4.2.1 Protocol : IEC 60870-5-101


 

Telegram structure

IEC 60870-5-101 protocol standard admits only frame format FT 1.2 defined in IEC 60870-5-1 ( Transmission frame formats ). Formats with fixed and variable block length are admitted. Also the single control characters E5H and A2H are admissible.

Each telegram consists of single UART characters, one start bit, 8 bits information, 1 parity bit and one stop bit. The transmission of data bytes takes place after the principle "LSB first". It is an asynchronous protocol with hamming distance = 4. Via the parity bit in the asynchronous character each byte is secured with d = 2. The telegram section, defined via the block length, is additionally secured with a check sum, whereby a hamming distance of d = 4 is reached. As the start sign and the block length are not contained in the check sum they are transmitted twice and therefore the same high transmission security of d = 4 is reached. The checksum is the arithmetic sum over all user data octets.

 

Information about the structure of the telegram see
<IEC 60870-5-101 : Telegram structure>

 


IEC 60870-5-101 : Configuration

 

 

With the channel button ( channel 1 ...12 ) on the bottom following settings are possible :

 

Each character has one start bit ( binary = 0 ), 8 information bits and normally one even parity bit and one stop bit ( binary = 1 ).

 

Interface

For each channel any COM port ( COM 1 till COM 24 ) can be selected.

Modem

An individual modem can be installed and connected for each channel. LIAN 98 is able to process up to twelve modems in the range of COM1 till COM24 simultaneously. Select here the modem assigned to the selected channel. Normally this assignment will be recognized by LIAN 98 and the corresponding modem will be set.

Setup Modem

The settings of the modem must be executed via the windows control panel "telephone and modem options". With this button you can check the modem settings and see if they correspond to the LIAN 98 configuration.

Connection type

Attention, the connection type should be set to full duplex for monitoring !
 

Full duplex :

Most of the modems are full duplex and can transmit data in both directions simultaneously. DTE ( LIAN 98 ) and DCE ( Modem ) work simultaneously as transmitter and receiver. None of both transmitters has to wait for clearance for transmitting data. Therefore the signals RTS and CTS are not significant. Sure, LIAN 98 is setting the control signals RTS and DTR to 1 when it is ready for transmission and receipt but it does not check the signals CTS and DSR.

Half duplex :

In case of a half duplex connection DTE ( LIAN 98 ) as well as DCE ( Modem ) can work as transmitter and receiver, hereby only one data line ( 2-wire connection ) is available that can be used alternately for transmission or receipt of data. The control signals RTS and CTS are used in order to define the allocation of transmission or receipt. When LIAN 98 should work as transmitter it activates the signal RTS and waits for the confirmation of the modem via the signal CTS. After the receipt of the signal CTS the data are transmitted and after the transmission of the data the signal RTS is set to 0. In each other case LIAN 98 is working as receiver only.

As long as the LIAN 98 software is ready for transmission and receipt the signal DTR is activated in order to show the modem that LIAN 98 is ready for operation, as well the software expects an activated DSR signal from the modem.

RTS Leading delay

0 ... 1000 msec
This parameter ist only used for the connection type "half duplex" and is determined by the initial transient behaviour of the used transmission equipment.
The RTS Leading defines the delay time from activating RTS signal to transmitting the first character and is used for modems whithout the hardware handshake signals "RTS and CTS". In this case the "RTS signal" must be led back over the "CTS line" to the PC with the help of a brazing bridge in the monitor cable. Dependent of the used modem it may be necessary to connect additionally the DTR-pin with the DSR-pin.
This function is deactivated if the "Leading and the Trailing" is set to NULL and therefore the control signals are analyzed diectly from the modem.

RTS Trailing delay

0 ... 1000 msec
This parameter ist only used for the connection type "half duplex" and is determined by the final transient behaviour of the used transmission equipment.
The RTS Trailing defines the delay time from the last character transmitted up to the RTS signal is deactivated.
This function is deactivated, if the "Leading and the Trailing" is set to NULL.

 

Baud rate

Transmission speed : 25 - 115200 baud ( variable )

Data byte

8 bit ( fixed )

Stop bit

1 bit ( variable )

Parity

even ( variable )

Time out

1 - 9999 msec ( variable )

 

Transmission procedure
B :
balanced

If balanced transmission procedure is used, each station may initiate message transfers. The balanced mode is restricted to "point-to-point" or "multiple point-to-point". Balanced mode can be used in a full duplex transmission.

U :
unbalanced

Unbalanced transmission is used in SCADA systems in which a master station controls the data traffic by polling outstations sequentially. The master station is the primary station that initiates all message transfers while outstations are secondary stations ( slaves ) that may transmit only when they are polled.
The unbalanced mode can be used generally, but must be used in party line configuration.

 

Settings in the channel window

 

 

Link address fields

0... 2, structured or unstructured can be selected.

The link address field is optional. If it exists it contains of one or two octets in the link layer. The length of the link address is a parameter defined by the system.

. Output format

dec / hex

The display of the LINK address in the screen output is done corresponding to the setting of the display format decimal or hexadecimal.

. Bit structure

The 16 bit LINK address can be divided in maximum 4 bit-fields. In the default division the address is byte by byte structured ( 8 + 8 ). But also any other values can be set ( e. g. 2 + 6 + 8 ). The entry begins always from the higher bit and the sum of all bits must be of course 16.

ASDU address fields

1... 2, structured or unstructured can be selected.

The ASDU address field contains of one or two octets in the data unit identifier. The length of the common address of the ASDU is a parameter defined by the system.

. Output format

dec / hex

The display of the ASDU address in the screen output is done corresponding to the setting of the display format decimal or hexadecimal.

. Bit structure

The 16 bit ASDU address can be divided in maximum 4 bit-fields. In the default division the address is byte by byte structured ( 8 + 8 ). But also any other values can be set ( e. g. 2 + 6 + 8 ). The entry begins always from the higher bit and the sum of all bits must be of course 16.

Object address fields

1... 3, structured or unstructured can be selected.

The object address field consists of one, two or three octets in the identifier of the information object. The length of the information object address is a parameter defined by the system.

. Output format

dec / hex

The display of the object address in the screen output is done corresponding to the setting of the display format decimal or hexadecimal.

. Bit structure

The 24 bit object address can be divided in maximum 6 bit-fields. In the default division the address is byte by byte structured ( 8 + 8 + 8 ). But also any other values can be set ( e. g. 2 + 6 + 4 + 4 + 8 ). The entry begins always from the higher bit and the sum of all bits must be of course 24.

Originator address

yes / no

 


IEC 60870-5-101 : Simulation

 

IEC 60870-5-101 : RTI ( Master )-Simulation

 

In the following PDF file a typical master simulation with LIAN 98 is shown :

<Master Simulation with LIAN 98>

 

LIAN 98 as a MASTER can communicate in the polling mode ( unbalanced ) with up to 32 connected substations simultaneously.

 

 

Link address
( address of the target station )

All telegrams to be sent are provided with the link address of the SIM list during master simulation.

Exception for unbalanced mode :
. If the link address 255 ( one octet address ) or 65535 ( two octet address ) of a "BROADCAST command" is inserted in a telegram of the TDB buffer, the telegram will be transmitted unchanged with the address already inserted.
. If a link address of the scan list is inserted in the telegram it will be transmitted unchanged with the address already inserted.

Address of ASDU
( address of the target station )

All telegrams to be sent are provided with the ASDU address of the SIM list during master simulation.

Exception for unbalanced mode :
. If the ASDU address 255 ( one octet address ) or 65535 ( two octet address ) of a "BROADCAST command" is inserted in a telegram of the TDB buffer, the telegram will be transmitted unchanged with the address already inserted. 
. If a ASDU address out of the scan list is inserted in the telegram, it will be transmitted unchanged with the address already inserted.

Originator address
( Address of the senderr )

All telegrams to be sent during RTI simulation will be provided with the origin address of the SIM list..

Response timeout

1 - 30 000 msec

The IEC 60870-5 standard specifies a fixed time out interval to be used for repeated frame transmissions. The time out interval and maximum number of retries are configurable and appropriate values will depend on the transmission system.

This parameter determines the time in milliseconds that the program LIAN 98 as primary station at most has to wait for an acknowledge before the last transmission is repeated.

Number of frame retries

0 - 255

Via this parameter it is defined how many times the transmission is to be repeated when the acknowledge is missing.

Enable station initialization

yes / no

The primary station synchronizes its link with the secondary station by transmitting "Request link status" and "Reset of remote link". The secondary station responds with "Status of link" and "ACK". When "ACK" was received from the primary station the link connection is established.

Request link status

TDB buffer number where the message "Request link status" ( PRM = 1, function 9 ) is stored.

Reset of remote link

TDB buffer number where the message "Request link status" ( PRM = 1, function 0 ) is stored.

Enable clock synchronization

yes / no

After the initialization of the communication LIAN 98 will transmit first of all a time synchronization command and will repeat it cyclic ( Clock SYNC cycle time ), if this parameter is activated.

Clock SYNC cycle time

1 - 1440 minutes

Dependent on this time LIAN 98 as master station will transmit the time synchronization command continually.

Clock SYNC command

TDB buffer number where the command "C_CS_NA_1" ( ID 103, COT 6 ) is stored.

Use system date/ time

yes / no

The system time of the PC will be taken over into the time synchronization command ( ID 103, COT 6 ) before the command will be transmitted, if this parameter is activated. Alternatively the telegram remains unchanged as before edited by the user.

Enable general interrogation

yes / no

After the initialization of the communication LIAN 98 will transmit a general interrogation command and will repeat it cyclic ( GI cycle time ) when necessary, if this parameter is activated.

GI cycle time

1 - 1440 minutes

Dependent on this time LIAN 98 as master station will transmit the general interrogation command continually.

GI command

TDB buffer number where the command "C_IC_NA_1" ( ID 100, COT 6 ) is stored.

Insert scan addresses
Number of addresses
delete
insert

Unbalanced : ( party line )
All stations to be processed at this line have to be inserted into the scan list. LIAN 98 establishes the connection to this stations and interrogates continuously the user data of this stations.

In order to insert the addresses please proceed as follows :

Activate "Insert scan addresses" ( button "insert" will be displayed ).
Insert in the fields "Link address" / "Address of ASDU" the station to be entered in the scan list.
Take over the addresses into the scan list by clicking "insert".
When all stations are inserted, please deactivate "insert scan addresses" ( button "insert" disappears ).

In order to delete a station out of this list select it and click "delete".

Disable automatic station scan

Unbalanced : yes / no

When the communication establishment is finished, LIAN 98 starts automatically the request of the user data ( class 1/ 2 ). If this requests are not wanted it can be deactivated here.

Request user data class 1

Unbalanced :
TDB buffer number where the command "Request user data class 1" ( PRM = 1, function 10 ) is stored.

Request user data class 2

Unbalanced :
TDB buffer number where the message "Request user data class 2" ( PRM = 1, function 11 ) is stored.

Scan delay

Unbalanced : 0 - 30 000 msec

This parameter determines the time that the program LIAN 98 delays the next request of data class 1 or 2.

Generate execute command

yes / no

An "Activate Execute Command" ( COT 6, execute command ) is automatically sent from LIAN 98 during Master simulation after the receipt of an "ACTCON Respond" ( COT 7, select command )  when this parameter is activated.

ACTCON response timeout
( activation confirmation )

This parameter defines the time in seconds that the program LIAN 98 as primary station at most has to wait for an "ACTCON Respond" ( COT 7 ) or "DEACTCON Respond" ( COT 9 ) before the message "*E: ACTCON missing !" is displayed.

ACTTERM response timeout
( termination activation )

This parameter defines the time in seconds that the program LIAN 98 as primary station at most has to wait for an "ACTTERM Respond" ( COT 10 ) before the message "*E: ACTTERM missing !" is displayed.

Enable test procedure

yes / no

The test procedure is used to check the complete loop from the controlling station to the controlled station and back.

A test command is sent from LIAN 98 after the initialization of the communication and repeated cyclic when necessary, if this parameter is activated.

Test cycle time

0 - 255 seconds

Depending on this time LIAN 98 as master station will continually send the test command.

Test command

TDB buffer number where the test command "C_TS_NB_1" ( ID 104, COT 6 ) is stored.

 

IEC 60870-5-101 : RTU ( Slave )-Simulation

 

In the following PDF file a typical slave simulation with LIAN 98 is shown :

<Slave Simulation with LIAN 98>

 

 

Link address

All telegrams to be sent will be provided with the link address out of the SIM list during slave simulation.

Address of ASDU

All telegrams to be sent will be provided with the ASDU address out of the SIM list during slave simulation.

Originator address

All telegrams to be sent during slave simulation will be provided with the origin address out of the SIM list ( = address of the master ).

Response timeout

Balanced : 1 - 30 000 msec

The IEC 870-5-101 standard specifies a fixed time out interval to be used for repeated frame transmissions. The time out interval and the maximum number of retries are configurable and appropriate values are depend on the transmission system.

This parameter determines the time in milliseconds that the program LIAN 98 as primary station ( only balanced ) at most has to wait for an acknowledge before the last transmission is repeated.

Number of frame retries

Balanced : 0 - 255

Via this parameter it is defined how many times the last transmission is to be repeated when the acknowledge is missing.

Station initialization

Balanced : yes / no

The primary station synchronizes its link with the secondary station by transmitting "Request link status" and "Reset of remote link". The secondary station responds with "Status of link" and "ACK" respectively, and when the "ACK" is received in the primary station the link connection is established.

The initialization procedure may be completed with the message "End of initialization" ( ID 70 ), sent by the controlled station.

Request link status

Balanced :
TDB buffer number where the "Request link status" message "Request link status" ( PRM = 1, function 9 ) is stored.

Reset of remote link

Balanced :
TDB buffer number where the fixed length message "Reset of remote link" ( PRM = 1, Function 0 ) is stored.

End of initialization

yes / no

TDB buffer number where the message "M_EI_NA_1" ( ID 70, COT 4 ) is stored.

Enable clock synchronization

yes / no

The current system time of the PC is given back in the activation confirmation ( ACTCON ) of a clock synchronization command, if this parameter is activated. Otherwise the received time will be only mirrored.

Set new system date/ time

yes / no

The system time of the PC will be adjusted to the received time values of the time synchronization command ( ID 103, COT 6 ), if this parameter is activated.

Time correction
( for system time of the PC )

0 - 9 999 msec

A correction value can be entered for the setting of the PC system time with a time synchronization command. It will be added onto the received value in the synchronization command.

Clock SYNC command
( spontaneous )

TDB buffer number where the time message "C_CS_NA_1" ( ID 103, COT 3 ) is stored.

C_CS_NA_1 in monitoring direction can be used to a spontaneous transmission of the time additionally to the procedure after 6.7 of IEC 60870-5-5. (e.g. change of hour )

Use system date/ time

yes / no

The system time of the PC will be inserted in telegrams with time stamp before transmission, if this parameter is activated. Otherwise the telegram remains unchanged as before edited by the user.

Use E5H for respond
on Request data class 2

Unbalanced : yes / no

Data acquisition is done via cyclic transmission of the short message  "Request data class 2" ( function 11 ) in interrogation systems. Substations that have no data of this class response normally with the short message "data not available" ( FKT=9 ). It can also be answered with the single sign "E5H" if the ACD bit = 0.

Use only data class 2 messages

Unbalanced : yes / no

 

 

 

Generate ACTCON respond

yes / no

When this parameter is activated, LIAN 98 will transmit automatically an "Activate Confirm" ( COT 7 ) or "Deactivate Confirm" respond ( COT 9 ) during slave simulation after the receipt of an "Activate" ( COT 6 ) or "Deactivate" command ( COT 8 ).

Generate ACTTERM respond

yes / no

When this parameter is activated, LIAN 98 will transmit automatically an "Activation Termination" respond ( COT 10 ) delayed for "
ACTTERM delay time" during slave simulation after the receipt of an "Activation" command ( COT 6 ).

ACTTERM delay time

This parameter defines the time in seconds that the program LIAN 98 delays the transmission of the "Activation Termination" respond ( COT 10 ).

 

IEC 60870-5-101 : Respond on primary functions ( quittances )

 

 

LIAN 98 receives a message with one of the following function codes from a primary ( PRM = 1 ) station and will reply the acknowledge message in the specified TDB buffer.

Normally after installing the software, there are already edited confirm/ respond messages ( 2 octets address field ) in the TDB buffers from 480 up to 495. When you have a different address structure, you have to modify this buffers.

 

Function codes of the control field in messages sent from the primary station ( PRM = 1 )

 

Function Frame type Service function FCV
0 Send/ CONFIRM expected Reset remote link 0
1 Send/ CONFIRM expected Reset user process 0
2 Balanced : Send/ CONFIRM expected Test function for link 1
3 Send/ CONFIRM expected User data 1
4 Send/ NO REPLY expected User data 0
5 reserved    
6 Reserved for special use by agreement.    
7 Reserved for special use by agreement.    
8 Unbalanced : Request for access demand/ RESPOND expected Expected response specifies access demand 0
9 Request/ RESPOND expected Request status of link 0
10 Unbalanced : Request/ RESPOND expected Request user data class 1 1
11 Unbalanced : Request/ RESPOND expected Request user data class 2 1
12 reserved    
13 reserved    
14 Reserved for special use by agreement.    
15 Reserved for special use by agreement.    

 

Function codes numbers in the control field used from the secondary station ( PRM = 0 )

 

Function Frame type Service function
0 CONFIRM ACK : Positive acknowledgement
1 CONFIRM NACK : Message not accepted, link busy
2 reserved  
3 reserved  
4 reserved  
5 reserved  
6 Reserved for special use by agreement.  
7 Reserved for special use by agreement.  
8 Unbalanced : RESPOND User data
9 Unbalanced : RESPOND NACK : Requested data not available
10 reserved  
11 RESPOND Status of link or access demand
12 reserved  
13 Reserved for special use by agreement.  
14   Link service not functioning
15   Link service not implemented

 

IEC 60870-5-101 : Simulation procedures

 

Simulation of the communication services :

LIAN 98 orientates to the function code and the PRM bit in the control field of the link layer :

The parameter [response timeout] determines the time in milliseconds that LIAN 98 after transmitting a command or request at most has to wait for an acknowledge before the transmission is repeated or a new message is sent. Via the parameter [number of frame retries] it is defined how many times the message is to be repeated. As long as the program LIAN 98 is waiting for an acknowledge no further telegram is sent. Send records are put down in the send list temporarily and will be sent after the receipt of the acknowledge.

LIAN 98 transmits dependent on the function code of a primary message automatically acknowledges dependent on the above defined TDB buffer numbers. The corresponding frames must be of course edited in the declared TDB buffer.

The program LIAN 98 also alternates the FCB bit for each new SEND/ CONFIRM or REQUEST/ RESPOND transmission directed to the secondary station. Therefore the primary station keeps a copy of the frame count bit per secondary station. In case of a reset command the FCB bit is always zero and after the response of these commands the secondary station will always be set to expect the next frame primary to secondary with FCV = valid ( FCV = 1 ) in order to have the opposite setting of FCB.

In balanced transmission mode the DIR bit in the control field of the link layer is set to 1 during master simulation and cleared for slave simulation by LIAN 98 for all telegrams to be sent. In the unbalanced transmission mode the DIR bit is always set to NULL.

 

Station initialization

The primary station synchronizes its link with the secondary station by transmitting "Request status of link" ( FKT = 9 ) and "Reset of remote link" ( FKT = 0 ). The secondary station responds with "Status of link" ( FKT = 11 ) and "ACK" ( FKT = 0 ) and when the "ACK" is received of the primary station the connection is established.

The station initialization will be done by LIAN 98 automatically when the master (RTI)- or the slave (RTU) simulation is started.

The RTI simulation will initiate a test command to start the test procedure after the connection is established and the test procedure is enabled. Optional the automatic time synchronization and the general interrogation can be activated.

In case of the RTU simulation LIAN 98 will transmit an "End of initialization/ M_EI_NA_1" ( ID 70, COT 4 ) message, if it's parameterized in the SIM list.

Data acquisition by polling
( unbalanced )

Data acquisition is used in unbalanced data transmission procedures to update the controlling station with actual states of process variables in the controlled stations. The controlling station performs polling by interrogating ( function code 10 and 11 ) the controlled stations sequentially. Controlled stations may only transmit when they are polled.

Polling is done automatically by LIAN 98 when (RTI) simulation is started and the link transmission procedure in the configuration is set to "U = unbalanced" and is not deactivated via the SIM list.

 

Station initialization in balanced mode.

 

Simulation of the application functions :

 

Cyclic data transmission

Cyclic data transmission is used to provide a continuous updating function of current values of process variables in balanced and unbalanced transmission procedures.

A cyclic data transmission is done in LIAN 98 via sending cyclic send jobs ( see "transmit" ) or a not terminated send sequence ( see "send sequence list" ).

Acquisition of events
( unbalanced )

There are two classes of data specified, class 1 data contains spontaneous data and class 2 data contains cyclic data. Also defined is the link service "Request user data class 2" ( FCT 11 ) used for polling controlled stations. Two consequences are possible in each controlled station when the polling telegram is received:

No spontaneous data are available :
In this case the link layer of the controlled station responds by a fixed frame message "Requested data not available" ( FCT 9 ) and the controlling station continues its polling procedure by polling the next controlled station.

Spontaneous data are available :
In this case the controlled station also responds by the fixed frame message "Requested data not available" ( FCT 9 ) but this time with the "ACD bit" set, indicating that spontaneous data are available and waiting for transfer. The controlling station then sends a "Request user data class 1" ( FCT 10 ) message, and the controlled station responds by transmitting an event ASDU.

A spontaneous data transmission can be done in the RTU simulation in LIAN 98 via sending single send jobs ( see "transmit" ) or a send sequence ( see "send sequence list" ).

General interrogation

The general interrogation application function is used to update the controlling station after the station initialization procedure or when the controlling station detects a loss of information.

The general interrogation procedure of the controlling station requests the controlled station to transmit the actual values of all its process variables. The interrogation procedure is finished when the controlling station receives an "End of interrogation message".

The information transfer is triggered by an interrogation command ( ID 100, COT 6 ) message from the controlling station to the controlled station, which responds with an interrogation confirmation ( ID 100, COT 7 ) message. The controlled station transmits the interrogated information by means of one or more monitored information ASDUs. The last information ASDU is then followed by an "interrogation termination" message ( ID 100, COT 10 ), indicating that all information has been transferred.

The confirmation ( ACTCON ) and the termination of the general interrogation ( ACTTERM ) is done automatically in LIAN 98 if this is activated in the simulation list. Transmission of requested user data can be done via an entry in the action filter ( see "Action filters" ) or when process data are loaded by processing the data point list ( siehe auch "Simulate data points" ).

Clock synchronization

Date and time of controlled stations are initially synchronized by the controlling station after initialization and afterwards re-synchronized periodically.

A clock synchronization command ( ID 103 ) containing the full current clock time is sent from the controlling station. After the execution of the clock synchronization the controlled station generates a confirmation message which contains the local time before synchronization.

Command transmission

The controlling station sends a "SELECT command" ( ID 45... 50, COT 6 ) to the controlled station, which responds by a "SELECT confirmation" ( COT 7 ) message if it is ready to receive the announced command. The time from the "SELECT command" to the "SELECT confirmation" is controlled by a configurable timeout interval ( Response timeout ).

A successful select procedure may then be deactivated by a break off. This command is transmitted by a "BREAK OFF command" ( COT 8 ) and the controlled station responds by a "BREAK OFF confirmation" ( COT 9 ) message. The time between these messages is controlled by a timeout interval ( Response timeout ).

If appropriate, an "EXECUTE command" ( ID 45... 51, COT 6 ) is sent to the controlled station, which responds by an "EXECUTE confirmation" ( COT 7 ) message ( positive when the specified control action begins, otherwise negative ). This procedure is also non interruptible and the time from the "EXECUTE command" to the "EXECUTE confirmation" is controlled by a configurable timeout interval. An "EXECUTE termination" ( COT 10 ) message is issued from the controlled station when the command application procedure is completed successfully. The addressed equipment should now change its state, and the new state is indicated to the controlling station by a spontaneous data message.

The confirmations ( ACTCON ) for the "SELECT command" and the "EXECUTE command" or "EXECUTE termination" ( ACTTERM ) message is done automatically in LIAN 98 if this is activated in the simulation list. The transmission of the change of state can be done manually or via an entry in the action filter ( see "Action filters ). If process data are loaded and the corresponding data point is available in the list the change of state is sent out of the data point list ( siehe auch "Simulate data points" ).

Transmission of integrated totals

Integrated totals are values that are integrated over a defined period of time.

Parameter loading

Parameter loading is used to change predefined parameters, e.g. dead band values that define when analogue measurements are to be transmitted. Parameters can only be transmitted from the controlling station as a result of an operator command.

To load a new parameter value, the controlling station sends a PARAMETER LOAD command ( ID 110... 112 ) to the controlled station in order to load a new parameter. The PARAMETER LOAD command is acknowledged by the controlled station by transmitting a PARAMETER LOAD confirmation message.

Test procedure

The test procedure is used to check the complete loop from the controlling station to the controlled station and back.

The controlling station initiates a test command by sending a "TEST command" message ( ID 104, COT 6 ). This ASDU is mirrored by the controlled station as a "TEST confirmation" ( COT 7 ) message. The controlling station compares the transmitted TEST message with the mirrored message, and if the messages are identical the test result is positive.

File transfer

File transfers from controlled stations are mainly used to inform the controlling station of events that had occurred. It concerns the registration of extensive data records.

File transfers in command direction are mainly used for down-line loading of parameter lists of programs.

 

IEC 60870-5-101 : Simulate data points

 

All process dependent data are available in a data base system in the control center computer. LIAN 98 offers the possibility to import these process data and use it for the simulation. ( see : <PAR file : Process data description> )

 

 

Use data points
( PAR list )

yes / no

If a parameter list contains of valid process data they may also be used for the simulation. LIAN 98 takes into account this process data during simulation if this parameter is activated. For example LIAN 98 will send back to the master the correct change state of the switch after the receipt of a command ( ID 45, 46, 58 and 59 ) depending on the data point description.

 

 

Simulation range

The parameter list is organized line by line and can accommodate up to 5800 data points, each line is one data point.

With the activation of the process send button process telegrams are generated of all data points and sent, starting from "line from". The transmission will completed by "till line" or by repeatedly pressing of the button.

Line from

1 ... number of data points

LIAN 98 starts from this or any subsequent line with generating and sending of process telegrams. The condition is that the data type is in accordance with the simulation mode. The RTI simulation uses only data types in control direction and the RTU simulation data types in monitoring direction.

Line till

> line from ; maximum number of data points

LIAN 98 stops in this or a previous line generating and sending of process telegrams.

 

 

Gap time

0 ... 255 [sec]

Is the time that is observed between two consecutive process telegrams. If is set to 0 a gap of 100 msec is used.

Number of passes

1 ... 255

The processing of the simulation range can be repeated, depending on the parameter "number of passes".

 

Send change of state
on process command

yes / no

If this parameter is activated, LIAN 98 during RTU simulation will send back to the master the correct change of state of the switch after the receipt of a process command ( ID 45, 46, 58 and 59 ) provided that the indication is defined in the data point description ( PAR list ).

Send interrogated
information on GI command

yes / no

If this parameter is activated, LIAN 98 during RTU simulation will send interrogated information to the master after the receipt of a GI command ( ID 100 ) depending on the indications in the PAR list. The selection of the indications is limited by the simulation range "line from" and "line till".

Disturbance suppression

yes / no

 

Number of messages
per GI block

1 ... 128

This parameter specifies the number of interrogated messages that are block-wise constructed to telegramms and sent afterwards. A pause is taken after a block has been constructed, corresponding to the parameter "gap time between GI blocks" before building the next block. Values for blocking and gap time vary dependent on the baud rate.

Gap between GI blocks

1 ... 36000 [x 100 msec]

The construction of a GI block requires much less time than the subsequent sending. The transmission time is determined by the baud rate. The gap time between the blocks corresponds approximately to the transmission time for the messages in a block. For a baud rate of 9600 and a blocking of 10 messages about 3 seconds are indicated.

 

IEC 60870-5-101 : Routing table

 

Another highlight of LIAN 98 is the use of the software as protocol router between the protocols IEC 101 and IEC 104. When using all twelve channels the IEC101 substations can be connected via the channels 1...11 and can communicate with an IEC104 client via channel 12 ( TCP/ IP network ). The stations can work point-to-point as well as in party line mode.

( see : <IEC 60870-5-101 Master/ IEC104 Router> and <IEC 60870-5-104 Server/ IEC101 Router> )

 

 

Enable router

yes / no

When this parameter is activated, the LIAN 98 starts the "IEC101 Master" with router function for the for the associated channel and establishes a connection to the substation. The assignment to the channel is set in the configuration ( KNF ) over the parameter "simulation list".
see also IEC 60870-5-101 : RTI ( Master )-Simulation

Message format

With this parameter the message format of the connected client/ master is selected. ( IEC 60870-5-104 ).

Route ACTCON respond

yes / no

A substation sends automatically an "activation confirmation" ( COT 7 ) or "deactivation confirmation" ( COT 9 ) after the receipt of an "activation" ( COT 6 ) or "deactivation" ( COT 8 ).

LIAN 98 will forward the confirmation message after the receipt to the client computer of the control center when this parameter is activated.

Route ACTTERM respond

yes / no

A substation sends e.g. at the end of a general interrogation or after the command execution automatically an "activation termination" ( COT 10 ).

LIAN 98 will forward the termination message after the receipt to the computer of the control center when this parameter is activated.

Route test command respond

yes / no

A substation sends after receipt of a "test command activation" ( ID 104, COT 6 ) automatically a "confirm activation" ( ID 104, COT 7 ).

When this parameter is activated, the test command confirmation ( ID 104, COT 7 ) will be converted to IEC 104 structure ( ID 107, COT 7 ) and forwarded to the control center computer.

Insert routing channel
Number of channels
delete
insert

All connected clients which should be taken into account from the LIAN 98 router have to be entered into the channel list.

In order to insert the channel numbers please proceed as follows :

activate "insert routing channel" ( button "insert" is displayed ).
Insert in the fields "Channel number" the channel to be entered. Take over the channel number by clicking "insert". When all channels are inserted please deactivate "Insert routing channels" ( button "insert" disappears ).

In order to delete one or more channels out of this list select it and click "delete".

 


IEC 60870-5-101 : Pre-filter/ Pre-trigger

 

It is absolutely necessary to set the start byte ( 10H or 68H ) for the filter- and trigger settings. With the start byte is determined whether the filter definition is valid for a telegram with fxed length or a telegram with variable length.

 

IEC 60870-5-101 : Monitoring filters

 

Monitoring filters reduce capture on particular pre-defined data records. By setting the corresponding filters a carefully directed data preselection can be achieved, which results in a reduction of the data to be analyzed later.

 

 

Filter released

yes / no

With this option already set monitoring filters for one channel can be deactivated temporarily without deleting them.

protocol specific
filter mask

Here monitoring can be filtered for telegram specific values in which several OR-linked filter masks can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
R 'from' and 'till' define a valid range
add Adds the next OR-element.
remove Removes the current OR-element.

 

IEC 60870-5-101 : Action filters

 

For the simulation and execution of data tests actions can be caused with the receipt of defined records. Therefore the possibility exists to define action filters, that effect the transmission of a send-sequence or transmit one or more message buffers ( TDB ).

 

 

Action filter released

yes / no

With this option already set action filters for one channel can be deactivated temporarily without deleting them.

protocol specific
filter mask

The action filter is described over telegram specific features corresponding to a filter setting. Additionally each action filter requires an allocation to a send buffer or alternatively to a send sequence.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
R 'from' and 'till' define a valid range
Sendbuffer number
( from, from/ till )

In correspondence with the action filter the message buffer "from" or the message buffers "from/ till" are to be sent.

Sequence line number
( from, from/ till )

In correspondence with the action filter the send sequence is to be started at line number "from" or to be started at line number "from" and to be ended at line number "till".

add Adds the next OR-element.
remove Removes the current OR-element.

 

IEC 60870-5-101 : Start trigger

 

With the receipt of a telegram pre-defined as start trigger, recording is started.

 

 

Start trigger released

yes / no

With this option already set start triggers for one channel can be deactivated temporarily without deleting them.

protocol specific
trigger mask

Here you can define telegram specific start triggers for monitoring in which several OR-linked triggers can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
R 'from' and 'till' define a valid range
add Adds the next OR-element.
remove Removes the current OR-element.

 

IEC 60870-5-101 : Stop trigger

 

Monitoring can also be stopped by telegram-specific filters and/ or "stop on error" after a defined number of following records. The number of the following records is defined in the field "records after stop on error/ stop trigger" in the global parameters of the VFL settings.

 

 

Stop trigger released

yes / no

With this option already set stop triggers for one channel can be deactivated temporarily without deleting them.

protocol specific
trigger mask

Here you can define telegram specific stop triggers for monitoring in which several OR-linked triggers can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
R 'from' and 'till' define a valid range
add Adds the next OR-element.
remove Removes the current OR-element.

 


Each alteration in the settings is displayed by an asterisk * in the caption title and will be only effective after saving.

 


IEC 60870-5-101 : Message display format

 

The sent and received messages of all channels are entered binary into the archive file. Before displaying on screen, the binary archived data are coverted to an easily readable procedure specific plaintext. In order to optimize the representation it can be chosen between five different plaintext settings. The plaintext format is set separately for each channel.
( see also "FMT file - Display format" )

 

 

Plaintext format 1

Everything is displayed :
link layer + data unit identifier + information objects/ elements

Plaintext format 2

No link layer is displayed :
data unit identifier + information objects/ elements

Plaintext format 3

Only information objects/ elements are displayed.

Plaintext format 4

Only link layer is displayed.

Plaintext format 5

No information objects/ elements are displayed :
link layer + data unit identifier

 

Additional to the plaintext output the transmission data can also be displayed in hexadecimal, decimal, ASCII, binary ( LSB first ) or binary ( MSB first ). Of course the plain text output can also be deactivated in order to display the transmission data only e.g. hexadecimal.

 


IEC 60870-5-101 : Error messages

 

Error checks during receive

 

per character

the start bit, the stop bit and the parity.

per frame

the start character, the frame checksum and the end character, the
length ( 2 bytes ) and second start character in frames with variable length.

 

*** TimeOut !

Within a telegram, there may be no pause between characters. In case of timeout occurs it is assumed that it is the end of the telegram and the telegram check is started. The sensitivity can be parameterized in the configuration ( timeout ).
Normally a time out is no error, but it is stored in the Pro file together with the initial error for a better analysis of the faulty transmission line in connection with a line error.

*E: COM-PORT !

Error during writing on the COM port. May be it is already occupied by another program.

*E: Length !

The length of the telegram is wrong.

*E: Format !

The repetition of the length or the start characters ( 68H ) in the message header are faulty, or the stop byte ( 16H ) is missing or set wrongly. For a fixed frame telegram, may be the parameter "Number of link address fields" is not set correct.

*E: Checksum !

The message checksum in the checksum byte is incorrect.

*E: SYNC !

The receive routine initially searches for 68H, 10H, E5H ( or A2H ). Each other character is noted as synchronization error and inserted in the PRO file.

*E: Overflow !

Error message from the UART. This error is noted only in the PRO file.

*E: Parity !

Error message from the UART. This error is noted only in the PRO file.

*E: Start/ Stop !

Error message from the UART. This error is noted only in the PRO file.

 

 

*E: TypeID !

The TypeID set in the ASDU is not provided.
( see Protocol specific parameter - PAR file )

*E: COT !

The cause of transmission set in the message is not provided or is not expected as response.
( see Protocol specific parameter - PAR file )

*E: INFOBJ length !

The length of the information object is not plausible.
( see Protocol specific parameter - PAR file )

*E: VSQ !

The values stored in the field "variable structure qualifier" are senseless, it is probably caused by wrong field length in the parameterization.

 

Error checks during simulation

 

*E: DIR bit !

Balanced : Direction bit is set wrong.

*E: PRM bit !

Primary message bit is set wrong.

*E: FCB bit !

Frame count bit is set wrong.

*E: FCV bit !

Frame count bit valid is not correct set.

*E: unexpected !

The respond at this time was not expected.

*E: Link state !

No station initialization is done, but in the message the FCV bit is already set to valid.

*E: Link address !

The received link address is incorrect or the entry in the SIM list is wrong.

*E: ASDU address !

The received ASDU address is incorrect or the entry in the SIM list is wrong.

*E: ACTCON missing !

An expected "Activation Confirm" ( COT 7 ) respond was not received within the parameterized "Response timeout".

*E: ACTTERM missing !

An expected "Activation Termination" ( COT 10 ) respond was not received within the parameterized response timeout..

 


IEC 60870-5-101 : Parameter list

 

IEC 60870-5-101 : ASDU parameter

 

The ASDU list is used for the plausibility of the received messages, both for recording as well as for the simulation. Telegram types, used in the project, have to be marked in the list and the respective permissible causes ( COT ) for this TypeID entered. Otherwise an error message is displayed when receiving the telegram ( E:TypeID, E:COT ). Additionally the length of an information object without the length of the object address is defined for each TypeID.

 

 

IEC 60870-5-101 : Process data

 

LIAN 98 offers the possibility to import process data available on the control center computer and use it for the simulation. This causes for testing a significant reduction in expenditure of time, because particular process messages must not be edited. The messages are automatically generated by the LIAN 98 software on the basis of the data point list.
( see : <PAR file : Process data description> and <Send using process data list> )

 

Load and use of process data for the simulation is detailed described for protocol IEC 104 in an article in the LIAN 98 forum. ( see : <IEC 60870-5-104 : Load and use process data for simulation> ) This procedure is also valid for the process data of protocol IEC 101.

 

 

The process data description is organized line by line and can accommodate up to 5800 data rows, where each row is one data point.

 

Address of ASDU
( station number )
high, low

The "common Address of ASDU" is normally the station number and the same for all objects in an ASDU. According to standard it contains of 1 or 2 octets ( high, low ). In LIAN 98 the process data always refer to one station. For the simulation this address must also be entered into the RTI- or RTU list.
( see : <IEC 60870-5-101 : Simulation> )

The input can be done structured as well as unstructured.

Station name

maximum 15 ASCII characters
For a better documentation of the data tests is the station name together with the name of the data point displayed as plaintext.

 

 

Information object address
( IOA )
high ... low

Address of the data point
The address of the information object is used as target address in control direction and as source address in monitoring direction. The 3rd octet ( high ) is only used if the address of the information object is structured in order to define unambiguous addresses within a certain system.

The input can be done structured as well as unstructured.

type
ASDU name

Type identification ( TypeID )
The type, the structure and the format of the information object are defined with the TypeID.
For a better overview the name of the ASDU is in addition displayed automatically by LIAN 98.

value

Object state ( OFF, ON, ... )
. state of the single-, double command or the regulating step command 
. state of the single- or double information

step

changing state
With the activation of the process send button  the data point is sent for the first time with the state of the object indicated in the list and subsequent increased by the "step value". The advantage during testing is that the state of the data point has changed in the next pass. There is no state change if the step value is not indicated or if it is zero.
( see : <IEC 60870-5-101 : Simulate data points> )

S/ E

qualifier of command ( QOC ) : select / execute
0 : execute
1 : select

If in the data S/E for commands is not defined, zero is sent !

time

qualifier of command ( QOC ) : Command pulse duration 
0 : Pulse duration is defined in the substation 
1 : short pulse duration ( circuit breaker )
2 : long pulse duration
3 : persistent output

If in the data no pulse duration for commands is defined, zero is sent !

data point

maximum 69 ASCII characters
For a better documentation of the data tests, the name of the data point together with the station name is displayed as plaintext.

 


MAYR Software

Wuerzburger Ring 39,  D 91056 Erlangen

Manual LIAN 98


LIAN 98 Protocol Router, Simulator and Analyzer
© Copyright 2001, 2006, 2011 by Werner Mayr. All Rights reserved.