Siemens Automation Partsucc.colorado.edu/siemens/GF_PRE_ACP_DNP3_ENG.pdfPreface 4 SICAM RTUs •...

DC0-090-2.10

SICAM RTUsSICAM A8000 Series

Common Functions DNP3

Protocol Element

___________________________________________________________________________

Preface, Table of Contents ___________________________________________________________________________

Introduction 1 ___________________________________________________________________________

Protocol Description 2 ___________________________________________________________________________

Application Notes 3 ___________________________________________________________________________

Literature ___________________________________________________________________________

Siemens Automation Parts

https://industrialautomation.co/product-category/siemens/page/6470/

Siemens AG Order number: DC0-090-2.10

Note

Please observe Notes and Warnings for your own safety in the Preface.

Disclaimer of LiabilityAlthough we have carefully checked the contents of this publicationfor conformity with the hardware and software described, we cannotguarantee complete conformity since errors cannot be excluded.The information provided in this manual is checked at regularintervals and any corrections that might become necessary areincluded in the next releases. Any suggestions for improvement arewelcome.

Subject to change without prior notice.Issuing date: 2017-12-11

CopyrightCopyright © Siemens AG 2017The reproduction, transmission or use of this document or itscontents is not permitted without express written authority.Offenders will be liable for damages. All rights, including rightscreated by patent grant or registration of a utility model or design,are reserved.

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 3DC0-090-2.10, Edition 12.2017

Preface

This document is applicable to the following product(s):

· SICAM AK 3· SICAM AK· SICAM TM· SICAM A8000 Series

─ CP-8000─ CP-8021─ CP-8022

· SICAM EMIC· SICAM BC· AK 1703· AMC 1703

Purpose of this manual

This manual describes the function and the manner of working of the DNP3 protocol andessentially contains:

· Functional descriptions

Target Group

The document you are reading right now is addressed to users, who are in charge of thefollowing engineering tasks:

· Conceptual activities, as for example design and configuration· Creation of the assembly technical documentation using the designated engineering tools· System parameterization and system diagnostic, using the designated engineering tools· Technical system maintenance

NoteThe functions described in this manual are illustrated with screenshots of the SICAM TOOLBOX II. Forexample these pictures show the use of the protocol element in SICAM AK. However they are also valid- under consideration of the product-specific differences - for the other products.



Preface

4 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3Edition 12.2017, DC0-090-2.10

Notes on Safety

This manual does not constitute a complete catalog of all safety measures required foroperating the equipment (module, device) in question because special operating conditionsmight require additional measures. However, it does contain notes that must be adhered to foryour own personal safety and to avoid damage to property. These notes are highlighted with awarning triangle and different keywords indicating different degrees of danger.

Dangermeans that death, serious bodily injury or considerable property damage will occur, if the appropriateprecautionary measures are not carried out.

Warningmeans that death, serious bodily injury or considerable property damage can occur, if the appropriateprecautionary measures are not carried out.

Cautionmeans that minor bodily injury or property damage could occur, if the appropriate precautionary measuresare not carried out.

Noteis important information about the product, the handling of the product or the respective part of thedocumentation, to which special attention is to be given.

Qualified PersonnelCommissioning and operation of the equipment (module, device) described in this manual must beperformed by qualified personnel only. As used in the safety notes contained in this manual, qualifiedpersonnel are those persons who are authorized to commission, release, ground, and tag devices,systems, and electrical circuits in accordance with safety standards.

Use as PrescribedThe equipment (device, module) must not be used for any other purposes than those described in theCatalog and the Technical Description. If it is used together with third-party devices and components,these must be recommended or approved by Siemens.

Correct and safe operation of the product requires adequate transportation, storage, installation, andmounting as well as appropriate use and maintenance.

During operation of electrical equipment, it is unavoidable that certain parts of this equipment will carrydangerous voltages. Severe injury or damage to property can occur if the appropriate measures are nottaken:

· Before making any connections at all, ground the equipment at the PE terminal.· Hazardous voltages can be present on all switching components connected to the power supply.· Even after the supply voltage has been disconnected, hazardous voltages can still be present in the

equipment (capacitor storage).· Equipment with current transformer circuits must not be operated while open.· The limit values indicated in the manual or the operating instructions must not be exceeded; that also

applies to testing and commissioning.

Consider obligatory the safety rules for the accomplishment of works at electrical plants:

1. Switch off electricity all-pole and on all sides!2. Ensure that electricity cannot be switched on again!3. Double check that no electrical current is flowing!4. Discharge, ground, short circuit!5. Cover or otherwise isolate components that are still electrically active!


Table of Contents

1 Introduction ................................................................................................................... 9

1.1 Application ..................................................................................................... 101.1.1 Which Protocols are available in which Systems ........................................ 101.2 Configuration .................................................................................................. 111.2.1 Communication ......................................................................................... 111.3 Features and Functions .................................................................................. 14

2 Protocol Description ................................................................................................... 15

2.1 Overview ........................................................................................................ 162.2 Technical Specifications ................................................................................. 192.3 Limitations ...................................................................................................... 222.4 Communication according to DNP3 ................................................................ 232.4.1 Data Acquisition through Queries and "unsolicited Responses" .................. 232.4.1.1 Continuous Interrogation of a Controlled Station ................................... 252.4.1.2 Acknowledgement Procedure ............................................................... 252.4.1.3 Failure Monitoring ................................................................................. 272.4.2 Station Initialization .................................................................................... 272.4.3 Acquisition of Events (transmission of data ready to be sent) ..................... 282.4.3.1 Message from the Controlled Station to the Controlling Station ............. 282.4.4 General Interrogation, Controlled Station Interrogation ............................... 292.4.5 Clock Synchronization ............................................................................... 302.4.5.1 Clock Synchronization with NTP (DNPi00 and DNPiA1 only)................. 312.4.5.1.1 NTP/SNTP Client “Clock Synchronization with one or several NTP

Servers” ........................................................................................... 322.4.5.1.2 Integrated NTP Server Clock Synchronization for one or several NTP

Clients ............................................................................................. 352.4.6 Command Transmission ............................................................................ 362.4.6.1 Message from Controlling Station selectively to a Controlled Station ..... 362.4.7 Count Transmission by means of Interrogation Command ......................... 362.4.8 Spontaneous Count Transmission ............................................................. 362.5 Optimized Parameters for selected Transmission Facilities (serial

communication) .............................................................................................. 372.6 Function for the Support of redundant Communication Routes ........................ 422.6.1 Redundancy Mode “SICAM RTUs Redundancy” ........................................ 422.7 Web Server (DNPi00 only).............................................................................. 432.8 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPi00 only) ........... 452.8.1 Remote Operation via external Terminal Server (Connection to M-CPU with

TIAX00) ..................................................................................................... 452.8.2 Remote Operation via integrated Terminal Server ...................................... 462.9 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPiA1 only) .......... 472.9.1 Remote Operation via TCP/IP HTTP/HTTPS ............................................. 47



Table of Contents


2.10 DNP3 Protocol Description ............................................................................. 492.10.1 PCMBA Modulation Method ....................................................................... 492.11 Interface Circuits Used ................................................................................... 502.12 Message Description for DNP3 (Data Link Layer) ........................................... 512.12.1 FT3 Message Format for Messages with variable Lengths ......................... 512.12.2 Message Structure for DNP3 ..................................................................... 542.12.2.1 LINK Header (message header) ........................................................... 552.12.2.2 Transport Header ................................................................................. 582.12.2.3 User Data (APDU) ................................................................................ 592.12.2.3.1 Application Header (APCI) ............................................................... 602.12.2.3.2 Object Header (DUI) ........................................................................ 642.12.2.3.3 Data Objects (IO) ............................................................................. 652.12.2.3.4 Data Index ....................................................................................... 652.12.3 Message Examples for DNP3 .................................................................... 652.13 Message Conversion ...................................................................................... 662.13.1 Status Information General Rules .............................................................. 692.13.1.1 Conversion of NT-bit ............................................................................. 702.13.1.2 Conversion of IV-bit .............................................................................. 702.13.1.3 Status Information for Binary Information .............................................. 712.13.1.4 Status Information for Measured Values ............................................... 712.13.1.5 Status Information for Counter Values .................................................. 712.13.2 DNP3 MASTER: Message Conversion in Receive Direction ...................... 722.13.2.1 Process Information “Binary Input” ........................................................ 732.13.2.2 Process Information “Double Binary Input” ............................................ 772.13.2.2.1 Process Information “Binary Output” ................................................ 802.13.2.3 Message Conversion Measured Values ................................................ 822.13.2.4 Message Conversion of Counts ............................................................ 902.13.3 DNP3 MASTER: Message Conversion in Transmit Direction ..................... 962.13.3.1 Message Conversion of Commands ..................................................... 972.13.3.2 Message Conversion of Binary Output ................................................ 1012.13.3.3 Message Conversion of Setpoint Values ............................................. 1032.13.4 DNP3 SLAVE: Message Conversion in Transmit Direction ....................... 1052.13.4.1 Message Conversion of Process Information ...................................... 1062.13.4.1.1 Conversion to Binary Input ............................................................. 1062.13.4.1.2 Conversion to Double Binary Input ................................................. 1092.13.4.2 Message Conversion Measured Values .............................................. 1122.13.4.3 Message Conversion Counts .............................................................. 1202.13.5 DNP3 SLAVE: Message Conversion in Receive Direction ........................ 1242.13.5.1 Message Conversion Commands ....................................................... 1252.13.5.2 Message Conversion Setpoint Values................................................. 1292.14 Special Functions ......................................................................................... 1322.14.1 Sags and Swells for DNP3 Master and Slave........................................... 1322.14.2 Storing User Data on the BSE (DNP3 Slave) ........................................... 1352.14.3 Enable SCBO (Check Back Before Operate) ........................................... 136

Table of Contents


2.14.4 Redundancy Function: Hot Standby ......................................................... 1372.14.5 State Compression for Measured Value Events ....................................... 1382.14.6 Link Address Substitution (DNPi00, DNPiA1 and DNPiT1 only) ................ 1382.15 Wildcard TCP/IP Address (DNPiT1) .............................................................. 1392.16 Protocol Element Control and Return Information ......................................... 1402.16.1 Protocol Element Control Slave ............................................................... 1412.16.1.1 Control Internal Indication Bit LOCAL .................................................. 1412.16.1.2 Control Selective Command Disable ................................................... 1422.16.1.3 Control Command Disable for OFF and ON Command ....................... 1432.16.1.4 Deactivate/Activate Events ................................................................. 1452.16.2 Protocol Element Control Master ............................................................. 1462.16.2.1 Send „Reset Link“ ............................................................................... 1462.16.3 Protocol Element Return Information ....................................................... 1472.17 Web Server .................................................................................................. 1482.17.1 Overview ................................................................................................. 1502.17.2 Connections ............................................................................................ 1512.17.3 Routing Transmit ..................................................................................... 1522.17.4 Routing Receive ...................................................................................... 1532.17.5 Developer Information - Freespace .......................................................... 1542.17.6 Developer Information – Dataflow Test .................................................... 155

3 Application Notes ...................................................................................................... 157

3.1 General ........................................................................................................ 1583.1.1 What are Static Data and what are Event Data? ...................................... 1583.1.2 What are Class 0, 1, 2 or 3 Data? ............................................................ 1583.1.3 Object Group and Object Variation .......................................................... 1593.1.4 Use of the Data Index .............................................................................. 1593.1.5 Unsolicited Response .............................................................................. 1593.2 Central Function ........................................................................................... 1603.2.1 Cyclic Data Query.................................................................................... 1603.2.2 Conversion 2 Single Binary Inputs to 1 Double-Point Information ............. 1613.3 Controlled Station Function........................................................................... 1623.3.1 Conversion 1 Double-Point Information to 2 Single Binary Inputs ............. 162



Table of Contents



1 Introduction

Contents

1.1 Application ..................................................................................................... 101.2 Configuration .................................................................................................. 111.3 Features and Functions .................................................................................. 14



Introduction


1.1 Application

The DNP3 protocol (Distributed Network Protocol) is used in automation units of the systemsSICAM AK, SICAM TM, SICAM BC, SICAM EMIC, SICAM A8000 Serie (CP-8000, CP-8021,CP-8022), AK 1703 and AMC 1703. It is deployed in the fields of telecontrol and automation.

The protocol is used for the exchange of data - and thereby for the transmission of messages- over a communication interface to other automation units or devices of other manufacturers.

1.1.1 Which Protocols are available in which Systems

Protocol SM

-254

1

SM

-254

5

SM

-055

1,S

M-2

551

SM

-254

6(o

nly

CP

xxxx

)S

M-2

556

SM

-255

8

SIC

AM

MIC

SIC

AM

EM

IC

SIC

AM

CP

-800

0,C

P-8

021,

CP

-802

2S

ICA

MB

C(lo

calS

S)

(onl

yC

P-5

014)

AM

C17

03(lo

calS

S)

(onl

yC

P-4

000)

DNP3 Master (serial) £ n n

DNP3 Slave (serial) £ n n n

DNP3 Master (LAN, TCP/IP) ¨ n

DNP3 Slave (LAN, TCP/IP) ¨ n n n n

↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓

System

n n n n AK 1703

n n n n n AMC 1703

n n SICAM AK 3

n n n n n SICAM AK

n n n n n SICAM TM

SICAM MIC

n SICAM EMIC

n SICAM A8000

n n n n n n SICAM BC

Legend:n available£ available – new functions are no longer implemented on this hardware!¨ only with external terminal servers (serial-to-Ethernet), e.g. Lantronix or Ruggedcom

DNP3 "serial" is used as protocoln product discontinued, termination of delivery date exceeded

Introduction


1.2 Configuration

1.2.1 Communication

For the stations to communicate with each other, suitable transmission facilities and/ornetwork components may be needed in addition.

Controlling station

System System Element Protocol Element Note

SICAM AK 3 CP-2016/CPCX26CP-2019/PCCX26CP-2017/PCCX25

SM-2551/DNPMA0SM-0551/DNPMA0

max. 20 Slaves

SICAM AK CP-2014/CPCX25CP-2010/CPC25CP-2017/PCCX25CP-2012/PCCE25


max. 20 Slaves

SICAM A8000 Series SICAM CP-8000 SICAM CP-8021 SICAM CP-8022

CP-8000/CPC80CP-8021/CPC80CP-8022/CPC80

DNPMT0 max. 10 Slaves


DNPiT2 max. 4 Slaves

SICAM BC CP-5014/CPCX55CP-5000/CPC55


max. 20 Slaves

SICAM TM CP-6014/CPCX65CP-6003/CPC65


max. 20 Slaves

AK 1703 CP-2000/CPC00CP-2002/PCCE00CP-2002/CE00CP-2012/CE20


max. 20 Slaves

AMC 1703 CP-4000/CCP4xCP-4003/CCP4x


max. 20 Slaves



Introduction


Controlled station

System System Element Protocol Element Note

SICAM AK 3 CP-2016/CPCX26CP-2019/PCCX26CP-2017/PCCX25

SM-2551/DNPSA0SM-0551/DNPSA0

1 Master as remote station

CP-2019/PCCX26CP-2017/PCCX25

SM-2546/DNPi00SM-2556/DNPi00

Max. 100 remote stations(Multislave)

CP-2019/PCCX26CP-2017/PCCX25

SM-2558/DNPiA1 Max. 100 remote stations(Multislave)

SICAM AK CP-2014/CPCX25CP-2010/CPC25CP-2017/PCCX25CP-2012/PCCE25



CP-2017/PCCX25CP-2010/CPC25CP-2012/PCCE25



CP-2017/PCCX25CP-2010/CPC25CP-2012/PCCE25


SICAM A8000 Series SICAM CP-8000 SICAM CP-8021 SICAM CP-8022


DNPST0 1 Master as remote station


DNPiT1 Max. 4 remote stations(Multislave)

SICAM BC CP-5014/CPCX55CP-5000/CPC55



CP-5014/CPCX55CP-5000/CPC55



CP-5014/CPCX55CP-5000/CPC55


SICAM TM CP-6014/CPCX65CP-6003/CPC65






AK 1703 CP-2000/CPC00CP-2002/PCCE00CP-2002/CE00CP-2012/CE20





AMC 1703 CP-4000/CCP4xCP-4003/CCP4x



SICAM EMIC DNPST0 1 Master as remote station

DNPiT0 Max. 2 remote stations(Multislave)

Third-party system -- -- According to SICAM RTUsDNP3 Interoperability

Introduction


Note when using DNPi00/DNPiT1/DNPiA1When using the function of the controlled station a controlled station must always be connected with onlyone controlling station. The DNP destination address and DNP source address may always only occur onetime in the definition of the network connections (connection definitions). It is not possible to connectmultiple controlled stations (e.g. DNP source address 1000, 1001 and 1002) to the same controllingstation (e.g. DNP destination address 10). Nevertheless and if needed it is possible to substitute the DNPdestination address and the DNP source addres for a maximum of 4 connections (see 2.14.6)

The following examples are possible:

· 1 controlling station with 18 controlled stations· 1 controlling station with 18 controlled stations and a further controlling station with 10

controlled stations· 1 controlled station with 1 controlling station· 3 controlled stations with 3 controlling stations· Combinations from the preceding points

NoteThe present versions of the firmwares DNPi00, DNPiT0, DNPiT1 and DNPiA1 only support the controlledstation functionality.In a later expansion variant the function of the controlling station will also be supported.



Introduction


1.3 Features and Functions

General Functions

Unbalanced Multi-Point (multi-point traffic) according to DNP3 over serial or network (TCP/IP)based transmission facilities

· DNPMx0 is controlling station (Master), DNPSx0 is controlled station (Slave) for DNP3serial

· DNPix0 and DNPix1 is controlled station (Slave) for DNP over TCP/IP─ Supported functionality according to:

SICAM RTUs DNP3 Interoperability (DC0-046-2)─ Data acquisition by polling (station interrogation)─ Acquisition of events (transmission of data ready to be sent, unsolicited responses)─ General interrogation, controlled station interrogation─ Command transmission─ Transmission of integrated totals

· DNPix2 is controlling station (Master) for DNP over TCP/IP─ Supported functionality according to:

SICAM RTUs DNP3 Interoperability (DC0-046-2)─ Data acquisition by polling (station interrogation, event request)─ General interrogation, controlled station interrogation─ Command transmission

· Clock synchronization according to NTP (Network Time Protocol) - RFC 1305 1)

─ NTP Client: Clock synchronization with one or more NTP servers─ NTP Server: integrated NTP server for clock synchronization of one or several

NTP clients

· Optimized parameters for selected transmission facilities 2)

· Functions for supporting redundant communication routes· Special functions· SICAM TOOLBOX II connection over LAN/WAN ("remote operation") 1)

─ Connection via proprietary TCP/IP protocol(one SICAM TOOLBOX II session can be served at the same time)

· Web server 1)

─ Integrated web server to display connection- statistic- and developer information─ Access to the web server with standard web browser via HTTP (Hyper Text Transfer

Protocol)______1) only DNP3 over TCP/IP2) only DNP3 serial

NoteThe above mentioned functions are described in detail in the chapter Protocol Description.

As a third-party system adaptation this protocol element implements only part of the functionality and dataformats of the third-party interface. It is therefore always to be checked for a concrete case of application,whether the supported functionality corresponds with the functionality required in the project, respectivelywhich additional functions or adaptations are required.


2 Protocol Description

Contents

2.1 Overview ........................................................................................................ 162.2 Technical Specifications ................................................................................. 192.3 Limitations ...................................................................................................... 222.4 Communication according to DNP3 ................................................................ 232.5 Optimized Parameters for selected Transmission Facilities (serial

communication) .............................................................................................. 372.6 Function for the Support of redundant Communication Routes ........................ 422.7 Web Server (DNPi00 only).............................................................................. 432.8 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPi00 only) ........... 452.9 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPiA1 only) .......... 472.10 DNP3 Protocol Description ............................................................................. 492.11 Interface Circuits Used ................................................................................... 502.12 Message Description for DNP3 (Data Link Layer) ........................................... 512.13 Message Conversion ...................................................................................... 662.14 Special Functions ......................................................................................... 1322.15 Wildcard TCP/IP Address (DNPiT1) .............................................................. 1392.16 Protocol Element Control and Return Information ......................................... 1402.17 Web Server .................................................................................................. 148



Protocol Description


2.1 Overview

The DNP3 protocol (Distributed Network Protocol) is an official communication standard fortelecontrol engineering. The protocol is used as general transmission protocol between controlsystems and remote stations.Typically the messages are transmitted over serial connections (ITU-T V.24 (EIA-232) / ITU-TV.28 (EIA-422) as well as over a network (TCP/IP) based infrastructure. The DNP3 telecontrolprotocol is standardized and further developed by the DNP Users Group.

The DNP3 protocol defines one controlling station with one or multiple controlled stations.

The controlling station and the controlled stations work with a communication protocolaccording to DNP3 in multi-point traffic.The supported functionality (interoperability) of the various devices can be seen in the device-specific "DNP3 Device Profile Document" – for SICAM RTUs in the document "SICAM RTUsDNP3 Interoperability".

A communication protocol for which a controlling station is connected with one or multiplecontrolled stations over a communication link in a linear or star configuration is known as multi-point traffic. The data traffic is controlled by the controlling station, whereby with DNP3, incontrast to other protocols, the controlled station can also send unsolicited spontaneous data(=unsolicited responses).

The protocol element DNPMx0 enables the serial communication of one MASTER with up to amaximum of 20 controlled stations (SLAVES) on a common line.Every controlled station is assigned an unambiguous station number (DNP source address) inthe range "0 - 65519". The controlling station is also assigned an unambiguous station numberin the range "0 - 65519".The station number 65535 (0xFFFF) is used for the simultaneous addressing of all stations (=BROADCAST). With this type of addressing no reply (Response Message) is transmitted fromthe SLAVES to the MASTER.

The protocol element DNPSx0 enables the serial communication of one controlled station withone controlling station.

As “Multi-Slave” the protocol element DNPi00 enables the communication of one or multiplecontrolled station(s) with one or multiple controlling stations over Ethernet (LAN/WAN).A controlled station can only communicate with one unambiguous controlling station.

NoteWhen using the firmware DNPi00 it is not possible to couple multiple controlled stations to one and thesame controlling station.Multiple controlled stations can only be connected to different controlling stations.



With DNP3 a transmission of data can be initiated not only by the MASTER station but also bythe SLAVE station. A data transmission consists either of a "query-response sequence"(= Query/Response Type) to selectively addressed controlled stations or a simultaneousaddressing of all connected controlled stations (= BROADCAST/NO Response Type).

The cyclic queries or data messages provided for the DNP3 communication protocol aretransmitted by the controlling station. Data from the controlled station to the controlling stationcan be transmitted either as direct response to a query or as spontaneous data withoutpreceding query.

Schematic configuration DNP3 "serial":

Schematic configuration DNP3 over Ethernet (TCP/IP):

DNP3 Slave #1Remote Station (Ax/ACP 1703)

DNPMx0

DNP3 Slave#2

DNP3 Slave#3

DNP3 Slave#n

DNP3 - protocol (max. 100 stations) – recommended „max. 20 stations“

n <= 65519

DNPSx0

DNP3 Master Station(Ax/ACP 1703)

serial-Interface

Switch

Switch Switch

Switch Switch

LAN-Interface

LAN-Interface

**) max. 100 connections per LAN-Interface

DNP3Zentralstation

Master #n

Ethernet “DNP3 over TCP/IP“ Ethernet “DNP3 over TCP/IP“

DNP3 Slave#n

Ethernet “DNP3 over TCP/IP“

LAN-Interface

DNPi00 **)

DNP3 Zentralstation Master #1(Ax/ACP 1703)

DNPMA0

DNP3 Slave #1(Ax/ACP 1703)

serial-Interface

DNPSx0DNP3 Slave #2

SICAM AK3, SICAM TMSICAM A8000 (CP-8000, CP-802x)

Serial <-> EthernetKonverter

Serial <-> EthernetKonverter

LAN-Interface

DNP3 Zentralstation Master #2(SICAM A8000 (CP-8000, CP-802x)

DNPiT2

DNPiT1

DNP3 Slave #3SICAM A8000 (CP-8000, CP-802x)

LAN-Interface

DNPiA1

SICAM AK3, SICAM TM(Ax/ACP 1703)

LAN-Interface





On the application layer the DNP3 communication protocol uses the “unbalanced transmissionprocedure“, in order to communicate with more than one slave. However on the link layer thecommunication between the two stations takes place as “balanced transmission procedure”.As a result it is also possible for the slave to send spontaneous data, so-called “unsolicitedresponses”, without preceding call of the master.

That means on the one hand, that as primary station the controlling station initiates messagestransmissions and the controlled station processes these and replies or that, in the case ofunsolicited responses, the controlled station starts the message transmission spontaneouslyand the controlling station processes these and replies or acknowledges.In multi-point traffic with polling mode the DNP3 protocol requires only a “half duplex”transmission medium and can be used in a star or linear structure.

If the controlled stations use the spontaneous data transmission (=unsolicited responses), thenwith a "half duplex” transmission medium collisions can occur in the message traffic. Eitherbecause multiple controlled stations or the master and one controlled station begin with thedata transmission at the same time. If collisions are to be completely avoided, then this is onlyachieved with a “full duplex” transmission medium and only one controlled station may beconnected to one master.

In all other cases collisions can occur and consequently the data transmission can beimpaired.



2.2 Technical Specifications

Number of Stations

· max. 100 DNP3 controlled stations *)

Slave Addresses · 0 - 65519, 65535 = BROADCAST

*) because of performance, required response time and limited storage capacity fewer stations arepossible for the serial protocols (max. 20)

Physical Interface

· RS232· RS485· LAN (TCP/IP)

Modulation

· PCM Byte-Asynchronous

Supported Baud Rates *)

· 50, 75, 100, 110, 134.5, 150, 200, 300, 600, 1050, 1200, 1800, 2000,2400, 4800, 9600, 19200, 38400, 56000, 57600, 64000

*) the max. possible baud rate is also determined by the hardware used

Byte Frame

· 8N1 (8E1)Bit transmission sequence: LSB 1st (less significant bit is transmitted first)

Message Frame

· Similar to IEC60870-5-1 / FT3

Message Protection

· d=6CRC g(x) = x16 + x13 + x12 + x11 + x10 + x8 + x6 + x5 + x2 + 1

DNP3 Protocol

Data communicationcontrol

· Master - Slave (Request Response) and “Unsolicited Responses”controlled station can transmit spontaneously

· Full duplex or half duplex

Transmission method

Supported DNP3 Formats

· … see SICAM RTUs DNP3 Interoperability (DC0-046-2)





DNP3 Slave:Supported IEC60870-5-101/104 message formats in transmit direction"SICAM RTUsè DNP3" (signal or monitor direction)

· <TI=30> … Single-point information with CP56Time2a time stamp· <TI=31> … Double-point information with CP56Time2a time stamp· <TI=34> … Measured value, normalized value with CP56Time2a time

stamp (15 Bit + polarity sign)

· <TI=35> … Measured value, scaled value with CP56Time2a timestamp (15 Bit + polarity sign)

· <TI=36> … Measured value, short floating point number withCP56Time2a time stamp

· <TI=37> … Integrated totals with CP56Time2a time stamp (31 Bit + polarity sign with sequence number)

DNP3 Slave:Supported IEC60870-5-101/104 message formats in receive direction"SICAM RTUsç DNP3" (command or control direction)

· <TI=45> … Single command· <TI=46> … Double command· <TI=48> … Setpoint command normalized value· <TI=49> … Setpoint command scaled value· <TI=50> … Setpoint command short floating point number

DNP3 Master:Supported IEC60870-5-101/104 message formats in transmit direction"SICAM RTUsè DNP3" (command or control direction)

· <TI=30> … Single-point information with CP56Time2a time stamp· <TI=34> … Measured value, normalized value with CP56Time2a time




· <TI=45> … Single command· <TI=46> … Double command· <TI=48> … Setpoint command normalized value· <TI=49> … Setpoint command scaled value· <TI=50> … Setpoint command short floating point number

DNP3 Master:Supported IEC60870-5-101/104 message formats in receive direction"SICAM RTUsç DNP3" (signal or monitor direction)

· <TI=30> … Single-point information with CP56Time2a time stamp· <TI=31> … Double-point information with CP56Time2a time stamp· <TI=34> … Measured value, normalized value with CP56Time2a time




· <TI=37> … Integrated totals with CP56Time2a time stamp (31 Bit + polarity sign with sequence number)



Redundancy

· Redundancy *)

*) is not supported for DNPixy (DNP over Ethernet)!

Parameter Setting

· System technical parameter with SICAM TOOLBOX II· Process technical parameter with SICAM TOOLBOX II

parameter-settable address conversion in transmit and receivedirection with OPM

NoteAs a third-party system adaptation this protocol element implements only part of the functionality and dataformats of the third-party interface. It is therefore to be checked for a concrete case of application, to whatextent the real requirements correspond with the functionality implemented here and to what extent areadditional expansions or adaptations required.





2.3 Limitations

· DNP3 Master: (DNPMx0)─ Only selected DNP3 function codes are supported─ The supported DNP3 functionality (Object/Variation, …) can be seen in the document

SICAM RTUs DNP3 Interoperability (=DNP3 Device Profile Document)─ File transfer is not supported─ Maximum 20 stations─ Max. data index (per data type) = 65535

· DNP3 Slave: (DNPSx0)─ Only selected DNP3 function codes are supported─ The supported DNP3 functionality (Object/Variation, …) can be seen in the document

SICAM RTUs DNP3 Interoperability (=DNP3 Device Profile Document)─ File transfer is not supported─ Max. data index (per data type) = 65535

· DNP3 over Ethernet: (DNPi00)─ See DNPSx0─ Maximum 100 stations─ No redundancy functionality

· DNP3 over Ethernet: (DNPiT0)─ See DNPSx0─ Maximum 2 stations─ No redundancy functionality

· DNP3 over Ethernet: (DNPiT1)─ See DNPSx0─ Maximum 2 stations─ No redundancy functionality

· DNP3 over Ethernet: (DNPiA1)─ See DNPSx0─ Maximum 100 stations─ No redundancy functionality

· DNP3 over Ethernet: (DNPiT2)─ See DNPMx0─ Maximum 4 stations─ No redundancy functionality

NoteAs a third-party system adaptation this protocol element implements only part of the functionality and dataformats of the third-party interface. It is therefore to be checked for a concrete case of application, to whatextent the real requirements correspond with the functionality implemented here and to what extent areadditional expansions or adaptations required.



2.4 Communication according to DNP3

2.4.1 Data Acquisition through Queries and "unsolicited Responses"

The transmission of the data from the controlled stations to the controlling station takes placeeither through station-selective station interrogation (interrogation procedure, polling) of theparameterized DNP3 data objects, controlled by the controlling station or through thespontaneous transmission of the data from the controlled station to the controlling station withthe DNP3 Service “Unsolicited Responses”.To reduce collisions in the transmission of data with DNP3 protocol the parameter advancedparameters | DNP time settings | Timeout transmit delay is to be set differentlyin all stations.

The station-selective parameters of the controlling station for the DNP3 protocol, such as"Stat No", "Link address", "Station enable", "Station failure", "Priority level", "Number of calls"and "Block class 2 data" are to be set in the parameter station definition.The 1703-internal station number is to be entered in the field "Stat No".

Station addresses

For the data transmission with DNP3 each station has an unambiguous station address. The"source address" and "destination address" are always to be entered in DNP3 messages.

In the controlling station and in every controlled station the own station address "sourceaddress" must be set with the parameter advanced parameters | common DNPsettings | Own station number.Note:In the controlled station the parameter Common settings | address of the link is identical with the parameter advancedparameters | common DNP settings | Own station number.

In the controlling station the station numbers of the remote stations "destination addresses"are to be set in the parameter station definition in the field "Link address".

In the controlled station the station number of the remote station "destination address" is to beset with the parameter advanced parameters | common DNP settings | destinationstation number.

When using the firmware DNPi00 the station parameterization is carried out by means of theConnection Definition.

With the DNP3 protocol, in monitoring direction either the momentary data of the processimage (static object types) or events (dynamic objects types or events with/without real timeinformation) are interrogated by the controlling station. The direct transmission of thecommands and setpoint values takes place in control direction. However it is also possiblethat the controlled station can also transmit events spontaneously without precedinginterrogation by the controlling station. This involves an unsolicited response.





Interrogation procedure (Query/Response Cycle)

All data that are to be queried by the DNP3 Master station must be configured using thesystemtechnical parameter spreadsheet advanced parameters | cyclic request fordata located on the protocol element for DNP3 Master. The simplest variant for this is thequery of the DNP3 data classes 0 to 3. Data class 0 contains all static data points (completeprocess image) and the data classes 1 to 3 contain the saved events with or without real timeinformation. Which data are then assigned to which data class can be freely parameterized.

The type, number and address of the data to be transmitted from the controlled station isspecified in the query message. As a response the addressed controlled station sends therequested data (Response Message) or if an error has been determined in the request (e.g.address not present in the controlled station), a corresponding error information. Data aretransmitted from the central station (MASTER station) to the controlled stations (SLAVEstation) spontaneously with change.

The interrogation procedure is carried out depending on the set cycle time. There exists nocontinuous cycle in the sense of permanent polling of the controlled station. If data are to bequeried, then these queries must be configured in the table mentioned above.

The station-selective parameters of the controlling station for the configuration of thecontrolled stations, such as "Stat No", "Link address", "Station enable", "Station failure" are tobe set in the parameter station definition. The station number "Stat No" (0-99) is onlyused 1703-internal. The station number "Link address" (0-65519) is used for thecommunication on the line to the controlled stations. Parameterized stations can be excludedfrom the station interrogation with the parameter "Station enable". The fault signaling of failedstations can be suppressed with the parameter "Station failure".

Every controlled station is assigned an unambiguous station number in the range "0 - 65519",whereby the controlling station also occupies an unambiguous station number.

The station number "65535" is used for the simultaneous addressing of all stations (=BROADCAST). With this type of addressing no reply (Response Message) is transmittedfrom the SLAVES to the MASTER.

A listening mode is not supported by the controlling station with DNP3 protocol!



2.4.1.1 Continuous Interrogation of a Controlled Station

The “continuous cycle” or continuous call of the controlled station for the transmission of userdata or also only for maintaining the connection between controlling station and controlledstation is not supported by the firmware DNPMx0 and DNPi00 and is also not provided in thisform in the definition of the DNP3.0 protocol. The reason for this lies in the possibility for thecontrolled station – also without preceding call by the controlling station – to send dataspontaneously. If the communication was occupied by a continuous cycle, then these datacould not be transmitted. Communication faults would then occur due to collisions.

But since it must nevertheless be possible to query data from the controlled station cyclically,the parameter table “cyclic data query” is available for this purpose. Here a cycle time of atleast 1 second to maximum 35535 seconds can be set for every data query configured there.If spontaneous data from the controlled station are used (unsolicited response), then thevalues used for the cycle time of the queries should not be too small. A precise description ofthis parameter table can be found in chapter “Application Notes”.

2.4.1.2 Acknowledgement Procedure

All interrogation messages sent selectively to a controlled station must be responded to or atleast acknowledged by this station. If the acknowledgement on a non-faulty transmission lineis missing for longer than the expected acknowledgement time, transmitted messages arerepeated up to n-times (n can be parameterized). After expiration of the number of retries thestation is marked as faulty.

The DNP3 protocol enables an acknowledgement at link level ("Data Link LayerConfirmation") and an acknowledgement at application level ("Application LayerConfirmation").An acknowledgement at application level ("Application Layer Confirmation") is only then usedfor multifragments by the DNP3 protocol implementation in SICAM RTUs if noacknowledgement at link level is set.

NoteThe firmware monitors all received messages for continuous byte reception (message interruption). It hasbeen shown again and again in the past, that some devices of third-party manufacturers can not maintainthis continuous message transmission and consequently message errors or acknowledgement errorsoccur. In this case the parameters advanced parameters | Monitoring times | Charactermonitoring time,advanced parameters | Monitoring times | Character monitoring time “time base”are tobe adapted accordingly. A value of approx. 100 milliseconds can thereby be used.

Acknowledgement at Link Level

The type of acknowledgement at link level ("Data Link Layer Confirmation") can be set in thecontrolling station and in the controlled station with the parameter advanced parameters |common DNP settings | Data link layer confirmation.

Acknowledgement at link level:

· No acknowledgement· Only for multifragments· Always expect acknowledgement





Expected Acknowledgement Time

The required expected acknowledgement time for acknowledgements at link level is set withthe following parameter advanced parameters | Monitoring times |Expected_ack_time_corr_factor. For this the message transfer time for maximum 292bytes of a message is to be observed in combination with other possible delays.

Messages Repetition (Retries)

The number of retries for "Data Link Layer Confirmation" for data messages is to be set in thecontrolling station and in the controlled station with the parameter Messageretries | Retries for data message SEND/CONFIRM (station selective).

Note:The parameter Message retries | Retries für Datentelegramm SEND/NO REPLY (broadcast) and the parameter Messageretries | Retries for INIT-messages SEND/CONFIRM (station selective) are presently not evaluated and not supported!

In the controlled station the Retry number for “Unsolicited Responses” can be set separatelywith the parameter advanced parameters | common DNP settings | Retrycount forunsolicited messages.

Acknowledgement at Application Level

If generally no acknowledgement is set at link level, then an acknowledgement at applicationlevel is used by the firmware, at least for multifragments.

The required expected acknowledgement time for acknowledgements at application level isset with the following parameter advanced parameters | DNP time settings |Timeout Application Confirmation. For this the message transfer time for a completeDNP3 message fragment (multiple single messages each with maximum 292 bytes) is to beobserved in combination with other possible delays.

The Retry number for “Application Layer” is taken from the Retry number for “Data Link LayerConfirmation”.



2.4.1.3 Failure Monitoring

Both the controlling station and the controlled station are able to monitor the communication.This can be realized in different ways. Thereby user data can be transmitted subject toacknowledgement with an acknowledgement request at the level of the link layer and/or theapplication layer. It is also possible to detect a failure of the remote station through cyclicmonitoring of the link layer. The parameter advanced parameters | Monitoringtimes | Interface_monitoring “cycle time”is used for this. This cycle time isretriggered with each message subject to acknowledgement and the test message of the linklevel is only transmitted after expiration of this time. The value 0 deactivates this testprocedure. In addition, for the master station function the parameter table “cyclic data query”can be used, in order to ensure failure monitoring.

If a message subject to acknowledgement is not acknowledged or if the acknowledgement isnot received, then a Retry of the message takes place after expiration of the expectedacknowledgement time. This takes place until the maximum number of retries has beenreached.

A station is signaled as failed after expiration of the number of retries. Retries to a controlledstation are thereby always transmitted directly one after the other after expiration of theexpected acknowledgement time i.e. no other controlled stations are interrogated during anongoing retry handling. A communication fault is only signaled for failed controlled stationswhen this is parameterized accordingly in the parameter "Station failure" of the stationdefinition.

No more cyclic data queries are allowed for stations that have failed once. A renewedconnection setup takes place at the level of the link layer once per minute (see StationInitialization).

No data are transmitted from the controlling station to failed controlled stations. The data arestored in the data storage of the communication function on the basic system element (BSE)until they are deleted by the dwell time monitoring or are transmitted to the non-failedcontrolled station.

2.4.2 Station Initialization

After startup or redundancy switchover the operation of the interface is resumed aftersuccessful station initialization.

The initialization of the link layer of the controlled station is carried out by the controllingstation with:

· Request status of the link layer (REQUEST STATUS OF LINK)· Normalization of the link layer of the controlled station (RESET OF REMOTE LINK)

Reset Command Function in the Controlled Station

--- no INIT (LINK is immediately active)

RESET of REMOTE LINK · only RESET of REMOTE LINK

REQUEST STATUS OF LINK+RESET of REMOTE LINK

· FCB-Bit (Frame Count Bit) is initialized· Acknowledgement for RESET of REMOTE LINK is transmitted

to the controlling station

Initialization End

The protocol element for DNP3 Master and DNP3 Slave does not send any “Initialization Endmessage” to the basic system element.





2.4.3 Acquisition of Events (transmission of data ready to be sent)

Data of the controlled station that are ready to be sent are stored for transmission in thecontrolled station in the DNP3 database on the protocol element or transmitted spontaneouslyto the controlling station.For this all data offered for transmission by the basic system element are transferred from theprotocol element and processed according to the settings in the process technical parameterson the protocol element.

Note:The protocol implementation for DNP3 Master and DNP3 Slave for SICAM RTUs uses the "Source Code Library (SCL) for DNP3" of the firmTriangle Micro Works. This integrated software package essentially controls the data transmission based on DNP3 – the data are stored inthe DNP3 database (=part of the SCL) for the data transmission.

The data are always entered in the process image for “status data” (static data class 0) in theDNP3 database and thus made ready for interrogation by the controlling station. In additionthe changed data can be entered in the DNP3 database as a sequence of events with orwithout real time information in a separate process image for "events" and if used, alsotransmitted spontaneously to the controlling station as “unsolicited response”.

In the process image for “status data” always only the current value per DNP3 address isstored in the DNP3 database and offered for transmission.

In the process image for events (Event Buffer) 250 events are stored in the DNP3 databasefor binary information “single binary input”, 250 events for “double binary input”, 250 formeasured values and 100 events for integrated totals.In the controlled station it can be determined with the parameter advancedparameters | common DNP settings | delete oldest event if event bufferoverflow whether with "Event Buffer Overflow" the oldest data are to be overwritten or themost recent data are to be discarded.

If it should be necessary to store more data in the Slave, for example during a communicationfailure, then it is possible to buffer these data on the BSE. A more detailed description aboutthis can be seen in the chapter entitled Special Functions 2.14.2 Storing User Data on theBSE (DNP3 Slave).

After startup of the protocol element DNPSx0 in the controlled station the data are updated inthe DNP3 database with a system-internal general interrogation. This general interrogation isgenerated by the firmware itself directly after startup and distributed in the system. Howeverthe communication to the controlling station is first activated after a delay time.The delay time is to be set with the parameter advanced parameters | Startup delayso that on expiration of the delay time all data intended for transmission to the controllingstation are available on the protocol element.

2.4.3.1 Message from the Controlled Station to the Controlling Station

Messages from the controlled station to the controlling station are transmitted from thecontrolled station to the controlling station either with station interrogation by the controllingstation (interrogation of parameterized DNP3 addresses or address ranges) or spontaneouslywith change with "Unsolicited Responses".

If “Unsolicited Responses” are used, then these are first transmitted after a delay time of 3seconds, so that any new events occurring within this time can also be transmitted.



2.4.4 General Interrogation, Controlled Station Interrogation

The function general interrogation (controlled station interrogation) is used to update thecontrolling station after the internal initialization (startup or reset) or after a goingcommunication fault has been detected.

The DNP3 protocol does not define any GI concept, as is used for example in IEC 870-5-101!To nevertheless establish compatibility to the system Ax/ACP 1703, the GI is realized asfollows:

· On reception of a GI request in the 1703 system all parameterized DNP3 data of dataclass 0 (=local static data) are interrogated by the controlled stations and forwarded to thebasic system element with cause of transmission (COT=20 “interrogated by GI”).

· The interrogation of data class 0 is sent to the controlled station and all received data areconverted accordingly.

A general interrogation command triggered in the system “to all” is always forwarded by thecommunication function on the basic system element (BSE) station-selective to the protocolelement of the controlling station and also processed station-selective by this.





2.4.5 Clock Synchronization

Setting the Time, Remote Synchronization

The clock synchronization of the controlled stations (=remote synchronization) can –controlled by the controlling station – be carried out over the serial communication line. Theremote synchronization is performed cyclically by the controlling station. In the controllingstation the time scale can be set with the parameter advanced parameters | Cycletime for sending clock synchronization command.

The controlled station can request a clock synchronization from the controlling station. Thetime scale for the request of the clock synchronization can be set in the controlled station withthe parameter advanced parameters | Cycle time for sending clocksynchronization command.

The clock synchronization command is always sent station-selective to the controlled stationsfrom the protocol element of the controlling station.Note: The most frequent application with time synchronization is, that the clock synchronization is requested by the controlled station.

In the controlling station the time in the clock synchronization command is adjusted beforetransmission by the automatically determined transmission time and by a settable correctiontime. The correction time is to be set with the parameter advanced parameters |Settings time management | Correction time for clock synchronizationcommand.

In the controlled station the time in the clock synchronization command can be adjusted onreception by a settable correction time. The correction time is to be set with the parameteradvanced parameters | Settings time management | Correction time forclock synchronization command.

The time base used for the communication between DNP3 devices should always beaccording to UTC (Universal Time Coordinated). The time used locally is thereby converted toUTC in transmit direction and vice versa. In addition a possible correction of a daylight-savingtime can also take place. The following options are available for parameterization, wherebythe transmit and receive direction can be set independently of each other:

advanced parameters | Settings time management | Time format in receivedirection

advanced parameters | Settings time management | Time format in transmitdirection

The following options are available:

· Without conversion (use of the local time) à use received time (withoutconversion) or Use local time

· With conversion from/to UTC with daylight-saving time correction à from UTC to localtime incl. DST correction or from local time incl. DST correction toUTC

· With conversion from/to UTC without daylight-saving time correction à from UTC tolocal time without DST correction or from local time without DSTcorrection to UTC

NoteIn the current version the DNP3 protocol defines, that the time in the clock synchronization command mustalways be according to UTC (Universal Time Coordinated).This is supported by the DNP3 protocol for SICAM RTUs for the following firmware from the specifiedrevision! The previous revisions use exclusively the local time.



2.4.5.1 Clock Synchronization with NTP (DNPi00 and DNPiA1 only)

The protocol element for DNP3 Slave over Ethernet (DNPi00) support the clocksynchronization of the controlled stations (=remote synchronization) - controlled by thecontrolling station – either via DNP3 protocol or via NTP.

When using DNP3 Slave over Ethernet in TM1703emic the clock synchronization via NTP isimplemented on basis system element.The selection of the time management mechanism is enabled with the parameter timemanagement | DNP3 Zeitmanagement | enabling Freigabe Zeitsetzen.

Selections for time synchronization:

· DNP3 protocol· NTP server

The Network Time Protocol (NTP) is a standard for the synchronization of clocks in systemsover IP communication networks. NTP is a hierarchical protocol over which time servers candetermine a common time amongst each other. The NTP protocol determines the delay ofpackets in the network and compensates these for the clock synchronization. The NTPprotocol uses port number 123.

The NTP protocol is a Client/Server protocol. NTP clients can request the time from NTPservers.

The Network Time Protocol (NTP) uses the connectionless network protocol UDP. The NTPprotocol has been developed especially to enable a reliable time tagging over networks withvariable packet delay.

The NTP protocol is defined in the standard "RFC 1305: NTP V3".

The time stamps in NTP are 64 bits long. 32 bits encode the seconds since the 1st January1900 00:00:00 hours, the other 32 bits the seconds fraction. In this way, a time period of 232

seconds (about 136 years) can be represented with a resolution of 2−32 seconds (about 0.25nanoseconds).

NTP uses a UTC time scale and supports switching seconds, but not daylight-saving time andwinter time.

NTP uses a hierarchical system of different levels. The level specifies how far the NTP serveris from an external time source. As time source an atomic clock, a DCF77 receiver or a GPSreceiver can be used.

A Layer-1 server is connected directly with a time source and uses this as reference for itstime. A Layer-2 server uses a Layer-1 server as reference and synchronizes itself with otherservers on its level if the connection to the higher level fails.The highest level is 16 and signifies, that this NTP server has not yet calibrated itself withother servers. As a rule no more than 4 levels exist, since otherwise the time would deviatetoo much.





2.4.5.1.1 NTP/SNTP Client “Clock Synchronization with one or several NTP Servers”

For the clock synchronization of a component, the time information can be requested from oneor several NTP servers in the network by the protocol element's integrated NTP-Clientfunction. The NTP servers themselves are synchronized either directly with DCF77 or GPSreceiver, or by interrogating the time information from other NTP servers..

General Functions NTP/SNTP Client

Function

DN

Pi00

DN

PiT0

DN

PiT1

DN

PiA

1

Clock synchronization with NTP servers 2) ü ü 1) ü 1) ü

Number of supported NTP servers ( for redundancy) 4 4 1) 4 1) 4

Cyclic time interrogation of the NTP servers, settable in seconds grid(self-adapting)

ü ü 1) ü 1) ü

Possible accuracy approx. 3 ms 3)

Protocol NTP V3 (Network Time Protocol) according to RFC 1305 ü ü 1) ü 1) ü

Protocol SNTP V4 (Network Time Protocol) according to RFC 2030 ü 1) ü 1) ü

1) In SICAM A8000 or SICAM AK3 with local PRE (PRE without NIP) this function is integrated onthe basic system element

2) The external NTP servers will be synchronized via GPS (or via DCF77 on request);an external NTP server can handle several automation units

3) Possible accuracy dependent on the quality of the IP network

If the clock synchronization with NTP is activated on a LAN/WAN protocol element, thetransfer of a received clock synchronization command with <TI:=103> to the basic systemelement is disabled.



Parameters for NTP time synchronization (NTP Client):

· NTP time synchronizationThe time synchronization by means of NTP is enabled with the parameter timemanagement | NTP time synchronisation client | NTP timesynchronisation.The other parameters for NTP time synchronization are only displayed after the functionhas been enabled.

· NTP server 1 IP addressNTP server 2 IP addressNTP server 3 IP addressNTP server 4 IP addressThe protocol firmware supports max. 4 different redundant NTP servers. The time isalways requested from all parameterized NTP servers. The time for the synchronization isdetermined by means of a defined algorithm from the times received from the NTPservers.For every NTP server the unambiguous IP address of the NTP server is to beparameterized in the format IPv4 (32 Bit) in dotted decimal notation.Example: 192.168.122.195The IP addresses of the NTP servers are to be parameterizedwith the parameters time management | NTP time synchronisationclient | NTP server # IP address.

· NTP maximum time deviationIf the deviation of the time between the own component and the NTP server is greater thanthe parameterized value, an error is signaled.The maximum time deviation is to be parameterized with the parameter timemanagement | NTP time synchronisation client | NTP optimization | NTPmaximum time deviation.

· Max. stratumIf the received stratum number from the NTP server is greater or equal as a parameterizedlimit, a warning is indicated. With this monitoring function an non synchronized NTP servercan be detected (e.g. defect or disconnected antenna). If all NTP servers are notsynchronized, the NTP time is not longer synchronous with the world time. In this case thetime of the NTP servers will drift with the quality of the local time of the NTP servers.The limit of the stratum number for generating a warning is to be parameterized with theparameter time management | NTP time synchronisation client | max.Stratum.

· Suppress stratum errorIf a 1703 system will be synchronized via several NTP servers, the stratum number mayonly differ by 1. If the difference of the stratum number is greater than 1, the protocolelement will generate an error indication "no valid time from server, stratum numberinvalid" for the NTP servers with higher stratum number.If different NTP servers will be used in a project from different providers, the requirementfor the tolerated difference in stratum number can not be guaranteed.The generation of error can be suppressed with the parameter time management | NTPtime synchronisation client | Suppress stratum error.Note:NTP server with higher stratum number (= less accuracy) will not be included in theprocessing. Only when NTP servers with lower stratum number will fail, the next NTPservers will be included in processing. Based on this handling an error indication can bedisplayed for a short time.





Advanced parameters for NTP time synchronization (NTP client):· NTP minimum cycle time

The interrogation of the time from the NTP server (NTP request) is performed cyclic by theprotocol element in time scale between NTP maximum cycle time and NTP minimum cycletime.Note:With the communication over GPRS the cycle time must not be set too short, since due tothe cyclic time request, corresponding transmission charges accumulate.See also "NTP cycle time until synchronized" and "NTP maximum cycle time".

· NTP maximum cycle timeSee also "NTP cycle time until synchronized" and "NTP minimum cycle time".

· NTP cycle tme until synchronizedUntil the 1st synchronization, the interrogation of the time from the NTP servers (NTP-Requests) can be carried out in a shorter time scale. The time scale is parameterized withthe parameter time management | NTP time synchronisation client | NTPoptimization | NTP cycle time until synchronized. After successfulsynchronization, the interrogation of the time is carried out cyclic in a time scale between"NTP minimal cycle time" and "NTP maximum cycle time". The cycle times are to beparameterized with the parameters time management | NTP time synchronisationclient | NTP optimization | NTP minimal cycle time, and time management| NTP time synchronisation client | NTP optimization | NTP maximalcycle time.

· Error signalization delayFor problems during the interrogation of the time from NTP servers, the signalization of theerror "No valid time from NTP server" can be delayed with the parameter timemanagement | NTP time synchronisation client | NTP optimization |Delay error signalization.By means of that, short-term faults or load problems in the network do not lead to anyerror.



2.4.5.1.2 Integrated NTP ServerClock Synchronization for one or several NTP Clients

In configurations with less demand on the accuracy for time synchronization, the LAN protocolfirmware in the SICAM RTUs component provides an integrated NTP server for othersystems. This function is helpful if the clock synchronization of the remote terminal unit iscarried out by means of DCF77 receiver, over a serial interface or NTP synchronization viaseparate LAN , and in this remote terminal unit other devices are connected over LAN, whichrequire a time synchronization with NTP.

Through this the additional procurement of an NTP server for the subnet in the remoteterminal unit is not necessary!

The time of the integrated NTP server is controlled by the local time of the component.The accuracy is therefore dependent on the accuracy of the clock synchronization of thecomponent itself.

Clock synchronization over LAN: (NTP Server)

· Integrated NTP server for clock synchronization of one or several NTP clients· Protocol: NTP V4 (for NTP V4 there is actually no public specification available)· Up to 30 different NTP clients can be served with a time request 1x per minute (this limit is

an experimental value and results from the system load utilization)· Stratum 7 (based on the achievable accuracy with remote synchronization over serial

communication line)· The NTP server supports only the request of the time (BROADCAST transmission of the

time is not supported by the integrated NTP server)· The achievable accuracy is dependent on the accuracy of the clock synchronization of the

component· Reaction time (transmission of the requested time by the protocol firmware):

Typically 300-900 us

Parameters for NTP time synchronization (NTP Server):

· NTP serverThe integrated NTP server function of the LAN/WAN communications firmware is enabledwith the parameter time management | NTP time synchronization server | NTPserver

· Synchronization with invalid timeBy means of parameter time management | NTP-time synchronization server |synchronization before first time set NTP reply messages are sent also whenthe time of the SICAM RTUs component is not yet setBy means of parameter time management | NTP-time synchronization server |synchronization also with invalid time (IV) the master station can stop theclock synchronization of the remote stations over the serial communication line when theclock synchronization of the master station fails





2.4.6 Command Transmission

2.4.6.1 Message from Controlling Station selectively to a ControlledStation

Station-selective data messages in command direction are always passed into the runninginterrogation procedure (station interrogation) by the controlling station with high priority, butonly after termination of the running data transmission service. This can sometimes causelong delays, if a multifragment is currently being transmitted. Data to be sent from the basicsystem element (=BSE) are always prioritized 1:1 versus station interrogations.

Inquiry

An “inquiry” (=parameter-settable station-selective continuous interrogation) to a controlledstation for the transmission of certain data is not supported.

2.4.7 Count Transmission by means of Interrogation Command

Interrogation by means of system message IEC count interrogation

For this the interrogation command “Freeze” in the DNP3 message is converted with thefunction code “immediate freeze no acknowledgement” as broadcast message to all stations.Accordingly the IEC count interrogation should also only be handled as Broadcast and notstation-selective. In parallel all counts which are assigned to the respective counter group aremarked internally for transmission in the firmware.

After the transmission of “immediate freeze…” the counts of every station are interrogatedstation-selective and processed and forwarded to the basic system element.

2.4.8 Spontaneous Count Transmission

Besides the transmission of counts by means of count interrogation, the DNP3 controlledstation function can also process and transmit counts spontaneously. For this the counts mustonly be assigned to a corresponding event class. Every count configured this way is thensaved as event on reception and transmitted.



2.5 Optimized Parameters for selected TransmissionFacilities (serial communication)

The protocol element supports selected transmission facilities – the parameters are set fixedfor these – the selection of the transmission facility takes place with the parameter Commonsettings | Interface modem. Through the selection of the “freely definable transmissionfacility” certain parameters can be set individually.

Apart from this, a transmission facility, that can be freely defined by the user, can be selected,for which all parameters that are available can be individually set. This is then necessarywhen transmission facilities are to be used that are not predefined or if modified parametersare to be used for predefined transmission facilities.

For the selection of the freely definable transmission facility the parameter Commonsettings | Interface modem is to be set to “freely definable”. Only through this are allsupported parameters displayed and able to be parameterized with the required values (seetable with default parameters for transmission facilities).

The parameters for the “freely definable transmission facility” are only displayed for selectedtransmission facility “freely definable”.

NoteFor reasons of flexibility and since it always involves a coupling to third-party systems, the use of the“freely definable” transmission facility is recommended.

Baud Rate

In most cases transmission facilities or remote stations only support certain baud rates orcombinations of baud rates in transmit/receive direction – these are to be taken from thedescriptions.

The transmission rate (baud rate) is to be set either separately for transmit/receive directionwith the parameter Common settings | Baud rate receiver and the parameter Commonsettings | Baud rate transmitter or for transmit/receive direction together with theparameter Common settings | Baud rate.

Byte Frame

The byte frame used for the DNP3 protocol can also (partly) be set. For serial datatransmission, as standard the DNP3 protocol uses the byte frame “8E1”. For specialapplications the parity bit, or the number of stop bits, can be changed.

With the DNP3 protocol the number of data bits is defined fixed with 8 bits and must not bechanged. The number of data bits used per byte is to be set fixed to 8 bits with the parameterCommon settings | Byte frame | Data bits.

The selection of the parity protection to be used per byte is to be parameterized with theparameter Common settings | Byte frame | Parity.

The number of stop bits to be used per byte is to be parameterized with the parameterCommon settings | Byte frame | Stop bits.





Status Lines

For special requirements of the communication equipment the protocol element for DNP3Master can switch the status lines RTS and DTR fixed to “HIGH”. The RTS status line can beswitched on permanently with the parameter advanced parameters | RTS ispermanent HIGH. The DTR status line can be switched on permanently with the parameteradvanced parameters | DTR immer fix auf HIGH.

Freely definable transmission facility

For the adaptation to different modems or time requirements of third-party systems thefollowing parameters can be set individually:

· Common settings | free defineable interface modem | electrical interface

[only SM2541]· Common settings | Asynchron/isochron

· Common settings | Source for receive-/transmit clock (only for “Isochronous”)

· Common settings | free defineable interface modem | Run-out time (tn),Common settings | free defineable interface modem | Run-out time “time base”

(tn)

· Common settings | free defineable interface modem | Set up time (tv),Common settings | free defineable interface modem | Set up time “time base”

(tv)

· Common settings | free defineable interface modem | Run-out time (tn),Common settings | free defineable interface modem | Run-out time “time base”

(tn)

· Common settings | free defineable interface modem | DCD handling

· Common settings | free defineable interface modem | Bounce suppression time

(tbounce)

· Common settings | free defineable interface modem | Disable time (tdis),Common settings | free defineable interface modem | Disable time “time base”

(tdis)

· Common settings | free defineable interface modem | Stability monitoring time

(tstab)

· Common settings | free defineable interface modem | Continuous level monitoring

time (tcl)

· Common settings | free defineable interface modem | Transmission delay if

countinous level (tcldly)

· Common settings | free defineable interface modem | 5V supply (DSR) [only SM0551,SM2551]

How the individual time settings are effective for the data transmission can be seen on thefollowing page in a Timing Diagram.



Parameter "5 V Supply (DSR)" [only SM-0551, SM-2551]

If necessary the voltage supply of the transmission facility (only 5V) – insofar as this isadequate – can be set over the status line DSR. The enabling of the voltage supply takesplace with the parameter advanced parameters | 5V supply (DSR). The voltage supplyis only switched to the DSR status line instead of the DSR signal with correspondingparameter setting.

ATTENTION: Required supply voltage and maximum current consumption of thetransmission facility must be observed!

In addition, for the adaptation of the protocol to the transmission medium used or to thedynamic behavior of the connected remote station, the following parameters are available:

· advanced parameters | Monitoring times | Character monitoring time,advanced parameters | Monitoring times | Character monitoring time “time base”

· advanced parameters | Monitoring times | Idle monitoring time,advanced parameters | Monitoring times | Idle monitoring time “time base”

· advanced parameters | Monitoring times | Character monitoring time,advanced parameters | Monitoring times | Character monitoring time “time base”

· advanced parameters | Monitoring times | Expected_ack_time_corr_factor(see Acknowledgement Procedure)

The signal monitoring time is used for message interruption monitoring and message re-synchronization in receive direction. A message interruption is detected when the timebetween 2 bytes of a message is greater than the set signal monitoring time. With messageinterruption the running reception handling is aborted and the message is discarded. After amessage interruption is detected a new message is only accepted in receive direction after anidle time on the line.

The protocol element – insofar as the transmission facility makes this signal available receive-side – can evaluate the interface signal DCD and e.g. utilize it for monitoring functions.





Default Parameters for Transmission Facilities with DNPMx0transmission facility electrical

interfaceRTS tp

[ms]tv[ms]

tn[bit]

tp_bc tdis[ms]

DCD tbounce[ms]

tstab[ms]

tcl[sec]

tcldlyz[ms]

A_I T Z 5 V *)

Modem for "4-wire transmission line"(SAT-VFM,-WT,-WTK,-WTK-S,CE-0700)

RS-232 ON 0 0 3 0 35 YES 5 5 10 200 A I B NO

Modem for "2-wire transmission line"(SAT-VFM,-WT,-WTK,-WTK-S,CE-0700)

RS-232 ↑↓ 0 30 3 0 35 YES 5 5 10 200 A I B NO

OPTICAL RS-232 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES

direct connection (RS-485) RS-485 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES

Freely definable

Default Parameters for Transmission Facilities with DNPSx0transmission facility electrical

interfaceRTS tp

[ms]tv[ms]

tn[bit]

tp_bc tdis[ms]

DCD tbounce[ms]

tstab[ms]

tcl[sec]

tcldly[ms]

A_I T Z 5 V *)

OPTICAL RS-232 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES

direct connection (RS-485) RS-485 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES

Freely definable

Legend: electrical interface Parameter "electrical interface" [only SM2541]

RTS RTS is switched with each message for the control of the carrier switching of the modem (ON / OFF)tp Parameter "Pause time (tp)", Parameter "Pause time time base (tp)"tv Parameter "Set-up time (tv)", Parameter "Set-up time time base (tv)"tn Parameter "Run-out time (tn)", Parameter "Run-out time time base (tn)"tp_bc Parameter "Pause time after Broadcast message (tp_bc)", Parameter "Pause time after Broadcast-message_time base (tp_bc)"tdis Parameter "Disable time (tdis)", Parameter "Disable time time base (tdis)"DCD Parameter "DCD-evaluation"tbounce Parameter "Bounce suppression time (tbounce)"tstab Parameter "Stability monitoring time (tstab)"tcl Parameter "Continuous level monitoring time (tcl)"tcldly Parameter "Transmit delay at level (tcldly)"A_I Parameter "Asynchronous_Isochronous"T Parameter " Bit cycle (only with Isochronous)" (I=internal, E=external)Z Parameter "Send clock synchronization command station-selective" (s=selective, B=BROADCAST)*) Parameter "5 V Supply (DSR)" [only SM0551, SM2551]



Status Lines & Timing

The following picture shows in detail the dynamic behavior (Timing) with the data transmission usingtransmission facilities with switched carrier.

tp tv tn

TXD

RTS

DCD

t´Prell

tp' t'v t'nt'sw

tverzRTS

tPrell tPrell

RXD

DCD

RXD

RTS

TXD

tsw tp tv

tPrell

tstabtdauer

tPrell

tstab

å å

t´verzRTS

t´Prell

t´verzRTS

t´signal

t'verz

tsignal tsignal

tverz

t'dis

tdis

tp_bcData transmission

Data transmission

Data transmission

Data transmission

Mas

ters

tatio

nR

emot

est

atio

n

Legend:

RTS ………….. Request to SendDCD …………. Data Carrier DetectTXD ……...….. Transmit DataRXD ……...….. Receive Data

tverzRTS ……….. Processing time of the transmission systemTime delay/time difference between activation of transmit part (RTS á) and receiver ready (DCD á)

tp ………….….. Break time (delay, before transmit part is activated with RTS)tv ………….….. Setup time (transmission delay, after transmit part was activated with RTS)tn ………….….. Reset time (delayed switch off of the transmit signal level with RTS after message transmission )tp_bc ……….….. Break time after BROADCAST-Messages (some systems require a longer break after the transmission of BROADCAST -messages before the next message can be sent )tsw ….....….….. Internal processing timetsignal ….....….. Signal propagation delays (dependent from the used transmission facility/transmission path)

tPrell …...….….. Protective time after positive/negative DCD-edge (debounce of DCD)tstab …...….….. Stability monitoring time – the new DCD-status is only used for message synchronisation after the expiration of the stability monitoring timetdauer …...….….. Continuous level monitoring timetverz …...….….. Transmission delay – in case of a continuous level a further message transmission will be made at the latest after the transmission delaytdis …….….….. Disable time of the receiver after message receiption (to supress faulty signs during level monitoring)

t`x …………….. Corresponding times in the remote stations

å …………….. DCD valide

Only forBROADCAST-

messages





2.6 Function for the Support of redundant CommunicationRoutes

To increase the availability, both controlling stations as well as controlled stations can bedesigned redundant.

In this chapter the possible redundancy concepts themselves that can be realized are notdescribed, rather only those functions supported by the protocol element for the support ofredundant communication routes.

The following redundancy control is supported by the controlling station and the controlledstation:

· SICAM RTUs redundancy

2.6.1 Redundancy Mode “SICAM RTUs Redundancy”

The switchover of the redundancy state takes place system-internal by means of redundancycontrol messages.In the controlling/controlled station, in addition a delay for the switchover of the redundancystate from PASSIVE (=STANDBY) to ACTIVE can be set with the parameter Redundancy |Delay time passive=>active.

Depending on the redundancy configuration the operating mode of the interface withredundancy state “PASSIVE” can be set with the parameter Redundancy | Operation ifpassiveas follows:

· Interface “TRISTATE” – only listening mode· Interface “ACTIVE” – only listening mode· Interface “ACTIVE” – interrogation mode

Listened messages are forwarded from the redundant, non-active controlling/controlled stationto the basic system element (BSE) and passed on in the system by this element with theidentifier “passive” in the status.

In redundant controlling stations that are not active, a failure of the interface is monitoredglobally and the failure of controlled stations is monitored station-selective.

The failure of the interface is detected by the STANDBY controlling station by monitoring forcyclic message reception. The monitoring time is set with the parameter Redundancy |Listening_mode (failure monitoring time). With reception timeout (active controllingstation or transmission facility of the controlling station has failed) the interface is signaled asfailed.

The failure of a controlled station is detected by the STANDBY controlling station throughstation-selective monitoring for cyclic message reception. With station-selective receptiontimeout (controlled station or transmission facility of the controlled station has failed) thecontrolled station is signaled as failed.

Station-specific active faults are reset in a redundant STANDBY controlling station, if afaultless message is “listened” by the respective station.



2.7 Web Server (DNPi00 only)

A web server is integrated into the protocol firmware for internal diagnostic information.This information can be read out comfortably with a common web browser (e.g. MicrosoftInternet Explorer). For the access to the web server the communications protocol "HTTP(Hyper Text Transfer Protocol)" is used with the port number 80.

The integrated web server is addressed by means of direct specification of the IP address ofthe Ethernet interface of the automation unit.

By default the web server is deactivated for security reasons. Also for security reasons, anauthentication can be configured for the access to the web server (specification of apassword).

· HTTP web serverThe integrated web server can if necessary be enabled for access by the user with theparameter HTTP web server | HTTP web server.

· Password for AuthenticationWith authentication enabled a password can be established with the parameter HTTP webserver | password for authentication. The access to the integrated web server isonly possible after successful authentication.

NoteThe information displayed on web pages is the actual information at open of the web page. Theinformation of a web page will not be updated automatically!For updating the web page displayed with Internet explorer use refresh function of Internet Explorer.





Via the integrated web server the following information can be read out:

· Diagnosis- Ethernet MAC address, speed, duplex mode, statistics- TCP/IP (DNPi) own network parameter (Own IP address, default gateway, Subnetmask) number of server connections- Firmware (actual firmware time)- Data Link Errors- Ping- System informations (Hardware, Software)

· Rangierungen- Sende-FR alle (loaded detail routing tables in transmit direction on PRE)- Empfangs-FR alle (oaded detail routing tables in receive direction on PRE)

· Abbilder- Abbild in Senderichtung (PRE internal data base for transmit direction)- Abbild in Empfangsrichtun (PRE internal data base for receive direction)

· Entwickler Debug (internal information for software developer)- Taskstack- Heap- Read Memory- Read Register (Ethernet Controller Configuration)- Read EEPROM- Threadx task info (operating system internal information)



2.8 Remote Operation for SICAM TOOLBOX II (LAN/WAN)(DNPi00 only)

The remote maintenance of SICAM RTUs components via LAN/WAN can be performed using"remote operation":

· Remote operation via external Terminal Server (connection to M-CPU with TIAX00)· Remote operation via integrated Terminal Server

2.8.1 Remote Operation via external Terminal Server(Connection to M-CPU with TIAX00)

For the remote maintenance of SICAM RTUs components using "remote operation" overexternal terminal server, the serial interface of the SICAM TOOLBOX II is connected with aselected SICAM RTUs component over Ethernet. An external terminal server (=serial toEthernet converter) is thereby implemented at the SICAM TOOLBOX II side and at the SICAMRTUs component side. At SICAM RTUs component side the serial interface of the externalTerminal Server is connected to M-CPU via TIAX00.

The IP address of the selected SICAM RTUs component and the SICAM TOOLBOX II are tobe parameterized in the external terminal servers. All components that can be reached via theselected SICAM RTUs component can thus be reached for the remote maintenance.

In the SICAM RTUs component and in the SICAM TOOLBOX II, no special parameter settingsare required.

If SICAM RTUs components are used in different LAN/WAN networks, a specific externalterminal server must be used at the SICAM TOOLBOX II side for each LAN/WAN network orthe external terminal server must be re-parameterized accordingly with the programs providedfor this purpose.

A communications protocol based on IEC 60870-5-1 and IEC 60870-5-2 "Balanced" is usedbetween the SICAM TOOLBOX II and the LAN/WAN communications protocol element.

Here, the "remote operation" over external terminal server is only mentioned for the sake ofcompleteness, it is not however any special functionality of the LAN/WAN communicationsprotocol element. In addition, this solution is now rarely implemented (or is only in use onolder plants).

In new plants, now in most cases the "remote operation" for SICAM TOOLBOX II is carriedout via "remote operation" with the integrated terminal server of the SICAM TOOLBOX II andthe LAN/WAN communications protocol element.





2.8.2 Remote Operation via integrated Terminal Server

For the remote maintenance of SICAM RTUs components using "remote operation" overexternal, a transparent connection is established over Ethernet between the SICAMTOOLBOX II and the integrated terminal server of the protocol element.

The Terminal Server protocol for "remote operation" is based on TCP/IP and is a Client-Server protocol. The SICAM TOOLBOX II thereby always takes over the client function, theSICAM RTUs component always the server function.

The connection for "remote operation" is always established by the SICAM TOOLBOX II.

For the Terminal Server protocol a TCP/IP connection must be set up. With the SICAMTOOLBOX II interfacing, the SICAM TOOLBOX II is Connector and the NIP is Listener. TheListener-Port number to be used is 2001. If several SICAM TOOLBOX II applications attemptto setup a connection at the same time, the first SICAM TOOLBOX II wins, the rest arerejected.

If an error is detected during the remote maintenance of SICAM RTUs components using"remote operation", then the TCP/IP connection is terminated.

For the "remote operation", a connection is to be set up on the SICAM TOOLBOX II for everyremote station with the following parameters:

· Transmission medium = terminal server, TCP/IP· IP address of the remote station (IP address or Host ID of the terminal server of the remote

station)· Port number = 2001· Delay time

For security reasons the "remote operation" for SICAM TOOLBOX II can be deactivated withthe parameter advanced parameters | remote operation | remote operation. With"remote operation" deactivated, the Terminal Server protocol over Port 2001 is no longerhandled.

With connection established for the remote maintenance, a warning is generated in theSICAM RTUs component. If necessary, this warning can be deactivated with the parameteradvanced parameters | remote operation | warning remote operation.

Functionally, the "remote operation" via integrated Terminal Server thereby corresponds withthe interfacing with external terminal server (and TIAX00), only with this solution thefunctionality of the terminal server is integrated in the SICAM TOOLBOX II and in theLAN/WAN communications protocol element.

So that a secure point-to-point connection via integrated Terminal Server protocol is ensured,a communications protocol based on IEC 60870-5-1 and IEC 60870-5-2 "Balanced" isimplemented between the SICAM TOOLBOX II and the LAN/WAN communications protocolfirmware on the application layer. Terminal Server is thereby used as transport protocol.

The service message formats between SICAM TOOLBOX II and the SICAM RTUs componentare prepared accordingly on the LAN/WAN communications protocol firmware (conversionfrom SICAM RTUs internal format and format for SICAM TOOLBOX II) and transferred to themaster service function of the SICAM RTUs component for further processing.



2.9 Remote Operation for SICAM TOOLBOX II (LAN/WAN)(DNPiA1 only)

The remote maintenance of SICAM RTUs components via LAN/WAN can be performed using"remote operation":

· Remote operation via TCP/IP HTTP/HTTPS

NoteFor reasons of flexibility and since it always involves a coupling to third-party systems, the use of the“freely definable” transmission facility is recommended.

At least SICAM TOOLBOX II version 5.11 is needed to use this type of remote operation.

2.9.1 Remote Operation via TCP/IP HTTP/HTTPS

For the remote maintenance of SICAM RTUs components using "remote operation" atransparent connection is established over TCP/IP, HTTP/HTTPS between theSICAM TOOLBOX II and the SICAM RTUs component via the protocol element.

For “remote operation" with SICAM TOOLBOX II a proprietary Client-Server protocol is usedfor remote maintenance and remote diagnostics of SICAM RTUs components working throughfirewalls, NAT and Proxy-Server.

For outgoing connections the SICAM TOOLBOX II uses the standard port 80 for HTTP orstandard port 443 for HTTPS. Therefore no adaption of firewall is required if internet access isenabled.

The connection for "remote operation" is always established by the SICAM TOOLBOX II.The SICAM TOOLBOX II thereby always takes over the client function, the SICAM RTUscomponent always the server function.

If several SICAM TOOLBOX II applications attempt to setup a connection at the same time,the first SICAM TOOLBOX II wins, the rest are rejected.

If an error is detected during the remote maintenance of SICAM RTUs components using"remote operation", then the TCP/IP connection is terminated.

For the "remote operation", a connection is to be set up on the SICAM TOOLBOX II for everyremote station with the following parameters:

· Transmission medium = terminal server, TCP/IP· IP address of the remote station (IP address or Host ID of the terminal server of the

remote station)· Port number = 80 (auto detection)· Delay time





For security reasons the "remote operation" for SICAM TOOLBOX II can be deactivated withthe parameter advanced parameters | remote operation | remote operation.

With connection established for the remote maintenance, a warning is generated in theSICAM RTUs component. If necessary, this warning can be deactivated with the parameteradvanced parameters | remote operation | warning remote operation.

So that a secure point-to-point is ensured, a communications protocol based on IEC 60870-5-1 and IEC 60870-5-2 "Balanced" is implemented between the SICAM TOOLBOX II and theLAN/WAN communications protocol firmware on the application layer. Terminal Server isthereby used as transport protocol.

The service message formats between SICAM TOOLBOX II and the SICAM RTUs componentare prepared accordingly on the LAN/WAN communications protocol firmware (conversionfrom SICAM RTUs internal format and format for SICAM TOOLBOX II) and transferred to themaster service function of the SICAM RTUs component for further processing.



2.10 DNP3 Protocol Description

2.10.1 PCMBA Modulation Method

The data are pulse-code-modulated in groups of 8 Bit and transmitted asynchronous. AUSART module in asynchronous mode thereby provides every byte with a byte frame (BF).

Byte frame for DNP3:

1 Start bit8 Data bits1 / NO Parity bit (even/no), “no parity” is standard1 Stop bit

By means of the start and stop bits of the byte frame the synchronization of the receiver takesplace again with each byte.

D1 D2 D3 D4 D5 D6 D7 D8

8 BIT INFORMATION

A B C D E

FB

MSBLSB

T

FB

A:

B:C:

D:E:T:FB:

Idle state of the line (binary information "1") between two messages at least 33 bit(in case of error)Start bit ("0")8 bit data (possibly frame data or message data), LSB (Least Significant Bit)is transmitted firstParity bit (even parity)1 Stop bit ("1")Time for the transmission of a bit (1/transmission rate)Framing bits of the USART module





2.11 Interface Circuits Used

The following V.24 interface circuits are used:

TxD <103> transmit dataRxD <104> receive dataGND <102> signal ground

Optionally the following V.24 interface circuits can be used:

RTS <105> Used for switching on the transmit signal level of thetransmission facility

DCD <109> Used for detecting the receive signal level of thetransmission facility



2.12 Message Description for DNP3 (Data Link Layer)

The DNP3 protocol uses message formats for messages with variable lengths based onIEC60870-5-1 / format class FT3.

2.12.1 FT3 Message Format for Messages with variable Lengths

The transmission formats and rules for DNP3 are based on the international standardIEC 60870-5-1 Telecontrol equipment and systems TC 57 Part 5.1, Transmission FrameFormats Format Class FT3.The DNP3 protocol uses the FT3 format with UART frame (typically 8N1) for messages withvariable lengths.

Note: FT3 in IEC60870-5-1 is only defined for synchronous data transmission.

Every message begins with a START CHARACTER (2 octets).

The DNP3 protocol uses only START CHARACTER 1 (05H, 64H).START CHARACTER 1 = "0000 0101 0110 0100"

Representation of one byte (LSB shown right-aligned):

27 26 25 24 23 22 21 20

D8 D7 D6 D5 D4 D3 D2 D1

D1 basically represents the least significant bit (LSB).

Representation of one byte “Bit sequence on the line”: (E.g.: START CHARACTER 05hex in format8E1)

Bit sequenceon the line 1 2 3 4 5 6 7 8 9 10 11

Data bits STA D1 D2 D3 D4 D5 D6 D7 D8 P STP

0 1 0 1 0 0 0 0 0 0 1

Legend: STA ... Start bit (is transmitted as 1st bit on the line)STP ... Stop bitP ........ Parity bit (even)

With the specified transmission rules and character definitions all message formats with d = 6are protected against faulty information and block displacements (synchronization errors).





Message Structure for Messages with variable Lengths

The 1st data block (header) of the messages with variable lengths is of fixed length. It beginswith a START CHARACTER (2 octets), ends with a CHECK SEQUENCE and contains up to14 data octets.

The “LENGTH” – character, which is situated in the header with fixed length, defines thenumber of user data octets in the “main part” of a message.

DNP3 message format based on FT3:

2021222324252627

START [05 hex]

START [64 hex]

LENGTH [1 … 255]

1. Byte

2. Byte

3. Byte

4. Byte

DESTINATION

DESTINATION

[LSB]

[MSB]

0DIR

DFC Function Code20212223FCVFCB

PRM=0

PRM=1

SOURCE

SOURCE

[LSB]

[MSB]

5. Byte

6. Byte

7. Byte

8. Byte

CRC

CRC

[LSB]

[MSB]

9. Byte

10. Byte

User-Data

User-Data

[Byte-1]

[Byte-16]

[Byte-2]User-Data

CRC

CRC

[LSB]

[MSB]

User-Data

User-Data

[Byte-1]

[max. Byte-16]

[Byte-2]User-Data

CRC

CRC

[LSB]

[MSB]

Control Field

DestinationStation-Address

SourceStation-Address

max. n. Byte

Bloc

k-0

Bloc

k-1

Bloc

k–

n**

)

DN

P3M

essa

geH

eade

r(a

ccor

ding

IEC

6087

0-5-

1/F

T3)

DN

P3U

serD

ata

Leng

th[1

…25

5](e

xcl.

CR

C)

**) the last data block may have less than 16 bytes



Transmission Rules for Messages with variable Lengths

R1 Idle state on the line equals 1-Signal.R2 The first 2 octets of a message represent the START CHARACTER.R3 Up to 14 user data octets are supplemented with a 16 Bit CHECK SEQUENCE.R4 The CHECK SEQUENCE forms a code, which is generated by the polynomial x16 + x13 + x12 + x11 + x10 + x8 + x6 + x5 + x2 + 1. The 16 bits of the CHECK SEQUENCE generated by this specification are inverted. R5

If an error according to rule R6 is detected, an idle state with a minimum duration of L + 6 octets is required, whereby L is the maximum number of user data octets per message, providing L is < 42 octets. For L = 42 octets the interval is at least 48 octets.R6 The receiver checks the signal quality, the START CHARACTER, the CHECK SEQUENCE, the message length as well as the duration of the idle state after detecting an error, as defined in rule R5. If one of these checks produces a negative result, then the message is to be discarded, otherwise it is to be released for the user.





2.12.2 Message Structure for DNP3

The DNP3 protocol uses message formats for messages with variable lengths based onIEC60870-5-1 / format class FT3.

The example shows the schematic structure of a DNP3 message with 3 frames.



2.12.2.1 LINK Header (message header)

STARTThe start field is 2 octets (2 bytes) long. The 1st byte is 0x05 and the 2nd byte is 0x64.

LENGTHThe length field is 1 octet long and defines the number of the following bytes in this messageframe, without the CRC bytes necessary for this. The length field includes CONTROL,DESTINATION, SOURCE field and the user data.The minimum length = 5, the maximum length is 255.





CONTROL (control field)The control field is 1 octet long and contains information about message direction, initiator ofthe message transmission, errors and data flow control and function.

Assignment of the control field:

Elements of the Control Field for IEC60870-5-101 (End-End)

DIR … Physical transmission direction DIR=1: Message from primary to secondary station MASTER à SLAVEDIR=0: Message from secondary to primary station SLAVE à MASTER

PRM … Primary Bit (=Primary message) PRM=1: Message from a primary station (=prompting station)PRM=0: Message from a secondary station (=responding station)

FCB … Frame Count Bit (message sequence bit)

Changing value for successive SEND/CONFIRM orREQUEST/RESPOND –services per station.(Retries are sent with the same FCB bit)

FCV … Frame Count Bit valid (message sequence bit valid)

FCV=0: Changing function of the FCB is invalid (not evaluated)FCV=1: Changing function of the FCB is valid

DFC … Data Flow Control (data flow control)

DFC=0: Further messages are acceptedDFC=1: Further messages could cause a data overflow

Function … Function code

The Primary Bit (PRM) is used for every message transmission itself.

Examples:

· If station B sends a single-point information to station A, then this message from station Bis sent with PRM=1 and acknowledged by station A with PRM=0.

· If station A sends a single command to station B, then this message from station A is sentwith PRM=1 and acknowledged by station B with PRM=0.

DIR PRM=1 FCB FCV Function Code

20212223

2021222324252627

Primary Station to Secondary Station(MASTER ð SLAVE)

DIR PRM=0 =0 DFC Function Code

20212223

2021222324252627

Secondary Station to Primary Station(SLAVE ð MASTER)



Data Link Function Codes:

Function Codes of the Control Field in Messages of the Primary Station (PRM=1)

FCFrame Type Service Function FCV

Bit

Response FunctionCodes permittedfrom Secondary

0 SEND-CONFIRM expected Reset Of Remote Link 0 0 or 1

1 SEND-CONFIRM expected Obsolete 0 15 or no response

2 SEND-CONFIRM expected Test function For Link 1 0 or 1(no response is

acceptable if the linkstates are UnReset)

3 SEND-CONFIRM expected Deliver application data,confirmation requested

1 0 or 1

4 SEND-NO REPLY expected Deliver application data,no confirmation requested

0 no response

5-8 - Reserved - 15 or no response

9 REQUEST-RESPOND expect. Request Status Of Link 0 11

10-15 - Reserved - 15 or no response

Function Codes of the Control Field in Messages of the Secondary Station (PRM=0)

FC Frame Type Service Function

0 CONFIRM ACK … Positive Acknowledgement

1 CONFIRM NAK … Negative Acknowledgement

2 - 10 Reserved

11 RESPOND Status Of The Link

12, 13 - Reserved

14 - Obsolete

15 - Link Service Not Supported

DESTINATION (=Target Address)The DESTINATION-Field (destination address) is 2 octets long and specifies the destinationaddress to which the message object is directed. The destination address 0xFFFF is used asBROADCAST address.

SOURCE (=Source Address)The SOURCE-Field (source address) is 2 octets long and specifies the source address fromwhere the message object has been sent.

CRC (Check Bytes)A CRC consisting of 2 octets is appended at the end of every message block. The messageheader contains START, LENGTH, CONTROL, DESTINATION and SOURCE. The messageheader (Block-0) is also protected with a CRC.

The CHECK SEQUENCE forms a code, which is generated by the polynomial x16 + x13 + x12 + x11 + x10 + x8 + x6 + x5 + x2 + 1.

The rules for message transmission and the methods used for message protectioncorrespond to hamming distance d=6.





2.12.2.2 Transport Header

The transport header is contained in every message of a sequence.

27 26 25 24 23 22 21 20

FIN FIR Sequence number 0 .. 63

FIN: If this bit is set, then this message is the last of asequence or a fragment.FIN = 0 more messages to followFIN = 1 last message of a fragment

FIR: This bit is set for the first message of a sequence or a fragment.FIR =1 first message of a sequenceFIR =0 part message of a sequence

Sequence No.: The sequence number is used to detect the correct message sequences offragments. It is used in a range from 0 to 63. For each message of afragment, with the exception of the first message of a fragment, thesequence number is increased by 1. Once the sequence number hasreached the value 63, then the next message of a sequence is sent with thesequence number 0. With every set FIR bit a new sequence number istransferred.



2.12.2.3 User Data (APDU)

The user data (APDU) for DNP3 consists of:

· Application Header (APCI)· Object Header (DUI)· Data "Information Object" (IO)





2.12.2.3.1 Application Header (APCI)

The application header (APCI … Application Protocol Control Information) consists of:

· Application Control (AC)· Function Code (FC)· Internal Indication (IIN)

(only contained in Response Header in monitoring direction)

Application Control (AC)

The application control field is used for the detection and use of multifragment messages.

27 26 25 24 23 22 21 20

FIR FIN CON UNS. Sequence number 0-15 Application Control (AC)

FIR: If this bit is set, then this sequence is the first of a multifragment.FIR = 0 more sequences to followFIR = 1 first sequence of a multifragment

FIN: If this bit is set, then this sequence is the last of a multifragment.FIN = 0 more messages to followFIN = 1 last sequence of a multifragment

CON: This bit is used for the applicative acknowledgement of a fragment.CON = 0 no acknowledgement is expectedCON = 1 an acknowledgement is expected for this fragment

UNS.: This bit is set when it concerns an unsolicited response (spontaneousmessage of the controlled station) or the applicative acknowledgement foran unsolicited response.Uns. = 0 no unsolicited responseUns. = 1 unsolicited response

Sequence No.: The sequence number is used for the detection of the order of individualfragments and the order of fragments within a multifragment. With everyreceived application header the sequence number is increased in a rangefrom 0 to 15.If an applicative acknowledgement is expected, then this acknowledgementhas the same sequence number as the application header of the remotestation that requested this acknowledgement.



Application Layer Function Codes (FC)

CODE Function Description Supported byDNPMx0 DNPSx0

General function codes

0 Confirm Acknowledgement for a fragment atapplication level

ü ü

1 Read Interrogation of data ü ü

2 Write Writing/Storage of data ü ü

Function codes for commands

3 Select Select or activate commands or setpointvalues without command output

ü ü

4 Operate Output of the selected or activated commandsor setpoint values

ü ü

5 direct operate Direct output of commands or setpoint valueswithout prior selection

ü ü

6 direct operate- No Acknowledgement

Direct output of commands or setpoint valueswithout prior selectionDo not generate any feedback about thestatus of the output

ü ü

Function codes for counters

7 immediate freeze Freeze the data ü ü

8 immediate freeze- No Acknowledgement

Freeze the dataDo not generate any feedback about thestatus of the operation

ü ü

9 freeze and clear Freeze and reset the data ü ü

10 freeze and clear- No Acknowledgement

Freeze and reset the dataDo not generate any feedback about thestatus of the operation

ü ü

11 freeze with time Freeze the data at the specified moment - *) - *)

12 freeze with time- No Acknowledgement

Freeze the data at the specified momentDo not generate any feedback about thestatus of the operation

- *) - *)

*) the counts are frozen at the moment of reception of the message






Application Control Function Codes

13 cold restart Perform restart in the controlled station - ü

14 warm restart Perform reset in the controlled station - -

15 initialize data to defaults Initialize the data with the default values - -

16 initialize application Initialize an application - -

17 start application Start an application - -

18 stop application Stop an application - -

Configuration Function Codes

19 save configuration Save the configuration - -

20 enable unsolicitedmessages

Enable transmission of spontaneousmessages

ü ü

21 disable unsolicitedmessages

Disable transmission of spontaneousmessages

ü ü

22 assign class The transferred data are assigned a class(class 1,2 or 3)

ü ü

Time Synchronization Function Codes

23 delay measurement Calculation of the message transfer time anddelay time of the controlled station for thetime synchronization

ü ü

Reserved

24–120 Reserved - -

121–128 Reserved - -

Function Codes of the Slave


General function codes

0 confirm Acknowledgement for a fragment atapplication level

ü ü

129 response Reply to an interrogation of data ü ü

130 unsolicited message Spontaneous message of the controlledstation without interrogation from the master

ü ü



Request HeaderThe request header is only contained in the first message of a sequence. It consists of theApplication Control and the Function Code. Only the master sends a request header.

27 26 25 24 23 22 21 20


Function code 0 .. 255 Function Code (FC)

Response HeaderThe response header is only contained in the first message of a sequence. It consists of theApplication Control, the Function Code and the Internal Indications. Only the slave sends aresponse header.

27 26 25 24 23 22 21 20


Function code 0 .. 255 Function Code (FC)

Internal Indications7 6 5 4 3 2 1 0

15 14 13 12 11 10 9 8

Every message with user data from the controlled station contains the internal indication in theresponse header. The internal indication consists of 16 bit and contains information and errorsof the controlled station.

Bit 0: A message addressed to all controlled stations has been received.Bit 1: Class 1 data presentBit 2: Class 2 data presentBit 3: Class 3 data presentBit 4: The controlled station expects a time synchronization.Bit 5: Some or all data points are/will be controlled locally (local/remote switch)Bit 6: Fault in the controlled stationBit 7: Controlled station restartBit 8: The function code is not supportedBit 9: The requested data are not present in the controlled station.Bit 10: Error in Qualifier/Index field or in the Range field of the object headerBit 11: Event memory overflowBit 12: The received request is already being executed.Bit 13: Fault or error in the controlled station parametersBit 14: ReservedBit 15: Reserved





2.12.2.3.2 Object Header (DUI)

The object header defines and describes the following data objects for this object header.

The Object Header (DUI … Data Unit Information) consists of:

· Object· Variation· Qualifier· Range

27 26 25 24 23 22 21 20

Object Object Type

Variation Object Variant

Res. Index Size Qualifier Code Qualifier

Range

Qualifier

The qualifier field determines the number and the structure of the individual data objects forthis object header. The precise use of the Qualifier field is to be taken from the generaldescription of the DNP protocol.

The Qualifier Code defines how the data objects are addressed and structured and the IndexSize defines how the index of the data objects is formed.

Range

The Range field can be a single index of a data object or a table from a start index and an endindex. The size of the index can be maximum 32 Bit or 42949671295.



2.12.2.3.3 Data Objects (IO)

The description of the individual data objects is to be taken from the document DNP3 DataObject Library of the DNP Organization.

2.12.2.3.4 Data Index

Every data object is defined by the object type and the object variant used. Within one objecttype the data objects are differentiated by the data index. According to the definition this dataindex can be maximum 42949671295. All DNP3.0 firmware variants however support only amaximum data index of 65535. Consequently a maximum of 65536 data points can be usedfor one object type. The same data index may be used for different object types, as thedifferentiation of the data is enabled through the object type.

2.12.3 Message Examples for DNP3

Example 1: Test of the link layer (Test Function for Link)Message is transmitted from the primary station with address = 0 to asecondary station with address = 1.

2021222324252627

START [0x05]

START [0x64]

LENGTH [0x05] **)

1. Byte

2. Byte

3. Byte

4. Byte

DESTINATION [0x01]

DESTINATION [0x00]

[LSB]

[MSB]

DIR=1 Funktion Code [0x02]20212223FCV=1FCB=1PRM=1

SOURCE [0x00]

SOURCE [0x00]

[LSB]

[MSB]

5. Byte

6. Byte

7. Byte

8. Byte

CRC [0x52]

CRC [0x0C]

[LSB]

[MSB]

9. Byte

10. Byte

Control Field

DestinationStation-Address

SourceStation-Address

Blo

ck-0

DN

P3

Mes

sage

Hea

der

(acc

ordi

ngIE

C60

870-

5-1

/FT3

)

**) CRC Bytes are not includend in LENGTH !





2.13 Message Conversion

Data in transmit direction are transferred from the basic system element to the protocolelement in SICAM RTUs internal IEC 60870-5-101/104 format. These are converted on theline by the protocol element to the DNP3 message format and transmitted according to thetransmission procedure of the protocol.

Data in receive direction are converted by the protocol element on the transmission line fromDNP3 format to a SICAM RTUs internal IEC 60870-5-101/104 format and transferred to thebasic system element.

The transformation of the message formats SICAM RTUs « DNP3 and the conversion of theaddress information is known as message conversion. The conversion of the addressinformation is carried out using the process-technical OPM (object-oriented Process DataManager) protocol detailed routing.



With the DNP3 protocol the addressing of the data (DNP Objects) is carried out with “Object /Variation" and data index. The interrogation of the data by the controlling station can takeplace either specifically (e.g.: “Binary Input with Status”) or with a general interrogation(e.g. “Binary Input - Any Variation”).

The default data types for interrogations with “Any Variation” are to be set in the controlledstation with the following parameters:

· Default data type for "Binary Input (Object 1)"Can be set with the parameter advanced parameters | Settings default data objecttypes | for binary input (object 1)

· Default data type for "Binary Input Change (Object 2)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for binary input change (object 2)

· Default data type for "Double Binary Input (Object 3)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for double binary input (object 3)

· Default data type for "Double Binary Input Change (Object 4)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for double binary input change (object 4)

· Default data type for "Binary Output (Object 10)"Can be set with the parameter advanced parameters | Settings default data objecttypes | for binary output (object 10)

· Default data type for "Binary Counter (Object 20)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for binary counter (object 20)

· Default data type for "Frozen Binary Counter (Object 21)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for frozen binary counter (object 21)

· Default data type for "Binary Counter Change Event (Object 22)"Can be set with the parameter advanced parameters | Settings default data objecttypes | for binary counter change event (object 22)

· Default data type for "Frozen Binary Counter Event (Object 23)"Can be set with the parameter advanced parameters | Settings default data objecttypes | for frozen binary counter event (object 23)

· Default data type for "Analog Input (Object 30)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for analog input (object 30)

· Default data type for "Analog Input Change (Object 32)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for analog input change(object 32)

· Default data type for "Analog Input Dead band (Object 34)"Can be set with the parameter advanced parameters | Settings default data objecttypesn | for analog input dead band (object 34)

· Default data type for "Analog Output Status (Object 40)"Can be set with the parameter advanced parameters | Settings defaultdata object typesn | for analog output status (object 40)





With the DNP3 Master the following detailed routing types are available in transmit direction:

· Commands for single or double commands· Setpoint values for setpoint commands normalized, scaled and short floating point

With the DNP3 Master the following detailed routing types are available in receive direction:

· Binary information as process information for single or double-point information· Measured values as measured values normalized, scaled and short floating point· Counts as count 31 Bit + polarity sign with sequence number

The Ax address consists of 5 + 1 bytes:1. octet of the CAASDU/ region number2. octet of the CAASDU/ component number1. octet of the IOA/ module number2. octet of the IOA/ value number3. octet of the IOA/ subaddressData type (process-technical addressing)

The 3rd party address consists of:DNP Link AddressDNP Data Index (address of the data point)DNP Object Group



2.13.1 Status Information General Rules

7 0

Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

Bit 0: Online (status of the data point)This status is displayed on the IV-status bit of the Ax message.0 = offline, the acquisition of the data point is possibly invalid.1 = online, the data point has been correctly acquired.

Bit 1: Restart (restart of the module that acquires this data point)This status is not supported by the firmware.0 = normal, normal status1 = restart, restart of the module

Bit 2: Communication lost (failure of the module that acquires this data point)This status is displayed on the NT-status bit of the Ax message.0 = normal, normal status1 = lost, communication failed

Bit 3: Remote Forced Data (the change of the data point was caused by a remotecommand.)This status is used as cause of transmission return information through remotecommand (COT=11) in the Ax message.0 = normal, change without command1 = remote forced, change through a remote command

Bit 4: Local Forced Data (the change of the data point was caused by a localcommand.)This status is used as cause of transmission return information through localcommand (COT=12) in the Ax message.0 = normal, change without command1 = local forced, change through a local command





2.13.1.1 Conversion of NT-bit

For master and slave there is the opportunity to convert the DNP3 status bits “offline” and“communication lost” in different ways if its needed. These parameters are used:

· Master (ethernet firmwares: DNP3 à Master à) advanced parameters | conversionDNP3 status bit „offline“

· Slave (ethernet firmwares: DNP3 à Slave à) advanced parameters | conversion ofNT-bit

Masterà Slave:

If the DNP3 status bit “communication lost” ist set, then it will be converted into the NT-bitanyways.

· (defaut) DNP3 status bit “offline” à IV-bit· DNP3 status bit “offline”à “NT-bit· DNP3 status bit “offline”à NT-bit and IV-bit

Slaveà Master:

· (default) NT-bità DNP3 status bit “communication lost” (bit 2)· NT-bità DNP3 status bit “offline” (bit 2)· NT-bità DNP3 status bits “offline” and “communication lost” (bit 0 and bit 2)

NoteThis is supported by the DNP3 protocol for SICAM RTUs for the following firmware from the specifiedrevision!

2.13.1.2 Conversion of IV-bit

For the slave there is the opportunity to use the IV-Bit additionally or alternatively to the NT-bitas an information for the failure of the data point. Thus will be converted like mentionedabove.

Slaveà Master:

· (default) only NT-bit is used for the failure of the data point· only the IV-bit is used for the failure of the data point· NT-bit and/or IV-Bit is used for the failure of the data point



2.13.1.3 Status Information for Binary Information

7 0

0/1 Res. Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

Bit 0 to 4: see Status Information General Rules

Bit 5: Chatter Filter (the transmission of the data point was prevented due to toomany changes; bounce suppression)This status is not supported by the firmware.0 = normal, normal status1 = filter on, bounce suppression

2.13.1.4 Status Information for Measured Values

7 0

Res. Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

Bit 0 to 4: see Status Information General Rules1

Bit 5: Over-Range (overflow of the measuring range)This status is displayed on the OV-status bit of the Ax message.0 = normal, no overflow1 = over-range, overflow of the measuring range

Bit 6: Reference Check (fault with reference check)This status is displayed on the IV-status bit of the Ax message.0 = normal, normal status1 = error, error during the reference check

2.13.1.5 Status Information for Counter Values

7 0

Res. Res. Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

Bit 0 to 4: see Status Information General Rules

Bit 5: Roll-Over (overflow of the count range)This status is used for the count calculation and is used for the detection of a possibleoverflow0 = normal, no overflow1 = roll-over, overflow of the count range





2.13.2 DNP3 MASTER: Message Conversion in Receive Direction

Message Conversion in Receive Direction DNP3 ® IEC60870-5-101/104:

DNP3 IEC60870-5-101/104

ObjectType

Object Variant Designation Designation TI

12

1, 21, 2, 3

Binary InputBinary Input Change

Single-point info with real timeDouble-point info with real time

3031

34

1, 21, 2, 3

Double Binary InputDouble Binary Input Change

Double-point info with real time 31

1011

1, 21, 2

Binary OutputBinary Cmd. Status

Single-point info with real time 30

30323440

1, 2, 3, 4,51, 2, 3, 4, 5, 7

1, 2, 31, 2, 3

Analog InputAnalog Change EventAnalog Input Dead bandAnalog Output Status

Measured value 15 Bit + signnormalizedMeasured value 15 Bit + signscaledMeasured value short floating point

343536

20212223

1, 2, 5, 61, 2, 5, 6, 9, 10

1, 2, 5, 61, 2, 5, 6

Binary CounterFrozen CounterCounter Change EventFrozen Counter Event

Count 31 Bit + polarity sign withsequence number

37

52 2 Time Delay Fine Time synchronization *)

*) Message is only evaluated on PRE



2.13.2.1 Process Information “Binary Input”

Object format: DNP3 Binary Input

Object type 1 - Variation 01 Type: Static

7 0

7 6 5 4 3 2 1 0

15 14 13 12 11 10 9 8

¯

0 0 0 n n-1 n-2 n-3 n-4

Object format: DNP3 Binary Input with Status


7 0


Object format: DNP3 Binary Input Change without Time

Object type 2 - Variation 01 Type: Event

7 0






Object format: DNP3 Binary Input Change with Time


7 0


LSB

48 Bit absolute time in milliseconds

Since 01.01.1970 00.00 hours

MSB



7 0


Relative time in milliseconds LSB

MSB 0 - 65535



Address Conversion SICAM RTUs ® DNP3:

The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “REC_Binary_Input” is available in the protocoldetailed routing with the following entries.

Supported SICAM RTUs message formats:

· 1 single-point Information (TI = 30)· 1 double-point Information (TI = 31)

SICAM RTUs address:

CASDU1CASDU2IOA1IOA2IOA3

5-stage freely parameter-settable SICAM RTUs destination addresspossible: 0 – 255

TI: type identification:

possible: 30 = single-point information31 = double-point information

Third-party address:

Link address: Station number of the remote station

DNP data index: Unambiguous address of this data pointpossible: 0-65535

Object_Group: Assignment of the data to the DNP object typespossible: - Single Binary Input

- Double Binary Input- Binary Output

Supplementary information:

None





Conversion information:

Data type_information: - single-point information - single-point information inverted- double-point information status OFF- double-point information status ON With this setting the type and the contents of the data is interpreted.

NoteIf a double-point information is to be generated automatically from 2 individual binary inputs, then 2individual data points must be created and in each case the corresponding signaling bit/data indexassigned for “double-point information status OFF” and “double-point information status ON”.

Conversion_information: - single-point information - transient information forward only ON - emulate transient information OFF - double-point information with faulty and intermediate positionmonitoring. - double-point information without faulty and intermediateposition monitoring. Through this setting the conversion of the data is defined.

GI behavior: - no forwarding with source-GI - forwarding with source-GI from the image With forwarding from the image, with GI data can beforwarded that are not sent from the remote station with a GI,e.g. transient information.



2.13.2.2 Process Information “Double Binary Input”

Object format: DNP3 double binary Input


7 0

7 6 5 4 3 2 1 0

15 14 13 12 11 10 9 8

¯

0 0 0 n n-1 n-2 n-3 n-4

Object format: DNP3 Binary Input with Status


7 0

ON OFF Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0



7 0






Object format: DNP3 Binary Input Change with Time


7 0


LSB

48 bit absolute time in milliseconds

Since 01.01.1970 00.00 hours

MSB



7 0



MSB 0 - 65535




· 1 double-point Information (TI = 31)

Address conversion DNP3à SICAM RTUs:


SICAM RTUs address:



TI: type identification

possible: 31 = double-point information




Object_Group: Assignment of the data to the DNP object typespossible: - Double Binary Input


none


IEC message conversion:

Data type_information: - double-point information OFF before ON - double-point information ON before OFFWith this setting the type and the contents of the data are interpreted.

Conversion_information: - double-point information with faulty and intermediate positionmonitoring. - double-point information without faulty and intermediateposition monitoring. Through this setting the conversion of the data is defined.






2.13.2.2.1 Process Information “Binary Output”

Object format: DNP3 Binary Output


7 0

7 6 5 4 3 2 1 0

15 14 13 12 11 10 9 8

¯

0 0 0 n n-1 n-2 n-3 n-4

Object format: DNP3 Binary Output with Status


7 0







· 1 single-point Information (TI = 30)

SICAM RTUs address:


5-stage freely parameter-settable SICAM RTUs destinationaddresspossible: 0 – 255


possible: 30 = single-point information




Object_Group: Assignment of the data to the DNP object typespossible: - Binary Output


none


Data type_information: - single-point information - single-point information inverted With this setting the type and the contents of the data is interpreted.

Conversion_information: - single-point information - transient information forward only ON - emulate transient information OFF Through this setting the conversion of the data is defined.






2.13.2.3 Message Conversion Measured Values

Object format DNP3 "32 Bit Analog Input":


Object format DNP3 "32 Bit Frozen Analog Input":


Object format DNP3 "32 Bit Analog Change Event without Time":


Object format DNP3 "32 Bit Frozen Analog Event without Time":


7 0

Status information measured values

LSB

Measured value

-2147483648 to +2147483647

MSB

Object format DNP3 "32 Bit Analog Input without Flag":


Object format DNP3 "32 Bit Frozen Analog Input without Flag":


7 0

LSB

Measured value

-2147483648 to +2147483647

MSB



Object format DNP3 "32 Bit Frozen Analog Input with Time of Freeze":


Object format DNP3 "32 Bit Analog Change Event with Time":


Object format DNP3 "32 Bit Frozen Analog Event with Time":


7 0


LSB

Measured value

-2147483648 to +2147483647

MSB

LSB


since 01.01.1970 00.00 hours

MSB





Object format DNP3 16 Bit Analog Input:


Object format DNP3 16 Bit Frozen Analog Input:


Object format DNP3 16 Bit Analog Change Event without Time:


Object format DNP3 16 Bit Frozen Analog Event without Time:


7 0


Measured value LSB

MSB -32768 to +32767

Object format DNP3 16 Bit Analog Input without Flag:


Object format DNP3 15 Bit Frozen Analog Input without Flag:


7 0

Measured value LSB

MSB -32768 to +32767



Object format DNP3 16 Bit Frozen Analog Input with Time of Freeze:


Object format DNP3 16 Bit Analog Change Event with Time:


Object format DNP3 16 Bit Frozen Analog Event with Time:


7 0


Measured value LSB

MSB -32768 to +32767

LSB


since 01.01.1970 00.00 hours

MSB





Object format DNP3 short floating point Analog Input:


Object format DNP3 short floating point Frozen Analog Input:


Object format DNP3 short floating point Analog Change Event without Time:


Object format DNP3 short floating point Frozen Analog Event without Time:


7 0


LSB

Measured value

short floating point

MSB



Object format DNP3 short floating point Analog Change Event with Time:


Object format DNP3 short floating point Frozen Analog Event with Time:


7 0


LSB

Measured value


MSB

LSB


Since 01.01.1970 00.00 hours

MSB






· Measured value 15 bit + polarity sign normalized (TI = 34)· Measured value 15 bit + polarity sign scaled (TI = 35)· Measured value short floating point (TI = 36)


The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “REC_Analog_Input” is available in the protocoldetailed routing with the following entries.

SICAM RTUs address:




possible: 34 = measured value 15 bit + polarity sign normalized35 = measured value 15 bit + polarity sign scaled36 = measured value short floating point




Object_Group: Assignment of the data to the DNP object typespossible: - analog input

- analog input dead bandanalog output


None




Adaptation X0: This is the minimum value of the DNP analog value.

Adaptation X100: This is the maximum value of the DNP analog value

Adaptation Y0: This is the minimum value of the SICAM RTUs measuredvalue.

Adaptation Y100: This is the maximum value of the SICAM RTUs measuredvalue.

Measured value threshold great:Change monitoring for measured valuesIf the delta between old and new value is greater than themeasured value threshold great, then this measured value isforwarded immediately.

Measured value threshold additive:Change monitoring for measured valuesThe change of every single value received is added uppolarity sign correct. If this summation value exceeds theadditive measured value threshold, then the measured valueis forwarded.





2.13.2.4 Message Conversion of Counts

Object format DNP3 32 Bit Binary Counter:


Object format DNP3 32 Bit Frozen Binary Counter:


Object format DNP3 32 Bit Binary Frozen Counter Change Event without Time:


7 0

Status information counts

LSB

Count

0 to +4294967295

MSB

Object format DNP3 32 Bit Binary Counter without Flag:


Object format DNP3 32 Bit Binary Frozen Counter without Flag:


7 0

LSB

Count

0 to +4294967295

MSB









7 0


LSB

Count

0 to +4294967295

MSB





7 0

LSB

Count

0 to +4294967295

MSB











7 0


Count LSB

MSB 0 to +65535





7 0

Count LSB

MSB 0 to +65535



Object format DNP3 16 Bit Binary Frozen Counter with Time of Freeze:


Object format DNP3 16 Bit Binary Frozen Delta Counter with Time of Freeze:

Object format DNP3 16 Bit Binary Frozen Counter Change Event with Time:


7 0


Count LSB

MSB 0 to +65535

LSB


since 01.01.1970 00.00 hours

MSB






· Count 31 Bit + polarity sign with sequence number (TI = 37)


The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “REC_Counter” is available in the protocoldetailed routing with the following entries.

SICAM RTUs address:




possible: 37 = count 31 Bit + polarity sign with sequence number




Object_Group: Assignment of the data to the DNP object typespossible: - binary counter

- frozen binary counter


IEC-Group: This parameter setting refers to the counter group in theAx system message counter interrogationpossible: - Group 1

- Group 2- Group 3- Group 4

Transmit: This parameter defines how the count is to be frozen internally andtransmitted. The count can be interrogated by the remote station(counter interrogation) or frozen time-controlled. If an event class isdefined, then the time-controlled frozen count is transmitted as eventat the moment of freezing.possible: - counter interrogation

- 1 minute- 2 minutes- 3 minutes- 5 minutes- 10 minutes- 15 minutes- 30 minutes- 60 minutes- spontaneously




Raw value type: This parameter determines the manner of the conversion.possible: - absolute valueà absolute value

- relative valueà absolute value- absolute valueà relative value- relative valueà absolute value

Overflow: Overflow of the count and how the value is usedpossible: - 31 bit integer

- 24 bit integer- 2 decades BCD (99)- 3 decades BCD (999)- 4 decades BCD (9999)- 5 decades BCD (99999)- 6 decades BCD (999999)- 7 decades BCD (9999999)- 8 decades BCD (99999999)- 9 decades BCD (999999999)- 16 bit integer- transparent data transfer

The count is calculated according to the following method.

· Calculate the delta between the new DNP3 value and the old DNP3 value (underconsideration of a possible overflow 16 or 32 bit)

· Add this delta value to the internal count· Perform overflow treatment according to the parameter “overflow” and set the CY bit

The overflow is to be adapted according to the rate of change of the DNP3 count, with greaterchanges greater overflows should be used accordingly.

NoteIn some cases the RTU does have an individual counter rollover (not 16 or 32 bit). Therefore it is possibleto transfer the received counter values without internal calculation. To use this the following parametersmust be used:overflow → transparent data transfertransmit → spontaneously

In this case the IEC counter interrogation and cyclic counter data transfer is not possible anymore.





2.13.3 DNP3 MASTER: Message Conversion in Transmit Direction

Message Conversion in Receive Direction IEC60870-5-101/104à DNP3:

IEC60870-5-101/104 DNP3

TI Designation Designation ObjectType

ObjectVariant

4546

single commanddouble command

Control Relay Output Block 12 1

30 Single-point info with real time Binary Output 10 1

484950

Setpoint command 15 bit + signnormalizedSetpoint command 15 bit + sign scaledSetpoint command short floating point

32 Bit Analog Output Block16 Bit Analog Output Blockshort floating point AnalogOutput Bl.

41 123

343536

Measured value 15 Bit + signnormalizedMeasured value 15 Bit + sign scaledMeasured value short floating point

Analog Input Dead band 34 1, 2, 3

Cyclic interrogations Enable/Disable unsolicitedmessages for data class 1, 2 or3.Enable or disable spontaneousmessage transmission

60 2, 3, 4 *)

Assign ClassAssign the specified data toclass 1, 2 or 3

*)

Delay MeasurementRun time measurement

*)

Time synchronization Time and DateTime synchronization

50 1 *)

*) message is only created on SIP



2.13.3.1 Message Conversion of Commands

Object format DNP3 Control Relay Output Block:


7 0

control code

count = 1

LSB

on time (ms)

MSB

LSB

off time (ms)

MSB

0 status





Count: Counter for the number of command outputs for this commandonly Count = 1 is supported by the firmware

Control code:

trip/close clear queue code

Code: 0 = no operation specified (is not evaluated by the firmware)1 = Pulse ON (pulse sequence OFFà ONà OFF, is used as command ON)2 = Pulse OFF (pulse sequence ON à OFFà ON, is used as command OFF)3 = Latch ON (switches the command ON)4 = Latch OFF (switches the command OFF)5 – 15 Reserve

Queue: If this bit is set, then the command is repeated following its output(is not evaluated by the firmware)

Clear: If this bit is set, all commands stored in the queue are cleared

Trip/Close: With this a double command can be executed with one command (data point).For this the commands TRIP and CLOSE are used.(is only used/evaluated for double commands)

Status: 0 = No error 1 = The OPERATE-command has been received after the timeout for

SELECT/OPERATE has expired 2 = The OPERATE-command was received without a

SELECT-command being received beforehand 3 = Implausible data in command message 4 = No routing record present for this command 5 = This command state is already active or the internal storage

(Queue) is occupied/full 6 = No output possible due to hardware problems 7 = No output possible because local/remote control not set to REMOTE 8 = No output possible because too many command outputs active at the

same time 9 = No output possible because no adequate authorization

present10 – 127 reservedThe status information is added by the controlled station and transmitted ascommand acknowledgement with the entire command object.



Address Conversion SICAM RTUsà DNP3:

The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Command” is available in the protocoldetailed routing with the following entries.


· 1 single command (TI = 45)· 1 double command (TI = 46)

DNP3 address



Object_Group: Assignment of the data to the DNP object typespossible: - binary command (CROB)

Supplementary information

Cmd_ON_time: This parameter determines the command output time for the ON-command.

Cmd_OFF_time: This parameter determines the command output time for the OFF-command.

Function_Code: This parameter determines the DNP function code to be added for thiscommand. In addition it is also defined which type of commandprocedure is to be performed.possible: - select und execute

- direct operate (only the EXECUTE command is used)- direct operate no ack. (only the EXECUTE command is used) [with this function code no command status information is sent by the RTU]






Control_code: This parameter determines which type of command output is to beperformed for this data point.possible: - command as LATCH ON/OFF (the output takes place

state-change stored as permanent state)- command as PULSE ON (pulse command, switch on command relay for the duration of Cmd_ON_time)- command as PULSE ON with TRIP (pulse command, in addition there is a TRIP relayà double command OFF on one DNP data point)- command as PULSE ON with CLOSE (pulse command, in addition there is a CLOSE relay à double command ON on one DNP data point)- command as PULSE ON with TRIP/CLOSE (pulse command, In addition there is a TRIP and CLOSE relayà double command ON and OFF on one DNP data point)

Command_Point: This parameter defines how the command is to be assigned to thedata point, e.g. whether a data point can execute the ON and the OFFcommand or only command of the two (2 data points for one doublecommand).possible: - Data point as ON/CLOSE and OFF/TRIP

- Data point only as ON/CLOSE- Data point only as OFF/TRIP

SICAM RTUs address:


5-stage freely parameter-settable SICAM RTUs source addresspossible: 0 – 255


possible: 45 = single command46 = double command

Every command message is sent back by the controlled station, unless it concerns thefunction code "direct operate no acknowledgement”, and in this message the status of thecommand output is entered.



2.13.3.2 Message Conversion of Binary Output

Object format DNP3 Binary Output:


7 0

7 6 5 4 3 2 1 0

15 14 13 12 11 10 9 8

¯

0 0 0 n n-1 n-2 n-3 n-4

The firmware however supports only the output of one data point per message.






The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Command” is available in the protocoldetailed routing with the following entries.


· 1 single-point Information (TI = 30)

DNP3 address



Object_Group: Assignment of the data to the DNP object typespossible: - binary output


Cmd_ON_time: not used

Cmd_OFF_time: not used

Function_Code: This parameter determines the DNP function code to be added for thiscommand. In addition it is also defined which type of commandprocedure is to be performed.possible: - write


Control_code: not used

Command_Point: not used

SICAM RTUs address:




possible: 30 = single-point information



2.13.3.3 Message Conversion of Setpoint Values

Object format DNP3 32 Bit Analog Output Block:


7 0

LSB

Setpoint value

-2147483648 to +2147483647

MSB

0 status



7 0

Setpoint value LSB

MSB -32768 to +32767

0 status

Object format DNP3 Short Floating Point Analog Output Block:


7 0

LSB

Setpoint value


MSB

0 status





Status: 0 No error1 The OPERATE-command has been received after the timeout

for SELECT/OPERATE has expired2 The OPERATE-command was received without a SELECT

command being received beforehand3 Implausible data in command message4 No routing record present for this command5 This command state is already active or the internal storage

(Queue) is occupied/full6 No output possible due to hardware problems7 No output possible because local/remote control not set to

REMOTE8 No output possible because too many command outputs

active at the same time9 No output possible because no adequate authorization

present10–127 Reserved

The status information is added by the controlled station and transmitted as commandacknowledgement with the entire command object.


The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Setpoint_Value” is available in the protocoldetailed routing with the following entries.

upported SICAM RTUs message formats:

· Setpoint command normalized (TI = 48)· Setpoint command scaled (TI = 49)· Setpoint command short floating point (TI = 50)

DNP3 address



Object_Group: Assignment of the data to the DNP object typespossible: - analog output block


Function_Code: This parameter determines the DNP function code to be added for thiscommand. In addition it is also defined which type of commandprocedure is to be performed.possible: - select und execute

- direct operate (only the EXECUTE command is used)- direct operate no ack. (only the EXECUTE command is used) [with this function code no command status information is sent by the RTU]



Conversion information

Object_Variation: This parameter determines the format and the data type of the data tobe converted.possible: - 32 Bit Analog Data

- 16 Bit Analog Data- short floating point analog data

Supplementary information for setpoint values/measured values:

Adaptation X0: This is the minimum value of the SICAM RTUs analog value.

Adaptation X100: This is the maximum value of the SICAM RTUs analog value

Adaptation Y0: This is the minimum value of the DNP measured value.

Adaptation Y100: This is the maximum value of the DNP measured value.

Every setpoint value message is sent back by the controlled station, unless it concerns thefunction code "direct operate no acknowledgement”, and in this message the status of thesetpoint value output is entered.

2.13.4 DNP3 SLAVE: Message Conversion in Transmit Direction

Message Conversion in Transmit Direction IEC60870-5-101/104 ® DNP3:

IEC60870-5-101/104 DNP3

TI Designation Designation ObjectType

ObjectVariant

3031

Single-point info with real timeDouble-point info with real time

Binary InputBinary Input Change

12

0, 1, 20, 1, 2, 3

31 Double-point info with real time Double Binary InputDouble Binary Input Change

34

0, 1, 20, 1, 2, 3

343536

Measured value 15 Bit + signnormalizedMeasured value 15 Bit + sign scaledMeasured value short floating point

Analog InputAnalog Change Event

3032

0, 1, 2, 3,4

0, 1, 2

37 Count 31 Bit + polarity sign withsequence number

Binary CounterFrozen CounterFrozen Counter Event

202123

0, 1, 50, 1, 5, 90, 1, 5

Time synchronization Time Delay Fine 52 2 *)

*) message is created automatically on SIP





2.13.4.1 Message Conversion of Process Information

2.13.4.1.1 Conversion to Binary Input

Object format DNP3 Binary Input:


7 0

7 6 5 4 3 2 1 0

15 14 13 12 11 10 9 8

¯

0 0 0 n n-1 n-2 n-3 n-4

Object format DNP3 Binary Input with Status:


7 0


Object format DNP3 Binary Input Change without Time:


7 0




Object format DNP3 Binary Input Change with Time:


7 0


LSB


Since 01.01.1970 00.00 hours

MSB



7 0



MSB 0 - 65535






· 1 single-point Information (TI = 30)· 1 double-point Information (TI = 31)


The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Binary_Input” is available in the protocoldetailed routing with the following entries.

SICAM RTUs address:




possible: 30 = single-point information31 = double-point information


Link address: Station number of the remote station (controlling station)Only for DNPi00


Object variant: Assignment of the data to the DNP object typespossible: - Binary Input


Event class: Assignment of the data point to an event classpossible: - Class 1 data

- Class 2 data- Class 3 data- Not used/no class


IEC message conversion: Conversion of the IEC information to the corresponding DNP dataindexpossible: - single-point information

- single-point information inverted- double-point information status OFF (TI 31)- double-point information status ON (TI 31)

NoteIf 2 individual binary inputs are to be generated automatically from one double-point information, then 2individual data points of the double-point information must be created and in each case the correspondingstatus “double-point information status OFF” and “double-point information status ON” assigned to therespective DNP3 data index.



2.13.4.1.2 Conversion to Double Binary Input

Object format DNP3 Binary Input:


7 0

7 6 5 4 3 2 1 0

15 14 13 12 11 10 9 8

¯

0 0 0 n n-1 n-2 n-3 n-4

Object format DNP3 Binary Input with Status:


7 0




7 0






Object format DNP3 Binary Input Change with Time:


7 0


LSB


since 01.01.1970 00.00 hours

MSB



7 0



MSB 0 - 65535




· 1 double-point Information (TI = 31)


The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Binary_Input” is available in the protocoldetailed routing with the following entries.

SICAM RTUs address:




possible: 31 = double-point information




Object variant: Assignment of the data to the DNP object typespossible: - Double Binary Input





IEC message conversion: Conversion of the IEC information to the corresponding DNP dataindexpossible: - Double-point information OFF before ON (TI 31)

- Double-point information ON before OFF (TI 31)





2.13.4.2 Message Conversion Measured Values









7 0


LSB

Measured value

-2147483648 to +2147483647

MSB





7 0

LSB

Measured value

-2147483648 to +2147483647

MSB









7 0


LSB

Measured value

-2147483648 to +2147483647

MSB

LSB


since 01.01.1970 00.00 hours

MSB













7 0


Measured value LSB

MSB -32768 to +32767





7 0

Measured value LSB

MSB -32768 to +32767









7 0


Measured value LSB

MSB -32768 to +32767

LSB


since 01.01.1970 00.00 hours

MSB





Object format DNP3 short floating point Analog Input:


Object format DNP3 short floating point Frozen Analog Input:


Object format DNP3 short floating point Analog Change Event without Time:


Object format DNP3 short floating point Frozen Analog Event without Time:


7 0


LSB

Measured value


MSB



Object format DNP3 short floating point Analog Change Event with Time:


Object format DNP3 short floating point Frozen Analog Event with Time:


7 0


LSB

Measured value


MSB

LSB


since 01.01.1970 00.00 hours

MSB








The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Analog_Input” is available in the protocoldetailed routing with the following entries.

SICAM RTUs address:








Object variant: Assignment of the data to the DNP object typespossible: - Measured value 16 bit

- Measured value 32 bit- Measured value short floating point








Adaptation X0: Minimum value of the SICAM RTUs analog value

Adaptation X100: Maximum value of the SICAM RTUs analog value

Adaptation Y0: Minimum value of the DNP measured value

Adaptation Y100: Maximum value of the DNP measured value

Measured value threshold great:Change monitoring for eventsIf the delta between old and new value is greater than themeasured value threshold, then an event is generated from this.





2.13.4.3 Message Conversion Counts







7 0


LSB

Count

0 to +4294967295

MSB





7 0

LSB

Count

0 to +4294967295

MSB



Object format DNP3 32 Bit Binary Frozen Counter with Time of Freeze:


Object format DNP3 32 Bit Binary Frozen Delta Counter with Time of Freeze:

Object format DNP3 32 Bit Binary Frozen Counter Change Event with Time:


7 0


LSB

Count

0 to +4294967295

MSB

LSB


since 01.01.1970 00.00 hours

MSB






· Count 31 Bit + polarity sign with sequence number (TI = 37)


The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Counter” is available in the protocoldetailed routing with the following entries.

SICAM RTUs address:




possible: 37 = count 31 Bit + polarity sign with sequence number




Object variant: Assignment of the data to the DNP object typespossible: - 32 bit count

- 16 bit count- 32 bit count delta- 16 bit count delta







IEC count type: Is the count used as absolute value or as relative value.possible: - Absolute value

- Relative value

Overflow: Overflow of the count and how the value is usedpossible: - 31-bit integer

- 24-bit integer- 2 decades BCD (99)- 3 decades BCD (999)- 4 decades BCD (9999)- 5 decades BCD (99999)- 6 decades BCD (999999)- 7 decades BCD (9999999)- 8 decades BCD (99999999)- 9 decades BCD (999999999)- 16-bit integer

Transmit: This parameter defines how the count is to be frozen internally andtransmitted. The count can be interrogated by the remote station(counter interrogation) or frozen time-controlled. If an event class isdefined, then the time-controlled frozen count is transmitted as eventat the moment of freezing.possible: - counter interrogation

- 1 minute- 2 minutes- 3 minutes- 5 minutes- 10 minutes- 15 minutes- 30 minutes- 60 minutes

The count is calculated according to the following method.

· Calculate the delta between the new internal value and the old internal value (underconsideration of a possible overflow depending on parameter setting)

· Add this delta value to the last transmitted DNP3 count· Perform overflow treatment according to DNP3 data type and set the roll-over bit





2.13.5 DNP3 SLAVE: Message Conversion in Receive Direction

Message Conversion in Receive Direction DNP3 ® IEC60870-5-101/104:

DNP3 IEC60870-5-101/104

ObjectType

ObjectVariant

Designation Designation TI

12 1 Control Relay Output Block single commanddouble command

4546

41 123

32 Bit Analog Output Block16 Bit Analog Output Blockshort floating point AnalogOutput Bl.

Setpoint command 15 bit + signnormalizedSetpoint command 15 bit + sign scaledSetpoint command short floating point

484950

60 1, 2, 3, 4 Interrogation data class 0, 1 ,2 or 3

*)

60 2, 3, 4 Enable/Disable unsolicitedmessages for data class 1 , 2or 3Enable/Disable spontaneousmessage transmission

*)

Assign ClassAssign the specified data toclass 1, 2 or 3

*)

Delay MeasurementRun time measurement

*)

50 1 Time and DateTime synchronization

*)

*) message is only evaluated on PRE



2.13.5.1 Message Conversion Commands

Object format DNP3 Control Relay Output Block:


7 0

control code

count = 1

LSB

on time (ms)

MSB

LSB

off time (ms)

MSB

0 status





Count: Counter for the number of command outputs for this commandonly Count = 1 is supported by the firmware

Control code:

trip/close clear queue code

Code: 0 = no operation specified (is not evaluated by the firmware)1 = Pulse ON (pulse sequence OFFà ONà OFF, is used as command ON)2 = Pulse OFF (pulse sequence ON à OFFà ON, is used as command OFF)3 = Latch ON (switches the command ON)4 = Latch OFF (switches the command OFF)5 – 15 Reserve

Queue: If this bit is set, then the command is repeated following its output(is not evaluated by the firmware)

Clear: If this bit is set, all commands stored in the queue are cleared

Trip/Close: If the command is a double command, then only the bits for Trip/Close areevaluated and transferred in the Ax message(is only used/evaluated for double commands)

Status: 0 No error1 The OPERATE-command has been received after the timeout for

SELECT/OPERATE has expired2 The OPERATE-command was received without a

SELECT-command being received beforehand3 Implausible data in command message4 No routing record present for this command5 This command state is already active or the internal storage

(Queue) is occupied/full6 No output possible due to hardware problems7 No output possible because local/remote control not set to REMOTE8 No output possible because too many command outputs active at the

same time9 No output possible because no adequate authorization

present10 Control not permitted11–127 Reserved



Address conversion DNP3 ® SICAM RTUs

The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “REC_Command” is available in the protocoldetailed routing with the following entries.


1 single command (TI = 45)

1 double command (TI = 46)

DNP3 address



Object variant: Assignment of the data to the DNP object typespossible: not used


IEC command conversion:This parameter defines, how the DNP command procedure is to beconverted on the IEC-command. The IEC command can be forwardedwith SELECT/EXECUTE or only with EXECUTE. A simulation oremulation of the SELECT command can also take place, if there is noSELECT available on the remote station.possible: - evaluate SELECT/EXECUTE

- simulate SELECT- ignore/do not forward SELECT

QOC: Qualifier of Command, addition of the command output timepossible: - not determined

- short output time- long output time

Cmd/Point Index: This parameter determines, how the received commands are to beconverted. The received data index or the configured data point canbe used together for switching on and off or only for the respectiveswitching on or off. Either a double command or a single command istransmitted per data index.possible: - data index as ON/CLOSE and OFF/TRIP

- data index only ON/CLOSE- data index only OFF/TRIP

DNP command option: It can be determines with this, whether only the protected commandtransmission using SELECT/EXECUTE, only the unprotectedcommand transmission using DIRECT OPERATE or both variantstogether are permitted.possible: - no restriction

- only SELECT/OPERATE- only DIRECT OPERATE

Bay level LOCAL reference:This parameter is used in combination with the function of the protocolelement control message for the specific enable or disable ofcommands. A detailed description of this function is to be taken fromchapter Protocol Element Control.possible: - Unambiguous reference number between 1 and 65535





Cmd OFF interlocking reference:

Cmd ON interlocking reference:With these two parameters a command disable can be configured ineach case for the ON command and the OFF command. Thisreference number is to be entered in the protocol element control asadditional parameter. A detailed description of this function is to betaken from chapter Protocol Element Control.possible: - Unambiguous reference number between 1 and 65535

Retrigger Cycle: If a variable command output time – based on the command ON timein DNP3 control relay output block – is needed, this can be realized byusing the retrigger command (regulated command) function on SICAMRTUs Hardware. The command output will remain activated as longas retrigger commands or a stopp command will be received by thehardware. This is only supported for double point commands (TI=46).possible: - no retrigger command

- retrigger cycle 1 second- retrigger cydle 2 seconds- retrigger cycle 5 seconds

Binary information command state:The IEC address of a single or double-point information can beconfigured in order to accept the current state of the command or itsreturn information. This is used to transmit the current command stateto a controlling station, if this is requested by it, above all if nocommand has been received after a restart and consequently, undercertain circumstances, an implausible value would be transmitted.

RM-CASDU1RM-CASDU2RM-IOA1RM-IOA2RM-IOA3


SICAM RTUs address:




possible: 45 = single command46 = double command

Every command message is sent back by the controlled station and the status of thecommand output is entered in this message.



2.13.5.2 Message Conversion Setpoint Values



7 0

LSB

Setpoint value

-2147483648 to +2147483647

MSB

0 status



7 0

Setpoint value LSB

MSB -32768 to +32767

0 status

Object format DNP3 Short Floating Point Analog Output Block:


7 0

LSB

Setpoint value


MSB

0 status





Status: 0 No error1 The OPERATE-command has been received after the timeout for

SELECT/OPERATE has expired2 The OPERATE-command was received without a

SELECT-command being received beforehand3 Implausible data in command message4 No routing record present for this command5 This command state is already active or the internal storage

(Queue) is occupied/full6 No output possible due to hardware problems7 No output possible because local/remote control not set to REMOTE8 No output possible because too many command outputs active at the

same time9 No output possible because no adequate authorization

present10–127 Reserved

Address conversion DNP3 ® SICAM RTUs

The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “REC_Command” is available in the protocoldetailed routing with the following entries.


· Setpoint command normalized (TI = 48)· Setpoint command scaled (TI = 49)· Setpoint command short floating point (TI = 50)

DNP3 address



Object variant: Assignment of the data to the DNP object typespossible: - 16 Bit measured value/setpoint value

- 32 Bit measured value/setpoint value- Short floating point measured value/setpoint value


IEC command conversion:The IEC-command conversion for setpoint values is integrated fixed inthe firmware and does not need to be parameterized. For setpointvalues only EXECUTE is supported or generated. If the remote stationsends setpoint values with SELECT, then the timeout betweenSELECT and EXECUTE is nevertheless monitored. In this casedespite this only the EXECUTE message is transferred.





Adaptation X0: This is the minimum value of the SICAM RTUs analog value.

Adaptation X100: This is the maximum value of the SICAM RTUs analog value

Adaptation Y0: This is the minimum value of the DNP measured value.

Adaptation Y100: This is the maximum value of the DNP measured value.

Every setpoint value message is sent back by the controlled station and the status of thesetpoint value command output is entered in this message.





2.14 Special Functions

For the interfacing to third-party systems, if necessary the following special functions can beactivated for the adaptation of the message conversion:

2.14.1 Sags and Swells for DNP3 Master and Slave

This concerns a sequence of 4 measured values with the same address. These values areonly transmitted as event with real time and represent a special treatment of a measuredvalue. In order to differentiate this special measured value processing from the normalmeasured value treatment of the measured value, bit 7 of the status information is used. All 4measured values have this bit set and can thus be unambiguously assigned. For thetransmission of these events the associated measured values are sorted directly one after theother and transmitted. Possible measured value events – no Sags and Swells events – forwhich the time tag is within a Sag and Swell sequence are sorted at the end of this sequence.

So that this function can be used the following global AU-parameters are to be adapted onMCPU.The state compression of following type identification must be disabled for Sags and Swellsmeasured vales using following parameters on MCPU:

· AU common settings | Settings for type identification | TI 34 Measuredvalue, normalized value | State compression = NO

· AU common settings | Settings for type identification | TI 35 Measuredvalue, scaled value | State compression = NO

· AU common settings | Settings for type identification | TI 36 Measuredvalue, short floating pt. number | State compression = NO

Message Conversion Master:

For the already existing measured value a second data point must be created with the sameDNP address but a different IEC address and Object Group = analog input (sags and swells).




The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “REC_Analog_Input” is available in the protocoldetailed routing with the following entries.



SICAM RTUs address:








Object_Group: Assignment of the data to the DNP object typespossible: - analog input (sags and swells)


none


Adaptation X0: This is the minimum value of the DNP analog value.

Adaptation X100: This is the maximum value of the DNP analog value

Adaptation Y0: This is the minimum value of the SICAM RTUs measured value.

Adaptation Y100: This is the maximum value of the SICAM RTUs measured value.

Measured value threshold great:Here the change monitoring is deactivated, every value is transferred.

Measured value threshold additive:Here the change monitoring is deactivated, every value is transferred.





Message Conversion Slave:

For the already existing measured value a second data point must be created with the sameDNP address but a different IEC address and Object Variant = 32 bit measured value (sagsand swells), 16 bit measured value (sags and swells) or floating point (sags and swells).




The address conversion is parameterized using the OPM (object-oriented process datamanager). For this the detailed routing type “TRA_Analog_Input” is available in the protocoldetailed routing with the following entries.

SICAM RTUs address:







Object variant: Assignment of the data to the DNP object typespossible: - Measured value 16 bit (sags and swells)

- Measured value 32 bit (sags and swells)- Measured value short floating point (sags and swells)








Adaptation X0: This is the minimum value of the SICAM RTUs analog value.Adaptation X100: This is the maximum value of the SICAM RTUs analog valueAdaptation Y0: This is the minimum value of the DNP measured value.Adaptation Y100: This is the maximum value of the DNP measured value.Measured value threshold great:

The measured value threshold is not evaluated, the data are alwaystransferred.

2.14.2 Storing User Data on the BSE (DNP3 Slave)

If the existing buffer is insufficient for the event data and more events are to be stored, thenthe data can be stored on the BSE. By means of parameter setting this can be activatedseparately for binary information or measured values advanced parameters | projectrelevant DNP settings | Keep/holding back event data on BSE - binaryindication or advanced parameters | project relevant DNP settings |Keep/holding back event data on BSE - measured values.

Shortly before the maximum filling level of 94 percent of the internal event buffer is reached,the corresponding priority level of the single/double-point information or the measured valueson the BSE is disabled. With that all other data of this priority level are stored on the BSE untilthis priority level is enabled again or the user data dwell time has expired. The priority level isonly enabled again when the internal event buffers have been transmitted and consequentlyare less than 30 percent full.

In addition to the parameter settings of the DNP3 Slave firmware other parameter settings areto be adapted on the global AU parameters as well as the BSE parameters.

If measured values are also to be buffered on the BSE, then the state compression is to beswitched off for the corresponding type identifications. With state compression activated,every time only the current value of the measured value is stored or overwritten.

The state compression of following type identification must be disabled for Sags and Swellsmeasured vales using following parameters on MCPU:

· AU common settings | Settings for type identification | TI 34 Measuredvalue, normalized value | State compression = NO

· AU common settings | Settings for type identification | TI 35 Measuredvalue, scaled value | State compression = NO

· AU common settings | Settings for type identification | TI 36 Measuredvalue, short floating pt. number | State compression = NO

When data is buffered on the BSE in the corresponding rings, then these data are buffereduntil the corresponding priority level has been enabled again or the time until the automaticdeleting of the process information has expired.

The behavior can be controlled individually for every interface of a BSE with the parameterCommunication | PRE# | Advanced settings | Failure behavior for processinform.

The protocol element DNPSx0 requires following settings for priority levels for binaryinformation and measured values:

· binary information: Communication | PRE# | Advanced settings | Prioritybinary information = "High priority" = class 1 data (spontaneous priority 1)"





· measured values: Communication | PRE# | Advanced settings | Prioritymeasured values = "Low priority" = class 2 data (spontaneous priority 7)".

NoteIntegrated totals (counters) must not be assigned to any of the two previously mentioned priority levels, asthese are then also disabled (Communication | PRE# | Advanced settings | Prioritycounters).

When using the selective data flow the corresponding data class is to be set for binary values = class 1and measured values = class 2.

If the priority level is disabled and the data are buffered on the BSE, then the firmware monitors thereception of data of the disabled priority level. If data are nevertheless sent from the BSE, then thefirmware generates a transient information for the error diagnosis and in parallel to that an entry in theinternal diagnostic ring, which can be read out with the ST-Emulation (command: IDR). The IEC address(CASDU, IOA and TK) is displayed.

2.14.3 Enable SCBO (Check Back Before Operate)

This is used for the transmission of the commands and thereby uses one of the methodsdeviating from the DNP3 standard for the procedure of SELECT and OPERATE. According tothe DNP3 standard, an already running SELECT ON command for the index 0 is interruptedby a new SELECT ON command for the index 1 and the new SELECT ON command for theindex 1 is now used instead. The command is therefore only executed if the followingOPERATE ON command for the index 1 is received.

Now if this parameter advanced parameters| project relevant DNP settings |Enable SCBO (check back before operate)is set to YES, then another method is usedby the firmware.

Variant a (parameter is NO according to the DNP3 standard):1. Reception of SELECT ON Command Index 0 à Response: Command Status 0 = no error2. Reception of SELECT OFF Command Index 1 à Response: Command Status 0 = no error3. Reception of EXECUTE ON Command Index 0à Response: Command Status 2 = no SELECT

Variant a (Parameter is YES):1. Reception of SELECT ON Command Index 0 à Response: Command Status 0 = no error2. Reception of SELECT OFF Command Index 1à Response: Command Status 4 = not supported3. Reception of EXECUTE ON Command Index 0à Response: Command Status 0 = no error

Variant b (parameter is NO according to the DNP3 standard):1. Reception of SELECT ON Command Index 0 à Response: Command Status 0 = no error2. Reception of SELECT OFF Command Index 1 à Response: Command Status 0 = no error3. Reception of EXECUTE OFF Command Index 1à Response: Command Status 0 = no error

Variant b (Parameter is YES):1. Reception of SELECT ON Command Index 0 à Response: Command Status 0 = no error2. Reception of SELECT OFF Command Index 1à Response: Command Status 4 = not supported3. Reception of EXECUTE OFF Command Index 1à Response: Command Status 2 = no SELECT



2.14.4 Redundancy Function: Hot Standby

This function concerns a special form of redundancy. Thereby 2 interfaces in the same AU areused for this mode. One interface contains all process data and is parameterized as activeinterface. The other interface is set as passive interface. Only messages of the link layer areprocessed over the passive interface, e.g. acknowledgements to the controlling station.

Normally user data calls are sent to the active interface and replied by this. The passiveinterface only receives and replies messages of the link layer. If the controlling stationdetermines a problem on the active communication, then from then on it sends the user datacalls to the passive interface. The passive interface detects these user data calls and forwardsthese to the active interface as internal container message over the node bus. The activeinterface processes this container message as if it had been received from the controllingstation over the serial communication and sends the reply message to the passive interface,also as internal container message over the node bus, so that it can be sent from there to thecontrolling station.

This type of redundancy covers only failures of the transmission facility, but not modulefailures of the SIP.

The following parameter settings are necessary for the active interface.- advanced parameters | project relevant DNP settings | Redundancy used ashot standby- advanced parameters | project relevant DNP settings | Target BSE for hotstandby container- advanced parameters | project relevant DNP settings | Target SSE for hotstandby container

NoteThis function is only supported by DNPSx0.Since the active database alone is responsible for the generation of the user data messages, thesequence numbers of transport header and application header must synchronous over both interfaces.This must also be supported by the connected controlling stations.

If the Hot Standby mode is activated, then the SICAM RTUs redundancy must not be used.





2.14.5 State Compression for Measured Value Events

With the parameter advanced parameters | project relevant DNP settings | Datacompression for analog change events measured value events can be state-compressed. Then only the last event received is transmitted for the next event interrogation.Without state compression all events of the measured values are transmitted.

2.14.6 Link Address Substitution (DNPi00, DNPiA1 and DNPiT1 only)

Like already mentioned every connection needs a different DNP destination and DNP sourcelink address, because the DNP destination link address is used to address the data of theprocess technical parameters (telegram conversion).

In a case where the link addresses of several connected DNP3 master stations is defined asthe same DNP destination and/or DNP source link address for every connection and cannotbe changed, it is possible to substitute these link addresses for a maximum of 4 connections.Nevertheless the link addresses parameterized in the connection table are still used forinternal addressing.

To substitute DNP destination and/or DNP source link address, this have to be activated in2 stages.

1. Connection table

2. Project relevant settings



2.15 Wildcard TCP/IP Address (DNPiT1)

With the help of a wildcard TCP/IP address 0.0.0.0 it is possible to establish a connection fromany TCP/IP address (master/client) to the slave (server). There can only be one client havingan active connection to the slave at the time. Any connection attempt by a different clientduring a connection is already established, will be refused by the server.

Once the wildcard address is used in the connection definition table, no other connection canbe used. There can only be one connection with the wildcards address 0.0.0.0. If there ismore than one connection and one of them has a wildcard address, the system will producean error message and ignore the settings.

The advantage of using a wildcard address is that only one connection in the connectiondefinition table is needed and therefore the process technical parameters only have to be setup once for this single connection.

NoteUsing the wildcard TCP/IP address may cause security issues, because any TVP/IP address of the samesubnet will be accepted.





2.16 Protocol Element Control and Return Information

This function is used for the user-specific influencing of the general functions of the protocolelements.

This function contains two separate independent parts:

· Protocol element control· Protocol element return information

The Protocol Element Control enables:

· applicative control of the station interrogation· set control location· the reachability of stations to be tested· the suppression of errors with intentionally switched-off stations (Station Service)

The Protocol Element Return Information enables:

· states of certain status lines to be used as process information· information about the station status/failure to be obtained

Block Diagram

Messages with process information

Messages with system information

Inte

rnal

dist

ribut

ion

form

essa

ges

with

proc

ess

info

rmat

ion

Protocol elementcontrol

Protocol elementreturn information Protocol element

Internal

functionTransmission route



2.16.1 Protocol Element Control Slave

For the controlled station the following firmware-specific protocol functions are used.

2.16.1.1 Control Internal Indication Bit LOCAL

With this function the IIN bit LOCAL can be switched on or off for the respective controlledstation (station number). If this IIN Bit is set all commands to this controlled station arediscarded with the command status 7 = LOCAL.

Control function 0 = switch offControl function 1 = switch on





2.16.1.2 Control Selective Command Disable

With this function the command output can be disabled or enabled for individual commands.The configurable additional parameter thereby determines the reference number, which isused in the process technical parameter setting. If the function is activated, all commands withthis reference number are discarded with the command status 7 = LOCAL.

Control function 4 = switch off command disableControl function 5 = switch on command disable



2.16.1.3 Control Command Disable for OFF and ON Command

With this function the command output can be disabled or enabled for the respectivecommand used, selectively for the OFF or the ON command. The configurable additionalparameter thereby determines the reference number, which is used in the process technicalparameter setting. If the function is activated, all OFF or ON commands with this referencenumber are discarded with the command status 10 = Control not permitted.

Control function 2 = switch off command disableControl function 3 = switch on command disable





2.16.1.4 Deactivate/Activate Events

This function can be used to deactivate or activate the building of events.

If events are deactivated, all changed data will not cause any transmission. Neither unsolicitedresponse will be sent, nor request for change event object groups or request for data class 1,2 or 3 will be responded with any data in this case. Nevertheless all new incoming data will bestored in the internal process image and in case of request data class 0 its actual state will betransmitted to the master.

Every time after start up the events are enabled. To disable the events the protocol elementcontrol function 6 is used, protocol element control function 7 is used to activate the eventsagain.





2.16.2 Protocol Element Control Master

2.16.2.1 Send „Reset Link“

This function can be used to send the link layer message “reset link” (link layer primaryfunction code 0) whenever it is necessary.

NoteLike it is shown in the above picture, a single binary input (TI=30) is used. Please notice that in this case afalling (negative) edge of this single binary intput needs to be generated before this function can beactivated again with a rising (positive) edge. It could be better to use a single binary command (TI=45)instead.



2.16.3 Protocol Element Return Information

The protocol element return information on the basic system element generates messages withprocess information in monitoring direction and with that enables states of the protocol elementto be displayed or processed.

There are three different categories of return information:

· Status of the status line· Status of the stations· Protocol-specific return information (dependent on the protocol element used)

The assignment of the messages with process information to the return information takes placeon the basic system element with the help of process technical parameters of the ACP 1703system data protocol element return information.

From which source the parameterized return information are to be generated, is set with theparameters "Supplementary system element" and "Station number".

Messages for protocol element return information are transmitted from the protocol element tothe basic system element spontaneously with change or as reply to a general interrogationcommand.

Possible return information controlling station:

Parameter

Return informationfunction_(PRE)

Station Remark

Status DTR 255 1 = status line active *)

Status DSR 255 1 = status line active *)

Station status 0–99 1 = Station enabled for call cycle

Station failure 0–99 1 = Station failed

*) Statuses of status lines are transmitted from the protocol element to the basic system elementspontaneously with change or as reply to a general interrogation command.The spontaneous transmission of the current states takes place internally in a 100 ms grid.ð Status line changes shorter than 100 ms are not guaranteed to be transmitted!

Legend:Station Station number

0–99 Station of the selected protocol element255 Station number not used!





2.17 Web Server

A web server is integrated into the protocol firmware for internal diagnostic information. Theweb server is part of basic system element firmware – the PRE specific web pages will beprovided by protocol element firmware.

System Firmware DNP3 PRE specific Web Pages

SICAM AK 3SICAM AKSICAM ACPSICAM BCSICAM TMAK1703AMC1703

DNPMA0 DNP3 Master “serial“

DNPSA0 DNP3 Slave “serial“

DNPiA1 DNP3 TCP/IP Slave

SICAM A8000 Series SICAM A8000 CP-8000 SICAM A8000 CP-8021 SICAM A8000 CP-8022

DNPMT0 DNP3 Master “serial“ ü

DNPST0 DNP3 Slave “serial“ ü

DNPiT2 DNP3 TCP/IP Master ü

DNPiT1 DNP3 TCP/IP Slave ü

The PRE specific web pages can be read out with a common Web Browser, as for instanceMicrosoft Internet Explorer ®.For the access to the web server the communications protocol "HTTP (Hyper Text TransferProtocol)" is used with the port number 80 or communications protocol "HTTPS (Hyper TextTransfer Protocol over SSL/TLS)" is used with the port number 443.

The integrated web server is addressed by means of direct specification of the IP address ofthe Ethernet interface of the automation unit.

With SICAM A8000 series (CP-8000, CP-8021, CP-8022), the integrated web server for theprotocol elements PRE0,1, 2, 3 can be reached as follows (example):

https://10.9.19.32/pre1 (pre…0,1, 2, 3)http://10.9.19.32/pre1 (pre…0,1, 2, 3)

NoteBy default the integrated web server is deactivated for security reasons. If needed, it can beenabled for access by the user with the parameter HTTP web server | HTTP web server.

https://10.9.19.32/pre1

http://10.9.19.32/pre1



Supported PRE specific WEB pages:

· Overview- Connections- Routing Transmit- Routing Receive

· Developer Information- Freespace- Dataflow Test

NoteThe values displayed on the web pages indicate the current status when the web page is started. Thevalues of a web page are not updated automatically!

An updating of the web page displayed in the web browser can be performed e.g. by means of the webbrowser function “Refresh”.

The web pages will be displayed only in English language!





2.17.1 Overview

With web page Overview general information of the firmware will be displayed.

Field Note

Firmware Name of firmware

Revision Revision of firmware

Hardware Hardware number (system internal)

Firmware number Firmware number (system internal)

Date and time actual date + time of firmware

Region number Region number (system internal)

Component number Component number (system internal)

BSE Basic system element number (system internal)

ZBG Supplementary system element number “SSE” (internal)

IP address Own IP address of the assigned interface

Default gateway Default gateway of the assigned interface

Subnet mask Subnet mask of the assigned interface

MAC address MAC address of the assigned interface

Redundancy Actual redundancy state of the firmware

Example: DNPiT2



2.17.2 Connections

With web page Connections detailed information for selective connection will be displayed.

Field Note

Station number 0..99 (SICAM A8000 internal stations number of connection)

IP:Port IP address and port number of connection

Connection TCP OK = TCP connection establishedNOK = TCP connection not established

Connection DNP3 link layer OK = DNP3 link layer connection establishedNOK = DNP3 link layer connection not established

DNP3 master station (source) DNP3 source address

DNP3 slave station (destination) DNP3 destination address

Name Name of remote station(station name from parameters for connection definition)

Example: DNPiT2





2.17.3 Routing Transmit

With web page Routing Transmit detailed information for each selective DNP3 data point intransmit direction will be displayed.

Field Note

Error Error number

TI IEC60870-5-101/-104 type identification (SICAM A8000 internal) ofspecific data point

CASDI1, CASDU2 IOA1, IOA2, IOA3

SICAM A8000 internal IEC60870-5-101/-104 address ofspecific data point

DNP3 addressDNP3 data index

DNP3 address of specific data point

Object group DNP3 data point type of specific data point

last time sent Date + time of last transmission of specific data point

last COT sent Last transmitted cause of transmission of specific data point

Last dp qual sent Last transmitted DNP3 quality state of specific data point

Last value sent Last transmitted value of specific data point

Example: DNPiT2



2.17.4 Routing Receive

With web page Routing Receive detailed information for each selective DNP3 data point inreceive direction will be displayed.

Field Note

Error Error number

TI IEC60870-5-101/-104 type identification (SICAM A8000 internal) ofspecific data point



DNP3 addressDNP3 data index

DNP3 address of specific data point

Object type DNP3 data point type of specific data point

last time rec Date + time of specific data point last received

last COT rec Last received cause of transmission of specific data point

Last dp qual rec Last received DNP3 quality state of specific data point

Last value rec Last received value of specific data point

Example: DNPiT2





2.17.5 Developer Information - Freespace

With web page Developer Information - Freespace internal information of “Freespace DNP3-Stack“ of the firmware will be displayed.Note: This information is helpful for developer in case of problems.

Field Note

Count malloc internal information

Count free internal information

Heap complete (Bytes) internal information

Heap internal (Bytes) internal information

Heap DNP3 protocol stack (Bytes) internal information

Example: DNPiT2



2.17.6 Developer Information – Dataflow Test

With web page “Developer Information – Dataflow Test” messages transmitted via internalinterface from PRE <-> BSE will be displayed.

The last 200 messages transmitted from PRE <-> BSE will be displayed.

Field Note

Nr. Message number

Dir DirectionPREàBSE: data received via DNP3BSE àPRE: date to be transmitted via DNP3

TK IEC60870-5-101/-104 type identification (SICAM A8000 internal)



Station SICAM A8000 internal station number of connection

COT SICAM A8000 internal IEC60870-5-101/-104 cause of transmission

origin SICAM A8000 internal IEC60870-5-101/-104 originator

data SICAM A8000 internal IEC60870-5-101/-104 state of data point

quality SICAM A8000 internal IEC60870-5-101/-104 quality of data point

Time Date + time of message transmitted via internal interfacefrom PRE <-> BSE

Example: DNPiT2




3 Application Notes

Contents

3.1 General ........................................................................................................ 1583.2 Central Function ........................................................................................... 1603.3 Controlled Station Function........................................................................... 162



Application Notes


3.1 General

3.1.1 What are Static Data and what are Event Data?

All data that are stored static in the process image are called "static data”. Therefore alwaysonly the current state at the moment of the interrogation is transmitted. Through this a changeof a single-point information from the state OFF to the state ON and back again within2 interrogations can not be acquired.

However, if also the changes are to be transmitted, then the “event data” are used for that.Here every change of the signal state is acquired and stored until the next event interrogationor sent as spontaneous data (unsolicited response).

A single-point information can thus be interrogated as static data (object type = 1, objectvariation = 2à binary input with status) with the respective state at the moment of theinterrogation or also as event data (object type = 2, object variation = 2 à binary input changeevent with time), whereby every change is stored and then transmitted on request. To simplifythe interrogation of events, it is possible to assign the event data to an event class. Then aninterrogation to the individual object types no longer needs to be generated, rather therespective event class is simply interrogated cyclically.

3.1.2 What are Class 0, 1, 2 or 3 Data?

In the controlled station all existing data are assigned to the data class 0 (object type = classdata, object variation = 1). An interrogation of class 0 data is therefore used to transmit thecurrent state of the entire process image of this station. This is used for the GI, but can alsobe used as cyclic query to interrogate those data from the controlled station that are notavailable as spontaneous event (comparable with a cyclic background scan with protocol IEC870-5-101).

Class 1, 2 or 3 data concern exclusively only spontaneous changes. So that these changescan be transmitted at all as class 1, 2 or 3 data they must be assigned to one of the 3 classes.Class 1 data thereby have the highest priority and class 3 data the lowest priority. Once thechanges have been assigned to a class, the changes of these data are stored in the controlledstation until the corresponding interrogation of class x data has been received. Now if theseinterrogations are transmitted cyclically, then with that it is relatively simple to obtain as quicklyand efficiently as possible only the respective change that has occurred between 2interrogations of the respective class.

While all existing data points are automatically assigned to the data class 0, as soon as theyare to be transmitted as changes the data points must be actively assigned to an event class(class 1, 2 or 3 data). With the firmware DNPSx0 and DNPi00 this can be set separately forevery data point via the process technique.

Application Notes


3.1.3 Object Group and Object Variation

As static or event data the various user data such as binary information, measured values orcounts are differentiated from each other by the object group. Within each object group thereare different object variations. This in turn makes it possible to specify the user data moreprecisely, e.g. as measured value with 16 bit, 32 bit or as short floating point. Which objectgroups and object variants are supported by a DNP device can be found in the DNP DeviceProfile Document (SICAM RTUs DNP3 Interoperability – DC0-046-2).

For the simplification of the data query, for most object groups there exists the object variant 0= all variants. With that the data to be queried do not need to be defined in more detail in adata query from the controlling station, rather the controlled station decides which objectvariant is sent. For the protocols described here, this is configured with the parameter blockAdvanced parameters | Settings default data object types.

3.1.4 Use of the Data Index

Within the object groups (DNP object type) every data point is addressed with the data index,regardless which object variant (DNP object variation) is used. The data point always remainsthe very same, regardless which object variant is used for the respective object group.

The data index can be freely assigned, but as far as possible should always begin at 0 andalso not feature any large gaps. Because with a general interrogation (class 0 data) the datarange of the respective data types to be transmitted always begins with the index 0 and endswith the largest configured data index for the respective object type. Data that are not presentare transmitted with 0 and status “Offline”. E.g. if the smallest data index used for binaryinformation (single binary information) begins with 1000, then with an interrogation of thisobject type 1000 data objects (data index 0 to 999) will be transmitted without information untilthe actual user data begin. This causes unnecessary delays and loads of the transmissionand processing equipment.

3.1.5 Unsolicited Response

As already described a controlled station can also send spontaneous data to a controllingstation, without prior call by the controlling station. This is used e.g. when the transmissionmedia are to be loaded as little as possible. However, the danger also thereby occurs, that 2controlled stations send data to a controlling station simultaneously and collisions occur as aresult, especially with serial transmission media. All protocols described here, insofar as theyutilize serial transmission media, are unable to avoid collisions. Therefore if multiple DNPSx0protocols are used, then the parameter for the retry delay time advanced parameters |DNP time settings | Timeout unsolicited message retry should be different for allstations.



Application Notes


3.2 Central Function

3.2.1 Cyclic Data Query

Up to 64 cyclic queries can be entered in this table.

A query can be sent either to an individual remote station (link address 0 – 65520), to allconnected remote stations separately (link address = 65530) or as broadcast to all remotestations together (link address = 65535).

The following table contains several examples for cyclic queries. With the first 4 queries (No. 0to 3) it is already possible to query all static data and all event data in one cyclic time scale.

The following query (No. 4) defines a query of all object variants for the object group of thestatic measured values (static analog input) to the controlled station with the DNP destinationaddress 1. However only the data with the data index 30 to 39 are to be requested thereby.

The last query (No. 5) defines the freezing of all existing static counts of the default objectvariant for the object group of static counts (static binary counter) to the controlled station withthe DNP destination address 4.

Application Notes


3.2.2 Conversion 2 Single Binary Inputs to 1 Double-Point Information

For the case that the controlled station does not support any double binary input data andinstead transmits the double-point information as 2 single-point information items, then it ispossible to convert these 2 single-point information items back to 1 double-point information.

Parameter record for the OFF binary information:

Parameter record for the ON binary information:



Application Notes


3.3 Controlled Station Function

3.3.1 Conversion 1 Double-Point Information to 2 Single Binary Inputs

For the case that a controlling station does not support any double binary input data, then ineach case the double-point information can be converted to single-point information (singlebinary input).

Parameter record for the OFF binary information:

Parameter record for the ON binary information:


LiteratureSICAM RTUs Common Functions System- and Basic System Elements DC0-015-2

SICAM RTUs Platforms – Configuration - Automation Units and AutomationNetworks

DC0-021-2

Documents on Interoperability

SICAM RTUs DNP3 Interoperability DC0-046-2

International standards

DNP3 SpecificationVolume 1: DNP3 Introduction

www.dnp.org/

DNP3 SpecificationVolume 2: Application LayerPart 1: Basics

www.dnp.org/

DNP3 SpecificationVolume 2: Application LayerPart 2: Annex

www.dnp.org/

DNP3 SpecificationVolume 2: Application LayerPart 3: State Tables and Diagrams

www.dnp.org/

DNP3 SpecificationVolume 2: Application LayerSupplement 1: Secure Authentication

www.dnp.org/

DNP3 SpecificationVolume 3: Transport Function

www.dnp.org/

DNP3 SpecificationVolume 4: Data Link Layer

www.dnp.org/

DNP3 SpecificationVolume 5: Layer Independent Topics

www.dnp.org/

DNP3 SpecificationVolume 6: Basics DNP3 Object Library

www.dnp.org/

DNP3 SpecificationVolume 7: IP Networking

www.dnp.org/

DNP3 SpecificationVolume 8: Interoperability

www.dnp.org/



Literature


Siemens Automation Partsucc.colorado.edu/siemens/GF_PRE_ACP_DNP3_ENG.pdfPreface 4 SICAM RTUs •...

Documents

Transcript of Siemens Automation Partsucc.colorado.edu/siemens/GF_PRE_ACP_DNP3_ENG.pdfPreface 4 SICAM RTUs •...