SYS600 - IEC 60870-5-104 Slave Protocol - 756654 - ENb

MicroSCADA Pro SYS 600 9.
3
IEC 60870-5-104 Slave Protocol
Trace back information:
Workspace Main version a10
Checked in 2012-11-12
1MRS756654 MicroSCADA Pro SYS 600 9.3
Issued: 31.3.2010 IEC 60870-5-104 Slave Protocol
Version: B/30.9.2012
Configuration Manual
Contents
1 Copyrights ............................................................................................. 5
2 Introduction ........................................................................................... 6
2.1 This manual .................................................................................. 6
2.2 Use of symbols ............................................................................. 6
2.3 Related documents ....................................................................... 7
2.4 Document revisions ...................................................................... 8
3 Safety information ................................................................................ 9

3.1 Backup copies .............................................................................. 9
3.2 Fatal errors ................................................................................... 9
4 Instructions ........................................................................................... 11
4.1 Communication ............................................................................. 11
4.2 Installation ..................................................................................... 11
4.3 Configuration ................................................................................ 11
4.3.1 Base system configuration .............................................. 11
4.3.2 Communication system configuration ............................. 12
4.3.2.1 IEC 60870-5-104 line layer ........................... 14
4.3.2.2 IEC 60870-5-104 station object .................... 21
4.3.2.3 File transfer attributes ................................... 38
4.4 After configuration ......................................................................... 46
4.5 How to test the configuration ........................................................ 46
5 Technical description ........................................................................... 47

5.1 IEC 60870-5-104 Protocol ............................................................ 47
5.2 Level of implementation ................................................................ 48
5.3 Supported process object types ................................................... 48
5.4 Communication ............................................................................. 48
5.4.1 Communication modes ................................................... 49
5.4.2 Protocol converter ........................................................... 49
5.4.3 Addressing ...................................................................... 49
5.4.4 Data flow ......................................................................... 50
5.4.5 Device communication attributes .................................... 52
5.5 Command procedures .................................................................. 62
5.5.1 Command procedures in COM 500i ............................... 62
5.5.2 Command procedures in SYS 600 ................................. 63
5.5.2.1 Command procedures for process data ........ 63
5.5.2.2 Command handling in IEC 60870-5-104
protocol ......................................................... 70
5.5.2.3 Command procedures for data commands .... 71
3
SYS 600 9.3 MicroSCADA Pro 1MRS756654

5.5.2.4 Command procedures for application

commands ..................................................... 75
5.5.2.5 Command procedures for system
commands ..................................................... 81
5.5.2.6 Command procedures for transparent data
commands ..................................................... 82
5.5.2.7 Command procedures for file transfer .......... 83
5.5.2.8 Command procedure for the end of
initialisation message .................................... 84
5.6 Command procedures for parameter in control direction ............. 84
5.7 Signal engineering ........................................................................ 86
5.8 Status codes ................................................................................. 86
5.9 Interoperability list ......................................................................... 87
5.9.1 Interoperability ................................................................ 87
5.9.1.1 System or device ........................................... 87
5.9.1.2 Network configuration ................................... 88
5.9.1.3 Physical layer ................................................ 88
5.9.1.4 Link layer ....................................................... 89
5.9.1.5 Application layer ............................................ 89
5.9.1.6 Basic application functions ............................ 96
Appendices
A Examples of communication system configuration ..........................102

Index .......................................................................................................105
4
1 Copyrights
The information in this document is subject to change without notice and should not be
construed as a commitment by ABB Oy. ABB Oy assumes no responsibility for any
errors that may appear in this document.
In no event shall ABB Oy be liable for direct, indirect, special, incidental or consequential
damages of any nature or kind arising from the use of this document, nor shall ABB Oy
be liable for incidental or consequential damages arising from the use of any software
or hardware described in this document.
This document and parts thereof must not be reproduced or copied without written
permission from ABB Oy, and the contents thereof must not be imparted to a third party
nor used for any unauthorized purpose.
The software or hardware described in this document is furnished under a license and
may be used, copied, or disclosed only in accordance with the terms of such license.
Copyright © 2012 ABB Oy. All rights reserved.
Trademarks
ABB is a registered trademark of ABB Group. All other brand or product names
mentioned in this document may be trademarks or registered trademarks of their respective
holders.
Guarantee
Please inquire about the terms of guarantee from your nearest ABB representative.
Third Party Copyright Notices
This software uses pugixml library (http://pugixml.org). pugixml is Copyright ©
2006-2012 Arseny Kapoulkine.
5

2 Introduction
2.1 This manual

This manual provides thorough information on the use of IEC 60870-5-104 Slave Protocol
and needed information related to it. It describes how to configure the base system and
the communication system to establish communication to IEC 60870-5-104 master.
In addition to this configuration, the base system needs to be configured for other
communication tasks, for example, process communication. For information about this
subject, see other manuals, for example, SYS 600 Application Objects and SYS 600
System Objects.

The IEC 60870-5-104 Slave protocol is mainly used for upper level communication
between SYS 600 and NCC as illustrated by Figure 2.1.
Figure 2.1: The IEC master sees the NET unit and the process behind it as a slave
The data from the process activates a certain event channel and a command procedure
in the base system. This command procedure sends the information forward to the NET
unit and the IEC master.
2.2 Use of symbols

This publication includes warning, caution and information symbols where appropriate
to point out safety-related or other important information. It also includes tips to point
out useful hints to the reader. The corresponding symbols should be interpreted as follows:
6
Warning icon indicates the presence of a hazard which could

! result in personal injury.
Caution icon indicates important information or a warning

related to the concept discussed in the text. It might indicate
the presence of a hazard, which could result in corruption of
software or damage to equipment/property.
Information icon alerts the reader to relevant factors and

conditions.
Tip icon indicates advice on, for example, how to design your
project or how to use a certain function.
Although warning hazards are related to personal injury, and caution hazards are
associated with equipment or property damage, it should be understood that operation
of damaged equipment could, under certain operational conditions, result in degraded
process performance leading to personal injury or death. Therefore, comply fully with
all warnings and caution notices.
2.3 Related documents

The following SYS 600 manuals should be available for reference during the use of this
manual:
Name of the manual MRS number
SYS 600 9.3 Communication Gateway, COM 1MRS756633
500i
SYS 600 9.3 System Configuration 1MRS756646
SYS 600 9.3 System Objects 1MRS756662
SYS 600 9.3 Application Objects 1MRS756660
Other referenced manuals

The IEC 60870-5-104 protocol is based on the following documents by the IEC Technical
Committee 57:
IEC 60870-5-1 Transmission Frame Formats
IEC 60870-5-2 Data Link Transmission Services
IEC 60870-5-3 General Structure of Application Data
IEC 60870-5-4 Definition and Coding of Information Elements
IEC 60870-5-5 Basic Application Functions
7

2.4 Document revisions

Version Revision number Date History
A 9.3 30.3.2010 New document
B 9.3 FP2 30.9.2012 Updated document
8
3 Safety information
This section gives information about the prevention of hazards and taking backups from
the system.
3.1 Backup copies
Taking backup copies

We suggest that you take backup copies before making any changes, especially the ones
that might have side effects. Software and data need to be copied to another place.
Backup copying makes it easier to restore the application software in case of disk crash
or other severe failure when stored data is lost. It is therefore recommended that backup
copies are taken regularly.
There should be at least two system backup copies and two application copies. A new
backup is copied over the oldest backup. This way the latest version is always available,
even if the backup procedure fails.
Detailed information on how to take backup copies should be delivered to the customer
with the application.
System backup
Usually a system back up is taken after the application is made. It should be taken again
when changes are made to the SYS 600 system. This is needed, for example, when the
driver configuration or the network setup is changed.
Application backup
An application backup is also taken at the same time with the system backup, after the
application is made. It should be taken again when changes are made to the application,
for example if pictures or databases are edited or new pictures are added.
3.2 Fatal errors

A fatal error is an error that causes a breakdown or a locked situation in the SYS 600
program execution.
Handling
In case of a fatal error:
1. Write down the possible SYS 600 error messages.
2. Shut down the SYS 600 main program. If this cannot be done in the SYS 600 Control
Panel, try to end the task in Windows Task Manager.
9

Files may be damaged if you shut down the base system

computers by switching the power off.
3. The data kept in the main memory at the moment of a fatal error is placed in the
drwtsn32.log file with Windows 2003 Server, Windows XP and earlier. By default
it is placed under %SYSTEMDRIVE%\Documents And Settings\All
Users\Application Data\Microsoft\Dr Watson. Log and dump file paths can be
checked with the drwtsn32 application. (Start -> run -> drwtsn32.exe). Analyze and
copy the data in these files.
Starting with Windows Server 2008 and Windows 7 the crash handling has changed.
The location of the dump files can be read from the registry under the key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error
Reporting\LocalDumps. The DumpFolder value tells the location of the dump files.
Collect the data from this location.
4. Restart the system.
Report the program break-down together with the possible SYS 600 error messages and
the information from the drwtsn32.log file to the SYS 600 supplier.
Status codes
Error messages in SCIL are called status codes. A list of status codes and short
explanations can be found in SYS 600 Status Codes.
10
4 Instructions
4.1 Communication
In SYS 600 the IEC 60870-5-104 Slave protocol is implemented only in the PC-NET
software. PC-NET unit communicates over an INTEGRATED link and via the Ethernet
ports of the base system computer.
Setting the attributes of SYS 600 system objects can modify the communication
parameters.
The base system sees each IEC device as a station (STA object) that has been created to
a line of a NET unit. Each IEC station works as a protocol converter that converts data
between the internal protocol of SYS 600 and the IEC 60870-5-104 protocol.
4.2 Installation
The SYS 600 installation is required.
4.3 Configuration
Configuration can be made either by using the System Configuration Tool or by using
SCIL statements. For more information of the System Configuration Tool, see SYS 600
System Configuration manual, chapter 'PC-NET start-up with System Configuration
Tool' and 'System Configuration Tool'. The usage of the System Configuration Tool is
recommended but if there is a need to create the communication configuration using
SCIL, it is instructed in the following chapters. In this case, the configuration can be
divided into two parts:
• Base system configuration
• Communication system configuration
The attribute descriptions presented in chapter 'Communication system configuration'
are the same for configurations created with System Configuration Tool or with SCIL.
4.3.1 Base system configuration
It is assumed here that the base system configuration for other objects but the
communication has been made according to the instructions in the System Configuration
manual.
The extra steps needed to configure the communication are:
1. Define a node number for a PC_NET instance
2. Reserve a link number a PC_NET instance. Creating the link as instructed in step
6 will start the PC_NET instance
11

3. Create the basesystem STA object for each remote IED (master function) or for
each NCC connection (slave function)
• IEC 60870-5-104 Slave protocol uses the station type IEC (STY type 29)
The STA objects are created to SYS_BASCON.COM using template or with a
separate creation sequence. If the template is not used, the sequence should contain
a line
#create STA'Sta_Nb':B = %Sta
where 'Sta_Nb' is the number of the station object in the basesystem. %Sta is a list
object which should contain at least the following settings: TT = "EXTERNAL",
ST = station type, ND = node number defined in step 1 and TN = translated object
number (usually the same as 'Sta_Nb'. See SYS600 System Objects manual for more
information about the basesystem object attributes for STA object).
4. Edit the PC_NET.CF1 according to the description of chapter 'Start-up definition
file PC_NET.CF1' in the SYS600 System Configuration manual
5. Create a command procedure which will create the lines and stations to the NET
object (= pc_net instance) using the S-attributes.
See Section 4.3.2 Communication system configuration for more information about
the attribute setting. A sample creation script is presented at the end of this manual.
6. Create a command procedure which will create the link of type 'INTEGRATED' to
the basesystem. This procedure should contain a line
#set LIN'i_Integrated_Link_Number':BLT = "INTEGRATED"
where 'i_Integrated_Link_Number' is the number of the link reserved in step 2. The

PC_NET executable is defined with the SC attribute of the link and it must set before
setting of the LT attribute
The testing of the communication system can be done as follows:
1. Execute the procedure created in step 6. This will start the PC_NET instance and
enable the setting of the S-attributes
2. Execute the procedure created in step 5. If the lines and stations are set to IU = 1
(i.e. are in use) and the configuration is correct and complete in both ends, the
communication should start.
For automatic start-up of the communication, the created command procedures must be
attached for example to the APL_INIT_1:C procedure.
4.3.2 Communication system configuration
Each NET instance contains a set of system objects which specify the existence and the
usage of the communication lines and the station objects connected to those lines. These
objects can be created, modified and deleted by SCIL, and setting the attributes will
define the functionality of these objects.
Access to the attributes can be one of the following:
12
• Read-only: The attribute can only be read. There are still a few exceptions in which
the values can be reset.
• Write-only: The attribute can only be written (set).
• Read, conditional write: The attribute can be both read and written, but the object
must be set out of use (IU = 0) before writing.
• No limitations: The attribute can be both read and written without limitations.
The implementation of the Configuration Manual in SYS 600 can be divided into two
layers: line layer and station layer. Both of these layers have a specific functionality and
a set of attributes of their own.
The purpose of the communication system configuration is to:
• Create all the system objects needed to establish communication between the master
and the slave.
• Adjust the values of the system object attributes to match the physical communication
channel and the properties of the remote partner / partners
Setting the attribute values

All the line and station attributes have sensible default values but the value of each
attribute must be checked against the requirements of the actual communication system.
The attribute values depend on:
• The physical communication media (for example leased telephone line, radio link,
power line carrier), which affects in particular the attributes of the line, such as the
baud rate and parity.
• The network topology used (point-to-point, multi-drop), which affects for example
the link type.
• The size (number of stations) of the system, which affects especially the timeout
parameters; the slower the media and larger the system, the longer timeouts are
needed.
• The remote system, which affects both the line and station attributes, and also the
message types used.
Network topologies
The implementation of the IEC 60870-5-104 slave protocol in MicroSCADA uses the
Ethernet connection, where the slaves communicate with a master. The IEC 60870-5-104
slave protocol supports multidrop technology where one or more slaves are connected
with one master. Figure 4.1 illustrates the multidrop network topology.
13

Figure 4.1: Multidrop network topology
By default, one logical connection is formed from the slave station object to one
IEC60870-5-104 master. If multiple connections is needed (for example, to multiple
masters), the redundancy extensions defined with line attribute LD and station attribute
IA can be used. The usage of the redundancy feature is recommended if only one of the
logical connections is active at any time. If multiple masters are active at the same time,
the recommended configuration is to use separate IEC60870-5-104 slave lines and station
objects (and NCCs in cross-reference tool). For the additional slave lines several network
cards is needed or several IP addresses must be assigned for the same network card.
When making the IEC connection, an agreement about the used communication
parameters should be made with the supplier or owner of the master system.
4.3.2.1 IEC 60870-5-104 line layer
The line process of a NET unit performs the functions of the line layer. The purpose of
the line layer is to send and receive messages with external devices using the IEC
60870-5-104 protocol.
According to the IEC 60870 standards, the line layer performs the following functions:
• Provides access to the transmission medium. for exmaple TCP/IP
• Adds and removes frame delimiters if not performed by data circuit terminating
equipment.
14
• Recognises frames addressed to a designated station.

• Reports on persistent transmission errors.
• Reports on the status of link configuration.
• Supports initiation and maintenance functions.
Line layer attributes

The following attributes can be used for configuring IEC 60870-5-104 master lines in
SYS 600.
IU In Use
Indicates whether the line is in use (value 1) or not in use (value 0).
Data type: Integer
Value: 0 or 1
Index range: 1...12 (NET line numbering)
Default value: 0
Access: No limitations
LD Local Address
IP address that is used locally. It is necessary to set this attribute when the computer
has multiple IP addresses and it is defined which address the created line must use. This
attribute must be set before the line has been taken into use for the first time. An empty
string in LD means that the default IP address of the computer is used. The value of
LD cannot be modified after the line has been taken into use for the first time. Multiple
IP addresses can also be given to support redundancy, refer to the station attributes IA
and AC.
Data type: Text

Value: String containing a valid IP address, max 230 characters.
Default value: Empty string
Index range: 1... 12 (NET line numbering)
Access: Read, conditional write
This attribute accepts the IP address in form:

#SET NET1:SLD1="192.168.1.10"
If multiple IP addresses have to be assigned for redundancy purposes, separate the

addresses with a space, for example
#SET NET1:SLD1="192.168.1.10 192.168.1.20 192.168.1.30"
The standard TCP port of 2404 specified for IEC60870-5-104 is used if the port number
is not explicitly specified. If a non-standard port for the line is needed, the port number
should be separated with a semicolon:
15

#SET NET1:SLD1=”192.168.1.10;2405” ;server port = 2405, (no spaces

allowed)
If a non-standard port is needed in the redundancy configuration, the port number should
be separated with a semicolon and the addresses are separated with a space character:
#SET NET1:SLD1=”192.168.1.10 192.168.1.10;2405 192.168.1.10;2406
192.168.1.10;2407” ;server ports = 2404 (default), 2405, 2406,
2407
The defined port number must be between range 1..65535. The operating system and
other applications running in the same computer may cause limitations to the availability
of the port numbers.
The same local address and port cannot be used by multiple slave lines. This means that
if the lines are using the standard TCP port 2404, a unique IP address must defined for
each IEC 60870-5-104 slave line.
There is an internal limitation which prohibits the use of the

same local IP address and the same line number multiple times.
This applies to all PC_NET protocols using LAN.
Example:
It is not possible to have
IEC104 master in Line 1 in PC_NET 1 with
LD="192.168.1.1"
and
DNP3.0 slave in Line 1 in PC_NET 2 with
LD="192.168.1.1"
the configuration must be changed to
LD="192.168.1.1"
and
LD="192.168.1.1"
or to
LD="192.168.1.1"
and
LD="192.168.1.2"
16
The limitation is present only when the same local IP address

is used. An easy workaround is to configure multiple
IP-addresses which are using the same adapter. If this is not
possible, setting a unique value for the NET node attribute LP
will redefine the internally used ports for the NET node and
no conflict will take place. See SYS 600 System Objects
manual for more information about the NET Node attribute
LP.
PO Protocol
The data transfer protocol used on the line. The line is defined to the NET by setting
this attribute. By setting the attribute to 0 the line definition including all the line attrib-
utes are deleted.
Data type: Integer
Value: 0...45
Value with IEC 60870-5-104 Slave protocol: 45 (Controlled station)
PS Buffer Pool Size

Specifies the number of the message buffers reserved for the line. Fixed buffer poll
sizes are used in versions 9.3FP1 and newer and this attribute is retained because of
the backward compatibility. Setting of the value for PS is not possible anymore. See
the attributes PS, NB and PB from the System Objects manual for more information.
Data type: Integer
Value: 1...250
Access: Read (conditional write accepted but has no effect)
PD Polling Delay
The delay between the communication test polling messages U(TESTFR) (as described
in the IEC 60870-5-104 standard). If no transmission occurs within the time specified
with this attribute, the frame U(TESTFR) is sent (t3). No test poll is sent when the value
is 0.
Data type: Integer
Value: 0... 255
Unit: Seconds
Index range: 1... 12 (NET line numbering)
Default value: 20 s
17

Access: Read, write
TI Response Timeout
The time in seconds that the IEC link waits for the response to the sent messages (t1)
(as described in the IEC 60870-5-104 standard).
Data type: Integer
Value: 0...255
Unit: Seconds
Default value: 15 s
Access: Read, Write
MI Message Identification
Object address of system messages.
Data type: Integer
Value: 1...32760
Default value: 6000 + (100 * NET number) + line number
MS Message Application
The number of the application that is the receiver of the system messages generated by
the line.
Data type: Integer
Value: 1...250
Default value: 1
Example:
In the example of SYS_BASCON.COM earlier in this chapter, the number of the
message application is 1.
DC Diagnostic Counters
18
The line protocols gather statistical information about the events on the lines by incre-
menting a number of diagnostic counters. All the major events and error situations of
the communication have their own counters.
When accessing diagnostic counters, the attribute is indexed according to the formula:
100 * (line number) + (diagnostic counter number)
The IEC 60870-5-104 Slave protocol supports the following counters:
1. Transmitted telegrams
2. Failed transmissions
4. Transmitted commands
5. Transmitted replies
6. Transmitted U (Unnumbered control function) format messages
7. Received I format messages
8. Received S format messages
9. Received U format messages
11. Received messages
12. TCP Connect count
13. TCP Accept count
14. TCP Close count
15. Duplicates and losses
16. Buffer overflow errors
Data type: Integer
Value: 0...30000
Index range: See above
Access: Read-only, the values can be reset
OM Operating Mode
A bit pattern which defines the operating mode of the line.

Value: See below
Default value: 0
19

Bit 0: When Bit 0 is not set, the IP address of a incoming connection request
is checked against the values defined with the station object attributes
IA and AI. If the incoming address does not match with any configured
connection, the TCP connection is not established. This is the default
behaviour.
If bit 0 is set, the IP address of the incoming connection request is not
checked. This configuration may be useful in hot-standby systems in
which there are two masters with separate IP addresses. Notice that
not more than one connection per station object can be active at the
same time.
Bit 1: When bit 1 is not set, new TCP connection attempts do not disconnect
an existing logical connection. This is the default behaviour. If bit 1
is set, new TCP connection attempt will disconnect an existing logical
connection. This bit may useful when it is known that the master
which is trying establish the connection will always be the one which
should continue the communication.
Bit 2: When bit 2 is not set, the same remote IP address may reserve multiple
logical connections for itself althought in most cases, the masters are
not configred to do that. This is the default behaviour.
When bit 2 is set, the same remote IP address may reserve only one
logical connection from each locally defined IP-address (line attribute
LD). Setting of bit 2 is meaningful only if the same remote IP address
is defined as an additional address (station attribute AI) to multiple
logical connections.
Setting bits 0, 1 and 2 has a same effect on all local addresses defined
with line attribute LD.
Bit 3: Process commands with invalid CAA. If this bit is 1 and the Common
Address of ASDU (CAA) of the incoming command does not match
with any of the configured STAs for the IP-address of the sender of
the command, the message is passed for processing to the STA object
which is the first station which used the IP-address in its IA. When
System Configuration Tool is used, this STA number is the lowest
STA number having the IA equal to IP-address of the sender of the
command.
The setting of this bit is necessary if the remote master send commands
with broadcast addresses or there is a need to detect invalid CAAs
using Cause of transmission = 46 (unknown common address of
ASDU). If this bit 0, incoming commands with Common Address of
ASDU (CAA) values not matching with configuration are not pro-
cessed.
20
4.3.2.2 IEC 60870-5-104 station object
The main purpose of the station layer is the protocol conversion between the IEC
60870-5-104 and the internal protocol of SYS 600. The station objects also takes care
of the application level communication with the master.
The STA objects created in a NET unit perform the functions of the station object. In
IEC 60870-5-104 Slave, it is possible to create multiple station objects to the same line.
If multiple stations are created, the usage of redundancy is not recommended. Separate
NCC definitions in COM 500i are needed for each station object.
The STA objects created in a NET unit perform the functions of the station object. Some
attributes are used for the station configuration, others are used for device communication.
The configuration attributes are presented in this chapter and the communication attributes
in the next one.
Station attributes
The following attributes can be used for configuring the IEC 60870-5-104 Slave stations
in SYS 600.
IU In Use
Indicates whether the station is in use (value 1) or not in use (value 0).
Data type: Integer
Value: 0 or 1
Default value: 0
LI Line Number
The number of the NET line the station is connected to.
Data type: Integer
Value: 1...12 (NET line numbering)
Indexing: None
Access: Read
SA Station Address
The station address of the IEC 60870-5-104 Slave station, the common address of
ASDU in an IEC message.
Data type: Integer
Value: 0...255, when SL attribute = 1
0...65535, when SL attribute = 2
Default value: 1
21

Example:
In the example of the communication system configuration, the slave address is 1.
IA Internet Address
The IP address or the hostname of the remote host. The connection is established with
the master device in this address by connecting to port number 2404 in the slave device
The line must have been taken into use at least once before writing to this attribute.
Value: Any string, max 29 characters
Index: 1...12 (optional, defines the connection number)
Access: Read/write
When read without index, the remote address of active connection is returned. In a
non-redundant configuration, this is equal to the configured IA. When read with indices
1..12, the configured remote address for the logical connection is returned. When read
with index 100, the remote IP-address of the connection currently active is returned (in
redundant configuration, one logical connection is active and used for data transfer, see
attributes AC and CS).
When IA is read with indices 101..112, the address of currently connected remote master
of logical connection index-100 is returned. The reading of these values may be necessary
if addtional addresses (AI) has been defined for the connection or the line uses setting
OM bit 0 =1 (Incoming addresses are not checked).
When written, this attribute accepts the IP address in form:
#SET STA1:SIA="192.168.1.11"
or as an alias name:
#SET STA1:SIA=”GRACE”
When an alias name is used, it must be defined in the TCP host file:
%windir\system32\drivers\etc\hosts.
In case there is a need to assign multiple IP addresses for the redundancy purposes, the
addresses must be given with an index. Each given index defines a logical connection.
Examples
#SET STA1:SIA1="192.168.1.11:2"
Defines that the first logical connection of STA1 is defined to be to/from IP-address
using the second local address given with line attribute LD.
A setup in which there is four logical connections to master and two local ip-addresses
connected to two separate LANs would result following configuration:
#SET NET1:SLD1="192.168.1.10 192.168.1.20" ; first LAN second LAN
22
.
.
#SET STA1:SIA1="192.168.1.11:1"
#SET STA1:SIA2="192.168.1.12:1"
#SET STA1:SIA3="192.168.1.21:2"
#SET STA1:SIA4="192.168.1.22:2"
AI Additional Internet address

Additional IP addresses of the remote host. The connection is accepted from the master
device if the incoming IP address matches with IA or with any of the addresses listed
in AI.
The given addresses must be separated with space. The index defines the logical con-
nection for the addresses. The line must be taken into use at least once before writing
an address to this attribute.
Value: Any string, max 200 characters
Index: 1...12 (optional, defines the connection number)
Access: Read/write
This attribute accepts the IP address in the following form

#SET STA1:SAI="192.168.2.180 192.168.2.181"
If only one address is defined to IA attribute (i.e. no redundancy configuration), the

connections are exclusive in a way that only the first connection attempt from a valid
address is accepted and the next ones are rejected.
In case multiple addresses has been defined to IA (i.e. redundancy configuration is
present) and there is a need to assign a list of valid addresses, the index for AI must
specified. Index defines the logical connection in a same way as in the definition of IA.
In case the same remote address is present in the configuration of multiple logical
connections, the new connection is established if it is allowed by the configuration. If
the logical connection is already established and the bit 1 of line attribute OM is 0, the
attempt is rejected. If the logical connection is already established or the bit 1 of line
attribute OM is 1, the new attempt is accepted and the existing connection is closed.
If bit 2 of the line attribute OM is 1, only one connection from each remote address to
each local address is accepted.
If bit 0 of the line attribute OM is 1, the connections are accepted from all remote
addresses and the contents of the AI attributes are meaningless.
Example 1.
#SET NET3:SOM1 = 0
#SET STA1:SIA="192.168.2.180"
#SET STA1:SAI="192.168.2.181 192.168.2.182 192.168.2.183"
23

A non-redundant connection is accepted from addresses 192.168.2.180, 192.168.2.181,

192.168.2.182 or 192.168.2.183 depending on which one is established first. Other
attempts are rejected.
Example 2.
#SET NET1:SLD1="192.168.2.10 192.168.100.10" ; first LAN second
LAN
#SET NET1:SOM1=0
.
.
#SET STA1:SIA1="192.168.2.180:1"
#SET STA1:SIA2="192.168.100.180:2"
#SET STA1:SAI1="192.168.2.181"
#SET STA1:SAI2="192.168.100.181"
Redundant configuration, logical connection 1 through 192.168.2.10 is accepted either

from 192.168.2.180 or 192.168.2.181 and logical connection 2 through 192.168.100.10
is accepted either from 192.168.100.180 or 192.168.100.181. In this configuratin there
are 2 logical connections which are usually connected to the 'hot' master. The 'cold'
master is not connected at all.
The usage of AI is recommended. It is also possible to configure 4 four logical connection
using configuration
#SET NET1:SLD1="192.168.2.10 192.168.100.10" ; first LAN second
LAN
#SET NET1:SOM1=0
.
.
#SET STA1:SIA1="192.168.2.180:1" ; Connection 1 of master A uses
192.168.2.10
#SET STA1:SIA2="192.168.100.180:2" ; Connection 2 of master A
uses 192.168.100.10
#SET STA1:SIA3="192.168.2.181:1" ; Connection 1 of master B uses
192.168.2.10
#SET STA1:SIA4="192.168.100.181:2" ; Connection 2 of master B
uses 192.168.100.10
This configuration creates 4 logical connections and both 'hot' and 'cold' master may be
connected at the same time. In case both masters A and B become 'hot' at the same time,
they may try to activate one of its own connections. This may lead to the continuous
switching of the active connection.
SL Station Address Length
The length of the station address (common address of ASDU) in octets.
Data type: Integer
Value: 1 or 2
24
Default value: 2
The default values of the SL, IL and CL attributes follow the

IEC 60870-5-104 standard. It is strongly recommended to use
these values, otherwise compatibility cannot be guaranteed.
IL Information Address Length

The length of the information object address in octets.
Data type: Integer
Value: 1...3
Default value: 3
CL Length of Cause of Transmission Information

The length of the cause of transmission field in an IEC 60870-5-104 message in octets.
Data type: Integer
Value: 1 or 2
Default value: 2
AL Allocation
Allocates the station to an application. When the AL attribute has the value 1, the station
is reserved by the application specified by the AS attribute. All the spontaneous messages
from the station are sent to this application.
Data type: Integer
Value: 0 or 1
AS Allocating Application
Specifies the allocating application of the station (see the AL attribute). The allocating
application will get all the spontaneous process data from the station. This application
is also the only one that is allowed to set the device communication attributes
Data type: Integer
Value: 0...250,
0 = no application
Access: Read-only , conditional write
25

When the AL attribute is set to 0, AS also gets the value 0.
MI Message Identification
Object address of system messages.
Data type: Integer
Value: 1...32760
Default value: 29000 + station number
MS Message Application
The number of the application, that is the receiver of the system messages generated
by the line.
Data type: Integer
Value: 1...250
Default value: 1
SE System Messages Enabled

Specifies whether the system messages generated by the NET and related to the station
are sent to applications (value 1) or not (value 0). By using this attribute, it is possible
to disable the system messages related to the station.
Data type: Integer
Value: 0 or 1
Default value: 1
CA Command Address
The object address of bit stream process object in the SYS 600 process database, where
unidentified messages are sent.
Data type: Integer
Value: 1 … 65535
Default value: 32000
The unit number (UN attribute) of the bit stream process object
must be the same as the STA object number.
26
CD Command Delay
The Command Delay attribute specifies the maximum delay for timestamped commands.
If the timestamp of the incoming command message indicates that the transmission
delay has been bigger than the value defined with this attribute, the command is not
accepted. The attribute defines a time window in which the timestamped command is
accepted.
IEC Station attribute CC controls how the “summer time” bit of the incoming command
is handled. See the corresponding description for more information.
The value of the NET node attribute TZ (Time zone) is used to compensate the
timestamps of different time zone.
The timestamped control commands are normally used only in IEC60870-5-104 and
not in IEC60870-5-101.
Value: 0...65535
Unit: Milliseconds
Default: 1000
Access: Read/Write
Example
If STA1:SCD is 2000, only the command with timestamps +-2000 ms around the current
time of the slave computer is accepted.
ML Maximum Message Length
The maximum amount of octets containing information objects.The Application Protocol
Control Information (APCI) fields and Data Unit Identifier fields are excluded from
this value. This attribute is automatically set to a smaller value if the total message
length would exceed 253 bytes with the given value.
Data type: Integer
Value: 20…253
Default value: 253
EA Event buffer overflow Address
27

Defines the information object address of the single indication, which is used to indicate
the event buffer overflow situation. See the descriptions of:
With index 2 it possible to define a percentage of the buffer space. If value different
from 100 is defined, single indication indicating the event buffer overflow is resent not
until the event buffer space has gone below the defined level of the total space at least
once.
See example below.
See the descriptions of:
• Bit 6 of the RM attribute
• PRI parameter of the EV attribute
Value: Integer
Index 1 or no index: 0..16777215
Index 2: 0..100
Indexing: 1..2 or no index
Index 1 or no index : Information object address
Index 2 : Percentage of buffer space
Default value: Index 1 or no index:32001, Index 2 = 100 (Percentage limit not used)
Access: Read/Write
Example 1.
STA1:SEA1=65535 ; Event buffer overflow event is sent to address
65535
STA1:SEA2=80
When event buffer overflow event has been sent, the same event is sent again not until
the total amount of events has gone under or equal to 80% of the total event buffering
space.
XT eXecute Timeout
The maximum time an execute command is waited after a select command. The value
is meaningful only if the bit 4 of the RM attribute is not set. See the RM attribute de-
scription for further information.
Data type: Integer
Value: 0... 65
Unit: Seconds
Default: 30
PC Process Data Confirmation
28
Controls how the confirmation message is sent to the master station. The manual con-
firmation (value 0) means that the user has to confirm the incoming message from SCIL
by setting the CF attribute. The automatic confirmation (value 1) means that the con-
firmation is done automatically by NET once the base system accepts the data message
sent by NET. System and Application commands are not confirmed automatically if
the attribute is set to the automatic test mode.
Data type: Integer
Value: 0, 1
Default value: 0
TC Time Synchronization
Determines the behaviour of the slave device when it receives a time synchronization
message as follows:
Data type: Integer
Value: 0...3
0 = The synchronization message is handled and the clock of the base
system is set to the received time. The synchronisation message is not
sent to the process database.
Value 1 = The clock of the base system is set to the received time and
the synchronisation message is also sent to the process database (to
a bit stream process object with address as defined by the CA attrib-
ute).
Value 2 = The clock of the base system is not set, but the synchronisa-
tion message is sent to the process database.
Value 3 = Synchronisation messages are not handled at all.
Default value: 1
IV Invalid Time
The "invalid time" information in timestamped messages will follow the value of this
attribute. When a time synchronization is received from IEC60870-5-101/IEC60870-
5-104 line, this attribute is set to value 0 and the timestamped messages are transmitted
with valid time. If the application writes value 1 to this attribute, the timestamped
messages are transmitted with invalid time. If value 0 is written, messages will be
transmitted with valid time. This attribute is useful if e.g. the connection to GPS making
the synchronization is lost. If IV attribute is not written from application, "invalid time"
bit behaves as described in RM attribute bit 1.
Data type: Integer
29

Value: 0 or 1
Indexing: No
RM Running Mode
Consists of a set of flags that control the behaviour and functionality of the IEC Slave
station. Each flag is one bit of this attribute. The bits are as follows:
Bit 0: The hour transmission method of the events from the slave station.
When this bit is 0, the slave device sends a spontaneous clock syn-
chronisation message (ASDU 103) to the master whenever the hour
changes. When this bit is 1, the synchronisation message is not sent
and the master can add its own time to events.
Bit 1: Time synchronisation method. When this bit is 0, the slave station
waits for a synchronisation command from the master station and
marks the time stamps as invalid until the synchronisation command
is received. When this bit is 1, the synchronisation message is not
expected and the time stamps are not marked as invalid.
Bit 2: Confirmation queue (significant only in the unbalanced mode). When
this bit is 0, all the confirmation messages are put to class 1 queue.
When this bit is 1, confirmation messages are put to class 2 queue.
Bit 3: Handling of unrecognised commands. When this bit is 0, unrecognised
command messages are ignored. When this bit is 1, unrecognised
command messages sent by the master are forwarded to a bit stream
process object with an address as defined by the CA attribute.
Bit 4: Select-execute timeout enable/disable. When this bit is 0, the validity
of each select and execute command for ‘single command’ or ‘double
command’ types is checked. A negative confirmation is automatically
returned if:
• the execute command is received without a preceding select
command
• the object address, ASDU type or value is not equal to the pre-
cending select command
• another select command is received (except for matching deactiv-
ation which is accepted)
The length of the timeout is defined with the XT attribute. As men-
tioned, this checking applies to ‘single command’ or ‘double com-
mand’ ASDUs only. Up to 10 select commands may be pending at
the same time. When the bit is 1, the commands are not checked and
the process objects are always updated. The value of XT is meaning-
less in this case.
30
Bit 5: SQ=1 packing enabled/disabled. When this bit is 1, data of ASDUs

1,3,9,11,13 is packed in SQ=1 style. The usage of this packing style
may speed up the communication, if the addresses entered in ComTool
contain blocks. In these blocks the addresses are incremented sequen-
tially. This means that addresses like baseaddr, baseaddr+1 or basead-
dr+2 are used.The SQ=1 packing is not supported for time tagged
data. When this bit is 0, SQ=1 packing is not used and the packing is
made in standard SQ=0 packing style.
Bit 6: If this bit is 1 and error 13856 ICCC_ASDU_QUEUE_FULL is re-
turned during writing to the EV attribute, the included timestamp is
stored. A single indication message using this timestamp is transmitted
automatically as the first event message when communication to the
master proceeds. The information object address of the event is defined
with the EA station attribute. Using attribute EA, index 2 it is possible
define a percentage level which limits the resending of this event
overflow indication. If this bit is 0, no action is taken when error is
returned.
Bit 7: When this bit 0, the parameter ASDU types 110-112 (P_ME_NA_1,
P_ME_NB_1 and P_ME_NC_1) received from the master update a
bitstream process object defined with application layer attribute CA.
When this bit is 1, the the incoming parameter ASDU types 110-112
are handled similarly to set-point command ASDUs 48-50 or ASDUs
61-63 i.e. an analog input process object is updated.
Bit 8: Exceptional command checking. If this bit is 1 and an exceptional
command is received, an immediate response with cause of transmis-
sion 44..47 (unknown type identification, unknown cause of transmis-
sion, unknown common address of ASDU or unknown information
object address) is sent back to the master. If this bit is 0, the cause of
transmission of the response is defined in the MicroSCADA applica-
tion. See also description of line attribute OM, bit 3.
Data type: Integer

Value: 0...65535, see above
Default value: 0
DC Diagnostic Counters
The values of the diagnostic counters which the NET unit keeps for the station. The
counters have the following meaning:
31

1. Suspension information (0 = OK, 1 = suspended)

2. Suspension counter
3. Transmitted data messages
4. Transmitted command messages
5. Transmitted confirmation messages
6. Received data messages
7. Received command messages
8. Received confirmation messages
9. Received unknown messages
10. Received too long messages
11. Link timeouts
12. TCP connects
13. TCP accepts
14. TCP accepts
15. Application response timeouts
Data type: Integer
Value: 1...65535
Index range: 1...20
OS Object Status
The current status of the IEC station object. When value 1 is written to this attribute,
the station object retransmits its current status codeto the system message process object.
Data type: Integer
Value: 0 ... 65535
Access: No limitations (write is possible only with value 1)
QI Queue Information
Information from the class queues. Returns the amount of unsent ASDUs with matching
values for COT (Cause Of Transmission) or TYPE ID (Type Identification).
When accessed, the formula for indices is
100*OPERATION+FIRST..100*OPERATION+LAST
The different values of OPERATION:
32
OPERATION = 1 : class 1 ASDUs in which COT is in range FIRST..LAST

2 : class 2 ASDUs in which COT is in range FIRST..LAST
3 : class 1 + class 2 ASDUs in which COT is in range FIRST..LAST
4 : class 1 ASDUs in which TYPE_ID is in range FIRST..LAST
5 : class 2 ASDUs in which TYPE_ID is in range FIRST..LAST
6 : class 1 + class 2 ASDUs in which TYPE_ID is in range
FIRST..LAST
Data type: Integer
Value: 0...255
Index: 1...6 (see above)
The last index is optional (see above).
Access: Read-Only
Examples
STAx:SQI103 ;Returns the amount of unsent ASDUs from class 1 with
COT=3
;(Spontaneous)
STAx:SQI(320..336) ;Returns the amount of unsent ASDUs with
COT=20..36
;(Interrogated/Group interrogated)
STAx:SQI513 ;Returns the amount of unsent ASDUs from class 2 with
TYPE
;ID=13 (M_ME_NC_1)
STAX:SQI(699..701) ;Returns the amount of unsent ASDUs from with
TYPE
;ID=99..101 (Interrogation commands)
ST SYS Waiting Time

The maximum time that the slave station waits for a reply from the base system.
Data type: Integer
Value: 0...60000
Unit: Milliseconds
Default value: 5000
AT Acknowledge Timeout
33

The timeout for sending an acknowledgement if the amount of APDUs defined by the
UR attribute is not received. The timer is restarted when an APDU is received and
cancelled when an acknowledge is sent (t2) (as described in the IEC 60870-5-104
standard). If no index is given, the currently active logical connection is accessed.
Value: 1... 255 s
Index: 1..12 (optional, defines the connection number )
Unit: Seconds
Access: Read/Write
Default: 10 s
MT Maximum Delayed Response Time
The maximum time to delay response for writing data to the SD and EV attributes, if
the number of items in the queue is greater than the value of the RW attribute.
Data type: Integer
Value: 0...600
0 = Delayed response mechanism not used
Unit: Seconds
Default value: 0
A high value of this attribute may cause queuing of command

procedure executions in the base system during communication
disturbance.
CC Command Control
This attribute defines how the incoming timestamped control commands and time
synchronization commands are handled.
See NET node attribute TZ (Time Zone) and IEC station object attribute CD (Command
delay) for more information.
The term 'summer time' is used in IEC standards as is a synonym for 'daylight saving
time'.
Values of the 'summer time' bit are:
0 = standard time
1= summer time/daylight saving time
Data type: Integer
Default: 0
34
Value: 0... 1
Value 0 = The 'summer time' bit of the timestamp in the incoming
command is ignored. The timestamp of the incoming command is
corrected with the value of the NET node attribute TZ (Time zone).
In order to accept the incoming command, the difference between this
timestamp and the arrival time (from local clock) of message must
not be bigger than the time window defined with station attribute CD.
Value 1 = The 'summer time' bit of the timestamp in the incoming
command is expected to contain a correct value. It is taken into account
in the clock setting or in the time comparison with the arrival time.
The value of the TZ is also taken into account, which means that if
the timestamp of the incoming command is in UTC time, the TZ at-
tribute of the NET node value should contain the amount of minutes
between the local time zone in winter time and the UTC time.
If the value of the 'summer time' bit is different from the daylight saving time information
of the local clock, the 1-hour difference is compensated before clock setting or the
comparison to the arrival time. In order to accept the control command, the difference
must not be bigger than the time window defined with station attribute CD.
SU Summer Time
States whether summer time is used or not. With this attribute the user can change the
SU flag in the IEC time tag. The SU attribute can be used for example to tell a master
system that the time tagged event uses summer time. If the master system does not use
summer time, it is then able to change the time to its own time.
Data type: Integer
Value: 0 or 1
Default value: 0 (summertime not used)
US Unacknowledge Send
The count of unacknowledged APDUs stored in the transport layer. The transport layer
will accepts the ASDUs from the station object up to this amount before the acknow-
ledgement from the remote host must take place (k) (as described in the IEC 60870-5-
104 standard). If no index is given, the currently active logical connection is accessed.
Value: 1... 65535
Access: Read/Write
Default: 12
UR Unacknowledge Receive
35

The count of unacknowledged APDUs forwarded to the station object but not yet ac-
knowledged to the remote host. The transport layer will receive the APDUs from the
remote host up to this amount before an acknowledgement will be sent to the remote
host (w) (as described in the IEC 60870-5-104 standard). If no index is given, the cur-
rently active logical connection is accessed.
Value: 1... 65535
Access: Read/Write
Default: 8
If you have communication problems, try to set the values of

the US and UR attributes to 1.
In order to get the optimised ratio for the limits of

unacknowledged messages sent to the master and received
messages by the slave, the size of the received messages should
be 2/3 of the size of sent messages (k/w).
AC Active Connection
Indicates which of the logical connections defined with the index of the IA-attribute is
active. Value changes when the master system starts using another connection. If the
none of the configured connections is active, the value is 0.
Value: Integer (0...12)
Index: No
Access: Read
Example:
#SET NET1:SLD1="192.168.1.10 192.168.1.20"
; first LAN second LAN
.
.
#SET STA1:SIA1="192.168.1.11:1"
#SET STA1:SIA2="192.168.1.12:1"
#SET STA1:SIA3="192.168.1.21:2"
#SET STA1:SIA4="192.168.1.22:2"
When STA1:SAC returns 3, it means that the data transmission takes place to address
192.168.1.21 using local address 192.168.1.20.
36
There may be only one connection from the same IP-address

in slave to to same IP-address in master. This means that it is
not possible to have
#SET STA1:SIA1="192.168.1.11:1"
#SET STA1:SIA2="192.168.1.11:1"
but it is possible to have

#SET STA1:SIA1="192.168.1.11:1"
#SET STA1:SIA2="192.168.1.11:2"
and (as mentioned before)

#SET STA1:SIA1="192.168.1.11:1"
#SET STA1:SIA2="192.168.1.12:1"
CS Connection State
Indicates the state of the specified logical connection. The given index refers to connec-
tion number specified with IA attribute.
Value: 0 = Connection is undefined
1 = IP Address is not resolved
2 = Not connected
3 = Connecting
4 = Connected
5 = Closing
Index: 1..12 Defines the connection number
Access: Read
Example
If STA1:SCS3 returns 4, it means that TCP connection to address specified with
STA1:SIA3 is in state Connected.
RW Reply Window Size
Defines how many data items (binary values, analog values) can be written from the
base system to NET without a reply or request from the master. If the slave station
cannot send data items spontaneously to the master, it stores data into local buffers and
creates a local reply to the base system and the execution of the SCIL program can
continue. The slave station stores items until the number of items in local buffers is
equal to RW. After that the slave station delays the replies to the base system until the
number of items drops below RW again (data sent to master and reply received).
37

Data type: Integer

Value: 0…100
Default value: 10
4.3.2.3 File transfer attributes
The IEC file transfer feature transmits all types of files between relay and the SYS 600
computer. Only one transmission per one STA object can be active at the same time. If
the another file transfer request is made during the first file transfer is in progress, the
status code is returned and the second file transfer progress does not start.
FI File Information
The FI attribute initializes the file transfer system with needed base information.
Value: Vector of 5 integers
1 = internally used
2 = SEGMENTCOUNT
3 = internally used
4 = QUEUE (unbalanced slave)
5 = PRIORITY (slave)
6 = Section request delay IN (0.1 seconds)
7 = Section filling delay OUT (0.1 seconds)
Indexing: 1..7
Access: Read/Write
Default value: 1=0
2=8
3=0
4=2
5 = 3 (1 is lowest value)
6 = 0 (0 milliseconds)
7 = 10 (1000 milliseconds)
Example:
The following example defines five segments in the each file section.
38
#SET STA'sta':SFI(2)=5
FD File Directory
The FD attribute defines to which directory the received files are stored. PC_NET in-
terrupts file receiving, if the directory does not exist or if it is write-protected.
Value: String contains a valid directory name with maximum length of 50
characters.
Access: Read/Write
Default: C:\TEMP
Example:
The following example defines C:\SC\DATA to the active directory.
#SET STA'sta':SFD="C:\SC\DATA"
FF File Transmission Status

The FF attribute indicates the status of the file transmission.
Value: 0 = Free to start or the previous transmission is completed
1 = Transmit in progress
2 = Timeout in PC_NET
3 = Not used
4 = Invalid directory or file name
5 = File is not available in the remote end
6 = Service is not available, internal error
7 = Transfer aborted
8 = File reading or writing failed
Access: Read, Write is allowed when the value is not 6.
Default value: 0
If transmission is in progress when the FF attribute is written, the transmission is
aborted and the file is closed. It does not have any other effects, except the value is set
to zero (0).
FT File Timeout
The FT attribute defines the maximum delay for incoming ack section or ack file request.
If the time expires, PC_NET interrupts the file transmission.
Value: 0..255
Unit: Seconds
39

Access: Read/Write
Default value: 30 seconds
FB File Bytes
The FB attribute returns both counts of received or transmitted bytes from the beginning
of the file transfer session (index 1) and the file size (index 2). At the beginning of the
file reception, the value of index 1 is automatically set to zero (0). The value of index
2 is updated when the FB attribute is written and a correct file index is given.
Value: 0..4294967295
Indexing: When read
1 = Number of bytes (DWORD), out
2 = File size in bytes (DWORD), out
3 = File name in relay (DWORD), out
4 = Number of bytes (DWORD), in
5 = File size in bytes (DWORD), in
6 = File name in relay (DWORD), in
Access: Read
Default: 0
FN File Name
The FN attribute collects the information address to certain file in the file system. When
the remote end requests the directory, the information address is reported as a real file,
not as a subdirectory (FOR = 0).
40
Value: When written

IOA
NAMEOFFILE
FILETYPE
STATUSOFFILE
NAMEINFILESYSTEM
SIZEINFILESYSTEM
DATEINFILESYSTEM
MSECSINFILESYSTEM
When read
NAMEINFILESYSTEM
When read
Indexing: When read, (0..299)
Queue out: index = 100+FILENUM
Queue in: index = 200+FILENUM
If the FILENUM offset is bigger than the number of files in the list, status code 13887
ICCC_NO_SUCH_FILE is returned.
For more information about status codes, see Section 5.8 Status codes
Access: Read/write
Where when writing
IOA
Information object address.
Type: DWORD
NAMEOFFILE
Defines the name of file field in the file transfer messages.
Type: WORD
FILETYPE
Type: WORD
Values: 1 = Transparent file
Other types are not supported at the moment.
STATUSOFFILE
Type: BYTE
Values: 0 = File waits for transfer
41

NAMEINFILESYSTEM
String contains a valid file name in the disk with maximum length of 100 charaters. If
the string is empty, the file is deleted from the list.
SIZEINFILESYSTEM (optional)
The file size.
Type: DWORD
DATEINFILESYSTEM (optional)
Creates file’s timestamp (seconds from 1.1.78).
Type: TIME
MSECSINFILESYSTEM (optional)
Creates file’s timestamp (milliseconds).
Type: WORD
Example of writing
#SET STA'sta':SFN=(1000, 1,1,0, "error.log", 5000, %clock)
Example of reading
The second file is read from the outgoing file list and returns the error.log file.
STA'sta':SFN(102)
FV File Values
The FV attribute checks the status of the defined file. During the reading process, the
attribute’s index defines where the file value is taken, either from the outgoing files list
or from the incoming files list.
Value: Vector
IOA
NAMEOFFILE
FILETYPE
CTRLANDSTATUSOFFILE
SIZEINFILESYSTEM
DATEINFILESYSTEM
MSECSINFILESYSTEM
42
Indexing: When read, word (0..65535)

Queue out: index = 100+FILENUM
Queue in: index = 200+FILENUM
If the FILENUM offset is bigger than the number of files in the list,
status code 13887 ICCC_NO_SUCH_FILE is returned.
For more information about status codes, see Section 5.8 Status codes
43

Access: Read, Where

IOA
Information object address
NAMEOFFILE
Defines the name of file field in the file transfer messages.
Type: WORD
If value = 0 is given for both IOA and NAMEOFFILE, a unique value
is assigned.
FILETYPE
Type: WORD
Values: 1 = Transparent file
Other types are not supported at the moment.
CTRLANDSTATUSOFFILE
Type: WORD.
The upper byte is a control byte.
Bit 0 : Internally used
Bit 1=0: Not yet transmitted
Bit 1=1: All sections transmitted
Bit 2=0: Transmission not acked by remote
Bit 2=1: Transmission acked by remote
The lower byte is equal to status of file (SOF)
Bit 7=0: File waits for transfer (FA)
Bit 7=1 Transfer of this file is active (FA)
SIZEINFILESYSTEM
Type: DWORD
The file size.
DATEINFILESYSTEM
Type: TIME
Creates file’s timestamp.
Example
Reading the second file from the outgoing file list.
44
STA'sta':SFV(102)
3 ;Information object address
3 ;Name of file
1 ;Transparent file
1536 ;CTRL=(transmitted, acked), SOF=0
10006 ;Filesize=10006 bytes
847636153 ;Timestamp
If the FILENUM offset is bigger than the number of files in the list, status code 13887
ICCC_NO_SUCH_FILE is returned.
For more information about status codes, see Chapter 5.8 Status codes
SS Send Subdirectory
The SS attribute initiates the transmission of the directory listing from the specified
address.
Value: IOA, (COT) vector
Access: Write, Where
IOA
Type: DWORD
Is not in use at the moment
COT (optional)
Type: BYTE
Defines the cause of transmission.
If the value is not given, value three (3) is used.
Example
The following example initiates the file directory’s transmission by using cause of
transmission 3.
#SET STA'sta':SSS=(1,3)
More examples on communication system configuration, see Appendix A Examples of

communication system configuration
45

4.4 After configuration

For each input signal received from the process devices the process database should
contain a process object whose value changes when process data is received. The change
activates an event channel, which in turn starts a command procedure. The command
procedure changes a value in the NET unit. From the NET unit data can be transferred
to the IEC master through the communication media.
Besides the configuration of the base system and the communication system it is also
need to:
1. Configure the IEC master.
2. Configure the base system for process communication.
3. Configure the process units.
4. Define the cross-references for signal rerouting, if COM 500i is used. For more
information, see SYS 600 COM 500i User’s Guide.
5. Create and define the input and output process objects for the process communication.
This is usually done when creating the station picture by using standard functions
from an application library.
6. Define event channels for the process objects.
7. Define command procedures for the event channels. If COM 500i is used, the
command procedures that are already in it can be used. Otherwise, the command
procedures are programmed. For more information about how to program the
command procedures and the values of the attributes, see Chapter 5 Technical
description.
4.5 How to test the configuration

When the slave and master stations have been physically tested and the configuration
has been completed, the connection and configuration can be tested based on the following
methods:
• Diagnostic counters. When the communication between the slave and the master is
running properly and data is moving on the line, the diagnostic counters indicating
the number received and transmitted data messages should be incrementing.
• Object status. The OS attribute of the IEC slave station should be 0.
• By connecting a protocol analyser supporting the IEC 60870-5-104 standard to the
line.
For MicroSCADA version 9.3 and newer, protocol analyzer included in PC-NET can
be used. See the NET line attributes AO and AU from the SYS 600 System Objects
manual.
One possible way to test the configuration is to use SYS 600 also as the IEC master/slave.
In this case you have to make the base system and communication system configuration
for the IEC 60870-5-104 Slave line and station(s). The IEC master can be even in the
same computer. Another benefit of using SYS 600 as the test master is that the application
pictures can be reused. However, the process database has to be recreated to an IEC.
46
5 Technical description
5.1 IEC 60870-5-104 Protocol

The IEC Technical Committee 57 (Working Group 03) has developed a protocol standard
for telecontrol, teleprotection and associated telecommunications for electric power
systems. The result of this work is IEC 60870-5. The five first documents listed in Section
2.3 specify the base of IEC 60870-5.
The IEC Technical Committee 57 has also generated a companion standard IEC
60870-5-104 for telecontrol equipment and systems with coded bit serial data transmission
TCP/IP based networks for monitoring and controlling geographically widespread
processes.
The IEC 60870-5-104 protocol standard defines that transferred data entities in the station
object are equal to the ones used in the IEC 60870-5-101 protocol. The implementation
of the IEC 60870-5-104 protocol uses the same STA objects as the IEC 60870-5-101
implementation.
IEC 60870-5-104 is designed according to a selection of transport functions given in the
TCP/IP Protocol Suite (RFC 2200). Within TCP/IP various network types can be utilised
including X.25, FR (Frame Relay), ATM (Asynchronous Transfer Mode), ISDN
(Integrated Service Data Network), Ethernet and serial point-to-point (X.21). Figure 5.1
shows the protocols used in different layers.
Figure 5.1: The protocols used in different layers
47

5.2 Level of implementation

In IEC 60870-5-104 the application level messages are called Application Service Data
Units (ASDUs). Each ASDU consists of one or several information objects that contain
the actual user data. SYS 600 supports the ASDUs presented in Section 5.9 Interoperability
listPrivate ASDUs, i.e. the ones not included in the IEC 60870-5-104 companion standard,
are indicated with an asterisk (*).
For more information, see Section 5.9 Interoperability list.
5.3 Supported process object types

Since in the IEC 60870-5-104 Slave protocol input data is sent to the master by using
SCIL statements, there is no strict relation between the SYS 600 process object types
and IEC ASDUs, but the relation shown in Table 5.1 can be made.
Table 5.1: Possible relations between the SYS 600 process object types and IEC
60870-5-104 Slave ASDUs
Type id Description Process object
type
1, 2, 30 Single point information Binary input
3, 4, 31 Double point information Double binary input
5, 6, 32 Step position information Digital input, analog
input
7, 8 Bit string of 32 bit Bit stream
9…14,34, 36 Measured value Analog input
15, 16, 37 Integrated totals Pulse counter
45, 58 Single command Binary input
46, 59 Double command Double binary input
47, 60 Regulating step commands Double binary input
48…50, 61...63 Set point command Analog input
51, 64 Bit string of 32 bit Analog input
5.4 Communication
This section gives a more detailed description of the implementation of the IEC
60870-5-104 Slave protocol in SYS 600, describing also the attributes that can be used
for device communication. Examples of how to exchange data between the master and
the slave are also given in this section along with information of the IEC 60870-5-104
Slave status codes.
48
5.4.1 Communication modes
The IEC 60870-5-104 protocol has only one mode or line object transmission procedure
compared to IEC 60870-5-101: balanced mode, where each station, master and slave
may initiate message transfers. The master may keep several connections to controlled
stations at the same time.
5.4.2 Protocol converter
Each IEC 60870-5-104 Slave station configured on a line of a NET unit acts as a protocol
converter between the IEC 60870-5-104 protocol and a base system. An internal protocol
of SYS 600 is used in communication between the SYS 600 nodes, for example, between
a base system and a NET unit.
Unlike in some other slave protocols, a IEC 60870-5-104 Slave station does not have a
database in the NET unit, all data is sent directly to the master station. Therefore no
database intialisation procedures are needed. If needed, messages are stored temporarily
into queues inside the NET unit.
In IEC 60870-5-104 data sent from the slave to the master can be assigned to two classes:
class 1 or class 2. Data in class 1 is sent with higher priority than class 2 data.
Both class 1 and class 2 queues contain space for 200 IEC60870-5-104 messages. At its
maximum, one queue may buffer about 4000 binary events (ASDU 30, M_SP_TB_1).
5.4.3 Addressing
In IEC 60870-5-104 there are two kinds of addresses:

• Station address: a common address of an ASDU. There can be several common
addresses of an ASDU with the same link address. This address is defined by the
SA (Station Address) attribute of the IEC station.
• Signal address: an information object address. This address is unique for each signal
with the same common address of an ASDU. The Information object address can
be given in two ways:
- As an unstructured address, which is basically just an integer within the range
of the information object address.
- As a structured address which is given byte-wise so that each byte usually
represents a level in a hierarchical structure. For example, upper byte = unit
number and lower byte = signal address.
SYS 600 supports only unstructured addresses. However, this does not prevent
communication with the IEC 60870 slaves using structured addresses, since the two
types of addresses just demonstrate two different ways of presenting the same address.
For example, a two-byte address can be represented as follows:
unstructured = 256*upper byte + lower byte.
49

5.4.4 Data flow
Figure 5.2 describes the data flow between the process devices and the IEC master. Both
directions are described separately since the data is handled in a different way depending
on the direction.
See manual COM 500i User's guide for detailed information about the data flow
configuration.
Figure 5.2: Data flow between the process devices and the IEC master in COM 500i
Input data
When input data, for example indications and measured values, are sent from the process
devices to the IEC master, the following steps are taken:
1. The process devices send data to the SYS 600 process database.
2. The updated process object activates an event channel.
3. The event channel executes a command procedure. Some of the attributes of the
process object are given as arguments to the command procedure.
4. The command procedure sends the data to the NET database by using the SD and
EV attributes based on specific cross-reference information.
50
5. The NET unit sends data to the IEC master either as static or unsolicited data.
The cross-reference information is the data needed to deliver the signal to the IEC master,
for example object address and message type.
The number event channels and command procedures needed to deliver data to the master
depends on the application, one solution is to have one command procedure for each
process object type. Examples of the command procedures are given later in this
document.
Output data
When output data, for example object commands and analog setpoints, are sent from the
IEC master to the process devices, the following steps are taken:
1. The command is received by the SYS 600 process database. There must be a separate
input process object for each IEC command address. This part of the process object
is created manually when the signal engineering is done.
2. The updated process object activates an event channel.
3. The event channel executes a command procedure. Some of the attributes of the
process object are given as arguments to the command procedure.
4. The command procedure sends the process devices by setting the corresponding
output process object(s) and, if required, sends a confirmation to the IEC master via
the NET unit.
Cross-reference data can also be used with commands. It can contain, for example,
information of the logical names and indices of the output process objects. Examples of
the command procedures are given later in this document.
Other messages
In addition to the input and output data described above, there are also some other
messages transferred between the master and the slave. These messages contain for
example synchronization commands and interrogation commands. Some of these
commands are handled automatically by the NET unit while others require SCIL
programming. The ones that require SCIL programming are described in detail later in
this document.
System and application commands are sent to the process database as follows:
• System commands (for example test command) are sent to a bit stream process
object.
• Application commands (for example general interrogation) are sent to an analog
input (AI) process object.
Using these process objects the messages can be interpreted and processed by using
SCIL. Unrecognised commands from the IEC master can be received by the bit stream
process object. This feature is configurable by using the RM attribute of the IEC slave
station.
51

5.4.5 Device communication attributes
TD Transparent Data
The TD attribute is used for sending transparent data (for example SPA messages) to
the IEC master as a response to the Read command (ASDU 102).
Data type: Vector
Value Vector (TYPE, ADDR, COT, TDT)
Value range: 0...255, for other parameters but ADDR
Access: Write-only
Description of the vector parameters:
TYPE: Type identification of the ASDU, integer. The type identifications
shown in Table 5.2 are allowed when transparent data is sent to the
IEC master/slave by using the TD attribute.
Table 5.2: The type identifications allowed when using the TD attribute
Type id ASDU Description
130 M_SB_NA_1 101 Encapsulated SPA bus reply message
ADDR: Information object address, integer

Value range: 0...255, when IL attribute = 1
0...65535, when IL attribute = 2
COT: Cause of transmission of the message, integer. Valid value: 7 = activ-
ation confirmation
TDT: Transparent data (for example SPA message) as a text string
For more detailed information, see the examples and the interoperability list later in this
document.
SD Spontaneous Data
Enables SYS 600 to send spontaneous or cyclic data to the IEC master. This data is sent
without time stamp. By reading the SD attribute the user can enquire the number of data
messages (ASDUs) in the queues not yet sent to the IEC master. When reading, the
station attribute QI is recommeded since it provides more specific information about the
contents of the queues during runtime.
Data type: Vector or integer
Value: When writing:
Vector (TYPE, ADDR, VAL, COT, QU, PRI, OW)
When reading: Integer
52
Index range: 1...2, 101...102

When writing:
The number of the class the message is assigned to.If value 101 is
given, the item is added to class 1 queue but is not sent until an index
value 1 or 2 is written.
If value 102 is given, the item is added to class 2 queue but is not sent
until an index value 1 or 2 is written.
When reading: the index is meaningless, the returned value is the
number of ASDUs not yet sent to the IEC master.
If station attribute MT is bigger than 0, instead of reading of the SD-
attribute, it is preferable to use the attribute QI.
TYPE: Type identification of the ASDU as a text string (for example
“M_IT_NA_1”)
The type identifications presented in Table 5.3 are allowed when data is sent to the IEC
master by using the SD attribute.
Table 5.3: The type identifications allowed when using the SD attribute
1 M_SP_NA_1 Single-point information without time
tag
3 M_DP_NA_1 Double-point information without time
tag
5 M_ST_NA_1 Step position information
7 M_BO_NA_1 Bit string of 32 bit
9 M_ME_NA_1 Measured value, normalised value
11 M_ME_NB_1 Measured value, scaled value
13 M_ME_NC_1 Measured value, short floating point
number
15 M_IT_NA_1 Integrated totals
70 M_EI_NA_1 End of initialisation
110 P_ME_NA_1 Parameter of measured values, normal-
ized value
111 P_ME_NB_1 Parameter of measured values, scaled
value
112 P_ME_NC_1 Parameter of measured values, short
floating point number
ADDR: Information object address
53

Value range: 0...255,

when IL attribute = 1
0...65535,
0...16777215,
VAL: The value of the object. The value range depends on the data object
type. For more information about the SCIL programs, refer to Sec-
tion 5.5.2.1 Command procedures for process data.
COT: Cause of transmission of the ASDU. This parameter describes the
reason why a message is sent. If the originator address is used, it can
be set by adding 256*originator address to the COT value. The causes
of transmission as shown in Table 5.4 are valid when using the SD
attribute.
Table 5.4: The causes of transmission valid for the SD attribute
COT Description
1 Periodic, cyclic
2 Background scan
3 Spontaneous
4 Initialised
5 Request or requested
11 Return information caused by a remote command
12 Return information caused by a local command
QU: Integer 1...255, bit mask of the qualifier descriptor bits of the ASDU.
Qualifier descriptor bits indicate the current state of the data object.
The bits in the qualifier byte are different for different ASDUs (see
the examples later in this document). The relation between the quali-
fier descriptor bits and process object attributes is presented in
Table 5.5.
Table 5.5: The relation between the qualifier descriptor bits and process object
attributes
Bit Name Description Attr.
IV Invalid A value is valid if it was correctly acquired. OS ==1
After the acquisition function recognises ab-
normal conditions of the information source
(missing or non-operating updating devices),
the value is then marked invalid. The value
of the information object is not defined under
this condition. The mark Invalid is used to
indicate to the destination that the value may
be incorrect and cannot be used.
54
NT Not topical A value is topical if the most recent update OS ==2

was successful. It is not topical if it was not
successfully updated during a specified time
interval or it is unavailable.
SB Substituted The value of the information object is SB
provided by input of an operator (dispatcher)
or by an automatic source.
BL Blocked The value of the information object is BL
blocked for transmission; the value remains
in the state that was acquired before it was
blocked. Blocking and deblocking may be
initiated e.g. by a local lock or a local auto-
matic cause.
CA Counter adjusted Counter was/was not adjusted since the last -
reading.
OV Overflow The value of the information object is beyond OR
a predefined range of value (mainly applic-
able to analogue values).
CY Carry Counter overflow occurred/did not occur in OF
the corresponding integration period.
PRI: Priority of the information object. This parameter defines how the
information object sent using the SD attribute is placed in the class 1
and class 2 queues. This parameter can be used for setting the priority
of data types or individual objects.
Value: Integer 0 … 3:
0 = The information object is always placed in the end of the queue.
1 or 2 = The information object is placed in the queue according to
the priority value. Objects with higher priority pass the lower priority
objects. If the queue contains more than one object with the same
priority, the new object is placed behind them.
3 = The information object is always placed in the beginning of the
queue.
OW: This parameter defines whether a new information object overwrites
an older information object in the queue.
Value: Integer 0 or 1
0 = No overwriting
1 = A new information object overwrites an older object in the queue
EV Event Data with Time Stamp
By writing data to the EV attribute the user can send event data, that is, time-tagged
messages from SYS 600 to the master. By reading the EV attribute the user can enquire
the number of information objects (events) in the queue not yet sent to the IEC master.
55

The maximum value of the EV attribute is limited by the RW attribute of the IEC slave
station.
Data type: Vector or integer
Value: When writing: Vector (TYPE, ADDR, VAL, COT, QU, PRI, RT,
RM, [CTRL])
When reading, Integer
Index range: 1...2, 101...102
When writing: the number of the class the message is assigned to.
If value 101 is given, the item is added to class 1 queue but is not sent
until an index value 1 or 2 is written. If value 102 is given, the item
is added to class 2 queue but is not sent until an index value 1 or 2 is
written.
When reading: the index is meaningless, returned value is the number
of data items not yet sent to the IEC master. If station attribute MT is
bigger than 0, instead of reading of the EV-attribute, it is preferable
to use the attribute QI.

TYPE: Type identification of the ASDU, either as a text string (for example
“M_IT_NA_1”) or as an integer
The type identifications presented in Table 5.6 are allowed when data is sent to the IEC
master by using the EV attribute.
Table 5.6: The type identification allowed when using the EV attribute
30 M_SP_TB_1 Single-point information with time tag
CP56Time2a
31 M_DP_TB_1 Double-point information with time tag
CP56Time2a
32 M_ST_TB_1 Step position information with time tag
CP56Time2a
34 M_ME_TD_1 Measured value, normalised value
with time tag CP56Time2a
36 M_ME_TF_1 Measured value, short floating point
number with time tag CP56Time2a
37 M_IT_TB_1 Integrated totals with time tag
CP56Time2a
ADDR: Information object address
56

0...16777215, when IL attribute = 3 (default)
VAL: The value of the object. The value range depends on the data object
type. See the examples later in this document.
COT: Cause of transmission of the ASDU. See the description of the SD
attribute above.
QU: Bit mask of the qualifier descriptor bits of the ASDU. See the descrip-
tion of the SD attribute above.
Value: Integer 1...255
PRI: Priority of the information object. See the description of the SD attrib-
ute above.
If value = 255 is given, the event data is not recorded. However the
timestamp given with the RT and RM attributes is recorded as the
timestamp of the event buffer overflow situation. A single indication
message using this timestamp is transmitted automatically as the first
event message when the communicating to the master proceeds. The
information object address of the event is defined with the EA station
attribute. If a percentage value defined with attribute EA index 2 is
defined to be less than 100, the event is sent only if the current state
of the queues is below or equal to the defined level.
RT: Registration time. The registration time included in the time stamp
of the unsolicited message.
RM: Registration milliseconds. The millisecond part of the time stamp of
the unsolicited message.
57

CTRL: This is an optional field, which can be given to define the contents of
the information object more specifically. The value is a bit pattern.
Bits 1 and 2 control the 'summer time' bit of the timestamp of the
outgoing event messages. The term 'summer time' is used in IEC
standards as a synonym for 'daylight saving time'.
Values of the 'summer time' bit are:
0 = standard time
1= summer time/daylight saving time.
This bit exists only in ASDU types with extension 'with time tag
CP56tIME2a'. In monitor direction the corresponding ASDU numbers
are 30..40. These ASDU numbers are usually used only with
IEC60870-5-104 slave protocol and not with IEC60870-5-101 slave.
Bit 0 = 0: The 'time invalid' bit of the timestamp of this information
object is not explicitly set, but it follows the value of the station attrib-
ute IV.
Bit 0 = 1: The 'time invalid' bit of the timestamp of this information
object is set to state 1 = invalid.
Bit 1 = 0: The 'summer time' bit of the timestamp of this information
object is not explicitly set, but it follows the value of the station attrib-
ute SU.
Bit 1 = 1: The 'summer time' bit of the timestamp of this information
object is set to state 1 = summertime.
Bit 2 = 0: No conversion from UTC (Coordinated Universal Time)
time to local time is requested. The given timestamp is sent as such
and the state 'summer time' bit follows the rules defined in the descrip-
tion of the bit 1 above.
Bit 2 = 1: The timestamp is given as an UTC time and the conversion
to the local time is requested. The timestamp of the event message
will be converted to the local time of the computer and the 'summer
time' bit of the timestamp will be set according to the localized event
timestamp. The setting of bit 2 will override the 'summer time' bit
setting rules defined in the description of the bit 1 above.
CF Command Confirmation
Manual confirmation of the received messages. In IEC 60870-5-104 commands received

by the slave station are confirmed by using specific confirmation messages. They are
basically original command messages with a different Cause Of Transmission (COT).
Confirmation can be either positive or negative. The number of confirmations and the
COT used depends on the type of the command. See the examples later in this document.
58
In SYS 600 the CF attribute is used to confirm received messages manually. When the
user writes only the COT value to the CF attribute, NET sends the confirmation message
with written COT to the master. In this case the confirmation message is formed from
the latest received command.
The user may also define which command is confirmed. NET automatically stores the
incoming commands to an internal table (70 latest commands are stored). In case ADDR
(or ADDR and TYPE) is given in CF-writing, the confirmed command is searched (latest
first) from the table. If no command with matching address (or address and ASDU-type)
is found, error ICCC_NO_ACTIVE_COMMAND is returned and the confirmation
message is not sent. If a matching command is found, the given COT is set and the
command is sent as a confirmation.
Data type: Vector
Value Vector (COT, [ADDR, [TYPE, [PRIO]]])
Access: Write-only

COT: Cause of transmission of the confirmation message, integer. This parameter
describes the reason why a message is sent. By adding 64 to the COT value, the
confirmation is set negative, i.e. the command is not accepted or failed. If the originator
address is used, it can be set by adding 256*originator address to the COT value. The
causes of transmission shown in Table 5.7 are valid when using the CF attribute.
Table 5.7: The causes of transmission valid for the CF attribute
COT Description
7 Activation confirmation
9 Deactivation confirmation
10 Activation termination
ADDR: Information object address of the confirmed command, integer. For

data commands, this is the address of the process object receiving the
command. For system commands the address must be resolved from
the command message and for application commands the address is
0.
0...16777215, when IL attribute = 3 (default)
TYPE: Type identification of the ASDU, integer. The CF attribute can also
be used for sending transparent data as an IEC 60870-5-104 confirm-
ation message. See the ASDUs and transport mechanisms later in this
document.
PRIO: Priority of the confirmation message 0..4 (or 100..104 or 200..204
when the queue needs to be defined)
59

The priority of the confirmation message cannot be specified, if the transparent data is
sent described below. For other ASDU types, the defining of the priority is possible and
the used values are the same as in the SD and EV attributes. A bigger value means higher
priority.
The messages are sorted in the transmission queue so that the higher priority messages
are sent first. The priority is optional and if not specified, fixed values which depend on
a given COT value are used. If the value of the PRIO is 100..104, the confirmation
messages are always placed to the class 1 queue. Correspondingly, if the value of the
PRIO is 200..204, the confirmation messages are always placed to the class 2 queue.
When the queue is explicitly defined using PRIO values >= 100, the actual priority in
the queue will be PRIO modulo 100. With PRIO values 0..4 or when the PRIO is not
defined, the queue selection is based on the value of the RM attribute, bit 2.
The type identifications presented in Table 5.8 are allowed commands ASDUs confirmed
by the CF attribute.
Table 5.8: The type identifications allowed when using the CF attribute
45 C_SC_NA_1 Single command
46 C_DC_NA_1 Double command
47 C_RC_NA_1 Regulating step command
48 C_SE_NA_1 Set point command, normalised value
49 C_SE_NB_1 Set point command, scaled value
50 C_SE_NC_1 Set point command, short floating point number
51 C_BO_NA_1 Bit string of 32 bit
58 C_SC_TA_1 Single command with time tag CP56Time2a
59 C_DC_TA_1 Double command with time tag CP56Time2a
60 C_RC_TA_1 Regulating step command with time tag CP56Time2a
61 C_SE_TA_1 Set point command, normalized value with CP56Time2a
62 C_SE_TB_1 Set point command, scaled value withCP56Time2a
63 C_SE_TE_1 Set point command, short floating point number with CP56Time2a
64 C_BO_TA_1 Bit string of 32 bit with CP56Time2a
100 C_IC_NA_1 Interrogation command
101 C_CI_NA_1 Counter interrogation command
102 C_RD_NA_1 Read command
103 C_CS_NA_1 Clock synchronisation command
104 C_TS_NA_1 Test command
105 C_RP_NA_1 Reset process command
107 C_TS_TA_1 Test command with CP56Time2a
110 P_ME_NA_1 Parameter of measured values, normalized value
111 P_ME_NB_1 Parameter of measured values, scaled value
60

112 P_ME_NC_1 Parameter of measured values, short floating point number
When sending transparent data, the syntax of the CF attribute is as follows:

vector (COT, [ADDR, [TYPE], [TDT]])
COT: Cause of transmission of the confirmation message, integer. Valid
value: 7 = activation confirmation.
ADDR: Information object address of the confirmed command, see above.
TYPE: Type identification of the ASDU, integer. The type identifications
presented in Table 5.9 are allowed when transparent data is sent to
the IEC master by using the CF attribute.
Table 5.9: The type identifications allowed when using the CF attribute
131 C_SR_NA_1 Parameter, byte string
133 C_SB_NA_1 101 Encapsulated SPA bus message
TDT: Transparent data (SPA message) as a text string. For more detailed
information, see the examples and the interoperability list later in this
document.
RS Reset Event Queues
RS is used for clearing the content of event queues in the slave station. If an optional
COT (Cause of Transmission) value is given, only the ASDUs with a matching COT
are cleared from the specified queue. If the COT is not specified, the whole queue(s) are
cleared.
Data type: Integer or Integer’s vector
Value: (VAL, [COT])
VAL= 1..3
1: reset the class 1 queue
2: reset the class 2 queue
3: reset both queues
COT= Integer 0..255 (optional)
If specified, only the ASDUs with the Cause of Transmission field matching with COT
are cleared.
Access: Write-only
Example
61

#SET STA1:SRS=(3,20) ; Clears the ASDUs with COT=20 (Interrogated)

from queues
; 1 and 2
5.5 Command procedures
5.5.1 Command procedures in COM 500i
Signals are sent from the process units to a NCC and commands from a NCC to the
process unit. COM 500i reroutes the signals using command procedures and
cross-references, see Figure 5.3. The command procedures, which are used for signal
rerouting, are described here.
Figure 5.3: COM 500i reroutes the signals
If the IEC 60870-5-104 Slave protocol is used with COM 500i, the command procedures
available for COM 500i are used. The cross-reference information is entered in the Signal
Cross-reference tool. In order to receive more information, see SYS 600 COM 500i
User’s Guide Table 5.10 shows the used COM 500i command procedures and event
channels.
Table 5.10: Used event channels and command procedures
Process Object Type Event Channel Command Procedure
Analog Input COM_USAI COM_USAI
Single Indication COM_USDI COM_USDI
Double Indication COM_USDB COM_USDB
Digital Input COM_USDI COM_USDI
62
Process Object Type Event Channel Command Procedure

Pulse Counter COM_USPC COM_USPC
Binary Outputs COM_DSBO COM_DSBO
Analog Outputs COM_DSAO COM_DSAO
Digital Outputs COM_DSDO COM_DSDO
5.5.2 Command procedures in SYS 600
5.5.2.1 Command procedures for process data
The command procedures presented in this chapter cannot cover all combinations and
requirements, but they provide examples of the implementation.
The connection between the SYS 600 process objects and messages to and from the IEC
master is made by using cross-reference data. The cross-reference data is written to the
FX (Free teXt) attribute of the process objects by using the Process Object Definition
Tool.
The cross-references for data transfer from SYS 600 to the IEC master are kept in the
FX attribute, which is a string of max 30 characters (10 before revision 8.4.2). The general
syntax for a cross-reference is:
<STA_NUMBER><TYPE><CLASS><ADDRESS><PRI><OW>
STA_NUMBER: Logical STA number (range 1 … 65535). The value is stored as

5 ASCII digits with leading spaces added if necessary. FX string
positions 1...5 are used for this value. Actually the maximum
value of the station number depends on the value of the SL attrib-
ute of the IEC station, but this example is according to the max-
imum range (SL=2).
TYPE: Type identification of the ASDU used when the value of the
process object is sent to the IEC master. The value is stored (in
the text format) as 9 ASCII digits with leading spaces added if
necessary. Type identification uses the FX string positions 6...14.
CLASS: The class (1 or 2) the signal is assigned to. The value is stored as
one ASCII digit. Static variation uses the FX string position 15.
ADDRESS: Information object address (range 1...16777215). The value is
stored as 8 ASCII digits with leading spaces added if necessary.
Address uses the FX string positions 16...23. Actually the maxim-
um value of the information object address depends on the value
of the IL attribute of the IEC station, but this example is according
to the maximum range (IL=3).
63

PRI: The priority of the information object in the NET queues. The
value is stored as one ASCII digit. Priority parameter uses the
FX string position 24.
OW: The parameter that determines whether the information object
overwrites an older one with the same address in the NET queues.
Stored as one ASCII digit. The overwrite parameter uses the FX
string position 25.
The used STA object attribute depends on whether the information object is sent with
or without a time tag, i.e. as static data or event. The qualifier byte is derived from the
attributes of the process object.
An example of the cross-reference of a double indication signal assigned to class 1 and
sent with time tag, overwrite and high priority.
FX 1 M _ D P _ T A _ 1 1 5 6 2 0 3 3 1
CHAR 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0
Another example of the cross-reference of a scaled analog input signal assigned to class
2 and sent without time tag, no overwrite and low priority.
FX 1 M _ M E _ N B _ 1 2 7 7 1 9 0 0
CHAR 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0
Analog inputs
In the IEC 60870-5-104 protocol analog values can be sent in three different ways:
• As 32-bit floating point values.
• As normalised values, i.e. as 16-bit fixed point values with range –1...1-(2/32768).
• As scaled values, i.e. as 16-bit integers with range –32768...32767.
When analog values are sent to NET by using the SD and EV attributes, both the
normalised and scaled values are handled as signed 16-bit integers. This means that the
maximum value of the analog signal is written as value 32767 and the minimum value
is written as value –32768. The interpretation of the value is done by the IEC master
based on the type identification of the ASDU.
If an analog signal is sent as a normalised or scaled value, it must be limited or scaled
to the value range –32768...32767. This can happen, for example, by using a specific
scale object and the SCIL SCALE function.
All the analog values are connected to the same event channel/command procedure
combination. The command procedure is activated each time the process object is updated.
It reads the updated value, and if necessary, limits or scales it and sends it to NET by
using the cross-reference data. An example of the command procedure is listed below.
A linear scale object AI_TO_S16 is used for the scaling of the analog values with the
value range as presented in Table .
64
Table 5.11: The value range for analog values that are to be sent to NET
Process SYS 600 Data-
base
Low -32768 -32767
High 32768 32767
This object does not scale the value but limits it to the correct range. If scaling is also
wanted, it can be done by changing the “process” side value range.
ERROR CONTINUE
;read cross-reference data
@FX = 'LN':PFX'IX'
@STA_NR = DEC_SCAN(SUBSTR(%FX,1,5))
@TYPE = SUBSTR(%FX,6,9)
@CLASS = DEC_SCAN(SUBSTR(%FX,15,1))
@ADDR = DEC_SCAN(SUBSTR(%FX,16,8))
@PRI = DEC_SCAN(SUBSTR(%FX,24,1))
@OW = DEC_SCAN(SUBSTR(%FX,25,1))
;scale the value if scaled or normalised value, and set the
overfow bit
#CASE SUBSTR(%TYPE,7,1)
#WHEN "A","B" #BLOCK
#IF %AI < -32768 OR %AI > 32767 #THEN #BLOCK
@VALUE = ROUND(SCALE(%AI,"AI_TO_S16","INPUT"))
@OR = 1
#BLOCK_END
#ELSE #BLOCK
@VALUE = ROUND(%AI)
@OR = 0
#BLOCK_END
#BLOCK_END
#OTHERWISE #BLOCK
@VALUE = %AI
@OR = 0
#BLOCK_END
#CASE_END
;calculate the qualifier byte
#IF %OS == 2 #THEN @NT = 1
#ELSE @NT = 0
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
@QUALIFIER = %OR+16*%BL+32*%SB+64*%NT+128*%IV
;send data to NET with spontaneous COT
#IF SUBSTR(%TYPE,6,1) == "T" #THEN - ;send with time tag
#SET
STA'STA_NR':SEV(%CLASS)=(%TYPE,%ADDR,%VALUE,3,%QUALIFIER,%PRI,%RT,%RM)
#ELSE - ;send without time tag
65

#SET
STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%VALUE,3,%QUALIFIER,%PRI,%OW)
Single indications
All the binary inputs are connected to an event channel/command procedure combination
that sends the process value to the NET unit. The command procedure is activated each
time the process object is updated. It reads the updated value and sends it to NET by
using cross-reference data. An example of the command procedure is listed below:
#ERROR CONTINUE

@FX = 'LN':PFX'IX'

#IF %OS == 2 #THEN @NT = 1
#ELSE @NT = 0
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
@QUAL= %BI+2+16*%BL+32*%SB+64*%NT+128*%IV

#SET
STA'STA_NR':SEV(%CLASS)=(%TYPE,%ADDR,%BI,3,%QUAL,%PRI,%RT,%RM)
#SET STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%BI,3,%QUAL,%PRI,%OW)
Double indications
All the double binary inputs are connected to an event channel/command procedure
combination that sends the process value to the NET unit. The command procedure is
activated each time the process object is updated. It reads the updated value and sends
it to NET by using the cross-reference data. An example of the command procedure is
listed below:
#ERROR CONTINUE

@FX = 'LN':PFX'IX'
66

#IF %OS == 2 #THEN @NT = 1
#ELSE @NT = 0
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
@DPIS = (0,2,1,3)
@DPI = %DPIS(%DB+1)
@QUAL = BIT(%DPI,0)+2*BIT(%DPI,1)+16*%BL+32*%SB+64*%NT+128*%

#SET
STA'STA_NR':SEV(%CLASS)=(%TYPE,%ADDR,%DB,3,%QUAL,%PRI,%RT,%RM)
#SET STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%DB,3,%QUAL,%PRI,%OW)
Digital inputs
In IEC 60870-5-104 there is no direct equivalent of the digital input data type. Digital
values can be sent as analog values, or as step position information as in this information.
Step position information is 8-bit data, where the 7 least significant bits are for the value
and the most significant bit is set if the equipment is in transient state. A typical example
of the use of this ASDU is the position of a tap changer. The command procedure for
sending step position information is listed below.
#ERROR CONTINUE
@FX = 'LN':PFX'IX'
#IF %OS == 2 #THEN @NT = 1
#ELSE @NT = 0
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
67

#ELSE @IV = 0
#IF %OV < -64 OR %OV > 63 #THEN @OR = 1
#ELSE @OR = 0
#SET
STA'STA_NR':SEV(%CLASS)=(%TYPE,%ADDR,%BI,3,%QUAL,%PRI,%RT,%RM)
#SET STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%BI,3,%QUAL,%PRI,%OW)
Pulse counters
Pulse counters are called integrated totals in the IEC 60870-5-104 protocol. All the pulse
counters are connected to an event channel/command procedure combination that sends
the process value to the NET unit. The command procedure is activated each time the
process object is updated. It reads the updated value and sends it to NET by using
cross-reference data.
The qualifier byte of the IEC 60870-5-104 integrated totals has a five-bit sequence
number that is increased every time the information object is successfully sent to the
IEC master. In this example the sequence number is stored in the RI attribute of the
process object.
#ERROR CONTINUE

@FX = 'LN':PFX'IX'

@SQ = 'LN':PRI'IX' ;sequence number
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
@CA = 0
@QUAL= %SQ+32*%OF+64*%CA+128*%IV
;reset status
@S = STATUS
68

#SET
STA'STA_NR':SEV(%CLASS)=(%TYPE,%ADDR,%PC,3,%QUAL,%PRI,%RT,%RM)
#SET STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%PC,3,%QUAL,%PRI,%OW)
;increase/reset sequence number, if sending successful

#IF STATUS == 0 #THEN #BLOCK
#IF %SQ >= 31 #THEN @SQ = 0
#SET 'LN':PRI'IX' = %SQ+1
#BLOCK_END
Bit strings
The IEC 60870-5-104 protocol provides ASDUs 7 and 8 for transferring 32-bit strings.
In the SYS 600 implementation the bit string must be converted into an integer, when
the string is sent to the IEC master by using the SD and EV attributes. This conversion
is done by using the BIT_SET function as shown in the example below.
@FX = 'LN':PFX'IX'

#IF %OS == 2 #THEN @NT = 1
#ELSE @NT = 0
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
@OR = 0
;convert the 32 least significant bits of the bit string to an

integer
@LIMITED = SUBSTR(%BS,1,32)
@VALUE = 0
#LOOP_WITH I = 0..31
#IF BIT(%LIMITED,%I+1) == 1 #THEN @VALUE = BIT_SET(%VALUE,%I)
#LOOP_END

#SET
STA'STA_NR':SEV(%CLASS)=(%TYPE,%ADDR,%VALUE,3,%QUAL,%PRI,%RT,%RM)
#SET STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%VALUE,3,%QUAL,%PRI,%OW)
69

5.5.2.2 Command handling in IEC 60870-5-104 protocol
Command confirmation
The IEC 60870-5-104 protocol includes the concept of command confirmations. Basically
a confirmation is a message sent by the slave indicating that a command has been received,
executed or rejected. Commands are confirmed in two steps as follows:
• A command is confirmed when it is received. An activation confirmation can be
positive (command accepted) or negative (command rejected).
• A command is terminated when its execution is finished. An activation termination
can be positive (command successfully completed) or negative (command failed).
The following exceptions apply:
• Select-type data commands and test commands (ASDU 104) are only confirmed,
not terminated.
• Clock synchronisation commands (ASDU 103) and reset process commands (ASDU
105) are not confirmed or terminated.
In the IEC 60870-5-104 Slave protocol commands are confirmed and terminated by
using the CF (Command Confirmation) attribute of the IEC slave station.
If bit 8 of the RM-attribute is set, the incoming commands are checked and if the
command contains an unsupported cause of transmission, information object address or
the ASDU type itself is not supported, a negative confirmation with cause of transmission
44,45 or 47 is sent automatically and the process object in the database is not updated.
In addition to this, if bit 3 (Process commands with invalid CAA) of the line attribute
OM is set and no STA object with matching Common Address of ASDU is configured,
a negative confirmation with cause of transmission 46 is sent. See the descriptions of
the station attribute RM and line attribute OM.
The meaning of these cause of transmission values:
44 unknown type identification
45 unknown cause of transmission
46 unknown common address of asdu
47 unknown information objects address
Command transactions
In the SYS 600 implementation of the IEC 60870-5-104 slave protocol 60 command
transactions can be open at the same time. When a command is confirmed by using the
CF attribute, a command with a matching ASDU number and address is searched from
the buffer. If a match is found, a confirmation or termination message is sent to the master
and if not, status 13860 = ICCC_NO_ACTIVE_COMMAND is returned.
70
Set the value of the PC attribute of each IEC slave station to

0 when confirming commands from SCIL. Otherwise
commands may not be properly confirmed or terminated.
Process object receiving commands

As stated before, commands received from the IEC master are seen as input data by the
slave and command messages can be received by IEC type process objects.
These process objects activate an event channel, which executes a command procedure.
The following attribute values should be the same for all the process objects receiving
command from the master:
• The value of the AN (Action Enabled) attribute should be 1
• The value of the AA (Action Activation) attribute should be 2 (update)
• The value of the AF (Action at First Update) attribute should be 1
5.5.2.3 Command procedures for data commands
The commands sent from the IEC master to SYS 600 are seen as input data and received
by IEC type input process objects.
When this kind of input is updated the value is read by a command procedure and, if
necessary, converted before it is written to the actual output objects which send the
command to the process devices. The command procedure is activated through an event
channel, which is bound to the input object.
The number of the output process objects and the SCIL statements used for sending the
commands to the process devices depend on the protocol of the device. Each controllable
SPA object, for example the circuit breaker, has four output process objects, whereas
each RTU or IEC object has only one.
It is also possible to utilize the input data to perform arbitrary internal operations in the
application program. The procedures that are presented below cover the basic cases when
IEC commands and setpoints can be mapped directly onto the corresponding SYS 600
outputs. If a more complex relationship between input and outputs is desired, it is
necessary to build application specific command procedures.
Object commands
Object commands, such as switching device open/close commands or tap changer
raise/lower commands contain the ASDUs shown in Table 5.12 below. The table also
includes the type of process object that can receive these commands.
Table 5.12: ASDUs of the object commands and process objects that receive these
commands
Type id ASDU Description Process Object Type
45 C_SC_NA_1 Single Command Binary Input
71

46 C_DC_NA_1 Double Command Double Binary Indication

47 C_RC_NA_1 Regulating Step Command Double Binary Indication
58 C_SC_TA_1 Single command with time Binary Input
tag CP56Time2a
59 C_DC_TA_1 Double command with time Double Binary Indication
tag CP56Time2a
60 C_RC_TA_1 Regulating step command Double Binary Indication
The unit number (UN attribute) of the input process object must be the same as the STA
object number of the corresponding IEC slave station, and the address of the process
object must equal to the address of the command in the IEC master. Table 5.13 shows
the updated attributes of the input process objects, which receive commands.
Table 5.13: Updated attributes of the input process objects
Attribute Values Description
TY 45... 47, 58...60 Type identification of the ASDU
OV 0,1,2 Value of the command 0 = off, 1 = on (single command),
1 = off, 2 = on (double command), 1 = lower, 2 = higher
(regulating step command)
RA 0, 1 Execution information of the command: 1 = select, 0 =
execute
RB 0... 255 Qualifier of the command
CT 6, 8 Cause of transmission of the command
OG 0... 255 Originator address of the command
In the following examples the process object receiving the command has the same logical
name as the output objects. The station number of the IEC slave station is assumed to
be 1. The first example is a single command for a SPA device with output process object
indices as follows: open select 11, close select 12, execute 13 and cancel 13.
;send activation confirmation if execute command
#IF %RA == 0 #THEN #SET STA1:SCF = (256*%OG+%CT+1,'LN':POA'IX')
;reset status
@S = STATUS
;route the command to the output objects

#IF %CT == 8 #THEN #SET 'LN':POV14 = 1 ; deactivate COT (cancel)
#ELSE_IF %CT == 6 #THEN #BLOCK ; activate COT
;select
#IF %RA == 1 #THEN #BLOCK
#IF %OV == 0 #THEN #SET 'LN':POV11 = 1 ; open select
#ELSE #SET 'LN':POV12 = 1 ; close select
#BLOCK_END
;execute
72
#ELSE #SET 'LN':POV13 = 1

#BLOCK_END
;send activation confirmation (select) or termination (execute)

#IF STATUS == 0 #THEN @CONF_STATUS = 0 ; positive
#ELSE @CONF_STATUS = 64 ; negative
#IF %RA == 0 #THEN @COT = 10 ;termination
#ELSE @COT = %CT+1 ; confirmation
#SET STA1:SCF = (256*%OG+%CONF_STATUS+%COT,'LN':POA'IX')
The second example is a double command for a RTU device with one
output process object with index 13.

;reset status
@S = STATUS
;route the command to the output objects

#IF %CT == 8 #THEN #SET 'LN':POV14 = 1 ; deactivate COT (cancel)
#ELSE_IF %CT == 6 #THEN #BLOCK ; activate COT
;select
#IF %RA == 1 #THEN #BLOCK
#IF %OV == 0 #THEN #SET 'LN':POV11 = 1 ; open select
#ELSE #SET 'LN':POV12 = 1 ; close select
#BLOCK_END
;execute
#ELSE #SET 'LN':POV13 = 1
#BLOCK_END

Analog setpoints
Analog output block messages from the IEC master can be received by AI (Analog Input)
process objects.
The unit number (UN attribute) of the input process object must be the same as the STA
object number of the corresponding IEC slave station, and the address of the process
object must be equal to the address of the command in the IEC master.
The attributes in the following Table of the input process objects receiving the commands
are updated.
73

Table 5.14: The updated attributes of the input process objects receiving setpoint
commands
TY 48...50, 61...63 Type identification of the ASDU
OV Real Value, range depends on the ASDU
RA 0, 1 Execution information of the command:
1 = select, 0 = execute
RB 0...255 Control status of the command
If the value of the setpoint command is a scaled or normalised value, its value range is
–32768...32767. It may be necessary to scale the value to another range by using a
procedure inverse to the one used for sending normalised and scaled analog values to
the IEC master. The scale object used in the following example is the same as the one
with analog inputs. The process device in this example does not support
select-before-execute analog setpoint commands.
;reset status
@S = STATUS
;accept only activate/execute command

#IF %RA == 1 AND %CT == 6 #THEN #BLOCK
;scale if scaled/normalizrd value

#CASE %TY
#WHEN 48,49 @VALUE = ROUND(SCALE(%AI,"AI_TO_S16","OUTPUT"))
#OTHERWISE @VALUE = %AI
#CASE_END
#SET 'LN':POV12 = %VALUE
#BLOCK_END

Bit strings
In IEC protocol it is possible to send 32-bit strings also from the master to the slave.
ASDU 51 and 64 are reserved for this purpose. Bit strings can be received by analog
input process objects as unsigned 32 bit integers. This analog value can be coverted to
a bit string by using SCIL statements.
74
5.5.2.4 Command procedures for application commands
Application commands contain the ASDUs shown in Table 5.15.

Table 5.15: The ASDUs that are included in the application commands
100 C_IC_NA_1 Interrogation command
101 C_CI_NA_1 Counter interrogation command
102 C_RD_NA_1 Read command
105 C_RP_NA_1 Reset process command
Application commands are received by an IEC type analog input with a unit number
(UN attribute) equal to the STA object number of the IEC slave station. In addition to
this, the object address (OA attribute) should be 0. When an application command is
received, the attributes of the process object are updated as presented in Table 5.16.
Table 5.16: Updated attributes of the process object
OV 100... 105 Type identification of the ASDU.
RA 0... 16777215 Information object address of the com-
mand. Depends on the value of the IL
attribute.
RB 0... 255 Qualifier of the command.
CT 6, 8 Cause of transmission of the command.
OG 0... 255 Originator address of the command. De-
pends on the value of the CL attribute.
This process object should execute the event channel and command procedures, which
recognise the incoming command, execute other command procedures depending on the
command and confirm the commands. An example of this kind of command procedure
is listed below. The sub-procedures are presented in the following sections.
#ERROR CONTINUE
;STA number and originator of the NCC
@STA_NR = 'LN':PUN'IX'
@ORIG = 'LN':POG'IX'
;send activation confirmation, if not read command

#IF %AI <> 102 #SET STA'STA_NR':SCF = (256*%ORIGINATOR+7,0,%AI)
;command specific part

#CASE %AI
;general interrogation
#WHEN 100 #EXEC GENINT:C (@STA_NUMBER = %STA_NR,@ORIGINATOR =
%ORIG)
;counter interrogation
75

#WHEN 101 #EXEC CNTINT:C (@STA_NUMBER = %STA_NR,@ORIGINATOR =

%ORIG)
;read
#WHEN 102 #EXEC RDDATA:C (@STA_NUMBER =
%STA_NR,@READ_OBJECT_ADDRESS = %RA)
;reset process
#WHEN 105 #EXEC RESPRC:C (@STA_NUMBER = %STA_NR,@ORIGINATOR =
%ORIG)
#CASE_END
General interrogation command

When the IEC slave station receives a general interrogation command from the master,
it must send all the input signals except pulse counters to the master without time tag.
The cause of transmission is set to 20. An example of the general interrogation command
procedure GENINT is listed below. The procedure is executed by the application
command handling procedure of the previous section.
#ERROR CONTINUE
;find all process objects with cross-reference data

#LOOP
@XREF_OBJECTS = APPLICATION_OBJECT_LIST(0,"IX","A","F","",-
"IU==1 AND SS>0 AND FX<>""""",("FX","OS","PT","OV","LN",-
"IX","BL","SB","OR"),10000)
#IF LENGTH(XREF_OBJECTS:VLN) > 0 #THEN #BLOCK
;initialize static data objects in NET

#LOOP_WITH SIGNAL = 1.. LENGTH(XREF_OBJECTS:VLN)
;cross-reference data
@FX = XREF_OBJECTS:VFX(%SIGNAL)
;type id without time tag

#IF SUBSTR(%TYPE,6,1) == "T" #THEN -
@TYPE = SUBSTR(%TYPE,1,5) + “N” + SUBSTR(%TYPE,7,0)
; substitution value and flag for each data type

@OV = XREF_OBJECTS:VOV(%SIGNAL)
@OS = XREF_OBJECTS:VOS(%SIGNAL)
@OR = XREF_OBJECTS:VOR(%SIGNAL)
@BL = XREF_OBJECTS:VBL(%SIGNAL)
@SB = XREF_OBJECTS:VSB(%SIGNAL)
76
#IF %OS == 2 #THEN @NT = 1

#ELSE @NT = 0
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
#CASE XREF_OBJECTS:VPT(%SIGNAL)
#WHEN 3 #BLOCK ; binary input
@SUBS_VALUE = 1
@QUAL = %OR+16*%BL+32*%SB+64*%NT+128*%IV
#BLOCK_END
#WHEN 9 #BLOCK ;analog input
@SUBS_VALUE = 0
@QUAL= %OV+2+16*%BL+32*%SB+64*%NT+128*%IV
#BLOCK_END
#WHEN 12 #BLOCK ;double binary input
@SUBS_VALUE = 1
@DPIS = (0,2,1,3)
@DPI = %DPIS(%OV+1)
@QUAL = BIT(%DPI,0)+2*BIT(%DPI,1)+16*%BL+32*%SB+64*%NT+128*%IV
#BLOCK_END
#CASE_END
;if not sampled or error, give substitution value

#IF %OS >= 10 #THEN @VALUE = %SUBS_VALUE
#ELSE @VALUE = XREF_OBJECTS:VOV(%SIGNAL)
#SET
STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%VALUE,20,%QUAL,%PRI,%OW)
#LOOP_END
#BLOCK_END
#IF NOT XREF_OBJECTS:VMORE #THEN #LOOP_EXIT
#LOOP_END
;send activation termination

#SET STA'STA_NUMBER':SCF = (256*%ORIGINATOR+9,0,100)
IEC 60870-5-104 also contains a group interrogation function. When this function is
used, the signals to be sent to the IEC master are divided into groups which can be
interrogated one at the time. The command procedure listed above can be modified to
support group interrogations as follows:
• Interrogation group number (integer 1...16) is added to the cross-reference data
stored in the FX attribute.
• The number of the interrogation group is read from the RB attribute of the AI process
object that receives the command.
• The query condition of the command procedure is modified to search only the process
objects with the specified group number. Note that the group 20 stands for the general
interrogation and in this case all signals must be sent.
• When executing the group interrogation commands, the cause of transmission of
the signals must be set to 20+group number.
77

Counter interrogation command

The counter interrogation command is like a general interrogation but for only pulse
counters. The counter interrogation procedure listed below can also be modified to
support the group interrogation as described in the previous section. The only difference
is that there are only four possible groups.
#ERROR CONTINUE
;find all pulse counter process objects with cross-reference data

#LOOP
@XREF_OBJECTS = APPLICATION_OBJECT_LIST(0,"IX","A","F","",-
"IU==1 AND SS>0 AND PT == 13 AND FX<>""""",("FX","OS","OV","LN",-
"IX","BL","SB","OF","RI"),10000)
#IF LENGTH(XREF_OBJECTS:VLN) > 0 #THEN #BLOCK
;initialize static data objects in NET

#LOOP_WITH SIGNAL = 1.. LENGTH(XREF_OBJECTS:VLN)
@FX = XREF_OBJECTS:VFX(%SIGNAL)
;type id without time tag

#IF SUBSTR(%TYPE,6,1) == "T" #THEN -
@TYPE = SUBSTR(%TYPE,1,5) + “N” + SUBSTR(%TYPE,7,0)
;substitution value and qualifier
@OV = XREF_OBJECTS:VOV(%SIGNAL)
@OS = XREF_OBJECTS:VOS(%SIGNAL)
@OF = XREF_OBJECTS:VOF(%SIGNAL)
@SQ = XREF_OBJECTS:VRI(%SIGNAL)
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
@QUAL= %SQ+32*%OF+128*%IV
#IF %OS >= 10 #THEN @VALUE = 0
#ELSE @VALUE = XREF_OBJECTS:VOV(%SIGNAL)
;reset status
@S = STATUS
;send the value to NET

#SET
STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%VALUE,37,%QUAL,%PRI,%OW)
;increase/reset sequence number, if sending successful

#IF STATUS == 0 #THEN #BLOCK
78
#IF %SQ >= 31 #THEN @SQ = 0

#SET 'LN':PRI'IX' = %SQ+1
#BLOCK_END
#LOOP_END
#BLOCK_END
#IF NOT XREF_OBJECTS:VMORE #THEN #LOOP_EXIT
#LOOP_END
;send activation termination

#SET STA'STA_NUMBER':SCF = (256*%ORIGINATOR+9,0,100)
Read command
By using the Read command, the user can request the value of an individual signal from
the IEC master. The requested signal is sent with the cause of transmission value 5. Note
that pulse counters are not included in the Read command.
#ERROR CONTINUE
;fx attribute to be searched

@READ_FX = "%%%%%%%%%%%%%%%" + DEC(%READ_OBJECT_ADDRESS,8) + "*"
;find the process objects with the given address

@READ_OBJECT = APPLICATION_OBJECT_LIST(0,"IX","A","F","",-
"(PT==3 OR PT==6 OR PT==9 OR PT==12) AND FX==%READ_FX",-
("FX","OS","PT","OV","LN","IX","BL","SB","OR","OF"),1)
#IF LENGTH(READ_OBJECT:VLN) > 0 #THEN #BLOCK
@FX = READ_OBJECT:VFX(1)
;substitution value and flag for each data type

@OV = READ_OBJECT:VOV(1)
@OS = READ_OBJECT:VOS(1)
@OR = READ_OBJECT:VOR(1)
@BL = READ_OBJECT:VBL(1)
@SB = READ_OBJECT:VSB(1)
@OF = READ_OBJECT:VOF(1)
#IF %OS == 2 #THEN @NT = 1
#ELSE @NT = 0
#IF %OS == 1 OR %OS == 10 #THEN @IV = 1
#ELSE @IV = 0
#CASE READ_OBJECT:VPT(1)
#WHEN 3 #BLOCK ; binary input
79

@SUBS_VALUE = 1
@QUAL = %OR+16*%BL+32*%SB+64*%NT+128*%IV
#BLOCK_END
#WHEN 6 #BLOCK ; digital input
@SUBS_VALUE = 0
#BLOCK_END
#WHEN 9 #BLOCK ;analog input
@SUBS_VALUE = 0
@QUAL= %OV+2+16*%BL+32*%SB+64*%NT+128*%IV
#BLOCK_END
#WHEN 12 #BLOCK ;double binary input
@SUBS_VALUE = 1
@DPIS = (0,2,1,3)
@DPI = %DPIS(%OV+1)
@QUAL = BIT(%DPI,0)+2*BIT(%DPI,1)+16*%BL+32*%SB+64*%NT+128*%IV
#BLOCK_END
#CASE_END
;if not sampled or error, give substitution value

#IF %OS >= 10 #THEN @VALUE = %SUBS_VALUE
#ELSE @VALUE = READ_OBJECT:VOV(1)
;send the value to NET with requested COT

#SET STA'STA_NR':SSD(%CLASS)=(%TYPE,%ADDR,%VALUE,5,%QUAL,%PRI,%OW)
#BLOCK_END
Read commands (ASDU 102) are not confirmed by using the

CF attribute.
Reset process command

Actions that should be taken with the reset process command may vary from one
application to another. This command is problematic since we cannot, for example,
switch off the base system computer by using SCIL. Some actions that can be taken with
these commands are listed below.
• Restart PC-NET by setting LINn:BLT to “NONE” and after a pause back to
“INTEGRATED”. After this, the lines and stations configured to this NET unit must
be created again.
• Reset the message queues in the NET unit by using the RS attribute of the IEC slave
station.
• Send an interrogation command to all the process devices. This will update the
process database, and thus the NET database, all the way from the process devices.
Reset process commands (ASDU 105) are confirmed by using

the CF attribute.
80
5.5.2.5 Command procedures for system commands
System commands include the ASDUs presented in Table 5.17.

Table 5.17: ASDUs that are included in system commands
103 C_CS_NA_1 Clock synchronisation command
104 C_TS_NA_1 Test command (to be used with IEC60870-5-
101 only)
107 C_TS_TA_1 Test command with time tag CP56Time2a (to
be used with IEC60870-5-104 only)
System commands are received by a bit stream process object with a unit number equal
to the STA object number of the IEC slave station, and an address as defined by the CA
attribute of the IEC slave station. NET sends the messages to this process object as
transparent data and they must be interpreted by using SCIL statements.
Commands not recognised by NET are also sent to this process object, if this feature is
enabled by the RM attribute of the IEC slave station.
Since synchronisation is handled by the NET and the test command requires only a
confirmation, the only action needed is the confirmation of the system commands.
This process object should execute the event channel and command procedures, which
recognise the incoming command, interpret the address of the command, and confirm
the commands. An example of this kind of command procedure is listed below:
;STA number and originator address of the NCC
@STA_NR = 'LN':PUN'IX'
@ORIGINATOR = 'LN':POG'IX'
;unpack the system command
@SYS_CMD = UNPACK_STR(%BS,8)
;type of command
@CMD_TYPE = %SYS_CMD(3)
;calculate the address of the command

@CMD_ADDR = 0
@STA_ADDR_END = 3 + STA'STA_NR':SPL + STA'STA_NR':SCL +
STA'STA_NR':SSL
#LOOP_WITH I = 1..(STA'STA_NR':SIL)
@CMD_ADDR = %CMD_ADDR + (256**(%I-1))*(%SYS_CMD(%STA_ADDR_END+%I))
#LOOP_END
;send activation confirmation

#SET STA'STA_NR':SCF =
(256*%ORIGINATOR+7,ROUND(%CMD_ADDR),%CMD_TYPE)
81

5.5.2.6 Command procedures for transparent data commands
It is possible to exchange transparent messages between a SYS 600 IEC slave and an
IEC master. An example of this kind of messages could be SPA messages. Transparent
SPA messages are received by a bit stream process object and the corresponding reply
is sent as a confirmation by using the CF attribute of the IEC slave station.
The example shown in Figure 5.4 has two SYS 600 base systems, one as the network
control system (IEC master) and one as the substation control system (IEC slave). The
latter acts also as the master for several SPA devices. In this example, a transparent SPA
command is sent from the IEC master to the SPA unit via the SYS 600 IEC slave and
the answer from the SPA unit is sent back to the IEC master. The following steps are
taken according to Figure 5.4.
Step 1 : The SPA command “RF:” is sent from the IEC master to the
IEC slave to address 12345 as an encapsulated SPA message
(ASDU 133) by using the TD attribute as in the following:
#SET STA1:STD = (133,12345,6,”RF:”)
Step 2 and 3: The message is received by the IEC slave in a bit stream process
object with the UN attribute equal to the STA object number of
the IEC slave station and the OA attribute value equal to the ad-
dress of the command, which is 12345 in this case. Attached to
this process object is an event channel, which activates a com-
mand procedure. The SPA message is parsed by the command
procedure as in the following:
@SPA_MSG = TYPE_CAST(%BS,"TEXT")
The SPA message is sent to the SPA unit and the corresponding
answer is read by using the SM attribute of the SPA station as in
the following:
#SET STA2:SSM = %SPA_MSG

@SPA_ANSW = STA2:SSM
Step 4: The answer is sent back to the IEC master as an activation con-
firmation of the command, i.e. the encapsulated SPA reply mes-
sage, as in the following:
@IEC_STA_NR = 'LN':PUN'IX'
@ORIG = 'LN':POG'IX'
@CMD_ADDR = 'LN':POA'IX'
@CMD_TYPE = 'LN':PTY'IX'
#SET STA'IEC_STA_NR':SCF = -
(256*%ORIG+7,%CMD_ADDR,%CMD_TYPE,%SPA_ASW)
82
The message is received by the IEC master in a bit stream process objects with the UN
attribute equal to the STA object number of the IEC slave station and the OA attribute
equal to the address of the command. In this case, the message can also be interpreted
by using the TYPE_CAST function to convert the message into text.
IEC 60870-5-104
Figure 5.4: Flow of the transparent SPA messages
By using a mechanism like the one described above, it is possible to read and write the
parameters of SPA units over an IEC 60870-5-104 line. The same kind of mechanism
can also be used for other purpose, e.g for exchanging free-format text messages between
the master and the slave.
5.5.2.7 Command procedures for file transfer
In COM 500i command procedures COM_USFT and COM_IEFT handle the file
transmission. Command procedures check cyclically, if the source directory contains
files to be transmitted. Source directory is defined with the cross-reference tool. When
requested, the directory listing of transferable files is sent to the IEC 60870-5-101 master
protocol. File transfer commands contain the ASDUs shown in Table 5.18.
Table 5.18: ASDUs for File Transfer
120 F_FR_NA_1 File Ready
121 F_SR_NA_1 Section ready
122 F_SC_NA_1 Call directory, se-
lect file
83

123 F_LS_NA_1 Last section, last

segment
124 F_AF_NA_1 Ack file, ack sec-
tion
125 F_SG_NA_1 Segment
126 F_DR_TA_1 Directory
5.5.2.8 Command procedure for the end of initialisation message
In the IEC 60870-5-104 protocol the slave station sends a specific message, end of
initialisation (ASDU 70), after the slave station is initialised (i.e. when it is ready to
normal operation after start-up).
An example of a command procedure sends the end of initialisation message to the IEC
master. This command procedure can be executed, for example, from the predefined
command procedure APL_INIT_1. The execution should be timed so that the message
is sent after all the process objects are updated from the process devices.
;send end of initialization (zero address and value)
#SET STA'COM_IEC_STA_NUMBER':SSD(1) = ("M_EI_NA_1",0,0,4,0,0,0)
5.6 Command procedures for parameter in control direction

In the IEC 60870-5-104 protocol it is possible for the master to set and activate the
parameters of information objects of the IEC slave. Setting the limits of a measured value
can be mentioned as an example of this kind of action. The following ASDUs are provided
by the protocol.
Table 5.19: ASDUs for parameters in control direction
110 P_ME_NA_1 Parameter of measured values, norm-
alised value
111 P_ME_NB_1 Parameter of measured values, scaled
value
112 P_ME_NC_1 Parameter of measured values,
short floating point number.

113 P_AC_NA_1 Parameter activation
In case RM bit 7 is set to 0, these ASDUs can be received by the same bit stream process
object as system commands, and their handling can be included in the same command
procedure that handles the system commands.
By using the UNPACK_STR function, the parameter ASDU can be converted into a
vector whose elements are the octets of the message. The position and number of the
84
elements depend on the address lengths, i.e. the value of the PL, SL and IL attributes of
the IEC slave station.
In case RM bit 7 is set to 1, the incoming ASDUs 110-112 are handled as set-point
commands. In this case the updated process object is of type analog input and the OA
of the process object is defined by the information object address field of the incoming
message. With this configuration, the bitstream process object is not updated.
Table 5.20 presents the information elements of an ASDU 110 message as decimal
numbers. The IEC slave station has the following address length attributes: PL=1, SL=2,
IL=3, CL=2.
Table 5.20: The information elements of an ASDU 110 message
Octet Value Description
1 243 Control byte
2 12 Link address
3 110 Type id of ASDU
4 1 Variable structure qualifier (one ob-
ject)
5 6 Cause of transmission (activation)
6 0 Originator address
7 12 First byte of common address of
ASDU
8 0 Second byte of common address of
ASDU
9 123 First byte of information object ad-
dress
10 0 Second byte of information object ad-
dress
11 0 Third byte of information object ad-
dress
12 111 First byte of the value of the paramet-
er
13 0 Second byte of the value of the para-
meter
14 2 Qualifier of the parameter
15 108 Checksum of the message
The actions taken depend on the value of some of the octets. The values listed in
Table 5.21 are possible.
Table 5.21: The values of information elements
Octet Values
Type id of ASDU 110…113, see Table 5.19
Cause of transmission 6 = activate, 8 = deactivate
85

Value ASDU 110: Parameter as normalised value
ASDU 111: Parameter as scaled value
ASDU 112: Parameter as short floating point number
ASDU 113: Not included

Qualifier ASDUs 110…112: 1=threshold value, 2=smoothing
factor, 3=low limit, 4=high limit
ASDU 113: 1=act/deact previously loaded paramet-

ers, 2=act/deact of the addressed object, 3=act/deact
cyclic transmission
5.7 Signal engineering

The term signal engineering here means the engineering needed for establishing the
communication to NCC using IEC protocol. The signal engineering in COM 500i is
made using the signal X-reference tool after the system configuration is completed and
the process database for the related to process devices is ready. The signal engineering
process has been described in detail in COM 500i Users Guide manual of the SYS 600
product. The principal sequence for the signal engineering is:
1. Make a list of all signals that are to be transferred between the master and the slave.
Include at least the ASDU type and address.
2. Determine the need for redundancy and update the system configuration
correspondingly.
3. Define the NCCs, communication mode and the cross-reference data using the Signal
X-references tool of COM 500i.
4. Test each signal.
5.8 Status codes

The following status codes are defined for the IEC 60870-5-104 Slave protocol. Some
typical reasons for some of the status codes are also given.
Status codes are sent as system messages, which can be received by analog input project
objects with a unit number (UN) 0 and an object address (OA) as determined by the MI
attribute of the line or station, or alternatively, they are returned as a response to a SCIL
command accessing a IEC station object.
Line layer status codes

For more information about the status codes, see Status Codes manual.
Station layer status codes

For more information about the status codes, see Status Codes manual.
86
5.9 Interoperability list
5.9.1 Interoperability
This companion standard presents sets of parameters and alternatives from which subsets
must be selected to implement particular telecontrol systems. Certain parameter values,
such as the choice of "structured" or "unstructured" fields of the INFORMATION
OBJECT ADDRESS of ASDUs represent mutually exclusive alternatives. This means
that only one value of the defined parameters is admitted per system. Other parameters,
such as the listed set of different process information in command and in monitor direction
allow the specification of the complete set or subsets, as appropriate for given applications.
This clause summarizes the parameters of the previous clauses to facilitate a suitable
selection for a specific application. If a system is composed of equipment stemming
from different manufacturers, it is necessary that all partners agree on the selected
parameters.
The interoperability list is defined as in IEC 60870-5-101 and extended with parameters
used in this standard. The text descriptions of parameters which are not applicable to
this companion standard are strike-through (corresponding check box is marked black).
In addition, the full specification of a system may require

individual selection of certain parameters for certain parts of
the system, such as the individual selection of scaling factors
for individually addressable measured values.
Application layer telegram formats

The selected parameters should be marked in the white boxes as follows:
Function or ASDU is not used
Function or ASDU is used as standardized (default)
Function or ASDU is used in reverse mode
Function or ASDU is used in stardard and reverse mode
Function or ASDU may need some additional application level work
The possible selection (blank, X, R, or B) is specified for each specific clause or

parameter.
A black check box indicates that the option cannot be selected in this companion standard.
5.9.1.1 System or device
(system-specific parameter)
87

System definition
Controlling station definition (Master)
Controlled station definition (Slave)
5.9.1.2 Network configuration
(network-specific parameter)
Point-to-point Multipoint-partyline
Multiple point-to-point Multipoint-star
5.9.1.3 Physical layer
(network-specific parameter)
Transmission speed (control direction)

Unbalanced inter- Unbalanced inter- Balanced interchange Circuit X.24/X.27
change Circuit change Circuit
V.24/V.28 Standard V.24/V.28 Recommen-
ded if >1 200 bit/s
100 bit/s 2400 bit/s 2400 bit/s 56000 bit/s
300 bit/s 9600 bit/s 9600 bit/s
600 bit/s 19200 bit/s
1200 bit/s 38400 bit/s
Transmission speed (monitor direction)

ded if >1 200 bit/s
300 bit/s 9600 bit/s 9600 bit/s
600 bit/s 19200 bit/s
88

ded if >1 200 bit/s
1200 bit/s 38400 bit/s
5.9.1.4 Link layer
(network-specific parameter).
Frame format FT 1.2, single character 1 and the fixed time out interval are used
exclusively in this companion standard.
Link transmission Address field of the link
Balanced transmission Not present (balanced transmission only)
Unbalanced transmission One octet
Two octets
Structured
Unstructured
Frame length
Maximum length L (number of octets)
When using an unbalanced link layer, the following ASDU types are returned in class
2 messages (low priority) with the indicated causes of transmission:
The standard assignment of ASDUs to class 2 messages is used as follows:
Type identification Cause of transmission

9, 11, 13, 21 <1>
A special assigment of ASDUs to class2 is used as follows:
5.9.1.5 Application layer
Transmission mode for application data

Mode 1 (least significant octet first), as defined in 4.10 of IEC 60870-5-4, is used
exclusively in this companion standard.
89

Common address of ASDU

One octet Two octets
Information object address

One octet Structured
Two octets Unstructured
Three octets
Cause of transmission
One octet Two octets (with originator address).
Originator address is set to zero if not
used
Length of APDU
(system-specific parameter, specify the maximum length of the APDU per system)
The maximum length of APDU for both directions is 253. It is a fixed system parameter.
Maximum length of APDU per system in control direction
Maximum length of APDU per system in monitor direction
Selection of standard ASDUs

Process information in monitor direction
(station-specific parameter)
<1> := Single-point information M_SP_NA_1
<2> := Single-point information with time tag M_SP_TA_1
<3> := Double-point information M_DP_NA_1
<4> := Double-point information with time tag M_DP_TA_1
<5> := Step position information M_ST_NA_1
<6> := Step position information with time tag M_ST_TA_1
<7> := Bitstring of 32 bit M_BO_NA_1
90
<8> := Bitstring of 32 bit with time tag M_BO_TA_1
<9> := Measured value, normalized value M_ME_NA_1
<10> := Measured value, normalized value with time M_ME_TA_1

tag
<11> := Measured value, scaled value M_ME_NB_1
<12> := Measured value, scaled value with time tag M_ME_TB_1
<13> := Measured value, short floating point value M_ME_NC_1
<14> := Measured value, short floating point value M_ME_TC_1

with time tag
<15> := Integrated totals M_IT_NA_1
<16> := Integrated totals with time tag M_IT_TA_1
<17> := Event of protection equipment with time tag M_EP_TA_1
<18> := Packed start events of protection equipment M_EP_TB_1

with time tag
<19> := Packed output circuit information of protec- M_EP_TC_1
tion equipment with time tag
<20> := Packed single-point information with status M_PS_NA_1
change detection
<21> := Measured value, normalized value without M_ME_ND_1
quality descriptor
<30> := Single-point information with time tag M_SP_TB_1
CP56Time2a
<31> := Double-point information with time tag M_DP_TB_1
CP56Time2a
<32> := Step position information with time tag M_ST_TB_1
CP56Time2a
<33> := Bitstring of 32 bit with time tag CP56Time2a M_BO_TB_1
<34> := Measured value, normalized value with time M_ME_TD_1

tag CP56Time2a
<35> := Measured value, scaled value with time tag M_ME_TE_1
CP56Time2a
<36> := Measured value, short floating point value M_ME_TF_1
<37> := Integrated totals with time tag CP56Time2a M_IT_TB_1
<38> := Event of protection equipment with time tag M_EP_TD_1

CP56Time2a
<39> := Packed start events of protection equipment M_EP_TE_1
<40> := Packed output circuit information of protec- M_EP_TF_1
tion equipment with time tag CP56Time2a
91

Although ASDUs <2>, <4>, <6>, <8>, <10>, <12>, <14> and <16> are not part of the
IEC 6870-5-104 companion standard, they are also supported to provide compatibility
with gateway devices using IEC 60870-5-101.
Process information in control direction

<45> := Single command C_SC_NA_1
<46> := Double command C_DC_NA_1
<47> := Regulating step command C_RC_NA_1
<48> := Set point command, normalized C_SE_NA_1

value
<49> := Set point command, scaled value C_SE_NB_1
<50> := Set point command, short floating C_SE_NC_1

point value
<51> := Bitstring of 32 bit C_BO_NA_1
<58> := Single command with time tag C_SC_TA_1

CP56Time2a
<59> := Double command with time tag C_DC_TA_1
CP56Time2a
<60> := Regulating step command with time C_RC_TA_1
tag CP56Time2a
<61> := Set point command, normalized C_SE_TA_1
value with time tag CP56Time2a
<62> := Set point command, scaled value C_SE_TB_1
<63> := Set point command, short floating C_SE_TC_1
point value with time tag CP56Time2a
<64> := Bitstring of 32 bit with time tag C_BO_TA_1
CP56Time2a
Either the ASDUs of the set <45> – <51> or of the set <58> – <64> are used.
System information in monitor direction

<70> := End of initialization M_EI_NA_1
System information in control direction

<100>:= Interrogation command C_IC_NA_1
92
<101>:= Counter interrogation command C_CI_NA_1
<102>:= Read command C_RD_NA_1
<103>:= Clock synchronization command C_CS_NA_1
<104>:= Test command C_TS_NA_1
<105>:= Reset process command C_RP_NA_1
<106>:= Delay acquisition command C_CD_NA_1
<107>:= Test command with time tag C_TS_TA_1

CP56Time2a
Parameter in control direction

<110>:= Parameter of measured value, nor- P_ME_NA_1
malized value
<111>:= Parameter of measured value, P_ME_NB_1
scaled value
<112>:= Parameter of measured value, short P_ME_NC_1
floating point value
<113>:= Parameter activation P_AC_NA_1
File transfer
<120>:= File ready F_FR_NA_1
<121>:= Section ready F_SR_NA_1
<122>:= Call directory, select file, call file, F_SC_NA_1

call section
<123>:= Last section, last segment F_LS_NA_1
<124>:= Ack file, ack section F_AF_NA_1
<125>:= Segment F_SG_NA_1
<126>:= Directory {blank or X, only available F_DR_TA_1

in monitor (standard) direction}
<127>:= Query Log – Request archive file F_SC_NB_1
Type identifier and cause of transmission assignments

(station-specific parameters)
93

Shaded boxes are not required.

Blank = function or ASDU is not used.
Mark type identification/cause of transmission combinations:
"X" if used only in the standard direction
"R" if used only in the reverse direction
"B" if used in both directions
1 2 3 4 5 6 7 8 9 10 11 12 13 20 37 44 45 46 47
to to
36 41
<1> M_SP_NA_1
<2> M_SP_TA_1
<3> M_DP_NA_1
<4> M_DP_TA_1
<5> M_ST_NA_1
<6> M_ST_TA_1
<7> M_BO_NA_1
<8> M_BO_TA_1
<9> M_ME_NA_1
<10> M_ME_TA_1
<11> M_ME_NB_1
<12> M_ME_TB_1
<13> M_ME_NC_1
<14> M_ME_TC_1
<15> M_IT_NA_1
<16> M_IT_TA_1
<17> M_EP_TA_1
<18> M_EP_TB_1
<19> M_EP_TC_1
<20> M_PS_NA_1
<21> M_ME_ND_1
94

<30> M_SP_TB_1
<31> M_DP_TB_1
<32> M_ST_TB_1
<33> M_BO_TB_1
<34> M_ME_TD_1
<35> M_ME_TE_1
<36> M_ME_TF_1
<37> M_IT_TB_1
<38> M_EP_TD_1
<39> M_EP_TE_1
<40> M_EP_TF_1
<45> C_SC_NA_1
<46> C_DC_NA_1
<47> C_RC_NA_1
<48> C_SE_NA_1
<49> C_SE_NB_1
<50> C_SE_NC_1
<51> C_BO_NA_1
<58> C_SC_TA_1
<59> C_DC_TA_1
<60> C_RC_TA_1
<61> C_SE_TA_1
<62> C_SE_TB_1
<63> C_SE_TC_1
<64> C_BO_TA_1
<70> M_EI_NA_1
<100> C_IC_NA_1
95


<101> C_CI_NA_1
<102> C_RD_NA_1
<103> C_CS_NA_1
<104> C_TS_NA_1
<105> C_RP_NA_1
<106> C_CD_NA_1
<107> C_TS_TA_1
<110> P_ME_NA_1
<111> P_ME_NB_1
<112> P_ME_NC_1
<113> P_AC_NA_1
<120> F_FR_NA_1
<121> F_SR_NA_1
<122> F_SC_NA_1
<123> F_LS_NA_1
<124> F_AF_NA_1
<125> F_SG_NA_1
<126> F_DR_TA_1*
<127> F_SC_NB_1*
* Blank or X only.
5.9.1.6 Basic application functions
Station initialization
Remote initialization
Cyclic data transmission

96
Cyclic data transmission
Read procedure
Read procedure
Spontaneous transmission
Spontaneous transmission
Double transmission of information objects with cause of

transmission spontaneous
The following type identifications may be transmitted in succession caused by a single
status change of an information object. The particular information object addresses for
which double transmission is enabled are defined in a project-specific list.
Single-point information M_SP_NA_1, M_SP_TA_1, M_SP_TB_1 and M_PS_NA_1
Double-point information M_DP_NA_1, M_DP_TA_1 and M_DP_TB_1
Step position information M_ST_NA_1, M_ST_TA_1 and M_ST_TB_1
Bitstring of 32 bit M_BO_NA_1, M_BO_TA_1 and M_BO_TB_1 (if defined for a specific
project)
Measured value, normalized value M_ME_NA_1, M_ME_TA_1, M_ME_ND_1 and
M_ME_TD_1
Measured value, scaled value M_ME_NB_1, M_ME_TB_1 and M_ME_TE_1
Measured value, short floating point number M_ME_NC_1, M_ME_TC_1 and M_ME_TF_1
Station interrogation
(station-specific parameter or object-specific parameter)
global
group 1 group 7 group 13
97

group 5 group 11 Information object addresses

assigned to each group must
group 6 group 12 be shown in a separate table
Clock synchronization
Clock synchronization
Day of week used
RES1, GEN (time tag substituted/ not substituted) used
SU-bit (summertime) used
optional, see 7.6
Command transmission
Direct command transmission
Direct set-point command transmission
Select and execute command
Select and execute set-point command
C_SE ACTTERM used
No additional definition
Short-pulse duration (duration determined by a system parameter in the outstation) 1)
Long-pulse duration (duration determined by a system parameter in the outstation) 1)
Persistent output 1)
Supervision of maximum delay in command direction of commands and set point commands
con- Maximum allowable delay of commands and set point commands

figur-
able
1) The qualifier field of the command updates the RB attribute of the process object. This
value is freely used by the MicroSCADA application.
Transmission of integrated totals

(station-specific parameter or object-specific parameter)
98
Mode A: local freeze with spontaneous transmission
Mode B: local freeze with counter interrogation
Mode C: freeze and transmit by counter interrogation commands
Mode D: freeze by counter interrogation command, frozen values reported spontaneously
Counter read
Counter freeze without reset
Counter freeze with reset
Counter reset
General request counter
Request counter group 1
Parameter loading
(object-specific parameter)
Threshold value
Smoothing factor
Low limit for transmission of measured value
High limit for transmission of measured value
Parameter activation
Act/deact of persistent cyclic or periodic transmission of the addressed object
Test procedure
Test procedure
99

File transfer
File transfer in monitor direction
Transparent file
Transmission of disturbance data of protection equipment
Transmission of sequences of events
Transmission of sequences of recorded analogue values
File transfer in control direction

Transparent file
Background scan
Background scan
Acquisition of transmission delay

Acquisition of transmission delay
Definition of time-outs
Parameter Default value Remarks Selected value
t0 30 s Time-out of connection 1-255 s
establishment
t1 15 s Time-out of send or 1-255 s
test APDUs
t2 10 s Time-out for acknow- 1-255 s
ledges in case of no
data messages t2 < t1
t3 20 s Time-out for sending 1-255 s
test frames in case of
a long idle state
Maximum range for timeouts t0 to t2: 1 s to 255 s, accuracy 1 s.
100
Maximum number of outstanding I format APDUs k and latest

acknowledge APDUs (w)
Parameter Default value Remarks Selected value
k 12 APDUs Maximum difference 1-32767 s
receive sequence
number to send state
variable
w 8 APDUs Latest acknowledge 1-32767 s
after receiving w I
format APDUs
Maximum range of values k: 1 to 32767 (215–1) APDUs, accuracy 1 APDU

Maximum range of values w: 1 to 32767 APDUs, accuracy 1 APDU (Recommendation:
w should not exceed two-thirds of k).
Portnumber
Parameter Value Remarks
Portnumber 2404 Configurable with an optional
definition to the line attributes
LD.
Redundant connections
1...12 Number N of redundancy group connections used
RFC 2200 suite

RFC 2200 is an official Internet Standard which describes the state of standardization
of protocols used in the Internet as determined by the Internet Architecture Board (IAB).
It offers a broad spectrum of actual standards used in the Internet. The suitable selection
of documents from RFC 2200 defined in this standard for given projects has to be chosen
by the user of this standard.
Ethernet 802.3
Serial X.21 interface
Other selection from RFC 2200:
List of valid documents from RFC 2200

1.
2.
3.
4.
5.
6.
7. etc.
101

Appendix A Examples of communication system configuration
The following SCIL procedures make the communication system configuration which
is related to the base system configuration example presented earlier in this document.
The first procedure creates an IEC 60870-5-104 Slave line and two stations on this line.
;***************************************************************************
; INPUT PARAMETERS
@NET = 3 ; NODE NUMBER OF THE PC-NET
@LINE = 1 ; LINE NUMBER
@STATION = 1 ; SLAVE STATION NUMBER
@APPLIC = 1 ; APPLICATION NUMBER
;***************************************************************************
; CREATE AN IEC 60870-5-104 LINE TO NET
#IF NET'NET':SPO'LINE'==0 #THEN #BLOCK
#SET NET'NET':SPO'LINE' = 45 ;IEC 60870-5-104 slave
#SET NET'NET':SPD'LINE' = 20 ;polling detection (s)
#SET NET'NET':SMS'LINE' = %APPLIC ;message application
#SET NET'NET':SMI'LINE' = %LINE+(6000+(%NET*100));message
identifier
#SET NET'NET':SPS'LINE' = 50 ;buffer pool size
#SET NET'NET':STI'LINE' = 15 ;timeout interval (s)
#SET NET'NET':SIU'LINE' = 1 ;Set line in use
#BLOCK_END
;***************************************************************************
; CREATE IEC 60870-5-104 STATION TO NET
@STA=%STATION
#SET NET'NET':SDV(29) = (%STA,%LINE) ;create station to line
#SET STA'STA':SAL = 1 ;allocated
#SET STA'STA':SAS = %APPLIC ;allocated system
#SET STA'STA':SMI = 29000+%STA ;message identification
#SET STA'STA':SMS = %APPLIC ;message application
#SET STA'STA':SSE = 1 ;system messages enabled
#SET STA'STA':SSA = %ST ;station address
#SET STA'STA':SSL = 2 ;station address length
(bytes)
#SET STA'STA':SIL = 3 ;info addr. length (bytes)
#SET STA'STA':SCL = 1 ;COT length (bytes)
#SET STA'STA':STC = 0 ;time synchronisation
(0,1,2,3)
#SET STA'STA':SCA = 32000 ;command address
#SET STA'STA':SPC = 0 ;data conf. (0=man, 1=auto)
#SET STA'STA':SMT = 15 ;manual conf. waiting time
(s)
#SET STA'STA':SST = 5000 ;SYS waiting time (ms)
#SET STA'STA':SSU = 0 ;summer time (0=no, 1=yes)
102
#SET STA'STA':SRW = 10 ;reply window size

#SET STA'STA':SML = 230 ;max. message length
#SET STA'STA':SRM = 1 ;running mode
#SET STA'STA':SIA = “host“ ;hostname or IP address of the
remote host
#SET STA'STA':SUS = 12 ;unacknowledge send
#SET STA'STA':SUR = 8 ;unacknowledge receive
#SET STA'STA':SAT = 10 ;acknowledge timeout (s)
#SET STA'STA':SIU = 1 ;set station in use
103
Index
Command Address, 26
A Command Confirmation, 58
AA, 71 Command Control, 34
AC, 36 Command Delay, 27
Acknowledge Timeout, 33 Command procedures, 62
Active Connection, 36 Command transaction, 70
Additional Internet address, 23 Common address of ASDU, 49
Addressing, 49 Configuration, 11
AF, 71 Connection State, 37
AI, 23, 73 Counter interrogation, 78
AL, 25 Cross-reference data, 63
Allocating Application, 25 CS, 37
Allocation, 25 CT, 75
AN, 71 CY, 55
Analog
Inputs, 64 D
setpoints, 73
Analog Inputs, 64 Data commands, 71
APDU, 17 Data flow, 50
APDUs, 34 DC, 18, 31
Application Backup, 9 Diagnostic Counters, 18, 31
Application commands, 75 Digital Inputs, 67
Application Service Data Units (ASDUs), 21, 24, 35, Double Indications, 66
48
AS, 25 E
AT, 33
EA, 27
B End of initialisation, 84
EV, 34, 50, 55, 64, 69
Backup copies, 9 Event buffer overflow Address, 27
Balanced mode, 49 Event channel, 50, 63
Bit Strings, 69 Event Data with Time Stamp, 55
BL, 55 eXecute Timeout, 28
Buffer Pool Size, 17
F
C Fatal error, 9
CA, 26, 29, 55, 81 FB, 40
Cause of transmission (COT), 54, 57, 58, 75, 76, 85 FD, 39
Cause of Transmission (COT), 25 FF, 39
CC, 34 FI, 38
CD, 27 File Bytes, 40
CF, 58, 70, 80 File Directory, 39
CL, 25 File Information, 38
COM 500i, 62 File Name, 40
Command File Timeout, 39
Procedures, 62 File Transmission Status, 39
Transaction, 70 File Values, 42
105

FN, 40
FT, 39
M
FV, 42 Maximum Delayed Response Time, 34
FX, 63, 77 Maximum Message Length, 27
FX attribute, 63 Message Application, 18, 26
Message Identification, 18, 26
G MI, 18, 26, 86
ML, 27
General interrogation, 76 MS, 18, 26
Group interrogation, 77 MT, 34
Multidrop network topology, 14
H
Hostname, 22
N
NCC, 6, 62
I NET, 6, 31, 49
Network topologies, 13
IA, 22 No limitations, 13
IEC 60870-5-101 master protocol, 6 NT, 55
IEC 60870-5-101 slave protocol, 11
IEC Slave O
COM 500i, 62
IL, 25, 63, 84 OA, 75
Information Address Length, 25 Object commands, 71
Information object address, 49 Object Status, 32
Input data, 50 OF, 55
Integrated link, 11 OG, 75
Integrated totals, 68 OM, 19
Internet Address, 22 Operating Mode, 19
In Use, 15, 21 OR, 55
Invalid Time, 29 OS, 32
IP address, 22 Output data, 51
IU, 15, 21 OV, 55, 74, 75
IU attribute, 15, 21
IV, 29, 54
P
K Parameter in control direction, 84
PC, 28, 71
k, 35 PC-NET, 11, 48
PD, 17
L PL, 84
PO, 17
LD, 15 Polling Delay, 17
Length of Cause of Transmission Information, 25 Process Data Confirmation, 28
Level of implementation, 48 Process object types, 48
LI, 21 Protocol, 6, 17
Line Layer, 14 Protocol converter, 11, 49
Line Layer Attributes, 15 PS, 17
Line Number, 21 Pulse counters, 68
Link layer, 14
Local Address, 15
106
Status codes, 86
Q Line Layer, 86
QI, 32 Station Layer, 86
Queue Information , 32 Structured address, 49
STY Objects, 12
SU, 35
R Summer Time, 35
RA, 74, 75 SYS 600, 6
Radio Connection Wait Time, 38 SYS_BASCON.COM, 12
RB, 74, 75, 77 System
Read, conditional write, 13 Backup, 9
Read command, 79 Commands, 59, 81
Read-only, 13 Messages, 18, 26, 86
Remote host, 22, 35 Objects, 12, 13
Reply Window Size, 37 System Messages Enabled, 26
Reset Event Queues, 52, 61 SYS Waiting Time, 33
Reset process command, 80
Response Timeout, 18 T
RI, 68
RM, 28, 30, 51, 81 t1, 18
RS, 52, 61, 80 t2, 34
Running Mode, 30 t3, 17
RW, 34, 37 TC, 29
TCP Connect, 19
TD, 52, 82
S TI, 18
SA, 21, 49 Timeout, 34
SB, 55 Time Synchronization, 29
SD, 34, 50, 52, 64, 69 Transparent data, 61
SE, 26 Transparent Data, 52
Select-execute timeout, 30 Transparent SPA, 82, 83
Send Subdirectory, 45 Transport layer, 36
Signal address, 49 TY, 74
Signal Cross-Reference Tool, 62
Signal rerouting, 62 U
Signals, 62
Single Indications, 66 U(TESTFR), 17
SL, 24, 84 UN, 26, 72, 75, 86
SM, 82 Unacknowledge Receive, 35
SPA messages, 52 Unacknowledge Send, 35
Spontaneous Data, 52 Unstructured address, 49
SS, 45 UR, 35
ST, 33 US, 35
STA objects, 21
Station Address, 21, 49 W
Station Address Length, 24
Station attributes, 21 w, 36
Station object, 21 Write-only, 13
Status
codes, 10 X
XT, 28
107

XT attribute, 28
108
Contact us
1MRS756654 B/30.9.2012 © Copyright 2012 ABB. All rights reserved.

ABB Oy
Substation Automation Products
P.O. Box 699
FI-65101 Vaasa
FINLAND
Tel. +358 10 22 11
Fax. +358 10 224 1094
www.abb.com/substationautomation

SYS600 - IEC 60870-5-104 Slave Protocol - 756654 - ENb

Uploaded by

Copyright:

Available Formats

SYS600 - IEC 60870-5-104 Slave Protocol - 756654 - ENb

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SYS600 - IEC 60870-5-104 Slave Protocol - 756654 - ENb

Uploaded by

Copyright:

Available Formats

MicroSCADA Pro SYS 600 9.

3 Safety information ................................................................................ 9

5 Technical description ........................................................................... 47

IEC 60870-5-104 Slave Protocol

5.5.2.4 Command procedures for application

A Examples of communication system configuration ..........................102

IEC 60870-5-104 Slave Protocol

2.1 This manual

IEC 60870-5-104 Slave Protocol

2.2 Use of symbols

Warning icon indicates the presence of a hazard which could

Caution icon indicates important information or a warning

Information icon alerts the reader to relevant factors and

2.3 Related documents

Other referenced manuals

IEC 60870-5-104 Slave Protocol

2.4 Document revisions

3.1 Backup copies

Taking backup copies

3.2 Fatal errors

IEC 60870-5-104 Slave Protocol

Files may be damaged if you shut down the base system

4.3.1 Base system configuration

IEC 60870-5-104 Slave Protocol

where 'i_Integrated_Link_Number' is the number of the link reserved in step 2. The

4.3.2 Communication system configuration

Setting the attribute values

IEC 60870-5-104 Slave Protocol

Figure 4.1: Multidrop network topology

4.3.2.1 IEC 60870-5-104 line layer

• Recognises frames addressed to a designated station.

Line layer attributes

Data type: Text

This attribute accepts the IP address in form:

If multiple IP addresses have to be assigned for redundancy purposes, separate the

IEC 60870-5-104 Slave Protocol

#SET NET1:SLD1=”192.168.1.10;2405” ;server port = 2405, (no spaces

There is an internal limitation which prohibits the use of the

The limitation is present only when the same local IP address

PS Buffer Pool Size

IEC 60870-5-104 Slave Protocol

Access: Read, write

A bit pattern which defines the operating mode of the line.

IEC 60870-5-104 Slave Protocol

4.3.2.2 IEC 60870-5-104 station object

IEC 60870-5-104 Slave Protocol

Access: Read, conditional write

AI Additional Internet address

This attribute accepts the IP address in the following form

If only one address is defined to IA attribute (i.e. no redundancy configuration), the

IEC 60870-5-104 Slave Protocol

A non-redundant connection is accepted from addresses 192.168.2.180, 192.168.2.181,

Redundant configuration, logical connection 1 through 192.168.2.10 is accepted either

The default values of the SL, IL and CL attributes follow the

IL Information Address Length

CL Length of Cause of Transmission Information

IEC 60870-5-104 Slave Protocol

When the AL attribute is set to 0, AS also gets the value 0.

SE System Messages Enabled