telecontrol protocol standards pdf

��

RTU Training

� � ��

��

RTU Training: IEC 60870

� � ��

IEC 60870IEC 60870EN 60870EN 60870

��

ISO 7498-1 Information technology - open systems interconnection - basic reference model

77

66

55

44

33

22

11

Application Layer(Anwendungsschicht)Application Layer(Anwendungsschicht)

Format Layer(Darstellungsschicht)Format Layer(Darstellungsschicht)

Communication ControlLayerCommunication ControlLayer

Transport Layer(Transportschicht)Transport Layer(Transportschicht)

Routing Layer(Vermittlungsschicht)Routing Layer(Vermittlungsschicht)

Link Layer(Sicherungsschicht)Link Layer(Sicherungsschicht)

Physical Layer(bitübertragunsschicht)Physical Layer(bitübertragunsschicht)

Identification of communication partnerPermissionSelection of dialogue procedure type

Identification of communication partnerPermissionSelection of dialogue procedure type

Selection of syntaxTransformation of data in formatsSelection of syntaxTransformation of data in formats

Establishing of partner connectionsControl of dialogsSynchronising of connections

Establishing of partner connectionsControl of dialogsSynchronising of connections

RoutingMultiplexing of network connectionsFlußkontrolle

RoutingMultiplexing of network connectionsFlußkontrolle

FramingSequence controlFramingSequence control

bit transportCodingSynchronising

bit transportCodingSynchronising

Establishing of transport connectionsMultiplexingFault recognition and repair

Establishing of transport connectionsMultiplexingFault recognition and repair

��

ISO/OSI-7-layer reference model

virtual protocols

real transport

77

66

55

44

33

22

11

77

66

55

44

33

22

11

Physical transport mediumPhysical transport medium

Application LayerApplication Layer

Format LayerFormat Layer


Transport LayerTransport Layer

Routing LayerRouting Layer

Link LayerLink Layer

Physical LayerPhysical Layer

Application LayerApplication Layer

Format LayerFormat Layer


Transport LayerTransport Layer

Routing LayerRouting Layer


Physical LayerPhysical Layer

��

ISO/OSI-7-layer reference model, IEC60870-5-.., TCP/IP, Ethernet

virtual protocolsreal transport

*)Jabber-function interuptssending after 30 ms at Ethernet

77 application layer, IEC60870-5-101,5-104,..., E-Mailsapplication layer, IEC60870-5-101,5-104,..., E-Mails

66Format layer , z.B.FTP, SMTP, TELNET, DNSFormat layer , z.B.FTP, SMTP, TELNET, DNS

55 communication layerFTP, SMTP, TELNET, DNScommunication layerFTP, SMTP, TELNET, DNS

44transport layer , z.BTransm.Control Prot. TCPtransport layer , z.BTransm.Control Prot. TCP

33network layer , z.BInternet Protocol (IP, RFC)network layer , z.BInternet Protocol (IP, RFC)

22data link layer , z.BEthernet IEEE802.3, FDDIdata link layer , z.BEthernet IEEE802.3, FDDI

11 physical layerphysical layer

77 application layerapplication layer

66 Format layerFormat layer

55 communication layercommunication layer

44transport layerClient calls - server respondschecksums, ackn., time supervision

transport layerClient calls - server respondschecksums, ackn., time supervision

33network layeradressing of nodes, fragmentation of pakages

network layeradressing of nodes, fragmentation of pakages

22data link layerSend+receive of bit streams,collision detection, Jabber-Fkt.*)

data link layerSend+receive of bit streams,collision detection, Jabber-Fkt.*)

11 physical layerphysical layer

Physical transport mediumtwisted pair, coaxcabel, fiber optic, radio

Physical transport mediumtwisted pair, coaxcabel, fiber optic, radio

��

EPA - enhanced performance architecturee.g. used in IEC 870-5-103

77 Application LayerApplication Layer

66 ------

55 ------

44 ------

33 ------

22

11 Physical LayerPhysical Layer


66 ------

55 ------

44 ------

33 ------

22 Link LayerLink Layer


Physical transmission mediumPhysical transmission medium


��

Layered Architecture DNP 3.0


66

33 Pseudo transport layerPseudo transport layer

22 Data Link LayerData Link Layer


Selected elements according to IEC 870-5-4 Selected services according to IEC 870-5-3

draft

Selected elements according to IEC 870-5-4 Selected services according to IEC 870-5-3

draft

--

segments messages into fragments(Start code, seq.nr., end code)segments messages into fragments(Start code, seq.nr., end code)

segments fragments into framesup to 256 bytes

segments fragments into framesup to 256 bytes

RS232, RS485, ....wire, fiber, radio, ....RS232, RS485, ....wire, fiber, radio, ....

...

��

DNP 3.0 in RTU560

This documentation is based on the following documents:

DNP Users Group

DNP Product Documentation

DNP V3.00 Data Object Library P009-0BL Version 0.02 July 28th, 1997

DNP V3.00 Data Link Layer P009-0PD.DL Version 0.02 May 30th, 1997

DNP V3.00 Application Layer P009-0PD.APP Version 0.03 May 28th, 1997

DNP V3.00 Transport Functions P009-0PD.TF Version 0.01 May 30th, 1997

��

IEC 60870-1-1

IEC 60870-1-2IEC 60870-1-3IEC 60870-1-4

IEC 60870-1-1

IEC 60870-1-2IEC 60870-1-3IEC 60870-1-4

Telecontrol equipment and systems, general considerations, general principles(multipoint partyline, point-to point-, ...) 1988Telecontrol equipment and systems, genr.consid., guide for specificationsTelecontrol equipment and systems, genr.consid., glossery, IEC50 chap.371 1997Telecontrol equipment and systems, genr.consid., basic aspects 1994

Telecontrol equipment and systems, general considerations, general principles(multipoint partyline, point-to point-, ...) 1988Telecontrol equipment and systems, genr.consid., guide for specificationsTelecontrol equipment and systems, genr.consid., glossery, IEC50 chap.371 1997Telecontrol equipment and systems, genr.consid., basic aspects 1994

IEC 60870-2-1IEC 60870-2-2IEC 60870-2-1IEC 60870-2-2

Telecontrol equipment and systems, operation conditions 1987Telecontrol equipment and systems, operation conditions, replaces patially -1 1996Telecontrol equipment and systems, operation conditions 1987Telecontrol equipment and systems, operation conditions, replaces patially -1 1996

IEC 60870-4IEC 60870-4

IEC 60870-3IEC 60870-3

IEC60870 Publications “Telecontrol and Systems”:

IEC 60870-5-xxxIEC 60870-5-xxx Telecontrol equipment and systems, Transmission protocols 1993...2000

IEC 60870-6IEC 60870-6 Telecontrol equipm. and syst., Telecontrol protocols compatible with ISO and CCITT

IEC standardIEC standard titletitle

��

IEC 60870-1-1 point-to point configuration

Fernwirkunterstation,remote terminal unit (RTU)

Leitzentrale /control centre

link terminals / Linienkoppler

End-End-Konfiguration / point-to-point configuration

��

IEC 60870-1-1 multiple point-to-point configurat.

Fernwirkunterstationen,remote terminal units (RTU)


link terminals / Linienkoppler

Mehrfach-End-End-Konfiguration / multiple point-to-point configuration

��

IEC 60870-1-1 multipoint star configuration



link terminal / Linienkoppler

Stern-Konfiguration / multipoint star configuration

��

IEC 60870-1-1 multipoint party line configuration



Linien-Konfiguration / multipoint party line configuration

��

IEC 60870-1-1 multipoint ring configuration

Ring-Konfiguration / multipoint ring configuration

Remote Terminal Units (RTUs)

control centreOption for switch-over unit:

Westermo type MD62www.westermo.se

dredgeraccident

��

7appl.

7appl.

2link2

linkIEC 60870-5-1IEC 60870-5-1 Transmission Frame Formats (FT1.2 - 11 bit including start and stop bit) 1990 Transmission Frame Formats (FT1.2 - 11 bit including start and stop bit) 1990

IEC 60870-5-101 IEC 60870-5-102IEC 60870-5-103IEC 60870-5-104

IEC 60870-5-101 IEC 60870-5-102IEC 60870-5-103IEC 60870-5-104

Companion standard for basic telecontrol tasks 1995Companion standard for tansmission of integrated totals in electric power systemsCompanion standard for informative interface of protection euipment 1997Network access for IEC60870-5-101 using standard transport profiles Draft 1999

Companion standard for basic telecontrol tasks 1995Companion standard for tansmission of integrated totals in electric power systemsCompanion standard for informative interface of protection euipment 1997Network access for IEC60870-5-101 using standard transport profiles Draft 1999

IEC 60870-5-5IEC 60870-5-5 Basic Application Functions (station initialization, general interrogation...) 1995Basic Application Functions (station initialization, general interrogation...) 1995

IEC 60870-5-3IEC 60870-5-3 General Structure of Application Data (application service data units - ASDUs...)92General Structure of Application Data (application service data units - ASDUs...)92

IEC 60870-5-4IEC 60870-5-4 Definition and Coding of Application Information Elements (type identifications:100 - interrogation, 103 - clock synch command..., time tag coding...) 1993Definition and Coding of Application Information Elements (type identifications:100 - interrogation, 103 - clock synch command..., time tag coding...) 1993

Link Transmission Procedures (request-respond, send-confirm, send-no reply,.)92Link Transmission Procedures (request-respond, send-confirm, send-no reply,.)92IEC 60870-5-2IEC 60870-5-2

IEC60870-5 Sub-publications “Transmission Prot.” OSI-layerOSI-layer

��

Hamming Distance 4

1 0 0 1 0 1 1 0

PC0

1 1 0 0 0 0 1 1

PC0

1 0 1 0 1 0 1 0

PC

1 1 1 0 1 1 0 0

PC1

0 1 1 0 0 1 0 0

PC1

0 1 1 1 0 1 1 1

PC0

7 6 5 4 3 2 1 0Bit:

Even parity (Format class 1.2)

Checksum

The change of any 3 bits is surelyrecognized.The change of 4 bits may not berecognized in seldom cases.

Hamming distance 4 Format class 1.2is common in telecontrol systems.

By the select-before-operate proceduresafety is increased in control direction.

user octet 0

user octet 255

user octet 1

user octet 2

...

��

Hamming Distance 6

1 0 0 1 0 1 1 0

PC

1 1 0 0 0 0 1 1

PC

x x x x x x x x

PC

1 1 1 0 1 1 0 0

PC

0 1 1 0 0 1 0 0

PC

0 1 1 1 0 1 1 1

PC

7 6 5 4 3 2 1 0Bit:

Check Sequence

Hamming distance 6 Format class 3is used at DNP 3.0.

user octet 0

user octet 15

user octet 1

user octet 2

...

x x x x x x x x

Cyclic redundancy check (CRC) iscalculated according special algorithm

The change of any 5 bits is surelyrecognized.The change of 6 bits may not berecognized in seldom cases.

��

10-8

10-18

10-1 = worst allowed R



Integrityclass I1

(hamming distance 2)

Integrity class

I2 (h 4)

Int.c

lass I3

R = residual

error rate

p = bit error rate Residual error rate =

number of undetected wrong messagestotal number of messages sent

10-5 0.5no signalonly noise

0.5 = 1bit wrong / 2 bit sent

1 day = 10-6

26 years = 10-10

260 000 years = 10-14

Mean time betweenundetected errorsat 1200 bit/s, p=10-4, 100 bitframes

IEC 60870-5-1 , Data Integrity Classes, Grafic

10-4

1bit wrong / 10.000 bitssent

100

10-3

10-1

10-210-3 10-1

��

IEC 870-5-1 , FT 1.2, Frame with Fixed Length

User Data

Start character 16

Check sum

End character 22

��

IEC 60870-5-1 , FT 1.2 Frame with Variable Length

User data octets

Start character 104

Length (0...255)

Length (repeated)

Start character 104

Length

Header offixed length

Application for frames with user data in both control and monitor direction

Check sum

End character 22

Example:hex decimal

0x68 = 1040x1A = 260x1A = 260x68 = 104

. . .

0x80 = 1280x16 = 22

��

Example fixed length, variable length, single control character

Telegram examples:

fixed length

single control character0xE5 = 229

fixed length

variable lengthstart length length start link control ..address type structure cause of tra

start link control address checksum end

��

REQUEST

RESPOND

Pollingof data

Data

Station A to Station B Station B to Station A

IEC 60870-5-2 ; Unbalanced Transmission

CONFIRM

SENDSend data

Acknowledge

��

REQUESTClass 1

RESPOND GI

message 1

Pollingfor events

Data

RTU Protection equipment

Unbalanced Transmission, example start of general interrogation (GI)

CONFIRM

SENDASDU 7

ASDU 7 is sentto initiate general

interrogationAcknowledge

REQUESTClass 1

RESPOND GI

message 2

Pollingfor events

Data

��

SEND

CONFIRM

REQUEST

SEND

CONFIRM

RESPOND

Send data

Acknowledge

Send data

Acknowledge

Station A to Station B Station B to Station A

IEC 60870-5-2 ; Balanced Transmission (point-to-point connection and full duplex lines required)

��

Bit 8 = RESERVED in unbalanced - physical directionat balanced, 1= station A to B, 0=viceversa

PRM = Primary / secondary station (=1 messagefrom primary/initiating station)

FCB = Frame count toggle bit (Primary station to sec. )FCV = Frame count bit valid (=0 at reset)

ACD = Access demand in unbalanced (=1 demand forhigh priority class1 data) - RESERVED at balanced

DFC = Data flow control (=0 further messages areacceptable by secondary station,

=1 overflow expected)

MSB LSB

8 PRMFCB

ACD

FCV

DFC

2 2 2 2

Function

8 7 6 5 4 3 2 1

3 2 1 0

Bit

start( length )( length )

( start )Link control

Link address

Userdata

endchecksum

IEC 870-5-2 , Link Level, Control Byte

��

IEC 870-5-2 , Link Level, Control Byte, Unbalanced Transmission, Function Codes,Messages sent from Primary (PRM=1)

startat -101

��

IEC 870-5-2 , Link Level, Control Byte, Unbalanced Transmission, Function Codes,Messages sent from Secondary (PRM=0)

1. answer

��

Example: IEC 870-5-2 , Unbalanced Transmission at IEC 870-5-101, Establishing the communication

RTU

RTU

Control System:

Control System:

Control System:

��

IEC 870-5-2 , Link Level, Control Byte, Balanced Transmission, Function Codes,Messages sent from Primary (PRM=1)

commun. start

��

IEC 870-5-2 , Link Level, Control Byte, Balanced Transmission, Function Codes,Messages sent from Secondary (PRM=0)

1. answer

��

IEC 870-5-3 , Telegram Structure, EPA-Model

22Link Level(IEC870)

Link Level(IEC870)

APPLICATIONuser data

77 Application LevelApplication Level

ASDUApplication Service Data UnitAPCI

APDUApplication Protocol Data Unit

LSDULink Service Data UnitLPCI

LPDULink Protocol Data Unit

Control Information

ControlInformation

��

Telegram Testtool, Protocol Profile Parameter

��

Common structure of data units

ASDU

applicationservice

data unitinformation

objects

optionaldata unitidentifier

informationobject 1

time stampobject 1

informationobject n

��

Data unit identifier

data unitidentifier

data unit type

optional at -101not used at -103

cause of transmission

type identification

variable structure qualifier


common address of ASDU


��

Type Identification

� defines type� for each type there is a standardized structure and format

TYPE IDENTIFICATION :=UI8 [1..8] <1..255> UI means unsigned integer

<1..127> := for definitions of this standard (compatible range)<128..135> := reserved for routing messages (private range)<136..255> := for special use (private range)

N u m b e r2 27 0

BIT 8 7 6 5 4 3 2 1

��

Type identification at IEC 870-5-101 (companion standard for basic telecontrol tasks) - Process Information in Monitor Direction

TYPE IDENTIFICATION

UI8 [1..8] <0...44>

See IEC60870-5-101

table 3

Type Symbol meaning ABB

1 M_SP_NA_1 single-point information X2 M_SP_TA_1 single-point information with time tag X3 M_DP_NA_1 double-point inforamtion X4 M_DP_TA_1 double-point inforamtion with time tag X5 M_ST_NA_1 step position information X6 M_ST_TA_1 step position information with time tag7 M_BO_NA_1 bit string of 32 Bit (X)8 M_BO_TA_1 bit string of 32 Bit with time tag (X)9 M_ME_NA_1 measured value, normalized value X10 M_ME_TA_1 measured value, normalized value with

time tagX

11 M_ME_NB_1 measured value, scaled value12 M_ME_TB_1 measured value, scaled value with time tag13 M_ME_NC_1 measured value, short floating point

number14 M_ME_TC_1 measured value, short floating point

number with time tag15 M_IT_NA_1 Integrated totals X16 M_IT_TA_1 Integrated totals time tag X17 M_EP_TA_1 event of protection equipment with time tag X18 M_EP_TB_1 packed start events of protection equipment

with time tag19 M_EP_TC_1 packed output circuit information of

protection equipment with time tag20 ... ...21 ... ...

RTU232

��

Type identification at IEC 870-5-101 Process Information in Control Direction

Single command

Double command

regulating step command

set point command

....

bitstring of 32 bits

TYPE IDENTIFICATION

UI8 [1..8] <45...69>

See IEC60870-5-101

table 4

COMAND

SINGLE COMMAND

NO TIMEA-Type Prozessinformation Steuerungsrichtung:

Typkennung Symbol Bedeutung ABB

45 C_SC_NA_1 Einzelbefehl46 C_DC_NA_1 Doppelbefehl X47 C_RC_NA_1 Stufenstellbefehl X48 C_SE_NA_1 Sollwert-Stellbefehl, normierter Wert X49 C_SE_NB_1 Sollwert-Stellbefehl, skalierter Wert50 C_SE_NC_1 Sollwert-Stellbefehl, Gleitkommazahl51 C_BO_NA_1 Bitmuster von 32 Bit (X)

RTU232

��

Type identification at IEC 870-5-101 Sytem Information in Monitor Direction

TYPE IDENTIFICATION

UI8 [1..8] <70...99>

See IEC60870-5-101

table 5

Type Symbol meaning

70 M_EI_NA_1 End of initialization

71 Reserved for further compatible definitions..99 Reserved for further compatible definitions

��

Type identification at IEC 870-5-101 Sytem Information in Control Direction

TYPE IDENTIFICATION

UI8 [1..8] <100...109>

See IEC60870-5-101

table 6

interrogation command

counter interrogation command

clock synchronisation command

test command

reset process command

delay acquisition command

....

��

Type identification at IEC 870-5-101 Parameter in Control Direction

TYPE IDENTIFICATION

UI8 [1..8] <110...119>

See IEC60870-5-101

table 7

parameter of measured value,

normalized value

parameter of measured value, scaled

value

parameter of measured value, short

floating point number

parmeter activation

....

��

Type identification at IEC 870-5-101File Transfer

TYPE IDENTIFICATION

UI8 [1..8] <120...127>

See IEC60870-5-101

table 8

File ready

section ready

call directory, select file, call file, call section,

last section, last segment

ack file, ack section

segment

directory

...

��

Type identification at IEC 870-5-102 (companion standard for the transmission of integrated totals in electric power systems)

��

Type identification at IEC 870-5-103 (companion standard for the informative interface of protection equipment)

TYPE

IDENTI-

FICATION

UI8 [1..8]

<1...255>

See

IEC60870-

5-103

table 3 and

4

��

Data unit identifier, variable structure qualifier

data unitidentifier

data unit type

Optional

type identification






��

Variable structure qualifier

Defines the structure of information objects in ASDU

Variabel structure qualifier := CP8{number,SQ}

Number = N := UI7[1..7]<1...127><0> := ASDU contains no information object<1..127> := number of information objects

SQ=single/sequence := BS1[8] <0...1>e.g. SQ=1 The following type-equal information elements are identified by object address incrementedby +1 from the first address

CP (compound data field) is a sequence of data fields.BS means bit string

SQ N u m b e r2 26 0

BIT 8 7 6 5 4 3 2 1

��

FT1.2, Link Bytes, ASDU with variable structure qualifier, example at -103

Number of information objects:

9 measurements

link link typecontrol addr.measm. COT

Variablestructurequalifier

commonaddressASDUstart length length start

160 =

= 0x94

��

Data unit identifier, cause of transmission

data unitidentifier

data unit type

Optional

type identification






��

Data unit identifier, cause of transmission

Bit 8 7 6 5 4 3 2 1

25

20

causeT P/NCause ofTransmission

Orginator adress Optionalper system

Cause of transmission := CP16{cause, P/N, T, orginator addres (optional)}Cause := UI6[1..6]<0..63>

<0> := not defined<1..47> := number of cause, compatibel range<48..63> := number of cause, private range

P/N := BS1[7]<0..1> (BS means bit string)<0> := positiv confirm<1> := negativ confirm

T = Test := BS1[8]<0..1><0> := no test<1> := test

orginator address := UI8[9..16]<0..255><0> := default<1..255> := number of originator address if available

��

Causes of transmission ( 870-5-101)

<0> := not used<1> := periodic, cyclic<2> := background scan<3> := spontaneus<4> := initialized<5> := request or requested<6> := activation<7> := activation confirmation<8> := deactivation<9> := deactivation confirmation<10> := activation termination<11> := return information caused by a remote command<12> := return information caused by a local command<13> := file transfer<14> ... <19> := reserved for further compatible definitions<20> := interrogated by general interrogation<21> := interrogated by group 1 interrogation<36> := interrogated by group 16 interrogation 2 <37>:= requested by general counter request<38> := requested by group 1 counter request<39> := requested by group 2 counter request<40> := requested by group 3 counter request<41> := requested by group 4 counter request<42> ... <47> := reserved for further compatible definitions

��

Causes of transmission ( 870-5-103 always 1 byte only)

<0> := not used<1> := spontaneus<2> := cyclic<3> := reset frame count bit (FCB)<4> := reset communication unit (CU)<5> := start / restart<6> := power on<7> := test mode<8> := time synchronisation<9> := general interrogation<10> := termination of general interrogation<11> := local opeartion<12> := remote operation

...

��

Data unit identifier, common address of ASDU

data unitidentifier

data unit type

Optional

type identification






��

RTUtil, Link-address, ASDU-address, Informationsobject

��

RTU560, Example of Broadcast ASDU address 65535

��

Information object

ASDU

applicationservice

data unitinformation

objects

data unitidentifier

informationobject 1

informationobject n

��

Information object details at IEC870-5-101

Information object 1

Optional

Information objectaddress

informationelement or set of it


27 Milliseconds 20

215 Milliseconds 28

25 minutes 20ResIV

variabel je ASDUInformation object n

e.g. 3 octet binary time0...59 999 ms, 0...59 min

IEC60870-5-4 clause 6.8

Information objectaddress

Information objectaddress high octet

Address 0 = irrelevant

address range 1...255

address range 1...65535if 2 octets are used

address range 1...16 777 215if 3 octets are used

��

Information object at IEC870-5-103

Information object 1

Optional

Function type



27 Milliseconds 20

215 Milliseconds 28

25 minutes 20ResIV

Information object n

e.g. 3 octet binary time0...59 999 ms, 0...59 min

IEC60870-5-4 clause 6.8

Information number

128 distance protection160 overcurrent protection176 transformer diff protection192 line differential protection254 generic function type

��

IEC870-5-101, Sequence of information objects, SQ=0

Single-point information without time tagTYPE IDENT 1: M_SP_NA_1

Sequence of information objects including object adresses (SQ = 0)

8 7 6 5 4 3 2 1 Bit

0 0 0 0 0 0 0 1

0Number of objects

T P/N 25 cause 20

TYPE IDENTIFICATION

VARIABLE STRUCTURE QUALIFIER

CAUSE OF TRANSMISSION

COMMON ADDRESS OF ASDU

ADDRESS OF INFORMATION OBJECTS

IV NT SB BL 0 0 0 SPI Quality bits and signal position

ADDRESS OF INFORMATION OBJECTS

DATA UNIT IDENTIFIER

INFORMATION OBJEKT 1

INFORMATION OBJEKT iIV NT SB BL 0 0 0 SPI

Quality bits and signal position

Info

rmat

ion

obje

cts

��

IEC870-5-101, No sequence of information objects, SQ=1

Single-point information without time tag

TYPE IDENT 1: M_SP_NA_1

Sequence of information objects, incremented object adress assumed (SQ = 1)

8 7 6 5 4 3 2 1 Bit

0 0 0 0 0 0 0 1

1number j of elements

T P/N 25 Cause 20

ADRESSE INFORMATIONSOBJEKTS A

IV NT SB BL 0 0 0 SPI 1

IV NT SB BL 0 0 0 SPI j

Quality bits and signal position of information object A

Quality bits and signal position of information object A+1Info

. obj

ects

DATA UNIT IDENTIFIER

INFORMATION OBJEKT 1

INFORMATION OBJEKT i

TYPE IDENTIFICATION

VARIABLE STRUCTURE QUALIFIER

CAUSE OF TRANSMISSION

COMMON ADRESS OF ASDU

��

Quality descriptor (IEC870-5-101)

OV = Overflow / No overflowThe value of the information object is out of range.Mainly analogue measured values.

BL = Blocked / Not blockedThe transmission of this information object is blocked.The contents is the last value before blocking.

SB = Substituted / Not substitutedThe value of the information object was substituted bythe operator or a local automation function.

NT = Not topical / TopicalThe information object is topical, if the last update within a certain time period was successful. Mainly cyclic analoguemeasured values and integrated totals.

IV = Invalid / ValidThe information object is invalid if the data acquisition functiondetects a malfunction of the information source.

��

Information elements IEC870-5-101, example indications

D7 D6 D5 D4 D3 D2 D1 D0IV NT SB BL 0 0 0 SPI

D7 D6 D5 D4 D3 D2 D1 D0IV NT SB BL 0 0 DPI

SIQ - Single indication

SIQ := CP8 {SPI, RES, BL, SB, NT, IV}SPI := BS1 [1] <0, 1>

<0> := OFF<1> := ON

DIQ := CP8 {DPI, RES, BL, SB, NT, IV}DPI := UI2 [1..2] <0..3>

<0> := Intermediate position<1> := OFF<2> := ON<3> := Error

DIQ - Double indication

��

Information elements IEC870-5-101, example double command DCO)

D7 D6 D5 D4 D3 D2 D1 D0S/E QU DCS

DCO := CP8 {DCS, QOC }DCS := UI2 [1..2] <0..3>

<0> := Not allowed<1> := OFF<2> := ON<3> := Not allowed

QOC := CP6 [3..8] {QU, S/E}QU := UI5 [3..7] <0..31>

<0> := No additional definition<1> := Short command output<2> := Long command output<3> := Persistent output<4..31> := Reserved

S/E := BS1 [8] <0, 1><0> := Execute<1> := Select

��

Information elements IEC870-5-101, measurement normalizedUsed in RTU560 as M_ME_NA_1 e.g. at AMI and DMI8/16

D7 D6 D5 D4 D3 D2 D1 D02-8 2-9 2-10 2-11 2-12 2-13 2-14 2-15

D15 D14 D13 D12 D11 D10 D9 D8S 2-1 2-2 2-3 2-4 2-5 2-6 2-7

NVA =normalized value

D7 D6 D5 D4 D3 D2 D1 D0 QDS =

-1 ... +1 - 0,000030517-1 ... +0,999969482

15

NVA := F16[1..16]< -1 ... +1 – (2 ) >-15

Quality descriptorIV NT SB BL 0 0 0 OV

��

Information elements, IEC870-5-101 measurement scaled

D7 D6 D5 D4 D3 D2 D1 D02+8 2+9 2+10 2+11 2+12 2+13 2+14 2+15

D15 D14 D13 D12 D11 D10 D9 D8S 2+1 2+2 2+3 2+4 2+5 2+6 2+7

SVA =Scaled value

D7 D6 D5 D4 D3 D2 D1 D0 QDS =

- 32 768 ... + 32 767

SVA := >I16[1..16] < -(2 ) ... +2 -1 +15+15

Used in RTU560 as M_ME_NB_1 at AMI

Quality descriptorIV NT SB BL 0 0 0 OV

��

RTUtil, input menu measurement normalized

��

RTUtil, input menu measurement scaled

maximum value 32 767

decimal factor e.g. 10 ,if 10.3 kV should be transferred as 103

��

RTU560 - Link-address, ASDU-address

Physical transport mediumPhysical transport medium

44 ------

33 ------

22



66 ------

55 ------


44 ------

33 ------

22



66 ------

55 ------


ASDU-address ASDU-address

LINK-address LINK-address

��

RTU560 - Link-address, ASDU-address, Information object

Link address range, if 8 BIT selected in RTU560 network tree: 1 ... 254

ASDUaddress range, if 16 BIT selected in RTU560 network tree: 1 ... 65 534

Information object address range, if 24 BIT selected in RTU560 network tree:

1 ... 16 777 215

��

Address concept

is

matter of the customer

RTU560 - Link-address, ASDU-address, Informationsobject

��

RTU560 IEC870-5-101, Link-address, ASDU-address, object number

Most simple case:Link-address = ASDU - address = substation number

useful:Each information object address exists only once within a networkcontrol system

==> not generally required==> required only within one RTU

Option at RTU560:individual ASDU-addresses on different 870-5-101 or -104-lines and also for data points

��

Example protocol -101: Link-address = ASDU-address

protocol

IEC60870IEC60870--55--101101

Knoten Station RTU560Knoten Station RTU560

RTU 560RTU 560Link-address 254ASDU-address 254object 14 777 215 ... 14 777 300

Link-address 444ASDU-address 444object 30 ... 50

RTU 560RTU 560Link-address 34ASDU-address 34object 1 017 ... 1 100

RTU 560RTU 560Link-address 4ASDU-address 4object 16 777 200 ... 16 777 215

RTU 560RTU 560

Link-address 17ASDU-address 17

object 1 ... 11

��

house number = phone number

Lonely Road 1402Phone no. 1402

5

Goethestr 317Telefonnr. 317

7

1

��

more frequently: several phone numbers at one house number

Lonely Road 1402Phone 1: 67312Phone 2: 59717Phone 3: 42799 5

Goethestr 317Telefon 1: 82317Telefon 2: 59174

7

1

��

Example protocol -101: Link-address ≠≠≠≠ ASDU-address, object

protocol

IEC60870IEC60870--55--101101

Knoten Station RTU560Knoten Station RTU560

RTU 560RTU 560

Link-address 503ASDU-address 38001object 14 777 215 ... 14 777 300


RTU 560RTU 560Link-address 50621ASDU-address 2001object 1 017 ... 1 100RTU 560RTU 560


380 kV380 kV

110 kV110 kV 20 kV20 kV

RTU 560RTU 560

Link-address 50622ASDU-address 2002object 15 777 200 ... 15 777 215 ASDU-address 38002object 16 777 200 ... 16 777 215

20 and 380kV20 and 380kV

Example:ASDUs for 380 kV start with 380... ,for 110 kV with 110... and for 20kV with 20...,LINK-addresses incorporate the line no.

1 2 3 4

5

1 25061 5062

501502

504505

��

Example protocol -101 at a utility

Alle switchyards have a plant numberLink-address = plant number 0 ... 4095

The ASDU address incorporates the link address and the voltage level coded

ASDU-address 0 ... 65 535

The object address contains the bay number, the information type, group type of high voltage equipment, etc

Information object, range at RTU560, if 24 BIT selectet:0 ... 16 777 215

��

protocol -101, example ASDU, details

Voltage level 0 ...7Plant number0 ... 4095

20 - bit is transmittedat first

Voltage level, 4 Bit: 0 ... 15

plant number , 12 Bit: 0 ...4095 is also used for LINK-address

2 informations in ASDU address:

��

protocol -101, example object address, details

Base element , 8 Bit: 0 ... 255

base element-(BE)-group , 3 Bit: 0 ...7 ( pol U, V, W - if equipment BM = transformer)

equipment-(BM)-group, 3 Bit: 0 ...7 (... transformator, coil, protection....)

information group, 4 Bit: 0 ...15 (system informations, measurements...)

bay number, 6 Bit: 0 ... 63

5 informations in object address:

��

RTU560, Example defintion of a structured address

��

RTU560, Example of a structured data point address

��

Example protocol -104: ASDU-address, object

protocolIEC60870IEC60870--55--104104

RTU560RTU560

RTU 560RTU 560ASDU-address 65 534object 14 777 215 ... 14 777 300

ASDU-address 444object 30 ... 50

RTU 560RTU 560ASDU-address 34object 1 017 ... 1 100

RTU 560RTU 560ASDU-address 4object 16 777 200 ... 16 777 215

RTU 560RTU 560

ASDU-address 17object 1 ... 11

LAN oder WAN

Beim -104-protocol entfällt die LINK-address auf Datenpunktebene:(therfore IP- and Gateway-addresses at ETH-level)

��

RTU560, Address Example with subRTUs, RTUtil default principle

RTUHeidelberg

RTUMannheim

RTUMutterstadt

NCC1 NCC2

-101 line

-101 sublineredundant

-101 subsubline

-104 line

DPI Mu yy -104line -101line -101subline -101subsublineIP or Link 199.5.5.51 3 4 17ASDU 222 222 412 366OBJEKT 1354 1354 4303 5703

DPI Ma xy -104line -101line -101sublineIP or Link 199.5.5.51 3 4 ASDU 221 221 281OBJEKT 917 917 1004

DPI Hd xx -104line -101lineIP or Link 199.5.5.51 3 ASDU 220 220 OBJEKT 483 483

Link 17

Link 4

Link 3IP 199.5.5.51

These default addresses maynot be unique in your system.Check, if you can live with it.

��

RTU560, Address Example with subRTUs

RTUHeidelberg

RTUMannheim

RTUMutterstadt

NCC1 NCC2

-101 line

-101 sublineredundant

-101 subsubline

-104 line

DPI Mu yy -104line -101line -101subline -101subsublineIP or Link 199.5.5.51 3 4 17ASDU 222 222 222 222OBJEKT 1354 1354 1354 1354

DPI Ma xy -104line -101line -101subline IP or Link 199.5.5.51 3 4 ASDU 221 221 221 OBJEKT 917 917 917

DPI Hd xx -104line -101lineIP or Link 199.5.5.51 3 ASDU 220 220 OBJEKT 483 483

Link 17

Link 4

Link 3IP 199.5.5.51

��

MicroSCADA and RTU560, RTUtil-configuration just copied

RTUHeidelberg 1

RTUHeidelberg 2

MicroSCADA

-101 line

Link addres 4

Link addres 3

Not nice - but possible:RTU Heidelberg 2 is a copy of RTU Heidelberg 1.ASDU-adresses and Object-adresse are the same in bothRTUs. Only the link address in Heidelberg 2 is modified.

Usually customers modify at least the ASDU-Addresses in the copied RTU also.

The MicroSCADA works with polling and stationaddresses. Polling Address PA in MicroSCADA = link address of RTUStation Address AA in MicroSCADA is = ASDU address in RTU

��

Telegram format RP571, variable length, created ca.1992, specific adress concept

variable length = 01101000, fixed length frame format = 00010000START CHARACTER

LENGTH

LENGTH

VALUE

START CHARACTER

Router RTU NO.

FCODE

PROCESS RTU

BLOCK NO.

Überwachungsrichtung: 7 bit Funktionsfeld, RichtungsbitExample IDM Prio 1= 0011000 0 = Indication Message without Status

command direction: 2 bit seq.number, Monolog/Dialog, 4 bit function code,direction bit

Example: 00000100 (Length entfällt bei fixed length frame format)

variable length = 01101000, fixed length frame format = 00010000

Example: 00000100 Wiederholung aus Sicherheitsgründen, “ )

Example: 00000101 = RTU Nr.5 Dezimal

Example: 00010001 = RTU Nr.17 Dezimal

Checksum

STOP CHARACTER 00010110

VALUE

BLOCK NO.

VALUE

BLOCK NO.

0001011010100000

��

ASDU IEC 60870-5-101 <--> RP571 - correspondant

0,1 ms ab Mitternacht

IEC-objectaddress

Startbyte bei variabler Telegrammlength 0110 1000

0000 1001

0000 1001

0110 1000

0000 0001

0101 0010

1101 0010

0000 0001

length (# Datenbytes ab Routeraddress)

Checksum

0001 0110

length (Wiederholung)

Startbyte (Wiederholung)

Routeraddress

Funktionkode ERMI

RTU-address bw. SCU-address210dez = D2 hex

Blocknr.1...255

STOP Byte

1000 1001Sequenznummer 0...255

bit 15, Typ DI,EIN

Unbelegt, timequalität, notsync.,overflow

Tag des Moants

0000 0000

1000 1001

0000 1101

0010 1101

0000 0101

0000 1100

0000 0001

0000 0100

0000 0010

0000 1011

0000 0001

1101 0010

0000 0010

Data Unit Identifier / Identifikationsfeld des Dateneinheit

Information Object 1

Information Object n ...

4 = Doppelindication mit time

2 Information objecte

Übertragungsursache:11 = Rückindication verursacht durch Fernbefehl

Stationsaddress 1

gültig, aktuell, not ersetzt, not blocked, Reserve, EIN bestimmt

Duale time, 3 Octette

0001 0000

0001 0000

0000 0000

not available in the othertyp

��

IEC 60870-5-103; Informative Interface of Bay Protection

Physical Layer: Fibre optics or RS 485Link Layer: Unbalanced transmissionApplication layer:

� Time synchronization� Time-tagged fault information� Operational measurands� Control of functions e.g. autoreclosure� Analog and digital disturbance data (samples)� Generic services

Details: Advanced training course RTU560

��

IEC60870-5-104

� � ��

� � � ��

� � � �� ! � �" � # �� $ � �%& ' ��

� � � ( �� $��

IEC 60870IEC 60870--55--104104EN 60870EN 60870--55--104104

��

IEC 60870-5-104 general system architecture

Application -101transport Interface

TCP/IP

OUTSTATIONRTU560

TCP/IP

Tansport InterfaceApplication -101

TCP/IP

Tansport InterfaceApplication -101

CENTRALSTATION

RouterRouter

RouterRouter

LANLANRouterRouter

redundant redundant optionoption

LANLAN

NetworkX.25, ISDN, FR

��

IEC 60870-5-104 , benefits of router use

� No network specific software in the end systems� No „routing“-capability in the end systems� No network-management in the end systems� Use of standard RTUs facilitated � Use of standard routers possible � Change of network just needs change of router� Future-proof

��

Selection of application functionsof IEC 60870-5-5 acc. to IEC 60870-5-101

Initia-lization

Selection of ASDUsof IEC 60870-5-101 and IEC 60870-5-104

APCI Application Protocol Control InformationUser TCP interface (transport Interface)

UserProcess

transportlayer (4)Networklayer (3)

Linklayer (2)Physicallayer (1)

Applicationlayer (7)

Selected TCP transmission control protocol

RFC = Request for Comments

IEC 60870-5-104 , protocol structure

Selected IP Internet protocol

EthernetLLC logical lnk controlMAC medium access controlLAN ISO 8802

For comparism,-101 definitions:

n.a.

60870-5-160870-5-2

ISO, ITU-T

n.a.

60870-5-360870-5-460870-5-5

��

transportlayer (4)

Networklayer (3)

Linklayer (2)

Physicallayer (1)

RFC 793 (TRANSMISSION CONTROL PROTOCOL)

RFC 791 (INTERNET PROTOCOL)

RFC 894(Transmission of

IP Datagramsover Ethernet

Networks)

IEEE 802.3

RFC = Request for Comments = Internet Standard Designation

RFC 1661(PPP)

X.21

RFC 1662(PPP in HDLC-like framing)

IEC 60870-5-104 , TCP/IP „Protocol Suite“ RFC 2200

��

TCP - Transmission Control Protocol

Functions:• Cutting of data stream from aplication layer intosegments (max. 65 kByte)• creates safe connection between end systems by time supervision / acknowledgement / fault recognition / repetition of send data• adapts transport adresses to network addresses• multiplex mechanism (e.g. RTU560 service based uponInternet Explorer runs via LAN in parallel with IEC870-5-104 telegrams)

Services:• Establishing a transport connection• Data transfer• Abortion of transport connection

��

IP - Internet Protocol

IPv4 - Adress length 32 bitIPv6 - Adress length 128 bit (backwards compatibel to IPv4)

Services:• Cut of segments into fragments (size of fragments can beset according to Ethernet requirements)• Transmission of fragments as „datagram“ from senderthrough the network to the receiver• a transmission path in the nework is searched for eachdatagram independant from other datagrams.• Datagrams can be lost • Datagrams can overtake other datagrams

Sorting in the right seqence and check for lost of faultydatagrams is realized on TCP level.

��

IEC 60870-5-104 , user TCP interface

User TCP interface• stream oriented• no start/stop mechanism for ASDUs from IEC60870-5-5101

ASDU = application service data unit, see IEC60870-5-101 and -3

APDU = application protocol data unit

APCI = application protocol control defintion

Therefore are additionally required:

��

IEC 60870-5-104 and DNP , APDU = APCI + ASDU

ASDUapplication

service data unit,max. 249 octets

APDUapplication

protocoldata unit

APCIapplication protocol

control defintion,6 octets

Length,max. 253

START 68HLength of APDU

Control field octet 1Control field octet 2Control field octet 3Control field octet 4

ASDU defined inIEC60870-5-101

andIEC60870-5-104

andDNP

Total max. 255 octets

��

IEC 60870-5-104 , I - format

I format: numbered information transfersend sequence number N(S)send sequence number N(S)

receive sequence number N(R)receive sequence number N(R)

LSB

MSB

MSB


LSB

��

IEC 60870-5-104 , S - format

S format: numbered supervisory transfer00

receive sequence number N(R)receive sequence number N(R)

LSB

MSB


��

IEC 60870-5-104 , U - format

U format: unnumbered control functionsTESTFR STOPDT STARTDT 1 1

000


��

IEC 60870-5-104 , user data transfer initialisation (link layer)

Ack V(S) V(R)

0 0 0

Station Ainternal counters V after

APDU was sent or received

Station Binternal counters V after


0 0 0V(S) V(R) Ack

U (STARTDT act)

U (STARTDT con)

The controlling station must activate the user data transfer by sending STARTDT act.

The controlled station answers STARTDT con.

If STARTDT is not confirmed, the connection is closed by the controlling station.

��

U-format, User data transfer initialisation, example

��

IEC 60870-5-104 , undisturbed sequences of I - APDUs

Ack V(S) V(R)

0 0 0

Station Ainternal counters V after


Station Binternal counters V after


0 0 0V(S) V(R) Ack

123

I(0,0)I(1,0)I(2,0)1

23

12 1

2

I(0,3)

I(1,3)

2

4

4

3

I(3,2)

1...3 O.k., deletebuffer1...2

O.k., deletebuffer

15 bit numbers0...32767

��

IEC 60870-5-104 , IP address and port number

Every TCP address consists of

• IP address (example: 199.5.5.31)

• port number The port number is unique within a system.The port number in telecontrol-IEC60870-5-104-systems is always 2404

��

Port Numbers

Ports are used in the TCP [RFC793] to name the ends of logical connections which carry long term conversations. For the purpose of providing services to unknown callers, a service contact port is defined.

��

Port Numbers

The port numbers are divided into three ranges:

1. the Well Known Ports0 - 1023

2. the Registered Ports 1024 - 49151

3. the Dynamic and/or Private Ports49152 - 65535

http://www.iana.org/assignments/port-numbers

��

IEC 60870-6 (former IEC 870-6-503 TASE.2)

Telecontrol Application Service Element (TASE.2) protocol (also known as Inter-Control Centre Communications Protocol, ICCP),purpose:

Data exchange over Wide Area Networks (WANs) between a utility control centre and other control centres, other utilities, power pools, regional control centres, and Non-Utility Generators.

Data exchange information consists of real-time and historical power system monitoring and control data, including measured values, scheduling data, energy accounting data, and operator messages.

This data exchange occurs between one control centre's SCADA/EMS host and another centre's host, often through one or more intervening communications processors.

��

Standard for future substation automation systems (SAS)

IEC 61850

Communication Networks and Systems

in Substations

IEC 61850 is a communication and engineering standardtargeting interoperability between devices, systems and

tools from different vendors

��

IEC 61850 Reference Model

��

IEC 61850 Modelling Approach

Examples:

switch position withquality and time stampsimiliar to object definitionin IEC870-5-103

circuit breaker XCBR,

distance protection PDIS,..

integer,

boolean,

time tag

��

Examples of Logical Nodes according to IEC 61850-7-4

LN: Logical node zero (only mandatory (M) data) Name: LLN0LN: Physical device information (only M data) Name: LPHDLN: Switch controller (only M data) Name: CSWILN: Alarm handling (only M data) Name: CALHLN: Generic automatic process control (all data) Name: GAPCLN: Generic general IO (all data) Name: GGIOLN: Measurant Unit (all current and voltage values) Name: MMXULN: Telecontrol Interface (all data) Name: ITCILN: Telemonitoring Interface (all data) Name: ITMI

��

Line Protection

Traditional approach

��

Line Protection

Logical Device“Breaker IED”

LN PCTRLN PCTRLN XCBR

Logical Device“Breaker IED”

LN PCTRLN PCTRLN XCBR

IEC 61850-8-1 / -9-2

Introducing breaker IED’s and protection bus

��

IEC 61850 - parts

Part 1 Introduction and OverviewPart 2 GlossaryPart 3 General requirementsPart 4 System and project managementPart 5 Communication requirements for functions and device

modelsPart 6 Substation automation system configuration language

(SCL) (e.g. ABB adapter SPA-ZC400: CID files can be exportedto other tools, ICD files are imported relay applications)

Part 7 Basic communication structure for substation and feederequipment7.1 Principles and models7.2 Abstract communication service interface (ACSI)7.3 Common data classes7.4 Compatible logical node classes

��

IEC 61850 - parts

Part 8.1 Specific communication service mapping (SCSM) -mapping to manufacturing message specification (MMS) (e.g. ABB adapter SPA-ZC400: Applications of REx541/3/5 protection and control devices can be accessed at the verticalcommunication)

Part 9.1 Specific communication service mapping (SCSM) – serialunidirectional multidrop point-to-point link

Part 9.2 Specific communication service mapping (SCSM) –mapping on IEEE802.3 based process bus

Part 10 Conformance testing

telecontrol protocol standards pdf

Documents

rfcnetwork layer

tcptransport layer

dnsformat layer

dns44 transport layer

fddidata link layer

tcp33 network layer

rfc22 data link layer

ethernet77 application