Connect to an IED

Safety: use a test relay or a test server on a test network only, never a relay in service.

State: verified against open-source IEC 61850 servers (libiec61850 1.6.2 example servers) on Linux, with tshark 4.4.9 as a second decoder agreeing with what the client decoded. Not run against any relay or vendor server (Siemens, Hitachi Energy, SEL, GE), and not on Windows.

The MMS client is the module's own, written from public descriptions of the protocol stack; it runs in the Editor's shared process, not in the window. Browsing and reading send only reads. The only writes it offers are report control block attributes, each after a confirmation (see Report control blocks).

Connect

1. Run Connect to IED Online.... The Editor lists the IEDs of the workspace's SCL files that have an IP address in their ConnectedAP, and takes their OSI addressing (OSI-TSEL, OSI-SSEL, OSI-PSEL, OSI-AP-Title, OSI-AE-Qualifier) from the file.
2. Choose MMS over TLS (IEC 62351-3), usually TCP port 3782 or Plain MMS. For TLS, build the connection profile as MMS over TLS and credentials describes.
3. Confirm or type the address, for example 127.0.0.1:10102 for a test server.
4. An IED Online tab opens (<IED> Online), and a status bar entry shows the IEDs online.

When the IED refuses an association for want of a password, you are asked for the ACSE password; it is not stored unless you choose to keep it in the profile.

The next Connect to IED Online... on the same IED offers Connect to <IED> at <address> with the profile, and connects without asking anything. Edit Connection Profile... and Forget Connection Profile are offered beside it; forgetting removes the address, the client certificate and the password kept for the IED, and the station's CA bundle stays.

Show IED Connections lists the open connections to open or disconnect one. Disconnect in the tab, or turning the Energy environment off, ends the association.

Browse and read

The IED Online tab shows:

• The association: the IED's identity, the PDU size and outstanding requests, and how the connection is secured. For example: "Connected (MZ basic io, revision 1.6.0). MMS PDUs up to 65000 bytes, ...".
• The live model read from the IED: logical devices, logical nodes with their FCs and data objects, data sets and report control blocks. Long name lists are read page by page.
• Values: click a data object to read its values with their types, quality and time.

Compare with SCL

Press Compare with SCL. The live model is compared with the IED in its SCL file: logical devices and nodes, and data objects and attributes per FC, that are missing, extra or of another type. When everything matches: "The live model matches <file> for every logical node compared."

Access refused

When the IED refuses an access under role-based access control (IEC 62351-8), the read says so in plain words: the permission needed (listing the model, reading values, changing a value), the identity the IED decided from (the client certificate's subject, the ACSE password, or none), and to ask the IED's security administrator. Nothing retries another way.

Lost connections

With no traffic for 10 s the client checks the IED; no answer within 10 s means the connection is lost and is closed. The tab says "Connection lost: <reason>" with Reconnect, and the status bar entry turns to a warning. See Report control blocks for what Reconnect does with enabled reports.

The log

The Energy output channel records the association, each browse (requests and time), confirmed writes and the disconnection.

What was verified

• Against server_example_basic_io and server_example_password_auth: association, identify, the model browsed and found to match the server's CID in every logical device, logical node, data set and attribute type, values read, conclude and release; ACSE password refused when missing or wrong and accepted when right.
• Against a server built from a sample CID: name lists of 14,427 names read in 6 pages, and an ldName domain matching the CID.
• server_example_access_control denying a read, shown in plain words.

Not verified

• Any relay or vendor server, and Windows.
• An IED with several access points was tested against a test peer only.