Smart IEC 61850 interoperability: canonical convergence, type-safe RCB mutation, unified acquisition #144

Problem

A physical SIPROTEC 7SX85 interoperability case exposed a concrete engine defect and a broader architectural gap.

Observed field evidence on ARSAS 1.6.40 / ARIEC61850 1.6.40:

• discovery succeeded: 33 LD, 2 static DataSets, 12 static members, 12 RCBs (6 BRCB + 6 URCB);
• static URCB activation succeeded;
• static BRCB activation failed with MMS type-inconsistent (7) on ResvTms=60;
• six BRCB-backed signals therefore remained unavailable in Static DataSet report-only mode;
• the current client-compatibility path encodes ResvTms using MmsDataValue.Unsigned(...), while the IEC 61850 BRCB semantic type is signed integer / INT16;
• individual signal selection can still fall through the stricter hybrid availability path to MMS polling even when the signal is already covered by a configured static DataSet/RCB.

This must not be solved as a one-off Siemens/vendor patch.

Architectural invariant

IP Discovery and Open SCL are two bootstrap/evidence sources for the same IED, not two runtime systems.

Both paths must converge into the same canonical model, connection/session lifecycle, acquisition planner, reporting executor, control runtime and diagnostics.

IP Discovery ─┐
              ├─> Canonical IED Model -> Common Connection System
Open SCL ─────┘                           -> Common Acquisition Planner
                                          -> Common Reporting Executor
                                          -> Common Control Runtime

The bootstrap cost may differ: Open SCL should use bounded live reconciliation instead of needlessly repeating full discovery, but downstream behavior must be the same.

Non-negotiable design rules

1. No protocol decision from UI strings.
2. No vendor-name branching for normal interoperability.
3. No raw MMS scalar type embedded in reporting business logic.
4. No mutation without typed preconditions.
5. No write success without readback/proof where applicable.
6. Missing evidence must not be treated as negative evidence.
7. No retry without a classified reason and bounded evidence-driven strategy.
8. ARSAS must not duplicate IEC 61850 protocol semantics owned by ARIEC61850.
9. No positional report projection without authoritative ordered DataSet membership.
10. Physically qualified behavior must not be replaced by an unqualified "cleaner" implementation.

Target architecture

Introduce an evidence-driven interoperability layer that composes:

• IEC semantic contracts;
• SCL declaration evidence;
• canonical/live MMS model evidence;
• live MMS TypeSpecification;
• DataSet directory/order evidence;
• RCB ownership/reservation evidence;
• association capabilities;
• previous proven stable capability evidence;
• current transaction/readback/report-traffic evidence.

Planning and mutation execution must be separate:

• Planner: pure/deterministic, no mutation;
• Executor: just-in-time revalidation, minimum mutation, bounded compatibility ladder;
• Verifier: readback + actual InformationReport proof;
• Cleanup: ownership-safe transactional rollback.

Implementation phases

P-1 — Canonical convergence contract

• one canonical IED model for Discovery and Open SCL;
• one connection/session lifecycle;
• one acquisition planner;
• one reporting executor;
• one control runtime;
• source provenance retained as evidence, not as a forked runtime behavior switch;
• architecture regression proving equivalent model/acquisition plans from Discovery vs Open SCL for the same IED.

P0 — Immediate RCB type correctness

• centralize well-known RCB field semantics;
• encode ResvTms as MMS signed integer, never unsigned;
• audit every direct RCB scalar write/release;
• add exact BER/type regression tests;
• remove duplicated hard-coded MmsDataValue.* choices from activation paths.

P1 — Type-aware mutation

• exact/bounded GetVariableAccessAttributes preflight for the mutation surface;
• reconcile IEC semantic type with live MMS TypeSpecification;
• type-safe semantic write builder;
• if a write returns type-inconsistent, revalidate exact live type and retry only when one safe semantic conversion is proven;
• no blind "try several types" behavior.

P2 — Evidence/confidence model

Track granular evidence independently, e.g.:

• RCB identity;
• DataSet binding;
• ordered membership;
• RptEna state;
• owner/reservation state;
• field type;
• write permission;
• report traffic.

Differentiate:

• missing evidence;
• reduced confidence;
• positive blocker evidence;
• proven success.

P3 — Transactional RCB lifecycle

• snapshot;
• JIT preconditions;
• receiver-before-write;
• minimum writes;
• readback;
• one-shot GI when appropriate;
• actual InformationReport proof;
• rollback only fields/reservations owned or changed by this client;
• explicit cleanup state: Clean / Partial / Residue / Unknown.

P4 — Unified acquisition planner

For every selected signal, regardless of UI entry path:

1. configured static DataSet/RCB coverage;
2. bounded dynamic reporting only for residual points when policy allows;
3. MMS polling only for true residual coverage.

When one selected point belongs to a static DataSet, subscribe to the full ordered DataSet on the wire and project only the selected subset into the UI/runtime.

P5 — SCL/live convergence

Classify divergence explicitly:

• ExactMatch;
• RuntimeReduced;
• RuntimeExpanded;
• OrderMismatch;
• BindingMismatch;
• MissingConfiguredMember;
• ExtraRuntimeMember;
• RCBFamilyMismatch.

Authority is contextual:

• offline engineering: SCL;
• online report index/order: live DataSet directory;
• user-friendly semantic identity: canonical/SCL + live evidence;
• ownership/reservation: live runtime state.

P6 — Stable capability fingerprint

Cache stable evidence such as type signatures/service support/model fingerprints, but never treat volatile state as durable:

• volatile: RptEna, Owner, Resv, ResvTms, EntryID, SqNum;
• these must be refreshed before mutation.

P7 — Qualification

Regression dimensions, not vendor branches:

• BRCB ResvTms integer;
• direct RptEna path;
• explicit reservation fallback;
• Owner unsupported vs foreign Owner;
• SCL/live DataSet count/order mismatch;
• GI unsupported/accepted/no-traffic cases;
• RptEna accepted but readback false;
• segmented/duplicate BRCB traffic;
• association loss mid-transaction;
• individual signal inside a static DataSet;
• signals spanning multiple static DataSets;
• true residual polling.

Qualification stages:
CodeVerified -> WireVerified -> PhysicalVerified.

First implementation slice

Start with P0/P1 foundation without changing production policy:

1. add a central typed RCB field contract/encoder;
2. migrate ResvTms, RptEna, Resv, GI mutation sites to that encoder;
3. prove ResvTms=60 emits MMS INTEGER and cleanup ResvTms=0 emits MMS INTEGER;
4. add tests that reject semantic/type mismatches;
5. keep the field-proven activation order and receiver-before-write behavior unchanged.

Acceptance criteria for the first slice

• no MmsDataValue.Unsigned(...) write remains for ResvTms;
• centralized semantic encoder is the only normal path for the migrated RCB scalar fields;
• existing URCB behavior is unchanged;
• BRCB direct-RptEna primary path remains unchanged;
• BRCB explicit reservation remains bounded compatibility fallback unless a higher-level proven plan requires it;
• tests cover wire kind and range constraints;
• no vendor-specific conditional logic is introduced;
• no ARSAS-side IEC semantic duplication is introduced.

Field regression target

For the reported 7SX85 class of behavior:

• static BRCB reservation must use correct signed integer semantics;
• BRCB activation must no longer fail solely because ARIEC61850 emitted ResvTms as unsigned;
• final success still requires RptEna/readback and InformationReport proof rather than assuming a successful write equals a working subscription.