A SCADA interface is safe only when every remote command, status and measurement preserves its electrical meaning, control authority, quality and time from the field device to the operator screen. A breaker “open” bit with bad communications is not an open breaker; a command accepted by a gateway is not a breaker operated; a 100% analogue value is meaningless without scale, unit and source quality.
This guide develops physical and logical SCADA interface schematics for MV switchgear using protection IEDs, RTUs/gateways, IEC 61850 station communication and IEC 60870-5-104 northbound telecontrol. It covers commands, double-point status, measurements, quality, SOE, fail states, cybersecurity and end-to-end testing.
Executive rules
- Document both the physical path and the semantic/protocol mapping for every point.
- Remote commands must pass explicit authority, select/execute or direct-control model, interlocks, freshness, output and final-position checks.
- Use independent open and closed proofs for switchgear position where consequence warrants; preserve intermediate/invalid states.
- Propagate valid/invalid, old, test, substituted and questionable quality; never convert unknown into a healthy binary state or zero measurement.
- Define engineering units, primary/secondary basis, scaling, sign, deadband and timestamp source for every analogue.
- Separate command acceptance, output issued, breaker movement and successful completion/timeout.
- Buffer SOE through communication outages with controlled replay and reliable time synchronisation.
- Test loss, duplication, delay, stale data, reboot, bad quality, unauthorised command and restoration end-to-end.
1. Standards architecture
| Reference | Use |
|---|---|
| IEC 61850-7-2:2010+AMD1:2020 | Abstract communication service interface, client/server and publisher/subscriber services |
| IEC 61850-7-3:2010+AMD1:2020 | Common data classes for status, measured and controllable information |
| IEC 61850-7-4:2010+AMD1:2020 | Compatible logical nodes and data objects |
| IEC 61850-6:2009+A1:2018+A2:2024 | SCL configuration exchange among IED/system engineering tools |
| IEC 60870-5-104:2006+AMD1:2016 (including 2023 corrigendum) | Network telecontrol companion standard enabling interoperable monitoring/control |
| IEC TS 60870-5-7:2025 / IEC 62351 series | Security extensions/authentication and role-based access context for IEC 60870-5-101/104 |
| IEC 61082-1:2014 / IEC 81346-1:2022 | Interface drawings and traceable object identification |
Protocol compliance does not define the project’s safe command philosophy or point semantics. Freeze exact editions/profiles, interoperability subset and cybersecurity requirements in the specification.
2. Draw two complementary schematics
| Physical schematic | Logical/data schematic |
|---|---|
| Field contact/coil, IED I/O terminal, DC source/common, cable/terminal | Signal ID, data object/address/type, quality/time and control model |
| IED/gateway/RTU/network switch/fibre/copper path | Publisher/server, gateway mapping, client/control centre and ownership |
| Redundant network/power and panel boundary | Redundancy/failover, report/event buffer and stale-data behaviour |
| Test switch/injection/isolation | Test/simulation/substitution state and SCADA presentation |
Link both with stable signal/object IDs. An IEC 61850 data reference or IEC-104 information-object address alone cannot replace the field circuit and fail-state drawing.
3. Master SCADA point list
- unique point/signal ID and equipment reference;
- operator text, description and point class;
- source IED/terminal or logical-node/data object;
- gateway mapping and SCADA address;
- binary single/double point, counter, analogue or command type;
- normal/active state and inversion;
- engineering unit, primary/secondary basis, scale, range, sign and precision;
- deadband/report trigger and update/integrity interval;
- quality/time handling and timestamp source/resolution;
- alarm priority, latching/ack/reset and SOE requirement;
- command control model, pulse, authority, interlocks and feedback/timeout;
- communications-loss/restart/test/substitution behaviour;
- cyber role/permission and audit requirement;
- drawing, settings/SCL, ICD and test-case references.
4. Command architecture
A safe breaker command path is conceptually: operator authentication/authority → control location/mode → select (if used) → current topology/quality/interlock validation → execute freshness check → IED logic/output → breaker coil/mechanism → 52a/52b/current feedback → success or timeout/failed alarm.
- Define direct operate versus select-before-operate (SBO), enhanced security/termination and select timeout.
- Bind selection to user/client, object and value; reject another client’s or stale selection.
- Use double commands or explicit open/close values according to protocol/profile; never infer from toggle.
- Re-evaluate interlocks/authority at execute, not only select.
- Prevent duplicate/replayed messages from producing repeated close operations; breaker anti-pumping remains a physical/logic safeguard.
- Trip/protection outputs must not depend on a remote SCADA session.
- Log select, execute, rejection reason, output issue and final result with user/origin/time where supported.
5. Local/remote and control authority
| State | Typical command rule |
|---|---|
| Local | Remote close/open blocked except protection/emergency functions defined independently |
| Station | Station HMI authorised; control-centre command may be blocked |
| Remote | Control-centre command permitted under interlocks |
| Maintenance/Test | Operational commands blocked or routed to test simulation under permit |
| Authority invalid/lost | New close normally rejected; no stale retained selection |
The physical selector’s contact states, IED logic and SCADA indication must agree. Define invalid/contradictory selector state and power-up default. A software flag must not override a mechanically selected local mode without an authorised design.
6. Interlocks, synchronism and command rejection
- breaker/truck/earth-switch/door/mechanism-ready state;
- lockout/protection trip/anti-pumping and close-circuit health;
- bus/source topology and no-prohibited-parallel condition;
- synchronism/dead-bus permission with valid VT quality;
- ATS/controller in-progress or command ownership;
- DC/network/IED health required for dependable completion;
- role/command authority and equipment not out of service.
Return a specific rejection cause—local mode, interlock, invalid status, selected by another client, timeout—not one generic “command failed.” Do not expose enough internal detail to unauthorised users; apply cybersecurity policy while keeping operators actionable.
7. Command timing and feedback
- command pulse/maintained duration and whether IED or breaker circuit shapes it;
- maximum gateway/network/control-model delay;
- output/interposing/coil delay and breaker opening/closing tolerance;
- 52a/52b bounce/transition allowance;
- completion timeout and late-operation handling;
- command termination positive/negative response to SCADA;
- SOE timestamps for command received, output and position change;
- behaviour if communication fails after execute but before confirmation.
A timed-out command may still complete late. The operator display and logic must reconcile actual position rather than automatically issuing the opposite/repeat command.
8. Breaker and switch statuses
Where both open and closed auxiliary contacts are available, derive a double-point state:
| Open proof | Closed proof | State |
|---|---|---|
| 1 | 0 | Open |
| 0 | 1 | Closed |
| 0 | 0 | Intermediate/invalid after normal travel allowance |
| 1 | 1 | Contradictory/invalid |
- Define contact convention and inversion from physical 52a/52b.
- Preserve intermediate state during travel; alarm only after mechanism-specific delay.
- Do not map invalid state to open for SCADA command permissive.
- Include truck service/test/intermediate and earth-switch position separately.
- Use current/voltage plausibility where required for stuck auxiliary contact detection.
- Timestamp changes at the closest reliable IED; gateway receipt is secondary evidence.
9. Alarm and protection indications
- Export actionable protection trip/lockout and essential first-out cause, not every internal bit by default.
- Separate pickup, trip, breaker failure and relay self-supervision semantics.
- Define latched target reset authority; remote alarm acknowledgement must not reset protection unless explicitly designed.
- Aggregate consequential alarms carefully while preserving detailed SOE/engineering access.
- Map priority consistently from local/HMI to SCADA.
- Carry test/simulation quality so commissioning operations cannot appear as real events.
- Use clear equipment+condition text with no vendor abbreviations that operators cannot act upon.
10. Measurement engineering
| Field | Design decision |
|---|---|
| Source | IED measured value, transducer or meter; CT/VT core/ratio and calculation method |
| Basis | Primary versus secondary, phase/line quantity, RMS window, demand/integrated value |
| Unit/scale | A, kA, V, kV, W, var, VA, Hz, PF, energy; protocol normalised/scaled/float representation |
| Sign | Import/export and inductive/capacitive convention tied to one-line direction |
| Range/precision | Expected/overrange, resolution and display decimals consistent with accuracy |
| Update | Deadband, periodic integrity, event trigger and maximum stale age |
| Quality/time | Invalid/questionable/old/test/substituted plus source timestamp/uncertainty |
Validate scaling at zero, normal operating point, negative direction and full/overrange. A bad measurement should display unavailable/invalid—not zero—because zero voltage/current can drive operational decisions.
11. Counters and energy
- Define source register, multiplier, unit, direction and rollover width.
- Distinguish breaker operation counter from protection trip count and command count.
- Preserve counter across IED/gateway restart according to source authority.
- Detect reset/rollover and prevent negative consumption spikes in historian.
- Time-align demand/interval energy and document daylight-saving/time-zone treatment.
- For revenue metering, use the approved metering interface/security/accuracy path rather than a general protection IED value.
12. Quality mapping across protocols
IEC 61850 and IEC 60870-5-104 have different data/service representations. Build an explicit gateway mapping for value, validity, old data, test/substitution/blocked status, timestamp, cause of transmission and command response. Where the destination cannot represent a source attribute, define a conservative conversion and separate diagnostic alarm—never silently discard safety-relevant quality.
- communications loss: retain value only with bad/stale quality and age;
- IED restart: invalidate until fresh integrity/data arrives;
- gateway failover: avoid duplicate commands/events and conflicting sequence state;
- test mode: mark/suppress operational alarms by governed rules;
- substituted value: visible with user/reason where supported;
- time invalid: preserve value but flag timestamp uncertainty for SOE use.
13. Event buffering and recovery
- Size IED/gateway buffers for credible outage/fault burst and event rate.
- Define oldest/newest overwrite and overflow alarm.
- Use source time where reliable; preserve event order and quality through gateway.
- On reconnect, replay historical events distinctly from current-state integrity.
- Prevent duplicate presentation after redundant path or gateway failover.
- Reconcile final state after replay; an old “breaker closed” event must not override a newer open state.
- Test loss during mass trip and recovery with buffer near capacity.
14. Cybersecurity controls
- role-based permissions for view, select/operate, reset, substitution, settings and administration;
- strong authentication and secure management channels according to the project/IEC 62351 profile;
- network segmentation, allow-listed services/peers and controlled remote access;
- command origin/user and configuration-change audit;
- secure time, certificate/key lifecycle and fail-safe expiry handling where used;
- disable unused protocol services/ports and default accounts;
- backup/restore and signed/approved configuration baselines;
- cyber failure must not disable independent local protection/tripping.
15. FAT/SAT end-to-end tests
- Static compare field schematic, I/O matrix, SCL, gateway database and SCADA point list.
- Operate every status from field contact through all intermediate systems; prove all double-point combinations.
- Inject each analogue at zero, mid, full, negative and bad/overrange; verify scale/unit/sign/deadband/time.
- Issue each command through authorised SBO/direct path and confirm output/position/termination.
- Test local/remote, interlock, synch-check, invalid quality, selection timeout and concurrent-client rejection.
- Force breaker fail-to-move, late operation, communication loss after execute and duplicate/replay attempt.
- Remove IED/gateway/network/time/DC sources; verify stale/bad quality, alarms and safe recovery.
- Test SOE burst/buffer/replay, redundant path/gateway failover and event order.
- Verify cybersecurity roles: unauthorised operations rejected/audited without exposing protection.
- Reconcile alarm priority/text/ack/reset and archive signed as-built mappings/evidence.
16. Frequent mistakes
| Mistake | Consequence | Correction |
|---|---|---|
| One status bit only | Broken wire may look open/closed | Double-point/plausibility where required |
| Bad analogue mapped to zero | False dead-bus/no-load decision | Preserve invalid quality |
| Gateway acceptance equals success | Operator assumes breaker moved | Final position/timeout termination |
| SBO interlock checked only at select | Topology changes before execute | Revalidate at execute |
| Engineering scale undocumented | Factor/sign/unit errors | Controlled point dictionary |
| SCADA acknowledge resets relay | Protection evidence/lockout cleared | Separate alarm acknowledge and authorised reset |
| Happy-path protocol test | Stale/reboot/failover defects latent | Failure/recovery end-to-end testing |
17. Design-release checklist
- Physical and logical schematics linked by stable IDs?
- All command control/authority/interlock/timeout rules approved?
- Open/closed/intermediate/invalid states preserved?
- Protection alarm/target/reset semantics safe?
- Measurement source/basis/unit/scale/sign/deadband complete?
- Quality/time attributes mapped conservatively across protocols?
- Buffer, replay, failover and restart behaviour deterministic?
- Local protection independent of SCADA/cyber availability?
- IEC 61850 SCL and IEC-104 database baselined?
- Cyber roles/audit/secure profile implemented?
- FAT/SAT covers failure, stale, duplicate and restoration cases?
- As-built point list, drawings and configuration accepted by operators?
References and further reading
- IEC 61850-7-2:2010+AMD1:2020 — ACSI services
- IEC 61850-7-3:2010+AMD1:2020 — Common data classes
- IEC 61850-7-4:2010+AMD1:2020 — Logical nodes/data objects
- IEC 61850-6:2009+A1:2018+A2:2024 — SCL configuration language
- IEC 60870-5-104:2006+AMD1:2016 — Network telecontrol
- IEC TS 60870-5-7:2025 — Security extensions
- IEC 61082-1:2014 — Electrotechnical document rules
Engineering note: Select the exact protocol profiles, control models, cybersecurity controls and quality mappings with the utility/site operator and tested device capabilities.