IEC 60870-5-101 telegram structure
- FT 1.2 frame format is used;
- Frames with fixed and variable block length and single control characters are used;
- Hamming distance = 4;
Frame with variable length
This frame type is used to transmit user data between controlling and controlled station
|
byte\bit |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|
|
|
|
|
|
0 |
Start byte 1 (0x68) |
Header |
|
LPCI |
|
LPDU | |||||||
|
1 |
Block length |
|
| ||||||||||
|
2 |
Block length (copy) |
|
| ||||||||||
|
3 |
Start byte 2 (0x68) |
|
| ||||||||||
|
4 |
RES |
PRM |
FCB / ACD |
FCV / DFC |
Function code |
Control field |
| ||||||
|
5 |
Link address fields |
|
| ||||||||||
|
|
(0, 1 or 2 octets) |
|
| ||||||||||
|
|
DATA UNIT IDENTIFIER |
|
ASDU |
| |||||||||
|
|
SQ |
Number of objects |
|
| |||||||||
|
|
T |
P/N |
|
| |||||||||
|
|
Originator address (ORG, 0 or 1 octets) |
|
| ||||||||||
|
|
ASDU address fields |
|
| ||||||||||
|
|
(1 or 2 octets) |
|
| ||||||||||
|
|
Information object address fields (IOA) |
Info-object |
| ||||||||||
|
|
(1,2 or 3 octets) |
|
| ||||||||||
|
|
Object information |
|
| ||||||||||
|
|
|
|
| ||||||||||
|
|
|
|
| ||||||||||
|
n-1 |
Checksum |
Tail |
|
LPCI |
| ||||||||
|
n |
Stop byte (0x16) |
|
| ||||||||||
Frame with fixed length
This frame type is used for link layer services. Sometimes used as an confirmation.
|
byte\bit |
7 |
6 |
5 |
4 |
3 |
2 |
1 |
0 |
|
|
|
|
0 |
Start byte 1 (0x10) |
|
|
LPCI | |||||||
|
1 |
RES |
PRM |
FCB / ACD |
FCV / DFC |
Function code |
Control field |
| ||||
|
2 |
Link address |
|
| ||||||||
|
|
(0, 1 or 2 octets) |
|
| ||||||||
|
n-1 |
Checksum |
|
| ||||||||
|
n |
Stop byte (0x16) |
|
| ||||||||
Single character data
Single characters are used to confirm link layer and user data transmissions.
- 0xE5 (positive acknowledge);
- 0xA2 (negative acknowledge);
Simple samples and explanations
101substation configuration: Link address = 2 octets, COT = 1 octet (ORG address not used), ASDU address = 2 octets, IOA address = 2 octets
Sample 1
10 49 0C 00 55 16
|
LPDU bytes |
Explanation |
|---|---|
|
10 |
Start byte: frame with fixed length |
|
49 |
Control filed: PRM-bit set (frame from primary station), function code = 9 (link status) |
|
0C 00 |
Link address (2 octets) = 12 dec. |
|
55 |
Checksum |
|
16 |
Stop byte |
Sample 2
10 0B 0C 00 17 16
|
LPDU bytes |
Explanation |
|---|---|
|
10 |
Start byte: frame with fixed length |
|
0B |
Control field: PRM-bit not set (frame from secondary station), function code = 11 (status of link or access demand) |
|
0C 00 |
Link address (2 octets) = 12 dec. |
|
17 |
Checksum |
|
16 |
Stop byte |
Sample 3
68 0B 0B 68 08 0C 00 65 01 0A 0C 00 00 00 05 95 16
|
LPDU bytes |
Explanation |
|---|---|
|
68 |
Start byte 1: frame with variable length |
|
0B 0B |
Block length and block length copy |
|
68 |
Start byte 2 |
|
08 |
Control field: PRM-bit not set (frame from secondary station), function code = 8 (user data) |
|
0C 00 |
Link address (2 octets) = 12 dec. |
|
65 |
Type identification: C_CI_NA_1 (counter interrogation) |
|
01 |
Number of objects = 1 |
|
0A |
Cause of transmission = 10 (activation confirmation) |
|
0C 00 |
Common ASDU address (2 octets) = 12 dec. |
|
00 00 |
Object address (2 octets) = 0 |
|
05 |
Counter interrogation request qualifier = 5 (general counter interrogation) |
|
95 |
Checksum |
|
16 |
Stop byte |
Sample 4
68 0F 0F 68 08 0C 00 0F 01 03 0C 00 81 30 DA 16 00 00 07 DB 16
|
LPDU bytes |
Explanation |
|---|---|
|
68 |
Start byte 1: frame with variable length |
|
0F 0F |
Block length and block length copy |
|
68 |
Start byte 2 |
|
08 |
Control field: PRM-bit not set (frame from secondary station), function code = 8 (user data) |
|
0C 00 |
Link address (2 octets) = 12 dec. |
|
0F |
Type identification: M_IT_NA_1 (integrated total) |
|
01 |
Number of objects = 1 |
|
03 |
Cause of transmission = 3 (spontanous) |
|
0C 00 |
Common ASDU address (2 octets) = 12 dec. |
|
81 30 |
Object address (2 octets) |
|
DA 16 00 00 |
BCR (binary counter value) |
|
07 |
Quality descriptor = 7 (sequence) |
|
DB |
Checksum |
|
16 |
Stop byte |
Sample 4
68 2B 2B 68 08 0C 00 0B 07 03 0C 00 10 30 BE 09 00 11 30 90 09 00 0E 30 75 00 00 28 30 25 09 00 29 30 75 00 00 0F 30 0F 0A 00 2E 30 AE 05 00 85 16
|
LPDU bytes |
Explanation |
|---|---|
|
68 |
Start byte 1: frame with variable length |
|
2B 2B |
Block length and block length copy |
|
68 |
Start byte 2 |
|
08 |
Control field: PRM-bit not set (frame from secondary station), function code = 8 (user data) |
|
0C 00 |
Link address (2 octets) = 12 dec. |
|
0B |
Type identification: M_ME_NB_1(measured value, scaled value) |
|
07 |
Number of objects = 7 |
|
03 |
Cause of transmission = 3 (spontanous) |
|
0C 00 |
Common ASDU address (2 octets) = 12 dec. |
|
10 30 |
Object address (2 octets) of first information object |
|
BE 09 00 |
Scaled value + QDS (quality descriptor) of first information object |
|
11 30 |
Object address (2 octets) of second information object |
|
90 09 00 |
Scaled value + QDS (quality descriptor) of second information object |
|
0E 30 |
Object address (2 octets) of third information object |
|
75 00 00 |
Scaled value + QDS (quality descriptor) of third information object |
|
28 30 25 09 00 |
Object address + Scaled value + QDS (quality descriptor) of information object four to seven |
|
85 |
Checksum |
|
16 |
Stop byte |