ug_tlc_120328

Rec 15, Rec 25RC_5_1Telecommunication

Use Guide

4

5

6

7

1

2

3

3

Contents

1. General Abbreviations 6

2. Telecommuication Interface TCI configuration 8

3. DNP3 protocol Overview 10 Device profile 10 DNP3 application layer 12 DNP3 transport layer 38 DNP3 data link layer 40 Physical layer 47

4. Modbus Protocol Overview 52 Application layer 52 Modbus data link layer 61 Physical layer 64

5. IEC 60870-5-104 Protocol Overview 66 Interoperability list 66 Application layer 76 Link layer 82 Physical layer 82

6. Hardware Specification RTU connection 84 Phone modem 85 Radio-modem 85 GSM modem 85 RS485 converter 85

7. Application Guide 88

1

5

General

1

6

Abbreviations

ABR Automatic Backfeed RestorationACK AcknowledgementASDU Application Service Data UnitAPCI Application Protocol Control InformationAPDU Application Protocol Data UnitAR Auto-reclosingBF Bolted Fault ProtectionCA Collision AvoidanceChar CharacterCO Close/Open operationsCON Confirmation CRC Cyclic Redundancy CheckCTS Clear To Send CU Current Unbalance ProtectionDCD Data Carrier DetectDCF Data Flow Control BitDIR Direction Control BitDNP3 Distributed Network ProtocolDRVM Driver ModuleDSR Data Set Ready DTR Data Terminal ReadyEF Earth Fault ProtectionFCB Frame Count BitFIFO First In First OutFUN Function Code HL Hot Line TagIED Intelligent Electronic DeviceIIN Internal IndicationINT IntegerLS Loss Of Supply ProtectionMPM Micro-processing Module OBJ ObjectOC Over-current ProtectionPRM Primary Message BitProt Protections PSM Power Supply ModulePTT Push-To-TalkQ QualifierRAM Random Access MemoryRC Recloser ControlRCM Recloser Control ModuleRI Ring IndicatorRTU Remote Telecommunication UnitTCI Telecommunication InterfaceSBO Select Before OperateSEF Sensitive Earth Fault ProtectionUINT Unsigned IntegerUD User Defined SignalsUF Under-frequency ProtectionUR Unsolicited Response UV Under-voltage ProtectionVAR VariationVU Voltage Unbalance Protection

2

7

Telecommunication Interface

2

8

Telecommunication interface (TCI) provides control and indication via RTU connected to serial port 6 located in the rear of RCM.

If TCI mode is set Disable no control and indication functions are supported via RTU connected to port 6 (refer to Design description for details).

TCI is a user-configurable interface. Configuration includes selection of applicable protocol and RTU in accordance with the following table.

TCI Configuration

The scope of generated indication and control data depends on the configuration, i.e. only data related to selected RTU and protocol are generated.

Protocol RTU applicable range RTU default value

RTU Radio modemPhone modemGSM modem

RS485-RS232 converterDirect connection

Radio modemModbus

IEC104 TCP/IP Network TCP/IP Network

Protocol setting can be set up by one of the following values: DNP3, Modbus or IEC104.

Depending on protocol selected, the RTU setting has different options, given in table below.

3

9

DNP3 Protocol

3

10

Overview

DNP3 is based on the standards of the International Electro technical Commission (IEC) Technical Committee 57, Working Group 03 who have been working on an OSI 3 layer "Enhanced Performance Architecture" (EPA) protocol standard for telecontrol applications. DNP3 has been selected as a Recommended Practice by the IEEE C.2 Task Force; RTU to IED Communications Protocol. For further information refer to www.dnp.org.Triangle MicroWorks, Inc. DNP3 Slave Source Code Library Version 3.00 is used for present DNP3 slave implementation, which complies with DNP 3.0 Subset Definition Level 3, and contains some functionality beyond Subset Level 3. Presentation of data in DNP3 is different from generally used one. So, it is strongly recommended for those not familiar with this subject to go through the following section before switching to DNP3 description. Note that in the description data formats and designations described below will be used without special references.

Device Profile

DNP V3.00DEVICE PROFILE DOCUMENT

Vendor Name: Tavrida Electric

Device Name: Recloser Control (RC), using the Triangle MicroWorks, Inc. DNP3 Multi-Port Slave Source Code Library, version 3.00.

Highest DNP Level Supported: For Requests: Level 3 For Responses: Level 3

Device Function: Master Slave

Notable objects, functions, and/or qualifiers supported in addition to the Highest DNP Levels Supported (the complete list is described in the attached table):

For static (non-change-event) object requests, request qualifier codes 00 and 01 (start-stop), 07 and 08 (limited quantity), and 17 and 28 (index) are supported in addition to request qualifier code 06 (no range or all points). Static object requests received with qualifiers 00, 01, 06, 07, or 08, will be responded with qualifiers 00 or 01. Static object requests received with qualifiers 17 or 28 will be responded with qualifiers 17 or 28. For change-event object requests, qualifiers 17 or 28 are always responded.

16-bit and 32-bit Analog Change Events with Time are supported.

The read function code for Object 50 (Time and Date), variation 1, is supported.

Maximum Data Link Frame Size (octets): Transmitted: Configurable from 64 up to 292 Received 292

Maximum Application Fragment Size (octets): Transmitted: 2048 Received: 2048

Maximum Data Link Retries: None Fixed at ____ Configurable from 0 to 255

Maximum Application Layer Retries: None Configurable

Requires Data Link Layer Confirmation: Never Always Sometimes Configurable as: Never, Sometimes (only for multi-frame messages), or Always.

Requires Application Layer Confirmation: Never Always When reporting Event Data When sending multi-fragment responses Sometimes Configurable as: Only when reporting Event Data or When reporting event data and multi fragment messages.

3

11

Timeouts while waiting for:

Data Link Confirm: None Fixed at ____ Variable Configurable Complete Appl. Fragment: None Fixed at ____ Variable Configurable Application Confirm: None Fixed at ____ Variable Configurable Complete Appl. Response: None Fixed at ____ Variable Configurable

Others:Configurable Transmission Delay: Tx Delay Inter-character Timeout: Char Timeout

Fixed at Select/Operate Arm Timeout: SBO Timeout fixed at 5 sec.

Configurable Need Time Delay: Need Time Delay Unsolicited response retry delay: Retry Delay Unsolicited offline interval: Offline Interval

Sends/Executes Control Operations:

WRITE Binary Outputs Never Always Sometimes Configurable SELECT/OPERATE Never Always Sometimes Configurable DIRECT OPERATE Never Always Sometimes Configurable DIRECT OPERATE NO ACK Never Always Sometimes Configurable

Count > 1 Never Always Sometimes Configurable Pulse On Never Always Sometimes Configurable Pulse Off Never Always Sometimes Configurable Latch On Never Always Sometimes Configurable Latch Off Never Always Sometimes Configurable Queue Never Always Sometimes Configurable Clear Queue Never Always Sometimes Configurable

Reports Binary Input Change Events when no specific variation requested:

Never Only time-tagged Only non-time-tagged Configurable, Sequence of event conception

Reports time-tagged Binary Input Change Events when no specific variation requested:

Never Binary Input Change With Time Binary Input Change With Relative Time Configurable

Sends Unsolicited Responses:

Never Configurable Only certain objects Sometimes (attach explanation) ENABLE/DISABLE UNSOLICITED Function codes supported

Sends Static Data in Unsolicited Responses:

Never When Device Restarts When Status Flags Change

No other options are permitted.

Default Counter Object/Variation:

No Counters Reported Configurable Default Object: 20 Default Variation: Configurable Point-by-point list attached

Counters Roll Over at:

No Counters Reported Configurable (attach explanation) 16 Bits 32 Bits Other Value: Point-by-point list attached

Sends Multi-Fragment Responses: Yes No

3

12

DNP3 Application Layer

The user sends Application User Data to the Application Layer where it is converted to ASDU (Application Service Data Unit). In DNP, the Application User Data is converted into multiple ASDUs. Each ASDU is then prefixed by APCI (Application Protocol Control Information) which is then packaged as an APDU. In DNP, each APDU that is part of the larger multi-APDU is referred to as a fragment and there is a restriction that each fragment contains complete data objects only and that the function code portion of the APCI (Application Protocol Control Information) is identical in each fragment of the same message or multi-APDU. That is, there will be no fragmentation of information objects between APDUs and the same operation must be requested of each object in the message. This is to ensure that each fragment on its own can be processed and also implies that each ASDU contains only complete data objects. In reverse, the Application Layer receives multiple APDU (one at a time) where it removes the APCI to obtain the ASDU and assembles the ASDUs into Application User Data.

Protocol States

The following figure illustrates Application layer state flow diagram

Figure 1

Application layer state flow diagram

Warm restart Normal Cold restart1 2

3 4

States description

State Description

Normal In this state the functions described in sections below are fully supported

Warm restart

In this state the functions described in sections below are supportedIn addition the following actions are executed:. Change event buffers are cleared. Last reported binary counters are zeroed. Last reported analogue inputs are zeroed. Unsolicited response counter (refer to DNP3 application layer indication data) is zeroed. Timeouts counter (refer to DNP3 application layer indication data) is zeroed

Cold restart

In this state the functions described in sections below are not supportedThe following actions are executed:. unsolicited response mode and DNP3 objects settings are cleared from RAM and restored from flash memory . 7-th internal indication bit in first octet is set to 1 (refer to Internal indications). if Unsolicited response mode is enable, NULL unsolicited response is sent (refer to Unsolicited responses).

3

13

Transitions description

Transition Condition

1 Reception of warm restart request (#3)

2 Reception of cold restart request (#2)

3Execution of actions specified above for warm restart state (generally it takes from 10 to 100ms)

4 Reception of request for writing 0 into 8-th internal indication bit (#31)

Application layer settings

General settings

Setting Applicable range Factory default

Confirmation mode Events only/Events and multi-fragments Events and multi-fragments

Confirmation timeout 0 to 3600s 15s

Maximum fragment size 512 to 4096 octets 2048

Time synchronization interval

0 to 64800 min 1440 min

Cold restart delay 0 to 65530 ms, step size 10 ms 5000ms

Warm restart delay 0 to 65530 ms, step size 10 ms 1000ms

Other settings are given in corresponding paragraphs of current section.

Binary Inputs

The following binary inputs are supported: Closed, Dummy on, Remote on, Lockout, AR initiated, Protec-tion active, RC door open, RCM fault, Malfunction, Warning, Prot on, AR on, EF on, SEF on, HL on, ABR on, Group 1 on, Group 2 on, Group 3 on, Group 4 on, UD signal (1...12) on, IOI input (1...12) on.

Binary inputs settings


Mode Enable/Disable

Enable for Dummy on, Closed, Remote on, Lockout, AR initiated, RC door open, Malfunction, Warning, Prot on, AR on, EF on, SEF on, HL on, Group 1 on, Group 2 on, Group 3 on, Group 4 on; Disable for others

Index 0 to 999

1 for Dummy on; 2 for Closed; 3 for Remote on; 4 for Lockout; 5 for AR initiated; 6 for RC door open; 7 for Malfunction; 8 for Warning; 9 for Prot on; 10 for AR on; 11 for EF on; 12 for SEF on; 13 for HL on; 14 for Group 1 on, 15 for Group 2 on, 16 for Group 3 on, 17 for Group 4 on; NA for others

Class 0/1/2/3 1 for Lockout; 2 for Malfunction; 3 for Warning; 0 for others

3

14

The binary input data field consists of one binary octet. Each bit has particular title as indicated in the table below

Bit # Bit titl Activation/deactivation conditions

0 ONLINE Always set to 1

1 RESTART Always set to 0

2 COMM_LOST Always set to 0

3 REMOTE_FORCED Always set to 0

4 LOCAL_FORCED Always set to 0

5 CHATTER_FILTER Always set to 0

6 RESERVED Always set to 0

7 STATE Always repeats to corresponding binary signal

Bits sequence is as follows: 76543210

Binary inputs are requested/responded in different formats (variations).The following table presents overview of the applicable variations

Variation # DNP3 title Description Size

1 Binary input without status 7-th bit only 1 bit

2 Binary input with status The entire octet 1 octet

Binary inputs change event

When 7-th bit of a particular binary input mapped for Class 1, 2 or 3 changes, new value of this binary input together with relevant date and time is added into Change event binary inputs buffer. Fig.1 and attached table illustrate an example of evolution of change event binary inputs buffer for the particular dynamics of a 7-th bit of a binary input having Index 1 and mapped for Class 1 (taken for example and assuming that this binary input has been the only one mapped for Class 1, 2 or 3 and being subject for change within analyzed timeframe).

Figure 2

Analyzed dynamics of the 7-th bit

3

15

Reference timeChange event binary inputs buffer

Index Class Binary input Absolute time

0 - - - -

T1 1 1 1000 0001 t1

T21 1 1000 0001 t2

1 1 0000 0001 t2

T3

1 1 1000 0001 t1

1 1 0000 0001 t2

1 1 1000 0001 t3

T4

1 1 1000 0001 t1

1 1 0000 0001 t2

1 1 1000 0001 t3

1 1 0000 0001 t4

Stored values of binary inputs are downloaded from buffer following relevant solicited and unsolicited responses. In case of solicited response only requested data is downloaded (refer to the description of solicited responses below). In case of class I (I=1/2/3) unsolicited response all binary inputs mapped for class I are downloaded (refer also to description of unsolicited responses below). This buffer is also cleared in Warm or Cold restart states (refer also to Application layer states description).

Binary Outputs

The list of binary outputs is given in Table below.

Binary output Event signal generated at binary output activationEvent signal generated at binary

output deactivation

Set Dummy on Set Dummy on from TCI Set Dummy off from TCI

Close Close request from TCI Trip request from TCI

Set Prot on Set Prot on from TCI Set Prot off from TCI

Set AR on Set AR on from TCI Set AR off from TCI

Set EF on Set EF on from TCI Set EF off from TCI

Set HL on Set HL on from TCI Set HL off from TCI

Set ABR on Set ABR on from TCI Set ABR off from TCI

Set Group 1 on Set Group1 on from TCI NA




Erase protection counters Erase protection counters from TCI NA

Erase energy meters Erase energy meters from TCI NA

Erase logs Erase logs from TCI NA

Erase TCI counters Erase TCI counters from TCI NA

Erase UD counters Erase UD counters from TCI NA

Set UD signal (1...12) on Set UD signal (1...12) on from TCI Set UD signal (1...12) off from TCI

3

16

Binary outputs settings


Mode Enable/DisableEnable for Dummy on, Closed, Prot on, AR on, EF on, SEF on, HL on, Group 1 on, Group 2 on, Group 3 on, Group 4 on; Disable for others

Index 0 to 9991 for Dummy on; 2 for Closed; 3 for Prot on; 4 for AR on; 5 for EF on; 6 for SEF on; 7 for HL on; 8 for Group 1 on, 9 for Group 2 on, 10 for Group 3 on, 11 for Group 4 on; NA for others

The binary output data field consists of one binary octet. Each bit has particular title as indicated in the table below.


0 ONLINEAlways set to 1 when binary signal Remote on=1, set to 0 if Remote on=0 for all binary outputs except of Trip; for which always set to 1





5 CHATTER_FILTER Always set to 0


7 STATE

If state is 0 it can be activated at reception request #12, #13 or sequence of requests #10 and #11 split by time interval not exceeding 5s if control code is Latch on/Pulse on or Close (the latter for binary outputs Dummy on and Closed only) 1) If state is 1 it can be deactivated at reception request #12, #13 or sequence of requests #10 and #11 split by time interval not exceeding 5s if control code is Latch off/Pulse off or Trip (the latter for binary outputs Dummy on and Closed only) 1)

1) Refer also to description of the content of the data field for requests ##10-13

Bits sequence is as follows: 76543210

Binary outputs are requested/responded in different formats (variations).The following table presents overview of the applicable variations


1 Binary output without status 7-th bit only 1 bit

2 Binary output with status The entire octet 1 octet

3

17

Binary Counters

The values of the following counters can be transmitted.

Data point Designation Range

A-phase active energy Wa 0 to 9999999

B-phase active energy Wb 0 to 9999999

C-phase active energy Wc 0 to 9999999

Three-phase active energy W3ph 0 to 9999999

A-phase reactive energy Ea 0 to 9999999

B-phase reactive energy Eb 0 to 9999999

C-phase reactive energy Ec 0 to 9999999

Three-phase reactive energy E3ph 0 to 9999999

BF trips 0 to 30000

OC trips 0 to 30000

EF trips 0 to 30000

SEF trips 0 to 30000

VU trips 0 to 30000

UV trips 0 to 30000

OV trips 0 to 30000

CU trips 0 to 30000

UF trips 0 to 30000

LS trips 0 to 30000

AR OC reclosures 0 to 30000

AR SEF reclosures 0 to 30000

AR UV reclosures 0 to 30000

AR OV reclosures 0 to 30000

AR UF reclosures 0 to 30000

ABR reclosures 0 to 30000

Total CO 0 to 30000

Mechanical wear 0 to 100

Contact wear 0 to 100

Load profile filling 0 to 100

Event log filling 0 to 100

Fault profile filling 0 to 100

Malfunction log filling 0 to 100

Change messages filling 0 to 100

Comms log filling 0 to 100

Transmitted frames 0 to 65535

Received frames 0 to 65535

CRC errors 0 to 65535

Timeouts 0 to 65535

Unsolicited responses 0 to 65535

Class 1 buffer filling 0 to 500



3

18

Binary counters settings


Mode Enable/Disable

Enable for Three phase active energy, Three phase reactive energy,OC trips, EF trips, SEF trips, AR OC reclosures, AR SEF reclosures, AR UV reclosures, AR UV reclosures, Mechanical wear, Contact wear; Disable for others

Index 0 to 999

1 for Three phase active energy, 2 for Three phase reactive energy, 3 for OC trips, 4 for EF trips, 5 for SEF trips, 6 for AR OC reclosures, 7 for AR SEF reclosures, 8 for Mechanical wear, 9 for Contact wear; NA for others

DeadbandSee analogue inputs

range

107 for XXX energy points, 104 for XXX trips, XXX reclosures and Total CO points, 100 for XXX filling and XXX wear points, 65535 for Transmitted frames, Received frames, CRC errors, Timeouts and Unsolicited responses

Class 0/1/2/3 0 for all

The binary counters data field has the following structure

Field Generation rule Size (binary octets) Applicable range

Status Current value of corresponding counter (refer also to the Table above)

1 octet NA

Value Refer to the table below 4 octets (32 bits) 0 to 232-1

Each status bit has particular title as indicated in the table below







5 ROLLOVER

Activates in the following cases:. prior to generation solicited responses #9, #11 and #13 if counter value exceed 216-1 . prior to generation unsolicited responses #5 and #7 if counter value exceeds 216-1. at addition new data into change event binary counter buffer if binary counter default variation is 2 and its value exceeds 216-1 Deactivates in the following cases:. prior to generation solicited responses #8, #10 and #12 or #9, #11 and #13 if counter value does not exceed 216-1. prior to generation unsolicited response #4 and #6 or #5 and #7 if counter value does not exceed 216-1. at addition new data into change event binary counter buffer if binary counter default variation is 1 or 2 and its value does not exceeds 216-1 . at counter erasure (i.e. when its value drops to 0)

6 DISCONTINUITYActivates at counter erasure (i.e. when its value drops to 0)Deactivates at first counter increment (following erasure)


3

19

Status bits sequence is as follows 76543210

Binary counters are requested/responded in different formats (variations).The following table presents overview of the applicable variations


1 32-bit binary counterStatus field followed by Value field (in original 32-bit format)

5 octets

2 16-bit binary counter

Status field followed by 16-bit value transformed from the 32-bit value presented in Value field. Transforma-tion rule is as follows:If original value exceeds 216-1 resultant value is 216-1Otherwise all bits are the bits of the original value

3 octets

Last reported binary counters and change event binary counters

When difference between value of a particular binary counter mapped for Class 1, 2 or 3 and its last reported value reaches selected deadband (refer to Binary counters settings) new last reported value of this counter is generated. Simultaneously this value together with relevant date and time is added into Change event binary counters buffer. Fig. 2 and attached table illustrate an example of evolution of last reported value and change event binary counters buffer for the particular dynamics of a binary counter value having index 7 and mapped for Class 2 (taken for example and assuming that this counter has been the only one mapped for Class 1, 2 or 3 and being subject for change within analyzed timeframe).

Figure 3

Analyzed dynamics of the counter value (Deadband

for this counter in the present example is set to 4)

Reference time Last reported valueChange event binary inputs buffer

Index Status Value Absolute time Class

0 0 - - - - -

T1 4 7 0000 0001 4 t1 2

T2 87 0000 0001 4 t1 2

7 0000 0001 8 t2 2

T3 12

7 0000 0001 4 t1 2

7 0000 0001 8 t2 2

7 0000 0001 12 t3 2

T4 16

7 0000 0001 4 t1 2

7 0000 0001 8 t2 2

7 0000 0001 12 t3 2

7 0000 0001 16 t4 2

Stored values of binary counters are downloaded from buffer following relevant solicited and unsolicited responses. In case of solicited response only requested data is downloaded (refer to the description of solicited responses below). In case of class I (I=1/2/3) unsolicited response all binary counters mapped for class I are downloaded (refer also to description of unsolicited responses below). This buffer is also cleared in Warm or Cold restart states (refer also to Application layer states description). Last reported binary counters are zeroed in Warm or Cold restart states (refer also to Application layer states description).

3

20

Analogue Inputs

The analogue inputs listed in table below are supported.

Data point Designation Range Coefficient

A-phase current Ia 0 to 7000 1B-phase current Ib 0 to 7000 1C-phase current Ic 0 to 7000 1Residual current In 0 to 7000 1Positive sequence current I1 0 to 7000 1Negative sequence current I2 0 to 7000 1Positive sequence voltage related to Source + U1 + 0.0 to 18.0 10Positive sequence voltage related to Source - U1 - 0.0 to 18.0 10Negative sequence voltage related to Source + U2 + 0.0 to 18.0 10Negative sequence voltage related to Source - U2 - 0.0 to 18.0 10Frequency measured from Source + F + 40.00 to 65.00 100Frequency measured from Source - F - 40.00 to 65.00 100A-phase power factor PFa -1.00 to 1.00 100B-phase power factor PFb -1.00 to 1.00 100C-phase power factor PFc -1.00 to 1.00 100Three-phase power factor PF3ph -1.00 to 1.00 100A-phase to earth voltage from Source + Ua + 0.0 to 18.0 10A-phase to earth voltage from Source - Ua - 0.0 to 18.0 10B-phase to earth voltage from Source + Ub + 0.0 to 18.0 10B-phase to earth voltage from Source - Ub - 0.0 to 18.0 10C-phase to earth voltage from Source + Uc + 0.0 to 18.0 10C-phase to earth voltage from Source - Uc - 0.0 to 18.0 10AB phase-to-phase voltage from Source + Uab + 0 to 30000 10AB phase-to-phase voltage from Source - Uab - 0 to 30000 10BC phase-to-phase voltage from Source + Ubc + 0 to 30000 10BC phase-to-phase voltage from Source - Ubc - 0 to 30000 10CA phase-to-phase voltage from Source + Uca + 0 to 30000 10CA phase-to-phase voltage from Source - Uca - 0 to 30000 10A-phase active power Pa -65535 to 65535 1B-phase active power Pb -65535 to 65535 1C-phase active power Pc -65535 to 65535 1Three phase active power P3ph -65535 to 65535 1A-phase reactive power Qa -65535 to 65535 1B-phase reactive power Qb -65535 to 65535 1C-phase reactive power Qc -65535 to 65535 1Three phase reactive power Q3phc -65535 to 65535 1Residual battery capacity 0 to 100 1MPM manufacturing number 0 to 2147483648 1PSM manufacturing number 0 to 2147483648 1DRVM manufacturing number 0 to 2147483648 1A-phase fault current 0 to 7000 1B-phase fault current 0 to 7000 1C-phase fault current 0 to 7000 1Residual fault current 0 to 7000 1Positive sequence fault current 0 to 7000 1Negative sequence fault current 0 to 7000 1Positive sequence fault voltage 0.0 to 18.0 10Negative sequence fault voltage 0.0 to 18.0 10Fault frequency 0.0 to 65.00 100

3

21

Analogue inputs settings


Mode Enable/Disable

Enable for A-phase current, B-phase current, C-phase current, Residual current, Frequency measured from Source+ side, Frequency measured from Source- side, Three phase power factor; Disable for others

Index 0 to 999

1 for A-phase current, 2 for B-phase current, 3 for C-phase current, 4 for Residual current, 5 for Frequency measured from Source +side, 6 for Frequency measured from Source- side, 7 for Three phase power factor; NA for others

Deadband 1 to 65535 1000 for voltages, 100 for others

Class 0/1/2/3 0 for all

The analogue input data field has the following structure

Field Generation rule Size (binary octets) Applicable range

Status Refer to the table below 1 octet NA

Analogue input valueCurrent value of corresponding numerical value multiplied by relevant transformation coefficient (refer to table above)

4 octets 0 to 232-1

Each status bit has particular title as indicated in the table below







5 OVER_RANGE

Activates in the following cases:. prior to generation solicited response #15, #17 and #19 if absolute value of analogue input exceeds 216-1. prior to generation solicited response #9 and #11 if absolute value of analogue input exceeds 216-1

6 REFERENCE_ERR Always set to 0


Status bits sequence is as follows 76543210

Analogue inputs are requested/responded in different formats (variations).The following table presents overview of the applicable variations

3

22


1 32-bit analogue inputStatus field followed by Value field in original (32-bit) format

5 octets

2 16-bit binary counter

Status field followed by 16-bit value transformed from the value presented in Value field. Transformation rules are as follows:7-th (sigh) bit of the second octet of the resultant value is always the 7-th (sigh) bit of the forth octet of the original value. If absolute original value exceeds 215-1, all bits of the resultant value (except of the sign bit) are 1Otherwise all bits (except of the sign bit) are corresponding bits of the original value

3 octets

Last reported analogue inputs and change event analogue inputs

When difference between value of a particular analogue input mapped for Class 1, 2 or 3 and its last reported value exceeds selected deadband (refer to Analogue inputs settings) new last reported value of this input is generated. Simultaneously this value together with relevant date and time is added into Change event analogue inputs buffer. Fig. 3 and attached table illustrate an example of evolution of last reported value and change event analogue input buffer for the particular dynamics of an analogue input value having index 5 and mapped for Class 3 (taken for example and assuming that this analogue input has been the only one mapped for Class 1, 2 or 3 and being subject for change within analyzed timeframe).

Figure 4

Analyzed dynamics of the analogue input value

(Deadband for this analogue input is set to 50)

Reference time Last reported valueChange event binary inputs buffer

Index Status Value Absolute time Class

0 0 - - - - -

T1 50 5 0000 0001 50 t1 3

T2 1005 0000 0001 50 t1 3

5 0000 0001 100 t2 3

T3 150

5 0000 0001 50 t1 3

5 0000 0001 100 t2 3

5 0000 0001 150 t3 3

T4 100

5 0000 0001 50 t1 3

5 0000 0001 100 t2 3

5 0000 0001 150 t3 3

5 0000 0001 100 t4 3

3

23

Stored values of analogue inputs are downloaded from buffer following relevant solicited and unsolicited responses. In case of solicited response only requested data is downloaded (refer to the description of solicited responses below). In case of class I (I=1/2/3) unsolicited response all analogue inputs mapped for class I are downloaded (refer also to description of unsolicited responses below). This buffer is also cleared in Warm or Cold restart states (refer also to Application layer states description). Last reported analogue inputs are zeroed in Warm or Cold restart states (refer also to Application layer states description).

Strings

Data point ValueMPM software version S02.06.0X:MPM/TEL-04E v XX.YY1) 1) - X and Y varies from 0 to 9

Strings settings


Mode Enable/Disable Enable for all

Index 0 to 999 1 for MPM software version

Default Variations


Binary input Object 01 1 (Binary input)/ 2 (Binary input with status) 2

Binary input Object 021 (Binary input change event without time)/ 2 (Binary input changeevent with time)/ 3 (Binary input change event with relative time)

2

Binary output Object 10 1 (Binary output)/ 2 (Binary output status) 2

Binary counter Object 20 32-bit binary counter)/ 2 (16-bit binary counter) 1

Binary counter Object 221 (32-bit counter change event)/ 2 (16-bit binary counter withouttime)/ 5 (32-bit counter change event with time)/ 6 (16-bit binary

counter with time)5

Binary counter Object 22 1 (32-bit analogue input)/ 2 (16-bit analogue input) 1

Analogue input Object 321 (32-bit analogue change event without time)/ 2 (16-bit analoguechange event without time)/ 3 (32-bit analogue change event with

time)/ 4 (16-bit analogue change event with time)3

Units of voltage points Volts (V) / Kilovolts (kV) Kilovolts (kV)

Change event binary inputsThis file is arranged as a FIFO buffer containing up to 500 readings.Each reading includes the following fields

Field Size

Index 2 octets

Binary input 1 octet

Absolute time 6 octets

Class 3 bits

Change Event Buffers

3

24

Data related to each reading (binary input value and absolute time) are requested/responded in different formats (variations).The following table presents overview of the variations applicable within the scope of the present implementation


1 Change event binary input without time Binary input field 1 octet

2 Change event binary input with timeBinary input field followed by Absolute time field

7 octets

Change event binary counters

This file is arranged as a FIFO buffer containing up to 500 readings.Each reading includes the following fields

Field Size

Index 2 octets

Status 1 octet

Value 4 octets


Class 3 bits

Data related to each reading (value, status and absolute time) are requested /responded in different formats(variations).The following table presents overview of the variations applicable within the scope of the present implementation


132-bit change event binary counter without time

Status field followed by Value field 5 octet

216-bit change event binarycounter without time

Status field followed by 16-bit value transformed fromthe value presented in Value field1)

3 octets

532-bit change event binarycounter with time

Status field followed Value field followed by Absolutetime field

11 octets

616-bit change event binarycounter with time

Status field followed by 16-bit value transformed fromthe value presented in Value field1), followed byAbsolute time field

9 octets

1) for transformation rules refer to Binary counters

Change event analog inputs

This file is arranged as a FIFO buffer containing up to 500 readings.Each reading includes the following fields

Field Size

Index 2 octets

Value 4 octet

Status 1 octets


Class 3 bits

3

25

Internal Indications

First octet

Bit Activation/Deactivation conditions

IIN1.0Activates after reception broadcast message, i.e. message with slave address fitting the range 65533-65535 (refer also to data link settings)Deactivates after reception another request or after unsolicited response

IIN1.1

Activates when binary input, binary counter or analogue input mapped for class 1 is logged into change event buffer. Deactivates when all binary inputs, binary counters or analogue inputs mapped for class 1 are downloaded from change event buffers

IIN1.2


IIN1.3


IIN1.4Activates when time synchronization interval 1) expired since last time synchronization procedureDeactivates after time synchronization

IIN1.5 Activates/deactivates at deactivation/activation binary input Remote on

IIN1.6 Activates/deactivates at activation/deactivation binary input Internal fault

IIN1.7Activates after reception cold restart request (#2)Deactivates after reception request for writing 0 into 8-th internal indication bit (#31)

1) Refer to general settings

Data related to each reading (value, status and absolute time) are requested /responded in different formats(variations).The following table presents overview of the variations applicable within the scope of the present implementation


132-bit change event analogueinput without time

Status field followed by Value field 5 octet

216-bit change event analogueinput without time

Status field followed by 16-bit value transformed fromthe value presented in Value field1)

3 octets

332-bit change event analogueinput with time

Status field followed Value field followed by Absolute time field

11 octets

416-bit change event analogueinput with time

Status field followed by 16-bit value transformed fromthe value presented in Value field1), followed byAbsolute time field

9 octets

1) for transformation rules refer to Analogue inputs

3

26

Second octet

Bit Activation/Deactivation conditions

IIN2.0Activates after reception request with invalid function codeDeactivates after reception request with valid function code or after generation unsolicited response

IIN2.1Activates after reception request with invalid object or variation codeDeactivates after reception request with valid object or variation code or after generation unsolicited response

IIN2.2Activates after reception request with invalid qualifier, range or data fieldsDeactivates after reception request with valid qualifier, range or data fields or after generation unsolicited response

IIN2.3Activates at overflow of any change event bufferDeactivates when buffer overflow is eliminated

IIN2.4 Not supported within the scope of the present implementation (always set to 0)

IIN2.5 Not supported within the scope of the present implementation (always set to 0)

IIN2.6 Reserved (always set to 0)

IIN2.7 Reserved (always set to 0)

DNP3 Application Requests

Application request format

Application request represents a binary file comprising in general case of the several fragments. At this each fragment contains in general case the following fields: request header, object header and data. Object header-data fields in general case are repeated several times in one request.Table below represents general structure of the request fragment having two object header-data fields (taken for example)

Field Subfield Size (binary octets) Meaning

Request headerApplication control 1 octet

Used for data flow control, in particular defines first/last fragment in the request, etc

Function code 1 octet Defines function to be performed

Object header

Object group 1 octetDefines DNP3 objects for which mentioned function shall be applied

Variation 1 octetDefines format in which data related to the mentioned objects shall be responded

Qualifier 1 octet Defines size and content of the range field

Range From 0 to 4 octets 1)Defines range of data for which mentioned function shall be applied

Data Data Depends on the content of the response 2)

Defines data that shall be processed (applicable only for requests 10-13 and 23 as defined in the section below)

Object header See above See above See above

Data See above See above See above

1) depending on the qualifier, refer also to the object header content description2) refer also to the section describing content of the data field

3

27

Application control

The following table presents description of the particular bits of the application control

Bit # Bit title Description

7 FIR First fragment bit; set by master station to 1 for the first fragment in relevant application request

6 FINLast fragment bit; set by master station to 1 for the last fragment in relevant application request

5 CON Meaningless to requests; always set to 0

4 UNS Meaningless to requests; always set to 0

3 to 0 SEQSequence; indicates fragment sequence number; master station increments this number by 1 with any new fragment sent; after reaching 15 master station turns this number to 0 at sending next fragment

Valid object header and function codes

The following table presents all values of function codes, object groups, variations, qualifiers and ranges relevant for valid requests within the scope of the present DNP3 implementation (where FUN stays for Function code, OBJ stays for Object group, VAR stays for Variation, Q stays for Qualifier).

# FUN OBJ VAR Q RANGE Meaning

1 0 NA NA NA NA Confirmation message

2 13 NA NA NA NA Request for DNP3 cold restart

3 14 NA NA NA NA Request for DNP3 warm restart

4 1 1 0/1/2 0x00/0x01 nm 1)Request for reading enabled binary inputs having indexes 3) from n to m

5 1 1 0/1/2 0x06 NA Request for reading all enabled binary inputs

6 1 2 0/1/2 0x06 NA Request for reading all change event binary inputs

7 1 2 0/1/2 0x07/0x08 n 2)Request for reading n latest values of the change event binary inputs

8 1 10 0/1/2 0x00/0x01 nm 1)Request for reading enabled binary outputs having indexes 3) from n to m

9 1 10 0/1/2 0x06 NA Request for reading all enabled binary outputs

10 3 12 1 0x17/0x28 1 Request for selecting binary output

11 4 12 1 0x17/0x28 1 Request for operating pre-selected binary output

12 5 12 1 0x17/0x28 1Request for operating binary output (that has not been pre-selected)

13 6 12 1 0x17/0x28 1Request for operating binary output (that has not been pre-selected) without response

14 1 20 0/1/2 0x00/0x01 nm 1)Request for reading enabled binary counters having indexes 3) from n to m

15 1 20 0/1/2 0x06 NA Request of reading all enabled binary counters

16 1 22 0/1/2/5/6 0x06 NA Request of reading all change events binary counters

17 1 22 0/1/2/5/6 0x07/0x08 n 2)Request for reading n latest values of the change event binary counters

18 1 30 0/1/2 0x00/0x01 nm 1)Request for reading enabled analogue inputs having indexes 3) from n to m

3

28

# FUN OBJ VAR Q RANGE Meaning

19 1 30 0/1/2 0x06 NA Request for reading all enabled analogue inputs

20 1 32 0/1/2/3/4 0x06 NA Request for reading all change event analogue inputs

21 1 32 0/1/2/3/4 0x07/0x08 n 3)Request for reading n latest values of the change event analogue inputs

22 1 50 0/1 0x07 1 Request for reading absolute time

23 1 50 1 0x07 1 Request for writing absolute time

24 1 60 1 0x06 NARequest for reading all enabled data points mapped for class 0 3)

25 1 60 2/3/4 0x07/0x08 n 2)Request for reading n latest values of the change event binary inputs, binary counters or analogue inputs mapped for class 1/2/3 3)

26 20 60 2/3/4 0x06 NA Request for enabling Class 1/2/3 unsolicited responses

27 21 60 2/3/4 0x06 NA Request for disabling Class 1/2/3 unsolicited responses

284) 22

60 1/2/3/4 0x06 NA Request for assigning Class 0/1/2/3 to:

1 0 0x00/0x01 nm 1) . enabled binary inputs having indexes3) from n to m

1 0 0x06 NA . all enabled binary inputs

20 0 0x00/0x01 nm 1) . enabled binary counters having indexes3) from n to m

20 0 0x06 NA . all enabled binary counters

30 0 0x00/0x01 nm 1) . enabled analogue inputs having indexes3) from n to m

30 0 0x06 NA . all enabled analogue inputs

29 23 NA NA NA NARequest for measuring communication channel delay time

30 1 80 1 0x00/0x01 nm 4)Request for reading internal indications having indexes 6) from n to m

31 2 80 1 0x00/0x01 77Request for writing 0 into internal indication bit having index 6) 7

32 1 110 0 0x00/0x01 nm 1)Request for reading enabled strings having indexes 3) from n to m

33 1 110 0 0x06 NA Request for reading all enabled strings

1) Notation nm means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is ranged from 0 to 255; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 1000. These values are also referred to as start-stop indexes 2) For qualifiers 0x07 and 0x17 n is a single octet value ranged from 0 to 255; for qualifiers 0x08 and 0x28 n is a double octet value ranged from 0 to 10003) Refer to Application layer: Binary inputs/Binary counters/Analogue inputs settings4) Notation nm means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is ranged from 0 to 15; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 15. These values are also referred to as start-stop indexes 5) Strings 2 to 6 in this request are optional, though at least one must present 6) Refer to Internal indications

3

29

Data field content for request ##10-13

For requests ##10-13 data field includes a single index-object code combinationIf requested qualifier is 17 index field consists of 1 octet and is ranged from 0 to 255; it consists of two octets and is ranged from 0 to 1000 if qualifier is 28.Each object code consists of 11 octets. The following table describes object coding relevant for the present implementation

Data field Size Meaning Range

Control code 1 octet Defines operation to be performed 1/2/3/4/64/128 3)

Count 1 octet Determines how many times the control shall be executed 1) 1

On time 4 octets Defines output activation time after request acceptance 2) 0 to 2 32-1

Off time 4 octets Defines output deactivation time after request acceptance 2) 0 to 2 32-1

Status 1 octet Meaningless for request 0

1) Always 1 within the scope of the present implementation2) Any value ignored within the scope of the present implementation, refer also to Application layer: Binary outputs 3) These codes are also referred to as Pulse on/Pulse off/Latch on/Latch off/Trip/Close correspondingly

Data field content for request #23

For request #23 data field includes 6 octets, reflecting absolute time counted in ms since Jan 1 1970.

DNP3 Application Responses

Solicited Responses

Solicited responses are generated following requests from master station. If total response size exceeds maximum fragment size (refer to general settings) it is split into fragments not exceeding this value. If confirmation mode is set for Events only for responses containing change events (## 3, 4, 10-13, 16-19) RC interrupts transmission after each fragment waiting for the confirmation from master station during selected confirmation timeout. RC restarts transmission after reception confirmation from master station or expiration confirmation timeout. If confirmation mode is set for Events and multi-fragments RC provides similar behaviour for other multi-fragment responses. In all other cases RC transmits requested data without intentional interruptions.

Solicited response represents a binary file comprising in general case of the several fragments. Each fragment in general case has the following fields: response header, object header and data. Object header-data fields in general case are repeated several times in one response.

Table below represents general structure of the response having two object header-data fields (taken for example)

3

30


Response header

Application control 1 octetUsed for data flow control, in particular defines first/last fragment in the response, whether confirmation is requested, etc

Function code 1 octet Defines response as solicited (function code 129)

Internal indications 2 octetsContains information about success/failure to explicitly execute request

Object header

Object group 1 octet Defines responded DNP3 object

Variation 1 octet Defines format of the responded data


Range From 0 to 8 octets 1) Defines range of responded data

Data DataDepends on the content

of the response 2)In general case contains responded data and its indexes



1) depending on the qualifier as described in Valid object header - data combinations2) refer to the description of the data field content in Valid object header - data combinations

Bit # Bit title Generation rules

7 FIR Set to 1 if particular fragment is the first one in relevant response. Always set to 1 for single-fragment responses

6 FINSet to 1 if particular fragment is the last one in relevant response. Always set to 1 for single-fragment responses

5 CON Set to 1 if confirmation mode is Events and multi-fragments (refer to general settings)

4 UNS Always set to 0 for solicited response

3 to 0 SEQThis value increments by 1 at generation each solicited response. If this value reaches 15 it will be set to 0 for the next solicited response

Application control (see table below)

Function code - responded function is 129.Internal indications (see relevant section above).

3

31

Object header-data combinations

If request is invalid RC responds with the response #21 (empty response). RC may respond with one or several object header-data fields to each requested object header-data fields. Several object header-data fields are responded if within requested range some particular objects are disabled. For example, if requested range is 09 (n=0, m=9) and objects having indexes 3, 4 and 6 are disabled; respond will contain three object header-data fields having ranges 02, 55, and 79.The following table presents correlation between valid requests and object header-data fields of relevant responses. For content of particular requests and responses refer to corresponding sections.

Request # Object header-data fields #(s)in relevant responseNumber of object header-data fields

1 NA NA

2 NA NA

3 NA NA

41/2, if requested VAR=1/2 or if requested VAR=0 and default VAR=1/2 1)

Several if there are disabled binary inputs within nm range, else 1

51/2, if requested VAR=1/2 or if requested VAR=0 and default VAR=1/2

Several if there are disabled binary inputs within 0n range, else 1


Always 1


Always 1


Several if there are disabled binary outputs within nm range, else 1


Several if there are disabled binary outputs within 0n range, else 1

10 7 Always 1

11 7 Always 1

12 7 Always 1

13 NA Always 1


Several if there are disabled binary counters within nm range, else 1


Several if there are disabled binary counters within 0n range, else 1

1610/11/12/13, if requested VAR=1/2/5/6 or requested VAR=0 and default VAR=1/2/5/6

Always 1

17 10/11/12/13, if requested VAR=1/2/5/6 or requested VAR=0 and default VAR=1/2/5/6

Always 1

1814/15, if requested VAR=1/2 or if reque-sted VAR=0 and default VAR=1/2

Several if there are disabled analogue inputs within nm range, else 1

1914/15, if requested VAR=1/2 or if reque-sted VAR=0 and default VAR=1/2

Several if there are disabled analogue inputs within 0n range, else 1

2016/17/18/19, if requested VAR=1/2/3/4 or requested VAR=0 and default VAR=1/2/3/4

Always 1

2116/17/18/19, if requested VAR=1/2/3/4 or if requested VAR=0 and default VAR=1/2/3/4

Always 1

22 20 Always 1

23 20 Always 1

3

32

Request # Object header-data fields #(s) in relevant responseNumber of object header-data fields

24

1/2, if default VAR=1/2Several if there are disabled binary inputs within the range of binary inputs mapped for Class 0, else 1

8/9, if default VAR=1/2Several if there are disabled binary counters within the range of binary counters mapped for Class 0, else 1

14/15, if default VAR=1/2Several if there are disabled analogue inputs within the range of analogue inputs mapped for Class 0, else 1

25

3/4, if default VAR=1/2 Always 1

10/11/12/13, if default VAR=1/2/5/6 Always 1

16/17/18/19, if default VAR=1/2/3/4 Always 1

26 NA NA

27 NA NA

28 21 Always 1

29 22 Always 1

30 23 Always 1

31 NA NA

32 24 Several if there are disabled strings within nm range, else 1

33 24Several if there are disabled strings inputs within 0n range, else 1

1) This notation shall be read as follows: Response #1 if requested variation is 1 or if requested variation is 0 and default variation is 1; Response #2 if requested variation is 2 or if requested variation is 0 and default variation is 2

Status codes for response #7

The following table describes conditions of generation of particular status codes for response #7. Note that if several conditions are in force status code related to higher priority condition will be responded. These priorities are as follows (from high to low): NO_SELECTTIMEOUTFORMAT_ERRORNOT_SUPPORTEDLOCALALREADY_ACTIVESUCCESS

Status code Code title Generation condition

0 SUCCESS In all cases except of the listed below

1 TIMEOUT At reception request #11 preceded by request #10 received 5s before and earlier

2 NO_SELECT At reception request #11 that has not been preceded by request #10

3 FORMAT_ERRORAt reception requests ##10-13 with control codes other than Latch on/Latch off/Pulse on/Pulse off/Close/Trip

4 NOT_SUPPORTEDAt reception requests ##10-13 with control codes Close/Trip for another than Dummy on and Closed binary input

5 ALREADY_ACTIVE

At reception requests ##10-13 with control code Latch on/Pulse on/Close (the latter for binary inputs Dummy on and Closed only) for binary output which state is 1 At reception requests ##10-13 with control code Latch off/Pulse off/Trip (the latter for binary inputs Dummy on and Closed only) for binary output which state is 0

7 LOCALAt reception requests ##10-13 when RC is in local mode (except of reception requests ##10-13 with control codes Latch off/Pulse off/Trip applied for binary output Closed)

3

33

Valid object header data combinations

The following table describes object header-data fields valid within the scope of the present implementation, where OBJ stays for Object group, VAR for Variation, Q for Qualifier.

# OBJ VAR Q RANGE DATA

11 1 0x00/0x01 ij 1)

7-th (state) bits of binary inputs having indexes 5) ranged from i to j (refer also to section below)

2 1 2 0x00/0x01 ij 1) Binary inputs having indexes 5) ranged from i to j

3 2 1 0x17/0x28 n 2) n pairs of index 5)-change event binary input without time 6)

4 2 2 0x17/0x28 n 2) n pairs of index 5)-change event binary input with time 6)

5 10 1 0x00/0x01 ij 1)7-th (state) bits of binary outputs having indexes 5) ranged from i to j (refer also to section below)

6 10 2 0x00/0x01 ij 1) Binary outputs having indexes 5) ranged from i to j

7 12 1 0x017/0x08 1 Refer to section below

8 20 1 0x00/0x01 ij 1) 32-bit binary counters having indexes 5) ranged from i to j

9 20 2 0x00/0x01 ij 1) 16-bit binary counters having indexes 5) ranged from i to j

10 22 1 0x17/0x28 n 2) n pairs of index 5)-32-bit change event binary counter without time

11 22 2 0x17/0x28 n 2) n pairs of index 5)-16-bit change event binary counter without time

12 22 5 0x17/0x28 n 2) n pairs of index 5)-32-bit change event binary counter with time

13 22 6 0x17/0x28 n 2) n pairs of index 5)-16-bit change event binary counter with time

14 30 1 0x00/0x01 ij 1) 32-bit analogue inputs having indexes 5) ranged from i to j

15 30 2 0x00/0x01 ij 1) 16-bit analogue inputs having indexes 5) ranged from i to j

16 32 1 0x017/0x08 N n pairs of index 5)-32-bit change event analogue input without time

17 32 2 0x017/0x08 n 2) n pairs of index 5)-16-bit change event analogue input without time

18 32 3 0x017/0x08 n 2) n pairs of index 5)-32-bit change event analogue input with time

19 32 4 0x017/0x08 n 2) n pairs of index 5)-16-bit change event analogue input with time

20 51 NA NA NA Absolute time

21 7) NA NA NA NA NA

22 52 2 0x07 1 18

23 80 1 0x00/0x01 ij 4)Current values of internal indication bits having indexes ranged from i to j

24 110 29 3) 0x00/0x01 ij 1) Current values of strings having indexes 5) ranged from i to j

1) Notation ij means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is ranged from 0 to 255; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 1000. These values are also referred to as start-stop indexes 2) For qualifier 0x17 n and index in data field are single octet values ranged from 0 to 255; for qualifier 0x28 n and index in data field are double octet values ranged from 0 to 10003) Responded string length (always 29 within the present implementation)4) Notation ij means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is ranged from 0 to 15; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 15. These values are also referred to as start-stop indexes 5) Refer to Application layer: Binary inputs/Binary outputs/Binary counters/Analogue inputs/ Strings settings6) For details refer to Internal indications 7) Empty response including just response header field

3

34

Data field structure for response #1 and #5

State bits of the requested binary inputs/outputs in this response are packed into integer number of octets. State bit of the binary input/output with index i has the lowest order. State bit of the binary input/output with index i+1 has next order to the lowest one, and so on. Bits related to not requested binary inputs/outputs are zero. For example for the object header-data fields 1 with the range field is 35, assuming that binary inputs 3, 4 and 5 have state bits 1, 0 and 1 respectively, data field will be represented by a single octet 0000 0101 (0x05 in hexadecimal format).

Data field content for response #7

Data field includes a single index-object code combinationEach object code consists of 11 octets. The following table describes object coding relevant for the present implementation (for details refer also to DNP3 Specification: Object library)

Data field Size Meaning Range

Control code 1 octet Defines performed operation 1/2/3/4/64/128 2)

Count 1 octet Determines how many times the control has been executed 1) 1

On time 4 octets Meaningless within the scope of the present implementation 0 to 10 32-1

Off time 4 octets Meaningless within the scope of the present implementation 0 to 10 32-1

Status 1 octetContains information about success/failure to execute requested operation and failure reason (if applicable)

0 to 5, and 7 3)

1) Always 1 within the scope of the present implementation2) These codes are also referred to as Pulse on/Pulse off/Latch on/Latch off/Trip/Close correspondingly3) Refer also to Application layer: Solicited responses

Unsolicited Responses

Unsolicited responses may be of 1/2/3 class. Class I (I=1/2/3) unsolicited response is initiated when Unsolicited response mode=Enable (refer to Unsolicited response settings), i-th minus one bit of unsolicited response mask is 1, and when total number of binary signals, binary counters and analogue events stored in relevant change event buffers and mapped for class I exceeds selected threshold level (refer also to Unsolicited responses settings). After each unsolicited response RC waits for confirmation request from master station during selected Confirmation timeout (refer to general settings). If confirmation is not received within this time interval, RC resends unsolicited response after selected Retry delay (refer to general settings). Number of unsolicited response retries is determined by likely general setting. If after all responses confirmation still has not been received, RC resumes another batch of retries following selected Offline interval (refer to general settings). This rules apply for the entire unsolicited response if its size does not exceed Maximum fragment size (refer to relevant general setting) or if confirmation mode is set to Events only. If unsolicited response size exceeds Maximum fragment size and confirmation mode is set to Events and multi-fragments this rule applies for each fragment. The following picture presents an example of data flow for unsolicited response consisting of two fragments with the Number of retries set to 2

Figure 5

Example of unsolicited response generation

3

35

UR stays for Unsolicited response, CON for Confirmation message (refer also to Application layer responses), DT for Data transfer, Trd for Retry delay, Toff for Offline interval, Tcon for Confirmation timeout.

Unsolicited response represents a binary data file comprising in general case of the several fragments.Each fragment contains in general case the following fields: response header, object header and data. Object header-data fields are generally repeated several times in one response.

Table below represents general structure of unsolicited response having two object header-data fields (taken for example)


Response header

Application control

1 octet

Used for data flow control, in particular defines first/last fragment in the response, whether confirmation is requested, etc; refer to Application layer description for details

Function code 1 octet Defines response as unsolicited (function code 130)

Internal indications

2 octetsContains information about success/failure to explicitly execute request

Count

Object group 1 octet Defines responded DNP3 object

Variation 1 octet Defines format of the responded data


Range

1 or 2 octets depen-ding on the qualifier (refer to the table below)

Defines range of responded data

Data Data

From 1 to 11 octets depending on the content of reported data

Contains responded data



Application control (see table below)

Bit # Bit title Generation rules

7 FIR Set to 1 if particular fragment is the first one in relevant response. Always set to 1 for single-fragment responses

6 FINSet to 1 if particular fragment is the last one in relevant response. Always set to 1 for single-fragment responses

5 CON Always set to 1 for unsolicited responses

4 UNS Always set to 1 for unsolicited responses

3 to 0 SEQThis value increments by 1 at generation each unsolicited response. If this value reaches 15 it will be set to 0 for the next unsolicited response

Function code - Responded function is 130.Internal indications, refer to relevant section for details.

3

36

Object header-data combinations

In general case unsolicited response includes several object header-data fields ##2-11.Number of these fields corresponds to Class I (I=1/2/3) threshold level (refer to Unsolicited response settings), i.e. number of Class I events stored in all change event buffers at the moment of unsolicited response generation.Object header-data fields start from the earliest change event.Responded variations of the change event binary inputs/binary counters/analogue inputs coincide with their default variations (refer to Default variations settings).Qualifier is 0x17 when responded object index fits the range from 0 to 255 and to 0x28 when this index exceeds 255.

Valid object header-data combinations

The following table presents object header-data fields valid within the scope of the present implementation (OBJ stays for Object group, VAR for Variation, Q for Qualifier).

# OBJ VAR Q RANGE DATA

1 NA 1) NA 1) NA 1) NA 1) NA

2 2 1 0x17/0x28 1 Combination of index 2)-change event binary input without time 3)

3 2 2 0x17/0x28 1 Combination of index 2)-change event binary input with time 3)

4 22 1 0x17/0x28 1 Combination of index 2)-32-bit change event binary counter without time 3)

5 22 2 0x17/0x28 1 Combination of index 2)-16-bit change event binary counter without time 3)

6 22 5 0x17/0x28 1 Combination of index 2)-32-bit change event binary counter with time 3)

7 22 6 0x17/0x28 1 Combination of index 2)-16-bit change event binary counter with time 3)

8 32 1 0x17/0x28 1 Combination of index 2)-32-bit change event analogue input without time 3)

9 32 2 0x17/0x28 1 Combination of index 2)-16-bit change event analogue input without time 3)

10 32 3 0x17/0x28 1 Combination of index 2)-32-bit change event analogue input with time 3)

11 32 4 0x17/0x28 1 Combination of index 2)-16-bit change event analogue input with time 3)

1) This unsolicited response is also called NULL unsolicited response2) For index meaning refer to Application layer: binary inputs/binary counters/analogue inputs settings; for qualifier 0x17 index is a single octet value ranged from 0 to 255, for qualifier 0x28 index is a double octet value ranged from 256 to 1000; 3) For details refer to Change event buffers

Unsolicited response settings


Unsolicited response mode Enable/Disable Enable

Class 1 threshold level 1 to 500 1



Retry delay 1 to 86400s 60s

Number of retries 0 to 255 255

Offline interval 0 to 86400s 300s

3

37

Unsolicited respons mask

The unsolicited mask data field includes three bits having the following order

Bit # 2 0 1

I-th bit of unsolicited response mask is activated following request 26 with VAR=I+1 (where I has range from 1 to 3)I-th bit of unsolicited response mask is deactivated following request 27 with VAR=I+1 (where I has range from 1 to 3)

Uploading Settings via DNP3

Classes for particular data points are assigned following reception of request #28

Control Command Set date and time

This control command is activated at reception request #23.The absolute time field of this command is the data field of the said request.

Applications Layer Indication Data

Data point Generation rules

TimeoutsIncrements with appearance of every confirmation timeout, drops to zero at generation event signal Erase TCI counters

Unsolicited responsesIncrements with appearance of every unsolicited response, drops to zero at generation event signal Erase TCI counters

Class 1 buffer fillingThe number of binary inputs, binary counters and analogue inputs currently stored in relevant change event buffers and mapped for class 1



Last timeout time Date and time of last confirmation timeout appearance

Last unsolicited response time

Date and time of last appearance of unsolicited response

3

38

DNP3 Transport Layer

Transport layer serves two main functions:

. it assembles application layer request fragments from transport layer requests

. it disassembles application layer solicited and unsolicited responses into sequence of transport layer responses

This element does not have user configurable settings

Transport Layer Requests

Transport layer assembles each fragment of the application layer request from the valid sequence of relevant transport layer requests. Sequence of transport layer requests is valid if it complies with the following rules:

. Requests have rising sequence number (SEQ subfield)

. First segment has FIR bit raised

. The other segments have FIR bit set to 0

. Last segment has FIN bit raised

. The other segments have FIN bit set to 0

In this case relevant application layer request fragment is the sequence of data presented in transport layer requests.

For example, the following sequence of transport layer requests (segments) is valid:

Transport layer request 1: FIN=0 FIR=1 SEQ=23 Data=Block1 Transport layer request 2: FIN=0 FIR=0 SEQ=24 Data=Block2Transport layer request 3: FIN=1 FIR=0 SEQ=25 Data=Block3 It will result in assembly of the application layer request fragment consisting of the data blocks 1, 2 and 3

Transport layer request with FIR and FIN bit raised corresponds to single-frame application layer request. In this case it presents the data carried by relevant transport layer request.

Transport layer requests represent binary files (also referred to as transport segments) comprising in general case of the header block followed by data block. Table below represents general structure of the transport layer request

Field Subfield Size Meaning

Transport header

FIN 1bitLast segment bit; when set indicates that this particular segment is the last one in relevant application fragment

FIR 1bitFirst segment bit; when set indicates that this particular segment is the first one in relevant application fragment (refer also to Application requests)

SEQ 6bits

Sequence; indicates frame sequence number; master station increments this number by 1 with any new segment sent; after reaching 63 master station turns this number to 0 at sending next segment

Data NA From 1 to 249 octets Data used for configuration application layer requests

3

39

Transport Layer Responses

If particular fragment of solicited or unsolicited application layer response has such a size (S) that thevalue (IM(S)1) + R(S)2) + 2 + 10) exceeds maximum frame size (refer to Data link settings) transport layerdisassembles this response into sequence of several transport responses.At this each transport layer response starts with the transport header as described in Transport layer responses.Transport layer raises FIR bit for the first segment in said sequence, and FIN bit for the last one. The value set in SEQsubfield increments by 1 at generation each transport layer response. If this value reaches 63 it will be set to 0 forthe next transport layer response.

If size of the particular solicited or unsolicited response does not exceed 249, transport layer forms a single transportlayer response where data carried by this response corresponds to the said solicited/unsolicited response.Transport layer responses represent binary files (also referred to as transport segments) comprising in general case ofthe header block followed by data block. Table below represents general structure of the transport layer response

1) Integer multiply modulo 162) Remainder modulo 16

Field Subfield Size Meaning

Transport header

FIN 1bitLast segment bit; when set indicates that this particular segment is the last one in relevant application fragment (refer also to Solicited/Unsolicited responses)

FIR 1bitFirst segment bit; when set indicates that this particular segment is the first one in relevant application fragment (refer also to Solicited/Unsolicited responses)

SEQ 6bitsSequence; indicates response transport segment sequence number; for generation details refer to Transport layer description

Data NA From 1 to 249 octetsApplication layer data; for generation details refer to Transport layer description

3

40

1) When it is 292, includes data link header (10 octets) and 16 user data blocks; 15 of which contain 18 octets (16 for user data and 2 for CRC) and the last one 12 octets (10 for user data and 2 for CRC)

Data Link Layer RC Requests

RC requests are generated following acceptance of relevant transport layer responses. At this all data presented in transport layer response are used as user data in RC data link layer request. The other fields of the request are filled following description presented in RC requests. If Confirmation mode (refer to settings) is set to Always RC repeats the request after expiration of time interval Confirmation timeout if during this time interval positive acknowledgement has not been received from master station (refer also to Data link layer master responses). At this total number of retries does not exceed set up value of Maximum retries (refer to settings) even if no confirmation from master station is received.

These requests represent binary files comprising in general case of the header block followed by optional data blocks (up to 16 of them). This file is often referred to as a frame. Table below represents structure of the frame having two user data blocks (taken as example)

DNP3 Data Link Layer

Data link layer provides bi-directional data transport (from master station to RC transport layer and vise versa).

In masterslave data transfer direction this is achieved by: . Configuration data received from master station into frames having defined structure;. Rejection frames with invalid structure.

It slavemaster data transfer direction data link layer assures delivery of data received from Transport layer into master station using mechanism of confirmations.

Data link layer settings

Name Applicable range Factory default

Master address 0 to 65534 3

Slave address 0 to 65534 5

Confirmation mode Never/Sometimes/Always Never

Confirmation timeout 0 to 60s 3s

Maximum retries 0 to 255 2

Maximum frame size 64 to 292 1) 292

Validate master address Enable/Disable Disable

Self-addressing Enable/Disable Enable

3

41


Header Block(Block 0)

START 2 octetsThe first octet is always 0x05The second octet is always 0x64

LENGTH 1 octet

The LENGTH subfield specifies the count of non-CRC octets which follow in the header and data blocks. This count includes the CONTROL, DESTINATION and SOURCE subfields in the header and the USER DATA subfields in the body. CRC subfields are not included in the count. The minimum value for this subfield is 5, indicating only the header is present, and the maximum value is 255.

CONTROL 1 octet

The CONTROL subfield contains information about frames direction, transmission initiator, data flow control and function to be performed. For details refer also to the table below

DESTINATION 2 octetsThis subfield contains master station address for RC requests

SOURCE 2 octetsThis subfield contains slave station (RC) address for RC requests

CRC 2 octets16-bit CRC; includes START, LENGTH, CONTROL, DESTINATION and SOURCE subfields

User Data Block 1USER DATA

16 octets for all but last user data blocks

User data to be transferred to master station

CRC 2 octets16-bit CRC; includes all USER DATA related to relevant user data block


From 0 to 16 octets the last user data block which is not 16-th;From 0 to 10 octets for 16-th user data block

User data to be transferred to master station


The following table describes detail structure of the CONTROL subfield relevant for master station requests.

Bits Size (in bits) Meaning

DIR 1 bit Direction control bit; always 0 for RC requests

PRM 1 bit Primary message bit; always 1 for RC request

FCB 1 bit This bit is meaningless for RC requests; always 0

DFC 1 bitData flow control bit; defines whether RC is capable of accepting new request with user data

FUNCTION CODE 4 bitsDefines function to be performed:3 deliver user data with acknowledgement4 deliver user data without acknowledgement

3

42

The following table describes length, control and user data fields relevant for valid RC requests (other fields are the same for all RC request; they are described in the general request structure presented above).

Length Control User data Meaning

6+N 0x43 or 0x53 1)1 transport layer octet and N application layer octets

Deliver user data with confirmation

6+N 0x44 or 0x54 1)1 transport layer octet and N application layer octets

Deliver user data without confirmation

Data Link Layer RC Responses

The following table describes correlation between master station requests and relevant RC responses.

Master station request Relevant RC response

Reset link states Positive acknowledgement

Test link states Positive acknowledgement

Deliver user data with confirmation Positive acknowledgement

Deliver user data without confirmation Not applicable

Request link status Link status

Request with not-supported function Link service not supported

Invalid request Negative acknowledgement

Note that master station requests are recognized as invalid in the following cases:. Any CRC sum is corrupted (refer also to Data link layer master requests). Slave address received from master station (refer to data link layer master requests) does not comply with the Slave address (refer to settings) with Self-addressing set to Disable (refer to settings). Slave address received from master station (refer to Data link layer master requests) complies neither with the Slave address nor the broadcast address 0xFF 0xFC with Self-addressing set to Enable . Master address received in master station request (refer to relevant section) does not comply with the Master address (refer to settings) when Validate master address setting is set to Enable. Request has been received during Confirmation timeout interval (refer to settings) after generation RCE request with Confirmation mode setting being set to Always . For Test link states and Deliver user data with confirmation requests has FCB bit different from what is expected by DNP3 data link layer (data link layer expects this bit to be 1 in the request following Reset link states request; and then being toggled after each RC Positive acknowledgment response)

1) DFC bit is activated/deactivated depending on data link layer ability to accept new requests containing user data; refer also to Data link layer description for details

3

43

These requests are consequently responded with the negative acknowledgement.

The data link layer responses represent binary sequence comprising of the header block having the following structure.



START 2 octetsThe first octet is always 0x05.The second octet is always 0x64.

LENGTH 1 octet Always 5 for RC responses

CONTROL 1 octet

The CONTROL subfield contains information about frames direction, transmission initiator, ability to accept new master station requests containing user data and requests acceptance. For details refer also to the table below

DESTINATION 2 octetsThis subfield contains master station address for RC responses

SOURCE 2 octetsThis subfield contains slave station (RC) address for RC responses

CRC 2 octets16-bit CRC. START, LENGTH, CONTROL, DESTINATION and SOURCE subfields are included when calculating this CRC

The following table describes detail structure of the CONTROL subfield relevant for master station responses.


DIR 1 bitDirection control bit; defines transmission direction; always 0 for RC responses

PRM 1 bitPrimary message bit; defines transmission initiator; always 0 for RC responses

FCB 1 bit This bit is meaningless for RC responses; always 0

DFC 1 bitData flow control bit; defines whether RC is capable of accepting new request with user data

FUNCTION CODE 4 bits

Defines result of the requested function processing:0 positive acknowledgement1 negative acknowledgement11 Report link status request successfully processed; link status reported15 requested function is not supported

The following table describes control subfields relevant for valid RC responses (other fields are the same for all RC responses; they are described in the general response structure presented above).

Control Meaning

0x00 or 0x10 1) Positive acknowledgment; request has been accepted

0x01 or 0x11 1) Negative acknowledgement; request has not been accepted

0x0B or 0x1B 1) Response to Request link status request

0x0F or 0x1F 1) Requested function code is not supported

1) DFC bit is activated/deactivated depending on data link layer ability to accept new requests containing user data; refer also to Data link layer description for details

3

44

Data Link Layer Master Requests

These requests represent binary files comprising in general case of the header block followed by optional user data blocks (up to 16 of them). This file is often referred to as a frame. Table below represents structure of the frame having 2 user data blocks (taken for example).



START 2 octetsThe first octet is always 0x05.The second octet is always 0x64.

LENGTH 1 octet

The LENGTH subfield specifies the count of non-CRC octets which follow in the header and data blocks. This count includes the CONTROL, DESTINATION and SOURCE subfields in the header and the USER DATA subfields in the body. CRC subfields are not included in the count. The minimum value for this subfield is 5, indicating only the header is present, and the maximum value is 255.

CONTROL 1 octet

The CONTROL subfield contains information about frames direction, transmission initiator, data flow con-trol and function to be performed. For details refer also to the table below

DESTINATION 2 octetsFor master station requests this subfield contains either slave station (RC) address or broadcast (0xFF 0xFC) address

SOURCE 2 octetsThis subfield contains master station address for master station requests

CRC 2 octets16-bit CRC; includes START, LENGTH, CONTROL, DE-STINATION and SOURCE subfields


16 octets for all but last user data blocks

User data to be transferred to transport layer



From 0 to 16 octets for the last user data block which is not 16-th;From 0 to 10 octets for 16-th user data block

User data to be transferred to transport layer


3

45

The following table describes the structure of the CONTROL subfield relevant for master station requests.


DIR 1 bit Direction control bit; always 1 for master station requests

PRM 1 bit Primary message bit; always 1 for master station request

FCB 1 bit

Frame count bit; master station toggles this bit every time after reception RC response with positive acknowledgement (refer also to section Data link layer RC responses)

FCV 1 bit

Frame count valid bit; master station raises this bit when slave station (RC) must check FCB bit; this is relevant only for Test link states and Deliver user data with confirmation requests (refer to the list of valid requests below)

FUNCTION CODE 4 bits

Defines function to be performed:0 reset link states2 test link states3 deliver user data with confirmation4 deliver user data without confirmation9 report link status 5,6,7,8,10,11,12,13,14,15 function not supported (reserved)

The following ta

ug_tlc_120328

Documents

control data

dnp3 application layer

dnp3 data link layer

physical layer

modbus data link layer

dnp3 protocol overview

dnp3 transport layer

selected rtu