Theory Overview

Jim Bougie
Hands on Relay School

INTRO TO COMMUNICATIONS
© ABB Group
March 13, 2013 | Slide 1
Agenda
 Communications Media
 RS 232
 RS 485
 Ethernet
 Protocols
 Proprietary
 Modbus
 DNP
 IEC61850
© ABB Group
RS 232
 Found in many formats, mainly 9 / 25

pin, but RJ45 has been used.
 Is voltage based.
 Is an TIA (Telecommunications Industry
Association) Standard
 Was originally developed on EIA
subcommittee TR30.2 on Interface.
 Latest revision as of July 2009 is TIA-
RS232-F
© ABB Group
RS 232
NODE
 RS 232 is a point to point connection network.

 Relays may have multiple RS 232 Ports, usually one
reserve for local programming
 Is voltage based (referenced to a single common
return [ground]).
 Is the most commonly used electrical interface.
© ABB Group
Typical RS 232 Devices
POINT TO POINT
B A A A
VALUE
RADIO FREQUENCY MODEMS

RS 232
EC
RS 232
The Cloud.
RING WITH FIBER OPTIC MODEMS EC
B A A A
VALUE
EC
RS 232 RS 232
RS 232 B A
A VALUE
A
© ABB Group
RS 232 ANSI SPEC
 2 Emulation's:
• DTE - Data Terminal Equipment
– Examples -
• Personal Computer.
• DCE - Data Communication Equipment.
– Examples
• Modem (Automatic Calling Equipment)
© ABB Group
SPEED RS 232
 Modem Speeds are from:

• 110 baud (Not Really Used)
• 115.2 K baud
 A Baud is a bit representation.

• One Baud does not necessarily mean 1 bit.
• One Baud means one change of state of the
line.
• Baud rate = 9600 = 1 change of state every
100 micro seconds.
© ABB Group
RS 232 Connector
 Connector Style is not specified.

• Originally Specified for 25 pins.
• IBM developed de-facto standard of 9 Pins
 Physical Interface Connector
• DB 25
• DB 9
• Screw Terminals
• RJ 11 Telephone Connectors.
• RJ 45 Ethernet Connectors
© ABB Group
RS 232 DB 25 Wiring Diagram
DTE DCE
1 - Protective Ground 1 - Protective Ground
2 - Transmitted Data 2 - Transmitted Data
3 - Received Data 3 - Received Data
4 - Request To Send 4 - Request To Send
5 -Clear To Send 5 -Clear To Send
6 - Data Set Ready 6 - Data Set Ready
7 - Signal Ground -Common Return 7 - Signal Ground -Common Return
8 - Data Carrier Detect 8 - Data Carrier Detect
20 - Data Terminal Ready 20 - Data Terminal Ready
22 - Ring Indicator 22 - Ring Indicator
RTS - Space= Transmit mode Mark = Receive Mode

CTS - Space = Send Data Mark = Do Not Send Data
DSR - Space = Device Off Hook Mark = Device ON Hook
DTR - Space = Device On Line Mark = Device Off Line
DCD - Space = Good Data Mark = Error In Data
RI - Mark = Phone Ringing Space = Not Ringing
NOTE: both RTS/CTS and DTR/DSR are rarely used

© ABB Group
RS 232 (DB 9)
DTE ( )
9 Pin DCE
DTE DCE
2 - TX TX - 2
3 - RX RX - 3
4 - DTR DTR - 4
Note: If both devices are 5- GND GND - 5
DTE’s or DCE’s 6 - DSR DSR - 6
re-pin the cable as 7 - RTS RTS - 7
necessary! 8 - CTS CTS - 8
50 feet cable length maximum
© ABB Group
RS 232 - Physical Interface
 Signal
– Transmit (TX)
– Receive ( RX)
– Ground (GND)
 Control
– Clear To Send ( CTS)
– Request To Send ( RTS)
– Data Set Ready ( DSR)
– Data Terminal Ready ( DTR)
– Carrier Detect (CD)
© ABB Group
What is a NULL MODEM Cable?
NODE A NODE B
2 TD 2 TD
3 RD 3 RD
5 GND 5 GND
7 RTS 7 RTS
8 CTS 8 CTS
4 DTR 4 DTR
6 DSR 6 DSR
 There are times to connect DTE - DTE or DCE-

DCE.
© ABB Group
Why the Jumpers?
NODE A NODE B
2 TD 2 TD
3 RD 3 RD
5 GND 5 GND
7 RTS 7 RTS
8 CTS 8 CTS
4 DTR 4 DTR
6 DSR 6 DSR
 There are times when handshaking is required

by the software and not by the hardware.
© ABB Group
RS 232
Advantages/Disadvantages
 Advantages
• Easy to implement
• Easy to troubleshoot
• Designed for “long-range” communication
equipment
 Disadvantages
• Susceptible to noise
• Relativity short distances
• Designed for single devices
RS 485
In Contrast to RS 232, RS 485 allows
interconnection of multiple devices.
NODE NODE NODE NODE NODE NODE
 ADVANTAGES
• EASY TO IMPLEMENT
• HIGH EXPANDABILITY
• Less Susceptible to noise
 DISADVANTAGES
• HIGHER WIRING COSTS
• MORE DIFFICULT TO TOUBLESHOOT
© ABB Group
AN IBM PC HAS AN RS 232 PORT
RS 485
NODE NODE NODE NODE NODE NODE

RS 232
CONVERTER
 A Converter may be needed to transform the RS

232 Interface to an RS 485 Interface.
 Many Manufacturers of interfaces are available.
© ABB Group
RS 485
 2 Variants of RS 485
• 2 Wire (Half Duplex)
TX = TX +
TX – TX-
RX + RX +
RX – RX –
REF REF
• 4 Wire ( Full Duplex)

TX = RX +
TX – RX-
RX + TX +
RX – TX –
REF REF
© ABB Group
Terminology
 HALF DUPLEX- data can be transmitted in

both directions, but not at the same time.
 FULL DUPLEX- data can be transmitted in
both directions (TX/RX) at the same
time.
© ABB Group
RS 485 Loading
 Balanced communication
• Sensed between + and -
– A, B
– +, -
• Able to connect up to 32 Loads
– The amount of data can affect polling times
• A Terminal negative with respect to B
Terminal
– 1 or MARK
• A Terminal positive with respect to B terminal
– 0 or SPACE
© ABB Group
RS 485 Loading
 A Driver must be able to drive:

• Impedance of 60 ohms (54 ohms worst
case).
 Check Manufacturer Recommendations (
depending on cable) 1000 ft. drive
distance - 4000 ft. max.
© ABB Group
What About Grounding?
 It is recommended that a shield is

terminated at one point.
 Some relays have isolated ports, This
may require a separate GROUND
conductor interconnecting each node on
the cable.
 “RS 485 EIA Spec states: “The circuit reference
may be established by a third connector connecting the
common leads of the equipment OR it may be provided
by connections in each using equipment to an earth
reference.”
© ABB Group
Topology Diagram for RS 485 Multi-drop Architecture
+5V
Jumper J8 “IN 470 Ohms

TX/RX +
Jumper J6 “IN” 120 Ohms
TX/RX - Cable “A”
Jumper J 7 “IN” 470 Ohms
BANK SW 2
Dipswitch 1 = IN (Term Resitor IN)
Three-wire cable with
RS 232/ RS422/485
Converter
E
C
shield. Cable “B”
* See Note A.
E
C E
C E
C
Unit 1 Unit 2 Unit 30 Unit 31

End Unit Inline Unit Jumpers Inline Unit End Unit
J6, J7, J8
“OUT”
© ABB Group
Ethernet
 IEEE 802.3
 Ethernet nodes are typically connected via
copper (CAT 5 Cable).
 Ethernet nodes found in substations are usually
connected via Fiber Optics.
 Copper: 10baseT, 100baseTX
• RJ45 Connector
 Fiber: 100baseFX
• Numerous connectors styles
– Make sure you know which one you need
© ABB Group
Cable Connection
 There are two types of Copper Ethernet ports:

• MDIX :Typically what a Hub or Switch uses.
• MDI : Typically what a NIC card uses.
 A typical Ethernet Hub emulates the MDI
interface.
 This means for interconnection one must know
what type of CAT 5 Cable is required:
– Straight Through Pinout.
– Cross Pinned.
 Most modern Ethernet devices have auto sense
capability eliminating the need for cross over
cables
© ABB Group
Ethernet Copper Connectivity
Ethernet Straight Through Cable
Ethernet Hub Ethernet Hub Ethernet Straight Through Cable
Ethernet Cross Pinned

Cable *
* Unless Hub has an Uplink Switch
IED’s With Ethernet Cards Installed

IED
With Ethernet Card
Ethernet Straight
Ethernet Cross Through Cable
Pinned Cable Ethernet
Hub
PC PC With NIC Ethernet Straight

With NIC Card Card Through Cable
© ABB Group
CAT 5 Cable Pinouts
Category 5 wiring standards:
EIA/TIA 568A/568B and AT&T 258A define the wiring standards and allow for two different wiring color codes.
Crossover Cable Straight Through Cable

RJ-45 PIN RJ-45 PIN RJ-45 PIN RJ-45 PIN
1 Rx+ 3 Tx+ 1 Tx+ 1 Rc+
2 Rc- 6 Tx- 2 Tx- 2 Rc-
3 Tx+ 1 Rc+ 3 Rc+ 3 Tx+
6 Tx- 2 Rc- 6 Rc- 6 Tx-
•Pairs may be solid colors and not have the stripe.

•Category 5 cable must use Category 5 rated connectors.
Pin # EIA/TIA 568A AT&T 258A, or Ethernet Token Ring FDDI, ATM, and
EIA/TIA 568B 10BASE-T TP-PMD
1 White/Green White/Orange X X
2 Green/White Orange/White X X
3 White/Orange White/Green X X
4 Blue/White Blue/White X
5 White/Blue White/Blue X
6 Orange/White Green/White X X
7 White/Brown White/Brown X
8 Brown/White Brown/White X
3- 17-26
© ABB Group
March 13, 2013 | Courtesy
Slide 26 of Enterasys Knowledge @ http://knowledgebase.enterasys.com/esupport/esupport
General Ethernet Architecture
LAN
Local
Area
Network
HUB/SWITCH
Ethernet Application Ethernet

IP TCP
Start Header Header End Flag Local SERVER
Flag
BROWSER -> Sends User Data ----DATAGRAM The WAN

Network
Wide
Area
Network
• The Internet uses Internet Protocol – TCP/IP. The
message is layered and sent to gather request data
© ABB Group
The Layers of the OSI Model
 Layer 1 – Physical Layer

 The actual hardware
 Layer 2 – Data Link Layer
 Data Transfer Method
 Frames the data
 Assures error free transmission
 Timing
 Logical Link Control (LLC)
 Maintains the link between two computers
 Media Access Control
 Used to send data between two computers
 Hardware address
© ABB Group
The layers of the OSI Model
 Layer 3 – Network Layer
 IP network protocol. Routes messages using
the best path available
 Layer 4 – Transport Layer
 TCP, UDP. Ensures properly sequenced and
error free transmission.
 Layer 5 – Session Layer
 User interface to the Network
 Determines when the session is begun or opened,
how long it is used, and when it is closed
 Controls the data
 Supports Security
 Supports name look up
© ABB Group
The layers of the OSI Model
 Layer 6 – Presentation Layer

 Makes the type of data transparent to the
layers around it.
 Used to translate data to computer
 Layer 7 – Application Layer
 Provides services software applications need
 Email, DNP, etc.
© ABB Group
Understanding the TCP/IP Model
 There are 4 interconnected layers:

• Application (Modbus, DNP)
• Transport (TCP, UDP)
• Internet (IP address)
• Network Access (media, MAC)
© ABB Group
IP addressing
 Network Address
• Identifies the network
 Host Address
• Identifies a device inside a network
IP address: 192.168.1.5
Subnet mask: 255.255.255.0
Gateway: 192.168.1.1
© ABB Group
192.168.2.5 192.168.3.5
HUB
Message
Generated Message Regenerated to each port.
 Ethernet is in essence a Point to Point Interface.

 If 2 Devices are connected a cross-pinned cable
may be necessary for interconnection.
 If more than 2 devices are connected, a
hub/switch is required
© ABB Group
HUB
Message
Generated Message Regenerated to each port.
 Performance of Hub deteriorates on large

network because of traffic.
© ABB Group
Switch
 A Switch is a device that channels incoming

data from any of multiple input ports to the
specific output port that will take the data toward
its intended destination.
 Performs Layer 2 of the OSI layer functionality
or Network Layer of the Ethernet Model.
© ABB Group
Router
To Network 1
DNS Address
The Cloud To Network 3

DNS Address
DNS Address
To Network 2
A router is a device or, in some cases, software in

a computer, that determines the next network point
to which a datagram should be forwarded toward
its final destination.
© ABB Group
Agenda
 Communications Media
 RS 232
 RS 485
 Ethernet
 Protocols
 Proprietary
 Modbus
 DNP
 IEC61850
© ABB Group
Propriety Protocols
 1st of Protocols
• Used were for SCADA Systems
– All components were one manufacturer
– Slow Baud rates
– Only basic information available
© ABB Group
Propriety Protocols
 2nd generation of protocols

• Used for programming equipment
– Electronic equipment
• Used by the 1st integration systems
– Was available
• More information was available
– But only limited amount sent to SCADA
© ABB Group
Propriety Protocols
 Automation Schemes
• Before all automation was hardwired
• Electronic Devices able to talk to each other
– Reduced wiring
– Longer distances
• Communication systems
• Limited to one manufacturer
– Led to “universal” protocols
• Modbus
• DNP
• IEC61850
© ABB Group
Modbus
 Modbus was invented by Modicon Inc. In

1978.
• As a method to connect PLC’s to a host
(Master/Slave or Parent/Child)
• Easy to implement with two emulations:
– RTU ( Remote Terminal Unit) Emulation
– ASCII Emulation
 Modbus is available through several
Physical Interfaces
(RS232/RS485/Ethernet, etc).
© ABB Group
What Makes Modbus a Non-Utility Protocol
 It has no Time Synch imbedded in

the protocol.
 It has no concept of frozen points.
 It has no concept of select before
operate.
 The manufacturer or implementer
of the protocol must engineer
these features into the
protocol/device.
© ABB Group
Modbus Protocol
Point to Point
Address 1
Confirm
E
SCADA C
Send Address X Address 2

Master
E
The Cloud. E
C C
Protective Relay
Slave Device E
C
Address 247
 Multi-Industry Open De-facto Standard.
 Master-Slave Protocol.
 Two Emulations
– Modbus ASCII ( Master/Slave Mode) - 10 bit Asynchronous
– Modbus RTU (Master/Slave Mode) - 11 bit Synchronous
© ABB Group
Modbus Example
The Master node (Circle) contains

a polling list. The master transmits
its request to a specific node and
waits for a response. All nodes hear
the transmitted request.
1 2 3 4 5
The addressed Slave responds with the

information. If the slave data cannot
be transmitted immediately, a not ready
response is generated and the Master
must poll the Slave again with the same
2 3 4 5
request.
1
© ABB Group
Modbus Command Format
Data Sent From Master
Device Function
Addr Code 8 Bit Data Bytes Checksum
Data Received From Master
Device Function
Addr Code 8 Bit Data Bytes Checksum
( Device Address = 0 ( Broadcast), 1 - 247)

© ABB Group
Modbus Emulation
 ASCII Mode-
• Asynchronous Communication
• Hexadecimal ASCII Characters 0-9, A-F ( 30 - 39,
41,46)
• 10 bit protocol
– 1 Start Bit
– 7 Data Bits
– 1 Parity ( if enabled)
– 1 Stop Bit ( if Parity) or 2 Stop Bits ( if no Parity
enabled).
• Longitudinal Redundancy Check
© ABB Group
Modbus Emulation
 RTU Mode
• Synchronous Communication
• Data 8 Bit Binary, Hexadecimal 0 - 9, A- F
• 11 Bit Protocol
– 1 Start Bit
– 8 Data Bits, LSB sent first
– 1 Bit Parity ( if selected)
– 1 Stop Bit ( if Parity) or 2 Stop Bits ( if No Parity Selected
• CRC-16 Error Check
© ABB Group
1 XXXX Memory
+V
C
E
Physical Input 1
Permanently assigned
PLC as TRIP
100001
 PLC 1 XXXX memory is analogous to the Physical

Inputs on a protective relay.
 1 XXXX memory is a discrete bit.
 PLC’s may have XXXX = 16 to 65535 discrete inputs
per device ( 1 X memory).
© ABB Group
0 XXXX Memory
000512 1 TRIP C 1
000513 0 27-1P 0
000514 1 46 0
50P-1 0
001024 0 50N-1 0
PLC C
E
00008 Physical Output 8
 PLC 0 XXXX memory has duality:

• Internal Memory bit-wide
• Output memory
 Many protective relays have similar capability.
• Internal memory is analogous to ULO [User Logical
Inputs/Outputs]
• Output memory is analogous to the physical outputs on the
relay.
© ABB Group
3XXXX Memory
30001 65535
30002 -32123 CT
30003 100
C
E
30004 0
0- 20 mA = PLC # 0 - 4095
I an
Transducer PLC
 A relay may have physical inputs matching the

3XXXX register definition.
 3 XXXX data is defined as a word wide Physical Input
from the field mapped to memory.
© ABB Group
4XXXX Memory
400512 1 Fault Number 1
400513 98 Year 98
400514 12 Month 12
Day 11
401024 0 Hours 23
- + 10 V dc = 0 to 4095
PLC C
E
V
 PLC 4 XXXX memory has duality:

• Internal Memory word-wide
• Output memory
 Many protective relays have similar capability.
• Internal memory is analogous to metering and fault
capabilities of the relay.
• 4X Physical Output mapping is not applicable for the
protective device.
© ABB Group
6 XXXX Memory
File 0
File 1 60001 Execute Register
60001 1
60002 Password char 1
60002 98 1 File 2
60003 1298 1 File 9
1298 60004 Password char 3
69999 0 12 1
0 98
0 12 C
E
PLC 0
 6XXX memory is defined as extended memory. Some

PLC’s have this memory. It is able to be paged in to 4
XXXX memory.
 A few protective relay store configuration parameters
in this memory area for network access.
© ABB Group
Function 01 -Read Coil Status
 Reads 0X ( Coil) references from the

slave.
 All bytes are in hex ( coding is dependent
on RTU or ASCII emulation).
 Memory Start Address is offset by one.
 If amount of data is not a multiple of 8,
most significant bits are padded with 0’s.
© ABB Group
Function 01 - Read Coil Status
Slave Funct. Start Start Coils Coils Error
SOT Addr. Code Addr Addr Read Read Check EOT
01 HI LO HI LO
Byte 1 …2……..3…….4…….5……6……..7….
Modbus Host Modbus Slave Addr =1
C
E
Read from
0X Mapping
Slave Funct. Byte Data Data Error

2000 elements SOT Addr. Code Count Byte ….. Byte Check EOT
access maximum. 01 * 1 NNN
MSB LSB
8 7 6 5 4 3 2 1
© ABB Group
What Happens if ……?
 The issue with static data is:
• What happens between access reads of the IED?
– If something changes?
– If something doesn’t change?
 IF two changes occur during read the

event is lost using static data.
– Breaker Trips - Pickup Alarm (PUA) energizes and
de-energizes briefly.
© ABB Group
How is this anomaly resolved?
 Latched Bits (which can be reset via a

control write)
 Momentary Change Detect Bits ( which
change status is reset on a read of the
element).
 This is a manufacturer’s function and not
one of the protocol.
 NOT ALL MODBUS IMPLEMENTATIONS
ARE ALIKE.
© ABB Group
Function 01 - Read Coil Status
Example - Read Output 1-6, with two bit status.
Modbus Slave Addr =1
C
E
Read from
0X Mapping
Obtain Output 8 Through Output 3 Status Indication (01037 to 01048 per the memory map).
Host Sends : 01 01 04 0C 00 00 14 - - = LRC or CRC Code
Addr = 01
Function = 01
Address = 1037 ( which is 1036 in hex = 040C)
Amount of Data Requested = 12 Coils
Relay Responds: 01 01 02 A1 02 -
Addr = 01
Function = 01
Data Bytes Received = 2
Data Received = A1 02
© ABB Group
Function 02 -Read Input Status
 Reads 1X ( Input) references from the

slave.
 All bytes are in hex ( coding is dependent
on RTU or ASCII emulation).
 If amount of data is not a multiple of 8,
most significant bits are padded with 0’s.
© ABB Group
Function 02 - Read Input Status
Slave Funct. Start Start Coils Coils Error
02 HI LO HI LO
Byte 1 …2……..3…….4…….5……6……..7….
C
E
Read from
2000 bits maximum. 1X Mapping
Slave Funct. Byte Data Data Error

SOT Addr. Code Count Byte ….. Byte Check EOT
02 * 1 NNN
MSB LSB
8 7 6 5 4 3 2 1
© ABB Group
Function 02 - Read Input Status
Example - Read User Logical Input 1-6, with two bit

status.
Modbus Slave Addr =1
C
E
Read from
1X Mapping
Obtain ULI1 Through ULI 6 Status Indication (10559 per the memory map).
Host Sends : 01 02 01 2E 00 14 - - = LRC or CRC Code
Addr = 01
Function = 02
Address = 559 ( which is 558 in hex = 012E)
Amount of Data Requested = 12 Inputs
Relay Responds: 01 02 02 A1 02 -
Addr = 01
Function = 01
Data Bytes Received = 2
Data Received = A1 02
© ABB Group
Function 03 -Read Holding Registers
 Reads 4X holding registers from the slave.
 All bytes are in hex ( coding is dependent on
RTU or ASCII emulation).
 Data is returned in register format ( 16 bits/2
bytes per register).
 Maximum registers read are 125 per query.
 Registers are sent Hi byte- Lo byte per
register.
© ABB Group
Function 03 - Read Holding Registers
Slave Funct. Start Start Regs Regs Error
03 HI LO HI LO
Byte 1 …2……..3…….4…….5……6……..7….
Command
Allows for C
E
125 Registers Read from

Max. 4X Mapping
Slave Funct. Byte Data Data Data Error

SOT Addr. Code Count Byte Byte Byte Check EOT
03 * Hi Lo Lo
MSB LSB MSB LSB
Register Hi Byte 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 Register Lo

Byte
© ABB Group
DNP PROTOCOL HISTORY
 Created by Westronics (Now GE ) in 1990

 Released into Public Domain in 1993.
 Users Group created in 1993.
 DNP Technical Committee Created in
1995
• Published Subset Documentation
• Established Parameters for future protocol
conformance committee
© ABB Group
DNP 3.0
 Dependent on the Implementation DNP 3.0

Can:
• Request and Respond with Multiple Data
Messages in a single message.
• Segment messages into multiple frames.
• Respond with changed data.
• Request data based on data priority
• Support time synchronization
• Allow multiple masters and peer to peer operation
• Allow user defined objects and file transfer.
© ABB Group
DNP 3.0
 DNP 3.0 Supports the ISO OSI

(International Standard Organization Open
Systems Interconnect) Model. Layers fully
supported are:
• Physical (Layer 1)
• Data Link (Layer 2)
• Application (Layer 7)
 Pseudo-Supported and Defined Layers are:
• Transport (Layer 4)
© ABB Group
DNP - Definition of Terms
 Object Categories - Data which conforms to

different data types:
• Static : Current Value of Field or Software Point.
• Event: Historical Data.
• Frozen Static: A Field or Software Value which is
not actively updated due to a Data Freeze
Request.
• Frozen Event: Data generated as a result of a
Data Freeze Event but historically archived upon a
change.
© ABB Group
Object Types per Object Category
DATA TYPE OBJECT VARIANTS
Binary Input 1,2, |1,2 | |1,2,3|
Binary Output 10,12 |1,2 | |1,2,3|
Counter 20,21,22,23 |1 - 8| |1 – 12 | |1 – 8 |
|1–8|
Analog Input 30,31,32,33 |1 – 4| |1 – 6 | |1 – 4|
|1 – 4|
Analog Output 40,41 | 1, 2 | | 1, 2|
Time (relative or absolute) 50,51,52 | 1,2 | | 1,2 | | 1,2|
© ABB Group
Object Types Per Object Category
DATA TYPE OBJECT VARIANT
Class 60 | 1 – 4|
Files 70 |1|
Devices 80,81,82,83 |1 | | 1| | 1 | | 1, 2 |
Applications 90 |1|
Alternate Numeric 100, 101 | 1,2,3 | |1,2,3|
Future Use [ 110 – 254] -
© ABB Group
Level 1 - DNP 3.0
Master
Slave
SEND
RESPOND
Data Concentrator Meter
SCADA Host Relay
Cap Bank Controller
 Master Requests - Slave Responds Auto-Recloser
 Slave MUST Accept Requests for:
• Data Object Reads
• Binary/Analog Output Object Reads *
• Control Operations for Binary/Analog Outputs
• Cold and Internal Indication Restarts
• Delay Measurements
• Writes to Date and Time
© ABB Group
Level 1 - DNP 3.0
 Master Must Accept (with multiple object

variations)
• Binary/Analog Input and Events
• Counter and Counter Events
• Binary/Analog Output Status
 Master Device Must be able to break the
message into component pieces (parse).
© ABB Group
Level 1 - DNP 3.0
 OPTIONAL FEATURE Implementation

• Slave OPTIONALLY MAY send unsolicited
responses.
• Slave OPTIONALLY MAY NOT generate parsed
data objects if master requests such information.
• Slave OPTIONALLY MAY respond without time
object attachment.
• Slave OPTIONALLY MAY send unsolicited
responses AND the capability MUST be
configurable.
© ABB Group
Level 2 - DNP 3.0
Data Concentrator Relay
Host Device SEND Large IED or Small RTU
REQUIRED
Node A RESPOND Node B

Master Slave
RESPOND OPTIONAL SEND
 Node A Requests - Node B Responds (Standard)

Node B Requests - Node B Responds (Optional)
 Slave MUST Accepts Requests for:
• FREEZE on Binary Counter Options
• Parse of Read Requests of various objects and OPTIONALLY
MAY report Frozen Counter objects.
 Master and Slave MUST incorporate Level 1 DNP
features.
© ABB Group
Introduction to DNP
 Event Based
– Binary change of state
– multiple change detection
– SOE
– Analog % change
– Event classes
– Event buffer
© ABB Group
Introduction to DNP
 Object based
– Data specification
– Object Types
– Value
– Change
– Frozen
– Additional attributes
© ABB Group
DNP Event Data
 Each Event Index Corresponds to Present

Value Index
 New Value
 Time stamp
 Class 1, 2, 3
© ABB Group
DNP Data Retrieval Types
 Polled
– Present Values: Class 0
– Event Data: Class 1, 2, 3
 Unsolicited
– Event Data
© ABB Group
Introduction to DNP
 Modbus Data Request
Master requests
specific memory
area from slave
Slave responds with

all data in region
© ABB Group
Introduction to DNP
 DNP Polled Static
Master requests
all data of a type
of Class 0
Slave responds with

all data of type or all
Classes
© ABB Group
Polled Static
 Polling Mechanism: Static Data Report

 Considerations
– Only Class 0 Data Reported
– No Unsolicited Data Reports
© ABB Group
Introduction to DNP
 DNP Polled Report-by-Exception
Master performs
periodic Class 0 poll
Slave responds to Class
0 poll with all data
Master polls for

events
Slave reports event
data
© ABB Group
Polled Report-by-Exception
 Polling Mechanism: Static Data Report

– Frequent Event Polls
– Infrequent Integrity Polls
 Considerations
– Class 1, 2, and 3 data reported from event polls
– No Unsolicited Data Reports
© ABB Group
Introduction to DNP
Slave reports unsolicited

event data
Master performs
occasional Class 0
poll
Slave responds to Class

0 poll with all data
© ABB Group
Unsolicited Report-by-Exception
 Polling Mechanism
– IEDs send Unsolicited Data
– Occasional Class 0 Polls
 Considerations
– Unsolicited Data used for Event Data
– Static Polls for Data Synchronization
© ABB Group
Introduction to DNP
Slave reports unsolicited

event data
Master does not poll
© ABB Group
Introduction to DNP
 Optimized Communication
• Event-driven polling
– class 0
– class 1, 2, 3
• Minimum message size
© ABB Group
Introduction to DNP
 High Data Integrity

• 16-Bit CRC every 16 bytes
• Data link confirmations
• Application confirmations
© ABB Group
Introduction to DNP
 Structured Evolution
– Subset definitions
– Object definitions
– Standard documentation
– Conformance testing
– User’s group
– Technical committee
© ABB Group
DATA LINK MESSAGE
 Data Link Header Length May be from 5 to 255 Bytes Long.
START INCLUDES ALL

BYTES
05 64 LENGTH DLFC DLSB DMSB SLSB SMSB CRC HI CRC LO
SOURCE ADDR
DESTINATION ADDR.
DATA LINK FUNCT CODE.
FCB FCV
FROM PRIMARY TO SECONDARY
DIR PRM RES OFC 4 3
FUNCTION2CODE 1 FROM SECONDARY TO PRIMARY
Data Link Header Length May be from 5 to 255 Bytes Long. 5 4 3 2 1 0
© ABB Group
Data Link Header Control Field
FCB FCV HOST TO RELAY
FROM PRIMARY TO SECONDARY
DIR PRM 4 3
FUNCTION2CODE 1
RES DFC FROM SECONDARY TO PRIMARY RELAY TO HOST
7 6 5 4 3 2 1 0
DIR = DIRECTION - 1 = Master To Relay 0 = Relay to Master
Gives Direction Of the Frame with respect to the master.
PRM= Data Flow Control 1 = Frame from Initiating Station 0 = Frame from Responding Station
Gives Direction of the Frame in relation to the sending station.
FCB = Frame Count Bit Toggles with each SEND/CONFIRM COMBINATION (on same Master/ IED transaction.
Used to prevent duplication of frames and loss of frame transmission. (Sent From Host)
FCV = Frame Count Valid 1 = Frame Count Bit Valid 0 = Ignore Frame Count Bit.
Enables Function of Frame Count Bit. (Sent From Host)
RES = Reserved Bit - No Function Defined
DFC = Data Flow Control 1 = Send Causes Data Link Buffer Overflow in Relay. 0 = Primary Can Send Data.
Prevents Overflow of Data buffers in Relay ( Returned on Host Request)
FUNCTION CODE - Identifies the Type of Message. PRM = 0
PRM = 1
FC FRAME TYPE SERVICE FUNCTION FCV BIT FC FRAME TYPE SERVICE FUNCTION
0 Send Confirm Expected Reset of Remote Link 0 0 CONFIRM ACK
1 Send Confirm Expected Reset of User Process 0 1 CONFIRM NACK
2 Send Confirm Expected Test Function For Link 1 11 RESPOND Link Status (DFC)
3 Send Confirm Expected User Data 1
4 Send No Reply Expected Unconfirmed User Data 0 SECONDARY FRAMES
©
9 ABBRequest
Group Respond Expected Request Link Status 0
What Does the Data Link Layer
Do?
 DNP can allow a host and and IED (Unsolicited

Request) to act as a master.
 The Data Link Layer:
 Synchronizes data exchanges.
 Controls Message Retries.
 Connects and Disconnects Dial Up Sessions.
 Controls the Physical Layer.
 Provides message services (priority, error notification).
 Establishes and disconnects a DIAL UP Connection.
 Sets the Frame Construction in a DNP 3.0 session.
 Performs Collision Avoidance of messages ( in an
unsolicited response node).
© ABB Group
Transport Layer
 The TRANSPORT LAYER indicates the length of a

communication session.
 Why is this needed?
 Long Messages exceeding 255 bytes are segmented in
multiple messages.
 The Length of DLC data is 5 bytes
 The Length of the TL is 1 byte
 The remaining data length is 255 - 5 -1 = 249 bytes.
 In case any data frames are corrupted, a retransmission of
the corrupted frame may occur.
 Allows assembly of large messages by a host device.
© ABB Group
TRANSPORT LAYER
DATALINK TRANSPORT
HEADER HEADER
FIN FIR SEQUENCE NUMBER
7 6 5 4 3 2 1 0
FIN = Final Indication 1 = FINal Frame in sequence 0 = More Frames Follow

FIR = FIRst Frame 1 = First Frame In a Sequence 0 = Not The First Frame
0 <= Sequence Number <= 63 (Number rolls over if more frames than 63)
 Byte indication of number of frame in

transmission sequence and first/last frame.
© ABB Group
Application Header (Request)
DATALINK TRANSPORT APPLICATION

HEADER HEADER HEADER
APPLICATION APPL. Request

CONTROL Function Code
AP Sequence Number
FIRST FINAL CONF.
7 6 5 4 3 2 1 0

AP CONF. = Application Confirm 1 = Sending Node Expects Confirm 0 = No Confirm Expected.
UNSOL = Unsolicited 1 = IED Responds 0 = Not Unsolicited
SEQUENCE NUMBER 0 <= X<= 15 - Master Station Requests (Rollover at 15)
16 <= X <= 31 - Unsolicited Request Sequence Numbers
 Contains a Header and A Function Code
© ABB Group
 There are 8 Types of Function Codes:

• 1. Transfer Function Code
• 0 (00x) - Confirm.
• 1 (01x) - Read.
• 2 (02x) Write.
• 2. Control Function Code
• 3 (03x) -Select.
• 4 (04x) -Operate.
• 5 (05x) -Direct Operate.
• 6 (06x) -Direct Operate - No Acknowledge.
© ABB Group
 3. Freeze Function Code

• 7 (07x) Immediate Freeze.
• 8 (08x) Immediate Freeze - No Acknowledgement.
 4 Transfer Function Code

• 9 (09x) Freeze and Clear
• 10 (0Ax) Freeze and Clear - No Acknowledgement.
• 11 (0Bx) Freeze with Time
• 12 (0Cx) Freeze with Time - No Acknowledgement
© ABB Group
 5. Application Control Function Codes

• 13 (0Dx) Cold Restart
• 14 (0Ex) Warm Restart
• 15 (0Fx) Initialize Data to Defaults
• 16 (10x) Start Application
• 17 (11x) Stop Application
 6. Save Function Codes

• 18 (12x) = Save Configuration
• 19 (22x) = Enable Unsolicited Messages
© ABB Group
 7. Transfer Function Codes

• 21 (15x) -Disable Unsolicited Messages
• 22 (16x) - Assign Class to Data Object
 8. Time Synchronization
• 23 (17x) - Delay Measurement
© ABB Group
Application Header (Response)

APPLICATION APPL. Response Internal Indication & Notification

CONTROL Function Code First Byte Final Byte
AP 0x = Confirm
FIRST FINAL CONF.
Sequence Number 81x (129) = Response
82x (130) = Unsolicited Response
7 6 5 4 3 2 1 0

AP CONF. = Application Confirm 1 = Sending Node Expects Confirm 0 = No Confirm Expected.
UNSOL = Unsolicited 1 = Unsolicited Response from the IED
SEQUENCE NUMBER 0 <= X<= 15 - Master Station Requests (Rollover at 15)
16 <= X <= 31 - Unsolicited Request Sequence Numbers
© ABB Group
IIN Field (Response)
APPLICATION APPL. Response Internal Indication & Notification

CONTROL Function Code First Byte Final Byte
Time Class 3 Class 2 Class 1 All Busy Req. Invalid

BAD Buffer
Dev. Dev. DO in Synch. Data Data Data Sta. Data Proc Format Object
Config. Overflw
Restart Trouble Local Req. Avail. Avail Avail. Rec’d Req. Error Req.
7 6 5 4 3 2 1 0 7 6 5 4 3 2 1 0
© ABB Group
Application Layer - Object Header
DATALINK TRANSPORT APPLICATION OBJECT

HEADER HEADER HEADER HEADER
Object Group Object Variant Object Qualifier Object Range
0 to 8 bytes - depending on the

1 BYTE 1 BYTE 1 BYTE
qualifier.
 Object Header is of variable length and differs when

requesting information in a variety of formats.
© ABB Group
March 13, 2013 | Slide 100
Object Header
 An object is a type of information requested.
 There are 12 Object Types.
 Variants:
• Objects report data in differing formats.
• A variant describes the format of the Object.
• Different Objects have differing defined variants.
• For Example
– Object 1 -Binary Input (Static Data).
• Variant 1 - Static Data.
• Variant 2 - Static Data With Point status.
• Variant 0 is the manufacturers default variant.
 Qualifier:
• Data may be read or written using a variety of addressing schemes
or requesting a variety of points.
• A qualifier “defines” the return or write format of the data.
• A Qualifier is a decoded single byte.
© ABB Group
March 13, 2013 | Slide 101
Class Data Reporting
 Data May be Obtained in a variety of

methods:
• Ask for each point by Object and Variant.
• Have the IED report the data by Unsolicited
Response.
• Have the Host report the data in Classes.
– Class 0
– Class 1
– Class 2
– Class 3
© ABB Group
March 13, 2013 | Slide 102
Typical IED (Slave) DNP Settings
 Communication Settings
– Communication Ports and Baud Rates for serial
ports
– IP addresses and TCP / UDP port numbers
 DNP Address
– Master / Client
– Slave / Server (IED)
 Class for Event Data (0, 1, 2, 3)
© ABB Group
March 13, 2013 | Slide 103
 Analog Variations,16 / 32 bit

 Select / Operate Time Out
 Number of Data Link Retries
– On / Off
– Number of Retries if used and Timeout
 Min / Max Delay From DCD (0 – 1000
ms)
© ABB Group
March 13, 2013 | Slide 104
 Hardware handshaking for Serial

Connections
– RTS / CTS and DCD functions
– May not be applicable to all IEDs
 Settings for Analog Events
 Unsolicited Reporting Enable / Disabled
© ABB Group
March 13, 2013 | Slide 105
IEC61850
 A collection of specifications,
protocols, mappings and models to
address :
 Standarized way of representing data
and documenting it (Data Model)
 Basic equipment specification for
Substation Automation system
 Basic Substation Automation system
performance requirements
 Protocol to report status information
(Client-Server)
 Protocol to exchange information
between IEDs at high speeds
 Protocol to distribute analog
information for metering, protection
and control functions (Process Bus)
© ABB Group
March 13, 2013 | Slide 106
IEC61850 HISTORY
 UCA Project Origin (North American Standardization Initiative):
• Utility Communications Architecture (UCA) - enterprise-wide unified scheme to share all
operating and management information
• 1994 - EPRI member utilities called for common standard for IEDs in substations
• EPRI RP 3599 defined requirements; looked at UCA compatible technologies for
substations
• 1996 - UCA demonstration initiative by AEP and other major utilities.
– Pushed to identify Ethernet protocol to be used for all data sharing, plus high-speed control
– Solicited IED vendor and user participation
– Specified replacing control wiring with LAN
 IEC 61850 Origin (first an EU Standardization Initiative):

• 1980s - Large European manufacturers were selling expensive LAN-based substation
control systems (SCS)
• Each design unique, and user committed to one vendor’s equipment
• Later - IEC developed Standard 870-5 (now 60870-5)
• 1995 - IEC TC 57 began 61850 Standard to define next generation of LAN-based
substation control
© ABB Group
March 13, 2013 | Slide 107
IEC 61850 based SA systems
Basics:
 Fast Ethernet (100 MBps to 1 GBps)
 MMS
 Station Bus 61850 8-1
 Process Bus 61850 9-2
 Data Model
 Substation Configuration Language
Much more than a protocol:

 Modularization and structuring of data
Copyright © 2004-2005 ABB Inc. All rights reserved.
 On-line meaningful information
 Free allocation of functions in IEDs
 Complete description of configuration
 Structured engineering & services
 Testing, validation, and certification
© ABB Group“Combining the best properties in a new way...”

March 13, 2013 | Slide 108
1-1-108
IEC 61850 Uses
Control Center
MMS
DA Substation
GOOSE
GOOSE The Standard Today
Gateway
Substation
GOOSE
Hydro/Wind
© ABB Group
March 13, 2013 | Slide 109
IEC 61850 - What the Standard Provides
 Interoperability
• Exchange information between IED’s
(Intelligent Electronic Device) from several
manufacturers
• IEDs use this information for their own
function
 Long Term Viability
• Future proof
• Follow progress in mainstream
communication technology
• Follow evolving system requirements needed
by customers
© ABB Group
March 13, 2013 | Slide 110
INTEGRATION - Where does IEC 61850 help?
 It is about AVOIDING …
• Media and protocol converters when using multiple protocols
• Understanding each device’s unique memory/point/register map
• Programming the data concentrator to accept that information
– Data types
– Reporting structure
 Connecting the information to the application
• Point 1 from Device 1 = 52A
© ABB Group
March 13, 2013 | Slide 111
Substation Modeling - The Substation
Structure
Orlando Substation
Orlando Substation
Line 1 Line 2
D1 D2 230kV Voltage Level
CB1 Bay D1 Bay
230kV CB2
IED D1.1 IED
CB3
IED D.1.2
T1 Line 3 Bay D2
115kV CB10 115 kV
CB11 CB12 CB13 Line X..Y
© ABB Group Line X Line Y Line Z

March 13, 2013 | Slide 112
1-1-112
Substation Modeling
The Substation Structure
Substation Structure IED Data Model
Substation MyIED IED
Logical Device
230kV Voltage Level LD0
(container)
CSWI1 Logical Node (s)

Bay D1 Bay
XCBR1
IED D1.1 IED
PDIS1
IED D.1.2
PTOC1
Bay D2
© ABB Group
March 13, 2013 | Slide 113
1-1-113

Theory Overview

Încărcat de

Informații document

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Theory Overview

Încărcat de

Drepturi de autor:

Formate disponibile

Jim Bougie

Hands on Relay School

 Found in many formats, mainly 9 / 25

 RS 232 is a point to point connection network.

RADIO FREQUENCY MODEMS

 Modem Speeds are from:

 A Baud is a bit representation.

 Connector Style is not specified.

RTS - Space= Transmit mode Mark = Receive Mode

NOTE: both RTS/CTS and DTR/DSR are rarely used

 There are times to connect DTE - DTE or DCE-

 There are times when handshaking is required

NODE NODE NODE NODE NODE NODE

NODE NODE NODE NODE NODE NODE

 A Converter may be needed to transform the RS

• 4 Wire ( Full Duplex)

 HALF DUPLEX- data can be transmitted in

 A Driver must be able to drive:

 It is recommended that a shield is

Jumper J8 “IN 470 Ohms

Jumper J 7 “IN” 470 Ohms

Unit 1 Unit 2 Unit 30 Unit 31

 There are two types of Copper Ethernet ports:

Ethernet Hub Ethernet Hub Ethernet Straight Through Cable

Ethernet Cross Pinned

* Unless Hub has an Uplink Switch

IED’s With Ethernet Cards Installed

PC PC With NIC Ethernet Straight

Crossover Cable Straight Through Cable

1 Rx+ 3 Tx+ 1 Tx+ 1 Rc+

2 Rc- 6 Tx- 2 Tx- 2 Rc-

3 Tx+ 1 Rc+ 3 Rc+ 3 Tx+

6 Tx- 2 Rc- 6 Rc- 6 Tx-

•Pairs may be solid colors and not have the stripe.

Ethernet Application Ethernet

BROWSER -> Sends User Data ----DATAGRAM The WAN

 Layer 1 – Physical Layer

 Layer 6 – Presentation Layer

 There are 4 interconnected layers:

 Ethernet is in essence a Point to Point Interface.

 Performance of Hub deteriorates on large

 A Switch is a device that channels incoming

The Cloud To Network 3

A router is a device or, in some cases, software in

 2nd generation of protocols

 Modbus was invented by Modicon Inc. In

 It has no Time Synch imbedded in

Send Address X Address 2

The Master node (Circle) contains

The addressed Slave responds with the

Data Sent From Master

Data Received From Master

( Device Address = 0 ( Broadcast), 1 - 247)

 PLC 1 XXXX memory is analogous to the Physical

 PLC 0 XXXX memory has duality:

 A relay may have physical inputs matching the

 PLC 4 XXXX memory has duality:

 6XXX memory is defined as extended memory. Some

 Reads 0X ( Coil) references from the

Slave Funct. Byte Data Data Error

 The issue with static data is:

• What happens between access reads of the IED?

 IF two changes occur during read the

 Latched Bits (which can be reset via a