Notes on the documentation

This description is only intended for the use of trained specialists in control and automation engineering who are familiar with the applicable national standards.
It is essential that the following notes and explanations are followed when installing and commissioning these components.

The responsible staff must ensure that the application or use of the products described satisfy all the requirements for safety, including all the relevant laws, regulations, guidelines and standards.

Disclaimer

The documentation has been prepared with care. The products described are, however, constantly under development.
For that reason the documentation is not in every case checked for consistency with performance data, standards or other characteristics.
In the event that it contains technical or editorial errors, we retain the right to make alterations at any time and without warning.
No claims for the modification of products that have already been supplied may be made on the basis of the data, diagrams and descriptions in this documentation.

Trademarks

Beckhoff®, TwinCAT®, EtherCAT®, Safety over EtherCAT®, TwinSAFE® and XFC® are registered trademarks of and licensed by Beckhoff Automation GmbH.
Other designations used in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owners.

Patent Pending

The TwinCAT Technology is covered, including but not limited to the following patent applications and patents:
EP0851348, US6167425 with corresponding applications or registrations in various other countries.

Copyright

© Beckhoff Automation GmbH & Co. KG, Germany.
The reproduction, distribution and utilization of this document as well as the communication of its contents to others without express authorization are prohibited.
Offenders will be held liable for the payment of damages. All rights reserved in the event of the grant of a patent, utility model or design.


Overview

The library TcIEC870_5_101Master.Lib implements the Beckhoff control station (master) according to the IEC60870-5-101 norm.

‘High level’ interface: IEC 60870-5-101 Control Station

This interface is a so-called ‘single-block solution’. All functions are encapsulated in one PLC block. The block implements the most important services and functions. This implementation is sufficient for over 90% of applications.

Pro: Very little PLC programming work is required in order to create an application; all services, such as general query, counter query, time synchronisation, command execution, spontaneous data transmission etc. are already implemented in the block and are executed automatically; the mapping of the IEC<->PLC process data and that of the data points is configured via function calls; the PLC programmer does not need to be very well acquainted with the protocol standard;

Contra: The PLC application has only a small influence on the execution of the protocol; no influence on the execution of the services – these are automatically implemented internally; time stamps are automatically generated by the block and cannot be changed (handed over by externals); only the direct command execution, for example, is possible; poorer performance if there are many data points.

This interface is recommended if you:

  • are not familiar with the protocol standard;
  • are implementing a simple application with few data points (<1000);
  • are not placing any great performance demands on the application;
  • are not sending any special command execution such as Select/Execute or data + time stamp from external devices;
  • do not require any functions that are not supported according to the compatibility list;


Interoperability

TS6500 | TwinCAT PLC Lib: IEC 60870-5-101 control station (master)

Interoperability list according to IEC 60870-5-101

for TwinCAT PLC Library: IEC 870-5-101 control station (master).

Version: 1.1
Date: 25.03.2011

Here you can open/save the protocol interoperability document (zipped PDF).

Table of contents:

  • General information

    • Project information

  • Compatibility

    • System or device
    • Network configuration
    • Physical layer
    • Link layer
    • Application layer
    • Selection of standardised ASDUs
      • Process information in monitoring direction
      • Process information in control direction
      • System information in monitoring direction
      • System information in control direction
      • Parameter in control direction
      • File transfer
    • Basic application functions
      • Station initialization
      • Cyclic data transfer
      • Read procedure
      • Spontaneous transmission
      • Double transmission
      • Station interrogation
      • Clock synchronisation
      • Command transmission
      • Counter interrogation
      • Parameter loading
      • Parameter activation
      • Test procedure
      • File transfer
      • Background scan
      • Telegram run time acquisition

  • Appendix

    • Beckhoff support and service
      • Beckhoff support
      • Beckhoff service
      • Beckhoff company headquarter

General Information

This compatibility list refers to functions supported within IEC 870-5-101.

Compatibility of the individual components has to be agreed for individual projects by all parties involved.

Project information

Projekt No.: ______________________________________________________________________________

Project: ______________________________________________________________________________

Responsible: ______________________________________________________________________________

Date: ______________________________________________________________________________

Compatibility

The selected parameters should be marked in the white control fields as follows:

Function or ASDU is not used
Function or ASDU is used as specified (preferred option)
Function or ASDU is used in reverse mode
Function or ASDU is used in regular and reverse mode

System or device

System definition
Specifications for the control station (master)
Specifications for the controlled station

Network configuration

Point-to-point | Multipoint-partyline
Multiple point-to-point | Multipoint-star

Physical layer

Transmission speed:

100 bps | 2400 bps | 56000 bps
200 bps | 4800 bps | 64000 bps
300 bps | 9600 bps |
600 bps | 19200 bps |
1200 bps | 38400 bps |

Link layer

According to this application-related standard, only telegram format FT 1.2, single character 1 and the time monitoring interval are used.

Address field of the link layer :

Not available (only balanced transfer)
One octet
Two octets
Structured
Non structured

Link layer transfer procedure:

Balanced transfer
Unbalanced transfer

Telegram length:

Maximum length L 255

In unbalanced mode some ASDU types are send with low (class 2) priority to the control station.

Normed asssignment of ASDU type to class 2 data
Type iedntifier | Cause of transmission

Special assignment of ASDU type to class 2 data
Type iedntifier | Cause of transmission

NOTE: An outstation may return class 1 data when polled for class 2 data if there is no class 2 data available (configuration parameter).

Application layer

Tranfer mode for application data

According to this application-related standard, only mode 1 (octet with the lowest value first) according to 4.10 IEC 60870-5-4 is used.

Common ASDU address

One octet Two octets

Address of the information object

One octet | Structured
Two octets | Non structured
Three octets |

Cause of transmission

One octet Two octets (with origin address).
Preset to 0, if origin address is not available.

Selection of standardised ASDU's

Process information in monitoring direction

<1> := Single-point information | M_SP_NA_1
<2> := Single-point information with time tag | M_SP_TA_1
<3> := Double point information | M_DP_NA_1
<4> := Double point information with time tag | M_DP_TA_1
<5> := Step position information | M_ST_NA_1
<6> := Step position information with time tag | M_ST_TA_1
<7> := Bitstring of 32 bits | M_BO_NA_1
<7> := Bitstring of 32 bits with time tag | M_BO_TA_1
<9> := Measured value, normalized | M_ME_NA_1
<10> := Measured value, normalized value with time tag | M_ME_TA_1
<11> := Measured value, scaled value | M_ME_NB_1
<12> := Measured value, scaled value with time tag | M_ME_TB_1
<13> := Measured value, short floating point value | M_ME_NC_1
<14> := Measured value, short floating point value with time | M_ME_TC_1
<15> := Integrated totals | M_IT_NA_1
<16> := Integrated totals with time tag | M_IT_TA_1
<17> := Event of protection equipment with time tag | M_EP_TA_1
<18> := Packed start events of protection equipment with time tag | M_EP_TB_1
<19> := Packed output circuit information of protection equipment with time tag | M_EP_TC_1
<20> := Packed single-point information with status change detection | M_PS_NA_1
<21> := Measured value, normalized value without quantity descriptor | M_ME_ND_1
<30> := Single-point information with time tag CP56Time2a | M_SP_TB_1
<31> := Double-point information with time tag CP56Time2a | M_DP_TB_1
<32> := Step position information with time tag CP56Time2a | M_ST_TB_1
<33> := Bitstring of 32 bits with time tag CP56Time2a | M_BO_TB_1
<34> := Measured value, normalized value with time tag CP56Time2a | M_ME_TD_1
<35> := Measured value, scaled value with time tag CP56Time2a | M_ME_TE_1
<36> := Measured value, short floating point value with time tag CP56Time2a | M_ME_TF_1
<37> := Integrated totals with time tag CP56Time2a | M_IT_TB_1
<38> := Event of protection equipment with time tag CP56Time2a | M_EP_TD_1
<39> := Packed start events of protection equipment with time tag CP56Time2a | M_EP_TE_1
<40> := Packed output circuit information of protection equipment with time tag CP56Time2a | M_EP_TF_1

Process information in control direction

<45> := Single command | C_SC_NA_1
<46> := Double command | C_DC_NA_1
<47> := Regulating step command | C_RC_NA_1
<48> := Set point command, normalized value | C_SE_NA_1
<49> := Set point command, scaled value | C_SE_NB_1
<50> := Set point command, short floating point value | C_SE_NC_1
<51> := Bitstring of 32 bits | C_BO_NA_1
<58> := Single command with time tag CP56Time2a | C_SC_TA_1
<59> := Double command with time tag CP56Time2a | C_DC_TA_1
<60> := Regulating step command with time tag CP56Time2a | C_RC_TA_1
<61> := Set point command, normalized value with time tag CP56Time2a | C_SE_TA_1
<62> := Set point command, scaled value with time tag CP56Time2a | C_SE_TB_1
<63> := Set point command, short floating point value with time tag CP56Time2a | C_SE_TC_1
<64> := Bitstring of 32 bits with time tag CP56Time2a | C_BO_TA_1

System information in monitoring direction

<70> := End of initialization M_EI_NA_1

System information in control direction

<100> := Interrogation command | C_IC_NA_1
<101> := Counter interrogation command | C_CI_NA_1
<102> := Read command | C_RD_NA_1
<103> := Clock synchronization command | C_CS_NA_1
<104> := Test command | C_TS_NA_1
<105> := Reset process command | C_RP_NA_1
<106> := Delay acquisition command | C_CD_NA_1
<107> := Test command with time tag CP56Time2a | C_TS_TA_1

Parameters in control direction

<110> := Parameter of measured values, normalized value | P_ME_NA_1
<111> := Parameter of measured values, scaled value | P_ME_NB_1
<112> := Parameter of measured values, short floating point value | P_ME_NC_1
<113>:= Parameter activation | P_AC_NA_1

File tranfer

<120>:= File ready | F_FR_NA_1
<121>:= Section ready | F_SR_NA_1
<122> := Call directory, select file, call file, call section | F_SC_NA_1
<123> := Last section, last segment | F_LS_NA_1
<124> := Ack file, ack section | F_AF_NA_1
<125>:= Segment | F_SG_NA_1
<126> := Directory (blank or X, available only in monitor [standard] direction) | F_DR_TA_1

Type identifier and cause of transmission asignments ( station-specific parameters )

The combination of type identifier / cause of transmission is marked as:

Shaded | Function or ASDU are not required.
Empty | Function or ASDU is not used.
 | Only used in standard direction
 | Only used in reverse direction
 | Used in both directions

Cause of transmission

Number | Cause of transmission
<0> | Not used
<1> | Periodic, cyclic
<2> | Background scan
<3> | Spontaneous
<4> | Initialized
<5> | Request or requested
<6> | Activation (ACT)
<7> | Activation confirmation (ACTCON)
<8> | Deactivation (DEACT)
<9> | Deactivation confirmation (DEACTCON)
<10> | Activation termination (ACTTERM)
<11> | Return information caused by a remote command
<12> | Return information caused by a local command
<13> | File transfer
<20..36> | General interrogation
<37..41> | Counter interrogation
<44> | Unknown type identification
<45> | Unknown cause of transmission
<46> | Unknown address of ASDU
<47> | Unknown information object address

Type identification |  | Cause of transmission
 |  | <1> | <2> | <3> | <4> | <5> | <6> | <7> | <8> | <9> | <10> | <11> | <12> | <13> | <20..36> | <37..41> | <44> | <45> | <46> | <47>
 |  | p e r / c y c | b a c k | s p o n t | i n i t | r e q | a c t | a c t c o n | d e a c t | d e a c t c o n | a c t t e r m | r e t r e m | r e t l o c | f i l e | i n r o | r e q c o | u n k n o w n t y p e | u n k n o w n C O T | u n k n o w n C A A | u n k n o w n I O A
<1> | M_SP_NA_1 |  | X | X |  |  |  |  |  |  |  | X |  |  | X |  |  |  |  |
<2> | M_SP_TA_1 |  |  | X |  |  |  |  |  |  |  | X |  |  |  |  |  |  |  |
<3> | M_DP_NA_1 |  | X | X |  |  |  |  |  |  |  | X |  |  | X |  |  |  |  |
<4> | M_DP_TA_1 |  |  | X |  |  |  |  |  |  |  | X |  |  |  |  |  |  |  |
<5> | M_ST_NA_1 |  | X | X |  |  |  |  |  |  |  | X |  |  | X |  |  |  |  |
<6> | M_ST_TA_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<7> | M_BO_NA_1 |  | X | X |  |  |  |  |  |  |  |  |  |  | X |  |  |  |  |
<8> | M_BO_TA_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<9> | M_ME_NA_1 | X | X | X |  |  |  |  |  |  |  |  |  |  | X |  |  |  |  |
<10> | M_ME_TA_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<11> | M_ME_NB_1 | X | X | X |  |  |  |  |  |  |  |  |  |  | X |  |  |  |  |
<12> | M_ME_TB_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<13> | M_ME_NC_1 | X | X | X |  |  |  |  |  |  |  |  |  |  | X |  |  |  |  |
<14> | M_ME_TC_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<15> | M_IT_NA_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  | X |  |  |  |
<16> | M_IT_TA_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  | X |  |  |  |
<17> | M_EP_TA_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<18> | M_EP_TB_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<19> | M_EP_TC_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<20> | M_PS_NA_1 |  | X | X |  |  |  |  |  |  |  | X |  |  | X |  |  |  |  |
<21> | M_ME_ND_1 | X | X | X |  |  |  |  |  |  |  |  |  |  | X |  |  |  |  |
<30> | M_SP_TB_1 |  |  | X |  |  |  |  |  |  |  | X |  |  |  |  |  |  |  |
<31> | M_DP_TB_1 |  |  | X |  |  |  |  |  |  |  | X |  |  |  |  |  |  |  |
<32> | M_ST_TB_1 |  |  | X |  |  |  |  |  |  |  | X |  |  |  |  |  |  |  |
<33> | M_BO_TB_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<34> | M_ME_TD_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<35> | M_ME_TE_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<36> | M_ME_TF_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<37> | M_IT_TB_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  | X |  |  |  |
<38> | M_EP_TD_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<39> | M_EP_TE_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<40> | M_EP_TF_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<45> | C_SC_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<46> | C_DC_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<47> | C_RC_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<48> | C_SE_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<49> | C_SE_NB_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<50> | C_SE_NC_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<51> | C_BO_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<58> | C_SC_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<59> | C_DC_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<60> | C_RC_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<61> | C_SE_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<62> | C_SE_TB_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<63> | C_SE_TC_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<64> | C_BO_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<70> | M_EI_NA_1 |  |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<100> | C_IC_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<101> | C_CI_NA_1 |  |  |  |  |  | X | X |  |  | X |  |  |  |  |  | X | X | X | X
<102> | C_RD_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<103> | C_CS_NA_1 |  |  | X |  |  | X | X |  |  |  |  |  |  |  |  | X | X | X | X
<104> | C_TS_NA_1 |  |  |  |  |  | X | X |  |  |  |  |  |  |  |  | X | X | X | X
<105> | C_RP_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<106> | C_CD_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<107> | C_TS_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<110> | P_ME_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<111> | P_ME_NB_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<112> | P_ME_NC_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<113> | P_AC_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<120> | F_FR_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<121> | F_SR_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<122> | F_SC_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<123> | F_LS_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<124> | F_AF_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<125> | F_SG_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<126> | F_DR_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |

Basic application functions

Station initilization

Remote initialzation

Cyclic data transmission

Cyclic data transmission

Read procedure

Read procedure

Spontaneous transmission

Spontaneous transmission

Double transmission of information objects with cause of transmission spontaneous

The following type identifications may be transmitted in succession caused by a single status change of an information object. The particular information object addresses for which double transmission is enabled are defined in a project specific list.

Single point informaion M_SP_NA_1, M_SP_TA_1, M_SP_TB_1 und M_SP_NA_1
Double point information M_DP_NA_1, M_DP_TA_1 und M_DP_TB_1
Step position information M_ST_NA_1, M_ST_TA_1 und M_ST_TB_1
Bitstring of 32 bits M_BO_NA_1, M_BO_TA_1 und M_BO_TB_1
Measured value, normalized value M_ME_NA_1, M_ME_TA_1, M_ME_ND_1 und M_ME_TD_1
Measured value, scaled value M_ME_NB_1, M_ME_TB_1 und M_ME_TE_1
Measured value, short floating point number M_ME_NC_1, M_ME_TC_1 und M_ME_TF_1

Station interrogation

Global
Group 1
Group 2
Group 3
Group 4
Group 5
Group 6
Group 7
Group 8
Group 9
Group 10
Group 11
Group 12
Group 13
Group 14
Group 15
Group 16

The allocation of information object addresses to each individual group must be specified in a separate table.

Clock synchronization

Clock synchronization

Command transmission

Direct command transmission
Direct setpoint command transmission
Command .selection and execution
Setpoint command .selection and execution
C_SE ACTTERM used
No additional definition
Short pulse duration (duration determined by a system parameter in the outstation)
Long pulse duration (duration determined by a system parameter in the outstation)
Persistent output

Supervision of maximum delay in command direction of commands and setpoint commands

Maximum allowable delay of commands and setpoint commands

Counter interrogation

Counter read
Counter freeze without reset
Counter freeze with reset
Counter reset
General counter request
Request counter group 1
Request counter group 2
Request counter group 3
Request counter group 4
Mode A: Local freeze with spontaneous transmission
Mode B: Local freeze with counter interrogation
Mode C: Freeze and transmit by counter-interrogation commands
Modus D: Freeze by counter-interrogation command, frozen values reported simultaneously

Parameter loading

Threshold value
Smoothing factor
Lower limit value for transmission of measured values
High limit value for transmission of measured values

Parameter activation

Activation/deactivation of cyclic or periodic transmission of the addressed object

Test procedure

Test procedure

File transfer

File transfer in monitoring direction:

Transparent file
Transmission of event sequences
Transmission of disturbance data of protection equipment
Transmission of sequences of recorded analog values

File transfer in control direction:

Transparent file

Background scan

Background scan

Telegram run time acquisition

Telegram run time acquisition

Appendix

Beckhoff support and service

Beckhoff and their partners around the world offer comprehensive service and support, making available fast and competent assistance with all questions related to Beckhoff products and system solutions.

Beckhoff Support and Service is available to you wherever you are in the world, and can be reached by telephone, fax or e-mail. The contact addresses for your country may be found in the list of Beckhoff branches and partner firms.

Beckhoff support

Support offers you comprehensive technical assistance, helping you not only with the application of individual Beckhoff products, but also with other, wide-ranging services:

  • World-wide support;
  • D esign, programming and commissioning of complex automation systems;
  • Extensive training program for Beckhoff system components

Please contact your Beckhoff branch office or representative for local support and service on Beckhoff products!

Beckhoff service

The Beckhoff Service Center supports you in all matters of after-sales service:

  • On-site service;
  • Repair service;
  • Spare parts service;
  • Hotline service

Please contact your Beckhoff branch office or representative for local support and service on Beckhoff products!

Beckhoff company headquarter

Beckhoff Automation
Eiserstr. 5
33415 Verl
Germany

Telefon: + 49 (0) 5246/963-0
Fax: + 49 (0) 5246/963-198
E-Mail: info@beckhoff.de
Web: www.beckhoff.de


Quick start

Simple projects with complete sources can be found here: IEC60870-5-101 control station.

Interoperability check list can be found here: Interoperability check list

Communication- and/or device error code overview can be found here: Error codes

Detailed introduction to implementation of control station in TwinCAT PLC can be found here: TUTORIAL

Short quide

Application object database

The application object database of the central station must be configured as hash table with the function F_iecCreateTableHnd. The individual array elements are linked with each other in the form of a hash table. This enables faster access to the individual data points, but also has certain disadvantages that have to be taken into account:

  • The size of the application database (array size) must not modified at runtime (e.g. through online change). The central station stops execution immediately and reports an error. The reason: The hash table links no longer match. When the program is modified it is best to load the complete project into the runtime system.
  • The individual array elements must not be accessed via the index but via the special functions (e.g. F_iecAddTableEntry etc. ).
  • With indexed table element access the internal configuration parameters must not be overwritten or modified. If the type, the ASDU address or the object address is changed the data point can no longer be found. To reconfigure a data point it should first be removed from the table via function call F_iecRemoveTableEntry. The new data point can then be added.

An implementation in the form of linear table would mean that for each received ASDU (data unit) the central station would have to search the complete array for a suitable element. With a large number of data points this would lead to long execution times.

Protocol parameters

Most protocol parameters are preconfigured with default values and do not have to be set explicitly.

System parameters

The system parameters are also preconfigured with default values. During commissioning it is useful to activate debugging output (dbgMode) in order to be able to locate any errors.

Parameters for cyclic data acquisition

The following parameters are preconfigured with default values:

  • Initialisation sequence (consisting of a test command, time synchronisation, station query and counter query);
  • Cyclic commands:
    • Test command every 60 s;
    • Time synchronisation every 60 s;
    • Group station query: generally every 60 s;
    • Group counter query: generally every 60 s;


Introduction: Overview

TS6500 | TwinCAT PLC Lib: IEC 60870-5-101 control station (master)

Introduction (tutorial)

This introduction explains how to implement and configure an IEC60870-5-101 control station (master) within the TwinCAT PLC.

Here you can unpack the complete PLC sources: TutorialSample.pro


Introduction: Glossary

Glossary

Term | Description
substation, slave, server, controlled station | Synonyms for a subordinate station (which is monitored)
central station, master, client, controlling station | Synonyms for a higher-level station (control station, monitors others stations)
control direction | Data transfer direction from the central station to the substation
monitoring direction | Data transfer direction from the substation to the central station
application objects | IEC information objects in the TwinCAT PLC application (single points, double points, measured values, short floating point values etc.)
APDU | Application protocol data unit
APCI | Application protocol control information
ASDU | Application service data unit
IOA, information object address | Address of the single point, double point, measured value, short floating point value etc.
primary station | Primary station sends commands/requests to the secondary station and controls the data transmission of the secondary station.
secondary station | Secondary station anwers to the requests of the primary station.
combined station | Combined stations are able to act as primary and secondary station (balanced mode).
balanced mode | In balanced mode both stations act as primary and secondary stations and are able to initialize the data transmission.
unbalanced mode | In unbalanced mode only the primary station is able to initialize the data transmissions. The central station acts as primary station and the substation acts as secondary station.


Introduction: New project

Creating a PLC project and integrating PLC libraries

Here you can unpack the complete PLC sources: TutorialSample.pro

  1. Start TwinCAT PLC Control.
  2. Create a new PLC project via File -> New. Select PC or CX (x86 or ARM) as the target system.
  3. A new MAIN program block will now be created automatically. Select ST (Structured Text) as the language for the block. Confirm.
    Rename the new program block to P_MAIN_LowSpeed.
  4. Add second program block and rename it to P_SerialComm_HighSpeed.

  5. Go to the task configuration and configure one fast task (T#1ms) and one slow task (T#10ms).
    Assign the P_SerialComm_HighSpeed to the fast task and the P_MAIN_LowSpeed to the slow task (see picture below).

  6. From the menu select Window -> Library Manager and then Insert -> Additional Library...
  7. Select TcIEC870_5_101Master.Lib from the list of TwinCAT libraries and confirm.


Introduction: Fast PLC task

The fast PLC task

Here you can unpack the complete PLC sources: TutorialSample.pro

Add the following PLC code to the declaration part of P_SerialComm_HighSpeed:

PROGRAM P_SerialComm_HighSpeed
VAR
     fbSerialLineCtrl        : FB_IEC870_SerialLineCtrl := (
                                Mode            := SERIALLINEMODE_PC_COM_PORT, (*SERIALLINEMODE_KL6_5B_STANDARD *)
                         Baudrate                := 19200,
                                NoDatabits      := 8,
                                Parity          := PARITY_EVEN,
                                Stopbits                := 1,
                                Handshake       := HANDSHAKE_NONE,
                                ContinousMode   := FALSE );

        serial_in               AT%IB4000       : PcComInData;
        serial_out      AT%QB4000       : PcComOutData;

        KL6_in          AT%IB4100       : KL6inData5B;
        KL6_out         AT%QB4100       : KL6outData5B;

        hSerial         : T_HSERIALCTRL;
END_VAR

and the instance is called in the program part:

      fbSerialLineCtrl(       pComIn          := SEL( fbSerialLineCtrl.Mode = SERIALLINEMODE_KL6_5B_STANDARD, ADR( serial_in ), ADR( KL6_in ) ),
                                        pComOut         := SEL( fbSerialLineCtrl.Mode = SERIALLINEMODE_KL6_5B_STANDARD, ADR( serial_out ), ADR( KL6_out ) ),
                                        SizeComIn               := SEL( fbSerialLineCtrl.Mode = SERIALLINEMODE_KL6_5B_STANDARD, SIZEOF( serial_in ), SIZEOF( KL6_in ) ),
                                        hSerial         := hSerial );

You can find a Twincat System Manager configuration fitting to the PLC on the example overview page.

Communication via standard PC COMx interface

  • In this case the mode parameter is set to the value: SERIALLINEMODE_PC_COM_PORT.
  • At the TwinCAT System Manager the serial_in and serial_out variables are bound to the corresponding IO variables of the serial interface.
  • The interface will and has to be configured within the TwinCAT System Manager (Baudrate, Parity etc.). Other communication parameters at the FB_IEC870_SerialLineCtrl function block are not relevant at this mode.

Communication via serial Beckhoff Bus Terminals KL6xxx

  • In this case the mode parameter is set to the value: SERIALLINEMODE_KL6_5B_STANDARD.
  • At the TwinCAT System Manager the KL6_in and KL6_out variables are bound to the corresponding IO variables of the serial terminal KL6xxx.
  • The interface is configured within the TwinCAT PLC by the instance of the FB_IEC870_SerialLineCtrlfunction block. Communication parameters like baud rate, parity etc. have to be set via this function block.

Communication via serial Beckhoff Bus Terminals EL6xxx

PROGRAM P_SerialComm_HighSpeed
VAR
        fbSerialLineCtrl : FB_IEC870_SerialLineCtrl := ( Mode := SERIALLINEMODE_EL6_22B );

        EL6_in AT%IB4100 : EL6inData22B;
        EL6_out AT%QB4100 : EL6outData22B;
        hSerial : T_HSERIALCTRL;
END_VAR

fbSerialLineCtrl( pComIn := ADR( EL6_in ),
                pComOut := ADR( EL6_out ),
                SizeComIn := SIZEOF( EL6_in ),
                hSerial := hSerial );
  • In this case the mode parameter is set to the value: SERIALLINEMODE_EL6_22B.
  • At the TwinCAT System Manager the EL6_in and EL6_out variables are bound to the corresponding IO variables of the serial terminal EL6xxx.
  • The interface will and has to be configured within the TwinCAT System Manager (Baudrate, Parity etc.). Other communication parameters at the FB_IEC870_SerialLineCtrl function block are not relevant at this mode.


Introduction: AODB

Defining and configuring an application object database of controling station

Here you can unpack the complete PLC sources: TutorialSample.pro

Application objects = single points, double points, measured values, short floating point values, etc.

In this example the process data in monitoring direction (commands) are placed in the same memory area but on another byte/bit offset than the data of information in control direction. But you can also place the commands to the same byte/bit offset like information in control direction.

Example:

C_SC_NA_1 with IOA = 10 on the same byte/bit offset like M_SP_NA_1 with IOA = 100 (both byte ofset = 100 and bit offset = 0). In this case a change of M_SP_NA_1 value will cause a activation of the C_SC_NA_1 command.

As an example we will configure the following application objects as part of the introductory project:

ASDU identifier | Object address IOA | Group configuration parameter | Base time multiplier | PLC process data area | Byte offset | Bit offset | Process data width in the TwinCAT PLC
M_SP_NA_1 | 100 | General interrogation group global | 0 | Memory | 100 | 0 | 1 bit
M_SP_TA_1 | 101 | General interrogation group global | 0 | Memory | 100 | 1 | 1 Bit
M_SP_TB_1 | 102 | General interrogation group global | 0 | Memory | 100 | 2 | 1 Bit
M_DP_NA_1 | 200 | General interrogation group global | 0 | Memory | 200 | 0 | 2 Bits
M_DP_TA_1 | 201 | General interrogation group global | 0 | Memory | 200 | 2 | 2 Bits
M_DP_TB_1 | 202 | General interrogation group global | 0 | Memory | 200 | 4 | 2 Bits
M_ST_NA_1 | 300 | General interrogation group global | 0 | Memory | 300 | 0 | 1 Byte
M_ST_TA_1 | 301 | General interrogation group global | 0 | Memory | 301 | 0 | 1 Byte
M_ST_TB_1 | 302 | General interrogation group global | 0 | Memory | 302 | 0 | 1 Byte
M_BO_NA_1 | 400 | General interrogation group global | 0 | Memory | 400 | 0 | 4 Byte
M_BO_TA_1 | 401 | General interrogation group global | 0 | Memory | 404 | 0 | 4 Byte
M_BO_TB_1 | 402 | General interrogation group global | 0 | Memory | 408 | 0 | 4 Byte
M_ME_NA_1 | 500 | General interrogation group global | 0 | Memory | 500 | 0 | 2 Byte
M_ME_TA_1 | 501 | General interrogation group global | 0 | Memory | 502 | 0 | 2 Byte
M_ME_TD_1 | 502 | General interrogation group global | 0 | Memory | 504 | 0 | 2 Byte
M_ME_NB_1 | 600 | General interrogation group global | 0 | Memory | 600 | 0 | 2 Byte
M_ME_TB_1 | 601 | General interrogation group global | 0 | Memory | 602 | 0 | 2 Byte
M_ME_TE_1 | 602 | General interrogation group global | 0 | Memory | 604 | 0 | 2 Byte
M_ME_NC_1 | 700 | General interrogation group global | 0 | Memory | 700 | 0 | 4 Byte
M_ME_TC_1 | 701 | General interrogation group global | 0 | Memory | 704 | 0 | 4 Byte
M_ME_TF_1 | 702 | General interrogation group global | 0 | Memory | 708 | 0 | 4 Byte
M_IT_NA_1 | 800 | General counter interrogation and mode A (local freeze with spontaneous transfer every 15s) | 0 | Memory | 800 | 0 | 4 Byte
M_IT_TA_1 | 801 | General counter interrogation and mode A (local freeze with spontaneous transfer every 15s) | 0 | Memory | 804 | 0 | 4 Byte
M_IT_TB_1 | 802 | General counter interrogation and mode A (local freeze with spontaneous transfer every 15s) | 0 | Memory | 808 | 0 | 4 Byte
Commands |  |  |  |  |  |  |
C_SC_NA_1 | 10 | - | 0 | Memory | 2100 | 0 | 1 Bit
C_SC_NA_1 | 11 | - | 0 | Memory | 2100 | 1 | 1 Bit
C_SC_TA_1 | 12 | - | 0 | Memory | 2100 | 2 | 1 Bit
C_DC_NA_1 | 20 | - | 0 | Memory | 2200 | 0 | 2 Bit
C_DC_NA_1 | 21 | - | 0 | Memory | 2200 | 2 | 2 Bit
C_DC_TA_1 | 22 | - | 0 | Memory | 2200 | 4 | 2 Bit
C_BO_NA_1 | 40 | - | 0 | Memory | 2400 | 0 | 4 Byte
C_BO_NA_1 | 41 | - | 0 | Memory | 2404 | 0 | 4 Byte
C_BO_TA_1 | 42 | - | 0 | Memory | 2408 | 0 | 4 Byte
C_SE_NA_1 | 50 | - | 0 | Memory | 2500 | 0 | 2 Byte
C_SE_NA_1 | 51 | - | 0 | Memory | 2502 | 0 | 2 Byte
C_SE_TA_1 | 52 | - | 0 | Memory | 2504 | 0 | 2 Byte
C_SE_NB_1 | 60 | - | 0 | Memory | 2600 | 0 | 2 Byte
C_SE_NB_1 | 61 | - | 0 | Memory | 2602 | 0 | 2 Byte
C_SE_TB_1 | 62 | - | 0 | Memory | 2604 | 0 | 2 Byte
C_SE_NC_1 | 70 | - | 0 | Memory | 2700 | 0 | 4 Byte
C_SE_NC_1 | 71 | - | 0 | Memory | 2704 | 0 | 4 Byte
C_SE_TC_1 | 72 | - | 0 | Memory | 2708 | 0 | 4 Byte

Declaring a database variable

The application object database is an array variable of type ST_IEC870_5_101AODBEntry. Each array element corresponds to an application object.

The array elements are not manipulated directly but through specially provided functions and a database handle (table handle). The database handle must be initialized via a F_iecCreateTableHnd function call before it can be used. During this process the array elements are linked as a hash table. With a larger number of data points the hash table enables faster access to individual data points.

The maximum number of application objects is freely selectable and is only limited by the available memory. During PLC programming you have to specify a constant maximum number. The maximum number of application objects cannot be changed at runtime. In our example 50 application objects are declared. This number is sufficient for most applications. Please note that many application objects require adequate memory and runtime resources.

Define the following variable in P_MAIN_LowSpeed:

PROGRAM P_MAIN_LowSpeed
VAR
     AODB : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;
        hTable          : T_HAODBTable;
END_VAR

Configuring application objects

The object type (M_SP_NA_1, M_DP_NA_1, M_ST_NA_1 etc.), the object address and further object parameters are specified during configuration of the individual application objects.

After initialization of the database handle is the application object database (database array) is empty and must be filled with the required data (data points). The data point configuration for the central station must match the data point configuration for the substation, i.e. in the central station data points of the same type and with the same common ASDU address and the same information object address must be configured as in the substation. Other parameters such as the mapping range and byte/bit offset can be configured as required.

The following functions are available for manipulating the application database:

Function | Description
F_iecCreateTableHnd | Initializes the hash table handle
F_iecAddTableEntry | Configures and adds a new hash table entry
F_iecRemoveTableEntry | Removes a hash table entry
F_iecLookupTableEntry | Checks if a special hash table entry exists
F_iecGetPosOfTableEntry | Determines the linear position of a hash table entry

The required application objects are configured during program runtime. The data base handle is transferred to the function via VAR_IN_OUT. Configuration is usually carried out once during PLC program start-up via an Init routine.

In order to configure the application objects during program start-up, add the following PLC code in P_MAIN_LowSpeed:

PROGRAM P_MAIN_LowSpeed
VAR
        AODB : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;
        hTable          : T_HAODBTable;

     init            : BOOL := TRUE;
        initError               : UDINT;
        asduAddr                : UDINT := 7;
END_VAR

      IF init THEN
        init := FALSE;

        initError := F_iecCreateTableHnd( ADR( AODB ), SIZEOF( AODB ), hTable );
        IF initError <> 0 THEN
                ADSLOGSTR( ADSLOG_MSGTYPE_HINT OR ADSLOG_MSGTYPE_LOG,
                        'F_iecCreateTableHnd() error: %s',
                        DWORD_TO_HEXSTR( initError, 8, FALSE ) );
                RETURN;
        END_IF

  (* Monitored Single Points *)
 initError := F_iecAddTableEntry( M_SP_NA_1, asduAddr, 100, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 100, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_SP_NA_1, asduAddr, 101, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 100, 1, 0, hTable );
        initError := F_iecAddTableEntry( M_SP_TB_1, asduAddr, 102, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 100, 2, 0, hTable );
  (* Double Points*)
 initError := F_iecAddTableEntry( M_DP_NA_1, asduAddr, 200, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 200, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_DP_NA_1, asduAddr, 201, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 200, 2, 0, hTable );
        initError := F_iecAddTableEntry( M_DP_TB_1, asduAddr, 202, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 200, 4, 0, hTable );
  (* Regulating step value *)
 initError := F_iecAddTableEntry( M_ST_NA_1, asduAddr, 300, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 300, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ST_NA_1, asduAddr, 301, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 301, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ST_TB_1, asduAddr, 302, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 302, 0, 0, hTable );
  (* 32 bit string *)
 initError := F_iecAddTableEntry( M_BO_NA_1, asduAddr, 400, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 400, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_BO_NA_1, asduAddr, 401, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 404, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_BO_TB_1, asduAddr, 402, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 408, 0, 0, hTable );
  (* Measured value, normalized value *)
 initError := F_iecAddTableEntry( M_ME_NA_1, asduAddr, 500, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 500, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ME_NA_1, asduAddr, 501, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 502, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ME_TD_1, asduAddr, 502, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 504, 0, 0, hTable );
  (* Mesured value, scaled value *)
 initError := F_iecAddTableEntry( M_ME_NB_1, asduAddr, 600, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 600, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ME_NB_1, asduAddr, 601, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 602, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ME_TE_1, asduAddr, 602, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 604, 0, 0, hTable );
  (* Measured value , short floating point value *)
 initError := F_iecAddTableEntry( M_ME_NC_1, asduAddr, 700, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 700, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ME_NC_1, asduAddr, 701, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 704, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_ME_TF_1, asduAddr, 702, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 708, 0, 0, hTable );
  (* Integrated totals *)
 initError := F_iecAddTableEntry( M_IT_NA_1, asduAddr, 800, IEC870_GRP_REQCOGEN, 0, MAP_AREA_MEMORY, 800, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_IT_NA_1, asduAddr, 801, IEC870_GRP_REQCOGEN, 0, MAP_AREA_MEMORY, 804, 0, 0, hTable );
        initError := F_iecAddTableEntry( M_IT_TB_1, asduAddr, 802, IEC870_GRP_REQCOGEN, 0, MAP_AREA_MEMORY, 808, 0, 0, hTable );

  (* Single commands *)
 initError := F_iecAddTableEntry( C_SC_NA_1, asduAddr, 10, 0, 0, MAP_AREA_MEMORY, 2100, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_SC_NA_1, asduAddr, 11, 0, 0, MAP_AREA_MEMORY, 2100, 1, 0, hTable );
        initError := F_iecAddTableEntry( C_SC_TA_1, asduAddr, 12, 0, 0, MAP_AREA_MEMORY, 2100, 2, 0, hTable );
  (* Double commands *)
 initError := F_iecAddTableEntry( C_DC_NA_1, asduAddr, 20, 0, 0, MAP_AREA_MEMORY, 2200, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_DC_NA_1, asduAddr, 21, 0, 0, MAP_AREA_MEMORY, 2200, 2, 0, hTable );
        initError := F_iecAddTableEntry( C_DC_TA_1, asduAddr, 22, 0, 0, MAP_AREA_MEMORY, 2200, 4, 0, hTable );
  (* 32 bit string commands *)
 initError := F_iecAddTableEntry( C_BO_NA_1, asduAddr, 40, 0, 0, MAP_AREA_MEMORY, 2400, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_BO_NA_1, asduAddr, 41, 0, 0, MAP_AREA_MEMORY, 2404, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_BO_TA_1, asduAddr, 42, 0, 0, MAP_AREA_MEMORY, 2408, 0, 0, hTable );
  (* Set point, normalized values*)
 initError := F_iecAddTableEntry( C_SE_NA_1, asduAddr, 50, 0, 0, MAP_AREA_MEMORY, 2500, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_SE_NA_1, asduAddr, 51, 0, 0, MAP_AREA_MEMORY, 2502, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_SE_TA_1, asduAddr, 52, 0, 0, MAP_AREA_MEMORY, 2504, 0, 0, hTable );
  (* Set point, scaled valuess *)
 initError := F_iecAddTableEntry( C_SE_NB_1, asduAddr, 60, 0, 0, MAP_AREA_MEMORY, 2600, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_SE_NB_1, asduAddr, 61, 0, 0, MAP_AREA_MEMORY, 2602, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_SE_TB_1, asduAddr, 62, 0, 0, MAP_AREA_MEMORY, 2604, 0, 0, hTable );
  (* Set point, short floating point values *)
 initError := F_iecAddTableEntry( C_SE_NC_1, asduAddr, 70, 0, 0, MAP_AREA_MEMORY, 2700, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_SE_NC_1, asduAddr, 71, 0, 0, MAP_AREA_MEMORY, 2704, 0, 0, hTable );
        initError := F_iecAddTableEntry( C_SE_TC_1, asduAddr, 72, 0, 0, MAP_AREA_MEMORY, 2708, 0, 0, hTable );

END_IF


Introduction: Mapping IEC-PLC

Mapping of PLC and IEC process data

Here you can unpack the complete PLC sources: TutorialSample.pro

The TwinCAT PLC process data are cyclically mapped (copied) into the IEC process data (application objects) and vice versa at program runtime. For mapping of the IEC<->PLC process data up to 4 process data areas (IO inputs, IO outputs, memory area, data area) can be declared as buffer variables in the PLC program. The byte size of the buffers is freely selectable and may be different for each area. Its not necessary to declare unused buffer areas.

In our introductory example we declare 4 PLC process data areas with 3000 bytes each:

PROGRAM P_MAIN_LowSpeed
VAR
        AODB    : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;
        hTable  : T_HAODBTable;

        init    : BOOL := TRUE;
        initError       : UDINT;
        asduAddr        : UDINT := 7;

     inputs AT%IB0   : ARRAY[0..2999] OF BYTE;
        outputs AT%QB0  : ARRAY[0..2999] OF BYTE;
        memory AT%MB0   : ARRAY[0..2999] OF BYTE;
        data            : ARRAY[0..2999] OF BYTE;

END_VAR

How the process data are to be mapped at runtime is specified during configuration of the application objects via the F_iecAddTableEntry function.
See also in: Declaration and configuration of application objects.

The buffer variables were now declared as byte arrays. In order to improve access to the required data we define the individual variables a second time and allocate them to the corresponding byte/bit offset addresses. In the event of a change in the byte array the corresponding variable is changed at the same time and vice versa, although this is not compulsory. The bytes/bits of the byte array buffer variables can be accessed directly.

VAR_GLOBAL
(* Memory offset 0..99 unused *)
  (* Single points *)
 msgSingle_0     AT%MX100.0 : BOOL;
        msgSingle_1     AT%MX100.1 : BOOL;
        msgSingle_2     AT%MX100.2 : BOOL;

  (* Double points *)
        (*      Bit 0..1 = first double point,
                Bit 2..3 = second double point,
                Bit 4..5 = third double point,
                Bit 6..7 = fourth double point *)
        msgDouble_0     AT%MB200        : BYTE;

  (* Regulating step values *)
        msgStep_0               AT%MB300        : BYTE;
        msgStep_1               AT%MB301        : BYTE;
        msgStep_2               AT%MB302        : BYTE;

  (* 32 bit strings *)
 msgBitStr_0     AT%MD400        : DWORD;
        msgBitStr_1     AT%MD404        : DWORD;
        msgBitStr_2     AT%MD408        : DWORD;

  (* Measured values, normalized values *)
 msgNormalized_0         AT%MW500        : WORD;
        msgNormalized_1         AT%MW502        : WORD;
        msgNormalized_2         AT%MW504        : WORD;

  (* Mesured values, scaled values *)
 msgScaled_0     AT%MW600        : INT;
        msgScaled_1     AT%MW602        : INT;
        msgScaled_2     AT%MW604        : INT;

  (* Measured values, short floating point values *)
 msgFloating_0   AT%MD700        : REAL;
        msgFloating_1   AT%MD704        : REAL;
        msgFloating_2   AT%MD708        : REAL;

  (* Integrated totals *)
 msgTotal_0      AT%MD800        : UDINT;
        msgTotal_1      AT%MD804        : UDINT;
        msgTotal_2      AT%MD808        : UDINT;

  (* Single commands *)
 cmdSingle_0     AT%MX2100.0 : BOOL;
        cmdSingle_1     AT%MX2100.1 : BOOL;
        cmdSingle_2     AT%MX2100.2 : BOOL;

  (* Double commands *)
        (*      Bit 0..1 = first double command,
                Bit 2..3 = second double command,
                Bit 4..5 = third double command,
                Bit 6..7 = fourth double command *)
 cmdDouble_0     AT%MB2200       : BYTE;

  (* 32 bit string commands *)
 cmdBitStr_0     AT%MD2400       : DWORD;
        cmdBitStr_1     AT%MD2404       : DWORD;
        cmdBitStr_2     AT%MD2408       : DWORD;

  (* Set point, normalized values *)
 cmdNormalized_0         AT%MW2500       : WORD;
        cmdNormalized_1         AT%MW2502       : WORD;
        cmdNormalized_2         AT%MW2504       : WORD;

  (* Set point, scaled values *)
 cmdScaled_0     AT%MW2600       : INT;
        cmdScaled_1     AT%MW2602       : INT;
        cmdScaled_2     AT%MW2604       : INT;

  (* Set point, short floating point values *)
 cmdFloating_0   AT%MD2700       : REAL;
        cmdFloating_1   AT%MD2704       : REAL;
        cmdFloating_2   AT%MD2708       : REAL;
END_VAR

Mapping of the IEC<->PLC process data in the controlling station

Process data in monitoring direction (slave->master information)

Example 1

Single point information (M_SP_NA_1) with the IOA = 100, PLC memory area, byte offset = 100, bit offset = 0.

Controlled station -> ... -> Controlling station FB -> memory[100].0 == msgSingle_0

Example 2

Measured value, short floating point value (M_ME_NC_1) with the IOA = 700, PLC memory area, byte offset = 700, bit offset = 0 (irrelevant).

Controlled station -> ... -> Controlling station FB -> memory[700..703] == msgFloating_0

Process data in control direction (master->slave commands)

Example 1

Single command state (C_SC_NA_1) with the IOA = 10, PLC memory area, byte offset = 2100, bit offset = 0.

cmdSingle_0 == memory[2100].0 -> Controlling station FB -> ... -> Controlled station

Example 2

Set point, short floating point value (C_SE_NC_1) with the IOA = 70, PLC memory area, byte offset = 2700, bit offset = 0 (irrelevant).

cmdFloating_0 == memory[2700..2703] -> Controlling station FB -> ... -> Controlled station


Introduction: Substation function block instance

Declaring and calling an instance of the IEC60870-5-101 controlling station

Here you can unpack the complete PLC sources: TutorialSample.pro

The complete functionality of a controlling station is encapsulated in the FB_IEC870_5_101Master function block. An instance can be used to establish a connection to the controlled station. For establishing a further connection a further instance of the function block can be declared.

Add the following PLC code to the declaration part of P_MAIN_LowSpeed:

PROGRAM P_MAIN_LowSpeed
VAR
        AODB            : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;
        hTable          : T_HAODBTable;

        init            : BOOL := TRUE;
        initError       : UDINT;
        asduAddr                : UDINT := 7;

        inputs AT%IB0   : ARRAY[0..2999] OF BYTE;
        outputs AT%QB0  : ARRAY[0..2999] OF BYTE;
        memory AT%MB0   : ARRAY[0..2999] OF BYTE;
        data            : ARRAY[0..2999] OF BYTE;

     bEnable                 : BOOL := TRUE;
        client          : FB_IEC870_5_101Master;

ND_VAR

and the instance is called in the program part:

IF init THEN
        init := FALSE;
...
ELSE
...

        client(         pAOEntries := ADR( AODB ),
                cbAOEntries := SIZEOF( AODB ),
                pInputs := ADR( inputs ),
                cbInputs := SIZEOF( inputs ),
                pOutputs := ADR( outputs ),
                cbOutputs := SIZEOF( outputs ),
                pMemory := ADR( memory ),
                cbMemory := SIZEOF( memory ),
                pData := ADR( data ),
                cbData := SIZEOF( data ),
                bEnable := bEnable,
                hSerial := P_SerialComm_HighSpeed.hSerial,
                hTable := hTable );

...
END_IF


Introduction: Protocol parameters

IEC60870-5-101 protocol parameters

Here you can unpack the complete PLC sources: TutorialSample.pro

The behaviour of the controlling station can be adapted to the requirements of the slave via the IEC60870-5-101 protocol parameters. Most parameters have preallocated default values that do not have to be changed.

In our example we change the link address, link address octet size and the cycle time of polling for class 1 and class 2 data.

IF init THEN
        init := FALSE;
...
  (*Configure protocol parameter *)
 client.protPara.linkAddr := 220;(* link address of remote slave *)
 client.protPara.eLinkAddrSize := eIEC870_LinkAddr_TwoOctets; (* link addres octet size *)
 client.protPara.tClass1Poll := T#0ms; (* poll class 1 data with max. speed *)
 client.protPara.tClass2Poll := T#0ms; (* poll class 2 data with max. speed *)
...

ELSE
    client( pInputs := ADR( inputs ),
                cbInputs := SIZEOF( inputs ),
                pOutputs := ADR( outputs ),
...

END_IF

The documentation for all transfer protocol parameters can be found here: ST_IEC870_5_101PotocolParams.


Introduction: System parameters

System parameters

Here you can unpack the complete PLC sources: TutorialSample.pro

The common ASDU address and the user functions of the controlling station are configured via the system parameters.

In our introduction we configure the following system parameters:

  • The common ASDU address is set to 7. (asduAddr);
  • The octet size of cause of transmission is set to two octets (one octet COT + one octet originator address) (eCOTSize);
  • The octet size of common asdu address is set to two octets (eAsduAddrSize);
  • The octet size of information object address is set to three octets (eObjAddrSize);
  • Logging of debugging messages in the application log is activated (dbgMode). Logging of device state changes and link layer errors is enabled;

Add the following PLC code to your PLC project:

IF init THEN
        init := FALSE;
...

        client.sysPara.asduAddr := 7;
        client.sysPara.asduFmt.eCOTSize := eIEC870_COT_TwoOctets;(* cause of transfer octet size *)
 client.sysPara.asduFmt.eAsduAddrSize := eIEC870_AsduAddr_TwoOctets;(* common ASDU address octet size *)
 client.sysPara.asduFmt.eObjAddrSize := eIEC870_ObjAddr_ThreeOctets;(* information object address octet size *)
 client.sysPara.dbgMode := IEC870_DEBUGMODE_DEVSTATE OR IEC870_DEBUGMODE_LINKERROR;(* IEC870_DEBUGMODE_ASDU OR IEC870_DEBUGMODE_LINKLAYER *)

...

ELSE
    client( pInputs := ADR( inputs ),
                cbInputs := SIZEOF( inputs ),
                pOutputs := ADR( outputs ),
...

END_IF

The documentation for all system parameters can be found here: ST_IEC870_5_101SystemParams.


Introduction: Initialisation sequence

Initialisation sequence

Here you can unpack the complete PLC sources: TutorialSample.pro

client.acqPara.arrInitSeq[0] := eIEC870_ISTEP_TEST; (* Send test command *)
client.acqPara.arrInitSeq[1] := eIEC870_ISTEP_CLOCK; (* Send clock synchronization command *)
client.acqPara.arrInitSeq[2] := eIEC870_ISTEP_GENRO; (* Send general interrogation command *)
client.acqPara.arrInitSeq[3] := eIEC870_ISTEP_CORO; (* Send counter interrogation command *)
client.acqPara.arrInitSeq[5] := eIEC870_ISTEP_UNUSED; (* not used *)


Introduction: Station interrogation

Station interrogation

Here you can unpack the complete PLC sources: TutorialSample.pro

The station interrogation command is initiated by the central station. The ID field of the command also contains the group (1 to 16 or general). The substation transfers the application objects associated with this group to the central station with cause of transmission <20> to <36>. Application objects with time tags are transferred without time tags.

client.acqPara.arrGenro[0].tPollCycle := T#60s;
client.acqPara.arrGenro[0].eQOI := eIEC870_QOI_INROGEN;
client.acqPara.arrGenro[0].bEnable := TRUE;


Introduction: Counter interrogation

Transfer of integrated totals (counter interrogation)

Here you can unpack the complete PLC sources: TutorialSample.pro

General count transfer model:

The actual values are added by counters. Via a re-store command that is either received by the central station or generated locally (in the substation), the actual values can be re-stored (copied) periodically into re-stored values. After freezing, the recorded value is either reset to zero (logging of incremental values), or the counter continues adding up (logging of counter readings).

Application objects with counts are assigned to groups. The groups are frozen individually, reset, or transferred. The central station sends count query commands to the substation. The task to be carried out (FRZ) and the group (RQT) are specified in an ID field of the command (QCC).

The allocation of the application objects to the individual groups (1 to 4 or general) is specified via the group flag parameter during configuration. There are four operating modes for recording counter readings and incremental values. Each mode includes notes about the configuration of the system parameters or the application objects.

Mode A: local freeze with spontaneous transfer

The substation internally initiates freeze or freeze with reset. The frozen counts are transferred spontaneously, once the freeze or freeze with reset function was executed. In this mode the central station does not issue any count query commands.

Configuration of the system parameters:

Configuration of the application objects:

Mode B: Local freeze with counter interrogation

The substation internally initiates freeze or freeze with reset. The central station queries the frozen counts via count query commands. In this case the central station must not use freeze or freeze with reset in the command ID field (FRZ=0). The counts are queried generally or in groups 1 to 4.

Configuration of the system parameters:

Configuration of the application objects:

Mode C: The central station initiates freeze, freeze with reset, or reset

The central station periodically issues a count query command to the substation for controlling the freeze or (and) reset process. This command does not result in a count transfer. The central station sends a subsequent count query command for collecting the frozen counts. This is similar to operating mode B.

Configuration of the system parameters:

Configuration of the application objects:

Mode D: The central station initiates freeze and (or) reset, and the frozen values are transferred spontaneously

This mode is a combination of the count command from the central station as in mode C and spontaneous transfer of the counts as in mode A.

Configuration of the system parameters:

Configuration of the application objects:


Introduction: Time synchronisation

TS6500 | TwinCAT PLC Lib: IEC 60870-5-101 control station (master)

Clock (time) synchronisation

Here you can unpack the complete PLC sources: TutorialSample.pro

Under construction...


Introduction: Testing the communication

Testing the communication

Here you can unpack the complete PLC sources: TutorialSample.pro

You can simulate the command transmission. Setting the bExecuteCmd variable to TRUE enables and to FALSE disables the simulation. In our example single command (C_SC_NA_1, IOA = 10) is send cyclicaly every 10 seconds to the controlled station.

PROGRAM MAIN
VAR
        ...

        bExecuteCmd : BOOL;
        timer : TON;

        ...
END_VAR

...

(* Simple command simulation *)
timer( IN := bExecuteCmd, PT := T#10s ); (* Send cyclic command *)
IF timer.Q THEN
        timer( IN := FALSE );
        cmdSingle_0 := NOT cmdSingle_0; (* toggle single command ON<->OFF *)

(*      cmdDouble_0 := SEL( cmdDouble_0 = 1, 1, 2 );

        cmdBitStr_0 := cmdBitStr_0 + 1;

        cmdNormalized_0 := cmdNormalized_0 + 2;

        cmdScaled_0 := cmdScaled_0 + 4;

        cmdFloating_0 := cmdFloating_0 + 1.2; *)
END_IF

...


Introduction: Protocol and data transmission errors

Protocol and data transmission errors

Here you can unpack the complete PLC sources: TutorialSample.pro

The station error messages are placed into a FIFO. Up to 10 error messages can be stored. At fatal communication errors (e.g. error of the linking layer, the check sum of the frame doesn't fit) the connection is cut and has to be build on new. Errors within the application layer (e.g. the ADSU send buffer is overflowed by to many frames) are only logged and doesn't cut the connection.

For this errors it is also possible to cut the connection out of the application. In addition to the error code also the error source is notified in the error message. This simplifies the localization of an error.

Example

The occurring error messages of an IEC 60870-5-101 control station can be read out via the request:

PROGRAM MAIN
VAR
...

        client : FB_IEC870_5_101Master;

...
END_VAR

....

REPEAT
        client.system.device.errors.RemoveError( );
        IF client.system.device.errors.bOk THEN
                ADSLOGSTR( ADSLOG_MSGTYPE_ERROR OR ADSLOG_MSGTYPE_LOG,
                        'IEC60870-5-101 master error: 0x%s',
                        DWORD_TO_HEXSTR( client.system.device.errors.getError.nErrId, 8, FALSE) );
        END_IF
UNTIL NOT client.system.device.errors.bOk
END_REPEAT
...


Introduction: Troubleshooting and debugging

Troubleshooting and debugging

Debugging messages written to the application log facilitate troubleshooting of the system. Currently three stages of debugging messages can be activated in an IEC application. These messages can be activated via the dbgMode system parameter of the control station (ST_IEC870_5_101SystemParams).

  1. Station status messages (dbgMode: IEC870_DEBUGMODE_DEVSTATE);
  2. Hexadecimal output of the ASDUs (frames without link layer control header, dbgMode: IEC870_DEBUGMODE_ASDU). 32 ASDU data bytes per row are output as hexadecimal numbers. Bigger frames are split into multiple lines;
  3. Hexadecimal output of the APDUs (serial frames, dbgMode: IEC870_DEBUGMODE_LINKLAYER). 32 APDU data bytes per row are output as hexadecimal numbers. Bigger frames are split into multiple lines;

Using additional option it is also possible to output the link layer errors (dbgMode: IEC870_DEBUGMODE_LINKERROR). In order to view the debugging messages start the TwinCAT System Manager and activate log view. A debugging output is shown below. The three different message types are identified with the respective numbers.

Further diagnostic tools:

  • Portmon for Windows (v3.02, Windows Sysinternals);
  • Diverse protocoll test suite products;


Introduction: Configuration of serial interface

Configuration of serial interface

  • Configuration of standard PC COMx port
  • Configuration of serial KL6xxx bus terminal
  • Configuration of serial EL6xxx bus terminal

1. Configuration of standard PC COMx port

The serial interface can only be added in PC/CX systems.

Right-click on "I/O devices". Select "Append Device". Select "Serial Interface" under "Miscellaneous". Then set the following settings.

1.1. Serial Port tab settings

Serial interface COM1

1.2. Communication Properties tab settings

Select the option KL6xxx1 Mode (Emulation) and set the communication parameter:

Baud rate, here 19200 Baud, 8 data bits, Parity = even, 1 stop bit

2. Configuration of serial KL6xxx bus terminal

The interface is configured within the TwinCAT PLC by the instance of the FB_IEC870_SerialLineCtrlfunction block. Communication parameters like baud rate, parity etc. have to be set via this function block.

3. Configuration of serial EL6xxx bus terminal

The settings for the serial interface can be found in the CoE Online tab (CoE=CanOpen over EtherCAT). The tab is only available for online access to the terminal, i.e. the settings cannot be modified if the System Manager is not linked to the hardware. The settings are stored in the terminal in a non-volatile manner, i.e. the settings are retained even if the voltage supply fails. These data do not have to be re-entered after a terminal scan. If the terminal is replaced, the data from the new terminal become active and have to be adjusted. To avoid this, the modified data can be entered in the Startup tab. During system startup, the data from the Startup tab are transferred to the terminal. Terminals can then be replaced without problem. After a terminal scan, the data have to be re-entered in the Startup tab.

3.1. CoE tab settings

(1) Baud rate, here 19200 Baud

(2) Date frame, 8E1 corresponds to 8 data bits, Parity = even, 1 stop bit

(3) Feature bits -> Enable RTS/CTS = FALSE for EL6001

Double-clicking on the corresponding row brings up a menu in which the settings can be modified.

3.1.1 RS485 operating mode

In the RS485 mode, the data is exchanged by means of half duplex transfer. The transmit and receive lines are connected to one another in RS485 operating mode. As a result, the terminal receives not only the data from other devices, but also its own transmitted data. The own data may disturb the communication. This can be suppressed with the option "Enable half duplex" in the "COM Settings" object (index 8000:06).

3.2. Startup tab settings

All non-standard settings should be entered in the Startup list. During system startup, the data from the Startup tab are transferred to the terminal. Terminals can then be replaced without problem. After a terminal scan, the data have to be re-entered in the Startup tab.

Baud rate, here 19200 Baud

Date frame, 8E1 corresponds to 8 data bits, Parity = even, 1 stop bit

Feature bits -> Enable RTS/CTS = FALSE for EL6001


FB_IEC870_5_101Master

FUNCTION_BLOCK FB_IEC870_5_101Master

An instance of the FB_IEC870_5_101Master function block can be used to implement an IEC60870-5-101 central station (master) in the TwinCAT PLC. A connection to the slave is established for each instance of the function block. Normally the data exchange is started automatically once the connection is established. This is the default configuration of the function block.

VAR_IN_OUT

VAR_IN_OUT
        hSerial         : T_HSERIALCTRL;
        hTable  : T_HAODBTable;
END_VAR

hSerial:

hTable: Application object database handle (hash table handle). The table handle must be initialised once with the function F_iecCreateTableHnd before it can be used.

VAR_INPUT

VAR_INPUT
        protPara        : ST_IEC870_5_101ProtocolParams := ( eType := eIEC870_101_MASTER );
        sysPara                 : ST_IEC870_5_101SystemParams := ( bEndOfInit := FALSE );
        acqPara                 : ST_IEC870_5_101AcquisitionParams;
        pAOEntries      : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF ST_IEC870_5_101AODBEntry := 0;
        cbAOEntries     : UDINT := 0;
        pInputs                 : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbInputs                : UDINT := 0;
        pOutputs                : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbOutputs       : UDINT := 0;
        pMemory                 : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbMemory                : UDINT := 0;
        pData           : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbData          : UDINT := 0;
        bEnable                 : BOOL := TRUE;
END_VAR

protPara: IEC60870-5-101 protocol parameter.

sysPara: System parameter.

acqPara: Parameter for cyclic data acquisition.

pAOEntries: Address of the application object database variables.

cbAOEntries: Byte size of the application object database variables.

pInputs: Address of the PLC process data area for the inputs.

cbInputs: Byte size of the PLC process data area for the inputs.

pOutputs: Address of the PLC process data area for the outputs.

cbOutputs: Byte size of the PLC process data area for the outputs.

pMamory: Address of the PLC process data area for the flags.

cbMamory: Byte size of the PLC process data area for the flags.

pData: Address of the PLC data area.

cbData: Byte size of the PLC data area.

bEnable : Activates/deactivates the function block (communication and connections).

The addresses can be determined with the ADR operator and the byte sizes with the SIZEOF operator.

VAR_OUTPUT

VAR_OUTPUT
        system  : ST_IEC870_5_101ExSystemInterface;
        eState  : E_IEC870_5_101SerialLinkState := eSERIALLINK_DISCONNECTED;
END_VAR

system: system interface. This variable is used by other IEC application functions as a communication interface for the IEC device (here: central station).

  • Member variable system.device is expected by the F_iecSetAOQuality function as VAR_IN_OUT parameter, for example.
  • Member variable system.device.errors is a device error FIFO. The PLC application can read and analyse registered errors.

eState: Status of the connection with the slave..

Example in ST: IEC60870-5-101 central station

Development environment | Target system type | PLC libraries to be linked
TwinCAT v2.10.0 Build >= 1328 | PC or CX (X86, ARM) | TcIEC870_5_101Master.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcUtilities.Lib; COMLibV2.Lib; TcIEC870_5_101Link.Lib; TcIEC870_5_101.Lib; are included automatically )


F_GetVersionTcIEC870_5_101Master

FUNCTION F_GetVersionTcIEC870_5_101Master

This function reads version information from the plc library.

FUNCTION F_GetVersionTcIEC870_5_101Master: UINT

VAR_INPUT
        nVersionElement : INT;
END_VAR

nVersionElement : Version element, that is to be read. Possible parameters:

  • 1 : major number;
  • 2 : minor number;
  • 3 : revision number;
Development Environment | Target System | PLC libraries to include
TwinCAT v2.10.0 Build >= 1328 | PC or CX (x86, ARM) | TcIEC870_5_101Master.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcUtilities.Lib; COMLibV2.Lib; TcIEC870_5_101Link.Lib; TcIEC870_5_101.Lib are included automatically )


ST_IEC870_5_101ExSystemInterface

TYPE ST_IEC870_5_101ExSystemInterface

TYPE ST_IEC870_5_101ExSystemInterface :
STRUCT
        device  : ST_IEC870_5_101DeviceInterface;
        service         : ST_IEC870_5_101SystemServices;
        hSOTable : T_HAODBTABLE;
END_STRUCT
END_TYPE

device: Communication interface of IEC device;

service: IEC device service;

hSOTable : System object database handle;

Development environment | Target system type | PLC libraries to be linked
TwinCAT v2.10.0 Build >= 1328 | PC or CX (x86, ARM) | TcIEC870_5_101Master.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcUtilities.Lib; COMLibv2.Lib; TcIEC870_5_101Link.Lib; TcIEC870_5_101.Lib are included automatically )


Error codes overview

TwinCAT IEC 60870-5-101 control station error codes

Codes (hex) | Codes (dec) | Error source | Description
0x00000000-0x00002000 | 0-8192 | Serial communication errors | Serial communication error (only if error source = eIEC870_ESRC_IEC60870_5_101LINK ).
0x00000000-0x00007800 | 0-30720 | TwinCAT System error | TwinCAT System error (ADS error codes inclusive only if error error source <> eIEC870_ESRC_IEC60870_5_101LINK ).
0x00008100-0x000081FF | 32768-33023 | IEC 60870-5-10x error | Internal IEC 60870-5-10x error


Troubleshooting

Troubleshooting/diagnostics

  1. Check the hardware and software requirements described in this documentation (TwinCAT version, CE image version etc.).
  2. Compare the interoperability check list of control station and controlled station.
  3. Check the IO configuration and mapping of PLC variables in TwinCAT System Manager (configuration of serial interface, baudrate, parity, stoppbits settings). Compare them to the parameters set in the controlled station.
  4. Check whether the function block issues an error code/source. The documentation for the error codes can be found here: Overview of error codes.
  5. Check the protocol parameters that are transferred to the function block (link address, link address octet size, FRAMELength etc.). Compare them to the parameters set in the controlled station.
  6. Check the system parameter that are transferred to the function block (ASDU address, ASDU address octet size, information object address octet size, cause of transfer octet size, etc. ). Compare them to the the parameters set in the controlled station.
  7. Check the acquisition parameters that are transferred to the function block (initialisation sequence, cyclic general interrogation, cyclic counter interrogation, cyclic test commands, etc. ).
  8. Check the configured data points (type, information object address etc.).
  9. Check if the controlled station issues an error code.
  10. Activate the debug output during connection establishment and/or of ASDU data. Open the TwinCAT System Manager and activate the LogView window. Analyze/check the debug output strings.


Examples

Used controlling station configuration parameters:

  • Standard PC interface: COM1
  • 19200 Baud
  • Link address: 220
  • Link address size: 2 octets
  • Cause of transfer size: 2 octets
  • Originator address: 1
  • Common ASDU address: 7
  • Common ASDU address size: 2 octets
  • Information object address size: 3 octets
PLC project | TwinCAT System Manager Configuration | Description
MiniMasterSample.pro | MiniMasterSample.tsm | Simple IEC60870-5-101 controlling station. Very small PLC project with one single point in monitoring (IOA = 100) and one single command in control direction (IOA = 10).
TutorialSample.pro | TutorialSample.tsm | Simple IEC60870-5-101 controlling station (master)