 detected error present
11 Ethernet link established
12 no Ethernet link established
13 connected to 100 Mbps link
14 not connected to 100 Mbps link
15 connected to full duplex link
16 note connected to full duplex link
17 configuration error detected

Services Status
Modbus function code 8 / sub-function code 21: services status

Service Status Number Description

1 enabled
2 working properly
3 disabled
4 not configured
5 at least one connection not working
6 enabled on
7 enabled off

QGH11908 12/2018 185

Diagnostics

BMENOP0300 Module Response

Modbus function code 8 / sub-function code 21: module response

Field Length Value (hex)

(bytes)
function code 1 08
sub-function code hi 1 00
sub-function code low 1 15
operation code hi 1 00
operation code low 1 76
byte count 1 D6
number of LEDs 2 6
LED 1 color 2 byte 0 = LED color 0 (black) = LED off
1 (green) = green LED on
byte 1 = blinking 0 (not blinking)
1 (blinking) = green LED blinking
LED 1 status 2 0
LED 1 name string 4 RUN
LED 2 color 2 byte 0 = LED color 0 (black) = LED off
2 (red) = red LED on
byte 1 = blinking 0 (not blinking)
1 (blinking) = red LED blinking
LED 2 status 2 0
LED 2 name string 4 ERR
LED 3 color 2 byte 0 = LED color 0 (black) = LED off
2 (red) = red LED on
byte 1 = blinking 0 (not blinking)
1 (blinking) = red LED blinking
LED 3 status 2 0
LED 3 name string 11 mod status
LED 4 color 2 byte 0 = LED color 0 (black) = LED off
1 (green) = green LED on
2 (red) = LED on
3 (yellow) = red and green LEDs on
4 (blink first green, then yellow) = green on,
red blinking
5 (blink first red, then yellow) = red and green
blinking
byte 1 = blinking 0 (not blinking)
1 (blinking) = LED in byte 0 blinking

186 QGH11908 12/2018

 Diagnostics

Field Length Value (hex)

(bytes)
LED 4 status 2 0
LED 4 name string 15 network status
LED 5 color 2 byte 0 = LED color 0 (black) = LED color
1 (green) = green LED on
2 (red) = LED on
3 (yellow) = red and green LEDs on
4 (blink first green, then yellow) = green on,
red blinking
5 (blink first red, then yellow) = red and green
blinking
byte 1 = blinking 0 (not blinking)
1 (blinking) = LED in byte 0 blinking
LED 5 status 2 0
LED 5 name string 17 network status 1
LED 6 color 2 byte 0 = LED color 0 (black) = LED off
1 (green) = green LED on
2 (red) = LED on
3 (yellow) = red and green LEDs on
4 (blink first green, then yellow) = green on,
red blinking
5 (blink first red, then yellow) = red and green
blinking
byte 1 = blinking 0 (not blinking
1 (blinking) = LED in byte 0 blinking
LED 6 status 2 0
LED 6 name string 17 network status 2
number of services 2 5
service 1 color 2 0 = off <default>
1 = green
service 1 status 2 1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 1 name string 15 access control
service 2 color 2 0 = off <default>
1 = on green
2 = on red
service 2 status 2 4 (corresponds to LED color 0) <default>
2 (corresponds to LED color 1)
5 (corresponds to LED color 2) – link to server down
service 2 name string 21 network time service

QGH11908 12/2018 187

Diagnostics

Field Length Value (hex)

(bytes)
service 3 color 2 0 = off <default>
1 = green
service 3 status 2 1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 3 name string 18 IED server service
service 4 color 2 0 = off <default>
1 = green
service 4 status 2 1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 4 name string 18 IED client service
service 5 color 2 0 = off <default>
1 = green
service 5 status 2 1 (corresponds to LED color 1)
3 (corresponds to LED color 0) <default>
service 5 name string 23 IP forwarding service

188 QGH11908 12/2018

 Diagnostics

Modbus Diagnostic Codes

Modbus NTP Diagnostic Codes

The BMENOP0300 module supports the following NTP diagnostic codes, which begin at 41219
(decimal):

Address MS Byte LS Byte Modbus Type Comments

41219 MSW - MSB MSW - LSB UDINT Enabled/disabled
Offset + 01 LSW - MSB LSW - LSB
Offset + 02 MSW - MSB MSW - LSB UDINT Primary NTP Server IP Address
Offset + 03 LSW - MSB LSW - LSB
Offset + 04 MSW - MSB MSW - LSB UDINT Secondary NTP Server IP
Offset + 05 LSW - MSB LSW - LSB Address

Offset + 06 Unused LS Byte USINT Polling Period

Offset + 07 Unused LS Byte USINT Daylight Saving Auto Adjustment
Offset + 08 Unused LS Byte USINT Update CPU with Module Time
Offset + 09 Unused LS Byte USINT Reserved
Offset + 10 MSW - MSB MSW - LSB UDINT Time Zone
Offset + 11 LSW - MSB LSW - LSB
Offset + 12 MS Byte LS Byte INT Time Zone Offset
Offset + 13 Unused Unused USINT Reserved
Offset + 14 Unused Unused USINT Reserved
Offset + 15 Unused LS Byte USINT Daylight Saving Start Date -
Month
Offset + 16 Unused LS Byte USINT Daylight Saving Start Date - week
# day of week
Offset + 17 Unused LS Byte USINT Daylight Saving End Date - Month
Offset + 18 Unused LS Byte USINT Daylight Saving End Date - week
# day of week
Offset + 19 MSW - MSB MSW - LSB UDINT Network Time Service Status
Offset + 20 LSW - MSB LSW - LSB
Offset + 21 MSW - MSB MSW - LSB UDINT Link to NTP Server Status
Offset + 22 LSW - MSB LSW - LSB
Offset + 23 MSW - MSB MSW - LSB UDINT Current NTP Server IP Address
Offset + 24 LSW - MSB LSW - LSB
Offset + 25 MSW - MSB MSW - LSB UDINT NTP Server Type
Offset + 26 LSW - MSB LSW - LSB

QGH11908 12/2018 189

Diagnostics

Address MS Byte LS Byte Modbus Type Comments

Offset + 27 MSW - MSB MSW - LSB UDINT NTP Server Time Quality
Offset + 28 LSW - MSB LSW - LSB
Offset + 29 MSW - MSB MSW - LSB UDINT Number of NTP Requests Sent
Offset + 30 LSW - MSB LSW - LSB
Offset + 31 MSW - MSB MSW - LSB UDINT Number of Communication Errors
Offset + 32 LSW - MSB LSW - LSB
Offset + 33 MSW - MSB MSW - LSB UDINT Number of NTP Reponses
Received
Offset + 34 LSW - MSB LSW - LSB
Offset + 35 MS Byte LS Byte UINT Last Error
Offset + 36 MSW - MSB MSW - LSB UDINT Current Time
Offset + 37 LSW - MSB LSW - LSB
Offset + 38 MS Byte LS Byte UINT Current Date
Offset + 39 MSW - MSB MSW - LSB UDINT Daylight Savings Status
Offset + 40 LSW - MSB LSW - LSB
Offset + 41 MSW - MSB MSW - LSB UINT Time Since Last Update
Offset + 42 LSW - MSB LSW - LSB

Modbus QoS Diagnostic Codes

The BMENOP0300 module supports the following QoS diagnostic codes, which begin at 41261
(decimal):

Address MS Byte LS Byte CIP Type Comments

41261 MS Byte LS Byte UINT 802.1Q Tag enable / disable
Offset + 01 MS Byte LS Byte UINT Reserved for DSCP PTP Event
Offset + 02 MS Byte LS Byte UINT Reserved for DSCP PTP General
Offset + 03 MS Byte LS Byte UINT Reserved for DSCP EIP Urgent
Offset + 04 MS Byte LS Byte UINT Reserved for DSCP EIP Scheduled
Offset + 05 MS Byte LS Byte UINT Reserved for DSCP EIP High
Offset + 06 MS Byte LS Byte UINT Reserved for DSCP EIP Low
Offset + 07 MS Byte LS Byte UINT Reserved for DSCP EIP Explicit
Offset + 08 MS Byte LS Byte UINT Reserved for DSCP Modbus IO Scanner
(same as DSCP EIP High)
Offset + 09 MS Byte LS Byte UINT DSCP Modbus Client/Server (same EIP
Explicit)
Offset + 10 MS Byte LS Byte UINT DSCP NTP
Offset + 11 MS Byte LS Byte UINT DSCP IEC 61850_Client

190 QGH11908 12/2018

 Diagnostics

IEC 61850 Diagnostic Codes

Introduction
The BMENOP0300 module supports IEC 61850 server, server report, and client diagnostic codes.

Server Diagnostic Codes

Address MS Byte LS Byte Modbus Comments

Type
42201 Active Health WORD  Active: 1 indicates configured
 Health: 1 indicates service is
operational
42201+ 1 ProtoEd ActiveConn WORD  ProtoEd :IEC 61850 Edition version
 ActiveConn:Number of connection
established with this server
42201+ 2 MSW - MSB MSW - LSB UDINT A counter that increments each time the
LSW - MSB LSW - LSB server receives a read variable request.

42201+ 4 MSW - MSB MSW - LSB UDINT Number of rejected MMS read variable
requests
LSW - MSB LSW - LSB
42201+ 6 MSW - MSB MSW - LSB UDINT A counter that increments each time the
server receives a write variable request.
LSW - MSB LSW - LSB
42201+ 8 MSW - MSB MSW - LSB UDINT Number of rejected MMS write variable
requests
LSW - MSB LSW - LSB
42201+ 10 MSW - MSB MSW - LSB UDINT A counter that increments each time the
server sends an information report
LSW - MSB LSW - LSB
message.
42201+ 12 MSW - MSB MSW - LSB UDINT A counter that increments each time the
server sends a GOOSE.
LSW - MSB LSW - LSB
42201+ 14 MSW - MSB MSW - LSB UDINT A counter that increments each time the
server receives a GOOSE.
LSW - MSB LSW - LSB
42201+ 16 MSW - MSB MSW - LSB UDINT A counter that increments each time the
server receives an invalid GOOSE.
LSW - MSB LSW - LSB
42201+ 18 MSW - MSB MSW - LSB DWORD Detected error code
LSW - MSB LSW - LSB

QGH11908 12/2018 191

Diagnostics

Server Report Diagnostic Codes

Address MS Byte LS Byte Modbus Comments

Type
42221 Enabled Overflow WORD  Enabled: 1 indicates configured
 Overflow: 1 indicates service is operational

42221+ 1 MSB LSB WORD Counter for data exchange for one report-1
... ... ... ... ...
... ... ... ... ...
42221 Enabled Overflow WORD  Enabled: 1 indicates configured
 Overflow: 1 indicates service is operational

42221+ 63 MSB LSB WORD Counter for data exchange for one report – 64

Client Diagnostic Codes

Address MS Byte LS Byte Modbus Comments

Type
42349 Active Health WORD  Active: 1 indicates configured
 Health: 1 means service is operational

42349+ 1 ProtoEd ActiveConn WORD  ProtoEd :IEC 61850 Edition version

 ActiveConn:Number of connections
established with this server
42349+ 2 MSW - MSB MSW - LSB UDINT IED connection status
LSW - MSB LSW - LSB
42349+ 4 MSW - MSB MSW - LSB UDINT A counter that increments each time the client
receives a read variable.
LSW - MSB LSW - LSB
42349+ 6 MSW - MSB MSW - LSB UDINT Number of rejected MMS read variable
requests
LSW - MSB LSW - LSB
42349+ 8 MSW - MSB MSW - LSB UDINT A counter that increments each time the client
LSW - MSB LSW - LSB sends a write variable request

42349+ 10 MSW - MSB MSW - LSB UDINT Number of rejected MMS write variable
requests
LSW - MSB LSW - LSB
42349+ 12 MSW - MSB MSW - LSB UDINT A counter that increments each time the client
LSW - MSB LSW - LSB receives an information report message.

42349+ 14 MSW - MSB MSW - LSB UDINT A counter that increments each time the client
receives a goose.
LSW - MSB LSW - LSB

192 QGH11908 12/2018

 Diagnostics

Address MS Byte LS Byte Modbus Comments

Type
42349+ 16 MSW - MSB MSW - LSB UDINT A counter that increments each time the client
LSW - MSB LSW - LSB receives an invalid goose.

42349+ 18 MSW - MSB MSW - LSB DWORD Detected error code

LSW - MSB LSW - LSB

QGH11908 12/2018 193

Diagnostics

Redundant System Switchover

Overview
The BMENOP0300 module supports the M580 redundancy function. In an M580 redundancy
system, the primary and standby PACs continuously exchange data including the state RAM of the
two BMENOP0300 modules.
Use the IP address [Link] to validate a redundant configuration, then rebuild your Control
Expert project.
NOTE:
 Because the primary M580 CPU automatically synchronizes I/O data between the primary and
standby CPU, it is not necessary to execute any operations on the BMENOP0300 module in the
standby PAC.
 Schneider Electric recommends that you configure the standby PAC to execute only the first
section of program logic, and place all code for BMENOP0300 module operations into code
sections that follow the first section.

IEC 61850 Server Functions in an M580 Redundancy System

SCADA:
In an M580 redundancy system, the primary PAC performs SCADA functions in the same manner
as a standalone PAC. The standby PAC does not communicate with SCADA, but does monitor
PAC memory each scan and generates reports.
On switchover, the primary PAC closes the connection with SCADA; the standby PAC starts to
listen for and accept new connection requests from SCADA. The former standby PAC, now the
primary, first applies the data values received from the former primary to its local database, and
then begins to perform SCADA functions after a SCADA connection is established.
Report Functions:
On every PAC cycle, the two BMENOP0300 modules synchronize the buffered report Entry ID
value. After switchover, confirm that SCADA explicitly sets the Entry ID to the BMENOP0300
module in the new primary PAC so that the module can continue to send buffered reports. If the
Entry ID is not synchronized, or if synchronization is not successful, the oldest reports are re-sent
during switchover buffer time. In this case, SCADA can detect if it has received a duplicated event
report by comparing the report time tags.
The Integrity Period setting can be used in a redundant system to generate buffered and
unbuffered reports on both primary and standby BMENOP0300 modules. We recommend you not
use this feature.
GOOSE:
Only the BMENOP0300 module in the primary PAC can publish GOOSE transmissions.
The BMENOP0300 modules in both the primary and standby PACs receive GOOSE data from the
remote IED. However, the data received by the standby PAC is not added to memory, but is only
added to the local database.

194 QGH11908 12/2018

 Diagnostics

On switchover, the BMENOP0300 module in the standby PAC takes over the task of sending
GOOSE. However, the stNum and sqNum fields are not synchronized.

IEC 61850 Client Functions in an M580 Redundant System

Connection with Remote IED:
Only the BMENOP0300 module in the primary PAC communicates with the remote IED; the
BMENOP0300 module in the standby PAC does not establish a connection with remote IED.
The BMENOP0300 modules in both the primary and standby PACs synchronize data out values
from PAC memory to the local database. However, because the standby PAC doesn't send output
data to the remote IED, the remote IED receives output data only from the BMENOP0300 module
in the primary PAC.
GOOSE:
The BMENOP0300 modules in both the primary and standby PACs receive GOOSE data from the
remote IED. However, the data received by the standby PAC is not added to memory, but is only
added to the local database.
Report Functions:
It is recommended to automatically enable the report function for buffered and unbuffered report
control blocks by setting the AutoEna field to 1 (auto enable). After switchover, the BMENOP0300
module sets the Entry ID to the remote IED and automatically enables the report when establishing
a connection with the remote IED.
Switchover:
On switchover, the BMENOP0300 module in the primary PAC closes the connection with remote
IED; the BMENOP0300 module in the former standby PAC, now the primary, begins to
communicate with remote IED.
If the execution of a report control block/GOOSE command, polling command, or control operation
is interrupted by a switchover, the high byte of the Status element for that object returns a
detected error bit. It is recommended to add an error handling procedure to your program logic that
will manage this detected error by re-sending the command.

BMENOP0300 IP Address Recovery Time

Use the following formula to determine the BMENOP0300 module IP address recovery time in a
M580 redundancy system:
500 ms (IP address swapping) + connection establishment time (3 s)
NOTE: The maximum swap time may increase if the end device does not respond in a timely
manner.
NOTE: During the swap, there may be disruption in communication between the BMENOP0300
module and the end device. Confirm that the application can tolerate this communication
disruption.

QGH11908 12/2018 195

Diagnostics

Dual Network Redundancy Diagnostics

Introduction
The BMENOP0300 module supports dual network redundancy for high reliability communications.
The module supports the following two level solutions for dual networks:
 one module: The BMENOP0300 module supports multiple IP segments with unique physical
interfaces, so you can use one module to support two IP segments. SCADA decides which IP
segment to use as primary and secondary network. This solution does not require additional
application programming because the two IP segments share one database and state machine.
 two modules: This solution, in which the two modules are configured within two different
networks, requires additional application programming to confirm that the two modules
synchronize with each other. The two modules use one dedicated elementary function block to
simplify the programming process. Refer to the documentation for the IEC 61850 Configuration
Tool for more information.

CAUTION
RISK OF BROADCAST STORM
 Do not connect more than one of the same module in a local rack to both the Ethernet
backplane and an Ethernet network. Connecting more than one of the same module to both
the backplane and an Ethernet network can cause a broadcast storm.
 You can connect one of each of the following modules to the Ethernet backplane and an
Ethernet network:
 a BME•58•0•0 CPU module that manages an EIO main ring
 a BMENOS0300 network option switch module
 a BMENOC03•1 communication module
 a BMENOP0300 IEC 61850 communication module

Failure to follow these instructions can result in injury or equipment damage.

196 QGH11908 12/2018

 M580 IEC 61850
Firmware Upgrade
QGH11908 12/2018

Chapter 10
Firmware Upgrade

Firmware Upgrade

Firmware Upgrade

Introduction
These instructions assume that:
 You are familiar with Control Expert.
 You put the M580 PLC in Stop mode.
 You confirmed that you enabled the FTP setting in the Security tab of your Control Expert
application.
 You installed Unity Loader on your PC during the Control Expert installation.
Refer to the Unity Loader manual for a description of the download procedure.

Upgrading the Firmware

Follow these steps to upgrade the module firmware:

Step Action
1 On your PC, install the Unity Loader software provided with Control Expert.
2 Connect the PC that is running Unity Loader to one of the module ports.
3 Launch Unity Loader.
4 Select the Firmware tab.
5 In the PC list box, select the .ldx file that contains the firmware file.
6 Check that the transfer sign is green to allow the transfer from the PC to the module.
7 Select Transfer.
8 Select Close after the transfer is complete.
9 Confirm that the installation of the firmware did not create an application mismatch
condition.

QGH11908 12/2018 197

Firmware Upgrade

198 QGH11908 12/2018

 M580 IEC 61850
Protocol Conformance
QGH11908 12/2018

Chapter 11
Protocol Conformance

Protocol Conformance

Statement of Protocol Conformance

Conformance
The BMENOP0300 module complies with Edition 1.0 or 2.0 of the IEC 61850 communication
protocol. Schneider Electric recommends using the module only in a network in which all devices
support the same edition of the protocol.
The BMENOP0300 module was tested against and conforms to the following standards,:
 PICS: Protocol Implementation Conformance Statement
 PIXIT: Protocol Implementation Conformance Extra Information for Testing
 MICS: Model Implementation Conformance Statement
 TICS: Technical Issue Conformance Statement

These documents are available in the IEC 61850 Configuration Tool.

QGH11908 12/2018 199

Protocol Conformance

200 QGH11908 12/2018

 M580 IEC 61850

QGH11908 12/2018

Appendices

What Is in This Appendix?

The appendix contains the following chapters:
Chapter Chapter Name Page
A Detected Error Codes 203
B Supported Data Model Items 213

QGH11908 12/2018 201

202 QGH11908 12/2018
 M580 IEC 61850
Detected Error Codes
QGH11908 12/2018

Appendix A
Detected Error Codes

Detected Error Codes

Overview
This chapter contains a list of codes that describe the status of Ethernet communication module
messages.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Modbus TCP Explicit Messaging Detected Error Codes 204
Explicit Messaging: Communication and Operation Reports 207
Modbus TCP Explicit Messaging Detected Error Codes 210

QGH11908 12/2018 203

Detected Error Codes

Modbus TCP Explicit Messaging Detected Error Codes

Introduction
If a DATA_EXCH function block does not execute a Modbus TCP explicit message, Control Expert
returns a hexadecimal detected error code.

Modbus TCP Detected Error Codes

Modbus TCP hexadecimal detected error codes include:

Detected Error Description

Code
16#800D Timeout on the explicit message request
16#8012 Bad device
16#8015 Either:
 Nor resources to handle the message, or
 Internal detected error: no buffer available, no link available, impossible to send to the
TCP task
16#8018 Either:
 Another explicit message for this device is in progress, or
 TCP connection or encapsulation session in progress

16#8030 Timeout on the Forward_Open request

Note: The following 16#81xx detected errors are Forward_Open response detected errors that originate at
the remote target and are received via the CIP connection.
16#8100 Connection in use or duplicate Forward_Open
16#8103 Transport class and trigger combination not supported
16#8106 Ownership conflict
16#8107 Target connection not found
16#8108 Invalid network connection parameter
16#8109 Invalid connection size
16#8110 Target for connection not configured
16#8111 RPI not supported
16#8113 Out of connections
16#8114 Vendor ID or product code mismatch
16#8115 Product type mismatch
16#8116 Revision mismatch
16#8117 Invalid produced or consumed application path
16#8118 Invalid or inconsistent configuration application path
16#8119 Non-Listen Only connection not opened

204 QGH11908 12/2018

 Detected Error Codes

Detected Error Description

Code
16#811A Target object out of connections
16#811B RPI is smaller than the production inhibit time
16#8123 Connection timed out
16#8124 Unconnected request timed out
16#8125 Parameter detected error in unconnected request and service
16#8126 Message too large for unconnected_send service
16#8127 Unconnected acknowledge without reply
16#8131 No buffer memory available
16#8132 Network bandwidth not available for data
16#8133 No consumed connection ID filter available
16#8134 Not configured to send scheduled priority data
16#8135 Schedule signature mismatch
16#8136 Schedule signature validation not possible
16#8141 Port not available
16#8142 Link address not valid
16#8145 Invalid segment in connection path
16#8146 Detected error in Forward_Close service connection path
16#8147 Scheduling not specified
16#8148 Link address to self invalid
16#8149 Secondary resources unavailable
16#814A Rack connection already established
16#814B Module connection already established
16#814C Miscellaneous
16#814D Redundant connection mismatch
16#814E No more user-configurable link consumer resources: the configured number of resources for
a producing application has reached the limit
16#814F No more user-configurable link consumer resources: there are no consumers configured for
a producing application to use
16#8160 Vendor specific
16#8170 No target application data available
16#8171 No originator application data available
16#8173 Not configured for off-subnet multicast
16#81A0 Detected error in data assignment

QGH11908 12/2018 205

Detected Error Codes

Detected Error Description

Code
16#81B0 Optional object state detected error
16#81C0 Optional device state detected error
Note: All 16#82xx detected errors are register session response detected errors.
16#8200 Target device does not have sufficient resources
16#8208 Target device does not recognize message encapsulation header
16#820F Reserved or unknown detected error from target

206 QGH11908 12/2018

 Detected Error Codes

Explicit Messaging: Communication and Operation Reports

Overview
Communication and operation reports are part of the management parameters.
NOTE: It is recommended that communication function reports be tested at the end of their
execution and before the next activation. On cold start-up, confirm that all communication function
management parameters are checked and reset to 0.
It may be helpful to use the%S21 to examine the first cycle after a cold or warm start.

Communication Report
This report is common to every explicit messaging function. It is significant when the value of the
activity bit switches from 1 to 0. The reports with a value between 16#01 and 16#FE concern errors
detected by the processor that executed the function.
The different values of this report are indicated in the following table:

Value Communication report (least significant byte)

16#00 Correct exchange
16#01 Exchange stop on timeout
16#02 Exchange stop on user request (CANCEL)
16#03 Incorrect address format
16#04 Incorrect destination address
16#05 Incorrect management parameter format
16#06 Incorrect specific parameters
16#07 Error detected in sending to the destination
16#08 Reserved
16#09 Insufficient receive buffer size
16#0A Insufficient send buffer size
16#0B No system resources: the number of simultaneous communication EFs exceeds the
maximum that can be managed by the processor
16#0C Incorrect exchange number
16#0D No telegram received
16#0E Incorrect length
16#0F Telegram service not configured
16#10 Network module missing
16#11 Request missing

QGH11908 12/2018 207

Detected Error Codes

Value Communication report (least significant byte)

16#12 Application server already active
16#13 UNI-TE V2 transaction number incorrect
16#FF Message refused

NOTE: The function can detect a parameter error before activating the exchange. In this case the
activity bit remains at 0, and the report is initialized with values corresponding to the detected error.

Operation Report
This report byte is specific to each function, and specifies the result of the operation on the remote
application:

Value Operation report (most significant byte)

16#05 Length mismatch (CIP)
16#07 Bad IP address
16#08 Application error
16#09 Network is down
16#0A Connection reset by peer
16#0C Communication function not active
16#0D  Modbus TCP: transaction timed out
 EtherNet/IP: request timeout

16#0F No route to remote host

16#13 Connection refused
16#15  Modbus TCP: no resources
 EtherNet/IP: no resources to handle the message; or an internal detected error; or
no buffer available; or no link available; or cannot send message
16#16 Remote address not allowed
16#18  Modbus TCP: concurrent connections or transactions limit reached
 EtherNet/IP: TCP connection or encapsulation session in progress

16#19 Connection timed out

16#22 Modbus TCP: invalid response
16#23 Modbus TCP: invalid device ID response
16#30  Modbus TCP: remote host is down
 EtherNet/IP: connection open timed out

16#80...16#87: Forward_Open response detected errors:

16#80 Internal detected error
16#81 Configuration detected error: the length of the explicit message, or the RPI rate, needs
to be adjusted

208 QGH11908 12/2018

 Detected Error Codes

Value Operation report (most significant byte)

16#82 Device detected error: target device does not support this service
16#83 Device resource detected error: no resource is available to open the connection
16#84 System resource event: unable to reach the device
16#85 Data sheet detected error: incorrect EDS file
16#86 Invalid connection size
16#90...16#9F: Register session response detected errors:
16#90 Target device does not have sufficient resources
16#98 Target device does not recognize message encapsulation header
16#9F Unknown detected error from target

QGH11908 12/2018 209

Detected Error Codes

Modbus TCP Explicit Messaging Detected Error Codes

Introduction
If an MBP_MSTR function block does not execute an explicit message, Control Expert displays a
hexidecimal detected error code.
Refer to the TCP/IP Ethernet detected error codes topic for a description of those codes.

Modbus TCP Detected Error Codes

Modbus TCP hexadecimal detected error codes include:

Code (hexadecimal) Description

16#800D Timeout on the explicit message request
16#8015 Either:
 Nor resources to handle the message, or
 Internal event: no buffer available, no link available, impossible to send to the
TCP task
16#8018 Either:
 Another explicit message for this device is in progress, or
 TCP connection or encapsulation session in progress

16#8030 Timeout on the Forward_Open request

Note: The following 16#81xx events are Forward_Open response detected error codes that originate at the
remote target and are received via the CIP connection.
16#8100 Connection in use or duplicate Forward_Open
16#8103 Transport class and trigger combination not supported
16#8106 Ownership conflict
16#8107 Target connection not found
16#8108 Invalid network connection parameter
16#8109 Invalid connection size
16#8110 Target for connection not configured
16#8111 RPI not supported
16#8113 Out of connections
16#8114 Vendor ID or product code mismatch
16#8115 Product type mismatch
16#8116 Revision mismatch
16#8117 Invalid produced or consumed application path
16#8118 Invalid or inconsistent configuration application path
16#8119 Non-Listen Only connection not opened
16#811A Target object out of connections

210 QGH11908 12/2018

 Detected Error Codes

Code (hexadecimal) Description

16#811B RPI is smaller than the production inhibit time
16#8123 Connection timed out
16#8124 Unconnected request timed out
16#8125 Parameter event in unconnected request and service
16#8126 Message too large for unconnected_send service
16#8127 Unconnected acknowledge without reply
16#8131 No buffer memory available
16#8132 Network bandwidth not available for data
16#8133 No consumed connection ID filter available
16#8134 Not configured to send scheduled priority data
16#8135 Schedule signature mismatch
16#8136 Schedule signature validation not possible
16#8141 Port not available
16#8142 Link address not valid
16#8145 Invalid segment in connection path
16#8146 Event in Forward_Close service connection path
16#8147 Scheduling not specified
16#8148 Link address to self invalid
16#8149 Secondary resources unavailable
16#814A Rack connection already established
16#814B Module connection already established
16#814C Miscellaneous
16#814D Redundant connection mismatch
16#814E No more user-configurable link consumer resources: the configured number of
resources for a producing application has reached the limit
16#814F No more user-configurable link consumer resources: there are no consumers
configured for a producing application to use
16#8160 Vendor specific
16#8170 No target application data available
16#8171 No originator application data available
16#8173 Not configured for off-subnet multicast
16#81A0 Event in data assignment
16#81B0 Optional object state event
16#81C0 Optional device state event

QGH11908 12/2018 211

Detected Error Codes

Code (hexadecimal) Description

Note: All 16#82xx events are register session response detected error codes.
16#8200 Target device does not have sufficient resources
16#8208 Target device does not recognize message encapsulation header
16#820F Reserved or unknown event from target

212 QGH11908 12/2018

 M580 IEC 61850
Supported Data Model Items
QGH11908 12/2018

Appendix B
Supported Data Model Items

Supported Data Model Items

Overview
This chapter describes the items supported by the data model of the BMENOP0300 module.

What Is in This Chapter?

This chapter contains the following topics:
Topic Page
Logical Nodes 214
Common Data Classes 222

QGH11908 12/2018 213

Supported Data Model Items

Logical Nodes

Overview
The BMENOP0300 module supports the logical nodes (LNs) appearing in the following groups.

Group L: System Logical Nodes

Name Description
LLN0 Logical node zero
LPHD Physical device information
LCCH Physical communication channel supervision
LGOS GOOSE subscription
LTIM Time management
LTMS Time master supervision

Group A: Automatic Control Logical Nodes

Name Description
ACTM Control mode selection
AJCL Joint control
ANCR Neutral current regulator
APSF PSS 4B filter function
APSS PSS control, common information
APST PSS 2A/B filter function
ARCO Reactive power control
ARIS Resistor control
ATCC Automatic tap changer
AVCO Voltage control

Group C: Control Logical Nodes

Name Description
CALH Alarm handling
CCGR Cooling group
CILO Interlocking
CPOW Point-on-wave switching

214 QGH11908 12/2018

 Supported Data Model Items

Name Description
CSWI Switch controller
CSYN Synchronizer controller

Group F: Functional Block Logical Nodes

Name Description
FCNT Counter
FCSD Curve shape description
FFIL Generic filter
FHBT Functional heartbeat
FLIM Control function output
FPID PID regulator
FRMP Ramp function
FSCH Scheduler
FSPT Set-point control
FXOT Action at over threshold
FXPS Functional priority status
FXUT Action at under threshold

Group G: Generic Reference Logical Nodes

Name Description
GAPC Generic automatic process control
GGIO Generic process I/O
GSAL Generic security application

Group H: Hydropower Specific Logical Nodes

Name Description
HBRG Turbine – generator shaft bearing
HCOM Combinator
HDAM Hydropower dam
HDFL Deflector control
HDLS Dam leakage supervision
HEBR Electrical brake

QGH11908 12/2018 215

Supported Data Model Items

Name Description
HGOV Governor control mode
HGPI Gate position indicator
HGTE Dam gate
HITG Intake gate
HJCL Joint control
HLKG Leakage supervision
HLVL Water level indicator
HMBR Mechanical brake
HNDL Needle control
HNHD Water net head data
HOTP Dam over-topping protection
HRES Hydropower / water reservoir
HSEQ Hydropower unit sequencer
HSPD Speed monitoring
HSST Surge shaft
HTGV Guide vanes (wicket gate)
HTRB Runner blades
HTRK Trash rack
HTUR Turbine
HUNT Hydropower unit
HVLV Valve (butterfly valve, ball valve)
HWCL Water control

Group I: Interfacing and Archiving Logical Nodes

Name Description
IARC Archiving
IFIR Fire detection and alarm
IHMI Human machine interface
IHND Hand interface
ISAF Safety alarm function
ITCI Telecontrol interface
ITMI Telemonitoring interface
ITPC Teleprotection communication

216 QGH11908 12/2018

 Supported Data Model Items

Group K: Mechanical and Non-Electric Primary Equipment Logical Nodes

Name Description
KFAN Fan
KFIL Filter
KPMP Pump
KTNK Tank
KVLV Valve control
KHTR Heater, cubicle heater

Group M: Metering and Measurement Logical Nodes

Name Description
MENV Environmental information
MFLK Flicker measurement name
MHAI Harmonics or interharmonics
MHAN Non-phase-related harmonics or interharmonics
MHYD Hydrological information
MMDC DC measurement
MMET Meteorological information
MMTN Metering single phase
MMTR Metering 3 phase
MMXN Non-phase-related measurement
MMXU Measurement
MSQI Sequence and imbalance
MSTA Metering statistics

Group P: Protection Function Logical Nodes

Name Description
PDIF Differential
PDIR Direction comparison
PDIS Distance
PDOP Directional overpower
PDUP Directional underpower
PFRC Rate of change of frequency
PHAR Harmonic restraint

QGH11908 12/2018 217

Supported Data Model Items

Name Description
PHIZ Ground detector
PIOC Instantaneous overcurrent
PMRI Motor restart inhibition
PMSS Motor starting time supervision
POPF Over power factor
PPAM Phase angle measuring
PRTR Rotor protection
PSCH Protection scheme
PSDE Sensitive directional earthfault
PTEF Transient earth fault
PTHF Thyristor protection
PTOC Time overcurrent
PTOF Overfrequency
PTOV Overvoltage
PTRC Protection trip conditioning
PTTR Thermal overload
PTUC Undercurrent
PTUF Underfrequency
PTUV Undervoltage
PUPF Underpower factor
PVOC Voltage controlled time
PVPH Volts per Hz
PZSU Zero speed or underspeed

Group Q: Power Quality Logical Nodes

Name Description
QFVR Frequency variation
QITR Current transient
QIUB Current unbalance variation
QVTR Voltage transient
QVUB Voltage unbalance variation
QVVR Voltage variation

218 QGH11908 12/2018

 Supported Data Model Items

Group R: Protection Related function Logical Nodes

Name Description
RBRF Breaker failure
RDIR Directional element
RFBC Field breaker configuration
RFLO Fault locator
RMXU Differential measurements
RPSB Power swing detection/blocking
RREC Autoreclosing
RSYN Synchronism-check

Group S: Supervision and Monitoring Logical Nodes

Name Description
SARC Monitoring and diagnostics for arcs
SCBR Circuit breaker supervision
SFLW Supervision of media flow
SIMG Insulation medium supervision (gas)
SIML Insulation medium supervision (liquid)
SLTC Tap changer supervision
SLVL Supervision of media level
SOPM Supervision of operating mechanism
SPDC Monitoring and diagnostics for partial discharges
SPOS Supervision of the position of a device
SPRS Supervision media pressure
SPTR Power transformer supervision
SSWI Circuit switch supervision
STMP Temperature supervision
SVBR Vibration supervision

QGH11908 12/2018 219

Supported Data Model Items

Group T: Instrument Transformer and Sensor Logical Nodes

Name Description
TANG Angle
TAXD Axial displacement
TCTR Current transformer
TDST Distance
TFLW Liquid flow
TFRQ Frequency
TGSN Generic sensor
THUM Humidity
TLVL Media level
TMGF Magnetic field
TMVM Movement sensor
TPOS Position indicator
TPRS Pressure sensor
TRTN Rotation transmitter
TSND Sound pressure sensor
TTMP Temperature sensor
TTNS Mechanical tension / stress
TVBR Vibration sensor
TVTR Voltage transformer
TWPH Water acidity

Group X: Switchgear Logical Nodes

Name Description
XCBR Circuit breaker
XFFL Switching control for field flashing
XSWI Circuit switch

220 QGH11908 12/2018

 Supported Data Model Items

Group Y: Power Transformers Logical Nodes

Name Description
YEFN Earth fault neutralizer (Petersen coil)
YLTC Tap changer
YPSH Power shunt
YPTR Power transformer

Group Z: Further Power System Equipment Logical Nodes

Name Description
ZAXN Auxiliary network
ZBAT Battery
ZBSH Bushing
ZCAB Power cable
ZCAP Capacitor bank
ZCON Converter
ZGEN Generator
ZGIL Gas insulated line
ZLIN Power overhead line
ZMOT Motor
ZREA Reactor
ZRES Resistor
ZRRC Rotating reactive component
ZSAR Surge arrestor
ZSCR Semi-conductor controlled rectifier
ZSMC Synchronous machine
ZTCF Thyristor controlled frequency converter
ZTCR Thyristor controlled reactive component

QGH11908 12/2018 221

Supported Data Model Items

Common Data Classes

CDCs
The BMENOP0300 module supports the following common data classes (CDCs):

CDC Description Information Type

ACD Directional protection activation information Status information
ACT Protection activation information Status information
APC Controllable analogue process value Controls information
ASG Analog setting Analog settings
BAC Binary controlled analog process value Controls information
BCR Binary counter reading Status information
BSC Binary controlled step position information Controls information
CMV Complex measured value Measurment information
CSD Curve shape description Descriptive information
CSG Curve shape setting Analog settings
CURVE Setting curve Analog settings
DEL Phase to phase related measured values of a three-phase Measurement information
system
DPC Controllable double point Controls information
DPL Device name plate Descriptive information
DPS Double point status Status information
ENC Controllable enumerated status Controls information
ENG Enumerated status setting Status settings
ENS Enumerated status Status information
HDEL Harmonic value for DEL Measurment information
HMV Harmonic value Measurment information
HST Histogram Status information
HWYE Harmonic value for WYE Measurment information
INC Controllable integer status Controls information
ING Integer status setting Status settings
INS Integer status Status information
ISC Integer controlled step position information Controls information
LPL Logical node name plate Descriptive information
MV Measured value Measurment information
ORG Object reference setting Status settings

222 QGH11908 12/2018

 Supported Data Model Items

CDC Description Information Type

RST Operational restriction Hydro-specific information
SAV Sampled value Measurment information
SEC Security violation counting Status information
SEQ Sequence Measurment information
SPC Controllable single point Controls information
SPG Single point setting Status settings
SPS Single point status Status information
TAG Maintenance and operational tag Hydro-specific information
TSG Time setting group Status settings
VSG Visible string setting Status settings
WYE Phase to ground/neutral related measured values of a three- Measurment information
phase system

QGH11908 12/2018 223

Supported Data Model Items

224 QGH11908 12/2018

 M580 IEC 61850
Glossary
QGH11908 12/2018

Glossary

C
CID
configured IED description: The SCL file that describes the communication-related part of an
instantiated IED within a project. The communication section contains the address of the IED. The
substation section related to this IED may be present and, if so, contains project-specific assigned
name values.

D
DAI
instantiated data attribute: A single data attribute that has been assigned an initial value by the
Modicon IEC 61850 Configuration Tool, thereby instantiating both the data attribute and its parent
data object (DO).
data set
A collection of data attributes and data objects that can be viewed and transmitted together.
Although data sets are related to logical nodes, the member data attributes can originate in
different logical nodes and logical devices. Data sets are used to define data collections that form
the basis for reporting and logging using buffered report control blocks, unbuffered report control
blocks, and GOOSE control blocks.
DDT
derived data type: A derived data type is a set of elements with the same type (ARRAY) or with
different types (structure).
DOI
instantiated data object: A single data object with one or more data attributes (DAs) that have been
assigned an initial value by the Modicon IEC 61850 Configuration Tool.
DRS
(dual-ring switch) A ConneXium extended managed switch that has been configured to operate on
an Ethernet network. Predefined configuration files are provided by Schneider Electric to
downloaded to a DRS to support the special features of the main ring / sub-ring architecture.

QGH11908 12/2018 225

Glossary

E
EF
(elementary function) This is a block used in a program which performs a predefined logical
function.
A function does not have any information on the internal state. Several calls to the same function
using the same input parameters will return the same output values. You will find information on
the graphic form of the function call in the [functional block (instance)]. Unlike a call to a function
block, function calls include only an output which is not named and whose name is identical to that
of the function. In FBD, each call is indicated by a unique [number] via the graphic block. This
number is managed automatically and cannot be modified.
Position and configure these functions in your program to execute your application.
You can also develop other functions using the SDKC development kit.
ERT
encoder, receiver, transmitter: ERT is a wireless protocol used to automatically read and transmit
data from utility meters over a short range so utility personnel need not physically enter a premises
and manually take readings from each meter.
Ethernet
A 10 Mb/s, 100 Mb/s, or 1 Gb/s, CSMA/CD, frame-based LAN that can run over copper twisted pair
or fiber optic cable, or wireless. The IEEE standard 802.3 defines the rules for configuring a wired
Ethernet network; the IEEE standard 802.11 defines the rules for configuring a wireless Ethernet
network. Common forms include 10BASE-T, 100BASE-TX, and 1000BASE-T, which can utilize
category 5e copper twisted pair cables and RJ45 modular connectors.
explicit messaging
TCP/IP-based messaging for Modbus TCP . It is used for point-to-point, client/server messages
that include both data (typically unscheduled information between a client and a server) and routing
information.

F
FTP
(file transfer protocol) A protocol that copies a file from one host to another over a TCP/IP-based
network, such as the internet. FTP uses a client-server architecture as well as separate control and
data connections between the client and server.

226 QGH11908 12/2018

 Glossary

G
GOOSE
generic object-oriented substation event: A control model defined by the IEC 61850 protocol that
provides a mechanism for the transfer of event data relating to module status and value settings.
GOOSE is a sub-set of the GSE model. As implemented in the Ethernet communication module,
GOOSE is used to publish and subscribe to event data in the form of VLAN transmissions.

I
ICD
IED capability description: A mandatory SCL file used to exchange data from the IED configurator
to the system configurator. This file describes the functional and engineering capabilities of an IED
type. It contains exactly one IED section for the IED type whose capabilities are described. The
IED name shall be TEMPLATE.
IED
intelligent electronic device: An IEC 61850 protocol compliant, microprocessor based industrial
device incorporating one or more processors with the capability of receiving or sending
data/controls from or to an external source (for example, electronic multifunction meters, digital
relays, controllers).
IID
instantiated IED description: An SCL file that contains the configuration data for a single IED in an
application. This file must contain the instantiated device description, communication settings, and
data type templates. The file may optionally contain a description of LNs bound to the substation
object.
IPsec
(internet protocol security) An open set of protocol standards that make IP communication
sessions private and secure for traffic between modules using IPsec, developed by the internet
engineering task force (IETF). The IPsec authentication and encryption algorithms require user-
defined cryptographic keys that process each communications packet in an IPsec session.

L
LD
logical device: A collection of a group of functions. Each function is defined as a logical node. A
physical device can include one or more LDs. The IEC 61850 server includes a root LD named
System.
LN
logical node: A specific function of a logical device (LD), defined by a collection of data objects
(DOs).

QGH11908 12/2018 227

Glossary

M
MB/TCP
(Modbus over TCP protocol) This is a Modbus variant used for communications over TCP/IP
networks.

R
RSTP
(rapid spanning tree protocol) A protocol that allows a network design to include spare (redundant)
links to provide automatic backup paths if an active link stops working, without the need for loops
or manual enabling/disabling of backup links.

S
SCD
substation configuration description file: An SCL file containing a detailed description of an entire
substation design. It must include sections describing the substation, communication, IED, and
data type template. A single SCD file comprises multiple SSD and ICD files.
SCL
system configuration description language: An XML based language that allows a formal
description of power utility automation systems, the devices and the relation between them, and
the IED configuration.
SNMP
(simple network management protocol) Protocol used in network management systems to monitor
network-attached devices for events. The protocol is part of the internet protocol suite (IP) as
defined by the internet engineering task force (IETF), which consists of network management
guidelines, including an application layer protocol, a database schema, and a set of data objects.
SNTP
(simple network time protocol) See NTP.

228 QGH11908 12/2018

 M580 IEC 61850
Index
QGH11908 12/2018

Index

Symbols common data classes, 222

connection operation
{Module_name}_CLIENT_STATE, 125
client, 145
{Module_name}_IED_GOOSE, 126
Control Expert
{Module_name}_MOD_CONTROL, 120
archive application, 73
{Module_name}_MOD_DIAG, 121
creating project, 29
{Module_name}_MOD_INFO, 120
download application, 72
{Module_name}_MODULE_STATE, 122
standard data types, 21
{Module_name}_SERVER_STATE, 124
upload application, 73
control operation
client, 142
A server, 140
access control, 59 cyber security
IPsec, 61
B
backplane D
selecting, 25 data attributes
baud rate, 69 instantiating, 88
BITSTRING data in
IEC61880, 21 BMENOP0300, 19
BMENOP0300 data model, 81
custom data types, 23 data objects
data in, 19 instantiating, 88
data out, 19 data out
explicit messaging, 20 BMENOP0300, 19
GOOSE, 19 data rate, 69
specifications, 19 data set
BMEXBP0400, 25 create, 90
BMEXBP0800, 25 data types, custom
BMEXBP1200, 25 BMENOP0300, 23
breadcrumb navigation, 37 data types, standard
Control Expert, 21
IEC 61850, 21
C DATA_EXCH, 172
certifications, 24 error codes, 204
CO_OPER_BOOL, 136 explicit message, 164
CO_OPER_ENUM, 138
CO_OPER_FLOAT, 138
CO_OPER_INT32, 137
CO_OPER_INT8, 137

QGH11908 12/2018 229

Index

DDT explicit messaging

{Module_name}_CLIENT_STATE, 125 BMENOP0300, 20
{Module_name}_IED_GOOSE, 126 communication report, 207
{Module_name}_MOD_CONTROL, 120 Modbus TCP function codes, 169
{Module_name}_MOD_DIAG, 121 operation report, 207
{Module_name}_MOD_INFO, 120 explicit messaging detected error codes, 210
{Module_name}_MODULE_STATE, 122
{Module_name}_SERVER_STATE, 124
{Module}_{IED name, 127, 128 F
CO_OPER_, 139 firmware
CO_OPER_BOOL, 136 upgrade, 197
CO_OPER_ENUM, 138 firmware upgrade, 197
CO_OPER_FLOAT, 138 forwarding
CO_OPER_INT32, 137 IP, 45
CO_OPER_INT8, 137 frame type
GOOSE_CB, 135 Ethernet II, 42
POLLING_CTRL, 136 FTP
REPORT_CB, 130, 134 enabling, 59
detected error codes function code 3, 179
Modbus TCP, 210
Modbus TCP explicit messaging, 210
diagnostic codes, 191 G
diagnostics, 175 General window, 38
Modbus codes, 179, 189, 190 GOOSE
syslog service, 70 BMENOP0300, 19
dual network redundancy, 196 publication port, 39
duplex GOOSE control blocks
full, 69 publishing, 97
half, 69 subscribing, 102
GOOSE_CB, 135

E
elementary function H
T850, 157 Hot Standby
T850_TO_T870, 157 switchover, 194
elementary function block
NOP850_EVTS, 153
embedded router I
IP forwarding, 45 I/O mapping, 112
Ethernet IEC 61850
supported frame type, 42 BITSTRING, 21
Ethernet port roles, 42 edition, 33
explicit message, 164 standard data types, 21
read register, 172

230 QGH11908 12/2018

 Index

IEC 61850 client NTP diagnostic codes, 189

diagnostic codes, 192
enable/disable, 40
import IEDs, 105 O
IEC 61850 server OPER_ANA, 139
create, 76
delete, 76
enable/disable, 40 P
export, 76 PDU size, 38
IED POLLING_CTRL, 136
importing, 105 port mirroring, 44
installation, 25 port roles, 42
IP address protocols
assigning, 43 conformance, 199
default, 44
IP forwarding, 45
IP forwarding service, multiple modules, 50 Q
IP forwarding service, one module, 47 QoS diagnostic codes, 190
IPsec, 61
enabling, 59
R
redundancy
L dual network, 196
LEDs, 176 redundant
Ethernet ports, 178 switchover, 194
module, 176 replacing, 26
network, 176 report control blocks
logging configuring, 93
cyber security events, 70 REPORT_CB, 130, 134
logical nodes, 214 router
embedded, IP forwarding, 45
RSTP, 53
M
Modbuc TCP detected error codes, 210
Modbus diagnostic codes S
NTP, QoS, 189, 190 secure communications, 61
module description, 16 security, 59
mounting, 25 SNMP
enabling, 59
SNMP agent, 57
N SNTP, 54
network SOE data sets
dual, redundancy, 196 configuring, 100
network transparency, 47, 50 specifications
NOP850_EVTS, 153 BMENOP0300, 19

QGH11908 12/2018 231

Index

standards, 24
state management, 119
static route
IP forwarding, 50
sub-function code 21, 179
syslog server, 70

T
T870_TO_T850, 157
TCP explicit messaging
error codes, 204
toolbar, 35
transparency, 47, 50

U
upgrade
firmware, 197

V
variables
located, 118

W
workbench, 35

232 QGH11908 12/2018