Telecontrol Protocol Standards PDF
-
Upload
insansoft6498 -
Category
Documents
-
view
150 -
download
16
description
Transcript of Telecontrol Protocol Standards PDF
���� �
RTU Training
� � �� � �� �� � � � ��� �� � � � � �
���� �
RTU Training: IEC 60870
� � �� � �� ��� � � �� � � ��� � �� � � �� � �
IEC 60870IEC 60870EN 60870EN 60870
���� �
ISO 7498-1 Information technology - open systems interconnection - basic reference model
77
66
55
44
33
22
11
Application Layer(Anwendungsschicht)Application Layer(Anwendungsschicht)
Format Layer(Darstellungsschicht)Format Layer(Darstellungsschicht)
Communication ControlLayerCommunication ControlLayer
Transport Layer(Transportschicht)Transport Layer(Transportschicht)
Routing Layer(Vermittlungsschicht)Routing Layer(Vermittlungsschicht)
Link Layer(Sicherungsschicht)Link Layer(Sicherungsschicht)
Physical Layer(bitübertragunsschicht)Physical Layer(bitübertragunsschicht)
Identification of communication partnerPermissionSelection of dialogue procedure type
Identification of communication partnerPermissionSelection of dialogue procedure type
Selection of syntaxTransformation of data in formatsSelection of syntaxTransformation of data in formats
Establishing of partner connectionsControl of dialogsSynchronising of connections
Establishing of partner connectionsControl of dialogsSynchronising of connections
RoutingMultiplexing of network connectionsFlußkontrolle
RoutingMultiplexing of network connectionsFlußkontrolle
FramingSequence controlFramingSequence control
bit transportCodingSynchronising
bit transportCodingSynchronising
Establishing of transport connectionsMultiplexingFault recognition and repair
Establishing of transport connectionsMultiplexingFault recognition and repair
���� �
ISO/OSI-7-layer reference model
virtual protocols
real transport
77
66
55
44
33
22
11
77
66
55
44
33
22
11
Physical transport mediumPhysical transport medium
Application LayerApplication Layer
Format LayerFormat Layer
Communication ControlLayerCommunication ControlLayer
Transport LayerTransport Layer
Routing LayerRouting Layer
Link LayerLink Layer
Physical LayerPhysical Layer
Application LayerApplication Layer
Format LayerFormat Layer
Communication ControlLayerCommunication ControlLayer
Transport LayerTransport Layer
Routing LayerRouting Layer
Link LayerLink Layer
Physical LayerPhysical Layer
���� �
ISO/OSI-7-layer reference model, IEC60870-5-.., TCP/IP, Ethernet
virtual protocolsreal transport
*)Jabber-function interuptssending after 30 ms at Ethernet
77 application layer, IEC60870-5-101,5-104,..., E-Mailsapplication layer, IEC60870-5-101,5-104,..., E-Mails
66Format layer , z.B.FTP, SMTP, TELNET, DNSFormat layer , z.B.FTP, SMTP, TELNET, DNS
55 communication layerFTP, SMTP, TELNET, DNScommunication layerFTP, SMTP, TELNET, DNS
44transport layer , z.BTransm.Control Prot. TCPtransport layer , z.BTransm.Control Prot. TCP
33network layer , z.BInternet Protocol (IP, RFC)network layer , z.BInternet Protocol (IP, RFC)
22data link layer , z.BEthernet IEEE802.3, FDDIdata link layer , z.BEthernet IEEE802.3, FDDI
11 physical layerphysical layer
77 application layerapplication layer
66 Format layerFormat layer
55 communication layercommunication layer
44transport layerClient calls - server respondschecksums, ackn., time supervision
transport layerClient calls - server respondschecksums, ackn., time supervision
33network layeradressing of nodes, fragmentation of pakages
network layeradressing of nodes, fragmentation of pakages
22data link layerSend+receive of bit streams,collision detection, Jabber-Fkt.*)
data link layerSend+receive of bit streams,collision detection, Jabber-Fkt.*)
11 physical layerphysical layer
Physical transport mediumtwisted pair, coaxcabel, fiber optic, radio
Physical transport mediumtwisted pair, coaxcabel, fiber optic, radio
���� �
EPA - enhanced performance architecturee.g. used in IEC 870-5-103
77 Application LayerApplication Layer
66 ------
55 ------
44 ------
33 ------
22
11 Physical LayerPhysical Layer
77 Application LayerApplication Layer
66 ------
55 ------
44 ------
33 ------
22 Link LayerLink Layer
11 Physical LayerPhysical Layer
Physical transmission mediumPhysical transmission medium
Link LayerLink Layer
���� �
Layered Architecture DNP 3.0
77 Application LayerApplication Layer
66
33 Pseudo transport layerPseudo transport layer
22 Data Link LayerData Link Layer
11 Physical LayerPhysical Layer
Selected elements according to IEC 870-5-4 Selected services according to IEC 870-5-3
draft
Selected elements according to IEC 870-5-4 Selected services according to IEC 870-5-3
draft
--
segments messages into fragments(Start code, seq.nr., end code)segments messages into fragments(Start code, seq.nr., end code)
segments fragments into framesup to 256 bytes
segments fragments into framesup to 256 bytes
RS232, RS485, ....wire, fiber, radio, ....RS232, RS485, ....wire, fiber, radio, ....
...
���� �
DNP 3.0 in RTU560
This documentation is based on the following documents:
DNP Users Group
DNP Product Documentation
DNP V3.00 Data Object Library P009-0BL Version 0.02 July 28th, 1997
DNP V3.00 Data Link Layer P009-0PD.DL Version 0.02 May 30th, 1997
DNP V3.00 Application Layer P009-0PD.APP Version 0.03 May 28th, 1997
DNP V3.00 Transport Functions P009-0PD.TF Version 0.01 May 30th, 1997
���� �
IEC 60870-1-1
IEC 60870-1-2IEC 60870-1-3IEC 60870-1-4
IEC 60870-1-1
IEC 60870-1-2IEC 60870-1-3IEC 60870-1-4
Telecontrol equipment and systems, general considerations, general principles(multipoint partyline, point-to point-, ...) 1988Telecontrol equipment and systems, genr.consid., guide for specificationsTelecontrol equipment and systems, genr.consid., glossery, IEC50 chap.371 1997Telecontrol equipment and systems, genr.consid., basic aspects 1994
Telecontrol equipment and systems, general considerations, general principles(multipoint partyline, point-to point-, ...) 1988Telecontrol equipment and systems, genr.consid., guide for specificationsTelecontrol equipment and systems, genr.consid., glossery, IEC50 chap.371 1997Telecontrol equipment and systems, genr.consid., basic aspects 1994
IEC 60870-2-1IEC 60870-2-2IEC 60870-2-1IEC 60870-2-2
Telecontrol equipment and systems, operation conditions 1987Telecontrol equipment and systems, operation conditions, replaces patially -1 1996Telecontrol equipment and systems, operation conditions 1987Telecontrol equipment and systems, operation conditions, replaces patially -1 1996
IEC 60870-4IEC 60870-4
IEC 60870-3IEC 60870-3
IEC60870 Publications “Telecontrol and Systems”:
IEC 60870-5-xxxIEC 60870-5-xxx Telecontrol equipment and systems, Transmission protocols 1993...2000
IEC 60870-6IEC 60870-6 Telecontrol equipm. and syst., Telecontrol protocols compatible with ISO and CCITT
IEC standardIEC standard titletitle
���� ��
IEC 60870-1-1 point-to point configuration
Fernwirkunterstation,remote terminal unit (RTU)
Leitzentrale /control centre
link terminals / Linienkoppler
End-End-Konfiguration / point-to-point configuration
���� ��
IEC 60870-1-1 multiple point-to-point configurat.
Fernwirkunterstationen,remote terminal units (RTU)
Leitzentrale /control centre
link terminals / Linienkoppler
Mehrfach-End-End-Konfiguration / multiple point-to-point configuration
���� ��
IEC 60870-1-1 multipoint star configuration
Fernwirkunterstationen,remote terminal units (RTU)
Leitzentrale /control centre
link terminal / Linienkoppler
Stern-Konfiguration / multipoint star configuration
���� ��
IEC 60870-1-1 multipoint party line configuration
Fernwirkunterstationen,remote terminal units (RTU)
Leitzentrale /control centre
Linien-Konfiguration / multipoint party line configuration
���� ��
IEC 60870-1-1 multipoint ring configuration
Ring-Konfiguration / multipoint ring configuration
Remote Terminal Units (RTUs)
control centreOption for switch-over unit:
Westermo type MD62www.westermo.se
dredgeraccident
���� ��
7appl.
7appl.
2link2
linkIEC 60870-5-1IEC 60870-5-1 Transmission Frame Formats (FT1.2 - 11 bit including start and stop bit) 1990 Transmission Frame Formats (FT1.2 - 11 bit including start and stop bit) 1990
IEC 60870-5-101 IEC 60870-5-102IEC 60870-5-103IEC 60870-5-104
IEC 60870-5-101 IEC 60870-5-102IEC 60870-5-103IEC 60870-5-104
Companion standard for basic telecontrol tasks 1995Companion standard for tansmission of integrated totals in electric power systemsCompanion standard for informative interface of protection euipment 1997Network access for IEC60870-5-101 using standard transport profiles Draft 1999
Companion standard for basic telecontrol tasks 1995Companion standard for tansmission of integrated totals in electric power systemsCompanion standard for informative interface of protection euipment 1997Network access for IEC60870-5-101 using standard transport profiles Draft 1999
IEC 60870-5-5IEC 60870-5-5 Basic Application Functions (station initialization, general interrogation...) 1995Basic Application Functions (station initialization, general interrogation...) 1995
IEC 60870-5-3IEC 60870-5-3 General Structure of Application Data (application service data units - ASDUs...)92General Structure of Application Data (application service data units - ASDUs...)92
IEC 60870-5-4IEC 60870-5-4 Definition and Coding of Application Information Elements (type identifications:100 - interrogation, 103 - clock synch command..., time tag coding...) 1993Definition and Coding of Application Information Elements (type identifications:100 - interrogation, 103 - clock synch command..., time tag coding...) 1993
Link Transmission Procedures (request-respond, send-confirm, send-no reply,.)92Link Transmission Procedures (request-respond, send-confirm, send-no reply,.)92IEC 60870-5-2IEC 60870-5-2
IEC60870-5 Sub-publications “Transmission Prot.” OSI-layerOSI-layer
���� ��
Hamming Distance 4
1 0 0 1 0 1 1 0
PC0
1 1 0 0 0 0 1 1
PC0
1 0 1 0 1 0 1 0
PC
1 1 1 0 1 1 0 0
PC1
0 1 1 0 0 1 0 0
PC1
0 1 1 1 0 1 1 1
PC0
7 6 5 4 3 2 1 0Bit:
Even parity (Format class 1.2)
Checksum
The change of any 3 bits is surelyrecognized.The change of 4 bits may not berecognized in seldom cases.
Hamming distance 4 Format class 1.2is common in telecontrol systems.
By the select-before-operate proceduresafety is increased in control direction.
user octet 0
user octet 255
user octet 1
user octet 2
...
���� ��
Hamming Distance 6
1 0 0 1 0 1 1 0
PC
1 1 0 0 0 0 1 1
PC
x x x x x x x x
PC
1 1 1 0 1 1 0 0
PC
0 1 1 0 0 1 0 0
PC
0 1 1 1 0 1 1 1
PC
7 6 5 4 3 2 1 0Bit:
Check Sequence
Hamming distance 6 Format class 3is used at DNP 3.0.
user octet 0
user octet 15
user octet 1
user octet 2
...
x x x x x x x x
Cyclic redundancy check (CRC) iscalculated according special algorithm
The change of any 5 bits is surelyrecognized.The change of 6 bits may not berecognized in seldom cases.
���� ��
10-8
10-18
10-1 = worst allowed R
10-3 = worst allowed R
10-12 = worst allowed R
Integrityclass I1
(hamming distance 2)
Integrity class
I2 (h 4)
Int.c
lass I3
R = residual
error rate
p = bit error rate Residual error rate =
number of undetected wrong messagestotal number of messages sent
10-5 0.5no signalonly noise
0.5 = 1bit wrong / 2 bit sent
1 day = 10-6
26 years = 10-10
260 000 years = 10-14
Mean time betweenundetected errorsat 1200 bit/s, p=10-4, 100 bitframes
IEC 60870-5-1 , Data Integrity Classes, Grafic
10-4
1bit wrong / 10.000 bitssent
100
10-3
10-1
10-210-3 10-1
���� ��
IEC 870-5-1 , FT 1.2, Frame with Fixed Length
User Data
Start character 16
Check sum
End character 22
���� ��
IEC 60870-5-1 , FT 1.2 Frame with Variable Length
User data octets
Start character 104
Length (0...255)
Length (repeated)
Start character 104
Length
Header offixed length
Application for frames with user data in both control and monitor direction
Check sum
End character 22
Example:hex decimal
0x68 = 1040x1A = 260x1A = 260x68 = 104
. . .
0x80 = 1280x16 = 22
���� ��
Example fixed length, variable length, single control character
Telegram examples:
fixed length
single control character0xE5 = 229
fixed length
variable lengthstart length length start link control ..address type structure cause of tra
start link control address checksum end
���� ��
REQUEST
RESPOND
Pollingof data
Data
Station A to Station B Station B to Station A
IEC 60870-5-2 ; Unbalanced Transmission
CONFIRM
SENDSend data
Acknowledge
���� ��
REQUESTClass 1
RESPOND GI
message 1
Pollingfor events
Data
RTU Protection equipment
Unbalanced Transmission, example start of general interrogation (GI)
CONFIRM
SENDASDU 7
ASDU 7 is sentto initiate general
interrogationAcknowledge
REQUESTClass 1
RESPOND GI
message 2
Pollingfor events
Data
���� ��
SEND
CONFIRM
REQUEST
SEND
CONFIRM
RESPOND
Send data
Acknowledge
Send data
Acknowledge
Station A to Station B Station B to Station A
IEC 60870-5-2 ; Balanced Transmission (point-to-point connection and full duplex lines required)
���� ��
Bit 8 = RESERVED in unbalanced - physical directionat balanced, 1= station A to B, 0=viceversa
PRM = Primary / secondary station (=1 messagefrom primary/initiating station)
FCB = Frame count toggle bit (Primary station to sec. )FCV = Frame count bit valid (=0 at reset)
ACD = Access demand in unbalanced (=1 demand forhigh priority class1 data) - RESERVED at balanced
DFC = Data flow control (=0 further messages areacceptable by secondary station,
=1 overflow expected)
MSB LSB
8 PRMFCB
ACD
FCV
DFC
2 2 2 2
Function
8 7 6 5 4 3 2 1
3 2 1 0
Bit
start( length )( length )
( start )Link control
Link address
Userdata
endchecksum
IEC 870-5-2 , Link Level, Control Byte
���� ��
IEC 870-5-2 , Link Level, Control Byte, Unbalanced Transmission, Function Codes,Messages sent from Primary (PRM=1)
startat -101
���� ��
IEC 870-5-2 , Link Level, Control Byte, Unbalanced Transmission, Function Codes,Messages sent from Secondary (PRM=0)
1. answer
���� ��
Example: IEC 870-5-2 , Unbalanced Transmission at IEC 870-5-101, Establishing the communication
RTU
RTU
Control System:
Control System:
Control System:
���� ��
IEC 870-5-2 , Link Level, Control Byte, Balanced Transmission, Function Codes,Messages sent from Primary (PRM=1)
commun. start
���� ��
IEC 870-5-2 , Link Level, Control Byte, Balanced Transmission, Function Codes,Messages sent from Secondary (PRM=0)
1. answer
���� ��
IEC 870-5-3 , Telegram Structure, EPA-Model
22Link Level(IEC870)
Link Level(IEC870)
APPLICATIONuser data
77 Application LevelApplication Level
ASDUApplication Service Data UnitAPCI
APDUApplication Protocol Data Unit
LSDULink Service Data UnitLPCI
LPDULink Protocol Data Unit
Control Information
ControlInformation
���� ��
Telegram Testtool, Protocol Profile Parameter
���� ��
Common structure of data units
ASDU
applicationservice
data unitinformation
objects
optionaldata unitidentifier
informationobject 1
time stampobject 1
informationobject n
���� ��
Data unit identifier
data unitidentifier
data unit type
optional at -101not used at -103
cause of transmission
type identification
variable structure qualifier
cause of transmission
common address of ASDU
common address of ASDU
���� ��
Type Identification
� defines type� for each type there is a standardized structure and format
TYPE IDENTIFICATION :=UI8 [1..8] <1..255> UI means unsigned integer
<1..127> := for definitions of this standard (compatible range)<128..135> := reserved for routing messages (private range)<136..255> := for special use (private range)
N u m b e r2 27 0
BIT 8 7 6 5 4 3 2 1
���� ��
Type identification at IEC 870-5-101 (companion standard for basic telecontrol tasks) - Process Information in Monitor Direction
TYPE IDENTIFICATION
UI8 [1..8] <0...44>
See IEC60870-5-101
table 3
Type Symbol meaning ABB
1 M_SP_NA_1 single-point information X2 M_SP_TA_1 single-point information with time tag X3 M_DP_NA_1 double-point inforamtion X4 M_DP_TA_1 double-point inforamtion with time tag X5 M_ST_NA_1 step position information X6 M_ST_TA_1 step position information with time tag7 M_BO_NA_1 bit string of 32 Bit (X)8 M_BO_TA_1 bit string of 32 Bit with time tag (X)9 M_ME_NA_1 measured value, normalized value X10 M_ME_TA_1 measured value, normalized value with
time tagX
11 M_ME_NB_1 measured value, scaled value12 M_ME_TB_1 measured value, scaled value with time tag13 M_ME_NC_1 measured value, short floating point
number14 M_ME_TC_1 measured value, short floating point
number with time tag15 M_IT_NA_1 Integrated totals X16 M_IT_TA_1 Integrated totals time tag X17 M_EP_TA_1 event of protection equipment with time tag X18 M_EP_TB_1 packed start events of protection equipment
with time tag19 M_EP_TC_1 packed output circuit information of
protection equipment with time tag20 ... ...21 ... ...
RTU232
���� ��
Type identification at IEC 870-5-101 Process Information in Control Direction
Single command
Double command
regulating step command
set point command
....
bitstring of 32 bits
TYPE IDENTIFICATION
UI8 [1..8] <45...69>
See IEC60870-5-101
table 4
COMAND
SINGLE COMMAND
NO TIMEA-Type Prozessinformation Steuerungsrichtung:
Typkennung Symbol Bedeutung ABB
45 C_SC_NA_1 Einzelbefehl46 C_DC_NA_1 Doppelbefehl X47 C_RC_NA_1 Stufenstellbefehl X48 C_SE_NA_1 Sollwert-Stellbefehl, normierter Wert X49 C_SE_NB_1 Sollwert-Stellbefehl, skalierter Wert50 C_SE_NC_1 Sollwert-Stellbefehl, Gleitkommazahl51 C_BO_NA_1 Bitmuster von 32 Bit (X)
RTU232
���� ��
Type identification at IEC 870-5-101 Sytem Information in Monitor Direction
TYPE IDENTIFICATION
UI8 [1..8] <70...99>
See IEC60870-5-101
table 5
Type Symbol meaning
70 M_EI_NA_1 End of initialization
71 Reserved for further compatible definitions..99 Reserved for further compatible definitions
���� ��
Type identification at IEC 870-5-101 Sytem Information in Control Direction
TYPE IDENTIFICATION
UI8 [1..8] <100...109>
See IEC60870-5-101
table 6
interrogation command
counter interrogation command
clock synchronisation command
test command
reset process command
delay acquisition command
....
���� ��
Type identification at IEC 870-5-101 Parameter in Control Direction
TYPE IDENTIFICATION
UI8 [1..8] <110...119>
See IEC60870-5-101
table 7
parameter of measured value,
normalized value
parameter of measured value, scaled
value
parameter of measured value, short
floating point number
parmeter activation
....
���� ��
Type identification at IEC 870-5-101File Transfer
TYPE IDENTIFICATION
UI8 [1..8] <120...127>
See IEC60870-5-101
table 8
File ready
section ready
call directory, select file, call file, call section,
last section, last segment
ack file, ack section
segment
directory
...
���� ��
Type identification at IEC 870-5-102 (companion standard for the transmission of integrated totals in electric power systems)
���� ��
Type identification at IEC 870-5-103 (companion standard for the informative interface of protection equipment)
TYPE
IDENTI-
FICATION
UI8 [1..8]
<1...255>
See
IEC60870-
5-103
table 3 and
4
���� ��
Data unit identifier, variable structure qualifier
data unitidentifier
data unit type
Optional
type identification
variable structure qualifier
cause of transmission
cause of transmission
common address of ASDU
common address of ASDU
���� ��
Variable structure qualifier
Defines the structure of information objects in ASDU
Variabel structure qualifier := CP8{number,SQ}
Number = N := UI7[1..7]<1...127><0> := ASDU contains no information object<1..127> := number of information objects
SQ=single/sequence := BS1[8] <0...1>e.g. SQ=1 The following type-equal information elements are identified by object address incrementedby +1 from the first address
CP (compound data field) is a sequence of data fields.BS means bit string
SQ N u m b e r2 26 0
BIT 8 7 6 5 4 3 2 1
���� ��
FT1.2, Link Bytes, ASDU with variable structure qualifier, example at -103
Number of information objects:
9 measurements
link link typecontrol addr.measm. COT
Variablestructurequalifier
commonaddressASDUstart length length start
160 =
= 0x94
���� ��
Data unit identifier, cause of transmission
data unitidentifier
data unit type
Optional
type identification
variable structure qualifier
cause of transmission
cause of transmission
common address of ASDU
common address of ASDU
���� ��
Data unit identifier, cause of transmission
Bit 8 7 6 5 4 3 2 1
25
20
causeT P/NCause ofTransmission
Orginator adress Optionalper system
Cause of transmission := CP16{cause, P/N, T, orginator addres (optional)}Cause := UI6[1..6]<0..63>
<0> := not defined<1..47> := number of cause, compatibel range<48..63> := number of cause, private range
P/N := BS1[7]<0..1> (BS means bit string)<0> := positiv confirm<1> := negativ confirm
T = Test := BS1[8]<0..1><0> := no test<1> := test
orginator address := UI8[9..16]<0..255><0> := default<1..255> := number of originator address if available
���� ��
Causes of transmission ( 870-5-101)
<0> := not used<1> := periodic, cyclic<2> := background scan<3> := spontaneus<4> := initialized<5> := request or requested<6> := activation<7> := activation confirmation<8> := deactivation<9> := deactivation confirmation<10> := activation termination<11> := return information caused by a remote command<12> := return information caused by a local command<13> := file transfer<14> ... <19> := reserved for further compatible definitions<20> := interrogated by general interrogation<21> := interrogated by group 1 interrogation<36> := interrogated by group 16 interrogation 2 <37>:= requested by general counter request<38> := requested by group 1 counter request<39> := requested by group 2 counter request<40> := requested by group 3 counter request<41> := requested by group 4 counter request<42> ... <47> := reserved for further compatible definitions
���� ��
Causes of transmission ( 870-5-103 always 1 byte only)
<0> := not used<1> := spontaneus<2> := cyclic<3> := reset frame count bit (FCB)<4> := reset communication unit (CU)<5> := start / restart<6> := power on<7> := test mode<8> := time synchronisation<9> := general interrogation<10> := termination of general interrogation<11> := local opeartion<12> := remote operation
...
���� ��
Data unit identifier, common address of ASDU
data unitidentifier
data unit type
Optional
type identification
variable structure qualifier
cause of transmission
cause of transmission
common address of ASDU
common address of ASDU
���� ��
RTUtil, Link-address, ASDU-address, Informationsobject
���� ��
RTU560, Example of Broadcast ASDU address 65535
���� ��
Information object
ASDU
applicationservice
data unitinformation
objects
data unitidentifier
informationobject 1
informationobject n
���� ��
Information object details at IEC870-5-101
Information object 1
Optional
Information objectaddress
informationelement or set of it
informationelement or set of it
27 Milliseconds 20
215 Milliseconds 28
25 minutes 20ResIV
variabel je ASDUInformation object n
e.g. 3 octet binary time0...59 999 ms, 0...59 min
IEC60870-5-4 clause 6.8
Information objectaddress
Information objectaddress high octet
Address 0 = irrelevant
address range 1...255
address range 1...65535if 2 octets are used
address range 1...16 777 215if 3 octets are used
���� ��
Information object at IEC870-5-103
Information object 1
Optional
Function type
informationelement or set of it
informationelement or set of it
27 Milliseconds 20
215 Milliseconds 28
25 minutes 20ResIV
Information object n
e.g. 3 octet binary time0...59 999 ms, 0...59 min
IEC60870-5-4 clause 6.8
Information number
128 distance protection160 overcurrent protection176 transformer diff protection192 line differential protection254 generic function type
���� ��
IEC870-5-101, Sequence of information objects, SQ=0
Single-point information without time tagTYPE IDENT 1: M_SP_NA_1
Sequence of information objects including object adresses (SQ = 0)
8 7 6 5 4 3 2 1 Bit
0 0 0 0 0 0 0 1
0Number of objects
T P/N 25 cause 20
TYPE IDENTIFICATION
VARIABLE STRUCTURE QUALIFIER
CAUSE OF TRANSMISSION
COMMON ADDRESS OF ASDU
ADDRESS OF INFORMATION OBJECTS
IV NT SB BL 0 0 0 SPI Quality bits and signal position
ADDRESS OF INFORMATION OBJECTS
DATA UNIT IDENTIFIER
INFORMATION OBJEKT 1
INFORMATION OBJEKT iIV NT SB BL 0 0 0 SPI
Quality bits and signal position
Info
rmat
ion
obje
cts
���� ��
IEC870-5-101, No sequence of information objects, SQ=1
Single-point information without time tag
TYPE IDENT 1: M_SP_NA_1
Sequence of information objects, incremented object adress assumed (SQ = 1)
8 7 6 5 4 3 2 1 Bit
0 0 0 0 0 0 0 1
1number j of elements
T P/N 25 Cause 20
ADRESSE INFORMATIONSOBJEKTS A
IV NT SB BL 0 0 0 SPI 1
IV NT SB BL 0 0 0 SPI j
Quality bits and signal position of information object A
Quality bits and signal position of information object A+1Info
. obj
ects
DATA UNIT IDENTIFIER
INFORMATION OBJEKT 1
INFORMATION OBJEKT i
TYPE IDENTIFICATION
VARIABLE STRUCTURE QUALIFIER
CAUSE OF TRANSMISSION
COMMON ADRESS OF ASDU
���� ��
Quality descriptor (IEC870-5-101)
OV = Overflow / No overflowThe value of the information object is out of range.Mainly analogue measured values.
BL = Blocked / Not blockedThe transmission of this information object is blocked.The contents is the last value before blocking.
SB = Substituted / Not substitutedThe value of the information object was substituted bythe operator or a local automation function.
NT = Not topical / TopicalThe information object is topical, if the last update within a certain time period was successful. Mainly cyclic analoguemeasured values and integrated totals.
IV = Invalid / ValidThe information object is invalid if the data acquisition functiondetects a malfunction of the information source.
���� ��
Information elements IEC870-5-101, example indications
D7 D6 D5 D4 D3 D2 D1 D0IV NT SB BL 0 0 0 SPI
D7 D6 D5 D4 D3 D2 D1 D0IV NT SB BL 0 0 DPI
SIQ - Single indication
SIQ := CP8 {SPI, RES, BL, SB, NT, IV}SPI := BS1 [1] <0, 1>
<0> := OFF<1> := ON
DIQ := CP8 {DPI, RES, BL, SB, NT, IV}DPI := UI2 [1..2] <0..3>
<0> := Intermediate position<1> := OFF<2> := ON<3> := Error
DIQ - Double indication
���� ��
Information elements IEC870-5-101, example double command DCO)
D7 D6 D5 D4 D3 D2 D1 D0S/E QU DCS
DCO := CP8 {DCS, QOC }DCS := UI2 [1..2] <0..3>
<0> := Not allowed<1> := OFF<2> := ON<3> := Not allowed
QOC := CP6 [3..8] {QU, S/E}QU := UI5 [3..7] <0..31>
<0> := No additional definition<1> := Short command output<2> := Long command output<3> := Persistent output<4..31> := Reserved
S/E := BS1 [8] <0, 1><0> := Execute<1> := Select
���� ��
Information elements IEC870-5-101, measurement normalizedUsed in RTU560 as M_ME_NA_1 e.g. at AMI and DMI8/16
D7 D6 D5 D4 D3 D2 D1 D02-8 2-9 2-10 2-11 2-12 2-13 2-14 2-15
D15 D14 D13 D12 D11 D10 D9 D8S 2-1 2-2 2-3 2-4 2-5 2-6 2-7
NVA =normalized value
D7 D6 D5 D4 D3 D2 D1 D0 QDS =
-1 ... +1 - 0,000030517-1 ... +0,999969482
15
NVA := F16[1..16]< -1 ... +1 – (2 ) >-15
Quality descriptorIV NT SB BL 0 0 0 OV
���� ��
Information elements, IEC870-5-101 measurement scaled
D7 D6 D5 D4 D3 D2 D1 D02+8 2+9 2+10 2+11 2+12 2+13 2+14 2+15
D15 D14 D13 D12 D11 D10 D9 D8S 2+1 2+2 2+3 2+4 2+5 2+6 2+7
SVA =Scaled value
D7 D6 D5 D4 D3 D2 D1 D0 QDS =
- 32 768 ... + 32 767
SVA := >I16[1..16] < -(2 ) ... +2 -1 +15+15
Used in RTU560 as M_ME_NB_1 at AMI
Quality descriptorIV NT SB BL 0 0 0 OV
���� ��
RTUtil, input menu measurement normalized
���� ��
RTUtil, input menu measurement scaled
maximum value 32 767
decimal factor e.g. 10 ,if 10.3 kV should be transferred as 103
���� ��
RTU560 - Link-address, ASDU-address
Physical transport mediumPhysical transport medium
44 ------
33 ------
22
11 Physical LayerPhysical Layer
77 Application LayerApplication Layer
66 ------
55 ------
Link LayerLink Layer
44 ------
33 ------
22
11 Physical LayerPhysical Layer
77 Application LayerApplication Layer
66 ------
55 ------
Link LayerLink Layer
ASDU-address ASDU-address
LINK-address LINK-address
���� ��
RTU560 - Link-address, ASDU-address, Information object
Link address range, if 8 BIT selected in RTU560 network tree: 1 ... 254
ASDUaddress range, if 16 BIT selected in RTU560 network tree: 1 ... 65 534
Information object address range, if 24 BIT selected in RTU560 network tree:
1 ... 16 777 215
���� ��
Address concept
is
matter of the customer
RTU560 - Link-address, ASDU-address, Informationsobject
���� ��
RTU560 IEC870-5-101, Link-address, ASDU-address, object number
Most simple case:Link-address = ASDU - address = substation number
useful:Each information object address exists only once within a networkcontrol system
==> not generally required==> required only within one RTU
Option at RTU560:individual ASDU-addresses on different 870-5-101 or -104-lines and also for data points
���� ��
Example protocol -101: Link-address = ASDU-address
protocol
IEC60870IEC60870--55--101101
Knoten Station RTU560Knoten Station RTU560
RTU 560RTU 560Link-address 254ASDU-address 254object 14 777 215 ... 14 777 300
Link-address 444ASDU-address 444object 30 ... 50
RTU 560RTU 560Link-address 34ASDU-address 34object 1 017 ... 1 100
RTU 560RTU 560Link-address 4ASDU-address 4object 16 777 200 ... 16 777 215
RTU 560RTU 560
Link-address 17ASDU-address 17
object 1 ... 11
���� ��
house number = phone number
Lonely Road 1402Phone no. 1402
5
Goethestr 317Telefonnr. 317
7
1
���� ��
more frequently: several phone numbers at one house number
Lonely Road 1402Phone 1: 67312Phone 2: 59717Phone 3: 42799 5
Goethestr 317Telefon 1: 82317Telefon 2: 59174
7
1
���� ��
Example protocol -101: Link-address ≠≠≠≠ ASDU-address, object
protocol
IEC60870IEC60870--55--101101
Knoten Station RTU560Knoten Station RTU560
RTU 560RTU 560
Link-address 503ASDU-address 38001object 14 777 215 ... 14 777 300
Link-address 506ASDU-address 444object 30 ... 50
RTU 560RTU 560Link-address 50621ASDU-address 2001object 1 017 ... 1 100RTU 560RTU 560
Link-address 50611ASDU-address 11001object 1 ... 11
380 kV380 kV
110 kV110 kV 20 kV20 kV
RTU 560RTU 560
Link-address 50622ASDU-address 2002object 15 777 200 ... 15 777 215 ASDU-address 38002object 16 777 200 ... 16 777 215
20 and 380kV20 and 380kV
Example:ASDUs for 380 kV start with 380... ,for 110 kV with 110... and for 20kV with 20...,LINK-addresses incorporate the line no.
1 2 3 4
5
1 25061 5062
501502
504505
���� ��
Example protocol -101 at a utility
Alle switchyards have a plant numberLink-address = plant number 0 ... 4095
The ASDU address incorporates the link address and the voltage level coded
ASDU-address 0 ... 65 535
The object address contains the bay number, the information type, group type of high voltage equipment, etc
Information object, range at RTU560, if 24 BIT selectet:0 ... 16 777 215
���� ��
protocol -101, example ASDU, details
Voltage level 0 ...7Plant number0 ... 4095
20 - bit is transmittedat first
Voltage level, 4 Bit: 0 ... 15
plant number , 12 Bit: 0 ...4095 is also used for LINK-address
2 informations in ASDU address:
���� ��
protocol -101, example object address, details
Base element , 8 Bit: 0 ... 255
base element-(BE)-group , 3 Bit: 0 ...7 ( pol U, V, W - if equipment BM = transformer)
equipment-(BM)-group, 3 Bit: 0 ...7 (... transformator, coil, protection....)
information group, 4 Bit: 0 ...15 (system informations, measurements...)
bay number, 6 Bit: 0 ... 63
5 informations in object address:
���� ��
RTU560, Example defintion of a structured address
���� ��
RTU560, Example of a structured data point address
���� ��
Example protocol -104: ASDU-address, object
protocolIEC60870IEC60870--55--104104
RTU560RTU560
RTU 560RTU 560ASDU-address 65 534object 14 777 215 ... 14 777 300
ASDU-address 444object 30 ... 50
RTU 560RTU 560ASDU-address 34object 1 017 ... 1 100
RTU 560RTU 560ASDU-address 4object 16 777 200 ... 16 777 215
RTU 560RTU 560
ASDU-address 17object 1 ... 11
LAN oder WAN
Beim -104-protocol entfällt die LINK-address auf Datenpunktebene:(therfore IP- and Gateway-addresses at ETH-level)
���� ��
RTU560, Address Example with subRTUs, RTUtil default principle
RTUHeidelberg
RTUMannheim
RTUMutterstadt
NCC1 NCC2
-101 line
-101 sublineredundant
-101 subsubline
-104 line
DPI Mu yy -104line -101line -101subline -101subsublineIP or Link 199.5.5.51 3 4 17ASDU 222 222 412 366OBJEKT 1354 1354 4303 5703
DPI Ma xy -104line -101line -101sublineIP or Link 199.5.5.51 3 4 ASDU 221 221 281OBJEKT 917 917 1004
DPI Hd xx -104line -101lineIP or Link 199.5.5.51 3 ASDU 220 220 OBJEKT 483 483
Link 17
Link 4
Link 3IP 199.5.5.51
These default addresses maynot be unique in your system.Check, if you can live with it.
���� ��
RTU560, Address Example with subRTUs
RTUHeidelberg
RTUMannheim
RTUMutterstadt
NCC1 NCC2
-101 line
-101 sublineredundant
-101 subsubline
-104 line
DPI Mu yy -104line -101line -101subline -101subsublineIP or Link 199.5.5.51 3 4 17ASDU 222 222 222 222OBJEKT 1354 1354 1354 1354
DPI Ma xy -104line -101line -101subline IP or Link 199.5.5.51 3 4 ASDU 221 221 221 OBJEKT 917 917 917
DPI Hd xx -104line -101lineIP or Link 199.5.5.51 3 ASDU 220 220 OBJEKT 483 483
Link 17
Link 4
Link 3IP 199.5.5.51
���� ��
MicroSCADA and RTU560, RTUtil-configuration just copied
RTUHeidelberg 1
RTUHeidelberg 2
MicroSCADA
-101 line
Link addres 4
Link addres 3
Not nice - but possible:RTU Heidelberg 2 is a copy of RTU Heidelberg 1.ASDU-adresses and Object-adresse are the same in bothRTUs. Only the link address in Heidelberg 2 is modified.
Usually customers modify at least the ASDU-Addresses in the copied RTU also.
The MicroSCADA works with polling and stationaddresses. Polling Address PA in MicroSCADA = link address of RTUStation Address AA in MicroSCADA is = ASDU address in RTU
���� ��
Telegram format RP571, variable length, created ca.1992, specific adress concept
variable length = 01101000, fixed length frame format = 00010000START CHARACTER
LENGTH
LENGTH
VALUE
START CHARACTER
Router RTU NO.
FCODE
PROCESS RTU
BLOCK NO.
Überwachungsrichtung: 7 bit Funktionsfeld, RichtungsbitExample IDM Prio 1= 0011000 0 = Indication Message without Status
command direction: 2 bit seq.number, Monolog/Dialog, 4 bit function code,direction bit
Example: 00000100 (Length entfällt bei fixed length frame format)
variable length = 01101000, fixed length frame format = 00010000
Example: 00000100 Wiederholung aus Sicherheitsgründen, “ )
Example: 00000101 = RTU Nr.5 Dezimal
Example: 00010001 = RTU Nr.17 Dezimal
Checksum
STOP CHARACTER 00010110
VALUE
BLOCK NO.
VALUE
BLOCK NO.
0001011010100000
���� ��
ASDU IEC 60870-5-101 <--> RP571 - correspondant
0,1 ms ab Mitternacht
IEC-objectaddress
Startbyte bei variabler Telegrammlength 0110 1000
0000 1001
0000 1001
0110 1000
0000 0001
0101 0010
1101 0010
0000 0001
length (# Datenbytes ab Routeraddress)
Checksum
0001 0110
length (Wiederholung)
Startbyte (Wiederholung)
Routeraddress
Funktionkode ERMI
RTU-address bw. SCU-address210dez = D2 hex
Blocknr.1...255
STOP Byte
1000 1001Sequenznummer 0...255
bit 15, Typ DI,EIN
Unbelegt, timequalität, notsync.,overflow
Tag des Moants
0000 0000
1000 1001
0000 1101
0010 1101
0000 0101
0000 1100
0000 0001
0000 0100
0000 0010
0000 1011
0000 0001
1101 0010
0000 0010
Data Unit Identifier / Identifikationsfeld des Dateneinheit
Information Object 1
Information Object n ...
4 = Doppelindication mit time
2 Information objecte
Übertragungsursache:11 = Rückindication verursacht durch Fernbefehl
Stationsaddress 1
gültig, aktuell, not ersetzt, not blocked, Reserve, EIN bestimmt
Duale time, 3 Octette
0001 0000
0001 0000
0000 0000
not available in the othertyp
���� ��
IEC 60870-5-103; Informative Interface of Bay Protection
Physical Layer: Fibre optics or RS 485Link Layer: Unbalanced transmissionApplication layer:
� Time synchronization� Time-tagged fault information� Operational measurands� Control of functions e.g. autoreclosure� Analog and digital disturbance data (samples)� Generic services
Details: Advanced training course RTU560
���� ��
IEC60870-5-104
� � �� � �� ��� � � �� � � ��� � �� � � �� � �
� � � ��� �� � � � � �� � � �� � � � ��
� � � �� ��� � �! � �" � # �� � � � � $ � �%& ' �� ��� ������
� � � ( �� �� � � � � ��� � � � � ���� � $��� �
IEC 60870IEC 60870--55--104104EN 60870EN 60870--55--104104
���� ��
IEC 60870-5-104 general system architecture
Application -101transport Interface
TCP/IP
OUTSTATIONRTU560
TCP/IP
Tansport InterfaceApplication -101
TCP/IP
Tansport InterfaceApplication -101
CENTRALSTATION
RouterRouter
RouterRouter
LANLANRouterRouter
redundant redundant optionoption
LANLAN
NetworkX.25, ISDN, FR
���� ��
IEC 60870-5-104 , benefits of router use
� No network specific software in the end systems� No „routing“-capability in the end systems� No network-management in the end systems� Use of standard RTUs facilitated � Use of standard routers possible � Change of network just needs change of router� Future-proof
���� ��
Selection of application functionsof IEC 60870-5-5 acc. to IEC 60870-5-101
Initia-lization
Selection of ASDUsof IEC 60870-5-101 and IEC 60870-5-104
APCI Application Protocol Control InformationUser TCP interface (transport Interface)
UserProcess
transportlayer (4)Networklayer (3)
Linklayer (2)Physicallayer (1)
Applicationlayer (7)
Selected TCP transmission control protocol
RFC = Request for Comments
IEC 60870-5-104 , protocol structure
Selected IP Internet protocol
EthernetLLC logical lnk controlMAC medium access controlLAN ISO 8802
For comparism,-101 definitions:
n.a.
60870-5-160870-5-2
ISO, ITU-T
n.a.
60870-5-360870-5-460870-5-5
���� ��
transportlayer (4)
Networklayer (3)
Linklayer (2)
Physicallayer (1)
RFC 793 (TRANSMISSION CONTROL PROTOCOL)
RFC 791 (INTERNET PROTOCOL)
RFC 894(Transmission of
IP Datagramsover Ethernet
Networks)
IEEE 802.3
RFC = Request for Comments = Internet Standard Designation
RFC 1661(PPP)
X.21
RFC 1662(PPP in HDLC-like framing)
IEC 60870-5-104 , TCP/IP „Protocol Suite“ RFC 2200
���� ��
TCP - Transmission Control Protocol
Functions:• Cutting of data stream from aplication layer intosegments (max. 65 kByte)• creates safe connection between end systems by time supervision / acknowledgement / fault recognition / repetition of send data• adapts transport adresses to network addresses• multiplex mechanism (e.g. RTU560 service based uponInternet Explorer runs via LAN in parallel with IEC870-5-104 telegrams)
Services:• Establishing a transport connection• Data transfer• Abortion of transport connection
���� ��
IP - Internet Protocol
IPv4 - Adress length 32 bitIPv6 - Adress length 128 bit (backwards compatibel to IPv4)
Services:• Cut of segments into fragments (size of fragments can beset according to Ethernet requirements)• Transmission of fragments as „datagram“ from senderthrough the network to the receiver• a transmission path in the nework is searched for eachdatagram independant from other datagrams.• Datagrams can be lost • Datagrams can overtake other datagrams
Sorting in the right seqence and check for lost of faultydatagrams is realized on TCP level.
���� ��
IEC 60870-5-104 , user TCP interface
User TCP interface• stream oriented• no start/stop mechanism for ASDUs from IEC60870-5-5101
ASDU = application service data unit, see IEC60870-5-101 and -3
APDU = application protocol data unit
APCI = application protocol control defintion
Therefore are additionally required:
���� ��
IEC 60870-5-104 and DNP , APDU = APCI + ASDU
ASDUapplication
service data unit,max. 249 octets
APDUapplication
protocoldata unit
APCIapplication protocol
control defintion,6 octets
Length,max. 253
START 68HLength of APDU
Control field octet 1Control field octet 2Control field octet 3Control field octet 4
ASDU defined inIEC60870-5-101
andIEC60870-5-104
andDNP
Total max. 255 octets
���� ��
IEC 60870-5-104 , I - format
I format: numbered information transfersend sequence number N(S)send sequence number N(S)
receive sequence number N(R)receive sequence number N(R)
LSB
MSB
MSB
Control field octet 1Control field octet 2Control field octet 3Control field octet 4
LSB
���� ��
IEC 60870-5-104 , S - format
S format: numbered supervisory transfer00
receive sequence number N(R)receive sequence number N(R)
LSB
MSB
Control field octet 1Control field octet 2Control field octet 3Control field octet 4
���� ��
IEC 60870-5-104 , U - format
U format: unnumbered control functionsTESTFR STOPDT STARTDT 1 1
000
Control field octet 1Control field octet 2Control field octet 3Control field octet 4
���� ��
IEC 60870-5-104 , user data transfer initialisation (link layer)
Ack V(S) V(R)
0 0 0
Station Ainternal counters V after
APDU was sent or received
Station Binternal counters V after
APDU was sent or received
0 0 0V(S) V(R) Ack
U (STARTDT act)
U (STARTDT con)
The controlling station must activate the user data transfer by sending STARTDT act.
The controlled station answers STARTDT con.
If STARTDT is not confirmed, the connection is closed by the controlling station.
���� ��
U-format, User data transfer initialisation, example
���� �� �
IEC 60870-5-104 , undisturbed sequences of I - APDUs
Ack V(S) V(R)
0 0 0
Station Ainternal counters V after
APDU was sent or received
Station Binternal counters V after
APDU was sent or received
0 0 0V(S) V(R) Ack
123
I(0,0)I(1,0)I(2,0)1
23
12 1
2
I(0,3)
I(1,3)
2
4
4
3
I(3,2)
1...3 O.k., deletebuffer1...2
O.k., deletebuffer
15 bit numbers0...32767
���� �� �
IEC 60870-5-104 , IP address and port number
Every TCP address consists of
• IP address (example: 199.5.5.31)
• port number The port number is unique within a system.The port number in telecontrol-IEC60870-5-104-systems is always 2404
���� �� �
Port Numbers
Ports are used in the TCP [RFC793] to name the ends of logical connections which carry long term conversations. For the purpose of providing services to unknown callers, a service contact port is defined.
���� �� �
Port Numbers
The port numbers are divided into three ranges:
1. the Well Known Ports0 - 1023
2. the Registered Ports 1024 - 49151
3. the Dynamic and/or Private Ports49152 - 65535
http://www.iana.org/assignments/port-numbers
���� �� �
IEC 60870-6 (former IEC 870-6-503 TASE.2)
Telecontrol Application Service Element (TASE.2) protocol (also known as Inter-Control Centre Communications Protocol, ICCP),purpose:
Data exchange over Wide Area Networks (WANs) between a utility control centre and other control centres, other utilities, power pools, regional control centres, and Non-Utility Generators.
Data exchange information consists of real-time and historical power system monitoring and control data, including measured values, scheduling data, energy accounting data, and operator messages.
This data exchange occurs between one control centre's SCADA/EMS host and another centre's host, often through one or more intervening communications processors.
���� �� �
Standard for future substation automation systems (SAS)
IEC 61850
Communication Networks and Systems
in Substations
IEC 61850 is a communication and engineering standardtargeting interoperability between devices, systems and
tools from different vendors
���� �� �
IEC 61850 Reference Model
���� �� �
IEC 61850 Modelling Approach
Examples:
switch position withquality and time stampsimiliar to object definitionin IEC870-5-103
circuit breaker XCBR,
distance protection PDIS,..
integer,
boolean,
time tag
���� �� �
Examples of Logical Nodes according to IEC 61850-7-4
LN: Logical node zero (only mandatory (M) data) Name: LLN0LN: Physical device information (only M data) Name: LPHDLN: Switch controller (only M data) Name: CSWILN: Alarm handling (only M data) Name: CALHLN: Generic automatic process control (all data) Name: GAPCLN: Generic general IO (all data) Name: GGIOLN: Measurant Unit (all current and voltage values) Name: MMXULN: Telecontrol Interface (all data) Name: ITCILN: Telemonitoring Interface (all data) Name: ITMI
���� �� �
Line Protection
Traditional approach
���� ���
Line Protection
Logical Device“Breaker IED”
LN PCTRLN PCTRLN XCBR
Logical Device“Breaker IED”
LN PCTRLN PCTRLN XCBR
IEC 61850-8-1 / -9-2
Introducing breaker IED’s and protection bus
���� ���
IEC 61850 - parts
Part 1 Introduction and OverviewPart 2 GlossaryPart 3 General requirementsPart 4 System and project managementPart 5 Communication requirements for functions and device
modelsPart 6 Substation automation system configuration language
(SCL) (e.g. ABB adapter SPA-ZC400: CID files can be exportedto other tools, ICD files are imported relay applications)
Part 7 Basic communication structure for substation and feederequipment7.1 Principles and models7.2 Abstract communication service interface (ACSI)7.3 Common data classes7.4 Compatible logical node classes
���� ���
IEC 61850 - parts
Part 8.1 Specific communication service mapping (SCSM) -mapping to manufacturing message specification (MMS) (e.g. ABB adapter SPA-ZC400: Applications of REx541/3/5 protection and control devices can be accessed at the verticalcommunication)
Part 9.1 Specific communication service mapping (SCSM) – serialunidirectional multidrop point-to-point link
Part 9.2 Specific communication service mapping (SCSM) –mapping on IEEE802.3 based process bus
Part 10 Conformance testing