BCI IEC60870-5-104 en

Power Grids
RTU500 series - Remote Terminal Units

Bidirectional Communication Interface with
IEC 60870-5-104
Protocol description
Revision
Revision
Document identity: 1KGT 150 962 V001 1

Revision: Date: Changes:
0 08/2017 Initial version
1 07/2018 New layout
New chapter: Secure Communication According IEC 62351-3
(PR#38008)
New table: Functions of the BCI compared to HCI and SCI
(PR#37659)
Revision
Contents
Contents
1 Introduction..............................................................................................................................7
1.1 Preface.................................................................................................................................... 7
1.2 References.............................................................................................................................. 7
1.3 Conventions........................................................................................................................... 7
1.4 Functions of the BCI compared to HCI and SCI............................................................ 8
2 Physical Layer...........................................................................................................................9
2.1 IP based Communication................................................................................................... 9
2.2 Host interface....................................................................................................................... 9
3 Link Layer................................................................................................................................ 11
3.1 General...................................................................................................................................11
4 Application Layer................................................................................................................... 13
4.1 General.................................................................................................................................. 13
4.2 Communication Queue Handling....................................................................................14
4.3 ASDU Type identification................................................................................................. 14
4.3.1 ASDU in monitoring direction........................................................................ 15
4.3.2 ASDU in control direction................................................................................15
4.3.3 ASDU of system information in command direction.................................16
5 Parameters and Addressing................................................................................................. 17

5.1 General data point parameters....................................................................................... 17
5.2 Address elements............................................................................................................... 17
5.2.1 Restrictions for the Common Address......................................................... 17
5.2.2 Restrictions for the information object address........................................17
6 Data Types - Monitoring Direction..................................................................................... 19

6.1 AMI – Analog Measured Information..............................................................................19
6.1.1 Supported Data Types.....................................................................................19
6.1.2 Additional Information.....................................................................................19
6.1.3 Conversion of Values........................................................................................20
6.1.4 Conversion of Quality Descriptors................................................................20
6.1.5 Conversion of Causes of Transmission........................................................20
6.2 BSI – Bit String Information............................................................................................. 21
6.2.1 Supported Data Types..................................................................................... 21
6.2.3 Conversion of values.........................................................................................21
6.2.4 Conversion of Quality Descriptors................................................................ 22
6.3 DMI – Digital Measured Information.............................................................................. 22
6.3.3 Conversion of values........................................................................................ 23
1KGT 150 962 V001 1 I

Contents
6.4 DPI – Double Point Information...................................................................................... 23

6.4.2 Additional Information.................................................................................... 24
6.5 EPI – Protection Event Information................................................................................ 25
6.5.2 Additional information.................................................................................... 25
6.6 ITI – Integrated Totals Information................................................................................ 26
6.6.5 Conversion of Causes of Transmission........................................................ 27
6.7 MFI – Measured Float Information................................................................................. 27
6.7.2 Values...................................................................................................................27
6.8 SPI – Single Point Information........................................................................................ 29
6.8.5 Conversion of Causes of Transmission....................................................... 30
6.9 STI – Step Position Information......................................................................................30
6.9.1 Supported Data Types.................................................................................... 30
6.9.5 Conversion of Causes of Transmission........................................................ 31
7 Data Types - Controlling Direction..................................................................................... 33

7.1 ASO – Analog Setpoint Output....................................................................................... 33
7.1.2 Command Authority......................................................................................... 33
7.1.5 Conversion of qualifier of command............................................................34
7.1.6 Conversion of causes of transmission.........................................................34
7.2 BSO – Bit String Output................................................................................................... 34
II 1KGT 150 962 V001 1

Contents

7.2.2 Command Authority.........................................................................................34
7.2.6 Conversion of causes of transmission......................................................... 35
7.3 DCO – Double Command Output................................................................................... 35
7.4 DSO – Digital Setpoint Output........................................................................................37
7.4.3 Additional information.....................................................................................37
7.5 FSO – Floating Point Setpoint Output.......................................................................... 38
7.6 RCO – Regulation Command Output............................................................................. 39
7.6.2 Command Authority........................................................................................ 40
7.6.4 Conversion of values........................................................................................40
7.6.5 Conversion of qualifier of command........................................................... 40
7.6.6 Conversion of causes of transmission.........................................................40
7.7 SCO – Single Command Output......................................................................................41
8 Transparent Data.................................................................................................................. 43
9 File Transfer........................................................................................................................... 45
10 Internal Functions................................................................................................................. 47
1KGT 150 962 V001 1 III

Contents
10.1 General Interrogation........................................................................................................ 47

10.1.2 Values...................................................................................................................47
10.2 Time Synchronization........................................................................................................48
10.2.2 Values.................................................................................................................. 48
10.2.3 Command Authority........................................................................................ 48
10.3 System Events.................................................................................................................... 49
10.4 System Commands............................................................................................................50
11 Secure Communication according IEC 62351-3................................................................. 51

11.1 Technology Overview.........................................................................................................51
11.2 TLS Version.......................................................................................................................... 51
11.3 Supported Cipher Suites.................................................................................................. 51
11.4 Certificates.......................................................................................................................... 52
11.5 RTUtil500 Engineering...................................................................................................... 52
11.6 Certificate Upload via the RTU500 Web Server........................................................... 52
12 Interoperability List.............................................................................................................. 53
12.1 System or device................................................................................................................ 53
12.2 Network configuration......................................................................................................53
12.3 Physical Layer...................................................................................................................... 53
12.3.1 Transmission speed (control direction).......................................................53
12.3.2 Transmission speed (monitor direction).....................................................54
12.4 Link Layer............................................................................................................................. 55
12.5 Application Layer................................................................................................................55
12.5.1 Transmission Mode for Application Data.................................................... 55
12.5.2 Common Address of ASDU.............................................................................55
12.5.3 Information object address............................................................................56
12.5.4 Cause of transmission.....................................................................................56
12.5.5 Length of APDU................................................................................................ 56
12.5.6 Selection of standard ASDUs.........................................................................56
12.6 Basic application functions............................................................................................. 60
12.6.1 Station initialization.........................................................................................60
12.6.2 Cyclic data transmission.................................................................................60
12.6.3 Read procedure................................................................................................. 61
12.6.4 Spontaneous transmission............................................................................. 61
12.6.5 Double transmission of information objects with cause of transmission
spontaneous.......................................................................................................61
12.6.6 Station interrogation........................................................................................61
12.6.7 Clock synchronization...................................................................................... 61
IV 1KGT 150 962 V001 1

Contents
12.6.8 Command transmission.................................................................................. 62

12.6.9 Transmission of integrated totals................................................................ 62
12.6.10 Parameter loading............................................................................................ 62
12.6.11 Parameter activation........................................................................................62
12.6.12 Test procedure.................................................................................................. 63
12.6.13 File transfer........................................................................................................63
12.6.14 Background scan...............................................................................................63
12.6.15 Acquisition of transmission delay.................................................................63
12.6.16 Definition of timeouts..................................................................................... 63
12.6.17 Maximum number of outstanding I format APDUs k and latest
acknowledge APDUs (w)................................................................................. 64
12.6.18 Port number.......................................................................................................64
12.6.19 Redundant connections.................................................................................. 64
12.6.20 RFC 2200 suite.................................................................................................. 64
13 Glossary.................................................................................................................................. 65
1KGT 150 962 V001 1 V

Contents
VI 1KGT 150 962 V001 1

Introduction Preface
1 Introduction
1.1 Preface
This document describes the functions of the bidirectional communication interface in
RTU500 series according to IEC 60870-5-104.
RTU500 series fulfills the requirements of IEC 60870-5-104 Edition 2. Detailed information can
be found in the interoperability list (see Chapter 12).
1.2 References
[1] Telecontrol equipment and systems – Part 5-104
Transmission protocols –
Network access for IEC 60870-5-101
using standard transport profiles

Second edition 06-2006
[2] RTU500 series Interfaces and Protocols Release 12 (1KGT 150 939)
[3] User Manual RTUtil500 Release 12 (1KGT 150 950)
1.3 Conventions
In this document function codes of data types according to IEC 60870-5-104 are marked with
brackets: <Function code>
Bold fonts with the table heading "Parameter name" are references to configuration
parameters in RTUtil500. The parameter is followed by the parameter location where to
find this parameter in RTUtil500. The first element of the parameter location defines the
node in the hardware tree on the left side (e. g. RTU, CMU, line, IED) and the second element
defines selected header control tab in the parameter window on the right side (e. g. general,
interfaces, protocol).
Example:
Parameter name Default Parameter location
In use enabled data point (e.g. SPI) - line GP104

If enabled, the data point is transmitted to the host communication interface.
This setting refers to data in monitoring and command direction.
The tables in the next chapters include lists of the functions, options and message types
supported according to the protocol structure given in IEC 60870-5 (EPA three layer model)
for
The tables in the next chapters include lists of the functions, options and message types
supported according to the protocol structure given in IEC 60870-5 (EPA three layer model)
for
• the physical layer
• the link layer
• the application layer
1KGT 150 962 V001 1 7

Functions of the BCI compared to HCI and SCI Introduction
This layered model is valid for the protocol IEC 60870-5-104.
1.4 Functions of the BCI compared to HCI and SCI

Functions supported in the IEC 60870-5-104 host communication interface (HCI) and not in
the bidirectional communication interface (BCI):
• Structured addresses for ASDU and IOA.

• The configuration of control systems as communication partner is only possible for HCI.
For the BCI external device are configured as IED.
• Simultaneous communication with up to 8 hosts (Multi-Host connection) is only
supported by the HCI. This also includes the configuration and exclusive connection to
host IP addresses. The BCI supports redundant connections with 2 links.
• Counter interogation commands (C_CI) and counter mode B, C, D
• Read commands (C_RD), reset process command (C_RP) and test command (C_TS)
• Parameter download and file transfer
• Supervision of maximum delay in command direction of commands and setpoints
Functions supported in the IEC 60870-5-104 subdevice communication interface (SCI) and not
in the bidirectional communication interface (BCI):
• Structured addresses for ASDU and IOA.

• Read commands (C_RD), reset process command (C_RP) and test command (C_TS)
• File transfer
Tabular representation of the functions:
Function HCI SCI BCI

Structured addresses for ASDU and IOA x x -
control system as communication partner x - -
IED as communication partner - x x
Simultaneous communication with up to 8 x - -
hosts
exclusive connection to host IP addresses x - -
redundant connections with 2 links x x x
Counter interrogation commands (C_CI) x x -
and counter mode B, C, D
Read commands (C_RD) x x -
reset process command (C_RP) x x -
test command (C_TS) x x -
Parameter download x - -
File transfer x x -
Monitoring the maximum delay in com- x x -
mand direction of commands and set-
points
8 1KGT 150 962 V001 1

Physical Layer IP based Communication
2 Physical Layer
2.1 IP based Communication

The protocol IEC 60870-5-104 is running on the Ethernet-Interfaces of the CMU. For more
details see RTU500 series Interfaces and Protocols Release 12 (1KGT 150 939).
For each Ethernet interface following parameters can be configured:
Interface mode Auto-negotiation CMU - Network Interfaces
Transmisssion rate and duplex modes.

Possible values are:
- 100BaseTx half duplex
- 100BaseTx full duplex
- 10BaseT half duplex
- 10BaseT full duplex
- Auto-negotiation
Default value: Auto-negotiation
Node name none CMU - Network Interfaces
Node name of RTU at this ethernet interface
IP Address 0.0.0.0 CMU - Network Interfaces
IP Address of this RTU interface
Subnet mask 0.0.0.0 CMU - Network Interfaces
Subnet mask of IP address
Default gateway IP 0.0.0.0 CMU - Network Interfaces
IP address of default gateway
2.2 Host interface

All host interfaces will be configured according to the following table.
Host number 1 CMU - all interfaces

Logical number of this host interface. Value range: 1 to 16.
The Host Number has to be unique in a system,
and will point to the data in the system event block
Interlock with local control authority disabled CMU - all interfaces
If enabled:
No commands are accepted from the host, as long as a user
has successfully requested the 'Command Authority' in the 'Integrated HMI'
1KGT 150 962 V001 1 9

Host interface Physical Layer
10 1KGT 150 962 V001 1

Link Layer General
3 Link Layer
3.1 General
Protection against loss and duplication of message is handled as defined in [1, 5.1].
For each Ethernet connection a slave IP address is necessary.
IP address 1 (slave) IED/RTU - Line GP104

Unique network address of the subdevice
IP address 2 (slave) disabled IED/RTU - Line GP104
If enabled: A second IP-Address for the subdevice can be configured
to establish a redundant link.
Second IP address of the subdevice or '-' to disable.
As VPN is enabled at the 2nd network interface, you can select between ethernet IP address and VPN virtual IP address.
Server TCP port 2404 IED/RTU - Line GP104
GeneralLngParameter1
1KGT 150 962 V001 1 11

General Link Layer
12 1KGT 150 962 V001 1

Application Layer General
4 Application Layer
4.1 General
The selectable parameters have to be calculated regarding the real communication
technology. All parameters preset to the default values from the IEC standard.
Maximum difference receive sequence number 12 APDUs IED/RTU - Line GP104

(k)
k: maximum difference receive sequence number to send sequence count variable
1 to 32767 APDUs; default value: 12 APDUs
Latest acknowledge after number of I format 8 APDUs IED/RTU - Line GP104
(w)
Latest acknowledge after receiving w I format APDUs
1 to 32767 APDUs; default value: 8 APDUs
(w should not exceed two-thirds of k)
Maximum length of APDU 253 byte Line GP IEC 60870-5-104 - General Parameter
32 to 253 octets (byte)
Default value: 253 octets
Table 1: Parameters application layer IEC 60870-5-104: telegram framing
Time out of connection establishment (t0) 30 sec IED/RTU - Line GP104

t0: Time-out of connection establishment
1 to 255 seconds; default value: 30 seconds
Send or test APDUs (t1) 15 sec IED/RTU - Line GP104
t1: Time-out of send APDUs or test APDUs
Acknowledge no data message (t2) 10 sec IED/RTU - Line GP104
t2: Time-out for acknowledges in case of no data messages

t2 < t1
Sending test frames (t3) 30 sec IED/RTU - Line GP104
t3: Timeout for sending test frames in case of a long idle state.
Value range: 1 to 65535 seconds.
Table 2: Parameters application layer IEC 60870-5-104: timeouts
Time interval of clock synchronization com- disabled IED/RTU - Line GP104

mands
Specification whether Time Synchronization
of the secondary station shall take place.
Time period in seconds,
Value range: 60 to 65000 or'-' to disable.
Approved value for SPA-Bus devices is 60 seconds.
Send commands with time tag disabled IED/RTU - Line GP104
If enabled, all commands to sub devices get send with timestamp.
Table 3: Line parameters application layer IEC 60870-5-104: other parameters
1KGT 150 962 V001 1 13

Communication Queue Handling Application Layer
4.2 Communication Queue Handling

The host interface has 7 different communication queues and an additional process image:
• Command acknowledgment queue
• Priority 1 queue for monitoring data (except integrated totals and measured values)
(Priority 1 for monitoring data can be configured individual per data point)
• Priority 2 queue for monitoring data (except integrated totals and measured values)
(Priority 2 for monitoring data can be configured individual per data point)
• Integrated totals (ITI) queue
(The priority of the ITI queue can be assigned in total as Prio 1 or Prio 2)
• Spontaneous measured value queue
• Requested information queue incl. file transfer
The queue priority is assigned by function/ cause of transmission (COT) or by configuration
Highest Priority:
• Command acknowledgment queue (COT=6…10)
Priority level 1:
• Priority 1 Monitoring data queue (COT=3)
• Integrated totals queue (if configured as priority 1) (COT=3)
Priority level 2:
• Priority 2 Monitoring data queue (COT=3)
• Integrated totals queue (if configured as priority 2) (COT=3)
• Spontaneous measured value queue (COT=3)
• Requested information queue incl. file transfer (COT=37..41 and COT =13)
• SOE queue (if double transmission mode is activated)
Lowest priority:
• Interrogated data, direct from process image (COT=20…36)
• Periodic/ cyclic measured values, direct from process image (COT=1)
• Background cycle, direct from process image (COT=2)
Buffer size of priority 1 datapoints 500 entries IED/RTU - Line GP104

Transmit buffer size for priority 1 data.
Value range: 100 to 10000 entries
Buffer size of priority 2 datapoints 500 entries IED/RTU - Line GP104
Transmit buffer size for priority 2 data.
Buffer size of Integrated Totals (ITI) 1000 entries IED/RTU - Line GP104
Transmit buffer size for Integrated Total.
Buffer size of spontaneous transmitted Analog 500 entries IED/RTU - Line GP104
Measured values (AMI)
Transmit buffer size for spontaneous transmitted measurements.
Value range: 100 to 100000
4.3 ASDU Type identification

Overview on type identifications for data elements of the application layer defined in [2].
The column "RTU data type" shows the type of data with must be configured in RTUtil500.
14 1KGT 150 962 V001 1

Application Layer ASDU Type identification
4.3.1 ASDU in monitoring direction
ASDU Description Type iden- RTU data type

tification
M_SP_NA_1 Single-point information <1> SPI
M_SP_TB_1 Single-point information with time tag <30> SPI
CP56Time2a
M_D- Double-Point information <3> DPI
P_NA_1
M_DP_TB_1 Double-Point information with time tag <31> DPI
CP56Time2a
M_ST_NA_1 Step position information <5> STI
M_ST_TB_1 Step position information with time tag <32> STI
CP56Time2a
M_BO_NA_1 Bitstring of 32 bit <7> BSI8/16/321
M_BO_T- Bitstring of 32 bit with time tag CP56Time2a <33> BSI8/16/321
B_1
M_ME_NA_1Measured value, normalized value <9> AMI DMI8/16
M_ME_T- Measured value, normalized value with time tag <34> AMI DMI8/16
D_1 CP56Time2a
M_ME_N- Measured value, scaled value <11> AMI
B_1
M_ME_TE_1 Measured value, scaled value with time tag <35> AMI
CP56Time2a
M_ME_NC_1Measured value, short floating point <13> MFI
M_ME_T- Measured value, short floating point value with <36> MFI
F_1 time tag CP56Time2a
M_IT_NA_1 Integrated totals <15> ITI
M_IT_TB_1 Integrated totals with time tag CP56Time2a <37> ITI
M_EP_TD_1 Event of protection equipment with time tag <38> EPI
CP56Time2a
Table 4: ASDU in monitoring direction
1 BSI32 is not supported for local I/O.
4.3.2 ASDU in control direction
ASDU Description Type iden- RTU data type

tification
C_SC_NA_1 Single command <45> SCO
C_DC_NA_1 Double command <46> DCO
C_RC_NA_1 Regulation step command <47> RCO
C_SE_NA_1 Set point command, normalized value <48> ASO DSO8/16
C_SE_NB_1 Set point command, scaled value <49> ASO DSO8/16
C_SE_NC_1 Set point command, short floating point <50> FSO
C_BO_NA_1 Bitstring of 32 bit <51> BSO1/2/8/16/32
Table 5: ASDU in control direction
1KGT 150 962 V001 1 15

ASDU Type identification Application Layer
4.3.3 ASDU of system information in command direction
ASDU Description Type iden-

tification
C_IC_NA_1 Interrogation Command <100>
C_CS_NA_1 Clock synchronization command <103>
Table 6: System information in command direction
16 1KGT 150 962 V001 1

Parameters and Addressing General data point parameters
5 Parameters and Addressing
5.1 General data point parameters

In use enabled data point (e.g. SPI) - line GP104

If enabled, the data point is transmitted to the host communication interface.
This setting refers to data in monitoring and command direction.
Interrogation group number disabled data point - Line T101/T104/GP104

If enabled:
Data point belongs to an interrogation group.
Enter group number for group interrogation.
Value range: 1 to 16 or '-' to disable.
Table 7: General data point parameters
5.2 Address elements

Selection according to [1]. The address fields have the following size:
Common address ASDU length 2 octets (fixed)

Information object address length 3 octets (fixed)
Cause of transmission length 2 octets (fixed)
5.2.1 Restrictions for the Common Address
The value 0 is not allowed.
The highest possible address value (255 for 1 octet common address length and 65 535 for
2 octet common address length) is reserved for broadcast calls in control direction and
therefore must not be used as station address.
ASDU address 1 data point - Line GP104

Application Service Data Unit.
The address is unstructured.
Length: 2 octets.
5.2.2 Restrictions for the information object address
All addresses must be unique within one station. The type of presentation (ASDU format) is
not part of the identification of an object.
The value 0 is not allowed.
1KGT 150 962 V001 1 17

Address elements Parameters and Addressing
Information object 1 data point - Line GP104

Address of the Information Object.
The addresses are unstructured.
Length: 3 octets
18 1KGT 150 962 V001 1

Data Types - Monitoring Direction AMI – Analog Measured Information
6 Data Types - Monitoring Direction
6.1 AMI – Analog Measured Information

Analog process information indicated by 16 bit used as a measured value from analog inputs
in normalized or scaled format.
6.1.1 Supported Data Types
IEC 60870-5-104 RTU

ASDU Type iden- Data type Data Parame- Parameter location
tification property type ter name
M_ME_NA_1 <9> normalized AMI Transmission AMI - line T101/
without time- format: Normal- T104/GP104
stamp ized
M_ME_NB_1 <11> scaled without AMI Transmission AMI - line T101/
timestamp format: Scaled T104/GP104
M_ME_TD_1 <34> normalized AMI Transmission AMI - line T101/
with timestamp format: Normal- T104/GP104
CP56Time2a ized
Transmission AMI - line T101/
with timestamp T104/GP104
M_ME_TE_1 <35> scaled with AMI Transmission AMI - line T101/
timestamp format: Scaled T104/GP104
CP56Time2a Transmission AMI - line T101/
with timestamp T104/GP104
Table 8: AMI - Supported data types
6.1.2 Additional Information
Spontanous transmission enabled data point - Line T101/T104/GP104

if enabled:
Spontaneous transmission of this process data point1)
Background cycle disabled data point - Line T101/T104/GP104
If enabled:
Cyclic transmission of this process data point
out of the process image of the host interface with given cycle time of the background cycle.
Value range: disabled, 1 sec, 2, 4, 5, 8, 10, 16, 30, 60 sec, 2 min, 5 min, 10 min, 15 min1)
1)It
is possible to set both parameters at the same data point. That means that the
concerning data point is directly send to the NCC on every change and additional after the
configured time period.
1KGT 150 962 V001 1 19

AMI – Analog Measured Information Data Types - Monitoring Direction
6.1.3 Conversion of Values
Transmission format Normalized AMI - line T101/104

Transmission format for this data point:
Normalized: Value range -1.0 ... +1.0
Scaled: Value range -32768.0 ... +32767.0.
Maximum value 1 (Normalized) AMI - line T101/104
32767 (Scaled)
+100 % within RTU internal communication get converted
to parameter 'Maximum value' in the external communication protocol.
Normalized: Value range -1.0 ... +1.0.
Minimum value -1 (Normalized AMI - line T101/104
-32768 (Scaled)
-100 % within RTU internal communication get converted
to parameter 'Minimum value' in the external communication protocol.
Normalized: Value range -1.0 ... +1.0.
Range RTU internal value IEC 60870-5-104

Range min. -100 % Minimum value
... ...
Range max. +100 % Maximum value
Table 9: AMI - Conversion of values
6.1.4 Conversion of Quality Descriptors
RTU IEC 60870-5-104

Internal Internal Communication
communication (short) communication (long)
OV Overflow Overflow
BL Blocked Blocked
SB Substituted Substituted
NT Not Topical Not Topical
IV Invalid Invalid
Table 10: AMI - Conversion of quality descriptors
6.1.5 Conversion of Causes of Transmission
RTU IEC 60870-5-104

T Test Test
P/N Positive/negative confirma- - Irrelevant -
tion
Cause Spontaneous 3 - spontaneous
Table 11: AMI - Conversion of causes of transmission
20 1KGT 150 962 V001 1

Data Types - Monitoring Direction BSI – Bit String Information
RTU IEC 60870-5-104

1 - periodic / cyclic
2 - background scan
5 - requested
20, 21 ... 36 - interrogated
Table 11: AMI - Conversion of causes of transmission
6.2 BSI – Bit String Information

Binary process information is indicated by 8, 16 or 32 bit.
IEC 60870-5-104 RTU

M_BO_NA_1 <7> without time- BSI
stamp
M_BO_TB_1 <33> with timestamp BSI Transmission BSI - line T101/T104/
CP56Time2a with timestamp GP104
Table 12: BSI - Supported data types
None
6.2.3 Conversion of values

Range min. 0 0
... ...
Range max. BSI8: Bit mask of 8 bit; 255
range ... 255

BSI16: Bit mask of 16 65 535
bit;
range ... 65 535

BSI32: Bit mask of 32 4 294 967 295
bit;
range ... 4 294 967 295

Table 13: BSI - Conversion of values
1KGT 150 962 V001 1 21

BSI – Bit String Information Data Types - Monitoring Direction
RTU IEC 60870-5-104

BL Blocked Blocked
IV Invalid Invalid
Table 14: BSI - Conversion of quality descriptors
RTU IEC 60870-5-104

T Test Test
tion
2 - background scan
5 - requested
Table 15: BSI - Conversion of causes of transmission
6.3 DMI – Digital Measured Information

Binary process information indicated by 8 or 16 bit is used as a measured value from digital
inputs in normalized format.
IEC 60870-5-104 RTU

M_ME_NA_1 <9> without time- DMI
stamp
M_ME_TD_1 <34> with timestamp DMI Transmission DMI - line T101/
CP56Time2a with timestamp T104/GP104
Table 16: DMI - Supported data types
None
22 1KGT 150 962 V001 1

Data Types - Monitoring Direction DMI – Digital Measured Information

Range min. -100 % -1
... ...
Range max. +100 % +1-2e-15
Table 17: DMI - Conversion of values
RTU IEC 60870-5-104

BL Blocked Blocked
IV Invalid Invalid
Table 18: DMI - Conversion of quality descriptors
RTU IEC 60870-5-104

T Test Test
tion
2 - background scan
5 - requested
Table 19: DMI - Conversion of causes of transmission
6.4 DPI – Double Point Information

Binary process information is indicated by two bits.
1KGT 150 962 V001 1 23

DPI – Double Point Information Data Types - Monitoring Direction
IEC 60870-5-104 RTU

M_DP_NA_1 <3> without time- DPI
stamp
M_DP_TB_1 <31> with timestamp DPI Transmission DPI - line T101/T104/
Table 20: DPI - Supported data types
None
RTU internal value IEC 60870-5-104

intermediate 11
off 01
on 10
indeterminate 00
Table 21: DPI – Conversion of values
RTU IEC 60870-5-104

BL Blocked Blocked
IV Invalid Invalid
Table 22: DPI - Conversion of quality descriptors
RTU IEC 60870-5-104

T Test Test
tion
2 - background scan
Table 23: DPI - Conversion of causes of transmission
24 1KGT 150 962 V001 1

Data Types - Monitoring Direction EPI – Protection Event Information
RTU IEC 60870-5-104

5 - requested
Table 23: DPI - Conversion of causes of transmission
6.5 EPI – Protection Event Information

Binary process information is indicated by two bits and relative timetag (used by protection
relays).
IEC 60870-5-104 RTU

M_EP_TD_1 <38> with timestamp EPI
CP56Time2a
Table 24: EPI - Supported data types
6.5.2 Additional information
The EPI contents a elapsed time tag of the protection event with the range of 0..59 999 ms.

intermediate 0
off 1
on 2
indeterminate 3
Table 25: EPI - Conversion of values
RTU IEC 60870-5-104

EI Elapsed time valid Elapsed time valid
BL Blocked Blocked
IV Invalid Invalid
Table 26: EPI - Conversion of quality descriptors
1KGT 150 962 V001 1 25

EPI – Protection Event Information Data Types - Monitoring Direction
RTU IEC 60870-5-104

T Test Test
tion
2 - background scan
Table 27: EPI - Conversion of causes of transmission
6.6 ITI – Integrated Totals Information

Binary process information is indicated by 32 bits as a count value.
IEC 60870-5-104 RTU

M_IT_NA_1 <15> without time- ITI
stamp
M_IT_TB_1 <37> with timestamp ITI Transmission ITI - line T101/T104/
Table 28: ITI - Supported data types
None

Range min. - 2 147 483 648 - 2 147 483 648
... ...
Range max. 2 147 483 647 2 147 483 647
Table 29: ITI - Conversion of values
RTU IEC 60870-5-104

SEQ Sequence number Sequence number
Table 30: ITI - Conversion of quality descriptors
26 1KGT 150 962 V001 1

Data Types - Monitoring Direction ITI – Integrated Totals Information
RTU IEC 60870-5-104

CY Carry Carry
CA Adjusted Adjusted
IV Invalid Invalid
Table 30: ITI - Conversion of quality descriptors
RTU IEC 60870-5-104

T Test Test
tion
5 - requested
Interrogated 37, 38 … 41 - interrogated
Table 31: ITI - Conversion of causes of transmission
6.7 MFI – Measured Float Information

32 bit analog process information is used as a measured value in float format.
IEC 60870-5-104 RTU

M_ME_NC_1 <13> without time- MFI
stamp
M_ME_TF_1 <36> with timestamp MFI Transmission MFI - line T101/
CP56Time2a with timestamp T104/GP104
Table 32: MFI - Supported data types
6.7.2 Values
R32–IEEE STD 754
1KGT 150 962 V001 1 27

MFI – Measured Float Information Data Types - Monitoring Direction
Spontanous transmission enabled data point - Line T101/T104/GP104

if enabled:
Spontaneous transmission of this process data point1)
Background cycle disabled data point - Line T101/T104/GP104
If enabled:
Cyclic transmission of this process data point
out of the process image of the host interface with given cycle time of the background cycle.
Value range: disabled, 1 sec, 2, 4, 5, 8, 10, 16, 30, 60 sec, 2 min, 5 min, 10 min, 15 min1)
1)It
is possible to set both parameters at the same data point. That means that the
concerning data point is directly send to the NCC on every change and additional after the
configured time period.

Range min. -3.4 x 10e38 -3.4 x 10e38
... ...
Range max. +3.4 x 10e38 +3.4 x 10e38
Table 33: MFI - Conversion of values
RTU IEC 60870-5-104

BL Blocked Blocked
IV Invalid Invalid
Table 34: MFI - Conversion of quality descriptors
RTU IEC 60870-5-104

T Test Test
tion
2 - background scan
Table 35: MFI - Conversion of causes of transmission
28 1KGT 150 962 V001 1

Data Types - Monitoring Direction SPI – Single Point Information
RTU IEC 60870-5-104

5 - requested
Table 35: MFI - Conversion of causes of transmission
6.8 SPI – Single Point Information

Binary process information is indicated by one bit.
IEC 60870-5-104 RTU

M_SP_NA_1 <1> without time- SPI
stamp
M_SP_TB_1 <30> with timestamp SPI Transmission SPI - line T101/T104/
Table 36: SPI - Supported data types
None

off 0
on 1
Table 37: SPI - Conversion of values
RTU IEC 60870-5-104

BL Blocked Blocked
IV Invalid Invalid
Table 38: SPI - Conversion of quality descriptors
1KGT 150 962 V001 1 29

SPI – Single Point Information Data Types - Monitoring Direction
RTU IEC 60870-5-104

T Test Test
tion
2 - background scan
5 - requested
Table 39: SPI - Conversion of causes of transmission
6.9 STI – Step Position Information

Binary process information is indicated by 8 bits.
IEC 60870-5-104 RTU

M_ST_NA_1 <5> without time- STI
stamp
M_ST_TB_1 <32> with timestamp STI Transmission STI - line T101/T104/
Table 40: STI - Supported data types
None

Range min. -63 -63
... ...
Range max. +63 +63
Table 41: STI - Conversion of values
30 1KGT 150 962 V001 1

Data Types - Monitoring Direction STI – Step Position Information
RTU IEC 60870-5-104

BL Blocked Blocked
IV Invalid Invalid
T Transient Bit Transient Bit
Table 42: STI - Conversion of quality descriptors
RTU IEC 60870-5-104

T Test Test
tion
2 - background scan
5 - requested
Table 43: STI - Conversion of causes of transmission
1KGT 150 962 V001 1 31

STI – Step Position Information Data Types - Monitoring Direction
32 1KGT 150 962 V001 1

Data Types - Controlling Direction ASO – Analog Setpoint Output
7 Data Types - Controlling Direction
7.1 ASO – Analog Setpoint Output

Analog process command (16 bit signed number).
IEC 60870-5-104 RTU

ASDU Type iden- Data type Data Parame- Parameter
tification property type ter name location
C_SE_NA_1 <48> normalized, ASO Transmis- ASO - line T101/
without time sion format: T104/GP104
tag Normalized
C_SE_NB_1 <49> scaled, without ASO Transmis- ASO - line T101/
time tag sion format: T104/GP104
Scaled
Table 44: ASO - Supported data types
7.1.2 Command Authority
See also parameter Interlock with local control authority
(Table Interface parameters - IEC 60870-5-104 in chapter Physical Layer (page "2-1"))
Analog set-point output is a persistent output.

Range min. -100 % Normalized: -1
Scaled: -32 768

... ...
Range max. +100 % Normalized: +1-2e-15
Scaled: +32 767

Table 45: ASO - Conversion of values
1KGT 150 962 V001 1 33

ASO – Analog Setpoint Output Data Types - Controlling Direction
7.1.5 Conversion of qualifier of command
RTU IEC 60870-5-104

SE Select / Execute Select / Execute
(1 select, 0 execute)
QL default 0 - default
Table 46: ASO - conversion of qualifier of command
7.1.6 Conversion of causes of transmission
RTU IEC 60870-5-104

T Test Ignored
P/N Positive/negative confirma- Relevant in monitor direction
tion only
Cause Activation 6 - Activation
Activation Confirmation 7 - Activation Confirmation
Deactivation 8 - Deactivation
Deactivation Confirmation 9 - Deactivation Confirmation
Activation Termination 10 - Activation Termination
Negative Confirmation 45 … 47 - Unknown
Table 47: ASO - Conversion of causes of transmission
7.2 BSO – Bit String Output

Binary process command (1, 2, 8, 16, 32 bit unsigned number).
IEC 60870-5-104 RTU

C_BO_NA_1 <51> without time BSO
tag
Table 48: BSO - Supported data types
34 1KGT 150 962 V001 1

Data Types - Controlling Direction BSO – Bit String Output
Always persistent output. A new command with value 0 (all bits) has to be generated.

Range min. 0 0
... ...
Table 49: BSO - Conversion of values
RTU IEC 60870-5-104

SE only direct execute only direct execute
Table 50: BSO - conversion of qualifier of command
RTU IEC 60870-5-104

T Test Ignored
tion only
Table 51: BSO - Conversion of causes of transmission
7.3 DCO – Double Command Output

Binary process command (two bits).
1KGT 150 962 V001 1 35

DCO – Double Command Output Data Types - Controlling Direction
IEC 60870-5-104 RTU

C_DC_NA_1 <46> without time- DCO
stamp
Table 52: DCO - Supported data types
None

off 01
on 10
Table 53: DCO - Conversion of values
RTU IEC 60870-5-104

QU default 0 - no additional definition
Table 54: DCO - conversion of qualifier of command
RTU IEC 60870-5-104

T Test Ignored
Table 55: DCO - Conversion of causes of transmission
36 1KGT 150 962 V001 1

Data Types - Controlling Direction DSO – Digital Setpoint Output
RTU IEC 60870-5-104

tion only
Table 55: DCO - Conversion of causes of transmission
7.4 DSO – Digital Setpoint Output

Binary process command (8 or 16 bit signed number).
IEC 60870-5-104 RTU

C_SE_NA_1 <48> normalized, DSO Transmis- DSO - line T101/
without time sion format: T104/GP104
tag Normalized
C_SE_NB_1 <49> scaled, without DSO Transmis- DSO - line T101/
time tag sion format: T104/GP104
Scaled
Table 56: DSO - Supported data types
Digital set-point output is a persistent output.

Range min. -100 % -1
... ...
Range max. +100 % +1-2e-15
Table 57: DSO - Conversion of values
1KGT 150 962 V001 1 37

DSO – Digital Setpoint Output Data Types - Controlling Direction
RTU IEC 60870-5-104

Table 58: DSO - conversion of qualifier of command
RTU IEC 60870-5-104

T Test Ignored
tion only
Table 59: DSO - Conversion of causes of transmission
7.5 FSO – Floating Point Setpoint Output

Floating point process command (32 bit short floating point number)
IEC 60870-5-104 RTU

C_SE_NC_1 <50> without time FSO
tag
Table 60: FSO - Supported data types
38 1KGT 150 962 V001 1

Data Types - Controlling Direction FSO – Floating Point Setpoint Output
None

Range min. -3.4 x 10e38 -3.4 x 10e38
... ...
Range max. +3.4 x 10e38 +3.4 x 10e38
Table 61: FSO - Conversion of values
RTU IEC 60870-5-104

Table 62: FSO - conversion of qualifier of command
RTU IEC 60870-5-104

T Test Ignored
tion only
Table 63: FSO - Conversion of causes of transmission
7.6 RCO – Regulation Command Output

Regulation step command (two bits).
1KGT 150 962 V001 1 39

RCO – Regulation Command Output Data Types - Controlling Direction
IEC 60870-5-104 RTU

C_RC_NA_1 <47> without time RCO
tag
Table 64: RCO - Supported data types
Regulation step commands are in principle retriggerable commands.
In order to retrigger a running two step regulation command, it is not necessary to resend the
command Select.

Lower 01
Higher 10
Table 65: RCO - Conversion of values
RTU IEC 60870-5-104

Table 66: RCO - conversion of qualifier of command
RTU IEC 60870-5-104

T Test Ignored
Table 67: RCO - Conversion of causes of transmission
40 1KGT 150 962 V001 1

Data Types - Controlling Direction SCO – Single Command Output
RTU IEC 60870-5-104

tion only
Table 67: RCO - Conversion of causes of transmission
7.7 SCO – Single Command Output

Binary process command (one bit).
IEC 60870-5-104 RTU

C_SC_NA_1 <45> without time- SCO
stamp
Table 68: SCO - Supported data types
None

off 0
on 1
Table 69: SCO - Conversion of values
1KGT 150 962 V001 1 41

SCO – Single Command Output Data Types - Controlling Direction
RTU IEC 60870-5-104

Table 70: SCO - conversion of qualifier of command
RTU IEC 60870-5-104

T Test Ignored
tion only
Table 71: SCO - Conversion of causes of transmission
42 1KGT 150 962 V001 1

Transparent Data
8 Transparent Data
Transparent data communication is not supported.
1KGT 150 962 V001 1 43

Transparent Data
44 1KGT 150 962 V001 1

File Transfer
9 File Transfer
File transfer is not supported.
1KGT 150 962 V001 1 45

File Transfer
46 1KGT 150 962 V001 1

Internal Functions General Interrogation
10 Internal Functions
10.1 General Interrogation
IEC 60870-5-104 RTU

ASDU Type iden- Data type Data type Parame- Parameter
tification property ter name location
C_IC_NA_1 <100>
Table 72: General Interrogation - Supported data types
10.1.2 Values
20, 21 … 36
None
The general interrogation is responded from the HCI’s process image.
RTU IEC 60870-5-104

Internal commu- Internal commu- Communication
nication (short) nication (long)
QOI Qualifier of Interrogation 20 – General interrogation
21 – Interrogation Group 1
Table 73: General Interrogation - Conversion of quality descriptors
1KGT 150 962 V001 1 47

General Interrogation Internal Functions
RTU IEC 60870-5-104

T Test Ignored
P/N Positive/negative confir- Relevant in monitor direction only
mation
Table 74: General Interrogation - Conversion of causes of transmission
10.2 Time Synchronization

The RTU500 series supports different methods of time synchronization. The time
synchronization can be done via the communication line with the protocol IEC 60870-5-104.
The eight time masters have their own priority. If a higher prior master will fail, the time
master with the lower priority will synchronize the RTU. If the higher prior time master is
available again, he will continue synchronizing.
Time administration Not used RTU Parameters

Primary device for time synchronization. This device is always allowed to synchronize the RTU if availble. If not, the next device
is used.
IEC 60870-5-104 RTU

C_CS_NA_1 <103>
Table 75: Time Synchronization - Supported data types
10.2.2 Values
Complete time and date information in CP56Time2a format.
None
48 1KGT 150 962 V001 1

Internal Functions Time Synchronization
RTU IEC 60870-5-104

T Test Ignored
P/N Positive/negative confir- Relevant in monitor direction only
mation
Table 76: Time synchronization - Conversion of causes of transmission
10.3 System Events

The bidirectional interface manages internal status messages of the RTU500 series. These
status messages can be created from the host itself or other activities of the RTU500 series.
The system events of other activities are sent via internal communication and are processed
by the BCI.
Fix SEV address schema enabled SDI - line

Value range: enabled/ disabled
if enabled: a base address for the whole block of system events is defined at the SDI node
if disabled: individual addresses per SEV can be defined
In order to avoid collisions, the addresses of the system events may not be used for other process objects.
In use enabled SDI - line
Value range: enabled/ disabled
if disabled: no SEVs will be transmitted on this line
The following table shows the system events available for the host interface:
Description of system event Address offset

At least one indication faulty SEV#016
At least one analog value faulty SEV#017
At least one digital value faulty SEV#018
At least one integrated total faulty SEV#019
At least one object or regulation command faulty SEV#020
At least one analog output faulty SEV#021
At least one digital output faulty SEV#022
RTU is faulty SEV#023
Device/ RTU active SEV#024
RTU synchronized SEV#025
External clock inoperable SEV#026
Local printer offline SEV#027
At least one indication oscillating SEV#028
Table 77: Description of system events
1KGT 150 962 V001 1 49

System Commands Internal Functions
Description of system event Address offset

Battery voltage low (RTU560E only) SEV#029
AC power supply failure (RTU560E only) SEV#030
Test mode active SEV#042
At least one data object simulated SEV#043
At least one data communication equipment (DCE) faulty SEV#044
Device connected SEV#045
At least one PLC function not running SEV#046
At least one PLC function cycle time exceeded SEV#047
Device/ RTU inoperable SEV#048
Device/ RTU is out of service SEV#049
Power supply failure in RTU central sub-rack SEV#059
Command supervision circuit x disconnected or faulty, 1 ≤ x ≤ 32 SEV#064 ... #095
SNTP client 1 is synchronized SEV#096
SNTP client 2 is synchronized SEV#097
Local control authority active SEV#100
Host x Online, 1 ≤ x ≤ 16 SEV#101 ... #116
Host interface x: At least one change of information lost, 1 ≤ x ≤ 16 SEV#117 ... #132
Host interface x: At least one pulse counter lost, 1 ≤ x ≤ 16 SEV#133 ... #148
CMU x is inoperable, 1 ≤ x ≤ 16 SEV#149 … #164
Database identity tag SEV#174
Device reachable on redundant line x, 1 ≤ x ≤ 4 SEV#180 … #183
Device active on redundant line x, 1 ≤ x ≤ 4 SEV#184 … #187
Device preferred on redundant line x, 1 ≤ x ≤ 4 #SEV188 … #191
Network element x is operable, 1 ≤ x ≤ 32 SEV#192 … #223
CMU x is active, 1 ≤ x ≤ 16 SEV#224 … #239
Process command collision with host x, 1 ≤ x ≤ 16 SEV#242 ... #257
Command collision with Integrated HMI SEV#258
Command collision with web server SEV#259
Command collision with PLC SEV#260
HMI Client x online,1 ≤ x ≤ 16 SEV#261 ... #276
PRP interface x: Network interface E1 link on, 1 ≤ x ≤ 8 SEV#277 ... #284
PRP interface x: Network interface E2 link on, 1 ≤ x ≤ 8 SEV#285 ... #292
Host interface x: SOE buffer filling status is not reached, 1 ≤ x ≤ 16 SEV#293 ... #308
CAM Client x online, 1 ≤ x ≤ 4 SEV#309 ... #312
RTC battery voltage low 1 SEV#313
Table 77: Description of system events
1 540CID01, 540CMD01 and 560CMR01/02
10.4 System Commands

System commands are not supported.
50 1KGT 150 962 V001 1

Secure Communication according IEC 62351-3 Technology Overview
11 Secure Communication according IEC

62351-3
11.1 Technology Overview
In general, the protocol IEC 60870-5-104 is a plaintext protocol. If not secured, one can
read and change any communication between the external device and the RTU500. Using
an open network, it is recommended to protect the communication with encryption and
authentication of the transmitted data as requested in IEC 62351-3.
This chapter describes the implementation of secured IEC 60870-5-104 BCI communication
with IEC 62351-3 in RTU500 as controlled station. RTU500 supports TLS (Transport Layer
Security) encryption and authentication by means of X.509 certificates. This option is
available with the license feature "Advanced Security".
ADVICE
In secured mode the BCI IEC 60870-5-104 can manage up to 30 substations per line.
11.2 TLS Version

RTU500 supports TLS version 1.2 as specified in RFC 5246:2008. TLS versions lower than TLS
1.2 are not supported.
11.3 Supported Cipher Suites

The following cipher suites are supported by RTU500:
RFC Identifier OpenSSL Name

TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 DHE-DSS-AES256-GCM-SHA384
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 DHE-RSA-AES256-GCM-SHA384
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 DHE-RSA-AES256-SHA256
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 DHE-DSS-AES256-SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA DHE-RSA-AES256-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA DHE-DSS-AES256-SHA
TLS_RSA_WITH_AES_256_GCM_SHA384 AES256-GCM-SHA384
TLS_RSA_WITH_AES_256_CBC_SHA256 AES256-SHA256
TLS_RSA_WITH_AES_256_CBC_SHA AES256-SHA
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 DHE-DSS-AES128-GCM-SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 DHE-RSA-AES128-GCM-SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 DHE-RSA-AES128-SHA256
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 DHE-DSS-AES128-SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA DHE-RSA-AES128-SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA DHE-DSS-AES128-SHA
TLS_RSA_WITH_AES_128_GCM_SHA256 AES128-GCM-SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256 AES128-SHA256
TLS_RSA_WITH_AES_128_CBC_SHA AES128-SHA
1KGT 150 962 V001 1 51

Certificates Secure Communication according IEC 62351-3
11.4 Certificates
For a secure TLS communication, it is essential to have a mutual authentication between the
communication partners. For TLS in general, X.509 certificates are used. A digital certificate
is used to prove that someone is who they say they are. In a TLS negotiation, RTU500 uses
a server certificate to prove its identity to the control system. TLS requires that the control
system prove its identity with a client certificate as well.
Certificates are a set of keys and information. A private and a public key are needed. The
private key is a RSA key. RTU500 supports a key length of 2048 bits. The private key is used
for signature and encryptions. A corresponding public key with the same length can be
distributed to the public and is used for verifying the signature or for decrypting messages.
Version 3 of X.509 certificates are supported by RTU500 (RFC5280). One certificate per CMU
module may be configured for IEC 62351-3. RTU500 supports up to two CAs (Certificate
Authorities). RTU500 supports X.509 certificates with a size up to 8192 bytes. Certificate
revocation list handling is not implemented.
11.5 RTUtil500 Engineering

The configuration parameters for IEC 62351-3 are defined for each IEC 60870-5-104 BCI line
respectively within an RTU. For securing data traffic the following modes are selectable:
• Unsecured
• IEC 62351-3
The certificate used for authentication and encryption is selectable from a dropdown list. List
items depend on certificate store configuration. That means prior to that list selection set
an entry with descriptive text in the certificate store of the CMU module to upload external
certificates for authentication.
11.6 Certificate Upload via the RTU500 Web Server

TLS requires an uploaded certificate in the certificate store of the CMU module. The web
pages for certificate configuration require secure HTTPS web server access. It is not possible
to open the web pages with standard HTTP access. For uploading the generated certificate
must be stored in PKCS#12 format (.p12 file extension).
The upload of an external generated certificate is done via the RTU500 series Web server. In
the Web server menu the link "Certificate Management" is the entry point for the certificate
upload. This link can be found under the menu item "Management".
To upload a certificate the following steps have to be executed:
• Select the description of the certificate to upload in the column "Certificate description".
In the selection all in RTUtil500 configured entries of the certificate store appear. The
selection text is the descriptive name set in RTUtil500.
• Select a certificate file.
• Enter the password for the private key passphrase by pressing the lock symbol.
When all steps are finished the certificate can be uploaded by pressing the upload button.
The upload button appears not before all required information are set.
52 1KGT 150 962 V001 1

Interoperability List System or device
12 Interoperability List
The selected parameters are marked in the white boxes as follows:
Function or ASDU is not used

X Function or ASDU is used as standardized (default)
R Function or ASDU is used in reverse mode
B Function or ASDU is used in standard and reverse mode
12.1 System or device

(system-specific parameter)
System definition
X Controlling station definition (master)
X Controlled station definition (slave)
12.2 Network configuration

(network-specific parameter)
Point-to-point
Multiple point-to-point
Multipoint-party line
Multipoint-star
12.3 Physical Layer

12.3.1 Transmission speed (control direction)
Unbalanced interchange
Circuit V.24/V.28
Standard
100bit/s
200bit/s
300bit/s
600bit/s
1 200bit/s
Circuit V.24/V.28
Recommended if >1 200 bit/s
2 400bit/s
4 800bit/s
1KGT 150 962 V001 1 53

Physical Layer Interoperability List
9 600bit/s
Balanced interchange
Circuit X.24/X.27
2 400bit/s
4 800bit/s
9 600bit/s
19 200bit/s
38 400bit/s
56 000bit/s
64 000bit/s
12.3.2 Transmission speed (monitor direction)
Circuit V.24/V.28
Standard
100bit/s
200bit/s
300bit/s
600bit/s
1 200bit/s
Circuit V.24/V.28
Recommended if >1 200 bit/s
2 400bit/s
4 800bit/s
9 600bit/s
Balanced interchange
Circuit X.24/X.27
2 400bit/s
4 800bit/s
9 600bit/s
19 200bit/s
38 400bit/s
56 000bit/s
64 000bit/s
54 1KGT 150 962 V001 1

Interoperability List Link Layer
12.4 Link Layer

Frame format FT 1.2, single character 1 and the fixed time out interval are used exclusively in
this companion standard.
Link transmission procedure

Balanced transmission
Unbalanced transmission
Frame length
Maximum length L (number of octets)
Address field of the link

Not present (balanced transmission only)
One octet
Two octets
Structured
Unstructured
When using an unbalanced link layer, the following ASDU types are returned in class 2
messages (low priority) with the indicated causes of transmission:
The standard assignment of ASDUs to class 2 messages is used as follows:
Type identification Cause of transmission
A special assignment of ASDUs to class 2 messages is used as follows:
12.5 Application Layer

12.5.1 Transmission Mode for Application Data
Mode 1 (least significant octet first), as defined in 4.10 of IEC 60870-5-4, is used exclusively in
this companion standard.
12.5.2 Common Address of ASDU
1KGT 150 962 V001 1 55

Application Layer Interoperability List
One octet X Two octets
12.5.3 Information object address
One octet Structured

Two octet X Unstructured
X Three octets
12.5.4 Cause of transmission
One octet X Two octets

(with originator address)
12.5.5 Length of APDU
The maximum length of APDU for both directions is 253. It is a fixed system parameter.
Maximum length of APDU per system in control direction

Maximum length of APDU per system in monitor direction
12.5.6 Selection of standard ASDUs

12.5.6.1 Process information in monitor direction
(station-specific parameter)
B <1> := Single-point information M_SP_NA_1

<2> := Single-point information with time tag M_SP_TA_1
B <3> := Double-point information M_DP_NA_1

<4> := Double-point information with time tag M_DP_TA_1
B <5> := Step position information M_ST_NA_1

<6> := Step position information with time tag M_ST_TA_1
<7> := Bitstring of 32 bit M_BO_NA_1
<8> := Bitstring of 32 bit with time tag M_BO_TA_1
B <9> := Measured value, normalized value M_ME_NA_1
<10> := Measured value, normalized value with time tag M_ME_TA_1
B <11> := Measured value, scaled value M_ME_NB_1
<12> := Measured value, scaled value with time tag M_ME_TB_1
B <13> := Measured value, short floating point value M_ME_NC_1
<14> := Measured value, short floating point value with time tag M_ME_TC_1
<15> := Integrated totals M_IT_NA_1
56 1KGT 150 962 V001 1

Interoperability List Application Layer
<16> := Integrated totals with time tag M_IT_TA_1
<17> := Event of protection equipment with time tag M_EP_TA_1

<18> := Packed start events of protection equipment with time M_EP_TB_1
tag
<19> := Packed output circuit information of protection M_EP_TC_1
equipment with time tag
<20> := Packed single-point information with status change M_PS_NA_1
detection
<21> := Measured value, normalized value without quality M_ME_ND_1
descriptor
B <30> := Single-point information with time tag CP56Time2a M_SP_TB_1

B <31> := Double-point information with time tag CP56Time2a M_DP_TB_1
B <32> := Step position information with time tag CP56Time2a M_ST_TB_1
B <33> := Bitstring of 32 bit with time tag CP56Time2a M_BO_TB_1
B <34> := Measured value, normalized value with time tag M_ME_TD_1
CP56Time2a
B <35> := Measured value, scaled value with time tag CP56Time2a M_ME_TE_1
B <36> := Measured value, short floating point value with time tag M_ME_TF_1
CP56Time2a
B <37> := Integrated totals with time tag CP56Time2a M_IT_TB_1
B <38> := Event of protection equipment with time tag M_EP_TD_1
CP56Time2a
<39> := Packed start events of protection equipment with time M_EP_TE_1
tag CP56Time2a
<40> := Packed output circuit information of protection M_EP_TF_1
equipment with time tag CP56Time2a
In this companion standard only the use of the set <30> – <40> for ASDUs with time tag is
permitted.
12.5.6.2 Process information in control direction
B <45> := Single command C_SC_NA_1

B <46> := Double command C_DC_NA_1
B <47> := Regulating step command C_RC_NA_1
B <48> := Set point command, normalized value C_SE_NA_1
B <49> := Set point command, scaled value C_SE_NB_1
B <50> := Set point command, short floating point value C_SE_NC_1
B <51> := Bitstring of 32 bit C_BO_NA_1
<58> := Single command with time tag CP56Time2a C_SC_TA_1

<59> := Double command with time tag CP56Time2a C_DC_TA_1
<60> := Regulating step command with time tag CP56Time2a C_RC_TA_1
<61> := Set point command, normalized value with time tag C_SE_TA_1
CP56Time2a
<62> := Set point command, scaled value with time tag C_SE_TB_1
CP56Time2a
<63> := Set point command, short floating point value with time C_SE_TC_1
tag CP56Time2a
<64> := Bitstring of 32 bit with time tag CP56Time2a C_BO_TA_1
1KGT 150 962 V001 1 57

Application Layer Interoperability List
12.5.6.3 System information in monitor direction
B <70> := End of initialization M_EI_NA_1
12.5.6.4 System information in control direction
B <100> := Interrogation command C_IC_NA_1

<101> := Counter interrogation command C_CI_NA_1
<102> := Read command C_RD_NA_1
B <103> := Clock synchronization command C_CS_NA_1
<104> := Test command C_TS_NA_1
<105> := Reset process command C_RP_NA_1
<106> := Delay acquisition command C_CD_NA_1
<107> := Test command with time tag CP56Time2a C_TS_TA_1
12.5.6.5 Parameter in control direction
<110> := Parameter of measured value, normalized value P_ME_NA_1

<111> := Parameter of measured value, scaled value P_ME_NB_1
<112> := Parameter of measured value, short floating point value P_ME_NC_1
<113> := Parameter activation P_AC_NA_1
12.5.6.6 File transfer
<120> := File ready F_FR_NA_1

<121> := Section ready F_SR_NA_1
<122> := Call directory, select file, call file, call section F_SC_NA_1
<123> := Last section, last segment F_LS_NA_1
<124> := Ack file, ack section F_AF_NA_1
<125> := Segment F_SG_NA_1
<126> := Directory {blank or X, only available in monitor (standard) F_DR_TA_1
direction}
<127> := Query Log - Request archive file F_SC_NB_1
12.5.6.7 Type identification and case of transmission assignments

1 2 3 4 5 6 7 8 9 10 11 12 13 20 37 44 45 46 47
to to
36 41
<1> M_SP_NA_1 X X X X
<2> M_SP_TA_1
<3> M_DP_NA_1 X X X X
58 1KGT 150 962 V001 1

Interoperability List Application Layer

1 2 3 4 5 6 7 8 9 10 11 12 13 20 37 44 45 46 47
to to
36 41
<4> M_DP_TA_1
<5> M_ST_NA_1 X X X X
<6> M_ST_TA_1
<7> M_BO_NA_1 X X X X
<8> M_BO_TA_1 X X
<9> M_ME_NA_1 X X X X X
<10> M_ME_TA_1
<11> M_ME_NB_1 X X X X X
<12> M_ME_TB_1
<13> M_ME_NC_1 X X X X X
<14> M_ME_TC_1 X X
<15> M_IT_NA_1 X X
<16> M_IT_TA_1
<17> M_EP_TA_1
<18> M_EP_TB_1
<19> M_EP_TC_1
<20> M_PS_NA_1
<21> M_ME_ND_1
<30> M_SP_TB_1 X X
<31> M_DP_TB_1 X X
<32> M_ST_TB_1 X X
<33> M_BO_TB_1 X X
<34> M_ME_TD_1 X X X
<35> M_ME_TE_1 X X X
<36> M_ME_TF_1 X X X
<37> M_IT_TB_1 X X
<38> M_EP_TD_1 X
<39> M_EP_TE_1
<40> M_EP_TF_1
<45> C_SC_NA_1 X X X X X X X X
<46> C_DC_NA_1 X X X X X X X X
<47> C_RC_NA_1 X X X X X X X X
<48> C_SE_NA_1 X X X X X X X X
<49> C_SE_NB_1 X X X X X X X X
<50> C_SE_NC_1 X X X X X X X X
<51> C_BO_NA_1 X X X X X X
<58> C_SC_TA_1 X X X X X X X X
<59> C_DC_TA_1 X X X X X X X X
<60> C_RC_TA_1 X X X X X X X X
<61> C_SE_TA_1 X X X X X X X X
<62> C_SE_TB_1 X X X X X X X X
1KGT 150 962 V001 1 59

Basic application functions Interoperability List

1 2 3 4 5 6 7 8 9 10 11 12 13 20 37 44 45 46 47
to to
36 41
<63> C_SE_TC_1 X X X X X X X X
<64> C_BO_TA_1 X X X X X X
<70> M_EI_NA_1 X
<100> C_IC_NA_1 X X X X X X
<101> C_CI_NA_1 X
<102> C_RD_NA_1 X
<103> C_CS_NA_1 X X X X X
<104> C_TS_NA_1
<105> C_RP_NA_1 X
<106> C_CD_NA_1
<107> C_TS_TA_1 X
<110> P_ME_NA_1 X
<111> P_ME_NB_1 X
<112> P_ME_NC_1 X
<113> P_AC_NA_1 X
<120> F_FR_NA_1 X
<121> F_SR_NA_1 X
<122> F_SC_NA_1 X
<123> F_LS_NA_1 X
<124> F_AF_NA_1 X
<125> F_SG_NA_1 X
<126> F_DR_TA_1 1
<127> F_SC_NB_11 X
1 Blank or X only.
(x) Functionality 'Local' or 'Remote' can be assigned by PLC.
12.6 Basic application functions

12.6.1 Station initialization
X Remote initialization
12.6.2 Cyclic data transmission
X Cyclic data transmission
60 1KGT 150 962 V001 1

Interoperability List Basic application functions
12.6.3 Read procedure
Read procedure
12.6.4 Spontaneous transmission
X Spontaneous transmission
12.6.5 Double transmission of information objects with cause of

transmission spontaneous
The following type identifications will be transmitted in succession caused by a single status
change of an information object. The particular information object addresses for which
double transmission is enabled are defined in a project-specific list.
Single-point information M_SP_NA_1, M_SP_TA_1, M_SP_TB_1 and M_PS_NA_1

Double-point information M_DP_NA_1, M_DP_TA_1 and M_DP_TB_1
Step position information M_ST_NA_1, M_ST_TA_1 and M_ST_TB_1
Bitstring of 32 bit M_BO_NA_1, M_BO_TA_1 and M_BO_TB_1
Measured value, normalized value M_ME_NA_1, M_ME_TA_1, M_ME_ND_1 and M_ME_TD_1
Measured value, scaled value M_ME_NB_1, M_ME_TB_1 and M_ME_TE_1
Measured value, short floating point number M_ME_NC_1, M_ME_TC_1 and M_ME_TF_1
12.6.6 Station interrogation
X global
X group 1 X group 7 X group 13
X group 5 X group 11
X group 6 X group 12
Information object addresses assigned to each group must be shown in a separate table.
12.6.7 Clock synchronization
X Clock synchronization
Day of week used
RES1, GEN (time tag substituted/ not substituted) used
X SU-bit (summertime) used
1KGT 150 962 V001 1 61

12.6.8 Command transmission
(object-specific parameter)
X Direct command transmission

X Direct set point command transmission
X Select and execute command
X Select and execute set point command
C_SE ACTTERM used
X No additional definition
Short-pulse duration (duration determined by a system parameter in the controlled
station)
Long-pulse duration (duration determined by a system parameter in the controlled
station)
X Persistent output
Supervision of maximum delay in command direction of commands and set point
commands
Maximum allowable delay of commands and set point commands
12.6.9 Transmission of integrated totals
(station- or object-specific parameter)
B Mode A: local freeze with spontaneous transmission

Mode B: local freeze with counter interrogation
Mode C: freeze and transmit by counter interrogation commands
Mode D: freeze by counter-interrogation command, frozen values reported spontaneously
Counter read
Counter freeze without reset
Counter freeze with reset
Counter reset
General request counter
Request counter group 1
12.6.10 Parameter loading
Threshold value
Smoothing factor
Low limit for transmission of measured value
High limit for transmission of measured values value
12.6.11 Parameter activation
Act/deact of persistent cyclic or periodic transmission of the addressed object
62 1KGT 150 962 V001 1

Interoperability List Basic application functions
12.6.12 Test procedure
Test procedure
12.6.13 File transfer
File transfer in monitor direction
Transparent file
Transmission of disturbance data of protection equipment
Transmission of sequences of events
Transmission of sequences of recorded analogue values
File transfer in control direction
Transparent file
12.6.14 Background scan
X Background scan
12.6.15 Acquisition of transmission delay
Acquisition of transmission delay
12.6.16 Definition of timeouts
Parameter Default value Remarks Selected values

t1 15 s Time-out of send or test 1 … 255 s
APDUs
t2 10 s Time-out for acknowledges 1 … 255 s
in case of no data messages
t2 < t1
t3 20 s Time-out for sending test 1 … 65 535 s
frames in case of a long idle
state
Maximum range for timeouts t1 to t2: 1 s to 255 s, accuracy 1 s.
Recommended range for timeout t3: 1 s to 48 h, resolution 1 s.
Long timeouts for t3 may be needed in special cases where satellite links or dialup
connections are used (for instance to establish connection and collect values only once per
day or week).
1KGT 150 962 V001 1 63

12.6.17 Maximum number of outstanding I format APDUs k and latest

acknowledge APDUs (w)
Parameter Default value Remarks Selected values

k 12 APDUs Maximum difference 1 … 32 767
receive sequence number
to send state variable
w 8 APDUs Latest acknowledge after 1 … 32 767
receiving w I format APDUs
12.6.18 Port number
Parameter Values Remarks

Port number 2 404 In all cases, except for
19 998 secure connection
12.6.19 Redundant connections
2 Number N of redundancy group connections used
12.6.20 RFC 2200 suite
X Ethernet 802.3
Serial X.21 interface
Other selection from RFC 2200
64 1KGT 150 962 V001 1

Glossary
13 Glossary
AC Alternating Current
AMI Analog Measured value Input
ASDU Application Service Data Unit
ASO Analog Setpoint command Output
BCI Bidirectional Communication Interface
BSI Bit String Input
BSO Bit String Output
CAM Central User Account Management
CMU Communication and Data Processing Unit
DCE Data Communication Equipment
DCO Double Command Output
DMI Digital Measured value Input (8, 16 bit)
DO Digital Output
DPI Double Point Input
DSO Digital Setpoint command Output (8, 16 bit)
EPI Event of Protection equipment Input (1 bit)
FSO Floating Setpoint Command Output
HCI Human Maschine Interface (here Integrated HMI function of the
RTU500 series)
IED Intelligent Electronic Device
IOA Information Object Address
ITI Integrated Totals Input
MAX Maximum
MFI Analog Measured value Floating Input
Min Minimum
MS Microsoft
NCC Network Control Center
PLC Programmable Logic Control
PRP Parallel Redundancy Protocol
RCO Regulation step Command Output
RFC Request for Comments
RTC Real Time Clock
1KGT 150 962 V001 1 65

Glossary
RTU Remote Terminal Unit

SCI Sub-Device Communication Interface
SCO Single Command Output
SEV System Event
SHA Secure Hash Algorithms
SNTP Simple Network Time Protocol (according to RFC 4330)
SOE Sequence-of-Event Queue
SPI Single Point Input or Single point information
STI Step position Input
VPN Virtual Private Network
66 1KGT 150 962 V001 1

1KGT 150 962 V001 1 67

Note:
The specifications, data, design or other information contained in this document (the
“Brochure”) - together: the “Information” - shall only be for information purposes and shall in
no respect be binding. The Brochure does not claim to be exhaustive. Technical data in the
Information are only approximate figures. We reserve the right at any time to make technical
changes or modify the contents of this document without prior notice. The user shall be
solely responsible for the use of any application example or information described within this
document. The described examples and solutions are examples only and do not represent
any comprehensive or complete solution. The user shall determine at its sole discretion, or
as the case may be, customize, program or add value to the ABB products including software
by creating solutions for the end customer and to assess whether and to what extent the
products are suitable and need to be adjusted or customized.
This product is designed to be connected to and to communicate information and data

via a network interface. It is the users sole responsibility to provide and continuously
ensure a secure connection between the product and users or end customers network
or any other network (as the case may be). The user shall establish and maintain any
appropriate measures (such as but not limited to the installation of firewalls, application
of authentication measures, encryption of data, installation of anti-virus programs, etc) to
protect the product, the network, its system and the interface against any kind of security
breaches, unauthorized access, interference, intrusion, leakage and/or theft of data or
information. ABB AG is not liable for any damages and/or losses related to such security
breaches, any unauthorized access, interference, intrusion, leakage and/or theft of data or
information.
ABB AG shall be under no warranty whatsoever whether express or implied and assumes
no responsibility for the information contained in this document or for any errors that may
appear in this document. ABB AG's liability under or in connection with this Brochure or the
files included within the Brochure, irrespective of the legal ground towards any person or
entity, to which the Brochure has been made available, in view of any damages including
costs or losses shall be excluded. In particular ABB AG shall in no event be liable for any
indirect, consequential or special damages, such as – but not limited to – loss of profit,
loss of production, loss of revenue, loss of data, loss of use, loss of earnings, cost of capital
or cost connected with an interruption of business or operation, third party claims. The
exclusion of liability shall not apply in the case of intention or gross negligence. The present
declaration shall be governed by and construed in accordance with the laws of Switzerland
under exclusion of its conflict of laws rules and of the Vienna Convention on the International
Sale of Goods (CISG).
ABB AG reserves all rights in particular copyrights and other intellectual property rights. Any
reproduction, disclosure to third parties or utilization of its contents - in whole or in part - is
not permitted without the prior written consent of ABB AG.
© Copyright ABB 2018
All rights reserved
68 1KGT 150 962 V001 1

1KGT 150 962 V001 1 69

Visit us
ABB AG
Power Grids
P.O. Box 10 03 51
68128 Mannheim, Germany
www.abb.com/remote-terminal-units
1KGT 150 962 V001 1

BCI IEC60870-5-104 en

Uploaded by

Copyright:

Available Formats

BCI IEC60870-5-104 en

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BCI IEC60870-5-104 en

Uploaded by

Copyright:

Available Formats

Power Grids

RTU500 series - Remote Terminal Units

Document identity: 1KGT 150 962 V001 1

5 Parameters and Addressing................................................................................................. 17

6 Data Types - Monitoring Direction..................................................................................... 19

1KGT 150 962 V001 1 I

6.4 DPI – Double Point Information...................................................................................... 23

7 Data Types - Controlling Direction..................................................................................... 33

II 1KGT 150 962 V001 1

7.2.1 Supported Data Types.....................................................................................34

1KGT 150 962 V001 1 III

10.1 General Interrogation........................................................................................................ 47

11 Secure Communication according IEC 62351-3................................................................. 51

IV 1KGT 150 962 V001 1

12.6.8 Command transmission.................................................................................. 62

1KGT 150 962 V001 1 V

VI 1KGT 150 962 V001 1

Network access for IEC 60870-5-101

using standard transport profiles

Parameter name Default Parameter location

In use enabled data point (e.g. SPI) - line GP104

1KGT 150 962 V001 1 7

This layered model is valid for the protocol IEC 60870-5-104.

1.4 Functions of the BCI compared to HCI and SCI

• Structured addresses for ASDU and IOA.

• Structured addresses for ASDU and IOA.

Function HCI SCI BCI

8 1KGT 150 962 V001 1

2.1 IP based Communication

For each Ethernet interface following parameters can be configured:

Parameter name Default Parameter location

Interface mode Auto-negotiation CMU - Network Interfaces

Transmisssion rate and duplex modes.

2.2 Host interface

Parameter name Default Parameter location

Host number 1 CMU - all interfaces

1KGT 150 962 V001 1 9

10 1KGT 150 962 V001 1

For each Ethernet connection a slave IP address is necessary.

Parameter name Default Parameter location

IP address 1 (slave) IED/RTU - Line GP104

1KGT 150 962 V001 1 11

12 1KGT 150 962 V001 1

Parameter name Default Parameter location

Maximum difference receive sequence number 12 APDUs IED/RTU - Line GP104

Table 1: Parameters application layer IEC 60870-5-104: telegram framing

Parameter name Default Parameter location

Time out of connection establishment (t0) 30 sec IED/RTU - Line GP104

t2: Time-out for acknowledges in case of no data messages

Table 2: Parameters application layer IEC 60870-5-104: timeouts

Parameter name Default Parameter location

Time interval of clock synchronization com- disabled IED/RTU - Line GP104

Table 3: Line parameters application layer IEC 60870-5-104: other parameters

1KGT 150 962 V001 1 13

4.2 Communication Queue Handling

Buffer size of priority 1 datapoints 500 entries IED/RTU - Line GP104

4.3 ASDU Type identification

14 1KGT 150 962 V001 1

4.3.1 ASDU in monitoring direction