Notes on the documentation

This description is only intended for the use of trained specialists in control and automation engineering who are familiar with the applicable national standards.
It is essential that the following notes and explanations are followed when installing and commissioning these components.

The responsible staff must ensure that the application or use of the products described satisfy all the requirements for safety, including all the relevant laws, regulations, guidelines and standards.

Disclaimer

The documentation has been prepared with care. The products described are, however, constantly under development.
For that reason the documentation is not in every case checked for consistency with performance data, standards or other characteristics.
In the event that it contains technical or editorial errors, we retain the right to make alterations at any time and without warning.
No claims for the modification of products that have already been supplied may be made on the basis of the data, diagrams and descriptions in this documentation.

Trademarks

Beckhoff®, TwinCAT®, EtherCAT®, Safety over EtherCAT®, TwinSAFE® and XFC® are registered trademarks of and licensed by Beckhoff Automation GmbH.
Other designations used in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owners.

Patent Pending

The TwinCAT Technology is covered, including but not limited to the following patent applications and patents:
EP0851348, US6167425 with corresponding applications or registrations in various other countries.

Copyright

© Beckhoff Automation GmbH & Co. KG, Germany.
The reproduction, distribution and utilization of this document as well as the communication of its contents to others without express authorization are prohibited.
Offenders will be held liable for the payment of damages. All rights reserved in the event of the grant of a patent, utility model or design.


Overview

The library TcIEC870_5_104Slave.Lib implements the Beckhoff substation (slave) according to the IEC60870-5-104 norm.

'High level' interface: IEC 60870-5-104 Controlled Station

This interface is a so-called ‘single-block solution’. All functions are encapsulated in one PLC block. The block implements the most important services and functions. This implementation is sufficient for over 90% of applications.

Pro: Very little PLC programming work is required in order to create an application; all services, such as general query, counter query, time synchronisation, command execution, spontaneous data transmission etc. are already implemented in the block and are executed automatically; the mapping of the IEC<->PLC process data and that of the data points is configured via function calls; the PLC programmer does not need to be very well acquainted with the protocol standard;

Contra: The PLC application has only a small influence on the execution of the protocol; no influence on the execution of the services – these are automatically implemented internally; time stamps are automatically generated by the block and cannot be changed (handed over by externals); only the direct command execution, for example, is possible; poorer performance if there are many data points.

This interface is recommended if you:

  • are not familiar with the protocol standard;
  • are implementing a simple application with few data points (<1000);
  • are not placing any great performance demands on the application;
  • are not sending any special command execution such as Select/Execute or data + time stamp from external devices;
  • do not require any functions that are not supported according to the compatibility list;


Interoperability

TS6507 | TwinCAT PLC Lib: IEC 60870-5-104 controlled station (slave)

Interoperability list according to IEC 60870-5-104

for TwinCAT PLC Library: IEC 60870-5-104 controlled station (slave).

Version: 1.3
Date: 28.03.2011

Here you can open/save the protocol interoperability document (zipped PDF).

Table of contents:

  • General information
    • Project information
  • Compatibility
    • System or device
    • Network configuration
    • Physical layer
    • Link layer
    • Application layer
    • Selection of standardised ASDUs
      • Process information in monitoring direction
      • Process information in control direction
      • System information in monitoring direction
      • System information in control direction
      • Parameter in control direction
      • File transfer
    • Basic application functions
      • Station initialization
      • Cyclic data transfer
      • Read procedure
      • Spontaneous transmission
      • Double transmission
      • Station interrogation
      • Clock synchronisation
      • Command transmission
      • Counter interrogation
      • Parameter loading
      • Parameter activation
      • Test procedure
      • File transfer
      • Background scan
      • Telegram run time acquisition
    • Definition of time outs
    • k- and w-parameters
    • Port number
  • RFC-2200 suite
  • Appendix
    • Beckhoff support and service
      • Beckhoff support
      • Beckhoff service
      • Beckhoff company headquarter

General Information

This compatibility list refers to functions supported within IEC 870-5-104.

Fields marked with are not used with TCP/IP coupling via IEC 870-5-104.

Compatibility of the individual components has to be agreed for individual projects by all parties involved.

Project information

Projekt No.: ______________________________________________________________________________

Project: ______________________________________________________________________________

Responsible: ______________________________________________________________________________

Date: ______________________________________________________________________________

Compatibility

The selected parameters should be marked in the white control fields as follows:

Function or ASDU is not used
Function or ASDU is used as specified (preferred option)
Function or ASDU is used in reverse mode
Function or ASDU is used in regular and reverse mode

System or device

System definition
Specifications for the control station
Specifications for the controlled station (slave)

Network configuration

Point-to-point | Multipoint-partyline
Multiple point-to-point | Multipoint-star

Physical layer

Transmission speed:

100 bps | 2400 bps | 56000 bps
200 bps | 4800 bps | 64000 bps
300 bps | 9600 bps |
600 bps | 19200 bps |
1200 bps | 38400 bps |

Link layer

According to this application-related standard, only telegram format FT 1.2, single character 1 and the time monitoring interval are used.

Address field of the link layer :

Not available (only symmetric transfer)
One octet
Two octets
Structured
Non structured

Link layer transfer procedure:

Symmetric transfer
Asymmetric transfer

Telegram length:

Maximum length L

Application layer

Tranfer mode for application data

According to this application-related standard, only mode 1 (octet with the lowest value first) according to 4.10 IEC 60870-5-4 is used.

Common ASDU address

One octet Two octets

Address of the information object

One octet | Structured
Two octets | Non structured
Three octets |

Cause of transmission

One octet Two octets (with origin address). Preset to 0, if origin address is not available.

Length of the APDU

(system-specific parameter, the maximum length of the APDU must be specified for each system)

The maximum length of the APDU is 253 (unless specified otherwise). The maximum length may be reduced, depending on the system.

253
 Maximum length of the APDU for each system

Selection of standardised ASDU's

Process information in monitoring direction

<1> := Single-point information | M_SP_NA_1
<2> := Single-point information with time tag | M_SP_TA_1
<3> := Double point information | M_DP_NA_1
<4> := Double point information with time tag | M_DP_TA_1
<5> := Step position information | M_ST_NA_1
<6> := Step position information with time tag | M_ST_TA_1
<7> := Bitstring of 32 bits | M_BO_NA_1
<7> := Bitstring of 32 bits with time tag | M_BO_TA_1
<9> := Measured value, normalized | M_ME_NA_1
<10> := Measured value, normalized value with time tag | M_ME_TA_1
<11> := Measured value, scaled value | M_ME_NB_1
<12> := Measured value, scaled value with time tag | M_ME_TB_1
<13> := Measured value, short floating point value | M_ME_NC_1
<14> := Measured value, short floating point value with time | M_ME_TC_1
<15> := Integrated totals | M_IT_NA_1
<16> := Integrated totals with time tag | M_IT_TA_1
<17> := Event of protection equipment with time tag | M_EP_TA_1
<18> := Packed start events of protection equipment with time tag | M_EP_TB_1
<19> := Packed output circuit information of protection equipment with time tag | M_EP_TC_1
<20> := Packed single-point information with status change detection | M_PS_NA_1
<21> := Measured value, normalized value without quantity descriptor | M_ME_ND_1
<30> := Single-point information with time tag CP56Time2a | M_SP_TB_1
<31> := Double-point information with time tag CP56Time2a | M_DP_TB_1
<32> := Step position information with time tag CP56Time2a | M_ST_TB_1
<33> := Bitstring of 32 bits with time tag CP56Time2a | M_BO_TB_1
<34> := Measured value, normalized value with time tag CP56Time2a | M_ME_TD_1
<35> := Measured value, scaled value with time tag CP56Time2a | M_ME_TE_1
<36> := Measured value, short floating point value with time tag CP56Time2a | M_ME_TF_1
<37> := Integrated totals with time tag CP56Time2a | M_IT_TB_1
<38> := Event of protection equipment with time tag CP56Time2a | M_EP_TD_1
<39> := Packed start events of protection equipment with time tag CP56Time2a | M_EP_TE_1
<40> := Packed output circuit information of protection equipment with time tag CP56Time2a | M_EP_TF_1

Process information in control direction

<45> := Single command | C_SC_NA_1
<46> := Double command | C_DC_NA_1
<47> := Regulating step command | C_RC_NA_1
<48> := Set point command, normalized value | C_SE_NA_1
<49> := Set point command, scaled value | C_SE_NB_1
<50> := Set point command, short floating point value | C_SE_NC_1
<51> := Bitstring of 32 bits | C_BO_NA_1
<58> := Single command with time tag CP56Time2a | C_SC_TA_1
<59> := Double command with time tag CP56Time2a | C_DC_TA_1
<60> := Regulating step command with time tag CP56Time2a | C_RC_TA_1
<61> := Set point command, normalized value with time tag CP56Time2a | C_SE_TA_1
<62> := Set point command, scaled value with time tag CP56Time2a | C_SE_TB_1
<63> := Set point command, short floating point value with time tag CP56Time2a | C_SE_TC_1
<64> := Bitstring of 32 bits with time tag CP56Time2a | C_BO_TA_1

System information in monitoring direction

<70> := End of initialization M_EI_NA_1

System information in control direction

<100> := Interrogation command | C_IC_NA_1
<101> := Counter interrogation command | C_CI_NA_1
<102> := Read command | C_RD_NA_1
<103> := Clock synchronization command | C_CS_NA_1
<104> := Test command | C_TS_NA_1
<105> := Reset process command | C_RP_NA_1
<106> := Delay acquisition command | C_CD_NA_1
<107> := Test command with time tag CP56Time2a | C_TS_TA_1

Parameters in control direction

<110> := Parameter of measured values, normalized value | P_ME_NA_1
<111> := Parameter of measured values, scaled value | P_ME_NB_1
<112> := Parameter of measured values, short floating point value | P_ME_NC_1
<113>:= Parameter activation | P_AC_NA_1

File tranfer

<120>:= File ready | F_FR_NA_1
<121>:= Section ready | F_SR_NA_1
<122> := Call directory, select file, call file, call section | F_SC_NA_1
<123> := Last section, last segment | F_LS_NA_1
<124> := Ack file, ack section | F_AF_NA_1
<125>:= Segment | F_SG_NA_1
<126> := Directory (blank or X, available only in monitor [standard] direction) | F_DR_TA_1

Type identifier and cause of transmission asignments ( station-specific parameters )

The combination of type identifier / cause of transmission is marked as:

Shaded | Function or ASDU are not required.
Empty | Function or ASDU is not used.
 | Only used in standard direction
 | Only used in reverse direction
 | Used in both directions

Cause of transmission

Number | Cause of transmission
<0> | Not used
<1> | Periodic, cyclic
<2> | Background scan
<3> | Spontaneous
<4> | Initialized
<5> | Request or requested
<6> | Activation (ACT)
<7> | Activation confirmation (ACTCON)
<8> | Deactivation (DEACT)
<9> | Deactivation confirmation (DEACTCON)
<10> | Activation termination (ACTTERM)
<11> | Return information caused by a remote command
<12> | Return information caused by a local command
<13> | File transfer
<20..36> | General interrogation
<37..41> | Counter interrogation
<44> | Unknown type identification
<45> | Unknown cause of transmission
<46> | Unknown address of ASDU
<47> | Unknown information object address

Type identification |  | Cause of transmission
 |  | <1> | <2> | <3> | <4> | <5> | <6> | <7> | <8> | <9> | <10> | <11> | <12> | <13> | <20..36> | <37..41> | <44> | <45> | <46> | <47>
 |  | p e r / c y c | b a c k | s p o n t | i n i t | r e q | a c t | a c t c o n | d e a c t | d e a c t c o n | a c t t e r m | r e t r e m | r e t l o c | f i l e | i n r o | r e q c o | u n k n o w n t y p e | u n k n o w n C O T | u n k n o w n C A A | u n k n o w n I O A
<1> | M_SP_NA_1 |  | X | X |  | X |  |  |  |  |  | X |  |  | X |  |  |  |  |
<2> | M_SP_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<3> | M_DP_NA_1 |  | X | X |  | X |  |  |  |  |  | X |  |  | X |  |  |  |  |
<4> | M_DP_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<5> | M_ST_NA_1 |  | X | X |  | X |  |  |  |  |  | X |  |  | X |  |  |  |  |
<6> | M_ST_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<7> | M_BO_NA_1 |  | X | X |  | X |  |  |  |  |  |  |  |  | X |  |  |  |  |
<8> | M_BO_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<9> | M_ME_NA_1 | X | X | X |  | X |  |  |  |  |  |  |  |  | X |  |  |  |  |
<10> | M_ME_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<11> | M_ME_NB_1 | X | X | X |  | X |  |  |  |  |  |  |  |  | X |  |  |  |  |
<12> | M_ME_TB_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<13> | M_ME_NC_1 | X | X | X |  | X |  |  |  |  |  |  |  |  | X |  |  |  |  |
<14> | M_ME_TC_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<15> | M_IT_NA_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  | X |  |  |  |
<16> | M_IT_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<17> | M_EP_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<18> | M_EP_TB_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<19> | M_EP_TC_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<20> | M_PS_NA_1 |  | X | X |  | X |  |  |  |  |  | X |  |  | X |  |  |  |  |
<21> | M_ME_ND_1 | X | X | X |  | X |  |  |  |  |  |  |  |  | X |  |  |  |  |
<30> | M_SP_TB_1 |  |  | X |  | X |  |  |  |  |  | X |  |  |  |  |  |  |  |
<31> | M_DP_TB_1 |  |  | X |  | X |  |  |  |  |  | X |  |  |  |  |  |  |  |
<32> | M_ST_TB_1 |  |  | X |  | X |  |  |  |  |  | X |  |  |  |  |  |  |  |
<33> | M_BO_TB_1 |  |  | X |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |
<34> | M_ME_TD_1 |  |  | X |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |
<35> | M_ME_TE_1 |  |  | X |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |
<36> | M_ME_TF_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<37> | M_IT_TB_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  | X |  |  |  |
<38> | M_EP_TD_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<39> | M_EP_TE_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<40> | M_EP_TF_1 |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<45> | C_SC_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<46> | C_DC_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<47> | C_RC_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<48> | C_SE_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<49> | C_SE_NB_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<50> | C_SE_NC_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<51> | C_BO_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<58> | C_SC_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<59> | C_DC_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<60> | C_RC_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<61> | C_SE_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<62> | C_SE_TB_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<63> | C_SE_TC_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<64> | C_BO_TA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<70> | M_EI_NA_1 |  |  |  | X |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<100> | C_IC_NA_1 |  |  |  |  |  | X | X | X | X | X |  |  |  |  |  | X | X | X | X
<101> | C_CI_NA_1 |  |  |  |  |  | X | X |  |  | X |  |  |  |  |  | X | X | X | X
<102> | C_RD_NA_1 |  |  |  |  | X |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<103> | C_CS_NA_1 |  |  | X |  |  | X | X |  |  |  |  |  |  |  |  | X | X | X | X
<104> | C_TS_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<105> | C_RP_NA_1 |  |  |  |  |  | X | X |  |  |  |  |  |  |  |  | X | X | X | X
<106> | C_CD_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
<107> | C_TS_TA_1 |  |  |  |  |  | X | X |  |  |  |  |  |  |  |  | X | X | X | X
<110> | P_ME_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<111> | P_ME_NB_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<112> | P_ME_NC_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<113> | P_AC_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<120> | F_FR_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<121> | F_SR_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<122> | F_SC_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<123> | F_LS_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<124> | F_AF_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<125> | F_SG_NA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  | X | X | X | X
<126> | F_DR_TA_1 |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |

Basic application functions

Station initilization

Remote initialzation

Cyclic data transmission

Cyclic data transmission

Read procedure

Read procedure

Spontaneous transmission

Spontaneous transmission

Double transmission of information objects with cause of transmission spontaneous

The following type identifications may be transmitted in succession caused by a single status change of an information object. The particular information object addresses for which double transmission is enabled are defined in a project specific list.

Single point informaion M_SP_NA_1, M_SP_TA_1, M_SP_TB_1 und M_SP_NA_1
Double point information M_DP_NA_1, M_DP_TA_1 und M_DP_TB_1
Step position information M_ST_NA_1, M_ST_TA_1 und M_ST_TB_1
Bitstring of 32 bits M_BO_NA_1, M_BO_TA_1 und M_BO_TB_1
Measured value, normalized value M_ME_NA_1, M_ME_TA_1, M_ME_ND_1 und M_ME_TD_1
Measured value, scaled value M_ME_NB_1, M_ME_TB_1 und M_ME_TE_1
Measured value, short floating point number M_ME_NC_1, M_ME_TC_1 und M_ME_TF_1

Station interrogation

Global
Group 1
Group 2
Group 3
Group 4
Group 5
Group 6
Group 7
Group 8
Group 9
Group 10
Group 11
Group 12
Group 13
Group 14
Group 15
Group 16

The allocation of information object addresses to each individual group must be specified in a separate table.

Clock synchronization

Clock synchronization

Command transmission

Direct command transmission
Direct setpoint command transmission
Command .selection and execution
Setpoint command .selection and execution
C_SE ACTTERM used
No additional definition
Short pulse duration (duration determined by a system parameter in the outstation)
Long pulse duration (duration determined by a system parameter in the outstation)
Persistent output

Supervision of maximum delay in command direction of commands and setpoint commands

Maximum allowable delay of commands and setpoint commands

Counter interrogation

Counter read
Counter freeze without reset
Counter freeze with reset
Counter reset
General counter request
Request counter group 1
Request counter group 2
Request counter group 3
Request counter group 4
Mode A: Local freeze with spontaneous transmission
Mode B: Local freeze with counter interrogation
Mode C: Freeze and transmit by counter-interrogation commands
Modus D: Freeze by counter-interrogation command, frozen values reported simultaneously

Parameter loading

Threshold value
Smoothing factor
Lower limit value for transmission of measured values
High limit value for transmission of measured values

Parameter activation

Activation/deactivation of cyclic or periodic transmission of the addressed object

Test procedure

Test procedure

File transfer

File transfer in monitoring direction:

Transparent fiel
Transmission of event sequences
Transmission of disturbance data of protection equipment
Transmission of sequences of recorded analog values

File transfer in control direction:

Transparent file

Background scan

Background scan

Telegram run time acquisition

Telegram run time acquisition

Definition of time outs

Parameter | Default value | Comments | Selected value
t0 | 30s | Timeout of connection establishment |
t1 | 15s | Timeout of connection establishment |
t2 | 10s | Timeout for acknowledgements, if no data telegrams are transferred t 2 < t 1 |
t3 | 20s | Timeout for sent test telegrams in the event of long idle states |

Maximum range of all time outs: 1 to 255 s, accuracy 1 s.

Maximum number k of unacknowledged APDU in I-format and latest APDU acknowledgement (w)

Parameter | Default value | Comments | Selected value
k | 12 APDU | Maximum difference between the number of reception sequences and the number of send sequences |
w | 8 APDU | Latest acknowledgement after receipt of w APDU in I format |

Maximum range of values k : 1 to 32767 (215 -1) APDU , accuracy 1 APDU .

Maximum range of values w : 1 to 32767 APDU , accuracy 1 APDU ( w should not exceed two thirds of k ).

Port number

Parameter | Value | Comments
Port number | 2404 | in all cases

RFC-2200 suite

RFC 2200 is an official Internet Standard which describes the state of standardization of protocols used in the Internet as determined by the Internet Architecture Board (IAB). It offers a broad spectrum of actual standards used in the Internet. The suitable selection of documents from RFC 2200 defined in this standard for given projects has to be chosen by the user of this standard.

Ethernet 802.3
Serial interface X.21
Other selection from RFC 2200
List of RFC-2200 documents to be used
1. |
2. |
3. |
4. |
5. |
6. |
7. | etc.

Appendix

Beckhoff support and service

Beckhoff and their partners around the world offer comprehensive service and support, making available fast and competent assistance with all questions related to Beckhoff products and system solutions.

Beckhoff Support and Service is available to you wherever you are in the world, and can be reached by telephone, fax or e-mail. The contact addresses for your country may be found in the list of Beckhoff branches and partner firms.

Beckhoff support

Support offers you comprehensive technical assistance, helping you not only with the application of individual Beckhoff products, but also with other, wide-ranging services:

  • World-wide support;
  • D esign, programming and commissioning of complex automation systems;
  • Extensive training program for Beckhoff system components

Please contact your Beckhoff branch office or representative for local support and service on Beckhoff products!

Beckhoff service

The Beckhoff Service Center supports you in all matters of after-sales service:

  • On-site service;
  • Repair service;
  • Spare parts service;
  • Hotline service

Please contact your Beckhoff branch office or representative for local support and service on Beckhoff products!

Beckhoff company headquarter

Beckhoff Automation
Eiserstr. 5
33415 Verl
Germany

Telefon: + 49 (0) 5246/963-0
Fax: + 49 (0) 5246/963-198
E-Mail: info@beckhoff.de
Web: www.beckhoff.de


Quick Start

Simple projects including complete sources is to be found here: IEC60870-5-104 substation.

Interoperability list is to be found here: Interoperability check list

Overview of error codes is to be found here: Error Error codes

A detailed instruction about implementing the substation within the PLC is to be found here: TUTORIAL

Brief instruction

  1. Create a new PLC project and link the PLC library TcIEC870_5_104Slave.Lib.
  2. Apply an instance of the T_HSERVER variable (connection handle) at the main program and initialize it once at the program part by calling of the F_CreateServerHnd function with the fitting parameters.
  3. Configuration of data points: Apply an array variable of ST_IEC870_5_101AODBEntry. Every array element corresponds to a data point. Configure the data points via the function F_iecInitAOEntry zat runtime (e.g. at an init step).
  4. Apply an instance of the des protocol block FB_IEC870_5_104Slave at the main program, configure it and call it.
    The system and protocol parameter are to be configured according to the parameter of the control station.


Introduction: Overview

TS6507 | TwinCAT PLC Lib: IEC 60870-5-104 controlled station (slave)

Introduction (tutorial)

This introduction explains how to implement and configure an IEC60870-5-104 substation (slave) within the TwinCAT PLC.

Here you can unpack the complete PLC sources: TutorialSample.pro


Introduction: Glossary

Glossary

Term | Description
substation, slave, server, controlled station | Synonyms for a subordinate station (which is monitored)
central station, master, client, controlling station | Synonyms for a higher-level station (control station, monitors others stations)
control direction | Data transfer direction from the central station to the substation
monitoring direction | Data transfer direction from the substation to the central station
application objects | IEC information objects in the TwinCAT PLC application (single points, double points, measured values, short floating point values etc.)
APDU | Application protocol data unit
APCI | Application protocol control information
ASDU | Application service data unit
IOA, information object address | Address of the single point, double point, measured value, short floating point value etc.


Introduction: New project

Creating a PLC project and integrating PLC libraries

Here you can unpack the complete PLC sources: TutorialSample.pro

- Start TwinCAT PLC Control.

- Create a new PLC project via File -> New. Select PC or CX (x86 or ARM) as the target system.

- A new MAIN program block will now be created automatically. Select ST (Structured Text) as the language for the block. Confirm.

- From the menu select Window -> Library Management and then Insert -> Further Library...

- Select TcIEC870_5_104Slave.Lib from the list of TwinCAT libraries and confirm.


Introduction: AODB

Defining and configuring an application object database of controlled station

Here you can unpack the complete PLC sources: TutorialSample.pro

Application objects = single points, double points, measured values, short floating point values, etc.

In this example the commands have been configured in a way that the process data are placed in the same memory area but on another byte/bit offset than the data of information in control direction. But you can also place the commands to the same byte/bit offset like information in control direction.

Example:

C_SC_NA_1 with IOA = 10 on the same byte/bit offset like M_SP_NA_1 with IOA = 100 (both byte ofset = 100 and bit offset = 0).
In this case a change of value via a command from the control station will cause a transfer of the M_SP_NA_1 with the object address 100 and transfer cause <11> (returned by remote command).

As an example we will configure the following application objects as part of the introductory project:

Array element | ASDU identifier | Object address IOA | Group configuration parameter | Base time multiplier | PLC process data area | Byte offset | Bit offset | Process data width in the TwinCAT PLC
0 | M_SP_NA_1 | 100 | General interrogation group global | 0 | Memory | 100 | 0 | 1 bit
1 | M_SP_NA_1 | 101 | General interrogation group global | 0 | Memory | 100 | 1 | 1 Bit
2 | M_SP_TB_1 | 102 | General interrogation group global | 0 | Memory | 100 | 2 | 1 Bit
3 | M_DP_NA_1 | 200 | General interrogation group global | 0 | Memory | 200 | 0 | 2 Bits
4 | M_DP_NA_1 | 201 | General interrogation group global | 0 | Memory | 200 | 2 | 2 Bits
5 | M_DP_TB_1 | 202 | General interrogation group global | 0 | Memory | 200 | 4 | 2 Bits
6 | M_ST_NA_1 | 300 | General interrogation group global | 0 | Memory | 300 | 0 | 1 Byte
7 | M_ST_NA_1 | 301 | General interrogation group global | 0 | Memory | 301 | 0 | 1 Byte
8 | M_ST_TB_1 | 302 | General interrogation group global | 0 | Memory | 302 | 0 | 1 Byte
9 | M_BO_NA_1 | 400 | General interrogation group global | 0 | Memory | 400 | 0 | 4 Byte
10 | M_BO_NA_1 | 401 | General interrogation group global | 0 | Memory | 404 | 0 | 4 Byte
11 | M_BO_TB_1 | 402 | General interrogation group global | 0 | Memory | 408 | 0 | 4 Byte
12 | M_ME_NA_1 | 500 | General interrogation group global | 0 | Memory | 500 | 0 | 2 Byte
13 | M_ME_NA_1 | 501 | General interrogation group global | 0 | Memory | 502 | 0 | 2 Byte
14 | M_ME_TD_1 | 502 | General interrogation group global | 0 | Memory | 504 | 0 | 2 Byte
15 | M_ME_NB_1 | 600 | General interrogation group global | 0 | Memory | 600 | 0 | 2 Byte
16 | M_ME_NB_1 | 601 | General interrogation group global | 0 | Memory | 602 | 0 | 2 Byte
17 | M_ME_TE_1 | 602 | General interrogation group global | 0 | Memory | 604 | 0 | 2 Byte
18 | M_ME_NC_1 | 700 | General interrogation group global | 0 | Memory | 700 | 0 | 4 Byte
19 | M_ME_NC_1 | 701 | General interrogation group global | 0 | Memory | 704 | 0 | 4 Byte
20 | M_ME_TF_1 | 702 | General interrogation group global | 0 | Memory | 708 | 0 | 4 Byte
21 | M_IT_NA_1 | 800 | General counter interrogation and mode A (local freeze with spontaneous transfer every 15s) | 0 | Memory | 800 | 0 | 4 Byte
22 | M_IT_NA_1 | 801 | General counter interrogation and mode A (local freeze with spontaneous transfer every 15s) | 0 | Memory | 804 | 0 | 4 Byte
23 | M_IT_TB_1 | 802 | General counter interrogation and mode A (local freeze with spontaneous transfer every 15s) | 0 | Memory | 808 | 0 | 4 Byte
Commands |  |  |  |  |  |  |  |
24 | C_SC_NA_1 | 10 | - | 0 | Memory | 2100 | 0 | 1 Bit
25 | C_SC_NA_1 | 11 | - | 0 | Memory | 2100 | 1 | 1 Bit
26 | C_SC_TA_1 | 12 | - | 0 | Memory | 2100 | 2 | 1 Bit
27 | C_DC_NA_1 | 20 | - | 0 | Memory | 2200 | 0 | 2 Bit
28 | C_DC_NA_1 | 21 | - | 0 | Memory | 2200 | 2 | 2 Bit
29 | C_DC_TA_1 | 22 | - | 0 | Memory | 2200 | 4 | 2 Bit
30 | C_RC_NA_1 | 30 | - | 0 | Memory | 2300 | 0 | 1 Byte
31 | C_RC_NA_1 | 31 | - | 0 | Memory | 2301 | 0 | 1 Byte
32 | C_RC_TA_1 | 32 | - | 0 | Memory | 2302 | 0 | 1 Byte
33 | C_BO_NA_1 | 40 | - | 0 | Memory | 2400 | 0 | 4 Byte
34 | C_BO_NA_1 | 41 | - | 0 | Memory | 2404 | 0 | 4 Byte
35 | C_BO_TA_1 | 42 | - | 0 | Memory | 2408 | 0 | 4 Byte
36 | C_SE_NA_1 | 50 | - | 0 | Memory | 2500 | 0 | 2 Byte
37 | C_SE_NA_1 | 51 | - | 0 | Memory | 2502 | 0 | 2 Byte
38 | C_SE_TA_1 | 52 | - | 0 | Memory | 2504 | 0 | 2 Byte
39 | C_SE_NB_1 | 60 | - | 0 | Memory | 2600 | 0 | 2 Byte
40 | C_SE_NB_1 | 61 | - | 0 | Memory | 2602 | 0 | 2 Byte
41 | C_SE_TB_1 | 62 | - | 0 | Memory | 2604 | 0 | 2 Byte
42 | C_SE_NC_1 | 70 | - | 0 | Memory | 2700 | 0 | 4 Byte
43 | C_SE_NC_1 | 71 | - | 0 | Memory | 2704 | 0 | 4 Byte
44 | C_SE_TC_1 | 72 | - | 0 | Memory | 2708 | 0 | 4 Byte

Declaring a database variable

The application object database is an array variable of type ST_IEC870_5_101AODBEntry. Each array element corresponds to an application object. The maximum number of application objects is freely selectable and is only limited by the available memory. During PLC programming you have to specify a constant maximum number. The maximum number of application objects cannot be changed at runtime.

In our example 50 application objects are declared. This number is sufficient for most applications. Please note that many application objects require adequate memory and runtime resources.

Define the following variable in MAIN:

PROGRAM MAIN
VAR
     AODB : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;
END_VAR

Configuring application objects

The object type (M_SP_NA_1, M_DP_NA_1, M_ST_NA_1 etc.), the object address and further object parameters are specified during configuration of the individual application objects.

The required application objects are configured during program runtime. Each application object (database array element) is configured by calling the F_iecInitAOEntry function once. The array element to be configured is transferred to the function via VAR_IN_OUT. Configuration is usually carried out once during PLC program start-up via an Init routine. The F_iecInitAOEntry function expects the following function parameters (from left to right):

FUNCTION F_iecInitAOEntry : UDINT
VAR_INPUT
        eType           : E_IEC870_5_101TcTypeID;
        objAddr                 : DWORD := 0;
        group           : DWORD := 0;
        multiplier      : BYTE := 0;
        ioMapType       : E_IEC870_5_101IOMappingType;
        byteOffs        : UDINT := 0;
        bitOffs                 : UDINT := 0;
END_VAR
VAR_IN_OUT
        dbEntry                 : ST_IEC870_5_101AODBEntry;
END_VAR

eType: application object type (ASDU identifier, e.g.: M_SP_NA_1 for single point or M_DP_NA_1 for double point). Please note that only the ASDU types listed in the compatibility list can be used. Invalid types are ignored.

objAddr : object address, e.g. 100. Each application object should be configured with a unique address.

group: group configuration parameters. The available group parameters are defined as constants and can be combined with an OR operator. E.g.: IEC870_GRP_INROGEN OR IEC870_GRP_PERCYC.

A description of all group configuration parameters can be found here.

mutiplier: base time multiplier for cyclic/periodic data transfer (0=deactivated). The base time is configured via the system parameters. If the base time was set to T#10 s, and the multiplier to 2, for example, the periodic/cyclic data of the application object are sent every 20 seconds.

ioMapType: This parameter defines from or in which process data area of the TwinCAT PLC the IEC process data are to be mapped at runtime (inputs, outputs, memory, data).

byteOffs: process data area byte offset;

bitOffs: process data area bit offset;

dbEntry: application object to be configured (a database variable array element that is transferred to the function via VAR_IN_OUT).

In order to configure the application objects during program start-up, add the following PLC code in MAIN:

PROGRAM MAIN
VAR
        AODB : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;

     init            : BOOL := TRUE;
        initError       : UDINT;
END_VAR

      IF init THEN
        init := FALSE;

  (* Monitored Single Points *)
 initError := F_iecInitAOEntry( M_SP_NA_1, 100, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 100, 0, AODB[0] );
        initError := F_iecInitAOEntry( M_SP_NA_1, 101, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 100, 1, AODB[1] );
        initError := F_iecInitAOEntry( M_SP_TB_1, 102, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 100, 2, AODB[2] );
  (* Double Points*)
 initError := F_iecInitAOEntry( M_DP_NA_1, 200, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 200, 0, AODB[3] );
        initError := F_iecInitAOEntry( M_DP_NA_1, 201, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 200, 2, AODB[4] );
        initError := F_iecInitAOEntry( M_DP_TB_1, 202, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 200, 4, AODB[5] );
  (* Regulating step value *)
 initError := F_iecInitAOEntry( M_ST_NA_1, 300, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 300, 0, AODB[6] );
        initError := F_iecInitAOEntry( M_ST_NA_1, 301, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 301, 0, AODB[7] );
        initError := F_iecInitAOEntry( M_ST_TB_1, 302, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 302, 0, AODB[8] );
  (* 32 bit string*)
 initError := F_iecInitAOEntry( M_BO_NA_1, 400, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 400, 0, AODB[9 );
        initError := F_iecInitAOEntry( M_BO_NA_1, 401, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 404, 0, AODB[10] );
        initError := F_iecInitAOEntry( M_BO_TB_1, 402, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 408, 0, AODB[11] );
  (* Measured value, normalized value *)
 initError := F_iecInitAOEntry( M_ME_NA_1, 500, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 500, 0, AODB[12] );
        initError := F_iecInitAOEntry( M_ME_NA_1, 501, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 502, 0, AODB[13] );
        initError := F_iecInitAOEntry( M_ME_TD_1, 502, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 504, 0, AODB[14] );
  (* Mesured value, scaled value *)
 initError := F_iecInitAOEntry( M_ME_NB_1, 600, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 600, 0, AODB[15] );
        initError := F_iecInitAOEntry( M_ME_NB_1, 601, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 602, 0, AODB[16] );
        initError := F_iecInitAOEntry( M_ME_TE_1, 602, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 604, 0, AODB[17] );
  (* Measured value , short floating point value *)
 initError := F_iecInitAOEntry( M_ME_NC_1, 700, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 700, 0, AODB[18] );
        initError := F_iecInitAOEntry( M_ME_NC_1, 701, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 704, 0, AODB[19] );
        initError := F_iecInitAOEntry( M_ME_TF_1, 702, IEC870_GRP_INROGEN, 0, MAP_AREA_MEMORY, 708, 0, AODB[20] );
  (* Integrated totals *)
 initError := F_iecInitAOEntry( M_IT_NA_1, 800, IEC870_GRP_REQCOGEN OR IEC870_GRP_LOCFREEZE, 0, MAP_AREA_MEMORY, 800, 0, AODB[21] );
        initError := F_iecInitAOEntry( M_IT_NA_1, 801, IEC870_GRP_REQCOGEN OR IEC870_GRP_LOCFREEZE, 0, MAP_AREA_MEMORY, 804, 0, AODB[22] );
        initError := F_iecInitAOEntry( M_IT_TB_1, 802, IEC870_GRP_REQCOGEN OR IEC870_GRP_LOCFREEZE, 0, MAP_AREA_MEMORY, 808, 0, AODB[23] );

  (* Single commands *)
 initError := F_iecInitAOEntry( C_SC_NA_1, 10, 0, 0, MAP_AREA_MEMORY, 2100, 0, AODB[24] );
        initError := F_iecInitAOEntry( C_SC_NA_1, 11, 0, 0, MAP_AREA_MEMORY, 2100, 1, AODB[25] );
        initError := F_iecInitAOEntry( C_SC_TA_1, 12, 0, 0, MAP_AREA_MEMORY, 2100, 2, AODB[26] );
  (* Double commands *)
 initError := F_iecInitAOEntry( C_DC_NA_1, 20, 0, 0, MAP_AREA_MEMORY, 2200, 0, AODB[27] );
        initError := F_iecInitAOEntry( C_DC_NA_1, 21, 0, 0, MAP_AREA_MEMORY, 2200, 2, AODB[28] );
        initError := F_iecInitAOEntry( C_DC_TA_1, 22, 0, 0, MAP_AREA_MEMORY, 2200, 4, AODB[29] );
  (* Regulating step commands *)
 initError := F_iecInitAOEntry( C_RC_NA_1, 30, 0, 0, MAP_AREA_MEMORY, 2300, 0, AODB[30] );
        initError := F_iecInitAOEntry( C_RC_NA_1, 31, 0, 0, MAP_AREA_MEMORY, 2301, 0, AODB[31] );
        initError := F_iecInitAOEntry( C_RC_TA_1, 32, 0, 0, MAP_AREA_MEMORY, 2302, 0, AODB[32] );
  (* 32 bit string commands *)
 initError := F_iecInitAOEntry( C_BO_NA_1, 40, 0, 0, MAP_AREA_MEMORY, 2400, 0, AODB[33] );
        initError := F_iecInitAOEntry( C_BO_NA_1, 41, 0, 0, MAP_AREA_MEMORY, 2404, 0, AODB[34] );
        initError := F_iecInitAOEntry( C_BO_TA_1, 42, 0, 0, MAP_AREA_MEMORY, 2408, 0, AODB[35] );
  (* Set point, normalized values*)
 initError := F_iecInitAOEntry( C_SE_NA_1, 50, 0, 0, MAP_AREA_MEMORY, 2500, 0, AODB[36] );
        initError := F_iecInitAOEntry( C_SE_NA_1, 51, 0, 0, MAP_AREA_MEMORY, 2502, 0, AODB[37] );
        initError := F_iecInitAOEntry( C_SE_TA_1, 52, 0, 0, MAP_AREA_MEMORY, 2504, 0, AODB[38] );
  (* Set point, scaled valuess *)
 initError := F_iecInitAOEntry( C_SE_NB_1, 60, 0, 0, MAP_AREA_MEMORY, 2600, 0, AODB[39] );
        initError := F_iecInitAOEntry( C_SE_NB_1, 61, 0, 0, MAP_AREA_MEMORY, 2602, 0, AODB[40] );
        initError := F_iecInitAOEntry( C_SE_TB_1, 62, 0, 0, MAP_AREA_MEMORY, 2604, 0, AODB[41] );
  (* Set point, short floating point values *)
 initError := F_iecInitAOEntry( C_SE_NC_1, 70, 0, 0, MAP_AREA_MEMORY, 2700, 0, AODB[42] );
        initError := F_iecInitAOEntry( C_SE_NC_1, 71, 0, 0, MAP_AREA_MEMORY, 2704, 0, AODB[43] );
        initError := F_iecInitAOEntry( C_SE_TC_1, 72, 0, 0, MAP_AREA_MEMORY, 2708, 0, AODB[44] );

END_IF


Introduction: Mapping IEC-PLC

Mapping of PLC and IEC process data

Here you can unpack the complete PLC sources: TutorialSample.pro

The TwinCAT PLC process data are cyclically mapped (copied) into the IEC process data (application objects) and vice versa at program runtime. For mapping of the IEC<->PLC process data up to 4 process data areas (IO inputs, IO outputs, memory area, data area) can be declared as buffer variables in the PLC program. The byte size of the buffers is freely selectable and may be different for each area. Its not necessary to declare unused buffer areas.

In our introductory example we declare 4 PLC process data areas with 3000 bytes each:

PROGRAM MAIN
VAR
        AODB : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;

        init            : BOOL := TRUE;
        initError       : UDINT;

     inputs AT%IB0   : ARRAY[0..2999] OF BYTE;
        outputs AT%QB0  : ARRAY[0..2999] OF BYTE;
        memory AT%MB0   : ARRAY[0..2999] OF BYTE;
        data            : ARRAY[0..2999] OF BYTE;

END_VAR

How the process data are to be mapped at runtime is specified during configuration of the application objects via the F_iecInitAOEntry function.
See also in: Declaration and configuration of application objects.

Now the buffer variables are declared as byte arrays. To have better access to the desired data the variables are declared a second time and assigned to the corresponding byte/bit offset addresses.
Now a change within the byte array causes a change of the corresponding variable and vice versa. This is not imperative necessary. You can also have access directly to the bits/bytes of the byte array buffer variables.

VAR_GLOBAL
(* Memory offset 0..99 unused *)
  (* Single points *)
 msgSingle_0     AT%MX100.0 : BOOL;
        msgSingle_1     AT%MX100.1 : BOOL;
        msgSingle_2     AT%MX100.2 : BOOL;

  (* Double points *)
        (*      Bit 0..1 = first double point,
                Bit 2..3 = second double point,
                Bit 4..5 = third double point,
                Bit 6..7 = fourth double point *)
        msgDouble_0     AT%MB200        : BYTE;

  (* Regulating step values *)
        msgStep_0               AT%MB300        : BYTE;
        msgStep_1               AT%MB301        : BYTE;
        msgStep_2               AT%MB302        : BYTE;

  (* 32 bit strings *)
 msgBitStr_0     AT%MD400        : DWORD := 2#10001000_10001000_10001000_10001000;
        msgBitStr_1     AT%MD404        : DWORD := 2#10001000_10001000_10001000_10001000;
        msgBitStr_2     AT%MD408        : DWORD := 2#10001000_10001000_10001000_10001000;

  (* Measured values, normalized values *)
 msgNormalized_0         AT%MW500        : WORD;
        msgNormalized_1         AT%MW502        : WORD;
        msgNormalized_2         AT%MW504        : WORD;

  (* Mesured values, scaled values *)
 msgScaled_0     AT%MW600        : INT;
        msgScaled_1     AT%MW602        : INT;
        msgScaled_2     AT%MW604        : INT;

  (* Measured values, short floating point values *)
 msgFloating_0   AT%MD700        : REAL;
        msgFloating_1   AT%MD704        : REAL;
        msgFloating_2   AT%MD708        : REAL;

  (* Integrated totals *)
 msgTotal_0      AT%MD800        : UDINT;
        msgTotal_1      AT%MD804        : UDINT;
        msgTotal_2      AT%MD808        : UDINT;

  (*#################################################################*)
        (* Single commands *)
 cmdSingle_0     AT%MX2100.0 : BOOL;
        cmdSingle_1     AT%MX2100.1 : BOOL;
        cmdSingle_2     AT%MX2100.2 : BOOL;

  (* Double commands *)
        (*      Bit 0..1 = first double command,
                Bit 2..3 = second double command,
                Bit 4..5 = third double command,
                Bit 6..7 = fourth double command *)
 cmdDouble_0     AT%MB2200       : BYTE;

  (* Regulating step commands *)
 cmdStep_0               AT%MB2300 : BYTE;
        cmdStep_1               AT%MB2301 : BYTE;
        cmdStep_2               AT%MB2302 : BYTE;

  (* 32 bit string commands *)
 cmdBitStr_0     AT%MD2400       : DWORD;
        cmdBitStr_1     AT%MD2404       : DWORD;
        cmdBitStr_2     AT%MD2408       : DWORD;

  (* Set point, normalized values *)
 cmdNormalized_0         AT%MW2500       : WORD;
        cmdNormalized_1         AT%MW2502       : WORD;
        cmdNormalized_2         AT%MW2504       : WORD;

  (* Set point, scaled values *)
 cmdScaled_0     AT%MW2600       : INT;
        cmdScaled_1     AT%MW2602       : INT;
        cmdScaled_2     AT%MW2604       : INT;

  (* Set point, short floating point values *)
 cmdFloating_0   AT%MD2700       : REAL;
        cmdFloating_1   AT%MD2704       : REAL;
        cmdFloating_2   AT%MD2708       : REAL;
END_VAR

Mapping of the IEC<->PLC process data in controlled station

Process data in monitoring direction (slave->master information)

Example 1

Single point information (M_SP_NA_1) with the IOA = 100, PLC memory area, byte offset = 100, bit offset = 0.

msgSingle_0 == memory[100].0 -> Controlled station FB -> ... -> Controlling station

Example 2

Measured value, short floating point value (M_ME_NC_1) with the IOA = 700, PLC memory area, byte offset = 700, bit offset = 0 (irrelevant).

msgFloating_0 == memory[700..703] -> Controlled station FB -> ... -> Controlling station

Process data in control direction (master->slave commands)

Example 1

Single command state (C_SC_NA_1) with the IOA = 10, PLC memory area, byte offset = 2100, bit offset = 0.

Controlling station -> ... -> Controlled station FB -> memory[2100].0 == cmdSingle_0

Example 2

Set point, short floating point value (C_SE_NC_1) with the IOA = 70, PLC memory area, byte offset = 2700, bit offset = 0 (irrelevant).

Controlling station -> ... -> Controlled station FB -> memory[2700..2703] == cmdFloating_0


Introduction: Substation function block instance

Declaring and calling an instance of the IEC60870-5-104 substation

Here you can unpack the complete PLC sources: TutorialSample.pro

The complete functionality of a substation is encapsulated in the FB_IEC870_5_104Slave function block. An instance can be used to establish a connection to the master. For establishing a further connection a further instance can be declared, and the same server handle (hServer variable) can be transferred to this second instance or use the FB_IEC870_5-104SlaveGrp function block (preferred!). You have change the host address (IP address) to the address of your target system.

Add the following PLC code to the declaration part of MAIN:

PROGRAM MAIN
VAR
        AODB            : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;

        init            : BOOL := TRUE;
        initError               : UDINT;

        inputs AT%IB0   : ARRAY[0..2999] OF BYTE;
        outputs AT%QB0  : ARRAY[0..2999] OF BYTE;
        memory AT%MB0   : ARRAY[0..2999] OF BYTE;
        data            : ARRAY[0..2999] OF BYTE;

     bEnable                 : BOOL := TRUE;
        hServer                 : T_HSERVER;
        server          : FB_IEC870_5_104Slave;
END_VAR

and the instance is called in the program part:

IF init THEN
        init := FALSE;
...
F_CreateServerHnd( '', '127.0.0.1'(* change this! *), 2404, nMode := LISTEN_MODE_CLOSEALL OR CONNECT_MODE_ENABLEDBG, bEnable, hServer );
ELSE

        server( pInputs := ADR( inputs ),
                cbInputs := SIZEOF( inputs ),
                pOutputs := ADR( outputs ),
                cbOutputs := SIZEOF( outputs ),
                pMemory := ADR( memory ),
                cbMemory := SIZEOF( memory ),
                pData := ADR( data ),
                cbData := SIZEOF( data ),
                pAOEntries := ADR( AODB ),
                cbAOEntries := SIZEOF( AODB ),
                hServer := hServer,
                bEnable := bEnable );
END_IF


Introduction: Protocol parameters

IEC60870-5-104 protocol parameters

Here you can unpack the complete PLC sources: TutorialSample.pro

The behaviour of the substation can be adapted to the requirements of the master via the IEC60870-5-104 protocol parameters. Most parameters have preallocated default values that do not have to be changed.

In our example we change the values of the iK and iW parameters:

IF init THEN
        init := FALSE;
...
        F_CreateServerHnd( '', '127.0.0.1'(* change this! *), 2404, nMode := LISTEN_MODE_CLOSEALL OR CONNECT_MODE_ENABLEDBG, bEnable, hServer );

        server.protPara.iK := 12;
        server.protPara.iW := 8;

ELSE
    server( pInputs := ADR( inputs ),
                cbInputs := SIZEOF( inputs ),
                pOutputs := ADR( outputs ),
...

END_IF

The documentation for all transfer protocol parameters can be found here: ST_IEC870_5_104PotocolParams.


Introduction: System parameters

System parameters

Here you can unpack the complete PLC sources: TutorialSample.pro

The common ASDU address and the user functions of the substation are configured via the system parameters.

In our introduction we configure the following system parameters:

  • The common ASDU address is set to 7. (asduAddr)
  • During initialisation the system time of the substation is synchronised with the system time of the local TwinCAT PC (bUsePCTime).
  • Synchronisation of the substation system time via the time synchronisation command is activated (bSyncTime).
  • The system time of the TwinCAT PC (bSyncPCTime) should not be synchronised during synchronisation of the substation system time.
  • Sending of M_EI_NA_1 (End of init) to the central station is activated (bEndOfInit).
  • Sending of the periodic/cyclic data is deactivated (bPerCyclic). The base time for sending of these data is set to 5 s.
  • Background scan is deactivated (bBackScan). The background scan cycle time is set to 30 s.
  • Local freeze and resetting of the counter readings is activated (bPerFRZ), and the cycle time for freeze and resetting is set to 15 s.
  • Logging of debugging messages in the application log is activated (dbgMode). Logging of device state changes is enabled.

Add the following PLC code to your PLC project:

IF init THEN
        init := FALSE;
...

        server.sysPara.asduAddr := 7;
        server.sysPara.bUsePCTime := TRUE;
        server.sysPara.bSyncTime := TRUE;
        server.sysPara.bSyncPCTime := FALSE;
        server.sysPara.bEndOfInit := TRUE;
        server.sysPara.bPerCyclic := FALSE;
        server.sysPara.tPerCyclicBase := T#5s;
        server.sysPara.bBackScan := FALSE;
        server.sysPara.tBackScanCycle := T#30s;
        server.sysPara.bPerFRZ := TRUE;
        server.sysPara.tPerFRZCycle := T#15s;
        server.sysPara.dbgMode := (*IEC870_DEBUGMODE_ASDU OR*) IEC870_DEBUGMODE_DEVSTATE;

...

ELSE
    server( pInputs := ADR( inputs ),
                cbInputs := SIZEOF( inputs ),
                pOutputs := ADR( outputs ),
...

END_IF

The documentation for all system parameters can be found here: ST_IEC870_5_101SystemParams.


Introduction: Station interrogation

Station interrogation

Here you can unpack the complete PLC sources: TutorialSample.pro

The station interrogation command is initiated by the central station. The ID field of the command also contains the group (1 to 16 or general). The substation transfers the application objects associated with this group to the central station with cause of transmission <20> to <36>. Application objects with time tags are transferred without time tags.

Configuration of the system parameters:

  • It's not necessery to set additional system parameters;

Configuration of the application objects:

  • The application has to assign the data point to one or more than one interrogation group. Here you can find all available group parameters: Group configuration flags.

Example of data point configuration. The data point belongs to group: 1 and group: general.

F_iecInitAOEntry( M_SP_NA_1, 100, IEC870_GRP_INROGEN OR IEC870_GRP_INRO1, 0, MAP_AREA_MEMORY, 100, 0, AODB[0] );


Introduction: Counter interrogation

Transfer of integrated totals (counter interrogation)

Here you can unpack the complete PLC sources: TutorialSample.pro

General count transfer model:

The actual values are added by counters. Via a re-store command that is either received by the central station or generated locally (in the substation), the actual values can be re-stored (copied) periodically into re-stored values. After freezing, the recorded value is either reset to zero (logging of incremental values), or the counter continues adding up (logging of counter readings).

Application objects with counts are assigned to groups. The groups are frozen individually, reset, or transferred. The central station sends count query commands to the substation. The task to be carried out (FRZ) and the group (RQT) are specified in an ID field of the command (QCC).

The allocation of the application objects to the individual groups (1 to 4 or general) is specified via the group flag parameter during configuration. There are four operating modes for recording counter readings and incremental values. Each mode includes notes about the configuration of the system parameters or the application objects.

Mode A: local freeze with spontaneous transfer

The substation internally initiates freeze or freeze with reset. The frozen counts are transferred spontaneously, once the freeze or freeze with reset function was executed. In this mode the central station does not issue any count query commands.

Configuration of the system parameters:

bPerFRZ  := TRUE
tPerFRZCycle := T#60s

The first parameter activates local freeze or freeze with reset. The second parameter specifies the cycle time with which freeze or freeze with reset is carried out (e.g. every 60 seconds).

Configuration of the application objects:

  • The IEC870_GRP_SPONTOFF group parameter must not be set, since it would prevent spontaneous data transfer of the counts.
  • The count is frozen if the IEC870_GRP_LOCFREEZE group parameter was set.
  • The count is reset if the IEC870_GRP_LOCRESET group parameter was set.
  • Local freeze or freeze with reset is carried out simultaneously for all groups (1 to 4 or general).

Operating mode B: Local freeze with counter interrogation

The substation internally initiates freeze or freeze with reset. The central station queries the frozen counts via count query commands. In this case the central station must not use freeze or freeze with reset in the command ID field (FRZ=0). The counts are queried generally or in groups 1 to 4.

Configuration of the system parameters:

bPerFRZ  := TRUE
tPerFRZCycle := T#60s

The first parameter activates local freeze or (and) reset. The second parameter specifies the cycle time with which freeze or freeze with reset is carried out (e.g. every 60 seconds).

Configuration of the application objects:

  • The IEC870_GRP_SPONTOFF group parameter must be set. The counts are not to be transferred spontaneously to the central station.
  • The count is frozen if the IEC870_GRP_LOCFREEZE group parameter was set.
  • The count is reset if the IEC870_GRP_LOCRESET group parameter was set.
  • Local freeze or freeze with reset is carried out simultaneously for all groups (1 to 4 or general).

Operating mode C: The central station initiates freeze, freeze with reset, or reset

The central station periodically issues a count query command to the substation for controlling the freeze or (and) reset process. This command does not result in a count transfer. The central station sends a subsequent count query command for collecting the frozen counts. This is similar to operating mode B.

Configuration of the system parameters:

bPerFRZ  := FALSE
tPerFRZCycle := T#60s

Local freeze or (and) reset must be deactivated. The second parameter is ignored.

Configuration of the application objects:

  • IEC870_GRP_SPONTOFF must be set. The counts are not to be transferred spontaneously to the central station.
  • The IEC870_GRP_LOCFREEZE and IEC870_GRP_LOCRESET group parameters must not be set. The central station initiates freeze or (and) reset.
  • The counts can be assigned to individual groups (1 to 4 or general) and queried (IEC870_GRP_REQCOGEN, IEC870_GRP_REQCO1, IEC870_GRP_REQCO2, IEC870_GRP_REQCO3, IEC870_GRP_REQCO4).

Operating mode D: The central station initiates freeze and (or) reset, and the frozen values are transferred spontaneously

This mode is a combination of the count command from the central station as in mode C and spontaneous transfer of the counts as in mode A.

Configuration of the system parameters:

bPerFRZ  := FALSE
tPerFRZCycle := T#60s

Local freeze or (and) reset must be deactivated. The second parameter is ignored.

Configuration of the application objects:

  • The IEC870_GRP_SPONTOFF group parameter must not be set, since it would prevent spontaneous data transfer of the counts.
  • The IEC870_GRP_LOCFREEZE and IEC870_GRP_LOCRESET group parameters must not be set. The central station initiates freeze or (and) reset.
  • The counts can be assigned to individual groups (1 to 4 or general) and queried (IEC870_GRP_REQCOGEN, IEC870_GRP_REQCO1, IEC870_GRP_REQCO2, IEC870_GRP_REQCO3, IEC870_GRP_REQCO4).


Introduction: Time synchronisation

Clock (time) synchronisation

Here you can unpack the complete PLC sources: TutorialSample.pro

The way in which the system time of the substation is to be synchronised can be configured via the system parameters.

  • During initialisation the system time of the substation can be synchronised with the system time of the local TwinCAT PC;
  • When a time synchronisation command is received from the central station, the system time of the substation can also be synchronised;
  • The system time of the local TwinCAT PC can also be synchronised when a time synchronisation command is received.


Introduction: Background scan

Background scan

Here you can unpack the complete PLC sources: TutorialSample.pro

The background scan is used for refreshing the process information sent from the substation to the central station as an additional safety contribution to the station interrogation and for spontaneous transfers. Application objects with the same type IDs as for the station interrogation may be transferred continuously with low priority, and with <2> background scan as the cause of transmission. The valid ASDU type IDs are listed in the compatibility list for the station (table type ID <-> cause of transmission). The background scan is initiated by the substation and is independent of the station interrogation commands.

Configuration of the system parameters:

The transfer cycle is specified via system parameters in the substation.

bBackScan := TRUE;
tBackScanCycle := T#30s;

Configuration of the application objects:

Application objects whose process data are to be transferred as a background scan have to be configured via the IEC870_GRP_BACKGROUND group flag.

Example:

F_iecInitAOEntry( M_SP_NA_1, 100, IEC870_GRP_INROGEN OR IEC870_GRP_BACKGROUND, 0, MAP_AREA_MEMORY, 100, 0, AODB[0] );


Introduction: Cyclic data transmission

Cyclic data transmission

Here you can unpack the complete PLC sources: TutorialSample.pro

Cyclic data transfer is initiated in a similar way as the background scan from the substation. It is independent of other commands from the central station. Cyclic data transfer continuously refreshes the process data of the central station. The process data are usually measured values that are recorded at regular intervals. Cyclic data transfer is often used for monitoring non-time-critical or relatively slowly changing process data (e.g. temperature sensor data). Cyclic/periodic data are transferred to the central station with cause of transmission <1> periodic/cyclic. The valid ASDU type IDs are listed in the compatibility list for the station (table type ID <-> cause of transmission). Cyclic data transfer can be configured via the system parameters and the configuration parameters of the application objects.

Configuration of the system parameters:

bPerCyclic       : BOOL := TRUE;
tPerCyclicBase  : TIME := T#60s;

The first parameter activates cyclic transfer. The second parameter is the base time for the cyclic/periodic data transfer (in this case 60 seconds).

Configuration of the application objects:

  • IEC870_GRP_PERCYC group parameter has to be set;
  • The multiplier parameter (multiplier) of the F_iecInitAOEntry function has to be set to a zero <> value. Example: With a multiplier = 2 and a base time of 60 seconds the process data of the application object are sent to the central station every 120 seconds;

Example of measured value configuration. The value has to be transferred every 120 seconds to the central station (measured value, normalized value without time tag, M_ME_NA_1).

F_iecInitAOEntry( M_ME_NA_1, 222, IEC870_GRP_INROGEN OR IEC870_GRP_PERCYC, 2, MAP_AREA_MEMORY, 6, 0, AODB[2] );


Introduction: Command transmission

Command transmission

Here you can unpack the complete PLC sources: TutorialSample.pro

Commands can be sent from the central station in control direction (to the substation). A single command with type ID 45 (C_SC_NA_1) is used for controlling an application object that is transferred in monitoring direction as a single-point information (M_SP_NA_1, M_SP_TA_1 or M_SP_TB_1). A dual command (C_DC_NA_1) is used for controlling an application object that is transferred in monitoring direction as a double-point information (M_DP_NA1, M_DP_TA_1 or M_DP_TB_1), etc.

Configuration of system parameters:

  • It's not necessery to set additional system parameters;

Configuration of application objects:

  • Configure the application object type as process data in control direction;
  • The information object addresses (IOA's) should be equal to the addresses configured in control station (master);

Examples:

Single command with the IOA = 10. The command value is mapped to memory area buffer, byte offset = 100, bit offset = 0.

F_iecInitAOEntry( C_SC_NA_1, 10, 0, 0, MAP_AREA_MEMORY, 100, 0, AODB[24] );

Double command with the IOA = 20. The command value is mapped to memory area buffer, byte offset = 200, bit offset = 0..1.

F_iecInitAOEntry( C_DC_NA_1, 20, 0, 0, MAP_AREA_MEMORY, 200, 0, AODB[27] );

Set point, scaled value with the IOA = 60. The command value is mapped to memory area buffer, byte offset = 600..601, bit offset = 0.

F_iecInitAOEntry( C_SE_NB_1, 60, 0, 0, MAP_AREA_MEMORY, 600, 0, AODB[39] )


Introduction: Read command

Interrogation / Read command

Here you can unpack the complete PLC sources: TutorialSample.pro

The central station sends interrogation commands to the substation. The interrogation command contains the address of the application object to be interrogated. The data of this application object are to be sent to the central station. The substation sends the data with cause of transmission <5> interrogation or interrogated. The valid ASDU type IDs are listed in the compatibility list for the station (table type ID <-> cause of transmission).

Configuration of system parameters:

  • It's not necessery to set additional system parameters;

Configuration of application objects:

  • It's not necessery to set additional system parameters;


Introduction: Double transmission

TS6507 | TwinCAT PLC Lib: IEC 60870-5-104 controlled station (slave)

Double transmission

Here you can unpack the complete PLC sources: TutorialSample.pro

All application objects (information objects) that are transferred with cause of transmission <3> spontaneous may be transferred twice, with or without time tag. This mode is referred to as "double transmission". Double transmission is currently not supported by the substation.


Introduction: Quality flags

Quality Flags

Here you can unpack the complete PLC sources: TutorialSample.pro

The quality flags (quality descriptor) provide additional information for the central station on the quality of an application object. The quality flags can be set/reset independent of each other from the PLC application via the F_iecSetAOQuality function. The F_iecGetAOQuality function can be used to interrogate the state of the quality flags. Any change in the quality flags leads to a spontaneous transfer of the data to the central station.

The following quality flags are internally analysed by the substation at runtime:

  • IECQ_BL_ON (blocked). If the process data of the application object were blocked for the transfer, mapping of the PLC and IEC process data is not executed for this application;

The following quality flags are internally set/reset by the substation at runtime:

  • IECQ_IV_ON (Invalid). The substation sets the invalid flag if mapping of the PLC and IEC process data could not be carried out (e.g. due to faulty configuration of the application object). This behaviour can be deactivated by setting group parameter IEC870_GRP_IV_OFF.

All other quality flags are sent to the central station without change.


Introduction: Testing the communication

Testing the communication

Here you can unpack the complete PLC sources: TutorialSample.pro

You can simulate the data point value changes. Setting the bChangeIO variable to TRUE enables the simulation and to FALSE disables. The new values are send cyclicaly every 3 seconds to the control station.

PROGRAM MAIN
VAR
        ...

        bChangeIO : BOOL; (* TRUE => simulate/modify plc process data *)
 timer : TON;
        i : INT;

        ...
END_VAR

...

(*modify plc process data *)
timer( IN := bChangeIO, PT := T#3s );
IF timer.Q THEN
        timer( IN := FALSE );

        msgSingle_0 := NOT msgSingle_0;
        msgSingle_1 := NOT msgSingle_1;
        msgSingle_2 := NOT msgSingle_2;

        FOR i:= 0 TO 3 DO
                IF F_iecGetDPI(msgDouble_0, i) = eIEC870_DPI_ON THEN (* the value of double point allready ON? *)
                        msgDouble_0 := F_iecSetDPI(     msgDouble_0, i, eIEC870_DPI_OFF ); (* change ON => OFF *)
                ELSE
                        msgDouble_0 := F_iecSetDPI(     msgDouble_0, i, eIEC870_DPI_ON );(* change OFF => ON *)
                END_IF
        END_FOR

        F_iecIncVTI( msgStep_0 );
        F_iecDecVTI( msgStep_1 );

        msgBitStr_0 := ROL( msgBitStr_0, 1 );
        msgBitStr_1 := ROR( msgBitStr_1, 1 );

        msgNormalized_0 := msgNormalized_0 + 1;
        msgNormalized_1 := msgNormalized_1 + 2;

        msgScaled_0 := msgScaled_0 + 3;
        msgScaled_1 := msgScaled_1 - 3;

        msgFloating_0 := msgFloating_0 + 0.1;
        msgFloating_1 := msgFloating_1 + 1.5;

        msgTotal_0 := msgTotal_0 + 1;
        msgTotal_1 := msgTotal_1 + 2;
END_IF

...


Introduction: Protocol and data transmission errors

Protocol and data transmission errors

Here you can unpack the complete PLC sources: TutorialSample.pro

The station error messages are placed into a FIFO. Up to 10 error messages can be stored. At fatal communication errors (e.g. error of the linking layer, the check sum of the frame doesn't fit) the connection is cut and has to be build on new. Errors within the application layer (e.g. the ADSU send buffer is overflowed by to many frames) are only logged and doesn't cut the connection.

For this errors it is also possible to cut the connection out of the application. In addition to the error code also the error source is notified in the error message. This simplifies the localization of an error.

Example

The occurring error messages of an IEC 60870-5-104 sub station can be read out via the request:

PROGRAM MAIN
VAR
...

        server : FB_IEC870_5_104Slave;
...

END_VAR

...

REPEAT
        server.system.device.errors.RemoveError();
        IF server.system.device.errors.bOk  THEN
                ADSLOGSTR( ADSLOG_MSGTYPE_ERROR OR ADSLOG_MSGTYPE_LOG,
                        'IEC60870-5-104 slave error: 0x%s',
                        DWORD_TO_HEXSTR( server.system.device.errors.getError.nErrId, 8, FALSE) );
        END_IF
UNTIL NOT server.system.device.errors.bOk
END_REPEAT

...


Introduction: Troubleshooting and debugging

Troubleshooting and debugging

Debugging messages written to the application log facilitate troubleshooting of the system. Currently five stages of debugging messages can be activated in an IEC application. Four stages of messages can be activated via the dbgMode system parameter of the controlled station (ST_IEC870_5_101SystemParams).

  1. Debugging messages that are logged when the TCP/IP connection is established or released (TcSocketHelper.Lib messages). These messages can be activated via the nMode: CONNECT_MODE_ENABLEDBG parameter when the F_CreateServerHnd() function is called;
  2. Station status messages (dbgMode: IEC870_DEBUGMODE_DEVSTATE);
  3. Hexadecimal output of the ASDUs (dbgMode: IEC870_DEBUGMODE_ASDU). 32 ASDU data bytes per row are output as hexadecimal numbers. Bigger frames are split into multiple lines;
  4. Hexadecimal output of the APDUs (TCP/IP frames, dbgMode: IEC870_DEBUGMODE_LINKLAYER). 32 APDU data bytes per row are output as hexadecimal numbers. Bigger frames are split into multiple lines;
  5. Output of link layer errors as debug messages (dbgMode: IEC870_DEBUGMODE_LINKERROR);

In order to view the activated debug messages start the TwinCAT System Manager and activate log view. A debugging output is shown below. The first three different message types are identified with the respective numbers.

Further diagnostic tools:

  • TwinCAT ADS monitor;
  • Network monitor;
  • Wireshark;
  • Ethereal;
  • Diverse protocoll test suite products;


FB_IEC870_5_104SlaveGrp

FUNCTION_BLOCK FB_IEC870_5_104SlaveGrp

Product Version: TwinCAT PLC Library: IEC60870-5-104 controlled station (slave) v2.0.2 and higher.

An instance of the FB_IEC870_5_104SlaveGrp function block can be used to implement an IEC60870-5-104 substation (slave) in the TwinCAT PLC. An instance of the function block can establish one connection with a master or more connections with a master ( redundant systems)

The maximum number of connections can be defined by the number of ST_IEC870_5_104ServerConnection array elements. The address and byte size of the array variables have to be passed to the instance of FB_IEC870_5_104SlaveGrp function block.

VAR_IN_OUT

VAR_IN_OUT
        hServer : T_HSERVER;
ND_VAR

hServer : TCP/IP Server-Handle. The internal parameter of the Server-Handle variable has to be initialised with the function F_CreateServerHnd.

VAR_INPUT

VAR_INPUT
        protPara        : ST_IEC870_5_104ProtocolParams;                                               (* IEC60870-5-104 protocol communication params *)
 sysPara                 : ST_IEC870_5_101SystemParams;                                         (* IEC60870-5-104 slave system params *)
 pAOEntries      : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF ST_IEC870_5_101AODBEntry := 0;       (* Pointer to the first element of application database object array *)
 cbAOEntries     : UDINT := 0;                                                             (* Byte size (length) of application database object array *)
 pInputs                 : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbInputs        : UDINT := 0;
        pOutputs        : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbOutputs       : UDINT := 0;
        pMemory                 : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbMemory        : UDINT := 0;
        pData           : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE := 0;
        cbData          : UDINT := 0;
        pConnections    : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF ST_IEC870_5_104ServerConnection := 0;
        cbConnections   : UDINT := 0;
        bEnable                 : BOOL := TRUE;
END_VAR

protPara: IEC60870-5-104 protocol parameter.

sysPara: system parameter.

pAOEntries: address of the application object database variable.

cbAOEntries: byte size of the application object database variable.

pInputs: address of the PLC process data area for the inputs.

cbInputs: byte size of the PLC process data area for the inputs.

pOutputs: address of the PLC process data area for the outputs.

cbOutputs: byte size of the PLC process data area for the outputs.

pMemory: address of the PLC process data area for the flags.

cbMemory: byte size of the PLC process data area for the flags.

pData: address of the PLC data area.

cbData: byte size of the PLC data area.

pConnections: address of the ST_IEC870_5_104ServerConnection array variables.

cbConnections: byte size of the ST_IEC870_5_104ServerConnection array variables.

bEnable :activates/deactivates the function block (communication and connection).

The addresses can found out with the ADR operator, resp. the byte sizes can be found with the SIZEOF operator.

VAR_OUTPUT

VAR_OUTPUT
        system          : ST_IEC870_5_104SystemInterface;
        status          : ST_IEC870_5_104GrpStatus;
ND_VAR

system: system interface. This variable is used by other IEC application functions as a communication interface for the IEC device (here: substation).

  • Member variable system.device is expected by the F_iecSetAOQuality function as VAR_IN_OUT parameter, for example.
  • Member variable system.device.errors is a device error FIFO. The PLC application can read and analyse registered errors.

status: Connection and data transfer status information.

Example:

Example projects: IEC60870-5-104 controlled station

Call in FBD with maximum of 2 master connections:

PROGRAM test
VAR
        AODB            : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;
        inputs AT%IB0   : ARRAY[0..999] OF BYTE;
        outputs AT%QB0  : ARRAY[0..999] OF BYTE;
        memory AT%MB0   : ARRAY[0..999] OF BYTE;
        data            : ARRAY[0..999] OF BYTE;

        hServer                 : T_HSERVER;
        server          : FB_IEC870_5_104SlaveGrp;
        connections     : ARRAY[0..1] OF ST_IEC870_5_104ServerConnection; (* Two master connections *)

        bEnable                 : BOOL := TRUE;
        protPara        : ST_IEC870_5_104ProtocolParams;
        sysPara                 : ST_IEC870_5_101SystemParams := ( asduAddr := 7 );
        status          : ST_IEC870_5_104GrpStatus;
        bError          : BOOL;
        iecError        : ST_IEC870_5_101ErrorFifoEntry;
END_VAR

In the following structured text example the device error FIFO is read cyclically, and the registered errors are written into the Windows Application Log.

REPEAT
        server.system.device.errors.RemoveError( getError=>iecError, bOk=>bError );
        IF bError THEN
                ADSLOGSTR( ADSLOG_MSGTYPE_ERROR OR ADSLOG_MSGTYPE_LOG, 'IEC60870-5-104 slave error: 0x%s', DWORD_TO_HEXSTR( iecError.nErrId, 8, FALSE) );
        END_IF
UNTIL NOT bError
END_REPEAT

Development Environment | Target System | PLC libraries to include
TwinCAT v2.9.0 Build >= 1030 | PC or CX (x86) | TcIEC870_5_104Slave.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcpIp.Lib; TcUtilities.Lib; TcSocketHelper.Lib; TcIEC870_5_104.Lib, TcIEC870_5_101.Lib are included automatically)
TwinCAT v2.10.0 Build >= 1301 | CX (ARM)


FB_IEC870_5_104Slave

FUNCTION_BLOCK FB_IEC870_5_104Slave

An instance of the FB_IEC870_5_104Slave function block can be used to implement an IEC60870-5-104 substation (slave) in the TwinCAT PLC. An instance of the function block can only establish a connection with a master.

Important hint:

If you want to realise redundant systems with two or more connections use the FB_IEC870_5_104SlaveGrp function block.

VAR_IN_OUT

VAR_IN_OUT
        hServer: T_HSERVER;
ND_VAR

hServer : TCP/IP server handle. The internal parameters of the server handle variable first have to be initialised via the F_CreateServerHnd function.

VAR_INPUT

VAR_INPUT
        protPara        : ST_IEC870_5_104ProtocolParams;                                               (* IEC60870-5-104 protocol communication params *)
 sysPara                 : ST_IEC870_5_101SystemParams;                                         (* IEC60870-5-104 slave system params *)
 pAOEntries      : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF ST_IEC870_5_101AODBEntry;    (* Pointer to the first element of application database object array *)
 cbAOEntries     : UDINT;                                                          (* Byte size (length) of application database object array *)
 pInputs                 : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE;
        cbInputs        : UDINT;
        pOutputs        : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE;
        cbOutputs       : UDINT;
        pMemory                 : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE;
        cbMemory        : UDINT;
        pData           : POINTER TO ARRAY[0..IEC870_ANYSIZE_ARRAY] OF BYTE;
        cbData          : UDINT;
        bEnable                 : BOOL := TRUE;
END_VAR

protPara: IEC60870-5-104 protocol parameter.

sysPara: system parameter.

pAOEntries: address of the application object database variable.

cbAOEntries: byte size of the application object database variable.

pInputs: address of the PLC process data area for the inputs.

cbInputs: byte size of the PLC process data area for the inputs.

pOutputs: address of the PLC process data area for the outputs.

cbOutputs: byte size of the PLC process data area for the outputs.

pMamory: address of the PLC process data area for the flags.

cbMamory: byte size of the PLC process data area for the flags.

pData: address of the PLC data area.

cbData: byte size of the PLC data area.

bEnable :activates/deactivates the function block (communication and connection).

VAR_OUTPUT

VAR_OUTPUT
        system          : ST_IEC870_5_104SystemInterface;
        eConnState      : E_SocketConnectionState          := eSOCKET_DISCONNECTED;  (* TCP/IP connection state *)
 eDTState        : E_IEC870_5_104DataTransferState  := eIEC870_STOPDT;        (* IEC60870-5-104 data transfer state *)
END_VAR

system: system interface. This variable is used by other IEC application functions as a communication interface for the IEC device (here: substation).

  • Member variable system.device is expected by the F_iecSetAOQuality function as VAR_IN_OUT parameter, for example.
  • Member variable system.device.errors is a device error FIFO. The PLC application can read and analyse registered errors.

eConnState: status of the TCP/IP connection with the master.

eDTState: status of the IEC60870-5-104 data exchange (STARTDT, STOPDT)

Example:

Example projects: IEC60870-5-104 controlled station

Call in FBD:

PROGRAM test
VAR
        AODB            : ARRAY[0..49] OF ST_IEC870_5_101AODBEntry;
        inputs AT%IB0   : ARRAY[0..999] OF BYTE;
        outputs AT%QB0  : ARRAY[0..999] OF BYTE;
        memory AT%MB0   : ARRAY[0..999] OF BYTE;
        data            : ARRAY[0..999] OF BYTE;

        hServer                 : T_HSERVER;
        server          : FB_IEC870_5_104Slave;

        bEnable                 : BOOL := TRUE;
        protPara        : ST_IEC870_5_104ProtocolParams;
        sysPara                 : ST_IEC870_5_101SystemParams := ( asduAddr := 7 );
        eConnState      : E_SocketConnectionState;
        eDTState        : E_IEC870_5_104DataTransferState;
        bError          : BOOL;
        iecError        : ST_IEC870_5_101ErrorFifoEntry;
END_VAR

In the following structured text example the device error FIFO is read cyclically, and the registered errors are written into the Windows Application Log.

REPEAT
        server.system.device.errors.RemoveError( getError=>iecError, bOk=>bError );
        IF bError THEN
                ADSLOGSTR( ADSLOG_MSGTYPE_ERROR OR ADSLOG_MSGTYPE_LOG, 'IEC60870-5-101 slave error: 0x%s', DWORD_TO_HEXSTR( iecError.nErrId, 8, FALSE) );
        END_IF
UNTIL NOT bError
END_REPEAT

Development Environment | Target System | PLC libraries to include
TwinCAT v2.9.0 Build >= 1030 | PC or CX (x86) | TcIEC870_5_104Slave.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcpIp.Lib; TcUtilities.Lib; TcSocketHelper.Lib; TcIEC870_5_104.Lib, TcIEC870_5_101.Lib are included automatically )
TwinCAT v2.10.0 Build >= 1301 | CX (ARM)


F_GetVersionTcIEC870_5_104Slave

FUNCTION F_GetVersionTcIEC870_5_104Slave

This function reads version information from the plc library.

FUNCTION F_GetVersionTcIEC870_5_104Slave: UINT

VAR_INPUT
        nVersionElement : INT;
END_VAR

nVersionElement : Version element, that is to be read. Possible parameters:

  • 1 : major number;
  • 2 : minor number;
  • 3 : revision number;
Development Environment | Target System | PLC libraries to include
TwinCAT v2.9.0 Build >= 1030 | PC or CX (x86) | TcIEC870_5_104Slave.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcpIp.Lib; TcUtilities.Lib; TcSocketHelper.Lib; TcIEC870_5_104.Lib, TcIEC870_5_101.Lib are included automatically )
TwinCAT v2.10.0 Build >= 1301 | CX (ARM)


ST_IEC870_5_104ServerConnection

TYPE ST_IEC870_5_104ServerConnection

Product Version: TwinCAT PLC Library: IEC60870-5-104 controlled station (slave) v2.0.2 and higher.

A variable of this type represents a IEC870-5-104 Server connection.

Example for a declaration for a triple connection:

connections : ARRAY[0..3] OF ST_IEC870_5_104ServerConnection;

Example for a declaration for a single connection:

connections : ARRAY[0..0] OF ST_IEC870_5_104ServerConnection;

Important note:

The structure elements should not be written or changed.

Development Environment | Target System | PLC Libraries to include
TwinCAT v2.9.0 Build >= 1030 | PC or CX (x86) | TcIEC870_5_104Slave.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcpIp.Lib; TcUtilities.Lib; TcSocketHelper.Lib; TcIEC870_5_101.Lib; TcIEC870_5_104.Lib are inculded automatically )
TwinCAT v2.10.0 Build >= 1301 | CX (ARM)


ST_IEC870_5_104GrpStatus

TYPE ST_IEC870_5_104GrpStatus

Product Version: TwinCAT PLC Library: IEC60870-5-104 controlled station (slave) v2.0.2 and higher.

Status of an IEC870-5-104 Slave Group.

TYPE ST_IEC870_5_104GrpStatus:
STRUCT
        nConnected : DWORD := 0;
        nSuspended : DWORD := 0;
        nDTStarted : DWORD := 0;
END_STRUCT
END_TYPE

nConnected: Number of connected TCP/IP Connections (ESTABLISHED).

nSuspended: Number of connections those status changes (CONNECTED->DISCONNECTED oder DISCONNECTED->CONNECTED).

nDTStarted: Number of connections with active data transfer.

Development Environment | Target System | PLC Libraries to include
TwinCAT v2.9.0 Build >= 1030 | PC or CX (x86) | TcIEC870_5_104Slave.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcpIp.Lib; TcUtilities.Lib; TcSocketHelper.Lib; TcIEC870_5_101.Lib; TcIEC870_5_104.Lib are included automatically )
TwinCAT v2.10.0 Build >= 1301 | CX (ARM)


ST_IEC870_5_104SystemInterface

TYPE ST_IEC870_5_104SystemInterface

TYPE ST_IEC870_5_104SystemInterface :
STRUCT
        device  : ST_IEC870_5_101DeviceInterface;
        service         : ST_IEC870_5_104SlaveServices;
END_STRUCT
END_TYPE

device: Communication interface of IEC device.

service: IEC device service;

Development Environment | Target System | PLC libraries to include
TwinCAT v2.9.0 Build >= 1030 | PC or CX (x86) | TcIEC870_5_104Slave.Lib ( Standard.Lib; TcBase.Lib; TcSystem.Lib; TcpIp.Lib; TcUtilities.Lib; TcSocketHelper.Lib; TcIEC870_5_104.Lib, TcIEC870_5_101.Lib are included automatically )
TwinCAT v2.10.0 Build >= 1301 | CX (ARM)


Error codes overview

TwinCAT IEC 60870-5-104 controlled station error codes

Codes (hex) | Codes (dec) | Error source | Description
0x00000000-0x00007800 | 0-30720 | TwinCAT System error | TwinCAT System error (ADS- error code inclusive)
0x00008000-0x000080FF | 32768-33023 | Internal TwinCAT TCP/IP Connection Server error code | Internal error of TwinCAT TCP/IP Connection Server
0x00008100-0x000081FF | 33024-33279 | Internal IEC 60870-5-10x error | Internal IEC 60870-5-10x error
0x80070000-0x8007FFFF | 2147942400-2148007935 | Error source = Code - 0x80070000 = Win32 system error code | Win32 System error (Windows Sockets error codes inclusive)


Troubleshooting

Troubleshooting/diagnostics

1. Check the hardware and software requirements described in this documentation (TwinCAT version, CE image version etc.).

2. Compare the interoperability check list of controlled station and control station.

3. Check the software installation hints described in this documentation (e.g. installation of CAB files on CE plattform).

4. In the event of connection problems the PING command can be used to ascertain whether the external communication partner can be reached via the network connection. If this is not the case, check the network configuration and firewall settings.

5. Check the input parameters that are transferred to the F_CreateServerHnd() function (network address, port number etc.) for correctness.

6. Check whether the function block issues an error code. The documentation for the error codes can be found here: Overview of error codes.

7. Check the protocol parameters that are transferred to the function block (iK, iW, t0, t1, t2, t3, APDULength etc.). Compare them to the parameters set in the controlling station.

8. Check the system parameter that are transferred to the function block (ASDU address, ASDU address octet size, information object address octet size, cause of transfer octet size, etc. ). Compare them to the the parameters set in the controlling station.

9. Check the configured data points (type, information object address etc.).

10. Check if the controlling station issues an error code.

11. Activate the debug output during connection establishment and/or of ASDU data. Open the TwinCAT System Manager and activate the LogView window. Analyze/check the debug output strings.

12. Check the usage of FB_SocketCloseAll() function block and the usage of the LISTEN_MODE_CLOSEALL parameter in your PLC application.
If your application is working with more than one TCP/IP connections (server/clients) than you have to use one instance of FB_SocketCloseAll() function block to close old/opened connections. Activate this function block instance only once at program start and don't use the LISTEN_MODE_CLOSEALL parameter.

13. Sniffer tools such as Wireshark enable logging of the entire network communication. The log can then be analysed by Beckhoff support staff.


Examples

Used controlled station configuration parameters:

  • Local (server) host address: 127.0.0.1 (you have to adapt at least this parameter to your target system!!)
  • Local (server) port addres: 2404
  • k: 12
  • w: 8
  • t0: 30s
  • t1: 15s
  • t2: 10s
  • t3: 20s
  • Cause of transfer size: 2 octets
  • Common ASDU address size: 2 octets
  • Information object address size: 3 octets
  • Originator address: 1
  • Common ASDU address: 7
  • Max. APDU length: 253
PLC project | Description
MiniSlaveSample.pro | TwinCAT IEC60870-5-104 controlled station with one master connection. Very small PLC project with one single point in monitoring (IOA = 100) and one single command in control direction (IOA = 10).
TutorialSample.pro | TwinCAT IEC60870-5-104 controlled station with one master connection. More complex PLC project with different data points in both directions.
TutorialSampleR.pro | TwinCAT IEC60870-5-104 controlled station with two master connections. More complex PLC project with different data points in both directions.


Firewall settings

The TwinCAT PLC library IEC 60870-5-104 sub station (slave/server) uses the TCP/IP protocol for communication. It is therefore essential to make sure that the corresponding TCP port will be activated during the using of a firewall. The table below lists standard ports, that have to be considered by using a firewall.

D escription | Type | Protocol | Port
IEC 60870-5-104 telecontrol protocol | Protocol | TCP | 2404

The configuration of the Windows Firewall is done via the corresponding dialog in the control panel. For further information please see the Windows resp. Firewall documentation.

Important note:

Remember if you use a Embedded Controller without display and USB: Activate the port for Remote Display (Windows CE) or Remote Desktop (Windows XP / Windows Vista) in the firewall. Otherwise you have no way to manage the computer via the network.