IEC 60870-5-101 telegram structure
- FT 1.2 frame format is used;
- Frames with fixed and variable block length and single control characters are used;
- Hamming distance = 4;
Frame with variable length
This frame type is used to transmit user data between controlling and controlled station
byte\bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
|
|
|
|
|
0 | Start byte 1 (0x68) | Header |
| LPCI |
| LPDU | |||||||
1 | Block length |
|
| ||||||||||
2 | Block length (copy) |
|
| ||||||||||
3 | Start byte 2 (0x68) |
|
| ||||||||||
4 | RES | PRM | FCB / ACD | FCV / DFC | Function code | Control field |
| ||||||
5 | Link address fields |
|
| ||||||||||
| (0, 1 or 2 octets) |
|
| ||||||||||
| DATA UNIT IDENTIFIER |
| ASDU |
| |||||||||
| SQ | Number of objects |
|
| |||||||||
| T | P/N |
|
| |||||||||
| Originator address (ORG, 0 or 1 octets) |
|
| ||||||||||
| ASDU address fields |
|
| ||||||||||
| (1 or 2 octets) |
|
| ||||||||||
| Information object address fields (IOA) | Info-object |
| ||||||||||
| (1,2 or 3 octets) |
|
| ||||||||||
| Object information |
|
| ||||||||||
|
|
|
| ||||||||||
|
|
|
| ||||||||||
n-1 | Checksum | Tail |
| LPCI |
| ||||||||
n | Stop byte (0x16) |
|
| ||||||||||
Frame with fixed length
This frame type is used for link layer services. Sometimes used as an confirmation.
byte\bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
|
|
|
0 | Start byte 1 (0x10) |
|
| LPCI | |||||||
1 | RES | PRM | FCB / ACD | FCV / DFC | Function code | Control field |
| ||||
2 | Link address |
|
| ||||||||
| (0, 1 or 2 octets) |
|
| ||||||||
n-1 | Checksum |
|
| ||||||||
n | Stop byte (0x16) |
|
| ||||||||
Single character data
Single characters are used to confirm link layer and user data transmissions.
- 0xE5 (positive acknowledge);
- 0xA2 (negative acknowledge);
Simple samples and explanations
101substation configuration: Link address = 2 octets, COT = 1 octet (ORG address not used), ASDU address = 2 octets, IOA address = 2 octets
Sample 1
10 49 0C 00 55 16
LPDU bytes | Explanation |
|---|---|
10 | Start byte: frame with fixed length |
49 | Control filed: PRM-bit set (frame from primary station), function code = 9 (link status) |
0C 00 | Link address (2 octets) = 12 dec. |
55 | Checksum |
16 | Stop byte |
Sample 2
10 0B 0C 00 17 16
LPDU bytes | Explanation |
|---|---|
10 | Start byte: frame with fixed length |
0B | Control field: PRM-bit not set (frame from secondary station), function code = 11 (status of link or access demand) |
0C 00 | Link address (2 octets) = 12 dec. |
17 | Checksum |
16 | Stop byte |
Sample 3
68 0B 0B 68 08 0C 00 65 01 0A 0C 00 00 00 05 95 16
LPDU bytes | Explanation |
|---|---|
68 | Start byte 1: frame with variable length |
0B 0B | Block length and block length copy |
68 | Start byte 2 |
08 | Control field: PRM-bit not set (frame from secondary station), function code = 8 (user data) |
0C 00 | Link address (2 octets) = 12 dec. |
65 | Type identification: C_CI_NA_1 (counter interrogation) |
01 | Number of objects = 1 |
0A | Cause of transmission = 10 (activation confirmation) |
0C 00 | Common ASDU address (2 octets) = 12 dec. |
00 00 | Object address (2 octets) = 0 |
05 | Counter interrogation request qualifier = 5 (general counter interrogation) |
95 | Checksum |
16 | Stop byte |
Sample 4
68 0F 0F 68 08 0C 00 0F 01 03 0C 00 81 30 DA 16 00 00 07 DB 16
LPDU bytes | Explanation |
|---|---|
68 | Start byte 1: frame with variable length |
0F 0F | Block length and block length copy |
68 | Start byte 2 |
08 | Control field: PRM-bit not set (frame from secondary station), function code = 8 (user data) |
0C 00 | Link address (2 octets) = 12 dec. |
0F | Type identification: M_IT_NA_1 (integrated total) |
01 | Number of objects = 1 |
03 | Cause of transmission = 3 (spontanous) |
0C 00 | Common ASDU address (2 octets) = 12 dec. |
81 30 | Object address (2 octets) |
DA 16 00 00 | BCR (binary counter value) |
07 | Quality descriptor = 7 (sequence) |
DB | Checksum |
16 | Stop byte |
Sample 4
68 2B 2B 68 08 0C 00 0B 07 03 0C 00 10 30 BE 09 00 11 30 90 09 00 0E 30 75 00 00 28 30 25 09 00 29 30 75 00 00 0F 30 0F 0A 00 2E 30 AE 05 00 85 16
LPDU bytes | Explanation |
|---|---|
68 | Start byte 1: frame with variable length |
2B 2B | Block length and block length copy |
68 | Start byte 2 |
08 | Control field: PRM-bit not set (frame from secondary station), function code = 8 (user data) |
0C 00 | Link address (2 octets) = 12 dec. |
0B | Type identification: M_ME_NB_1(measured value, scaled value) |
07 | Number of objects = 7 |
03 | Cause of transmission = 3 (spontanous) |
0C 00 | Common ASDU address (2 octets) = 12 dec. |
10 30 | Object address (2 octets) of first information object |
BE 09 00 | Scaled value + QDS (quality descriptor) of first information object |
11 30 | Object address (2 octets) of second information object |
90 09 00 | Scaled value + QDS (quality descriptor) of second information object |
0E 30 | Object address (2 octets) of third information object |
75 00 00 | Scaled value + QDS (quality descriptor) of third information object |
28 30 25 09 00 | Object address + Scaled value + QDS (quality descriptor) of information object four to seven |
85 | Checksum |
16 | Stop byte |