4.2.4 Protocol : IEC 60870-5-104


 

Telegram structure

IEC 60870-5-104 the network access for IEC 60870-5-101 using standard transportation profiles.

It will enable ASDUs, as defined in IEC 60870-5-101, to be transmitted over a variety of digital data networks. IEC 60870-5-104 is a combination of the application layer of IEC 60870-5-101 and the transport functions provided by a standard TCP/ IP ( Transmission Control Protocol / Internet Protocol ) interface. Within TCP/ IP various network types can be utilized including X.25, FR ( Frame Relay ) and ISDN ( Integrated Service Data Network ).

 

Information about the structure of the telegram and ethernet frames see
<IEC 60870-5-104 : Telegram structure>

 


IEC 60870-5-104 : Configuration

The PC must be connected to the network hub or switch before LIAN 98 will be started, otherwise parametrization of the network in LIAN can not be done.

 

 

With the channel button ( channel 1 ...12 ) on the bottom following settings are possible :

 

Local machine

 

Network adapter

If there are several network adapters in the PC the corresponding adapter to be tested has to be selected here.

Network protocol

Here the suitable protocol ( e.g. TCP/IP ) for the test must be selected.

Host Name

The name of the PC declared during the network installation is displayed here. It can be set via the network settings in the Windows system control. ( No input is possible, it is only a display field ! )

IP address

The IP-address allocated to the network adapter is displayed here. It can be set via the network settings in the Windows system control. ( No input is possible, it is only a display field ! )

If no IP address is displayed when opening the register card, the network is not correctly installed in Windows or the connection to the network hub or switch does not exist.

Port number

When LIAN 98 is used as client ( RTI simulation ) the port number = 0 must be entered. During the establishment of the client connection a free port address will be allocated to LIAN 98 automatically.
When LIAN 98 is used as server ( RTU simulation ) the port number = 2404 must be set.

 

Remote machine

 

Port number

When LIAN 98 is used as client ( master simulation ) the port number of the station to be tested must be entered. Normally it is the port number =2404.
When LIAN 98 is used as server ( slave simulation ) the port number is not relevant.

 

Receiving/ Capture

 

Time out

Recommendation : 100 msec
LIAN 98 waits this time until it will continue processing all network packets received in this time. Also the end of the transmission is detected with the timeout.

 

Settings in the channel window

 

 

ASDU address fields

2 bytes ( fixed ), structured or unstructured can be selected.

. Output format

dec / hex

The display of the ASDU address in the screen output is done corresponding to the setting of the display format decimal or hexadecimal.

. Bit structure

The 16 bit ASDU address can be divided in maximum 4 bit-fields. In the default division the address is byte by byte structured ( 8 + 8 ). But also any other values can be set ( e. g. 2 + 6 + 8 ). The entry begins always from the higher bit and the sum of all bits must be of course 16.

Object address fields

3 bytes ( fixed ), structured or unstructured can be selected.

. Output format

dec / hex

The display of the object address in the screen output is done corresponding to the setting of the display format decimal or hexadecimal.

. Bit structure

The 24 bit object address can be divided in maximum 6 bit-fields. In the default division the address is byte by byte structured ( 8 + 8 + 8 ). But also any other values can be set ( e. g. 2 + 6 + 4 + 4 + 8 ). The entry begins always from the higher bit and the sum of all bits must be of course 24.

 


IEC 60870-5-104 : Simulation

 

IEC 60870-5-104 : RTI ( Client/ Master )-Simulation

 

In the following PDF file a typical client simulation with LIAN 98 is shown :

<Client Simulation with LIAN 98>

 

LIAN 98 is simulating a CLIENT ( master ) and can communicate with up to 32 connected servers simultaneously. Assuming that these servers have different IP addresses.

 

 

ASDU address
( target = server )

It is the ASDU address of the server with which one will test mostly. All telegrams to be sent are provided with this ASDU address out of the SIM list and sent to the corresponding server.

Exception :
. If a TDB buffer contains a "BROADCAST command" with the ASDU address = 65535 ( 2 octet address ) the telegram will be sent unchanged to all servers entered in the server list.
. If a valid ASDU address out of the server list is already set in the TDB buffer the telegram will be sent with the entered address to the server with the allocated address.

IP address
( target = server )

This is the IP address of the default server with which one will test mostly.

Originator address
( source = client )

All telegrams to be sent will be provided with this originator address during the master simulation.

t0
Connection establishment

[ sec ] Network connection establishment timeout
Timeout for the establishment of the connection with the server.

t1
Response Timeout

[ sec ] Response timeout
This parameter defines the time in seconds that LIAN 98 waits maximum for an acknowledge from the server.

t2
A C K R S N
in case of no data message

[ sec ]
A S-format frame ( ACKRSN ) will be sent at the latest after this time starting from the last received telegram from the server.

t3
Used for sending test frames

[ sec ]
An U-format frame ( TESTFR ) will be sent at the latest after this time starting from the last received telegram from the server.

unacknowledged I frames (k) maximum ( A C K R S N )

Maximum difference ( k ) between the received sequence number ( RSN ) and the last acknowledged RSN. The transmitter stops the transmission at k unacknowledged I frames.

ACK latest after receiving I frames (w)

This parameter ( w ) indicates the number of received I frames after the RSN will be acknowledged at latest from LIAN 98 with a S frame ( A C K R S N ).

Send A C K R S N

yes / no

LIAN 98 will transmit a S-format frame ( A C K R S N ) to the server when this parameter is activated. Otherwise the RSN will not be acknowledged. Furthermore the number of the TDB  buffer has to be entered in which the telegram is stored.

Enable clock synchronization

yes / no

LIAN 98 will transmit first of all a time synchronization command ( ID 103 ) and repeat cyclic if necessary ( Time-Sync-Cycle ).

Clock SYNC cycle time

1 - 1440 minutes

Dependent on this time LIAN 98 as master station will repeatedly send the time synchronization command.

Clock SYNC command

TDB buffer number where the telegram "C_CS_NA_1" ( ID 103, COT 6 ) is stored.

Use system date/ time

yes / no

The system time of the PC will be taken over into the time synchronization command ( ID 103 ) and the commands ( ID 58 - 64 ) before the telegram will be transmitted, if this parameter is activated. Otherwise the telegram remains unchanged as before edited by the user.

Enable general interrogation

yes / no

After the initialization of the communication LIAN 98 will transmit a general interrogation command and repeat it cyclic ( GI cycle time ) if necessary.

GI cycle time

1 - 1440 minutes

Dependent on this time LIAN 98 as master station will transmit the general interrogation command repeatedly.

GI command

TDB buffer number where the message "C_IC_NA_1" ( ID 100, COT 6 ) is stored

Test with a connected router

yes / no

If this parameter is activated, it is assumed that all stations are connected through a router and therefore all have the same IP address.( IEC104 -> IEC101 seriell )

Insert server addresses
number of addresses
delete
insert

Multi-Server operation :
All servers ( max. 32 stations ) to be processed by LIAN 98 must be inserted in the server list. LIAN 98 will make a connection to all this servers during the master simulation.


In order to insert the addresses please proceed as follows :

Activate "Insert server addresses" ( button "insert" will be displayed ).
Insert in the fields "Address of ASDU" / "IP Address" the station to be entered in the server list.
Take over the addresses into the server list by clicking "insert".
When all stations are inserted, please deactivate "insert server addresses" ( button "insert" disappears ).

In order to delete a station out of this list select it and click "delete".

Send STARTDT

yes / no

LIAN 98 will transmit an U-format frame ( STARTDT ) to the server(s) after the establishment of the connection when this parameter is activated. Furthermore the number of the TDBbuffer has to be entered in which the telegram is stored.

Send  STOPDT

yes / no

LIAN 98 will transmit an U-format frame ( STOPPDT ) to the server(s) before of the connection will be closed when this parameter is activated. Furthermore the number of the TDB buffer has to be entered in which the telegram is stored.

Send  TESTFR

yes / no

LIAN 98 will transmit an U-format frame "TESTFR" ( see t3 - Used for sending test frames ) to the server(s) when this parameter is activated. Furthermore the number of the TDB buffer has to be entered in which the telegram is stored.

Send  TESTFR confirm

yes / no

LIAN 98 will acknowledge a "TESTFR activate" received from the server with an U-format frame ( TESTFR confirm ).

Generate execute command

yes / no

LIAN 98 will send automatically an Acitivate Execute Command ( COT 6, execute ) after the receipt of an ACTCON Respond ( COT 7, select ) during master simulation if this parameter is activated. 

ACTCON response timeout
( confirmation activation )

This parameter defines the time in seconds that LIAN 98 at most has to wait for an ACTCON Respond ( COT 7 ) or. DEACTCON Respond ( COT 9 ) before the message "*E: ACTCON missing !" is displayed.

ACTTERM response timeout
( deactivation )

This parameter defines the time in seconds that LIAN 98 at most has to wait for an ACTTERM Respond ( COT 10 ) before the message  "*E: ACTTERM is missing !" is displayed.

Enable test procedure

yes / no

The test procedure is used to check the complete loop from the controlling station to the controlled station and back.

LIAN 98 will send a test command message ( ID 107 ) after the establishment of the communication and repeat it cyclic ( test cycle time ) if necessary. This ASDU is mirrored by the controlled station as a test confirmation message.

Test cycle time

0 - 255 seconds

Dependent on this time LIAN 98 as master station will send the test command cyclic.

Test command

TDB buffer number where the telegram "C_TS_TA_1" ( ID 107, COT 6 ) is stored.

 

IEC 60870-5-104 : RTU ( Server/ Slave )-Simulation

 

In the following PDF file a typical server simulation with LIAN 98 is shown :

<Server Simulation with LIAN 98>

 

LIAN 98 is working as server and can provide 4 connected CLIENTS simultaneously.

 

 

ASDU address
( source = server )

This ASDU address is the source address and will be inserted in each telegram sent during slave simulation.

Originator address
( target = client )

All telegrams to be sent during slave simulation will be provided with this origin address and transmitted to the client with this address.

Multi client operation : ( max. 8 clients )
All telegrams, edited with originator address = 0, will be sent to the client with this address. If a valid address is entered ( consisting client connection ) in the telegram, the telegram will only be sent to this client. Each master must have an unambiguous originator address. LIAN 98 manages the originator - and IP-addresses of all clients which had established a connection to LIAN 98.

t0
Connection establishment

[ sec ]
Only important for the client !

t1
Response Timeout

[ sec ]
This parameter defines the maximum time in seconds that the program should wait for an acknowledge from the client.

t2
A C K
in case of no date message

[ sec ]
A S-format frame ( ACKRSN ) will be sent at the latest after this time starting from the last received telegram from the client.

t3
for sending test frames

[ sec ]
An U-format frame ( T E S T F R ) will be sent at the latest after this time starting from the last received telegram from the client.

max. difference RSN to send
A C K R S N

Maximum difference ( k ) between the received sequence number ( RSN ) and the last acknowledged RSN.

Latest  A C K
after receiving I-frames

The parameter ( w ) indicates the number of received I-format frames after which the RSN should be acknowledged at the latest from LIAN 98 with a S-format frame ( A C K R S N ).

Send ACKRSN

yes / no

LIAN 98 will transmit a S-format frame ( ACKRSN ) to the clients when this parameter is activated. Otherwise the RSN will not be acknowledged. Furthermore the number of the TDB buffer has to be entered in which the telegram "ACKRSN" is stored.

STARTDT / STOPDT controlled

yes / no

After the establishment of the connection LIAN 98 as server is waiting for a STARTDT from the client before I-format frames will be transmitted. As well a STOPDT from the client is expected before the connection will be closed.

End of initialization

yes / no

After the establishment of the connection to a client "End of initialization" will be transmitted automatically from LIAN 98. Furthermore the number of the TDB buffer has to be entered in which the telegram "M_EI_NA_1" ( ID 70, COT 4 ) is stored.

Send TESTFR

yes / no

LIAN 98 will transmit an U-format frame "TESTFR" ( see: t3 - Used for sending test frames ) to the clients if this parameter is activated. Furthermore the number of the TDB buffer has to be entered in which the telegram is stored.

Enable clock synchronization

yes / no

The current system time of the PC will be given back in an activation confirmation ( ACTCON ) of a clock SYNC command ( TypId 103 ), if this parameter is activated. Otherwise the received time will only be mirrored.

Set new system date/ time
( PC )

yes / no

With the receipt of a time synchronization command ( ID 103, COT 6 ) the system time of the PC will be updated with the received values if this parameter is activated.

Time correction
( for system time of the PC )

0 - 9 999 msec

A correction value can be entered for the setting of the PC system time with a time synchronization command. It will be added onto the received value in the synchronization command.

Send STARTDT confirm

yes / no

LIAN 98 will acknowledge a "STARTDT" received from the client with the U-format frame "STARTDT" when this parameter is activated.

Send STOPDT confirm

yes / no

LIAN 98 will acknowledge a "STOPDT" received from the client with the U-format frame "STOPDT" when this parameter is activated.

Send TESTFR confirm

yes / no

LIAN 98 will acknowledge a "TESTFR" received from the client with the U-format frame "TESTFR confirm" when this parameter is activated.

Send ACTCON respond

yes / no

An  Activation Conformation  ( COT 7 ) or DEACTCON respond ( COT 9 ) is sent automatically during slave simulation after the receipt of an Activate Command ( COT 6 ) or a Deactivate Command ( COT 8 ) when this parameter is activated.

Send ACTTERM respond

yes / no

An ACTTERM Respond ( COT 10 ) with delay time is sent automatically during slave simulation after the receipt of an Activate Command ( COT 6 ) when this parameter is activated.

ACTTERM delay time

This parameter defines the time in seconds that the program LIAN 98 delays the transmission of the "Activation Termination" respond ( COT 10 ).

Send ACTCON respond
on test command

yes / no

When this parameter is activated LIAN 98 will send automatically an  Activation Conformation  ( ID 107, COT 7 ) respond during server simulation after the receipt of a test command ( ID 107, COT 6 ).

Allow receipt of monitoring telegrams
in control direction

yes / no

When LIAN 98 will receive a monitoring message in control direction during RTU simulation the message will be marked with an error. The error message is suppressed if this parameter is set to "yes".

 

IEC 60870-5-104 : Simulation procedures

 

Simulation of the application functions :

 

cyclic data transmission

Cyclic data transmission is used to provide a continuous updating function of current values of process variables in balanced and unbalanced transmission procedures.

A cyclic data transmission is done in LIAN 98 via sending cyclic send jobs ( see "transmit" ) or a not terminated send sequence ( see "send sequence list" ).

General interrogation

The general interrogation application function is used to update the controlling station after the station initialization procedure or when the controlling station detects a loss of information.

The general interrogation procedure of the controlling station requests the controlled station to transmit the actual values of all its process variables. The interrogation procedure is finished when the controlling station receives an "End of interrogation message".

The information transfer is triggered by an interrogation command ( ID 100, COT 6 ) message from the controlling station to the controlled station, which responds with an interrogation confirmation ( ID 100, COT 7 ) message. The controlled station transmits the interrogated information by means of one or more monitored information ASDUs. The last information ASDU is then followed by an "interrogation termination" message ( ID 100, COT 10 ), indicating that all information has been transferred.

The confirmation ( ACTCON ) and the termination of the general interrogation ( ACTTERM ) is done automatically in LIAN 98 if this is activated in the simulation list. Transmission of requested user data can be done via an entry in the action filter ( see "Action filters" ) or when process data are loaded by processing the data point list ( see "Simulate data points" ).

Clock synchronization

Date and time of controlled stations are initially synchronized by the controlling station after initialization and afterwards re-synchronized periodically.

A clock synchronization command ( ID 103 ) containing the full current clock time is sent from the controlling station. After the execution of the clock synchronization the controlled station generates a confirmation message which contains the local time before synchronization.

Command transmission

The controlling station sends a "SELECT command" ( ID 45... 50, COT 6 ) to the controlled station which responds by a "SELECT confirmation" ( COT 7 ) message if it is ready to receive the announced command. The time from the "SELECT command" to the "SELECT confirmation" is controlled by a configurable timeout interval ( Response timeout ).

A successful select procedure may then be deactivated by a break off. This command is transmitted by a "BREAK OFF command" ( COT 8 ) and the controlled station responds by a "BREAK OFF confirmation" ( COT 9 ) message. The time between these messages is controlled by a timeout interval ( Response timeout ).

If appropriate, an "EXECUTE command" ( ID 45... 51, COT 6 ) is sent to the controlled station, which responds by an "EXECUTE confirmation" ( COT 7 ) message ( positive when the specified control action begins, otherwise negative ). This procedure is also non interruptible and the time from the "EXECUTE command" to the "EXECUTE confirmation" is controlled by a configurable timeout interval. An "EXECUTE termination" ( COT 10 ) message is issued from the controlled station when the command application procedure is completed successfully. The addressed equipment should now change its state, and the new state is indicated to the controlling station by a spontaneous data message.

The confirmations ( ACTCON ) for the "SELECT command" and the "EXECUTE command" or "EXECUTE termination" ( ACTTERM ) message is done automatically in LIAN 98 if this is activated in the simulation list. The transmission of the change of state can be done manually or via an entry in the action filter ( see "Action filters ). If process data are loaded and the corresponding data point is available in the list the change of state is sent out of the data point list ( see "Simulate data points" ).

 

 

 


IEC 60870-5-104 : Monitoring ( Capture network communication )

LIAN 98 records all IEC 60870-5-104 data packets of an ethernet, provided the data are available on the LAN interface of the PC running LIAN 98. This means that the PC has to be connected directly to the same network hub as the IEC 60870-5-104 client ( master ) without using a switch or router.

If a SCADA software is running under a Windows® Operating System, it is also possible to use LIAN 98 on the same computer simultaneously to monitor the network packets which are coming in and going out from this PC without an additional connection to the network hub or switch.

 

 

Ethernet type

0800H ( fixed )
This field indicates the type of the MAC clients protocols. The internet protocol ( IP ) is used for protocol IEC 60870-5-104.
( No input is possible, it is only a display field ! )

IP version

4 ( fixed )
This field indicates the format of the IP Headers. Version = 4 ( IPv4 ) is used for protocol IEC60870-5-104.
( No input is possible, it is only a display field ! )

Protocol

6 ( fixed )
This field indicates the protocol of the next level that is used in the data section of the internet datagram.
The transmission control protocol ( TCP ) is used for protocol IEC 60870-5-104. 
( No input is possible, it is only a display field ! )

IP Address Client

IP address of an IEC 60870-5-104 client ( Master station ). The network traffic between this client and the server(s) will be recorded. The required stations must be indicated in the server list and the PC must be connected with the client over the same network hub.

IP address server
( input field )

Use this field to enter the IP addresses of the servers in the server list.
When the server list is empty all server connections will be captured.

Port number server
( input field )

Use this field to enter the port numbers of servers in the server list.
( Port = 2404 is normally used for IEC 60870-5-104 )

Insert server addresses
number of addresses
delete
insert

Each particular server to be captured must be inserted in the server list. LIAN 98 will use this list to prefilter the network traffic.If no server address is inserted all IP addresses will be captured.

In order to insert the addresses please proceed as follows :

Activate "Insert server addresses" ( button "insert" will be displayed ).
Enter the IP address and port number to be inserted in the fields "IP address server" / "Port number server". Take over the addresses in the server list with "insert". When all stations are inserted deactivate "Insert server addresses". ( The button "insert" disappears ).

In order to delete a server out of this list select it and click "delete".

 

The screen shot above shows the user data of the transmission blocks. Also, if it is required the particulare network headers ( MAC-, IP-, TCP header ) can be displayed. The output format is set via the FMT file - Display format. The headecimal values can be suppressed separately, of course.

In the side view ( see Network capture view ) only the user data are displayed and the output of the network header is disabled. The direction of the transmission can be recognized by LIAN 98. A green status line shows the direction client to server and a yellow status line the direction server to client. A status line without any additional data is only a header transmission which is necessary in order to manage the network transfer.

 

Information to the structure of the telegram- and ethernet frame.  
IEC 60870-5-104 : Ethernet frame

 

IEC 60870-5-104 : Simulate data points

All process dependent data are available in a data base system in the control center computer. LIAN 98 offers the possibility to import these process data and use it for the simulation. ( see : <PAR file : Process data description> )

 

 

Use data points
( PAR list )

yes / no

If a parameter list contains of valid process data they may also be used for the simulation. LIAN 98 takes into account this process data during simulation if this parameter is activated. For example LIAN 98 will send back to the client the correct change state of the switch after the receipt of a command ( ID 45, 46, 58 und 59 ) depending on the data point description.

 

 

Simulation range

The parameter list is organized line by line and can accommodate up to 5800 data points, each line is one data point.

With the activation of the process send button  process telegrams are generated of all data points and sent, starting from "line from". The transmission will completed by "till line" or by repeatedly pressing of the button.

Line from

1 ... number of data points

LIAN 98 starts from this or any subsequent line with generating and sending of process telegrams. The condition is that the data type is in accordance with the simulation mode. The RTI simulation uses only data types in control direction and the RTU simulation data types in monitoring direction.

Line till

> line from ; maximum number of data points

LIAN 98 stops in this or a previous line generating and sending of process telegrams.

 

 

Gap time

0 ... 255 [sec]

Is the time that is observed between two consecutive process telegrams. If is set to 0 a gap of 100 msec is used.

Number of passes

1 ... 255

The processing of the simulation range can be repeated, depending on the parameter "number of passes".

 

Send change of state
on process command

yes / no

If this parameter is activated, LIAN 98 during RTU simulation will send back to the master the correct change of state of the switch after the receipt of a process command ( ID 45, 46, 58 and 59 ) provided that the indication is defined in the data point description ( PAR list ).

Send interrogated
information on GI command

yes / no

If this parameter is activated, LIAN 98 during RTU simulation will send interrogated information to the master after the receipt of a GI command ( ID 100 ) depending on the indications in the PAR list. The selection of the indications is limited by the simulation range "line from" and "line till".

Disturbance suppression

yes / no

 

Number of messages
per GI block

1 ... 128

This parameter specifies the number of interrogated messages that are block-wise constructed to telegramms and sent afterwards. A pause is taken after a block has been constructed, corresponding to the parameter "gap time between GI blocks" before building the next block. Values for blocking and gap time vary dependent on the baud rate.

Gap between GI blocks

1 ... 36000 [x 100 msec]

The construction of a GI block requires much less time than the subsequent sending. The transmission time is determined by the baud rate. The gap time between the blocks corresponds approximately to the transmission time for the messages in a block. For a baud rate of 9600 and a blocking of 10 messages about 3 seconds are indicated.

 

IEC 60870-5-104 : Routing table

 

Another highlight of LIAN 98 is the use of the software as protocol router between the protocols IEC 104 and IEC 101 or Siemens SINAUT ST1. When using all twelve channels the IEC101- and SINAUT ST1 substations can be connected via the channels 1...11 and can communicate with an IEC104 client via channel 12 ( TCP/IP network ).

See also :
  <IEC 60870-5-104 Server/ IEC101 Router>
  <IEC 60870-5-101 Master/ IEC104 Router>
  <Siemens SINAUT ST1 Master/ IEC104 Router>

 

 

Enable router

yes / no

When this parameter is activated, the LIAN 98 starts the "IEC 104 Server" with router function for the associated channel and waits for the establishment of the connection with the client. The assignment to the channel is set in the configuration ( KNF ) over the parameter "simulation list".
( see : IEC 60870-5-104 : RTU ( Server/ Slave )-Simulation )

Message format

With this parameter the Message format of the connected substation is selected.

. IEC 60870-5-101
. Siemens SINAUT ST 1

Route test command

yes / no

When this parameter is activated, the test command ( ID 107, COT 6 ) will be converted to IEC 101 structure ( ID 104, COT 6 ) and forwarded to the substation. This allows to examine the complete transmission path from the control system to the substation and back.

Insert routing addresses
Number of adresses
delete
insert

All connected substations which should be taken into account from the LIAN 98 router have to be entered into the station list.

In order to insert the addresses please proceed as follows :

activate "insert routing addresses" ( button "insert" is displayed ).
Insert in the fields "Link address" / "Address of ASDU" / "Channel number" the station to be entered. Take over the address by clicking "insert". When all stations are inserted please deactivate "Insert routing addresses" ( button "insert" disappears ).

In order to delete one or more stations out of this list select it and click "delete".

 


IEC 60870-5-104 : Pre-filter/ Pre-trigger

 

It is absolutely necessary to set the APCI format ( I, S or U ) for the filter- and trigger settings. With the APCI format is determined whether the filter definition is valid for a telegram with fxed length or a telegram with variable length.

 

IEC 60870-5-104 : Monitoring filters

 

Monitoring filters reduce capture on particular pre-defined data records. By setting the corresponding filters a carefully directed data preselection can be achieved, which results in a reduction of the data to be analyzed later.

 

 

Filter released

yes / no

With this option monitoring filters already set for one channel can be deactivated temporarily without deleting them.

protocol specific filter mask

Here monitoring can be filtered for telegram specific values in which several OR-linked filter masks can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
add Add the next OR-element.
remove Remove the current OR-element.

 

IEC 60870-5-104 : Action filters

 

For the simulation and execution of data tests actions can be caused with the receipt of defined records. Therefore the possibility exists to define action filters, that effect the transmission of a send-sequence or transmit one or more message buffers ( TDB ).

 

 

Action filter released

yes / no

With this option action filters already set for one channel can be deactivated temporarily without deleting them.

protocol specific
filter mask

The action filter is described over telegram specific features corresponding to a filter setting. Additionally each action filter requires an allocation to a send buffer or alternatively to a send sequence.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
Sendbuffer number
( from, from/ till )

In correspondence with the action filter the message buffer "from" or the message buffers "from/ till" are to be sent.

Sequence line number
( from, from/ till )

In correspondence with the action filter the send sequence is to be started at line number "from" or to be started at line number "from" and to be ended at line number "till".

add Adds the next OR-element.
remove Removes the current OR-element.

 

IEC 60870-5-104 : Start trigger

 

With the receipt of a telegram pre-defined as start trigger, recording is started.

 

 

Start trigger released

yes / no

With this option start triggers already set for one channel can be deactivated temporarily without deleting them.

protocol specific
trigger mask

Here you can define telegram specific start triggers for monitoring in which several OR-linked triggers can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
add Adds the next OR-element.
remove Removes the current OR-element.

 

IEC 60870-5-104 : Stop trigger

 

Monitoring can also be stopped by telegram-specific filters and/ or "stop on error" after a defined number of following records. The number of the following records is defined in the field "records after stop on error/ stop trigger" in the global parameters of the VFL settings.

 

 

Stop trigger released

yes / no

With this option stop triggers already set for one channel can be deactivated temporarily without deleting them.

protocol specific
trigger mask

Here you can define telegram specific stop triggers for monitoring in which several OR-linked triggers can be defined for the channel.

= Only values equal to 'from' are let through.
# Only values not equal to 'from' are let through.
< Only values less than 'from' are let through.
> Only values greater than 'from' are let through.
b 'from' and 'till' define a valid range
add Adds the next OR-element.
remove Removes the current OR-element.

 


Each alteration in the settings is displayed by an asterisk * in the caption title and will be only effective after saving.

 


IEC 60870-5-104 : Message display format

 

The sent and received messages of all channels are entered binary into the archive file. Before displaying on screen, the binary archived data are coverted to an easily readable procedure specific plaintext. In order to optimize the representation it can be chosen between five different plaintext settings. The plaintext format is set separately for each channel.
( see also "FMT file : Display format" )

 

 

Plaintext format 1

Everything is displayed :
link layer + data unit identifier + information objects/ elements

Plaintext format 2

Everything is displayed :
link layer + data unit identifier + information objects/ elements

Plaintext format 3

Only information objects/ elements are displayed.

Plaintext format 4

Only link layer is displayed.

Plaintext format 5

No information objects/ elements are displayed :
link layer + data unit identifier

 

Additional to the plaintext output the transmission data can also be displayed in hexadecimal, decimal, ASCII, binary ( LSB first ) or binary ( MSB first ). Of course the plain text output can also be deactivated in order to display the transmission data only e.g. hexadecimal.

For the monitoring of protocol IEC 104 also the particular network headers ( MAC, IP, TCP ) can be displyed.

 


IEC 60870-5-104 : Error messages

 

Error checks during receive

 

per frame

the start sign, the length, the frame checksum and the stop sign

 

*E: NETWORK !

Error during writing on the network, system error e.g. socket failure. 

*E: NET PACKET !

The captured length is not equal to the packet length.

*E: MAC HEADER !

The length of the MAC Header is incorrect or the data packet is not be interpretable.

*E: IPv4 HEADER !

The length of the IPv4 header is incorrect.

*E: TCP HEADER !

The length of the TCP header is incorrect.

 

 

*E: Length !

The length of the user data is not equal to the length of the APDU ( Application Protocol Data Unit ). The length of the MAC, IP or TCP header could also be incorrect.

*E: Format !

The APCI format is wrong. ( Application Protocol Control Information )

*E: SYNC !

The receive routine initially searches for 68H.  Each other character is noted as synchronization error.

 

 

*E: TypeID !

The TypeID set in the ASDU is not provided.
( see protocol specific parameter - PAR file )

*E: COT !

The COT set in the ASDU is not provided or is not expected as response.
( see protocol specific parameter - PAR file )

*F: INFOBJ length !

The length of the information object is not plausible.
( see Protocol specific parameter - PAR file )

*E: VSQ !

The values stored in the field "variable structure qualifier" are senseless.

*E: Control field !

The U format frame, a frame with a fixed length cannot be interpreted.

 

Error checks during simulation

 

*E: unexpected !

The respond at this time was not expected.

*E: Sequence !

The received send sequence number or receive sequence number is wrong or a message with variable length ( I format ) is missing.

*E: Parameter k !

Maximum difference ( k ) between the received sequence number ( RSN ) and the last acknowledged RSN is exceeded ( see settings for RTI- / RTU simulation in the SIM file ).

*E: Direction !

During RTU simulation LIAN 98 has received in control direction a message from the monitoring direction. This error message can be deactivated in the simulation list ( see settings for RTU simulation in the SIM file ).

*E: ACTCON missing !

An expected "Activation Confirm" ( COT 7 ) respond was not received within the parameterized "Response timeout".

*E: ACTTERM missing !

An expected "Activation Termination" ( COT 10 ) respond was not received within the parameterized response timeout.

 


IEC 60870-5-104 : Parameter list

 

IEC 60870-5-104 : ASDU parameter

 

The ASDU list is used for the plausibility of the received telegrams, both for recording as well as for the simulation. Telegram types, used in the project, have to be marked in the list and the respective permissible causes ( COT ) for this TypeID entered. Otherwise an error message is displayed when receiving the telegram ( E:TypeID, E:COT ). Additionally the length of an information object without the length of the object address is defined for each TypeID.

 

 

IEC 60870-5-104 : Process data

 

LIAN 98 offers the possibility to import process data available on the control center computer and use it for the simulation. This causes for testing a significant reduction in expenditure of time, because particular process messages must not be edited. The messages are automatically generated by the LIAN 98 software on the basis of the data point list.
( see : <PAR file : Process data description> and <Send using process data list> )

 

Load and use of process data for the simulation is detailed described in an article in the LIAN 98 forum. ( see : <IEC 60870-5-104 : Load and use process data for simulation> )

 

 

The process data description is organized line by line and can accommodate up to 5800 data rows, where each row is one data point.

 

Address of ASDU
( station number )
high, low

The "common Address of ASDU" is normally the station number and the same for all objects in an ASDU. According to standard it contains of 2 octets ( high, low ). In LIAN 98 the process data always refer to one station. For the simulation this address must also be entered into the RTI- or RTU list.
( see : <IEC 60870-5-104 : Simulation> )

The input can be done structured as well as unstructured.

Station name

maximum 15 ASCII characters
For a better documentation of the data tests is the station name together with the name of the data point displayed as plaintext.

 

 

Information object address
( IOA )
high ... low

Address of the data point
The address of the information object is used as target address in control direction and as source address in monitoring direction. The 3rd octet ( high ) is only used if the address of the information object is structured in order to define unambiguous addresses within a certain system.

The input can be done structured as well as unstructured.

type
ASDU name

Type identification ( TypeID )
The type, the structure and the format of the information object are defined with the TypeID.
For a better overview the name of the ASDU is in addition displayed automatically by LIAN 98.

value

Object state ( OFF, ON, ... )
. state of the single-, double command or the regulating step command 
. state of the single- or double information 

step

changing state
With the activation of the process send button  the data point is sent for the first time with the state of the object indicated in the list and subsequent increased by the "step value". The advantage during testing is that the state of the data point has changed in the next pass. There is no state change if the step value is not indicated or if it is zero.
( see : <IEC 60870-5-104 : Simulate data points> )

S/ E

qualifier of command ( QOC ) : select / execute
0 : execute
1 : select

If in the data S/E for commands is not defined, zero is sent. !

time

qualifier of command ( QOC ) : Command pulse duration 
0 : Pulse duration is defined in the substation 
1 : short pulse duration ( circuit breaker )
2 : long pulse duration
3 : persistent output

If in the data no pulse duration for commands is defined, zero is sent. ! 

data point

maximum 69 ASCII characters
For a better documentation of the data tests, the name of the data point together with the station name is displayed as plaintext.

 


MAYR Software

Wuerzburger Ring 39,  D 91056 Erlangen

Manual LIAN 98


LIAN 98 Protocol Router, Simulator and Analyzer
© Copyright 2001, 2006, 2011 by Werner Mayr. All Rights reserved.