What does protocol mean?

PROTOCOL: Is a set of "RULES" and "REGULATIONS" for

seeding and receiving Information on the NETWORK, by
using the standard [Link]/IP.
A protocol is a set of rules or agreed upon guidelines for
communication. When communicating, it is important to
agree on how to do so. If one party speaks Indian and one
German the communications will most likely fail. If they both
agree on a single language, communications will work. On
the Internet the set of communications protocols used is
called TCP/IP. TCP/IP is actually a collection of various
protocols that each has their own special function or
purpose. These protocols have been established by
international standards bodies and are used in almost all
platforms and around the globe to ensure that all devices on
the Internet can communicate successfully.
TCP/IP Networking Protocols
The TCP/IP suite of protocols is the set of protocols used to communicate across the internet. It is
also widely used on many organizational networks due to its flexibility and wide array of
functionality provided. Microsoft who had originally developed their own set of protocols now is
more widely using TCP/IP, at first for transport and now to support other services.

TCP/IP BY LAYER

Link Layer

• SLIP - Serial Line Internet Protocol. This protocol places data packets
into data frames in preparation for transport across network hardware
media. This protocol is used for sending data across serial lines. There is
no error correction, addressing or packet identification. There are no
authentication or negotiation capabilities with SLIP. SLIP will only
support transport of IP packets.
• CSLIP - Compressed SLIP is essentially data compression of the SLIP
protocol. It uses Van Jacobson compression to drastically reduce the
overhead of packet overhead. This may also be used with PPP and called
CPPP.
• PPP - Point to Point Protocol is a form of serial line data encapsulation
that is an improvement over SLIP which provides serial bi-directional
communication. It is much like SLIP but can support AppleTalk, IPX,
TCP/IP, and NetBEUI along with TCP/IP which is supported by SLIP. It
can negotiate connection parameters such as speed along with the ability
to support PAP and CHAP user authentication.
• Ethernet - Ethernet is not really called a protocol. There are also many
types of Ethernet. The most common Ethernet which is used to control

GBC Report 011-2 Page 1 of 9 2002 JAN 03

 the handling of data at the lowest layer of the network model is 802.3
Ethernet. 802.3 Ethernet provides a means of encapsulating data frames
to be sent between computers. It specifies how network data collisions
are handled along with hardware addressing of network cards.

Network Layer

• ARP - Address Resolution Protocol enables the packaging of IP data into

Ethernet packages. It is the system and messaging protocol that is used
to find the Ethernet (hardware) address from a specific IP number.
Without this protocol, the Ethernet package could not be generated from
the IP package, because the Ethernet address could not be determined.
• IP - Internet Protocol. Except for ARP and RARP all protocols' data
packets will be packaged into an IP data packet. IP provides the
mechanism to use software to address and manage data packets being
sent to computers.
• RARP - Reverse address resolution protocol is used to allow a computer
without a local permanent data storage media to determine its IP address
from its Ethernet address.

Transport Layer

• TCP - A reliable connection oriented protocol used to control the

management of application level services between computers. It is used
for transport by some applications.
• UDP - An unreliable connection less protocol used to control the
management of application level services between computers. It is used
for transport by some applications which must provide their own
reliability.
• ICMP - Internet control message protocol (ICMP) provides management
and error reporting to help manage the process of sending data between
computers. (Management). This protocol is used to report connection
status back to computers that are trying to connect other computers. For
example, it may report that a destination host is not reachable.
• IGMP - Internet Group Management Protocol used to support
multicasting. IGMP messages are used by multicast routers to track
group memberships on each of its networks.

Application Layer

• FTP - File Transfer Protocol allows file transfer between two computers with login
required.
• TFTP - Trivial File Transfer Protocol allows file transfer between two computers
with no login required. It is limited, and is intended for diskless stations.
• NFS - Network File System is a protocol that allows UNIX and Linux systems
remotely mount each other's file systems.
• SNMP - Simple Network Management Protocol is used to manage all types of
network elements based on various data sent and received.
• SMTP - Simple Mail Transfer Protocol is used to transport mail. Simple Mail
Transport Protocol is used on the internet; it is not a transport layer protocol but
is an application layer protocol.
 • HTTP - Hypertext Transfer Protocol is used to transport HTML pages from web
servers to web browsers. The protocol used to communicate between web servers
and web browser software clients.
• BOOTP - Bootstrap protocol is used to assign an IP address to diskless computers
and tell it what server and file to load which will provide it with an operating
system.
• DHCP - Dynamic host configuration protocol is a method of assigning and
controlling the IP addresses of computers on a given network. It is a server based
service that automatically assigns IP numbers when a computer boots. This way
the IP address of a computer does not need to be assigned manually. This makes
changing networks easier to manage. DHCP can perform all the functions of
BOOTP.
• BGP - Border Gateway Protocol. When two systems are using BGP, they establish
a TCP connection, and then send each other their BGP routing tables. BGP uses
distance vectoring. It detects failures by sending periodic keep alive messages to
its neighbours every 30 seconds. It exchanges information about reachable
networks with other BGP systems including the full path of systems that are
between them. Described by RFC 1267, 1268, and 1497.
• EGP - Exterior Gateway Protocol is used between routers of different systems.
• IGP - Interior Gateway Protocol. The name used to describe the fact that each
system on the internet can choose its own routing protocol. RIP and OSPF are
interior gateway protocols.
• RIP - Routing Information Protocol is used to dynamically update router tables on
WANs or the internet. A distance-vector algorithm is used to calculate the best
route for a packet. RFC 1058, 1388 (RIP2).
• OSPF - Open Shortest Path First dynamic routing protocol. A link state protocol
rather than a distance vector protocol. It tests the status of its link to each of its
neighbours and sends the acquired information to them.
• POP3 - Post Office Protocol version 3 is used by clients to access an internet mail
server to get mail. It is not a transport layer protocol.
• IMAP4 - Internet Mail Access Protocol version 4 is the replacement for POP3.
• Telnet is used to remotely open a session on another computer. It relies on TCP
for transport and is defined by RFC854.

Bandwidth Control

• BAP - Bandwidth Allocation Protocol is a bandwidth control protocol for PPP

connections. It works with BACP.
• BACP - Bandwidth Allocation Control Protocol.

TCP/IP BY FUNCTION

Packaging and Low Level

• IP - Internet Protocol. Except for ARP and RARP all protocols' data packets will be
packaged into an IP data packet. IP provides the mechanism to use software to
address and manage data packets being sent to computers.
• SLIP - Serial Line Internet Protocol. This protocol places data packets into data
frames in preparation for transport across network hardware media. This protocol
is used for sending data across serial lines. There is no error correction,
addressing or packet identification. There are no authentication or negotiation
capabilities with SLIP. SLIP will only support transport of IP packets.
 • CSLIP - Compressed SLIP is essentially data compression of the SLIP protocol. It
uses Van Jacobson compression to drastically reduce the overhead of packet
overhead. This may also be used with PPP and called CPPP.
• PPP - Point to Point Protocol is a form of serial line data encapsulation that is an
improvement over SLIP which provides serial bi-directional communication. It is
much like SLIP but can support AppleTalk, IPX, TCP/IP, and NetBEUI along with
TCP/IP which is supported by SLIP. It can negotiate connection parameters such
as speed along with the ability to support PAP and CHAP user authentication.
• Ethernet - Ethernet is not really called a protocol. There are also many types of
Ethernet. The most common Ethernet which is used to control the handling of
data at the lowest layer of the network model is 802.3 Ethernet. 802.3 Ethernet
provides a means of encapsulating data frames to be sent between computers. It
specifies how network data collisions are handled along with hardware addressing
of network cards.

Transport and Basic Functions

• TCP - A reliable connection oriented protocol used to control the management of

application level services between computers. It is used for transport by some
applications.
• UDP - An unreliable connection less protocol used to control the management of
application level services between computers. It is used for transport by some
applications which must provide their own reliability.

Network Management

• SNMP - Simple Network Management Protocol is used to manage all types of

network elements based on various data sent and received.
• ICMP - Internet control message protocol provides management and error
reporting to help manage the process of sending data between computers.
(Management). This protocol is used to report connection status back to
computers that are trying to connect other computers. For example, it may report
that a destination host is not reachable. This protocol is required for basic TCP/IP
operations.
• ARP - Address Resolution Protocol enables the packaging of IP data into Ethernet
packages. It is the system and messaging protocol that is used to find the Ethernet
(hardware) address from a specific IP number. Without this protocol, the Ethernet
package could not be generated from the IP package, because the Ethernet
address could not be determined. Protocol is used to report connection status
back to computers that are trying to connect other computers. For example, it may
report that a destination host is not reachable. This protocol is required for basic
TCP/IP operations.

Host Management

• BOOTP - Bootstrap protocol is used to assign an IP address to diskless computers

and tell it what server and file to load which will provide it with an operating
system.
• DHCP - Dynamic host configuration protocol is a method of assigning and
controlling the IP addresses of computers on a given network. It is a server based
service that automatically assigns IP numbers when a computer boots. This way
the IP address of a computer does not need to be assigned manually. This makes
changing networks easier to manage. DHCP can perform all the functions of
BOOTP.
 • RARP - Reverse address resolution protocol is used to allow a computer without a
local permanent data storage media to determine its IP address from its Ethernet
address.

Mail Protocols

• SMTP - Simple Mail Transfer Protocol is used to transport mail. Simple Mail
Transport Protocol is used on the internet; it is not a transport layer protocol but
is an application layer protocol.
• POP3 - Post Office Protocol version 3 is used by clients to access an internet mail
server to get mail. It is not a transport layer protocol.
• IMAP4 - Internet Mail Access Protocol version 4 is the replacement for POP3.

Multicasting Protocols

• IGMP - Internet Group Management Protocol used to support multicasting. IGMP

messages are used by multicast routers to track group memberships on each of its
networks.

Routing Protocols

• BGP - Border Gateway Protocol. When two systems are using BGP, they establish
a TCP connection, and then send each other their BGP routing tables. BGP uses
distance vectoring. It detects failures by sending periodic keep alive messages to
its neighbours every 30 seconds. It exchanges information about reachable
networks with other BGP systems including the full path of systems that are
between them. Described by RFC 1267, 1268, and 1497
• EGP - Exterior Gateway Protocol is used between routers of different systems.
• IGP - Interior Gateway Protocol. The name used to describe the fact that each
system on the internet can choose its own routing protocol. RIP and OSPF are
interior gateway protocols.
• RIP - Routing Information Protocol is used to dynamically update router tables on
WANs or the internet.
• OSPF - Open Shortest Path First dynamic routing protocol. A link state protocol
rather than a distance vector protocol. It tests the status of its link to each of its
neighbours and sends the acquired information to them.

A GENERAL INTRODUCTION TO THE IEC 60870-5-101 STANDARD

FOR A COMMUNICATION PROTOCOL THAT SUPPORTS BASIC
TELECONTROL TASKS

1. FOREWORD

The IEC 60870-5 series of standards documents consists of a number of base standard
sections and an open number of companion standards. Each companion standard
contains a selection of provisions taken from the base standards sections. These are
tailored to suit a particular application by adding further provisions that are defined
within the companion standard itself. The applications covered are all related to
performing tasks needed by electric power systems, although companion standards for
other types of system could also be produced.
The subject of this report is an international standard that provides rules for
communicating between telecontrol stations. Such rules are known as a telecontrol
communication protocol. Several stations, which use this protocol, may be assembled
into an interconnected installation for controlling and monitoring the operational
equipment of a widely distributed electric power system, from a central point.

The protocol is defined with reference to a simplified version of the Basic Reference
Model (ISO 7498) for system interconnection.

The present report starts by giving an outline of the reference model used, and then
continues by describing how the particular protocol works and giving some of the
reasoning behind the standard. Finally some questions, which have been asked about
the standard, are answered.

NOTE: The views expressed in this report are those of the author. They are intended to
help the reader understand the standard described. The report does not give or imply
any guarantee by the author concerning the use of the standard or its suitability for any
particular installation.

2. REFERENCE MODEL

The Basic Reference Model divides a protocol into seven layers. The top three layers are
directly concerned with the actual Application messages being sent between stations.
The bottom four layers are concerned with the method used to Transport these messages
between stations.

The simplified reference model used in the IEC 60870-5-101 standard (and several other
protocol standards) has fewer layers, because some of the facilities supported by the full
seven layer model are not required and enhanced working of the remaining facilities is
desired. Hence the model is often called the Enhanced Performance Architecture (EPA)
Model.

Each station in an installation performs its own local application tasks, called
Application Processes. For example the central (Controlling) station would drive the
keyboard/display or other operator interface equipment and manage the database
containing all the information about the installation, such as current values of measured
variables obtained from remote outstations etc.

Each outstation would have Application Processes for scanning, reading and storing its
local measurements and performing local control actions etc.
Communication between Application Processes in the central station and those in
remote outstations is performed according to the communication protocol.

The following figure shows two stations communicating using the EPA model. Each
station has a “stack” of protocol layers providing communication services to the station
Application Processes at the top and accessing the communications medium at the
bottom.
 STATION A STATION B

APPLICATION APPLICATION
LAYER LAYER
(7) (7)
LINK INTERFACE LINK INTERFACE

LINK LINK
LAYER LAYER
(2) (2)
PHYSICAL INTERFACE PHYSICAL INTERFACE

PHYSICAL PHYSICAL
LAYER LAYER
(1) (1)
COMMUNICATIONS MEDIUM

In general Application data is accepted at the top of the protocol stack in one station (say
station A) and passes down through the stack, acquiring in each layer any necessary
extra data needed to control the working of the protocol, until it emerges in serial form at
the bottom. It is then transmitted to the other station (say station B) where it enters at
the bottom of the protocol stack. The data passes up this stack having the control data
stripped off layer by layer until the original Application data emerges at the top and is
passed to the Application Processes in station B.

This is called “peer to peer” communication because all data originating in a particular
layer is transported to the same layer in the remote station.

The model is used to define a protocol in an abstract way. A real protocol may be
implemented in any way at all provided that, when viewed from outside the stations, it
works exactly as specified by the model. Thus the protocol standard imposes minimum
constraints on the hardware and software used inside the stations. This allows stations
to be chosen according to economic or other practical considerations.

The layer interfaces shown in the protocol stack do not have to be present in a real
station. However the Physical Interface is usually present because the Physical layer is
often implemented using a separate MODEM. The Link Interface needs to be present if it
is desired to implement the Application layer software and the Link layer software
separately.

3. MESSAGE STRUCTURE

Serial messages, as viewed outside of the stations, have a nested structure which derives
from the layered structure of the protocol, see the following figure.

Start End

S L L S C A ASDU CS E

APDU
LPCI LPCI
LPDU
All data fields shown in the figure consist of octet strings of one or more octets.

The ASDU (Application Service Data Unit) is a block of data being sent from the
Application Processes in one station to the Application Processes in another station.

According to the EPA model some APCI (Application Protocol Control Information) is in
general added to the ASDU to form the APDU (Application Protocol Data Unit). However
the APCI is not needed in the IEC 60870-5-101 protocol, so the APDU is equal to the
ASDU.

The Link layer adds its own LPCI (Link Protocol Control Information) to the APDU to
form the LPDU (Link Protocol Data Unit). In addition it prepares each data octet in the
LPDU to be transmitted as an Asynchronous start/stop serial character having one start
bit (value=0), eight data bits (the data octet), one even parity bit and one stop bit
(value=1).

The LPDU is transmitted as a contiguous frame with no idle line (“gaps”) between the
asynchronous characters.

LPCI = S+L+L+S+C+A+CS+E
S = Start character which has a fixed defined bit pattern.
L = Length character which specifies the length in octets of the ASDU+C+A
C = The Link Control character.
A = The Link Address field which is one or two characters chosen to suit the
Installation.
CS = The Check Sum character.
E = End character which has a fixed defined bit pattern.

The protocol specifies that, for transmission speeds up to 1200 bits/second, the Physical
layer shall convert each transmitted bit directly into one of two frequencies, representing
the binary one state and the binary zero state respectively. This form of modulation is
called Frequency Shift Keying (FSK) and it is both symmetrical and memory less. It is
suitable for most voice frequency (vs.) analogue channels on base band transmission
line, power line carrier or radio communications media.

4. FRAME INTEGRITY

The LPDU frame, as shown in the above figure, provides a very high data integrity (IEC
Integrity Class I2). There must be at least four bit errors in a received frame before an
undetectable frame error is possible. This corresponds to a code hamming distance of
four (had=4).

The frame consists of two parts which may be called the “header” and the “body”. The
header contains the S+L+L+S characters and the body contains the remaining
characters. Each frame is preceded and succeeded by a period of idle line (continuous
binary one state). The header specifies the length of the ASDU+C+A and hence the length
of the body.

Due to the parity protection, at least two bit errors in the contents of any asynchronous
character are required to cause an undetectable character error.
In the frame body, at least two characters with undetected errors are required to
produce an undetectable Sum Check error. Thus a total of four data or parity bit errors
are required to produce a received frame body with a possible undetectable error.

If the start bit of any asynchronous character is erroneously received as a binary one,
then the start of that character will be delayed until the next binary zero bit is received.
This will delay (and corrupt) the received character and, because there are no gaps
between characters, it will also delay (and corrupt) all subsequent characters in the
frame. This is sometimes called a “sync slip”.

If such a sync slip occurs in the body of a received frame, the End character will be
pushed into the idle line period, which succeeds the frame. This will be detected by the
receiver, with a high degree of certainty, because the pattern of bits in the End character
is specially chosen to differ from idle line and shifted versions of the character itself by at
least four bits.

The frame header has a fixed format and length. It is separately protected with had=4
integrity against both sync slip and data/parity bit errors. This means that the receiver
can rely on the length information it provides. Hence the receiver knows exactly where to
look for the End character when checking the integrity of the frame body.

Because the FSK modulation in the Physical layer is symmetrical, there is an equal
probability of receiving erroneous binary one bits and erroneous binary zero bits. But
more importantly the modulation is memory less, which means that it does not degrade
the integrity of the Link layer frame by introducing any particular erroneous bit more
than once into a received frame.

It is sometimes desired to transmit messages at speeds in excess of 1200 bits/second.

To do these synchronous MODEMs may be used. These have bit scramblers to ensure
that the receiver clock does not lose synchronisation during prolonged periods without
change of binary state in the data being sent. The scrambler introduces memory
into the modulation and potentially degrades the integrity provided by the Link layer.
However, it is has recently been proved that certain faster non-memory less modulation
methods may be used, without loss of integrity, due to particular properties of the Link
frame. See
IEC 60870-1-5 technical report when it is published.

In some circumstances faster transmission is possible on directly connected data

circuits using digital signal multiplexers. Speeds up to 19,200 bits/sec for asynchronous
characters and faster for the same characters sent isochronously are possible.

5. THE USE OF THE LINK AND PHYSICAL LAYERS

As explained above the LPDU (Link frame) contains the ASDU (Application message)
whilst it is being transmitted using FSK modulation on a vs. analogue channel between
stations.

The protocol is intended for use with permanent directly connected data circuits between
the central station and the outstations. These may be implemented as follows:-

A multi-drop party line connection which is time shared between several or all
outstations, using different Link addresses to identify individual outstations. This would
normally be operated in a half-duplex mode on a single channel, sending to and
receiving from each outstation in turn, using unbalanced (“speak when you are spoken
to”) media access for the Link protocol.

CENTRAL
STATION

OUTSTATION OUTSTATION OUTSTATION

Individual full duplex connections to some or all outstations, with a single V.F. channel
for each direction of communication in each connection. The individual connections
permit balanced media access for the Link protocol, enabling spontaneous sending of
data in both directions.

CENTRAL
STATION

OUTSTATION OUTSTATION OUTSTATION

The protocol provides Link functions for supporting balanced and unbalanced media
access. However practical considerations (including higher cost) may limit the extent to
which full duplex balanced connections are used.

6. PROVISIONS OF THE APPLICATION LAYER

The Application layer of the protocol includes all those parts of the station Application
Processes which are concerned with communicating with Application Processes in a
remote station. These parts are referred to as the “(protocol) User Process” in the IEC
60870-5-101 standard.

The standard defines two sets of provisions for the Application protocol.

a) Application Functions
Station Initialisation
Data acquisition by polling
Cyclic data transmission
Acquisition of events
General interrogation
Clock synchronisation
Command transmission
Transmission of Integrated Totals
Parameter loading
Test procedure
File transfer (for simple files)
Acquisition of transmission time delay

b) Application Service Data Units (ASDU)

The protocol offers an assortment of different types of ASDU suitable for the Application.
However they all have the same general format as shown in the following figure.

T Q C CA OA IE TT ------------------------- OA IE TT

IO 1 IO n

T = Type Identification (1 data octet)

Q = Variable Structure Qualifier (1 data octet). Indicates the number of
Information Objects in the ASDU or the number of Information Elements
in a single Information Object.
C = Cause of Transmission (1 or 2 data octets, fixed per installation)
Causes include: periodic/cyclic, spontaneous, Request/Requested,
Activation (of a Control action), etc.
CA = Common Address (1 or 2 data octets, fixed per installation). Distinguishes
the Station Address/Station Sector Address housing the Information
Objects (IO1 to IOn).
OA = Information Object Address (1, 2 or 3 data octets, fixed per installation).
IE = Set of Information Elements (as defined for the type of ASDU specified in
the T field).
TT = Time Tag of Information Object (if specified for the type of ASDU specified in
the T field).

USING THE PROTOCOL

The protocol is mainly concerned with standardising provisions so that different

suppliers of stations can agree a common set of provisions for a particular telecontrol
installation, to ensure station interoperability.

The parameters associated with the Link layer interface within stations are not defined
explicitly in the standard, because the standard is not concerned with standardising the
structure of the software used to run the communication protocol.

The standard permits the user of the telecontrol installation to specify/choose his own
system strategy for using the protocol provisions in ways that solve his system problems
and adhere to his economic, practical and technical constraints.

For example if economic considerations dictate that some or all outstations timeshare a
multi-drop party line, it is necessary for the central station to have a suitable outstation
data polling process. Such a polling process would reside at the Application level.
However, no detailed polling process is defined in the standard because it has no peer to
peer communication of its own with the outstations. It merely controls the sequence in
which the standard Link functions are used to acquire any Application data that is
waiting for transfer to the central station.

At the end of the standard there is a checklist to enable all parties concerned with an
installation to agree exactly which protocol provisions are to be used, to ensure
interoperability.
QUESTIONS AND ANSWERS ABOUT THE STANDARD

Q1. Why is the asynchronous FT1.2 frame format used rather than the more efficient
FT2 isochronous format also defined in the base standard
IEC 60870-5-1?
A1. It is generally agreed by both suppliers and users that it is worth some loss of
efficiency to be able to readily obtain industry standard hardware on which to run the
Link protocol. Unfortunately the FT2 frame format requires special hardware, which is
never likely to be made in large quantities and will therefore always be expensive and
difficult to obtain.

Q2. Why does the standard not use the ISO Abstract Syntax Notation (ASN.1) for
defining its ASDUs?
A2. At the time the ASDUs were being defined by the IEC, the only method of encoding
ASN.1-defined data units for transmission was by using the Basic Encoding Rule (BER).
This is very general and flexible but is very inefficient. A typical encoded ASDU would
use three to four times as many bits as are currently used. More recently the ISO has
introduced a Packed Encoding Rule (PER) which has the same order of efficiency as the
encoding used in the IEC 60870-5-101 standard. However the latter is now published
and has already been satisfactorily implemented by several suppliers, so it is too late to
change the encoding method used.

Q3. The standard states that there shall be no gaps between characters in the
transmitted frames. Is there any tolerance allowed?
A3. Yes. It has recently been proved that a small gap, of no more than one transmitted
bit duration, is permissible without any reduction in integrity.

Q4. Is it possible for a user or a supplier to specify a special ASDU of a type not listed
in the standard?
A4. Yes. The use of privately defined ASDUs is allowed, provided they have the same
general format as the standard ASDUs. The standard provides reserve codes for
compatible private use. The use of privately defined ASDUs should be made clearly
visible to all parties concerned with a particular installation. Because without such
visibility the required degree of interoperability may not be obtained.

Q5. Is it possible to use the IEC 60870-5-101 standard in installations where the user
wishes to use standard digital data networks (which do not have permanent direct
connections between stations)?
A5. This has recently become possible using a new standard called IEC 60870-5-104.
This will allow the Application layer of IEC 60870-5-101 protocol to be used with such
networks via an existing standard Transport interface.

FOOTNOTE

The author is prepared to attempt to answer any further questions readers may have
about the IEC 60870-5-101 standard.

AN INTRODUCTION TO THE INTEGRITY CONSIDERATIONS UNDERLYING THE IEC

60870-5-101 COMMUNICATION PROTOCOL
1. FOREWORD

An important aim of the IEC 60870-5-101 protocol is to provide a Link layer having a
very high data integrity, but which may be implemented using industry standard
hardware and simple software.

This report first describes in outline how the Link frame formats and associated
transmission rules provide the desired integrity (at least 4 bit errors required to produce
an undetectable bad frame). Then the necessary supporting features required from the
Physical layer are specified. Finally some of the implications of the high integrity are
discussed.

2. LINK FRAME INTEGRITY

The Link protocol uses variable length frames, fixed length frames and single character
transmissions. All frames consist of strings of data octets (8 bits); each octet is
transmitted as an eleven bit asynchronous start/stop character with even parity. The
data octets within characters are of three kinds.
• User data, which are frame user data octets.
• Control data, which are frame control data octets.
• Fixed data, which are specific fixed value data octets used as frame delimiters and for
single character transmissions.

2.1 Variable length frames

A variable length frame has two parts, namely a 4 character fixed length header followed
by a variable length body. Each frame is preceded by and succeeded by a period of idle
line (received as a continuous binary one state).

The frame header starts with a START-68Hex fixed data character, whose fixed 11 bit
pattern differs from idle line and from displaced versions of itself by at least 4 bits. This
means that at least 4 bit errors (each error being a zero bit received as a one or vice
versa) are required for the receiver to make a false start to the frame. See example 1
below.

START
TX Idle line 00001011011 Rest of header Body
RX (5 bit errors) Idle line 00001011011 Rest of header Body
Displaced START

The header contains two identical control data characters, the data value of each
specifies the length (number of user data characters) of the body. Because of the even
parity each length control character requires at least 2 bit errors to produce an
undetectable error in its received value and both received values must remain identical
for the indicated length to appear to be valid. This means that at least 4 bit errors are
required to produce a false value for the indicated length of the body. See example 2
below.

Length1 Length2
TX START 01001100011 01001100011 Rest of header Body
RX (4 bit errors) START 01010100011 01010100011 Rest of header Body

The header ends with a second START-68Hex fixed data character. Assuming that the
header of a received frame has not made a false start (see above) it is still possible for the
second length control character to be pushed late into the second START character at
the end of the header. This could occur, due to a 1 bit error in the start bit position of
the first of the length control characters causing that zero bit to be received as a one and
making the character start late (when the next zero bit is received). Once started the
asynchronous receiver will run for 11 bit times before stopping and waiting to be
restarted.

Due to the character strings in frames being transmitted without idle line between
characters (according to transmission rule R3) one character starting late will make the
following characters in the string also start late.

If the second length control character is pushed late by 7 bit positions, the pattern of the
transmitted second START-68Hex character is such that it only requires one extra bit
error to make the first character of the body be received as the end of header character.

The first character of user data in the body might happen to be equal to START-68Hex. If
this is the case a false header would have been received as a result of only 2 bit errors.
However both received length control characters must be identical for this to escape
detection.

If both length control characters happen to have ones in their first six data bit positions,
then the seven-bit position shift, described above, could occur. When received both
length control characters must be identical, which requires at least another 4 bit errors
to occur.

As a result a total of at least 6 bit errors must have occurred for the receiver to indicate
a false length for the body. See example 3 below.

| length1 | length2 | START |

TX START 011111100010111111000100001011011 Body
RX (6 bit errors) START 111111100010000101000100001011111 START
|idle line| length1 | length2 | idle|
line

Each transmitted control character always contains at least 2 zero bits. These are the
start bit and at least one data or parity bit (due to the even parity). Thus it requires at
least 4 bit errors to make both length control characters disappear (become idle line).
The second START-68Hex fixed data character plus the first two characters of the body
would then be received as the last three characters of a false header. See example 4
below.

Length1 Length2
TX START 01110111111 01110111111 START Body
RX (4 bit errors) START 11111111111 11111111111 Length1 Length2 START
Idle line

Interim Conclusion (1): it requires at least 4 bit errors due to any of the above causes
to generate an undetectable corrupt header indicating a false body length.

The frame body of a variable length frame contains the number of characters indicated
by the header length control characters plus a check sum control character and an END
fixed data character delimiter, followed by idle line.
Thus the receiver knows from the indicated length exactly which character in the body
should be the END character. Any character in the body starting late (due to a start bit
error) will, because of Transmission Rule R3, push all the subsequent characters
including the END character late, into the following idle line period.

The END character differs from idle line and shifted late versions of it by at least 4 bits.
So it would require at least 5 bit errors for this shift to be undetectable by the receiver.
See example 5 below.

END
TX Body (L characters) Check Sum 00110100011 Idle line
RX (7 bit errors) Body 1110. . . Body Check Sum 00110100011
| A late start to shifted END
a character

All the characters in the body have even parity, so it requires at least 2 bit errors to
receive an undetectable false character. It also requires at least two undetected false
user data or check sum control characters, so as to produce an undetectable sum check
error. Thus it requires at least 4 bit errors for a body containing undetectable errors to
be received. See example 6 below.

Character n Character n+1

TX Body 01010100101 00111000011 Body Check Sum END
RX (4 bit errors) Body 00010100111 01111000001 Body same Check Sum END

Interim Conclusion (2): thus it requires at least 4 bit errors in a received body for this
to be undetectable.

Conclusion: having regard for the two interim conclusions above, it requires
at least 4 bit errors to occur somewhere in a received variable length frame for this
corruption to be undetectable. The specified variable length frame therefore has the
required integrity.

2.2 Fixed length frames

A fixed length frame starts with a START-10Hex fixed data character, preceded by a
period of idle line. This character differs from idle line, displaced versions of itself and
the START-68Hex character (and displaced versions thereof) by at least 4 bits. It
therefore requires at least 4 bit errors for the frame to make a false start or be confused
with a variable length frame, see example 7 below.

START 10Hex
TX Idle line 00000100011 Rest of frame
RX (7 bit errors) Idle line 11100000100011 Rest of frame
|Idle| START |
line 10Hex
RX (5 bit errors) idle line 11100001011011 false variable length frame
|Idle| START |
line 68Hex

The frame contains a fixed number of user data characters (specified by a system
parameter chosen to suit the particular installation) plus a check sum control character
and an END fixed data character delimiter, followed by idle line.
Apart from the start, a fixed length frame has the same format as the body of a variable
length frame. So, as described above for the body of a variable length frame, it requires
at least 5 bit errors for an undetectable shift to the END character to occur and at least
4 bit errors for the contents of the frame to contain undetectable errors. Thus the
specified fixed length frame has the required integrity.

2.3 Single character transmissions

In addition to the variable and fixed length frames considered above, a single character
E5Hex preceded and succeeded by idle line may be transmitted when required by the
Link protocol.

This character differs from both START-68Hex and Start-10Hex (and displaced versions
of them) by at least 4bits. Thus it cannot be confused with either START character
unless at least 4 bit errors occur. See example 8 below.

Single character
E5Hex
TX Idle line 01010011111 Idle line

| START | Start of false character

68 Hexes
RX (5 bit errors) Idle line 000010110110

| START | Start of false character

10 Hex
RX (5 bit errors) Idle line 000001000110

2.4 Other integrity considerations

The IEC 60870-5-101 Link protocol uses frame type FT 1.2 and its associated
transmission rule R3, as defined in the base standard IEC 60870-5-1. Addendum A2 to
IEC 60870-5-101 now permits transmission Rule 3 to be slightly relaxed, allowing a very
short period of idle line between transmitted characters.

This idle line period is strictly limited to no more than the duration of a single
transmitted bit. It does not reduce frame integrity, as shown below.

Because characters are received asynchronously, a period of idle line between characters
has no effect on the normal operation of the receiver.

If one of the characters starts late (due to its zero start bit being received as a one) all
subsequent characters will still start late (as described in section 2.1 above) unless a
“critical” late character is reached. A critical late character is one whose stop bit position
is delayed by exactly one bit time, so that the idle line between it and the next character
acts as its stop bit.

Start bit Stop bit idle line bit

| ||
TX 00xxxxxxxx11

RX 0xxxxxxxx11 critical late character

| |
Late Start Bit Late stop bit
All characters after such a critical late character will then be received in their correct
positions and the END character will not be pushed late. However, the parity check on
the received critical late character will fail because its contents (octet + parity
bit) have gained a one (the original stop bit) and lost a zero (the original bit 1 of the
octet). Thus the received character, and hence the frame, will be rejected. But a second
bit error could cause the parity check to become correct again. The resulting received
character would however cause the frame Sum check to fail. It would then require at
least two further bit errors in the frame (making a total of at least 4 bit errors) to make
the Sum check correct again without further parity or stop bit errors.

Another critical situation could arise if the single bit of idle line in front of a character is
received as a zero. This would cause a critical early character (starting one bit early) to
be received, but subsequent characters will be received in their correct positions.

Idle line Start bit Stop bit

bit|| |
TX 10xxxxxxxxx1
|Parity bit

RX 00xxxxxxxxx1 critical early character

| |
Early Start bit Early Stop bit

However if the transmitted parity bit is a zero, this will cause a zero early stop bit to be
received, which will be detected (should be a one) and cause the character and hence the
frame to be rejected. But a second bit error could make the early stop bit into a one. The
resulting early character would however cause the frame Sum check to fail. It would
then require at least two further bit errors in the frame (making a total of at least 4 bit
errors) to make the Sum check correct again without further parity or stop bit errors.

If the transmitted parity bit is a one, the received early stop bit will be correct (a one).
But the received contents (octet + parity bit) will have lost a one (the original parity bit)
and gained a zero (the original start bit). Thus the parity check on the received early
character will fail and the character and hence the frame will be rejected. But a second
bit error could cause the parity check to become correct again. The resulting received
character would however cause the frame Sum check to fail. It would then require at
least two further bit errors in the frame (making a total of at least 4 bit errors) to make
the Sum check correct without further parity or stop bit errors.

NOTE:

Sections 2.1 to 2.4 above give a simplified explanation of Frame integrity. As such they
are not fully rigorous. For example no proof is given that the END character differs from
idle line and shifted versions of itself by at least 4 bits. Nor is it mentioned that the
occurrence of certain critical characters may not be detected (by failure of the receiver
Sum check) when only two bit errors have occurred, because the received value of the
data octet of these particular characters is the same as the transmitted value and
consequently the integrity of the received frame is not reduced.

All the various integrity considerations outlined in this paper are fully proved for all
situations in the Informative Annex of Addendum A2 to IEC 60870-5-101.
3. PHYSICAL LAYER REQUIREMENTS

Probably the most important Physical layer feature needed to support the correct
operation of the Link layer is the requirement that the modulation/coding of the Physical
layer MODEM shall be memory less. This means that if any bit errors occur within the
Physical layer during transmission of a frame then each error bit shall be presented to
the receiver in the Link layer only once. Otherwise the number of errors in the received
Link level frame would be increased (reducing the integrity if not detected).

Now MODEMS running at speeds over 1200 bits/sec need to operate synchronously and
therefore contain scramblers to avoid the signal on the transmission medium containing
long periods without any changes (which could lead to loss of synchronisation.).

Unfortunately these scramblers have memory, so that bit errors occurring at any point
in a received frame will be presented to the Link receiver as they occur and again
(usually more than once) a fixed number of bit positions later.

Whether these extra bit errors can be detected, by the standard frame checking
procedures (Parity and Sum check) depends on the fixed number of bit positions
involved.

An investigation has been carried out to determine which CCITT/ITU standard MODEMs
(with scramblers) can be used in conjunction with Link frame type FT1.2 with no
reduction in integrity due to memory of bit errors or to the modulation method used.

The following MODEMs may be used because they do not reduce integrity:
V22, V22bis, V27, V27bis, V27ter, V29, V32, V33 (this list is not exhaustive).

The following MODEM reduces integrity from hamming distance 4 to 3 (that is only 3 bit
errors in the received data could cause an undetectable error): V26ter.

For transmission speeds up to 1200 bits/sec: FSK modulation and MODEM V23 may be
used. These are memory less, needing no scramblers and no assembly of successive bits
into packets during modulation to work in asynchronous mode.

For transmission speeds in excess of 9600 bits/sec synchronous digital signal

multiplexers may be used.

4. SOME IMPLICATIONS OF THE HIGH LINK FRAME INTEGRITY

It is particularly important for Telecontrol systems to have high transmission integrity

because undetected errors could lead to expensive shut down of vital electric power
systems.

The Link frame integrity conforms with IEC integrity class I2, which gives for example
one chance in 1010 of an undetected error when the bit error rate at the Physical level is
one bit error per 104 bits received.

It should be noted that this integrity is quite independent of the values of the user data
carried by the frame and does not rely on any Link user functions. Indeed the overall
system integrity is often improved still further by the use of Application level procedures
such as Select-Check-Execute for vital Telecontrol commands.
A REVIEW OF THE APPLICATION FUNCTIONS PROVIDED BY THE
IEC 60870-5-101 TELECONTROL PROTOCOL STANDARD

1. FOREWORD

A general introduction to the protocol is given in GBC Report 011, it is recommended

that this is read first so as to become familiar with the protocol structure, its purpose
and the terms used to describe it.

The present report reviews many of the Application functions, which are provided by the
protocol to perform basic telecontrol tasks for distributed electric power systems in a
standard way. It includes some provisional information obtained from addendum A2 to
the standard, presently under consideration by the IEC.

An assortment of functions is defined in the standard, from which selections may be

made to suit the requirements of individual installations of telecontrol
Controlling/Controlled stations.

2. STATION INTERROGATION

After the central Controlling station and the various Controlled stations (outstations)
have been initialised (made active). It is necessary for the Controlling station to obtain an
image of the present states of all those digital (on/off) inputs, which are normally
reported spontaneously and all the values of the analogue (process variable) inputs,
which are similarly reported. To do this, a Station Interrogation activation command may
be sent to all outstations, requesting that they return all their designated station
interrogation data as soon as possible.

When these data have been acquired, the Controlling station may construct an image
(called the Network Image in addendum A2) of all the inputs to the installation, which
are normally reported spontaneously. This image is then used as the starting point for
future operations.

If, at a later time, communication with a particular outstation is lost and then restored
(after whatever period), a station Interrogation may be used to obtain a static update of
the part of the network image belonging to just that outstation.

3. ACQUISITION OF EVENTS

Once the network image has been constructed, using the static data obtained from
Station Interrogation, the image must be kept up to date with dynamic data obtained by
the Acquisition of Events function, when changes take place.

This dynamic data is usually vital input information, which is likely to require quick
action at the Controlling station. For example if an important switch, within the process
equipment of the electric power system, changes state: then the outstation Application
layer presents a Request ASDU to its Link layer.

In due course the Link layer of the central Controlling station will generate an Indication
to its Application layer, presenting the received ASDU. The ASDU will be marked with
Cause of Transmission = Spontaneous, which prompts the Application layer immediately
to update the appropriate point in the network image. As a result other urgent
operations may take place, for example an Alert may be signalled.
Optional double transmission of spontaneous events is permitted when desired. The first
transmission is as described above. A second lower priority transmission of the same
events, with an added Time Tag, may be used to construct a central event record. This
may be analysed to determine the exact sequence in which events occurred.

4. BACKGROUND SCAN

This function (which is a slow cyclic scan) may be used to ensure that the network image
values are up to date and have not been falsified by the undetected loss of
spontaneously reported events since the last scan cycle.

5. CYCLIC TRANSMISSION

This function may be used to continuously update another central image with
information data obtained from measurements taken at regular intervals of time. It is
often used for monitoring the less vital inputs to an installation; that is those which are
slow moving or do not require fast action at the Controlling station. For example the
temperature of a piece of process equipment (such as a transformer) might be monitored
using Cyclic Transmission.

The ASDUs received by the Controlling station would be marked with Cause of
Transmission = Periodic/Cyclic which would prompt relatively leisurely actions including
the updating of the appropriate point(s) in the central image possibly followed by the
cyclic updating of a display to the operator.

6. TRANSMISSION OF INTEGRATED TOTALS

Extra detail has been added to the definition of this function in addendum A2.

Integrated totals (such as Kilowatt-hours) are accumulated in counters, which may be

read by outstations. The accumulating total in a counter may be sampled (on the fly)
using a freeze command. After which the total may continue to accumulate (for
integrated totals information) or start accumulating again from zero (for incremental
information) by using a reset command.

Four modes of operation are provided.

In Mode A: the freeze and reset (if required) commands are derived from time signals
from the outstation local clock. The resulting integrated totals or incremental
information are transmitted to the Controlling station in ASDUs with Cause of
Transmission = spontaneous, with or without a time tag.
Mode B is the same as mode A except that ASDUs to be transmitted are held at the
outstation until they are requested by a counter interrogation command from the
Controlling station. The responding ASDUs from the outstation have Cause of
Transmission = Requested by counter interrogation.

In Mode C Counter interrogation commands are sent periodically to outstations

requesting integrated totals/incremental information. The freeze and reset at the
outstation are controlled by command settings within these interrogation commands
(not by signals from the local clock). Several combinations of settings are permitted.
Further Counter interrogation commands are then sent to collect the totals/incremental
information, the responding ASDUs have Cause of Transmission = Requested by counter
interrogation.
Mode D is a combination of modes C and A, in which the freeze and reset at the
outstation are controlled by Counter interrogation command settings sent from the
Controlling station. But the resulting totals/incremental information is returned
spontaneously.

7. COMMAND TRANSMISSION

ASDUs containing Commands are sent from the Controlling station to the outstations
when required. There are two main kinds of Commands: those for process information
and those for system information.

Process information commands include those for changing the state of single digital
(on/off) outputs, step (raise/lower) outputs and set point (analogue) outputs. Two modes
of operation are provided: Direct (immediate) execution and Select/Execute, where the
selection ASDU is confirmed back to the Controlling station before the actual execution
ASDU is sent.

System information commands include Station Interrogation command (see section 2

above), Counter Interrogation command (see section 6 above), Clock Synchronisation
command (see section 10 below), all of which are confirmed back to the Controlling
station.

8. FILE TRANSFER

In general files are held in the part of a system where they are generated. For example
within an electric power substation: disturbance data could be held in the protection
equipment (sometimes with a copy in the substation automation equipment); event
records could be held in the automation equipment or in the telecontrol outstation itself.

To enable efficient file transfer, files may be addressed using a Directory, which contains
file names or the names of Subdirectories, which in turn contain file names.

The Controlling station may request a Directory or Subdirectory from an outstation, to

inform it what files are currently available for transfer. If the contents of a
Directory/Subdirectory change it may be transmitted spontaneously to the Controlling
station.

Disturbance data records contain data in a format, which is easily mapped onto the
format of the IEC 60870-5-103 Informative Interface for protection equipment. Thus
data can be obtained readily from equipment using this interface, but it does not restrict
systems to using such equipment.

Event records available from an outstation may be used instead of (or in addition to) the
central event record described in the last paragraph of section 3 above.

Files may also be transferred from the Controlling station to an outstation.

9. PARAMETER LOADING

Parameters, such as the threshold (minimum change needed) for reporting an analogue
input or the High or Low limit for reporting an analogue input etc, are defined as
Information Objects. Their Information Object Addresses may be related to those of their
associated inputs in ways chosen to suit particular installations.
10. CLOCK SYNCHRONISATION

In order to ensure accurate time tags, it is necessary for the clocks in all the outstations
to be synchronised to the clock in the Controlling station. The protocol provides facilities
for this to be done, using the Clock Synchronisation function.

Outstation clocks may be synchronised periodically, at intervals which ensure that no

clock drifts out of synchronisation by more than a chosen amount, corresponding to the
time tag accuracy required.

The Synchronisation command contains the time at which its first bit is transmitted
(according to the clock in the Controlling station). When the ASDU is received it is used
to reset the outstation clock. An allowance for the transmission delay time of the
command message can be made after reception in the outstation.

The command is acknowledged by the outstation returning a Time message containing

the time registered by the outstation clock just before being reset (minus the value of the
transmission delay time). The transmission of this time message may be delayed until
after any waiting time tagged messages (tagged before the clock was reset) have been
transmitted to the Controlling station.

The Time message may be transmitted spontaneously when required. For example to
indicate the change of hour at an outstation, when short time tags (containing only ms
to minutes) are being used. Thus avoiding ambiguity if such messages are stored for over
one hour before being transmitted.

10.1 Acquisition of transmission delay

This function may be used to obtain the value of the transmission delay to be used when
making allowance for it during the reset of an outstation clock, mentioned in section 10
above.

Note: If constancy of transmission delay cannot be guaranteed in a particular

installation, then the Clock Synchronisation function should not be used and
outstations will require radio controlled or other independent clocks having the required
accuracy.

11. REVERSE DIRECTION

In standard operation, Commands are sent from the Controlling station to a Controlled
station and Events/Measurements are sent from a Controlled station to the Controlling
station.

In some installations it may be advantageous to have dual mode operation between two
equal stations, so that both Commands and Events/Measurements may be sent in both
directions. This may be done using “Standard operation” and
“Reverse operation” via a common Link layer.

Individual Application functions and associated ASDUs may be chosen for

Standard operational use, Reverse operational use or for both uses.
12. FOOT NOTE

This report does not cover every Application function in the standard. In particular Data
Acquisition by Polling has not been mentioned until now, because it is only a
management function (used with a Link layer operating in unbalanced mode). It does not
add any Application functionality to what has been described already. See GBC Report
011, section 7, paragraph 4.

SOME EXAMPLES OF THE USE OF IEC 60870-5-101 PROTOCOL STANDARD

1. INTRODUCTION

The IEC 60870-5-101 standard defines a communication protocol for telecontrol

installations. It deliberately does not standardise other aspects of such installations.

Nevertheless it may be helpful to illustrate, by way of examples, the sort of equipment

that the protocol could support and how it may be tailored to suit a variety of uses
whilst remaining interoperable.

The author does not intend to extend or modify the protocol standard in any way and
the examples given do not represent an attempt to standardise the wider aspects of
telecontrol equipment.

2. TELECONTROL OUTSTATIONS

The following diagram shows an example of a telecontrol outstation being used to control
and monitor an electric power substation. The substation may or may not have some
substation automation equipment to provide a degree of local autonomous control and
internal intercommunication between items of plant equipment.

STANDARD PROTOCOL
Measured
Variables Monitor direction Control direction

Spontaneous
Digital changes
Substation
(Events)
OUTSTATION Automation
Equipment

Integrated Total
Counters

Protection
Equipment
Internal
Controls

Intercommunication

Highway(s)
The protocol standard offers appropriate Application functions and ASDUs to enable the
communication of all the input/output data needed for this example.

3. PRIORITY OF DATA SENT IN THE MONITOR DIRECTION

The standard offers an outstation two classes of data for returning data in the monitor
direction. Class 1 is generally for high priority data to be returned urgently. Class 2 is for
lower priority data to be returned less urgently. Data with different causes of
transmission may be assigned to the two classes as required to ensure that an
outstation responds in an efficient way.

For example:
Cause of Transmission = Spontaneous, assigned to Class 1
Cause of Transmission = Cyclic/Periodic, assigned to Class 2
Cause of Transmission = Requested, assigned to Class 1
Cause of Transmission = Interrogated, assigned to Class 1
Cause of Transmission = Background scan, assigned to Class 2

When a balanced Link is used, each outstation has its own dedicated channel to send
data in the monitor direction and transmits this data spontaneously, without requiring a
poll request. The Priority Control Manager is solely responsible for determining the order
of transmission of data to the controlling station.

When an unbalanced Link layer is used, a number of outstations share a common

channel. The central Controlling station then manages the collection of data (in the
monitor direction) from each outstation Transmission buffer in turn, ensuring that each
outstation is given a fair opportunity to return its data.

In general this is done by the Controlling station polling successive outstations for Class
2 data, interleaving the polling of Class 1 data if there is any waiting. An outstation may
return Class 1 data when polled for Class 2 data if there is no Class 2 data available (at
the time of polling). This prevents wasting some Class 2 polls and thus improves the
overall polling efficiency.

If a particular outstation has a large quantity of Class 1 data waiting in its Transmission
buffer, it may be advisable to limit the number of consecutive Class 1 polls allowed to
that outstation before polling the next outstation. Thus avoiding an undue delay to the
sending of data by other stations.

4. DATA SENT IN THE CONTROL DIRECTION

A Command may be sent in the control direction when it is available in the Application
layer of the central Controlling station and when the Link layer is available to send it.

The protocol defines the ASDUs and Application Functions provided for this purpose.
However the protocol does not define in detail the actual Application Processes that are
supported by the transmission of Commands.

For example, an outstation may have an Application Process for the Control of items of
operational equipment such as two states ON/OFF switches etc. This may be a two stage
“Select/Execute” Process, enabling a human operator at the Controlling station to:
a) Select a desired point ready to perform a specified operation.
b) Obtain confirmation that his selection has taken place.
c) Then, at his discretion request that the operation be executed.

In practice the Select/Execute Application Process at the outstation will probably permit
only one point at a time to be selected awaiting execution. The Process mechanism will
therefore remain busy after a Selection until an Execute command or a Select-
deactivation command is received.

Any attempt to make a new selection, when the Process mechanism is busy, will fail and
cause a Select-negative-activation-confirmation to be returned in the monitor direction.

If for any reason an Execute command is sent to a point that has not already been
selected ready to perform the specified operation, it will fail, clear the Process busy state
(if set) and return an Execute-negative-activation-confirmation in the monitor direction.
The Process will then be ready to perform a new Select/Execute sequence.

After a successful Select/Execute sequence or after a successful

Select-deactivation the Process will also be left in the ready state.

5. LATERAL COMMUNICATION BETWEEN STATIONS OF EQUAL RANK

In some installations it may be required to send the values of certain Measured

Variables (for example) to other outstations, as well as or instead of, to the central
Controlling station. This may be done, by declaring these ASDUs to use the “Reverse
Direction mode” of transmission.
The central Controlling station, acting as a data concentrator, may then relay the ASDUs
in the Reverse direction from the central station to the required destination outstation(s).
Similarly Events and Commands may be sent in the Reverse direction if required.

6. FOOTNOTE

At the present date (see the date of this report), IEC 60870-5-101 protocol standard is
available as a published standard.

Addendum A1 adds a number of ASDUs with long time tags (including Hour, Day,
Month and Year) to the standard. This is a draft, which has been approved for
publication as a standard. At the present date it is not yet available as a published
standard.

Addendum A2 adds some important detail to the standard, including Link layer State
Diagrams, detailed use of File transfers, extra modes for collecting Integrated Totals,
some extra ASDUs and details of outstation data priority management. It also has an
informative annex proving the integrity of the Link frames used in the standard. This is a
draft, which is ready for approval to be published as a standard. At the present date it is
not yet available as a published standard.

For the latest information regarding the publication status of these standards, please
ask your National Standards Organisation.
AN INTRODUCTION TO IEC 60870-5-104, A STANDARD FOR THE TELECONTROL
OF ELECTRIC POWER TRANSMISSION SYSTEMS, USING INTERNET
COMMUNICATION SERVICES

1. FOREWORD

IEC 60870-5-101 is an International Communications Protocol Standard for the

Telecontrol of Electric Power transmission systems, which is being widely adopted in
many countries throughout the world.

The standard specifies the use of permanent directly connected Links between
Telecontrol stations. Dedicated base band cables, Power Line Carrier or Radio may be
used for Analogue channel communication or direct digital links may be used.

There is now a growing desire to use the 60870 Standard to communicate between
Telecontrol stations via Internet services. A new Companion Standard called IEC 60870-
5-104 has been published by the IEC for this purpose.

The present paper assumes that the reader is broadly familiar with
IEC 60870-5-101 and explains the principal differences that are being introduced to
enable “101” Application messages to be transported via Internet services.

2. SIGNIFICANT CHARACTERISTICS OF INTERNET COMMUNICATION WITH

RESPECT TO ITS USE FOR TELECONTROL

The time taken for a Telecontrol message to be transported by the Internet from one
Telecontrol station to another is variable and is often significantly longer than the time
taken for transportation using the directly connected Links defined in the “101”
standard. The time taken depends on the amount of traffic (other messages) being
carried by the interconnected networks at the time the Telecontrol message is sent.

3. THE INTRODUCTION OF AN INTERNET TRANSPORT INTERFACE

Every Telecontrol station conforming to the IEC 60870-5-104 standard has an Internet
Transport Interface between its Application layer and the layers below. The interface and
the lower layers are defined by the appropriate Internet standards. These include the
Transmission Control Protocol (TCP), according to RFC 793, for the Transport layer
immediately below the Transport Interface.

4. THE ADDITION OF APCI TO THE APPLICATION LAYER

Some Application Protocol Control Information (APCI) is added to each Application

Service Data Unit (ASDU) so as to obtain an Application Protocol Data Unit (APDU) that
is suitable for Internet transportation.

The APCI includes a copy of some of the control information fields used by the Packet
layer of the X25 protocol (according to ISO/IEC 8208). The associated control procedures
are also copies of those used by X25.

The purpose of the APCI and associated procedures is to ensure that Application
messages, each consisting of an individual APDU, are not lost or duplicated. It also
enables message transfers to be started/stopped and supervises Transport connections.
The APCI starts with a fixed octet (value = 68 Hex) followed by an octet specifying the
length of the rest of the APDU, including the ASDU when present. Some messages are
used for control purposes only and do not include an ASDU.

5. BLOCK DIAGRAM OF TWO STATIONS USING IEC 60870-5-104 PROTOCOL

APPLICATION APPLICATION
LAYER LAYER
AS DEFINED IN AS DEFINED IN
IEC 60870-5-101 IEC 60870-5-101

APCI APCI

INTERNET
INTERNET
TRANSPORT
TRANSPORT
INTERFACE
INTERFACE
TCP
TCP
TRANSMISSION
CONTROL PROTOCOL
TRANSMIS
IP IP
INTERNET INTERNET
PROTOCOL PROTOCOL

INTERNET

All items shown in blue are defined according to standard Internet Transport
specifications.

SEE PAGE 5 FOR A DETAILED PICTURE OF THE INTERNET ADDRESSING

6. APPLICATION FUNCTIONS AND ASSOCIATED ASDUs SUPPORTED BY TCP

SERVICES

The following Application Functions and associated ASDUs are supported by the TCP
services.

• Station Initialisation
• Read data
• Cyclic data transmission (see below)
• Acquisition of Events (see below)
• General Interrogation
• Clock Synchronisation (see below)
• Command transmission (see below)
• Transmission of Integrated Totals
• Parameter loading
• Test procedure
• File transfer

7. THE REMOVAL OF DATA ACQUISITION BY POLLING FROM THE

 APPLICATION FUNCTIONS

Data Acquisition by Polling relies on the Request for User data class 1 & class 2 Link
functions defined in IEC 60870-5-2. These functions are not available when using the
“104” protocol, because all layers below the Transport Interface are defined by Internet
standards, which do not provide them.

8. CYCLIC DATA TRANSMISSION

This function should be used with care, taking due regard of the relatively long
Transportation times likely to be encountered when using the Internet. Too many APDUs
of this type per second may cause queues of Telecontrol data to form, potentially
delaying more important Telecontrol messages.

9. ACQUISITION OF EVENTS

Event ASDUs that are tagged with their time of occurrence use the long Time Tag (ms to
years) as defined in the latest edition of IEC 60870-5-101. This ensures there can be no
ambiguity about the time of occurrence (uncertainty as to the hour involved) due to any
long transmission delays introduced by the Internet services.

10. CLOCK SYNCHRONISATION

Accurate Clock Synchronisation in an outstation depends on knowing the time taken to

transmit a Telecontrol message to it from the central Controlling station containing the
master clock. This permits an allowance to be made for the transmission time during
synchronisation. When using the Internet, there is a variable delay before a transmitted
message arrives at an outstation. This causes a time uncertainty that depends on the
maximum transmission time offered by the Internet service provider.

The resulting clock synchronisation setting is unlikely to be more accurate than within
one second. Thus individual radio clocks, or other accurate clocks, will be required at
each outstation when time tags having a better accuracy than this are required.

11. COMMAND TRANSMISSION

When using the Internet, it is sometimes possible for a Command message to an

outstation to be seriously delayed. The “104” protocol offers Time Tagged Command
ASDUs so that the receiving outstation can check the time they were sent and
potentially ignore any Commands that are “dangerously” late.

12. FOOTNOTE

The picture on page 5 shows details of the Internet Addressing.

All the stations in an IEC 60870-5-104 Installation are interconnected via a Local Area
Network (LAN) shown in blue. This network is regarded as “local” to the Installation,
even though it may be geographically distributed over a wide area.

The LAN contains a Router for each station, to which it is connected via a LAN “Port”.

The Routers are interconnected via a Wide Area Network (WAN) shown in green. Each
access point (Router to WAN) has a unique “IP Address”.
Virtual Connections (shown in red) may be set up between the Controlling station’s
Transmission Control Protocol (TCP), acting as a Client, and individual Controlled
stations’ TCPs acting as Servers.

The Address at each end of a Virtual Connection consists of a combination of the local
station’s IP Address and the Port Number. The Port Number for all Server stations in an
IEC 60870-5-104 LAN is officially allocated as 2404. The Port Numbers for the Client
station are allocated from a pool of reusable numbers held by the TCP of that station.
There are typically a few thousand numbers in the pool, starting at 1024. A new Port
Number from the pool is used for each new Connection as it is established. The Number
is returned to the pool when the Connection is closed.

CONTROLLING STATION A (CLIENT)

APPLICATION
101

TRANSPORT INTERFACE TCP ADDRESSES = (A), 1024

TCP/IP = (A), 1025

PORT Nos = (1024) and (1025) for example

ROUTER

IP ADDRESS
= (A)

ROUTER ROUTER
IP ADDRESS WAN IP ADDRESS
=(B1) =(B2)
IP

LAN

PORT No = (2404) PORT No = (2404)

VIRTUAL CONNECTIONS
(A),1024  (B1), 2404 (A),1025  (B2), 2404

TCP/IP TCP/IP

TCP ADDRESSES =
(B1),2404 (B2),2404
APPLICATION APPLICATION
101 101
CONTROLLED STATION B1 (SERVER) CONTROLLED STATION B2 (SERVER)

REMARKS TO IMPLEMENTERS OF THE IEC 60870-5-101 PROTOCOL

1. INTRODUCTION

These remarks are intended to help implementers of the protocol appreciate some of its
characteristics and requirements more fully and hence achieve better implementations
for their products.

2. THE IMPORTANCE OF MESSAGE EFFICIENCY

The IEC 60870-5-101 Protocol is often used for transferring messages between stations
that are directly connected to one another by narrow-band (voice frequency) analogue
communication channels.

On such channels, the time taken to transfer a message depends mainly on the length of
the message (the number of bits it contains) and the rate at which the bits are
transmitted (bits per second).

This is in contrast to the broadband channels used when messages are transferred by
Internet services. Here the high bit rate, that is possible, makes the time taken to
transmit the actual message short compared with the message queuing delays, that may
be experienced in the various intermediate network nodes between user stations.

Thus, for narrow-band channels, message efficiency (the ratio of useful information bits
to the total number of bits in a message) is of prime importance; so as to minimise the
numbers of bits and hence reduce the transfer times of messages. The “101” protocol
has been defined to provide a good efficiency, consistent with providing high data
integrity and using readily available hardware (for example a “UART” for receiving and
transmitting characters).

3. STATION LINK LEVEL PROCESSING TIMES

The time taken to process message data at the Link level of user stations is important for
several reasons, including the following.

In order to obtain high data integrity, the transmitting station must not allow periods of
idle line, longer than one bit, between the asynchronous characters in a message. Thus
the program responsible for feeding data octets to the transmitting UART must not be
held-up for any period that is significant compared with the transmission duration of
one 11-bit asynchronous character. Otherwise the transmit-buffer memory of the UART
may not contain the next character to be transmitted when it is required. This would
cause a period of idle line, until data is again available, which could well be longer than
one transmitted bit time.

The Link level of a Controlled station is expected to return a “Confirm” message after
receiving a “Send” message and to return a “Respond” message after receiving a
“Request” message. The time interval between receiving a message and returning the
appropriate Confirm or Respond message (the reaction time) must not be longer than a
designated length. Otherwise the Controlling station may time-out the message
exchange. Thus care is needed to avoid holding-up any Link level programs that could
lengthen the Controlled station’s reaction time unacceptably.

In general care is needed to ensure that all Link level programs (for example doing a
sum-check on an incoming message) can be performed well within the time required to
keep up with the rate of message transmission being used.

4. APPLICATION LEVEL MESSAGE MANAGEMENT

Application messages of all sorts are generated in the various application processes
within the station. The data for each message is generated at a particular time, which we
will call its “generation time”.

The data are then placed in queues according to their priority (which is a measure of the
urgency of transmission required). Each message type and associated “cause of
transmission” is assigned to a suitable priority level and each priority level may have its
own particular message queue.

In due course the data are extracted from the queues and placed in messages, which are
fed one at a time into a transmit-buffer memory. When the current message has been
transmitted, another message is fed into the buffer.

The program that feeds the transmit-buffer is responsible for the order in which the
messages are transmitted. For example the program may extract data for messages from
the highest priority queue until it is temporarily empty before extracting any message
data from a lower priority queue.

Message data are fed into the various queues in the order of their data generation times.
But care is needed to ensure that the messages are still in the correct chronological
order when they are transmitted.

For example the value of a particular point that is transmitted as a “Spontaneous”

message (an Event) will be transmitted with high priority. But it must not be transmitted
before the value of the same point, having an earlier generation time, is transmitted as a
“Background Scan” message (which is low priority).

Stations that have an unbalanced mode Link will have two transmit-buffer memories.
The first is for “Class 1” (high priority) messages and the second for “Class 2” (low
priority) messages.

The order in which Respond messages from these two buffers are transmitted is
managed by the Requesting station, which has the responsibility of acquiring messages
from all the stations sharing the common communication channel in an equitable way.

Thus extra care is needed to ensure that messages obtained from the Class 1 buffer
cannot overtake messages about the same point, having earlier generation times, from
the Class 2 buffer. This is the responsibility of the program feeding the two buffers, in
the Responding station. For example it could do this by ensuring that both the buffers
never contain messages about the same point at the same moment of time. Thus
avoiding giving the Requesting station the opportunity to acquire the two messages in
both possible orders (“1, 2” and”2, 1”).

5. MESSAGE PRIORITY IN THE RESPOND DIRECTION

After Initialisation all the Application functions in a Controlled station must be available
to run simultaneously. If several messages of different types are available for
transmission at the same time, they must be sent in the following order.

End of Initialisation (Class 1)

Command transmission (Class 1)
Event reporting/Clock sync/acquisition of transmission delay (Class 1)
Read /Test /Reset Process /Parameter loading (Either Class) x
Station Interrogation/Integrated totals (Either Class) y
Cyclic data/file transfer/background scans (Class 2)

NOTE: The Class of data to be used for Unbalanced Link responses is shown above in
brackets. “y” must not be a higher Class than “x”.

6. CONCLUSION

The Standard deliberately does not specify the detailed working of stations. Exactly how
the various issues, discussed in this paper, are handled is for the implementers to
decide.

For example, take the remark in (3) above. “The program responsible for feeding data
octets to the transmitting UART must not be held-up …”. This could be accomplished by
inhibiting program interrupts when this program is running. Or interrupts could be
limited to very short periods: they could just set a Flag indicating the work to be done
when the program has finished running.

Alternatively a subsidiary processor could be used, dedicated to running all programs

associated with the UART, in parallel with the operations of the main processor. The
subsidiary processor could be coupled to the main processor via an area of shared RAM
or by a short local interface highway (having any suitable protocol) etc. It is for the
implementers to decide.

FURTHER QUESTIONS AND ANSWERS ABOUT IEC 60870-5-101

This Report contains answers (An) to further questions (FQn) that have been asked on
the User Group Mail List iec60870-5@[Link].

FQ1. In view of the fact that a Controlled station rejects any COMMAND that it receives
when it is busy, should the Controlling station send a repeat of the COMMAND with the
same setting of the Link FCB after receiving a NACK (Link Busy) back from a Controlled
station?

A1. No it should not. The NACK CONFIRM is a valid reply, indicating that the original
COMMAND was received correctly (by the Controlled station).

The original COMMAND should only be repeated with the same setting of the Link FCB
after the Controlling station fails to receive a reply or receives a non-valid reply (such as
a Frame containing Parity bit or Sum Check errors).

FQ2. Does the Standard allow FILE TRANSFER to be used to send dynamically changing
Application Data, such as Send-On-Exception (SOE) Data, to the Controlling station as
soon as it becomes available?
A2. No it does not. The Standard already provides a method for sending event data
spontaneously (as the events occur) to the Controlling station. The standard method of
reporting SPONTANEOUS EVENTS carefully preserves the chronological order of these
events.

FILE TRANSFER is intended for sending Records of past events (or Files of other static
non-changing Data), which have been compiled locally within the station. The Records
are sent at a convenient point in Time after they have been compiled.

Thus the chronological order of a mixture of Events reported by FILE TRANSFER and as
SPONTANEOUS EVENTS would not necessarily be correct.

The Records of past events reported by FILE TRANDFER are typically used for the Post
Mortem analysis of multi-event occurrences. The Records must not be used directly for
dynamic moment to moment Control and Monitoring of a Process Plant.

FQ3. The Standard states that the Link layer of a Controlled station is Reset (during
Initialisation) to expect the Link FCB of the first message (with FCV=1), received after
Reset, to be set to ONE (1). What should the Controlled station reply if the FCB of the
first message, received after Reset, is set to ZERO (0)?

A3. Such a situation could only occur if there is a fault in the operation of the
Controlling station’s Link Transmission procedure.

The Controlled station should return a Reply message with the Link Function code=14,
this would indicate that the Link service is not functioning.
If Replies indicating that the Link service is not functioning are persistently received, an
Engineering Investigation would be needed to determine the cause of the fault (which
could also be caused by some failure at the Controlled station end of the Link.

WHAT COMES AFTER IEC 60870-5-101 & IEC 60870-5-104?

1. THE FUTURE

During the coming years an increasing number of the Substations used in Electric
Power Transmission Systems will benefit by having more elaborate distributed
Automation equipment.

To standardise Communication for these more elaborately Automated Substations the

IEC has started work on defining a new suite of Standards, called IEC 61850.

The introduction of more extensively Automated Substations will be an evolutionary

process. In some situations new Power Transmission Systems with new highly
Automated Substations will be being built. In other situations existing Substations will
have their Automation extended or improved. Many situations (both existing and new)
will not require the more elaborate Automation supported by IEC 61850.

2. WHAT IS THE DIFFERENCE BETWEEN IEC 60870-5-101/104 AND

IEC 61850?

Whereas IEC 60870-5-101 and IEC 60870-5-104 both define the use of simple
Information Objects, consisting of an ADDRESS+VALUE+TIME TAG (Optional) for
individual single points in the Process Plant (Substation).
IEC 61850 defines more elaborate Information Objects, each relating to a complete piece
of equipment (multipoint entity) in the Process Plant (more elaborately Automated
Substation).

The IEC 61850 enables the various Automation functions to be broken down into
elementary functions, which may then be allocated to various pieces of electronic
Automation equipment distributed within the Substation and interconnected by
Substation Internal highways.

The transmission of messages, containing the more elaborate Information Objects,

between the central Controlling station and the remote Substations requires broadband
communication media, because each message contains more data than the simpler IEC
60870-5-101/104 messages.

Similarly broadband media are required for the Substation Internal highways.

3. CONSIDERATIONS THAT INFLUENCE THE INTRODUCTION AND USE OF

EQUIPMENT CONFORMING TO IEC 61850

For each particular situation, the following should be considered.

• Is there a need to have more elaborated Automation in the Substations?

• To what extent would IEC 61850 conforming equipment benefit the System?
• Will the necessary Broadband Communication paths be available?

4. CONCLUSION
In general the requirement to manufacture, maintain, and sometimes to gracefully
convert, equipment conforming to IEC 60870-5-101 and IEC 60870-5-104 will
continue for many years.