Protocol : IEC 60870-5-103


 

The protocol IEC 60870-5-103 is also available in the LIAN 98 Software,
running under the operating system Microsoft® Windows® ( 32/ 64 bit ).

see : LIAN 98 Protocol Router, Simulator and Analyzer


 

IEC 60870-5-103 : Parameterization

 

 

CDE adapter :

Baud rate :

Modulation mode:

Data byte :

Stop bit :

Parity :

Time out :

Link address fields :

ASDU address fields :

Switch setting PCM

50 - 115 200 baud

pulse-code-modulation asynchronous

8 bit (fix)

1 bit (fix)

even (fix)

250 msec (variable)

1 (fix)

1 (fix)

.

Link transmission procedure

Concerning to the IEC 60870-5-103 description balanced transmission is not supported. With LIAN DOS it is however possible to support this transmission procedure.
B :

  Balanced
  

Point to point

If balanced transmission procedure is used, each station may initiate message transfers. The balanced mode is restricted to "point-to-point or multiple point-to-point".
Balanced transmission can be used in full duplex mode.

Balanced transmission can be used in full duplex transmission

U :
 
Unbalanced

Party line

Unbalanced transmission is used in SCADA systems in which a master station controls the data traffic by polling outstations sequentially.

The master station (master) is the primary station that initiates all message transfers while outstations are secondary stations (slaves) that may transmit only when they are polled.
The unbalanced mode can be used generally, but must be used in party line configuration.


Telegram structure

IEC 60870-5-103 protocol standard admits exclusive frame format FT 1.2 defined in IEC 60870-5-1 (Transmission frame formats). Formats with fixed and variable block length are admitted. Also the single control characters E5H are used. The transmission of data bytes takes place after the principle "LSB first".

It is an asynchronous protocol with hamming distance = 4. The sequence of user data characters is terminated by a 8 bits checksum. The checksum is the arithmetic sum over all user data octets.

Frame with variable length :
Frame with variable length is used for data transmission of user data between controlling and controlled station.

    

Frame with fixed length :

Frame with fixed length is normally used for link layer services. In special cases frame with fixed length can be used as a confirm frame instead of single character.

Single character:

Single characters are normally used in order to confirm service data of the link layer and user data. 

E5 H = ACK: positive acknowledge.


Control field :

RES Reserved ( DIR )
PRM Primary message

0 = message from a secondary (controlled) station
1 = message from a primary (controlling) station

FCB Frame count bit  - primary message

alternating bit for consecutive  SEND/ CONFIRM or REQUEST/ RESPOND message per station. The primary station alternates the FCB bit for each new SEND/ CONFIRM or REQUEST/ RESPOND transmission service directed to the same secondary station.

If an expected reply is timed out (missing) or grabled, then the same SEND/ CONFIRM and REQUEST/ RESPOND service is repeated with the same frame count bit.

In case of reset commands the FCB bit is always zero, and upon receipt of these commands the secondary station will always be set to expect the next frame primary to secondary with FCV = valid (FCV = 1) to have the opposite setting of FCB, i.e. FCB equal to one

FCV Frame count bit valid - primary message

0 = alternating function and FCB bit is invalid
1 = alternating function and FCB bit is  valid

SEND/ NO REPLY services, broadcast messages and other transmission services that ignore the deletion of duplication or loss of information output do not alternate the FCB bit and indicates this by a cleared FCV bit.

ACD/ RES Unbalanced mode : Access demand - secondary message
Balanced
mode : Reserved

There are two classes of message data provided, namely class 1 and 2.

0 = no access demand  on transmission of data class 1
1 = access demand for class 1 data transmission

Class 1 data transmission is typically used for events or for messages with high priority.
Class 2 data transmission is typically used for cyclic transmission or for low priority messages.

DFC Data flow control - secondary message

0 = more messages are acceptable
1 = further messages can cause a data overflow

Secondary (responding) stations indicate to the message initiating (primary) station that an immediate secession of further message may cause a buffer overflow.

Function code:
 

Funktion codes of the control-field in a message sent from the primary station ( PRM = 1 )

Function Frame type Service function FCV
 0 Send/ CONFIRM expected Reset remote link ( CU ) 0
 1 reserved    
 2 reserved    
 3 Send/ CONFIRM expected User data 1
 4 Send/ NO REPLY expected User data 0
 5 Reserved    
 6 Reserved for special use by agreement    
 7 Send/ CONFIRM expected Reset remote link ( FCB )   
 8 Reserved    
 9 REQUEST/ RESPOND expected Request status of link 0
10 Unbalanced : REQUEST/ RESPOND expected Request user data class 1 1
11 Unbalanced : REQUEST/ RESPOND expected Request user data class 2 1
12 Reserved    
13 Reserved    
14 Reserved for special use by agreement    
15 Reserved for special use by agreement    

 

Function codes of control-field in a message sent from the secondary station ( PRM = 0 ) 

Function Frame type Service function
  0 CONFIRM ACK: Positive acknowledgement
  1 CONFIRM NACK: message not accepted, link busy
  2 Reserved  
  3 Reserved  
  4 Reserved  
  5 Reserved  
  6 Reserved for special use by agreement  
  7 Reserved for special use by agreement  
  8 Unbalanced : RESPOND User data
 9 Unbalanced : RESPOND NACK: requested data not available
10 Reserved  
11 RESPOND Status of link
12 Reserved  
13 Reserved for special use by agreement  
14   Link service not functioning
15   Link service not implemented

Link adress fields :

Link transmission procedures are using a control field and the optional address field.

The link address is a number for a communication link which is used for the communication lines out from a controlling station. It is only used as an address in the communication network itself, an shall not be a part of total address of a data point.

According to the standard this parameter can consist of  1 octet. 0 is valid only for balanced mode.

Type Identification :

The value <0> is not used. The range of numbers 1 to 31 is used for standard definitions from IEC 60870-5-103 standard.

The range of numbers up to 255 are privat and not defined in the standard, but it is recommended that the data unit identifier fields of private ASDUs have the same format as standard ASDUs.

The following tables show the definition of TYPE IDENTIFICATION numbers for process and system information in monitor and control direction.

Process information in monitor direction :

1 Time-tagged message
2 Time-tagged message with relative time
3 Measurands I
4 Time-tagged measurands with relative time
5 Identification
6 Time synchronisation
   
8 General interrogation termination
9 Measurands II
10 Generic data
11 Generic identification
   
23 List of recorded disturbances
   
26 Ready for transmission of disturbance data
27 Ready for transmission of a channel
28 Ready for transmission of tags
29 Transmission of tags
30 Transmission of disturbance values
31 End of transmission

System information in control direction :

6 Time synchronisation
7 General interrogation
   
10 Generic data
   
20 General command
21 Generic command
   
24 Order for disturbance data transmission
25 Acknowledgement for disturbance data transmission

 

The program SIMO is able to process user-defined messages from 1-127, provided they do not contravene against the telegram structure of IEC 60870-5-103. 

Variable structure qualifier :

The SQ bit specifies the method of addressing of the following information objects or elements.

SQ = 1

Each single element or a combination of elements is addressed by the information object address. The ASDU may consist of one or more than one equal information objects. The number of objects is binary coded and defines the number of the information objects.

SQ = 0

A sequence of equal information elements (e.g. measured values of identical format) is addressed by the object address. The information object address specifies the associated address of the first information element of the sequence. The following information elements are identified by numbers incrementing continuously by + 1 from this offset. The number of objects is binary coded and defines the number of the information elements. In case of a sequence of information elements only one information object per ASDU is allocated.

Cause of transmission :

The cause of transmission directs the ASDU to a specific application task (program) for processing.

ASDUs in control direction are confirmed application services and may be mirrored in monitor direction with different causes of transmission.

Common address of ASDU :

The common address is associated with all objects in an ASDU. The global address is a broadcast address directed to all stations of a specific system. ASDUs with a broadcast address in control direction have to be answered in monitor direction by ASDUs that contain the specific defined common address  (station address). According to the standard this parameter can consist of 1 octets.

Function type :

 

Information number :

 

 


Simulation mode

With the implemented simulation mode the program SIMO offers besides the recording of telegrams the possibility of using the PC as a counter-station.

 

Please note that the simulation was completely revised as of version 3.56.5. Corresponding to the used LIAN-DOS version please read the equivalent section.  

 

Simulation with LIAN-DOS up to version 3.56.4

The simulation can be started via the command 'RTI [time window] [repetitions]. There is no difference between primary- and secondary station or balanced- and unbalanced transmission. The program orientates to the function code and the PRM bit in the control field of the link layer.

The parameter [time window] determines the  time  in 1/10  seconds  that  the  program SIMO as primary station  at most has to wait for an acknowledge before the transmission is repeated. Via the parameter  [repetitions] it is defined  how many times the above procedure is to be repeated. The call  'RTI 10 3' ,for example, defines a monitoring time of  one second and up to 3 repetitions. 

If   'RTI' without parameter is entered, the time monitoring is  switched off  and there are no repetitions. As long as the program SIMO  is waiting for an acknowledge no further  telegrams are  included in the send list. By entering  'RTI' again during running simulation, the simulation is switched off.

The program SIMO as secondary station transmits dependent  on the function code of the primary station automatically acknowledges according to the message buffers listed in the table.  The corresponding telegrams must be of course edited in the declared TDB buffers.

Allocation of  TDB (Transmit data buffer)

number commentary telegram type data (hexadezimal)
490

491

492

493

494

495

CONFIRM Fkt 00          490

CONFIRM Fkt 03          491

CONFIRM Fkt 07          491

RESPOND auf Fkt 09   493

RESPOND auf Fkt 10   494

RESPOND auf Fkt 11   495

10H fixed length

10H fixed length

10H fixed length

10H fixed length

10H fixed length

10H fixed length

10  00  00  00  16

10  00  00  00  16

10  00  00  00  16

10  000  00  16

10  09  00  00  16

10  09  00  00  16

Course of simulation

Program SIMO as secondary station

Receipt of telegrams from the primary station
function transmitted from the primary station SIMO transmits TDB
0 SEND-CONFIRM expected

standardizing of the communication unit  of the  secondary station.

buffer 490
1,2 reserved for particular use  
3 SEND-CONFIRM expected

user data

buffer 491
4 SEND

no response expected 

 
5, 6,  reserved for particular use  
7 SEND-CONFIRM expected buffer 492
8 reserved for particular use  
9 REQUEST-RESPOND expected

query of state of communication unit

buffer 493
10 REQUEST-RESPOND expected

query of user data class 1

buffer 494
11 REQUEST-RESPOND expected

query of user data class 2

buffer 495
12 - 15 reserved for particular use  

Program SIMO as primary station

 Receipt of telegrams from the  secondary station 
function transmitted from the secondary station actions in SIMO 
0 CONFIRM

Positive acknowledge  (ACK)

switch off timer 
1, 2 reserved for particular use  
3 CONFIRM  
4 SEND

no respond expected

 
5, 6 reserved for particular use  
7 CONFIRM switch off timer 
8 reserved for particular use  
9 RESPOND

query of state of communication unit

switch off timer 
10 RESPOND

query of user data class 1

switch off timer 
11 RESPOND

query of user data class 2

switch off timer 
12 - 15 reserved for particular use  

 

Transmission of telegrams to the secondary station
function Telegram type / service function SIMO transmits 
0 SEND-CONFIRM expected

standardizing of the communication unit  of the  secondary station.

FCB set back

FCB, FCV = 0

ACK function 0

start timer

1, 2 reserved for particular use  
3 SEND-CONFIRM expected

user data

FCB invert

FCV = 1

ACK function 0

start timer

4 SEND-no response expected FCB, FCV = 0
5, 6 reserved for particular use  
7 SEND-CONFIRM expected FCB set back

FCB, FCV = 0

ACK function 0

start timer

8 reserved for particular use  
9 REQUEST-RESPOND expected

query of state of communication unit

FCB, FCV = 0

ACK function 11

start timer

10 REQUEST-RESPOND expected

query of user data class1

FCB invert

FCV = 1

ACK function 8

start timer

11 REQUEST-RESPOND expected

query of user data class 2

FCB invert

FCV = 1

ACK function 8

start timer

12 - 15 reserved for particular use  

 


Extended simulation with LIAN-DOS as of version 3.56.5

All parameters needed for the simulation are set in the program LIAN via menu item  <settings | simulation>  ( see section  5.3.5.16 settings - simulation )

RTI (Master)-simulation
Link address

This link address is the target address and will be inserted in each telegram to be sent during master simulation.

Exception for unbalanced mode :
The link address ( 255 for an one octet address ) of a broadcast command is entered in the TDB buffer telegram. 

ASDU address

This ASDU address is the target address and will be inserted in each telegram to be sent during master simulation.

Exception for unbalanced mode :
The ASDU address ( 255 for an one octet address ) of a broadcast command is entered in the TDB buffer telegram. 

Response timeout

The IEC 870-5-103 standard specifies a fixed link time-out interval to be used for repeated frame transmissions. The time-out interval and maximum number of retries are configurable and appropriate values will depend on the transmission system.

This parameter determines the time in 1/10 seconds  that the program SIMO as primary station  at most has to wait for an acknowledge before the transmission is repeated.

Number of frame retries Via this parameter it is defined  how many times the transmission is to be repeated when the acknowledge is missing. 
Reset Communication Unit
( Standardizing of communication unit )

yes / no

The controlling station synchronizes its link with the controlled station by transmitting "Request status of link" and "Reset communication unit". The controlled station responds with "Status of link" and "ACK" respectively, and when the "ACK" is received in the controlling station the link connection is established.

The telegram "Request status of link" ( PRM=1, function 9 ) must be stored in the TDB buffer 470 and the telegram "Reset communication unit" ( PRM = 1, function 9 ) must be stored in the TDB buffer 471.

Reset Frame Count Bit yes / no

The telegram "Reset FCB" ( PRM = 1, Function 7 ) must be stored in the TDB buffer 475. 

Scan delay

( only unbalanced )

 

This parameter determines the time in 1/10 seconds  that the program SIMO delays the next request ( data class 1 or 2 ).

The telegram "Request user data class 1" ( PRM = 1, function 10 ) must be stored in the TDB buffer 473 and the telegram "Request user data class 2" ( PRM = 1, function 11 ) must be stored in the TDB buffer 474.

 

RTU (Slave)-simulation
Link address

This link address is the source address and will be inserted in each telegram sent during RTU simulation.

ASDU address

This ASDU address is the source address and will be inserted in each telegram sent during RTU simulation.

Response timeout

( only balanced )

The IEC 870-5-103 standard specifies a fixed link time-out interval to be used for repeated frame transmissions. The time-out interval and maximum number of retries are configurable and appropriate values will depend on the transmission system.

This parameter determines the time in 1/10 seconds  that the program SIMO as primary station  at most has to wait for an acknowledge before the last transmission is repeated.

Number of frame retries
( only balanced )

Via this parameter it is defined  how many times the transmission is to be repeated when the acknowledge is missing ( only balanced ). 

Enable Station initialization

( only balanced )

yes / no

The controlling station synchronizes its link with the controlled station by transmitting "Request status of link" and "Reset of remote link". The controlled station responds with "Status of link" and "ACK" respectively, and when the "ACK" is received in the controlling station the link connection is established.

The telegram "Request status of link" ( PRM=1, function 9 ) must be stored in the TDB buffer 470 and the telegram "standardizing of the communication unit" ( PRM = 1, function 9 ) must be stored in the TDB buffer 471.

End of initialization yes / no

The telegram ( ID 05, COT 4 ) must be stored  in the TDB buffer 479.

 

Allocation of TDB Buffers (Transmit data buffer) for the primary station

TDBnum Commentary Frame Data

470

471
  

...

473

474

475

.....

479
   

Request status of link

Standardizing of the communication unit

 ....

Request user data class 1

Request user data class 2

Reset FCB

....

Identification
( End of initialization ) 

10H

10H
   

  ....

10H

10H

 10H 

...

68H
  

RES 0 PRM 1 FCB 0 FCV 0 FKT 09

RES 0 PRM 1 FCB 0 FCV 0 FKT 00
  

  ....

RES 0 PRM 1 FCB 0 FCV 1 FKT 10

RES 0 PRM 1 FCB 0 FCV 1 FKT 11

RES 0 PRM 1 FCB 0 FCV 0 FKT 07

....

RES 0 PRM 0 ACD 0 DFC 0 FKT 03 // PzP
RES 0 PRM 0 ACD 0 DFC 0 FKT 08 // Gmv

 

Allocation of TDB Buffers (Transmit data buffer) for acknowledges of the secondary station

TDBnum Commentary Frame Data

480

481

482

483

...

485

486

487

488

489

490

491

492

493

494

495

CONFIRM on Function 00

Service not available

Service not available

CONFIRM on Function 03

....

Service not available

Service not available

CONFIRM on Function 07

Service not available

RESPOND on Function 09

RESPOND on Function 10

RESPOND on Function 11

Service not available

Service not available

Service not available

Service not available

10H

10H

10H

E5H

...

10H

10H

10H

10H

10H

10H

10H

10H

10H

10H

10H

RES 0 PRM 0 ACD 0 DFC 0 FKT 00

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

E5H CONFIRM ACK

...

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

RES 0 PRM 0 ACD 0 DFC 0 FKT 00

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

RES 0 PRM 0 ACD 0 DFC 0 FKT 11

RES 0 PRM 0 ACD 0 DFC 0 FKT 09

RES 0 PRM 0 ACD 0 DFC 0 FKT 09

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

RES 0 PRM 0 ACD 0 DFC 0 FKT 15

 


Simulation procedures

Simulation of the communication services :

LIAN DOS orientates to the function code and the PRM bit in the control field of the link layer :

The parameter [response timeout] determines the time in milliseconds that LIAN DOS after transmitting a primary message  at most has to wait for an acknowledge before the transmission is repeated. Via the parameter [number of frame retries] it is defined how many times the message is to be repeated. As long as the program is waiting for an acknowledge no further telegrams are included in the send list.

LIAN DOS transmits dependent on the function code of a primary message automatically acknowledges according to the defined TDB buffer numbers above. The corresponding frames must be of course edited in the declared TDB buffers.

The program also alternates the FCB bit for each new SEND/ CONFIRM or REQUEST/ RESPOND transmission service directed to the same secondary station. Thus the primary station keeps a copy of the frame count bit per secondary station. In case of reset commands the FCB bit is always zero, and upon receipt of these commands the secondary station will always be set to expect the next frame primary to secondary with FCV = valid ( FCV = 1 ) to have the opposite setting of FCB.

If master simulation and balanced transmission mode are selected the DIR bit is set to 1 in the control field of the link layer for all sent telegrams.

.

Station initialization

The primary station synchronizes its link with the secondary station with the transmission "Request status of link" and "Standardizing of the communication unit". The secondary station responds with "Status of link" or "ACK". When the primary station receives "ACK" the link is established.

The station initialization will be done by LIAN DOS automatically when the master (RTI)- or the slave (RTU) simulation is started.

.

Simulation of the application functions :

.

General interrogation

The general interrogation application function is used to update the controlling station after the station initialisation procedure or when the controlling station detects a loss of information.

The general interrogation function of the controlling station requests the controlled station to transmit the actual values of all its process variables. The interrogation procedure is finished when the controlling station receives an End of Interrogation message.

The information transfer is triggered by an interrogation command ( ID 07, COT 9 ) message from the controlling station to the controlled station, which responds with a confirmation. The controlled station transmits the interrogated information by means of one or more monitored information ASDUs. The last information ASDU is then followed by an interrogation termination message ( ID 08, COT 10 ), indicating that all information has been transferred.

Clock synchronization

Clocks of controlled stations are initially synchronised by the controlling station after initialisation and then re-synchronized periodically.

A CLOCK SYNCHRONIZATION command message ( ID 06, COT 8 ) containing the full current clock time is sent from the controlling station. After the execution of the clock synchronization the controlled station generates a confirmation ( ID 06 ) message which contains the local time before synchronization.

Command transmission The controlling station sends a command message ( ID 20 ) to the controlled station, which responds by a COMMAND confirmation message ( positive if the specified control action is about to begin, otherwise negative ). The addressed equipment should now change its state, and the new state is indicated to the controlling station by a spontaneous data message when reached.
Test Mode

 

Blocking of monitor direction

 

Transmission of disturbance data

 

Blocking of monitor direction

 

 


Plaintext display format

The output for each channel can be manipulated over the menu item Format in the programs SIMO, TRAP and TDEP. To optimize the output one can distinguish between three plaintext settings for protocols with long telegrams ( e.g. IEC protocols )

Plaintext F 1

Plaintext F 2

Plaintext F 3

output of the complete telegram (link layer + identification + information)

output of link layer and information of data unit

output of information only

 


Transmission errors

Error checks during receive by LIAN DOS :
  • per character the start bit, the stop bit and the even parity bit.
  • per frame the start character, the frame checksum and the end character and  the length (2  bytes) and second start character in frames with variable lengths.
*F:BCCode The telegram check sum in the BCC-Byte is incorrect
*F:Blocklength The stop byte ( 16H ) is missing or set wrongly.
*F:TelFormat The repetition of the length or the start sign in the telegram header is  faulty.
*F:TimeOut Within a telegram, there may be no pause between characters. The sensitivity  can be parameterized in the program LIAN.
*F:SYNC The receive routine initially searches for 68H, 10H or E5H. Every other character is given an asterisk '*' in SIMO and a synchronization error is noted against it in the protocol.
*F:Overflow Error message by  UART
*F:Parity Error message by  UART
*F:Start/Stop Error message by  UART
*F:VSQ The information stored in the field 'variable structure qualifier' is absurd, probably caused by wrong field length with the  parameterization.

 

Error checks during simulation by LIAN DOS  ( as of version 3.56.5 ) 
*F: DIR-Bit ! Balanced : Direction bit is wrong.
*F: PRM-Bit ! Primary message bit is wrong.
*F: FCB-Bit ! Frame count bit is wrong.
*F: FCV-Bit ! Frame count bit valid is not correct set.
*F: un-reset ! No station initialization is done yet, but in the message the FCV bit is already set.
*F: unexpected ! The respond was not expected.

 


MAYR Software

Wuerzburger Ring 39,  D 91056 Erlangen

Manual LIAN DOS


LIAN DOS Protocol Simulator and Analyzer
© Copyright 1991, 1996, 2001, 2006-2010 by Werner Mayr. All Rights reserved.