Home

You cannot Flash but only read this

1. OBJECT REQUEST RESPONSE slave must parse master must parse Func Qual Func Qual Obj Var Description Codes Codes Codes Codes dec hex dec hex 32 0 Analog Change Event All Variations 1 06 07 08 32 1 32 Bit Analog Change Event without Time 1 06 07 08 129 130 17 28 32 2 16 Bit Analog Change Event without Time 1 06 07 08 129 130 17 28 32 3 32 Bit Analog Change Event with Time 32 4 16 Bit Analog Change Event with Time 33 0 Frozen Analog Event All Variations 33 1 32 Bit Frozen Analog Event without Time 33 2 16 Bit Frozen Analog Event without Time 33 3 32 Bit Frozen Analog Event with Time 33 4 16 Bit Frozen Analog Event with Time 40 0 Analog Output Status All Variations 1 00 01 06 40 1 32 Bit Analog Output Status 1 00 01 06 129 130 00 01 40 2 16 Bit Analog Output Status 1 00 01 06 129 130 00 01 41 1 32 Bit Analog Output Block 3 4 5 6 17 28 129 echo of request 41 2 16 Bit Analog Output Block 3 4 5 6 17 28 129 echo of request 50 0 Time and Date All Variations 50 1 Time and Date 2 07 where see 4 14 quantity 1 1 07 where 129 07 where quantity 1 quantity 1 50 2 Time and Date with Interval Schneider Electric NT00160 EN 06 T200 Flair 200C R200 DNP3 OBJECT REQUEST RESPONSE
2. OBJECT REQUEST RESPONSE slave must parse master must parse Func Qual Func Qual Obj Var Description Codes Codes Codes Codes dec hex dec hex 23 0 Frozen Counter Events All Variations 1 06 07 08 23 1 32 Bit Frozen Counter Event without Time 1 06 07 08 129 130 17 28 23 2 16 Bit Frozen Counter Event without Time 1 06 07 08 129 130 17 28 23 3 32 Bit Frozen Delta Counter Event without Time 1 06 07 08 129 130 17 28 23 4 16 Bit Frozen Delta Counter Event without Time 1 06 07 08 129 130 17 28 23 5 32 Bit Frozen Counter Event with Time 23 6 16 Bit Frozen Counter Event with Time 23 7 32 Bit Frozen Delta Counter Event with Time 23 8 16 Bit Frozen Delta Counter Event with Time 30 0 Analog Input All Variations 1 22 00 01 06 30 1 32 Bit Analog Input 1 00 01 06 129 130 00 01 30 2 16 Bit Analog Input 1 00 01 06 129 130 00 01 30 3 32 Bit Analog Input without flag 1 00 01 06 129 130 00 01 30 4 16 Bit Analog Input without flag 1 00 01 06 129 130 00 01 31 0 Frozen Analog Input All Variations 31 1 32 Bit Frozen Analog Input 31 2 16 Bit Frozen Analog Input 31 3 32 Bit Frozen Analog Input with Time of Freeze 31 4 16 Bit Frozen Analog Input with Time of Freeze 31 5 32 Bit Frozen Analog Input without Flag 31 6 16 Bit Frozen Analog Input without Flag NT00160 EN 06 Schneider 47 Electric T200 Flair 200C R200 DNP3 48
3. 8 1 Legend Type Internal Meaning No TCD T l commande double double telecontrol TSS T l signalisation simple single telesignal TSD T l signalisation double double telesignal TM T l mesure remote measurement CT Counter Access Defined as VISU Viewing EXPL Operator ADMIN Administrator Options Required commercial option I I IU IUP I2UP TR U IU IUP I2UP TR P IUP I2UP TR 2U 12UP TR Object Meaning In this column appears the type of static object used in transmission Index Meaning NA Not Accessible by SCADA no index has been configured For the SCADA to be able to access the Object simply configure an index which is not already used NT00160 EN 06 Schneider 55 T200 Flair 200C R200 DNP3 8 2 T200 P Type Index Index me EE No Switch position ISD visu Binaryimput 32 20 Swithlocked ISS 49 VISU BinayInput 68 44 Switch command TCD 1 EXPL Control Relay 4 04 Output Block Operation counter VISU EN Analog Input Operation counter preset command TCD 25 ADMIN Control Relay NA NA Output Block Auxiaybi isss VISU Binaryimput NA NA MV voltage present 5873 vsu Bmayimput NA NA Earn fan SSA VISU Binary Input 6i 3D Phase faut T5877 VISU Bmeyinut 60 3C pecs me pe ee e Input Phase current 2 TM3 VISU NE a Input EN ee RE Input EN LER Input NEN G
4. TSS615 visu Binary Input 125 7D Phasefaut TSS62 visu Binary Input_ 124 7C Input hannel 10 Switch position TSD82 visu Binary input 41 29 Switch locked rss ISU JBinayInput 133 85 A PT aes EEN Output Block MV voltage present auxiliary D TSS Visu Binary Input 143 8F Earth fault SS VISU Binary Input 127 7F hase fault visu Binary Input 126 7E Phase current TM 173 VISU A Input Ulm O oo ITI 0p nm Switch position 1SD83 VISU Bnayinpu 42 2A Switch locked TSS ISU Binaryimput 134 86 a NL al Output Block MV voltage present auxiliary DI ISS Visu Bimaryimput 144 90 Earth faut SS ISU Binaryimput 129 81 Phasefaut ISS ISU Binaryimput 128 80 Input hannel 12 Switch position TSDa4 VISU JBinaylnpu 43 2B Switch locked ISS ISU Binary input 135 87 pum o em Je ema N Output Block MV voltage present auxiliary DI ISS visu Bimaryimput 145 91 Earthfault dess VISU Binaryimput 131 83 Phasefaut SS ISU JBina nput 130 82 Input NT00160 EN 06 Schneider 61 T200 Flair 200C R200 DNP3 Type Index Index mere meses No Channel 13 Switch position 11 TSD1a1 visu Binary
5. NT00160 EN 06 Schneider 67 T200 Flair 200C R200 DNP3 Type Index Index ET EE No Switch position J TSDa VISU Binary Input 33 21 Switchlocked ISS 81 VISU BinayInput 69 45 Output Block Input ele mox pump IESER Output Block AuxiliaryDI TSS83 VISU Binary Input NA NA MV voltage present TSS105 visu Binary Input 79 4F Aux MV voltage present TSS86 VISU Binaryimput NA NA Eathfaut ISS OB visu Binaryimput 62 SE Phasefaut TSS109 visu Binary Input 63 3F e AT AA SUE RE Input Phase current 2 TM 10 VISU ma du Input NN ee p Input ee E 1T ii ASE Input Input Local Remote position TSS23 visu Binaryimput 82 52 Door opening rss24 VISU Binaryimput 78 de Output Block Immediate AC power supply defect TSS 17 visu Binary Input_ 83 53 Time delayed AC power supply defect TSS 18 visu Binary Input Power cutimminent TSS25 VISU Binaryimput NA NA ISNTP synchronised frst VISU Binary Input 68 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 Type Index Index EI epe No Automatic controls Automatic control ON OFF position TSD9 visu Binaryinput 35 23 Automatic control ON OFF command TCD 9 EXPL Control Relay 7 07 Output Block Automatic control has op
6. l2 max 1 PaM O l3max 1 1 PaM O Phase currenti ViPato D Phase current ViPato D Phasecurrenti8 VIPM10 D Phase oak demandeur im MO o D D D D n a n a gt en w n a V16 V16 868 0364h 9 0365h V16 0366h V16 871 0367h V16 872 0368h V16 73 0369h V16 874 036Ah V16 75 036Bh V16 876 036Ch V16 77 036Dh V16 7 036Eh 79 036Fh 8 0370h 88 0371h 00 00 CO Co NOD 00 o Co 00 Co o SPS SPS SPS SPS SPS SPS _INC32_ _INC32_ TINGS INCG2 INCS2 MVi6 MVi6 MVi6 MEN Nga lt FAERIE o o c O O S D El o NT00160 EN 06 Schneider 73 T200 Flair 200C R200 DNP3 Cubicle 1 data Real power total PM800 A MV16 0372h Reactive power to PM800 A MVi6 0373h Apparent power total PM800 A MV16 0374h rue power factor total PM800 A MV16 0375h 8 6 4 Cubicle xxx data Same principles apply for further cubicles with same default variables and default external address From the tables of previous paragraph just add an offset for default external address as follows 74 Objecttype Index Decimal Index dec depending on cubicle Offset per number cubicle Base Dec Offset Cub_Nb 1 DPC 16 Base 16 Cub_Nb 1 DPS 16 Base 16 Cub_Nb 1 SPC 16 Base 16 Cub_Nb 1 SPS 32 Base 32 Cub_Nb 1 INC32 120 Base
7. 65 Switch command TCD 42 EXPL Control Relay Output Block MV voltage present auxiliary DI TSS 358 visu Binary Input Eathfaut T88375 visu Binary Input 95 5F hase fault SS381 VISU BinaryInput 94 SE Phase current VISU 16 Bit Analog Input Ulm D MIO m AR Switch position TS AB VISU BinaryInput_ 38 26 Switchlocked TSS385 visu Binaryimput 102 66 ee s s To mer Output Block MV voltage present auxiliary D 1198390 VISU Binary mpat 172 70 Eann iaut ISS 07 VISU Binaryimput 97 TSS413 VISU Binary Input 96 Input hannel 8 61 id MEE Mm Hai 62 0A 70 61 C6 27 6 71 63 62 7 Switch position TSD44 VISU Binayinpu 39 Switch locked TSS417 VISU pum o eem lee lisa Output Block MV voltage present auxiliary DI TSS 422 visu JBinaryInput 113 Earthfault TSS439 visu Binary Input 99 Phase fault ISS 5 VISU JBinay nput 98 Input 60 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 Type Index Index EI ess No hannel 9 Switch position TSD8 VISU Binary Input 40 28 Switch locked TSS593 visu Binaryimput 132 84 GR I eee Output Block MV voltage present auxiliary DI TSS 598 visu BinaryImput 142 BE Eathfaut
8. Transport FIN 1 FIR 1 Seq 30 App FIR 1 FIN 1 CON 0 Seg 25 Fc 130 05 64 1A 53 02 00 01 0051 CB DE D9 82 00 00 20 04 28 01 00 CO 00 01 00 00 82 9C 3E 39 25 D7 12010197 09 23 41 208 a Reset of Remote Link 05 64 05 40 02 00 01 00 EA 38 09 23 41 234 Confirm ACK Il 05 64 05 80 01 00 02 00 CE D3 38 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 General comment The DNP3 protocol in transmission by managing in particular a complete transport layer makes it possible to provide for numerous transmission possibilities Unfortunately the disadvantage of this for medium sized systems such as the T200 is that a large number of octets must be transmitted for a small quantity of information This problem is even greater when operating in the mode without Unsolicited Response when using the 3 dynamic classes and the link confirmations However this is not very troublesome when using high transmission speeds As an example below are shown several traces corresponding to transmission of the same information namely transmission of a change of operating mode local remote in different modes It will thus be possible to compare the corresponding data interchange volumes e Mode without Unsolicited Response use of the 3 dynamic classes and link confirmations 09 39 15 322 CC 2 5RIU 1 User Data Transport FIN 1 FIR 1 Seq 2 App FIR 1 FIN 1 CON 0 Seq 10 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Clas
9. configured value Consequently The T200 will use this field to answer a request e nit UDP Port Port used for first unsolicited message if no UDP datagram has yet been received e Local UDP Port Listen UDP Port e UDP Mode Configured value The T200 sends a reply by using the dest UDP port Source value The T200 sends a reply by using the datagram port contained in the request No UDP The UDP protocol is not used e Timeout Keep alive link fault detection delay It is used in TCP to end a session with a client if no data is exchanged 16 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 4 3 Specific configurations related to transmission media The DNP3 protocol defines the format of transmitted frames This format is FT3 itself defined in IEC Standard 60870 5 1 Here in summarized form are the main specifications of these frames e Each frame begins with a start character coded on 2 octets e The frames are formed of blocks containing at most 16 user data octets supplemented by a check sequence coded on 16 bits e There are fixed length frames and variable length frames The length of each frame is checked relative to the fixed length fixed length frame or the transmitted length variable length frame These specifications make it possible to work in asynchronous or synchronous serial transmission In the case of the T200 only asynchronous transmission is managed This does not prevent oper
10. slave must parse master must parse Func Qual Func Qual Obj Var Description Codes Codes Codes Codes dec hex dec hex 51 0 Time and Date CTO All Variations 51 1 Time and Date CTO 129 130 07 where quantity 1 51 2 Unsynchronized Time and Date CTO 129 130 07 where quantity 1 52 0 Time Delay All Variations 52 1 Time Delay Coarse 129 07 where quantity 1 52 2 Time Delay Fine 129 07 where quantity 1 60 0 Not Defined 60 1 Class 0 Data 1 06 60 2 Class 1 Data 1 06 07 08 20 21 22 06 60 3 Class 2 Data 1 06 07 08 20 21 22 06 60 4 Class 3 Data 1 06 07 08 20 21 22 06 70 1 File Identifier 80 1 Internal Indications 1 00 01 2 00 index 7 81 1 Storage Object 82 1 Device Profile 83 1 Private Registration Object 83 2 Private Registration Object Descriptor 90 1 Application Identifier 100 1 Short Floating Point 100 2 Long Floating Point 100 3 Extended Floating Point NT00160 EN 06 Schneider 49 Electric T200 Flair 200C R200 DNP3 50 OBJECT REQUEST RESPONSE slave must parse master must parse Func Qual Func Qual Obj Var Description Codes Codes Codes Codes dec hex dec hex 101 1 Small Packed Binary Coded Decimal 101 2 Medium Packed Binary Coded Decimal 101 3 Large Packed Binary Coded Decimal No object 13 No object 23 see 4 14 Schneider P Electric NT00160 EN 06 T200 Flair 200C
11. Binaryimput NA MA Dijtainput7 87 VISU Bayinu NA NA Dijtainut8 3 3 3 TSS8 VISU 1Binaryinput NA NA Digital output position TSD5 VISU Bimayinpu NA NA Digital output 1 command TCD 5 EXPL Control Relay NA NA Output Block Digital output 2 position TSD 6 VISU Binary Input Digital output 2 command TCD 6 EXPL Control Relay NA NA Output Block Digital output 3 position TSD 7 VISU Binary Input Digital output 3 command TCD7 EXPL Control Relay NA NA Output Block DIO AR AAR 58 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 8 3 T2001 Type Index Index EI EE No hannel 1 Switch position ISDi vsu Binaryinpu 32 20 Switchlocked TSS49 VISU JBinaylnpu 68 44 GEN Pert PS kaa o Output Block MV voltage present auxiliary DI TSS54 VISU Binarylnpt 78 4E Eathfaut o ssa VISU Binaryimput 61 3D Phasefaut TSS77 VISU Binary input 60 sc Input hannel 2 Switch position Jrspa ViSU Binayinpu_ 33 2i Switch locked 1 TSS81 visu Binary input 69 45 GR a lon kamay A Output Block MV voltage present auxiliary DI TS 86 visu Binarylnput 79 4F Eathfaut T98108 visu Binary Input 63 3F hase fault TSS 109 visu Biainput 62 3E Phase current VISU EN Lu
12. Control Relay Output Block Qual 17x Qty 1 05 64 18 D3 01 00 02 00 78 36 D3 C5 04 0C 01 17 0104 4101 0100 00 00 00 00 CC 0D 00 00 00 FF FF 16 40 46 487 RIU 1 CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 0 46 529 RTU 1 CC 2 User Data Transport FIN 1 FIR 1 Seq 49 App FIR 1 FIN 1 CON 0 Seq 5 Fc 129 05 64 1A 73 02 00 01 00 OC D3 F1 C5 8100 00 OC 01 17 0104 4101 01 00 00 00 B5 54 00 00 00 00 00 FF FF 16 40 46 582 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Then comes polling to wait for the change of switch position 16 40 47 167 CC 2 gt RTU 1 User Data Transport FIN 1 FIR 1 Seq 20 App FIR 1 FIN 1 CON 0 Seq 6 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 F3 01 00 02 00 1E 01 D4 C6 01 3C 02 06 3C 03 06 3C 04 06 88 FE 16 40 47 196 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 16 40 47 238 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 50 App FIR 1 FIN 1 CON 0 Seq 6 Fc 129 05 64 0A 53 02 00 01 00 90 B3 F2 C6 81 00 00 DD 08 16 40 47 271 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE DI Finally in response to a polling the T200 sends the change of state CC 2 gt RIU 1 User Data Transport FN 1 FIR 1 Seq 21 App FIR 1 FIN 1 CON 0 Seq 7 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11D3 0100 02 00 43 19 D5 C7 013C 02 06 3C 03 06 3C 04 06 E1 04 16 40 48 394 RTU 1
13. NT00160 EN 06 Schneider 15 T200 Flair 200C R200 DNP3 4 2 DNP 3 IP configuration We saw on chapter 3 6 that DNP3 protocol can also be used over Ethernet Consequently there are some new parameters related to the TCP IP layer that must be set Beforehand the DNP3 IP must be activated Operating mode menu Communication parameters on TCPAP ports Link Mormal v AAA After that a new list of parameters appears on the protocol page DHP3 IP Parameters Configuration SCADA IP address fo 0 0 0 TCP Port 20000 Connection Mode Server Outgoing TCP Port 20000 Port3 Dest UDP Port f20000 Init UDP Port f20000 Local UDP Port 20000 UDP Mode Contigured value y Timeout eo s e SCADA IP address Specifies which supervisors can initiate a connection with the equipment IP filtering 0 0 0 0 All SCADA addresses are allowed No filtering 255 255 255 255 No SCADA address allowed Global filtering xXX yyy www zzz Single SCADA IP address allowed Protocol DHP3 over TCPAP e CP Port Server TCP port number Listen Application It is used when the T200 is waiting for a connection request e Connection Mode TCP server only UDP only Dual end Point Used if the T200 must be able to initiate the connection to a supervisor e Outgoing TCP Port It can be only used in Dual end Point mode when the T200 initiates the connection e Dest UDP Port UDP port used for emission It is only used if UDP mode is
14. the DCD signal carrier detection and the squelch signal When the squelch signal is available it should be preferred to the DCD signal This is because carrier detection can be caused by noise on the line whereas the squelch is generally more secure and gives more reliable information In the second option when collision avoidance is activated an additional window appears in the Protocol Parameters screen Standard parameters Priority y Min random delay o ms Max random delay 500 ms Port 2 Squelch Protect ves Squelch active level Low y Tsqu Squelch protect fi 0000 ms 1st attempt fi s y 2nd attempt fi mn y Before describing the various parameters used we shall explain how collision avoidance operates We shall consider two types of frame acknowledgement frames other frames When a T200 receives a frame from the Supervisor and this must be acknowledged by it the acknowledgement frame is sent immediately For the other frames the T200 will allow for a waiting time before sending This time is calculated by the following formula time priority x min random time random time The random time ranges between the min random time and the max random time NT00160 EN 06 Schneider 13 T200 Flair 200C R200 DNP3 Priority This parameter can be used to hierarchize various T200s The smaller the number the more priority is assigned to the T200 it will wait for a shorter time Usually th
15. the Supervisor after repatriating all the events perform reading of the class 0 objects to obtain the real state of the T200 Given the large number of objects that the T200 is capable of storing there is little chance of this situation occurring except through an avalanche of phenomena or a lasting loss of the link between the Supervisor and the T200 transmission problem or extended SCADA fault e Request understood but already being executed octet 2 bit 4 Marking of this bit occurs when the T200 receives a request that has already been made to it and for which it is in the process of performing an action e Corrupt configuration octet 2 bit 5 This bit is not managed by the T200 Bits 6 and 7 of octet 2 are always set to O by the T200 they are reserved for possible concerted use by the Supervisor and remote terminal unit manufacturers 26 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 5 2 Tracing interchange with the Supervisor In order to clarify the operation of the protocol we shall give here a few specific examples of interchange viewed by means of the Trace provided by the T200 Comment The following screens were obtained by sending frames step by step so as to show the operation in detail from a simulator the time tags are therefore not significant Energizing the T200 In mode without Unsolicited Hesponse As soon as the SCADA system tries to establish communication with the T200 it sends a
16. 00 78 36 C1 C5 04 OC 01 17 01 04 41 01 01 00 00 00 00 00 89 36 00 00 00 FF FF 08 16 45 601 RTU 1 gt CC Confirm ACK 05 64 05 00 02 00 01 00 50 08 08 16 45 643 RTU 1 gt CC User Data Transport FIN 1 FIR 1 Seq 8 App FIR 1 FIN 1 CON 0 Seq 5 Fc 129 05 64 1A 73 02 00 01 00 OC D3 C8 C5 81 00 00 OC 01 17 0104 41 01 01 00 00 00 35 42 00 00 00 00 00 FF FF 08 16 45 695 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 08 16 47 433 User Data Transport FIN 1 FIR 1 Seq 9 App FIR 1 FIN 1 CON 0 Seq 19 Fc 130 05 64 20 53 02 00 01 00 79 FE C9 D3 82 00 00 0A 02 28 01 00 04 00 81 02 02 28 78 41 010020 00 81 88 94 E8 DG 12 01 A9 10 08 16 47 513 CC 2 gt RTU Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Cyclic measurement transmission In mode without Unsolicited Hesponse The SCADA performs its polling normally on the T200 From time to time the T200 records the measurements declared as cyclic and delivers them to the Control Centre in reply to one of its polling operations 08 47 01 792 CC 2 gt RIU 1 UserData Transport HN 1 FIR 1 Seq 10 App FIR 1 FIN 1 CON 0 Seq 13 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 D3 01 00 02 00 43 19 CA CD 01 3C 02 06 3C 03 06 3C 04 06 C194 08 47 01 822 RIU 1 CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 08 47 01 865 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 13 App FIR 1 FIN 1 CON 0 Seq 13 Fc 129 05 64 1A 53 02 00 01 00 51 CB CD CD
17. 09 57 10 815 User Data Transport HN 1 FIR 1 Seq 10 App FIR 1 FIN 1 CON 0 Seq 6 Fc 129 05 64 0A 53 02 00 01 00 90 B3 CA C6 81 00 00 5B EF 09 57 10 848 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 09 57 13 113 Unconfirmed User Data Transport FIN 1 FIR 1 Seq 4 App FIR 1 FIN 1 CON 0 Seq Class 1 Data Qual 06x 05 64 0B C4 01 00 02 00 69 YE C4 C7 01 3C 02 06 28 44 09 57 13 142 User Data Transport FIN 1 FIR 1 Seq 11 App FIR 1 FIN 1 CON 0 Seq 7 Fc 129 05 64 18 73 02 00 01 00 BB F5 CB C7 81 00 00 02 02 28 01 00 52 00 01 BF 85 44 4C 7B D7 120175 4E 09 57 13 197 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 09 57 15 442 Unconfirmed User Data Transport FIN 1 FIR 1 Seq 5 App FIR 1 FIN 1 CON 0 Seq 8 Fc 1 Class 1 Data Qual 06x 05 64 0B C4 01 00 02 00 69 YE C5 C8 01 3C 02 06 94 4D 09 57 15 471 User Data Transport FIN 1 FIR 1 Seq 12 App FIR 1 FIN 1 CON 0 Seq 8 Fc 129 05 64 0A 53 02 00 01 00 90 B3 CC CB 81 00 00 E2 C4 09 57 15 504 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 The above sequence is again an assembly of several screens consisting of 2 polling operations for which the T200 has no object to transmit followed by 1 polling operation with the change in response and a further polling operation without objectto be transmitted by the T200 It can be observed that the volume of octets exchanged is far smaller Unsolicited Response mode a single dynamic class and link confirmations in the T200 to SCADA direc
18. 1 FIN 1 CON 0 Seg 19 Fc 130 05 64 1A 53 02 00 01 00 51 CB D8 D3 82 00 00 20 04 28 01 00 CO 00 01 00 00 18 54 22 BD 1F D7 12 01 FB E3 09 17 10 762 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 24 App FIR 1 FIN 1 CON 0 Seq 19 Fc 130 05 64 1A 53 02 00 01 00 51 CB D8 D3 82 00 00 20 04 280100C000010000 18 54 22 BD 1F D7 12 01 FB E3 09 17 10 814 CC 2 gt RTU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 NT00160 EN 06 Schneider 37 Electric T200 Flair 200C R200 DNP3 If the disturbance lasts longer the T200 repeats the frame complying with the link timeout interval link timeout here set to 10 s and the maximum number of repetitions here set at 3 i e 4 send operations in all Still having no acknowledgement it tries to resynchronize with the SCADA system by sending Heset of remote link requests 09 23 00 650 User Data Transport FIN 1 FIR 1 Seq 30 App FIR 1 FIN 1 CON 0 Seq 25 Fc 130 05 64 1A 53 02 00 01 00 51 CB DE D9 82 00 00 20 04 28 01 00 CO 00 01 00 00 82 9C 3E 3925 D7 12010197 User Data Transport FIN 1 FIR 1 Seq 30 App FIR 1 FIN 1 CON 0 Seq 25 Fc 130 05 64 1A 53 02 00 01 00 51 CB DE D9 82 00 00 20 04 28 01 00 CO 00 01 00 00 82 9C 3E 39 25 D7 12010197 09 23 20 929 User Data Transport FIN 1 FIR 1 Seq 30 App FIR 1 FIN 1 CON 0 Seg 25 Fc 130 05 64 1A 53 02 00 01 00 51 CB DE D9 82 00 00 20 04 28 01 00 CO 00 01 00 00 82 9C 3E 39 25 D7 12010197 09 23 31 068 User Data
19. 120 Cub_Nb 1 Energies 40 Base 40 Cub_Nb 1 MV16 60 Base 60 Cub Nb 1 MV32 120 Base 120 Cub Nb 1 Where Base is the default decimal index of corresponding object in Cubicle1 Schneider NT00160 EN 06 Schneider Electric Industries SAS Schneider Electric Telecontrol 839 chemin des Batterses Z I Ouest 01700 St Maurice de Beynost Tel 33 0 4 78 55 13 13 Fax 433 0 4 78 55 50 00 http www schneider electric com E mail telecontrol schneider electric com NT00160 EN 06 01 2014 En raison de l volution des normes et du mat riel les caract ristiques indiqu es par les textes et les images de ce document ne nous engagent qu apr s confirmation par nos services As standards specifications and designs change from time to time please ask for confirmation of the information given in this publication Debido a la evoluci n de las normas y del material las caracter sticas y dimensiones indicadasen el texto y las im genes nos comprometen solamente previa confirmaci n de nuestros servicios Publication production and printing Schneider Electric Telecontrol Made in France Europe
20. 81 00 00 20 04 28 01 00 CO 00 0183 24 75 83 AB 47 04 D7 12 01 F6 4B 08 47 01 917 CC 2 gt RTU 1 ConfirmACK 05 64 05 80 01 00 02 00 CE D3 In our case the measurement of Index 192 00C0 in hexadecimal has been placed in class 2 the polling delay is set at 1 s and the period between two successive storage in memory operations is set at 1 mn Since the preceding transmission took place at 8 h 47 mn 1 s the following one takes place at 8 h 48 mn 1 s 08 48 01 479 CC 2 gt RTU User Data Transport HN 1 FIR 1 Seq 58 App FIR 1 FIN 1 CON 0 Seq 13 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 D3 01 00 02 00 43 19 FA CD 01 3C 02 06 3C 03 06 3C 04 06 D7 BE 08 48 01 508 RTU 1 gt CC Confirm ACK 05 64 05 00 02 00 01 00 50 08 08 48 01 550 RTU 1 gt CC User Data Transport FIN 1 FIR 1 Seq 61 App FIR 1 FIN 1 CON 0 Seq 13 Fc 129 05 64 1A 53 02 00 01 00 51 CB FD CD 81 00 00 20 04 28 01 00 CO 00 01 2D 17 8F D8 4A 2F05 D7 12 01 B0 F4 08 48 01 603 CC 2 gt RTU Confirm ACK 05 64 05 80 01 00 02 00 CE DI Comment Although the measurements are cyclic they cannot be time stamped using the measurement reception time because it depends on the time of the class 2 user data request and not on the time at which they were stored in memory The difference between the two may increase with the time difference between 2 SCADA polling operations 36 Schneider NT00160 EN 06 T200 Flair 200
21. Earth faut TSS983 visu Binaryimput 163 A3 Phasefaut TSS989 visu Binaryimput 162 A2 Input ommon objects ocal Remote position TSS 23 VISU TCD 17 5817 SS 18 SS 25 82 i Output Block Output Block Output Block Output Block 52 15 3 3 3 5 5 5 5 H O O al l Q 5 3 3 5 Q gt 3 S H O O eo NI NA NA NA 53 mmediate AC power supply defect ime delayed AC power supply defect ower cut imminent Binary Input Binary Input Binary Input Iisa mle me ng ac O 9 m O w ci cioc i c DEN ol ol a ol o ol a e e al o o o ol ol ol o ol ol ol o 2 2 al al al G eo eo eo eo ol o o e e ec e ol ol al o ol ol sl 6 3 3 3 3 gt o pl D E al al a ol ol ol o SI 2 Dl mo D 9 2 2 2 kao D D D D o o o o ol o w gaa O O co NI z o S 62 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 ed aa ad epe Internal Dec Hex No Automatic controls Es a ER ETE channels 1 to 4 channels 1 to 4 Output Block EG A N Mid EEN GN 99 2 channels 5 to 8 es Eer oe oe Bel channels 5 to 8 Output Block KG NN Li N Mid EEN eve St channels 9 to 12 Automatic control ON OFF command TCD 89 EM CAESAR Output Block Automatic control ON OFF position TSD 129 AEN RE 37 channels 13 to 16 Output Block Automatic control ON OFF command channels 13 to 16 nternal faults Motorization power supp
22. GANG GR Ge Ge ee ee ee Ge Re sans 27 6 GIOSS AE RO EE 41 Interoperability DOcumenls 2 o tote EA Easier aa En Eier oa 45 TA Implementation Table irr p AL EE EE OE ibaan 45 7 2 Device Profile Document roii RR ER EE N EE NE N 51 13 Control GER RA AE EE N RE iere 54 8 Object addressing EE aia 55 MEE RE EE E DBA BANAAG EE E E E 55 8 2 T200 Porro ei lla EER NS E E EE EE ER ss 56 831200 AA 59 AE LIME MA HERE ENE ER RE EE ete 64 LM EE MAN e AE ET RE ET OE ER EE 67 8 6 BU EA EE EA EE AS LI N MERE EE EA ON AN 70 8 6 1 RTU REM EP 70 8 6 2 eo KA AA 71 8 6 3 C bicle c stig M T2 8 6 4 C ubicle oes MA EE EE KAR HE EE ER OE IE T4 2 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 1 Introduction This appendix to the User Manual is designed to provide aid with setting up a telecontrol network using the DNP3 protocol It will therefore provide information to help choose an operating mode to make the corresponding configuration settings and to analyse any problems faced For this purpose the following will be found e References of documents relating to this protocol e Operating principles with a brief description of the specification and fundamentals of the protocol a description of the various operating modes with help in choosing between them a list of the types of data exchanged a description of the main functionalities a description of the D
23. Heset of remote link request So long as the T200 does not respond the Supervisor repeats this request Upon receiving the positive confirmation Ack sent by the T200 the phase of communication initialization in the Supervisor to T200 direction is completed The T200 initializes the link in the SCADA to T200 direction same message sequence but in the opposite direction MODEM Interface inititiatisation start MODEM Interface initialised MODEM Link available RTU 1 5CC 2 Reset of Remote Link 05 64 05 40 02 00 01 00 EA 38 aa 2 RIU 1 Corfirm ACK 05 64 05 80 01 00 02 00 CE DI CC 2 gt RIU 1 Reset of Remote Link 05 64 05 CO 01 00 02 00 74 E3 RIU 1 tC 2 Confirm ACK 05 64 05 00 02 00 01 DO 50 08 Maintenance Page Port 2 Comment The frame sequence can be different depending on the end speaking first and the time lag between sending of the 2 Reset of remote link requests With reference to the above case the following cases can also be found CC s RTU Reset of Remote Link RTU s CC Confirm ACK RTU s CC Reset of Remote Link CC RTU Confirm ACK Or RTU s CC Reset of Remote Link CC RTU Reset of Remote Link CC RTU Confirm ACK RTU CC Confirm ACK Or CC RTU Reset of Remote Link RTU s CC Reset of Remote Link RTU CC Confirm ACK CC RTU Confirm ACK Depending on the response time of the 2 ends one can also for the latter two cases have the 2 positive confirmations in reverse
24. Input hannel 3 U ITI O oo m j Switch position TSb3 visu BinaryInput 34 22 Switchlocked TSS113 visu Binary Input 70 46 a a NG Output Block MV voltage present auxiliary D TSS 118 visu BinaryInput 80 50 Eathfaut frssiss visu BinaryInput 65 41 Phase fault TSS141 VISU BinaryInput 64 40 iO A al Ma Input hannel 4 witch position TSD4 VISU witch locked TSS 145 VISU Switch command TCD4 EXPL MV voltage present auxiliary DI TSS 150 VISU arth fault TSS 167 VISU hase fault TSS 173 VISU TM 24 VISU HA Output Block Binary Input 67 43 Binary input 66 42 9 16 Bit Analog 195 C3 Input 07 AR 0 ol ol m oro 2 Dv o D Q S 3 NT00160 EN 06 Schneider 59 T200 Flair 200C R200 DNP3 Type Index Index ET EE No Channel 5 Switch position T1SD41 VISU Binaryimput 36 24 Switch locked TSS321 visu Binary input 100 64 Switch command TCD 41 EXPL Control Relay Output Block MV voltage present auxiliary DI Tss326 visu Binary Input Eathfaut T88343 visu Binary Input 93 5D Phasefaut TSS 349 visu inainpt 92 5C Input hannel 6 Switch position TSD42 VISU inaryInput 37 25 Switchlocked TSS353 visu Binary Input 101
25. LSB nergy apparent MSB A nergy apparent MSB A hase current I1 hase current I2 SPS n a SPS 8061 1F7Dh SPS 8062 1F7Eh SPS 8063 1F7Fh SPS 8064 1F80h SPS n a n a INC3 n a n INC3 n a n INC3 n a n a INC3 n a n INC3 n a n a INC3 n a n a INC3 n a n a INC3 n a INC3 n a INC3 10840 INC3 10842 INC3 10844 INC3 10846 INC32 10848 INC32 10850 860 n w 5 2 w 2 a 2A58h 2A5Ah 2A5Ch 2A5Eh 2A60h 2A62h 035Ch MV16 861 035Dh MV16 62 035Eh MV16 863 035Fh MV16 n a V16 n a n a n 864 0360h 865 0361h 866 0362h 867 0363h n a n a N m N m Co N hase current 13 T max max hase current I1 hase current I2 hase current I3 Measured Earth Fault Current l0 VIP410 Phase peak demand current Im1 mean current Phase peak demand current Im2 mean current Phase peak demand current Im3 mean current hase current 11 hase current I2 hase current I3 oltage U12 oltage U23 Voltage U31 Mean voltage between phases oltage V1 PM800 Voltage V2 Voltage V3 oltage NR ean voltage phase N requency 2 ma w 2 i w seb V16 V16 LO WE el D Hie D ME Low D D ED D D bb D p D D D ME Energy apparentMSB_________ PM800 A Phase currenti Flar3DbM D Phase currentl2 Flar23DM D Phase currenti8 Flarz3DM D Residual current o FiarsDM D max 0 ETA O
26. Layer Protocol Description and Data Object Library The Users Group also makes available to its members the document DNP3 Subset Definitions which allows integrators of the telecontrol network to e check that the equipments are capable of providing the desired information e make sure that they are capable of communicating with one another Their references are as follows e Basic 4 Application Layer 26 June 1997 Basic 4 Data Link 26 June 1997 Basic 4 Data Object Library 10 July 1997 Basic 4 Transport Function 26 June 1997 Subset Definitions 20 December 1997 Other documents can be consulted or used e IEC 60870 5 1 1990 Telecontrol equipment and systems Part 5 Transmission protocols Section 1 Transmission frame formats e IEC 60870 5 3 1992 Telecontrol equipment and systems Part 5 Transmission protocols Section 3 General structure of application data IEC 60870 5 3 1992 e IEC 60870 5 4 1993 Telecontrol equipment and systems Part 5 Transmission protocols Section 4 Definition and coding of application information elements e Errata 15 December 1999 e DNP Primer Rev A 21 March 2005 LAN WAN version 1 8 February 1999 DNP3Spec V1 Introduction 20070203 3 February 2007 DNP3Spec V2 ApplicationLayer 20070203 3 February 2007 DNP3Spec V2 Sup1 SecureAuthentication 20070203 3 February 2007 DNP3Spec V3 TransportFunction 20070203 3 February 2007 DNP3Spec V4 DataLinkLayer 20070203 3 February 2
27. The Supervisor can send a message to all the remote terminal units for time setting for example This type of message is called a G obal Request It contains as Destination Address the address 65535 This address is called the broadcast address To avoid all the remote terminal units responding at the same time the Supervisor uses the Send No reply expected function When a T200 sends its next information frame it will set in the nternal Indications the All stations message received bit to indicate that the message has been received correctly l Index In DNP3 the address defining an object in transmission is called the ndex It is configured in the External address section at the same time as the dynamic class of the object in the form address class This address can be represented on 1 or 2 octets 8 or 16 bits this being selected in the Object Address section Internal Indications IIN In data interchange between the T200 and the Supervisor the T200 gives an indication of its general state in 2 octets called nternal Indications There it indicates among other things that it has received a broadcast message that it has class 1 2 or 3 data to be transmitted that it has just restarted that the time is no longer set etc O On line Bit of the Status octet for a Binary Input with Status used by the T200 to indicate a complementarity fault when it handles a double signal This bit is set to 0 in the case of non com
28. Then it sends the time setting message Write Time and Date 11 19 10 178 CC 2 gt RTU 1 User Data Transport HN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 9 Fc 2 Time and Date Qual 07x Qty 1 05 64 12 D3 01 00 02 00 13 8A CO C9 02 32 01 07 01 98 3B 69 D2 12 01 A8 68 19 11 213 RTU 1 gt CC 2 ConfirmACK 05 64 05 00 02 00 01 00 50 08 11 19 11 255 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 11 App FIR 1 FIN 1 CON 0 Seq 9 Fc 129 IIN1 Device Restart 05 64 0A 73 02 00 01 00 CD AB CB CS 81 80 00 37 F4 11 19 11 290 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE DI Comment After time setting the Time synchronisation required from the master bit is no longer marked in the corresponding N octet sent by the T200 The Control Centre will now request all the T200 states so as to have a real image of the T200 To do so it sends a request for class 0 objects 11 21 33 591 CC 2 gt RTU 1 User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 10 Fc 1 Class 0 Data Qual 06x 05 64 0B F3 01 00 02 00 B4 C5 CO CA 01 3C 01 06 BA 43 11 21 33 623 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 11 21 33 665 RTU 1 5CC 2 User Data Transport AN 1 FIR 1 Seq 12 App FIR 1 FIN 1 CON 0 Seq 10 Fc 129 IIN1 Device Restart 05 64 7C 53 02 00 01 00 77 FF CC CA 8180 00 0101 0120 00 20 00 010101 0152 B6 23 00 23 00 00 01 01 013C 00 3D 00 00 01 01 01 DE EE 44 00 45 00 00 01 01
29. a Input Neutral current TM 12 VISU EM Input Input U21 voltage measurement TM 56 VISU EN aa Input V1 voltage measurement TM 59 VISU EN 2 Input Input Input Reactive power TM 63 VISU EB ii Input Apparent power TM 64 VISU EE ii Input Input Active energy CT 6 A A Oro o o o Oo D 2 2 Q o Time delayed AC power supply defect TSS 18 VISU Power cut imminet T8825 VISU Binary Input NT00160 EN 06 Schneider 57 T200 Flair 200C R200 DNP3 Type Index Index EI EE No Automatic controls Automatic control ON OFF position TSD9 visu Binaryinput 35 23 Automatic control ON OFF command TCD9 EXPL Control Relay 7 07 Output Block Automatic control has operated TSS 57 visu Binaryimput 89 59 nternal faults Motorization power supply failure TSS 19 VISU Binaryinpu 87 57 Accessoryequipmentpowersupplyfalure TSS20 VISU Binary Input NA NA Chargerfaut TSS21 VISU Binaryimput 85 55 Battery fault SS22 VISU Binaryimput 86 56 Digital Inputs Outputs Digital inputi TSS1 Vvisu JBinaylnpu 76 4C Dijtaliput2 3 82 VISU J Bmayinu 77 4D _ Digitalinput3 TSS3 VISU Binayinput 78 4E Digitalinput4 TSS4 ISU BinaryInpt_ NA NA Dijtainut5 3 1885 VISU 1Binaryinput NA NA Dijtainut 3 3 3 T8S6 visy
30. a specific destination port e Default ports used for DNP3 IP The T200 support TCP and UDP communications on port number 20000 All connection requests and all UDP data are sent to this common port number Port numbers can be changed for particular reasons 8 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 4 Configuration 4 1 General configuration of the protocol A configuration screen contains all the parameters directly related to the Protocol Schneider Monitoring Contral Settings Protocol Parameters DNP3 EASERGY Maintenance Port2 SCADA address D Device address Ei Maximum data link re tries B Link time out fon m ms use Requires data link confirm ves v Delay before first emission D ws Sends unsolicited responses no Classi Class2 Class3 J Unsolicited wait delay 1000 ms Objects Index 16 v pits Port Maximum application re tries E j Application time out 50000 m ms Requires application confirm no x Handle requested object unknown bit ves Select Timeout Es Clock validity Be s Use of double bit binary input ves 7 Parameters Setup Page Protocol DNP3 parameters e SCADA address This identifies the SCADA system On the network it allows the T200 to designate in Send mode as Destination Address or recognize in Receive mode as Source Address the SCADA system It can take any value between 0 and 65534 Device address This identifies the T200 On the network it allow
31. order NT00160 EN 06 Schneider 27 T200 Flair 200C R200 DNP3 At this stage the Control Centre doesn t know that the T200 has just started It knows only that after losing the connection with the T200 it has just been restored The SCADA system therefore asks the T200 whether the latter has dynamic data changes to transmit to it by making a request for objects of classes 1 2 and 3 CC 2 gt RIU 1 User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 1Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 F3 01 00 02 00 1E 01 CO C1 013C 02 06 3C 03 06 3C 04 06 10 26 09 07 05 732 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 09 07 05 774 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 1 Fc 129 IINT Time Required Device Restart 05 64 0A 73 02 00 01 00 CD AB CO C18190 00 73 EE 09 07 05 813 CC 2 73 RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE DI In the two JIN Internal Indications octets that the T200 returns it indicates by means of the Device restart and Time synchronisation required from the master bits that it has just started and that it needs time setting Comments Above the T200 has no class 1 2 or 3 object to transmit The SCADA system and the T200 are configured here to send messages with request for confirmation If the objects are all configured in class 1 the SCADA system may make on
32. phase fault CNT10 VISU gt fp Bit Analog EENE Input Counter phase fault CNT11 16 Bit Analog Input OO 0 U TM Mm NA 64 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 Measure channel 2 Current P1 TM71 VISU 16 Bit Analog 51 33 Input Current P2 TM76 VISU 16 Bit Analog 52 34 Input Current P3 TM81 VISU 16 Bit Analog Input lo Current TM86 VISU 16 Bit Analog Input Mean phase current TM91 VISU NEN 7 Input Power factor TM97 VISU 16 Bit Analog Input Input Input Apparent power TM106 VISU MEE e EA Input Active energy CNT102 VISU INR uu Ed Input Reactive energy CNT104 VISU EN MN Input Fault channel 2 Fast earth fault 155103 Binary Input Earth fault TSS104 Binary Input Fast phase fault TSS108 Binary Input Phase fault TSS109 Binary Input Counter fast earth fault CNT12 16 Bit Analog Input Counter earth fault CNT13 16 Bit Analog Input Counter fast phase fault CNT15 16 Bit Analog Input Counter phase fault CNT16 16 Bit Analog Input emperature measurement esile essa Internal temperature TM10 VISU 16 Bit Analog Input External temperature estimated TM11 VISU 16 Bit Analog Input Digital inputs Sosa 37 3A 53 54 56 57 59 61 35 36 38 39 3B D 3 Mad a es ae VISU jBinaryInput 10 TSSE visu Binay input TSS3 visu JgBinaryInput 12 EE TSS5 VISU Digital input 6 TSS6 VISU EE E EM
33. send a reset command for the Device restart bit 11 00 13 176 CC 2 gt RTU User Data Transport FIN 1 FIR 1 Seg 0 App FIR 1 FIN 1 CON 0 Seq 6 Fc 2 Internal Indications Qual 00x Start 7 Stop 7 Value 00x 05 64 OE F3 01 00 02 00 3D 3D CO C6 02 50 01 00 07 07 00 40 3D 11 00 13 205 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 11 00 13 247 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 5 App FIR 1 FIN 1 CON 0 Seq 6 Fc 129 05 64 0A 53 02 00 01 00 90 B3 C5 C6 81 00 00 00 53 11 00 13 288 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Comment The latter command can be sent by the Supervisor at any time In particular it could have been sent as soon as this bit was seen by the SCADA system This depends merely on the way in which the Supervisor processes this information Then the Supervisor periodically requests of the T200 the objects of class 1 2 or 3 possibly limited to the classes in which objects have been placed 11 05 38 929 CC 2 gt RIU 1 UserData Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 7 Fe 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11D3 01 00 02 00 43 19 CO C7 01 3C 02 06 3C 03 06 3C 04 06 34 51 11 05 38 958 RIU 1 gt CC 2 ConfirmACK 05 64 05 00 02 00 01 00 50 08 11 05 39 001 RTU 1 CC 2 User Data Transport HN 1 FIR 1 Seg 6 App FIR 1 FIN 1 CON 0 Seq 7 Fc 129 05 64 DA 73 02 00 01 00 CD AB C6 C
34. used by the Supervisor to perform date and time setting for the remote terminal units When the transmission time is constant the Supervisor can proceed in 2 steps a first step to acquire the transmission delay and a second to perform synchronization the T200 in that case correcting the transmission delay If the transmission time is not constant the Supervisor will perform only the second step Client Serveur Architecture Process used to exchange DNP3 messages over an IP network using TCP protocol In our case the T200 is associated to the server the supervisor to the client D Data Object Every information item transmitted is called an object An object can be static state of an item or dynamic change of an item For example the T200 will use the Binary Input with Status object to transmit the state of a double signal and the Binary Input Change with Time object to transmit a change in the same signal Static objects belong to class 0 dynamic objects to one of the classes 1 2 and 3 Delay Measurement To perform time synchronization the Supervisor when the transmission time is constant can send a Delay Measurement message which will make it possible to measure this time and thus perform synchronization via the Write Time and Date message by correcting the transmission delay NT00160 EN 06 Schneider 41 T200 Flair 200C R200 DNP3 Destination Address Exchanges between the T200 and the SCADA system contain a S
35. 007 DNP3Spec V5 Layerlndependent 20070203 3 February 2007 DNP3Spec V6 Part1 ObjectLibraryBasics 20070203 3 February 2007 DNP3Spec V6 Part2 Objects 20070203 3 February 2007 DNP3Spec V6 Part3 ParsingCodes 20070224 24 February 2007 DNP3Spec V7 IPNetworking 20070203 3 February 2007 DNP3Spec V8 Interoperability 20070220 20 February 2007 DNP3Spec V8 Apdx1 DeviceProfile 20070220 20 February 2007 TC 2006 12 20 Main topics were security proposal and removal of PCB from subset 3 4 January 2007 e TB2007 001 UTC Requirement Notice 3 January 2007 e Template for creation of device profile documents using MS Word from V8 Apdx1 dated 20070220 24 February 2007 e MS Word Template for Application Notes DOT 6 February 2007 e ZIP file containing XML schema XSLT to convert XML to HTML document and sample XML instance files 20 February 2007 4 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 3 Principles 3 1 General The development of DNP3 represented a major effort to allow interoperability open and based on standards between supervisors except for inter supervisor links remote terminal units RTUs and intelligent electronic devices IEDs in the electric power area This has enabled the protocol to be also extensively used in water transport the oil industry and the gas industry DNP3 is built on the basic standards resulting from the work of Technical Committee TC57 of the IEC dealing with Power Systems and as
36. 01 4C 00 4E 00 00 01 01 01 6D 31 52 00 53 00 00 0101 01 55 00 58 00 00 OA 02 01 AA 01 04 00 04 00 81 0A 02 01 07 00 07 00 010A 02 01 65 BI 15 00 15 00 00 1E 02 01 CO 00 CO 00 00 00 00 1E 60 BE 0101 C1 00 C1 00 00 00 00 00 80 14 0101 46 00 74 AG 46 00 01 9F 01 00 00 51 18 11 21 33 834 CC 2 gt RIU 1 ConfirmACK 05 64 05 80 01 00 02 00 CE DI The T200 returns all the static objects for which a transmission address has been configured The Supervisor now has a correct representation of the T200 It can send a reset command for the Device restart bit 11 25 41 822 CC 2 gt RTU User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 11 Fe 2 Internal Indications Qual 00x Start 7 Stop 7 Value 00x 05 64 DE D3 01 00 02 00 60 25 CO CB 02 50 01 00 07 07 00 8A C3 11 25 41 852 RTU 1 gt CC Confirm ACK 05 64 05 00 02 00 01 00 50 08 11 25 41 895 RTU 1 gt CC User Data Transport FIN 1 FIR 1 Seq 13 App FIR 1 FIN 1 CON 0 Seq 11 Fc 129 05 64 0A 73 02 00 01 00 CD AB CD CB 8100 00 A5 ED 11 25 41 929 CC 2 gt RIU Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Comment The latter command can be sent by the Supervisor at any time In particular it could have been sent as soon as this bit was seen by the SCADA system This depends merely on the way in which the Supervisor processes this information From here on there are no longer any exchanges between the SCADA system and the T200 Only a change at the T200 end or
37. 05 64 11 D3 01 00 02 00 43 19 D4 CF 01 3C 02 06 3C 03 06 3C 04 06 76 5C 16 09 26 422 RTU 1 gt CC 2 ConfirmACK 05 64 05 00 02 00 01 00 50 08 16 09 26 465 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 59 App FIR 1 FIN 1 CON 0 Seq 15 Fc 129 05 64 20 73 02 00 01 00 24 EG FB CF 81 00 00 0A 02 28 01 00 04 00 81 02 02 28 53 65 01 00 20 00 812DF1 72 D3 12 01 AD F5 16 09 26 526 CC 2 gt RIU 1 ConfirmACK 05 64 05 80 01 00 02 00 CE DI NT00160 EN 06 Schneider 33 E Electric T200 Flair 200C R200 DNP3 Select then Operate mode The Supervisor sends the selection of the device it wants to control The T200 acknowledges by an application 16 40 46 300 CC 2 gt RTU 1 User Data Transport FIN 1 FIR 1 Seq 18 App FIR 1 FIN 1 CON 0 Seq 4 Fc 3 Control Relay Output Block Qual 17x Qty 1 05 64 18 F3 01 00 02 00 25 2E D2 C4 03 0C 01 17 0104 41010100 00 00 00 00 88 96 00 00 00 FF FF 16 40 46 329 RIU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 16 40 46 371 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 48 App FIR 1 FIN 1 CON 0 Seq 4 Fc 129 05 64 1A 53 02 00 01 00 51 CB FO C4 81 00 00 OC 01 17 01 044101 01 00 00 00 21 77 00 00 00 00 00 FF FF 16 40 46 423 CC 2 gt RTU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Then it sends execution itself acknowledged by an application 16 40 46 458 CC 2 gt RTU 1 User Data Transport FIN 1 FIR 1 Seq 19 App FIR 1 FIN 1 CON 0 Seq 5 Fc 4
38. 5 64 05 80 01 00 02 00 CE HI 11 12 42 921 Reset of Remote Link 05 64 05 CO 01 00 02 00 74 E3 11 12 42 950 Confirm ACK 05 64 05 00 02 00 01 00 50 08 Maintenance Page Port 2 Comment The frame sequence can be different depending on the end speaking first and the time lag between sending of the 2 Reset of remote link requests In particular it is possible to have among other things the Heset of remote link sent by the SCADA system and the Positive confirmation of the T200 first Being now informed of restarting of the T200 the Supervisor will perform time synchronization For systems in which the message transmission delay is constant it is possible to correct synchronization of the transmission delay The Supervisor then sends a Delay measurement message which makes it possible to measure the time required for transmission 11 16 15 076 CC 2 gt RTU 1 User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 8 Fc 23 05 64 08 F3 01 00 02 00 E4 56 C0 C8 17 56 C8 11 16 15 105 RTU 1 gt CC 2 ConfirmACK 05 64 05 00 02 00 01 00 50 08 11 16 15 148 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 10 App FIR 1 FIN 1 CON 0 Seq 8 Fc 129 IINT Time Required Device Restart 05 64 10 53 02 00 01 00 3A 77 CA C8 8190 00 34 02 07 01 AF 00 2B SE 11 16 15 187 CC 2 gt RTU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 30 Sc SIT ider NT00160 EN 06 ectric n E GO T200 Flair 200C R200 DNP3
39. 7 81 00 00 E2 F4 11 05 39 041 CC 2 gt RIU 1 ConfirmACK 05 64 05 80 01 00 02 00 CE DI NT00160 EN 06 Schneider 29 T200 Flair 200C R200 DNP3 In mode without Unsolicited Response As soon as the SCADA system tries to establish communication with the T200 it sends a Reset of remote link request So long as the T200 does not respond the Supervisor repeats this request Upon receiving the positive confirmation Ack sent by the T200 the phase of communication initialization in the Supervisor to T200 direction is completed The T200 for its part tries to initialize the link in the SCADA to T200 direction same message sequence but in the opposite direction As soon as this direction is initialized the T200 sends the two IIN Internal Indications octets in which it indicates by means of the Device restart and Time synchronisation required from the master bits that it has just started and that it needs time setting 41 11 55 802 MODEM Interface inititialisation start 11 11 55 802 MODEM Interface initialised 11 11 55 807 MODEM Link available 11 41 55 836 RIU 1 gt CC 2 Reset of Remote Link 05 64 05 40 02 00 0100 EA 38 11 11 55 867 tC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE DI 1101156907 RTU 1 CC 2 UserData Transport FIN 1 HR 1 Seq 9 App FIR 1 FIN 1 CON 0 Seg 16 Fc 130 IIN1 Time Required Device Restart 05 64 0A 73 02 00 01 00 CD AB C9 DO 82 90 00 3B D7 11 11 56 940 tC 2 7 RTU Confirm ACK 0
40. 8V 8025 1F59h General Shutdown 8026 1F5Ah NT00160 EN 06 Schneider 71 T200 Flair 200C R200 DNP3 8 6 3 Cubicle 1 data pte ee eT Dec Hex Switchgear position 1 scito O DPC 7232 1C40h Protection setting group VIP410 O DPC 7236 1C44h Switchgear position 1 SC110 D DPS 9312 2460h Earth switch position SCi10 D DPS 9314 2462h Active setting group VIP410 D DPS 9318 2466h Current Maximeters Flai23DM O SPC ma n a Fault passage indication Flar23DM O SPC 6416 1910h Trip indication viP410 O SPC 6417 t9tfh Phase peak demand values VIP410 O SPC ma n a Switchgear control failure SC110 O SPS wa wa Trip indication SCH0 D SPS 8048 1F70h Ready for remote command scito SPS ma ma Local Remote switch state SC110 D SPS wa na Phasefaut Flai23DM D SPS 8049 1F71h Earhfaut Flrz3DM D SPS 8050 1F72h Transient phase fault Flai23DM D SPS na n a Transient earth fault Flai23DM D SPS ma na Fault by test action Flai23DM D SPS 8051 1F73h Phase or earth fault Flair23DM D SPS na na MV voltage presence Flai23DM D X SPS 8052 1F74h Residual voltage presence Flai23DM D SPS 8056 1F78h MV voltage a
41. 9 130 00 01 2 0 Binary Input Change All Variations 1 06 07 08 2 1 Binary Input Change without Time 1 06 07 08 129 130 17 28 2 2 Binary Input Change with Time 1 06 07 08 129 130 17 28 2 3 Binary Input Change with Relative Time 1 06 07 08 129 130 17 28 10 0 Binary Output All Variations 1 00 01 06 10 1 Binary Output 10 2 Binary Output Status 1 00 01 06 129 130 00 01 12 0 Control Block All Variations 12 1 Control Relay Output Block 3 4 5 6 17 28 129 ila 12 2 Pattern Control Block 5 6 17 28 129 Elke 12 3 Pattern Mask 5 6 00 01 129 naa 20 0 Binary Counter All Variations 1 7 8 00 01 06 9 10 22 20 1 32 Bit Binary Counter 1 00 01 06 129 130 00 01 20 2 16 Bit Binary Counter 1 00 01 06 129 130 00 01 20 3 32 Bit Delta Counter 1 00 01 06 129 130 00 01 20 4 16 Bit Delta Counter 1 00 01 06 129 130 00 01 20 5 32 Bit Binary Counter without Flag 1 00 01 06 129 130 00 01 20 6 16 Bit Binary Counter without Flag 1 00 01 06 129 130 00 01 20 7 32 Bit Delta Counter without Flag 1 00 01 06 129 130 00 01 20 8 16 Bit Delta Counter without Flag 1 00 01 06 129 130 00 01 NT00160 EN 06 Schneider 45 Electric T200 Flair 200C R200 DNP3 46 OBJECT REQUEST RESPONSE slave must parse master must parse Func Qual Func Qual Obj Var Description Codes Codes Code
42. AY Active 1 Triggers On active Alarm level Alarm es M Log M Event M Alarm scada sms v Delayed alarm C Yes No DNP Class 24 Scbneider E Electr ic No Inactive 0 On inactive M Log M Event M Alarm fio Hours Minutes Seconds NT00160 EN 06 T200 Flair 200C R200 DNP3 5 Diagnostic This chapter provides information which may be necessary when operating problems are encountered They may help with problem resolution in such cases 5 1 Processing protocol related information This section provides information on the way in which the T200 handles certain specific aspects relating to the DNP3 protocol Representation of double signals In DNP3 there are only Binary Inputs to transmit a signal The state of a Binary Input is given on a state bit State These binary inputs can be accompanied by additional information grouped together in a Status For double signals the T200 uses the State bit of the binary input to represent the closed position of the double signal and the On line bit in O state to indicate a complementarity fault The following table gives a summary of representations of a double signal Status Switch position bit7 bit 6 bit5 bit4 bit bit2 bit1 bitO State On line Complementarity fault 2 0 0 inputs at 0 Open 0 1 Closed 1 1 Complementarity fault 2 1 1 input
43. App FIR 1 FIN 1 CON 0 Seg 13 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 F3 01 00 02 00 1E 01 C5 CD 01 3C 02 06 3C 03 06 3C 04 06 A8 40 09 39 22 382 Confirm ACK 05 64 05 00 02 00 01 00 50 08 09 39 22 424 User Data Transport FIN 1 FIR 1 Seq 49 App FIR 1 FIN 1 CON 0 Seq 13 Fc 129 05 64 0A 73 02 00 01 00 CD AB F1 CD 8100 00 B9 92 09 39 22 458 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 The above sequence is an assembly of several screens consisting of 2 polling operations for which the T200 has no object to transmit followed by 1 polling operation with the change in response and a further polling operation without object to be transmitted by the T200 NT00160 EN 06 Schneider 39 Electric T200 Flair 200C R200 DNP3 Mode without Unsolicited Response a single dynamic class and link confirmations in the T200 to SCADA direction only Unconfirmed User Data Transport FIN 1 FIR 1 Seq 2 App FIR 1 FIN 1 CON 0 Seg 5 Fc 1 Class 1 Data Qual 06x 05 64 0B C4 01 00 02 00 69 9E C2 C5 01 3C 02 06 FD 69 09 57 08 487 User Data Transport FIN 1 FIR 1 Seg 9 App FIR 1 FIN 1 CON 0 Seq 5 Fc 129 05 64 0A 73 02 00 01 00 CD AB C9 C5 81 00 00 1080 09 57 08 520 Confirm ACK 05 64 05 30 01 00 02 00 CE D3 09 57 10 785 Unconfirmed User Data Transport FIN 1 FIR 1 Seq 3 App FIR 1 FIN 1 CON 0 Seq 6 Fc 1 Class 1 Data Qual 06x 05 64 OB C4 01 00 02 00 69 SE C3 C6 01 3C 02 06 10 BS
44. C R200 DNP3 In mode with Unsolicited Response The cyclic measurements are stored in memory and then sent to the SCADA regularly by the T200 without intervention by the Supervisor 09 02 00 239 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 5 App FIR 1 FIN 1 CON 0 Seq 18 Fc 130 05 64 1A 73 02 00 01 00 OC D3 C5 D2 82 00 00 20 04 28 01 00 CO 00 01 68 17 0E 84 D2 00 12 D7 1201FB21 09 02 00 292 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 09 03 00 746 RTU 1 gt CC 2 UserData Transport FIN 1 FIR 1 Seq 6 App FIR 1 FIN 1 CON 0 Seq 19 Fc 130 05 64 1A 53 02 00 01 00 51 CB C6 D3 82 00 00 20 04 28 01 00 CO 00 01 33 2E 17 F1 44 EC 12 D7 12 0139 B1 09 03 00 799 CC 2 gt RIU 1 ConfirmACK 05 64 05 80 01 00 02 00 CE D3 Note that there is no exchange between the 2 measurements sent by the T200 This is characteristic of the Unsolicited Response mode e Frame repetition In Unsolicited Hesponse mode We give here 2 examples showing the mechanism of frame repetition by the T200 when a transmission problem occurs The first case corresponds to a temporary transmission problem the second to a problem lasting a longer time Below the T200 has not seen the acknowledgement due to a transmission disturbance As a consequence the T200 repeats the frame after expiry of the waiting time the link timeout interval is set to 10 s 09 17 00 623 RTU 1 5CC 2 User Data Transport FN 1 FIR 1 Seq 24 App FIR
45. EN AE Input NA el eee NG input ins NN A i a input Phase current 3 TM 4 VISU Neutral current TM 5 VISU Average current TM 6 VISU input input Input Ea OLIE Input Input rc ee Input iii em o 1 Output Block O per ERR E Input A e pump aY Output Block Active power TM 53 VISU Reactive power TM 54 VISU Apparent power TM 55 VISU 56 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 Type Index Index ET EE No Switch position TSDa VISU Binary Input 33 21 Switchlocked ISS 81 VISU BinayInput_ 69 45 Input pere energy pressi command add JAMN N a Qn Output Block pee em a us ir A Input eie eemper ADMIN babawe NN Output Block ommon objects ocal Remote position T5523 ViSU Bimaryimput 82 82 Fault detection reset command TCD 17 EXPL Control Relay 21 15 Output Block ES mmediate AC power supply defect TSS 17 VISU BinaryInut 83 5 ESA Switch command TCD2 EXPL NE Relay 5 05 Output Block Operation counter CT2 VISU EM iu Input Operation counter preset command TCD 26 ADMIN Control Relay NA NA Output Block Auxiliary DI TSS 83 VISU Binary Input MV voltage present TSS105 visu Binary Input Earth fault TSS 103 visu Binary Input Phase fault TSS 109 visu Binary Input Phase current 1 TM 9 VISU EE d Input Phase current 2 TM 10 VISU LI zz Input Phase current 3 TM 11 VISU MUN
46. However this bit is not managed by some SCADA systems and worse for some of them its presence causes malfunctioning of the Supervisor To prevent this problem one can configure here inhibition of marking of this bit by the T200 when necessary e Select timeout This is the maximum time authorized between receiving a command selection and receiving its execution After that time the command is rejected This time is applicable only in the Select then Operate mode It can be set to between 1 and 60 s e Clock validity Like any clock the T200 s clock deviates over time Depending on the deviation he considers acceptable the user will configure the time after which he determines that the deviation is too great to consider the time tag valid The T200 declares the clock invalid after power up or when the set time has elapsed since the last clock synchronization command received This time can be as much as 24 h By setting O the T200 considers the time as infinite i e the clock will not be declared invalid The clock deviation is 5 ppm at 25 C i e about 40 0 ms per day less than 15 s per month If the user wants a deviation of less than 100 ms he will have to set the time on the T200 approximately every 6 h He need then merely program 22 000 ms leaving a little margin for the clock to be declared invalid if the T200 has not received a time setting within a period of slightly more than 6 h 6 h 6 min 40 s Special case of the GPS o
47. IC C nary Input nary Input nary Input D NT00160 EN 06 Schneider 65 T200 Flair 200C R200 DNP3 Digital inputs counters LL Geek NN E ER Eed cl WE i IE siii sa NG RR wmm kn ad HE Eurer m aa BEN Counter digital input 6 aid ER ona RR RR npu pe mi EET Output Block er e el l Output Block sm ee TE Output Block Digital output 1 VISU Binary Input 31 IF VISU RO Digital output 3 me EN _ Input Double digital outputs Digital output 1 2 Relay Output Block visu JBinaylnpt 66 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 8 5 T200 S Type Index Index xD ES No Switch position ISD visu Binaryimput 32 20 Swithlocked n ISS 49 VISU Binary Input_ 68 44 Switch command TCD 1 EXPL Control Relay 4 04 Output Block Operation counter CNT 1 VISU mr Analog Input Operation counter preset command TCD 25 ADMIN Control Relay NA NA Output Block WmWayD 8851 VISU Binary input NA NA MV voltage present 8973 VISU Bimayinpu 80 50 Aux MV voltage present T8854 visu BinayImput NA NA Eanna SSA VISU Binaryimput Phase faut ISS 77 VISU Binary input Phase current 1 VISU EEE d Input Phase current 2 VISU Sie Input Phase current 3 TM 4 VISU 16 Bit Analog NA NA Input Neutral current TM5 VISU 16 Bit Analog Input Input
48. Inpt 44 26 jSwitchlocked TSS865 visu Binaryimput 164 A4 preme UNE a Output Block MV voltage present auxiliary DI TSS 870 visu JBinaryInput 174 AE Eathfaut TS8887 visu Binary Input_ 157 9D Phasefaut TS8893 visu Binary Input 156 9C Input hannel 14 Switch position ISDi22 Visu Binaryinpu 45 Switchlocked TSS897 visu BinaryInput 165 A5 i id 3 RANE Output Block MV voltage present auxiliary DI TSS902 visu BinaryInput 175 AF Eathfaut TSS919 visu BinaryInput 159 9F hase fault SS925 VISU BinaryInput 158 9 Phase current TM 255 VISU Le Analog Input m 5 O CD io m E hannel 15 Switch position TSD123 VISU Binarylnpt 46 2E Switch locked h TSS929 visu Binary Input 166 A6 a JUNE eee 15 5 Output Block MV voltage present auxiliary DI TSS934 VISU Binary Input 176 BO Earth faut TSS95 visu Binaylnput 161 At Phasefaut ISS 957 visu Binaryimput 160 Ao eee ii i hannel 16 16 Bit Analog 20 Input 1 Switch position ISD 124 VSU Braymp 47 2F Switch locked TSS961 visu Binary Input 167 A7 pum o OPA INEEN Output Block MV voltage present auxiiaryD 73 rss9s6 VISU Binary Input 177 B1
49. MV electrical network management Easergy range T200 amp Flair 200C amp R200 ATS100 MV substation control and monitoring units DNP3 communication Appendix to the User Manual al AALS HE Schneider Electric T200 Flair 200C R200 CONTENTS T IDIFOQUCHOI PAA m ale A A E 3 2 HeleleHcBs axo aidera nee cuu AA aede 4 3 PHINCIPIOS gm 5 3 1 General HC d E Ee OE E 5 32 ISO Model Es 5 Jo Mam SUIS ING UES ER ee GE Ee ee ee RD MID 5 AD AM EE 7 2 5 Punc onalities Ed es ER RE Ge ee ED elim ee ee Ee ates DM EE LE 7 3 56 DNPS P E AA EE N EE Ee DIE E E LU E ii 8 4 eiii mm 9 4 1 General configuration of the protocol se se se ee ee ee ee rennen nn ee EKE RESPE Ee Se GR RA GRA Gee eene 9 AD ER IS od ie OS AO AE OE OR N ORE N EN EE N 16 4 3 Specific configurations related to transmission media i 17 4 4 Specific configurations of the objects transmitted RR GRA GNG RR Ge ee ee ee ee Re RR RR RA enne Gee Ge ee ee ee ee 19 4 5 R200 ATS100 configuration of the protocol e 23 O EE n Ee do ue Aii e GE ae UE 25 5 1 Processing protocol related information i 25 5 2 Tracing interchange with the Supervisor se se bana bun RA GR GAGO ee be ee SR GR Re GANG Rd CANG
50. Measurements scaling mode Standard Adjusted or Normalized Adjusted and Normalized are IEC60870 related scaling processes They are available for compatibility reason but should not be used Refer to NT00156 for details NT00160 EN 06 Schneider 23 T200 Flair 200C R200 DNP3 e DNP3 IP TCP configuration The parameters for DNP3 IP can be modified under Settings SCADA communication Ethernet Port DNP3 IP Parameters Configuration Communication parameters on TCP IP ports Protocol DNP3 TCP IP Link DNP3 IP Parameters Configuration SCADAIPaddress 0000 TCPPort 26000 o Connection Mode Sewer v Outgoing TCP Port 20000 Port 3 DestUDP Port 20000 mitUDP port 266009 OU Local UDP Port 20000 UDP Mode Source Value v Timeout xims 50000 SCADAIPaddress 0000 TCPPor ooo Connection Mode Server v Outgoing TCP Port 20000 Port 4 DestUDP Port 20000 initubPport 0000 oo Local UDP Port 20000 UDP Mode Source Value v Timeout x1ms 50000 Save Cancel Refer to chapter 4 2 for these parameters description e DNP3 Class assignment Each variable can be assigned to DNP class 1 2 or 3 It is not done using the External address field but a separate field DNP Class Variable Configuration General Access Name fac OFF Display v SPS 30 Class Cubicle 1 v Rank Source Modbus External address 8025 Single point status SPS DISPL
51. NP3 IP protocol e The configuration settings to be made with general configuration of the protocol specific configurations relating to the transmission media specific configurations relating to the objects exchanged Maintenance aid facilities A glossary of specific terms expressions written in italics in the text The descriptive documents specified in the protocol specifications Object addressing tables which can serve as a model for establishing databases for the T200 and Flair 200C All along the documentation the T200 is taken as an example The software features of the T200 and Flair 200C are the same As a result the same information can be used indifferently with the T200 or with the Flair 200C NT00160 EN 06 Schneider 3 T200 Flair 200C R200 DNP3 2 References As mentioned above the purpose of this appendix is to help the user set up a network It is not intended to provide a detailed explanation of the protocol specified in the documents referenced below It is not necessary to read these documents However the user faced with a specific problem or wanting to have a more precise knowledge of this protocol will find it useful to read them They are available following registration in the DNP Users Group on the website of that organization www dnp org The 4 basic documents also called Basic 4 Documents which define the DNP3 are called Data Link Layer Protocol Description Transport Functions Application
52. R200 DNP3 7 2 Device Profile Document DNP V3 00 DEVICE PROFILE DOCUMENT Vendor Name SCHNEIDER ELECTRIC Device Name T200 Series 3 Highest DNP Level Supported For Requests L3 For Responses L3 Device Function O Master M Slave Notable objects functions and or qualifiers supported in addition to the Highest DNP Levels Supported the complete list is described in the attached table Maximum Data Link Frame Size octets Transmitted 292 Received must be 292 Maximum Application Fragment Size octets Transmitted 2048 if gt 2048 must be configurable Received 2048 must be gt 249 Maximum Data Link Re tries O None O Fixed at M Configurable range 0 to 10 Maximum Application Layer Re tries M None O Configurable range 0 to 10 Fixed is not permitted NT00160 EN 06 Schneider si T200 Flair 200C R200 DNP3 Requires Data Link Layer Confirmation O Never O Always O Sometimes If Sometimes when M Configurable If Configurable how Always or Never selected through configuration software Requires Application Layer Confirmation 1 Never L1 Always not recommended M When reporting Event Data Slave devices only O When sending multi fragment responses Slave devices only O Sometimes If Sometimes when M Configurable If Configurable how Never or When reporti
53. TCP shall be the primary transport service for DNP3 messages because of its reliably UDP can be used on a high reliability single segment LAN and in specific cases where small pieces of non critical data need to be sent or when broadcasting is required e Background TCP UDP For a TCP connection to take place one side must be the server and one side must be the client Client Server architecture is therefore provided The side of the link that initiates the connection is the client and the side of the link that waits for a connection request is the server The client requests a connection by specifying the IP address and port number of the server Once the connection is made data is transferred without either side having to specify the IP address and port number The T200 is usually associated to the server and can hold two different TCP connections with a SCADA Each connection with a client is managed by a disconnection delay if no data is exchanged What s more the Dual End Point mode allows the T200 to initiate a connection to a supervisor In this case a specific outgoing port can be set For UDP communications each side includes the address and port number with each transmission Each host that receives a UDP datagram is then provided with the sending host address and port number However two distinct modes are available to answer a request The first one consists of using the datagram port to send a reply the second one of using
54. a deliberate action sending of a command or automatic action time synchronization by the Control Centre will result in resumption of dialogue between the 2 devices NT00160 EN 06 Schneider 31 T200 Flair 200C R200 DNP3 e Transmission of change of signal In mode without Unsolicited Response When a change occurs in response to polling by the Supervisor the T200 transmits the change User Data Transport FIN 1 FIR 1 Seq 2 App FIR 1 FIN 1 CON 0 Seq 15 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 F3 01 00 02 00 1E 01 C2 CF 01 3C 02 06 3C 03 06 3C 04 06 F3 71 12 02 40 298 RIU 1 CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 12 02 40 340 RTU 1 gt CC 2 UserData Transport FIN 1 FIR 1 Seq 16 App FIR 1 FIN 1 CON 0 Seq 15 Fc 129 05 64 18 73 02 00 01 00 BH F5 DO CF 81 00 00 02 02 28 01 00 52 00 81 AC E7 90 A7 71 05 64 05 80 01 00 02 00 CE D3 D2 12012031 12 02 40 394 CC 2 gt RTU 1 ConfirmACK Above it is a change of local remote mode ndex 82 or 52 in hexadecimal that has been sent In Unsolicited Response mode The T200 sends the change spontaneously without the SCADA needing to send it a request 11 47 53 701 RIU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 5 App FIR 1 FIN 1 CON 0 Seq 17 Fc 130 05 64 18 53 02 00 01 00 E6 ED C5 D1 82 00 00 02 02 28 01 00 52 00 81 A2 82 83 FD 9D D2 12012D 31 11 47 53 758 CC 2 gt RIU 1 C
55. ach explanation O Either time tagged or non time tagged for a single event O Both time tagged and non time tagged for a single event FILL OUT THE FOLLOWING ITEMS FOR SLAVE DEVICES ONLY Reports Binary Input Change Events when no specific variation requested 1 Never M Only time tagged O Only non time tagged other attach explanation O Configurable to send both one or the Reports time tagged Binary Input Change Events when no specific variation requested O Never M Binary Input Change With Time L1 Binary Input Change With Relative Time L1 Configurable attach explanation Sends Unsolicited Responses M Never L1 Configurable attach explanation O Only certain objects O Sometimes attach explanation L1 ENABLE DISABLE UNSOLICITED Function codes supported Sends Static Data in Unsolicited Responses M Never O When Device Restarts L1 When Status Flags Change No other options permitted Default Counter Object Variation L1 No Counters Reported L1 Configurable attach explanation M Default Object 20 Default Variation 01 O Point by point list attached Counters Roll Over at O No Counters Reported O Configurable attach explanation O 16 Bits 1 32 Bits M Other Value 9 999 999 O Point by point list attached Sends Multi Fragment Responses M Yes L1 No NT00160 EN 06 Spider 53 T200 Flair 200C R200 DNP3 7 3 Control Relay Contr
56. age Variable Configuration Default SF6 20 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 The external address Index has been configured in the form 69 1 where 69 represents the index and 1 the class After saving the following screen appears El Switch state TCD1 4 Preset number of operations TCD25 El Switch state TSD1 3241 El load break switch TSS49 68 1 El SFB fault T5551 69 1 8 ID fault TSS71 61 1 El Yoltage absence TSS73 El Imax fault TSS77 60 1 Number of operations CNT1 703 LE Ie 7 Preset active energy TCD29 Preset reactive energy TCD3 Cutrent P1 TM2 Current P2 TM3 Current P3 TM4 ID current TMS Mean phase current TMG 1922 Power factor TM Parameters Setup Page Variable Configuration In this example note that for the information one wants to transmit to the SCADA system information for which an address Index has been configured 3 classes have been used class 1 for important signals necessary for operation class 2 for measurements operating help and class 3 for the operation counter maintenance Comments If only one index is specified the class assigned will be class 1 by default Many users use only class 1 In that case the Supervisor repatriates all the change information in a single time operation NT00160 EN 06 Schneider 21 Electric T200 Flair 200C R200 DNP3 e Measurements Time lag for radio communications Background We suppose that
57. ation between modems in synchronous mode once the modem has restored the frames in asynchronous form to the T200 In asynchronous mode transmission usually takes place by means of characters with 1 start bit 8 data bits no parity bit and 1 stop bit However other characteristics may be required by the modems used for transmission Via the parameters proposed in the window relating to the transmission port in question one can change some of the characteristics to be compatible with the modem used Home n Schneider EASERGY amp E ec t ric Administrator Diagnastic Maintenance Settings Port 2 DNP3 Radio external with modem Transmission speed 1200 y bauds Parity Even y Humber of stop bits fi Frame error on noisy start ves Frame error on idle interval ves 7 Delay before response 0 ms Handle DTR Li DTR to RTS delay b ms Handle CTS al CTS delay Po ns RTS or CTS to message delay 400 ms MessagetoRTS delay Do ms Caller communication delay E seconds Called communication delay Bo seconds Parameters Setup Page Port 1 transmission e Parity It is possible to configure the following parity cases even odd space no parity Comments The fact of configuring a parity results in a longer message transmission time In some cases however the message transmission time is insignificant by comparison with the delays before and after the message The impact will in that case be weak The me
58. bsence Flai23DM D SPS 8057 1F79h Max Current Reset Indication Flai23DM O SPS ma n a Protection 50 511 delayed VIP410 O SPS wa n a Protection 50 51 I gt gt delayed VIP410 O SPS wa wa Protection 50 51 gt gt gt delayed VIP410 O SPS ma n a Protection 50 5115 pick up VIP410 O SPS wa ma Protection 50 51 gt gt pick up VIP410 O SPS ma n a Protection 50 51 I gt gt gt pickup VIP410 O SPS wa na Protection 50N 51N lo delayed VIP410 O SPS ma na Protection 50N 51N lo gt gt delayed VIP410 O SPS wa wa Protection 50N 51N los pick up VIP410 O SPS wa na Protection 50N 51N loss pickup VIP410 O SPS ma na Protection 49 RMS thermal alarm VIP410 SPS na nia 72 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 ubicle 1 data rotection 49 RMS thermal tripping xternal trip by external input ripping rip by test menu rip Indication hase peak demand values reset indication A peration counter rip counter hase earth fault counter hase fault counter arth fault counter Number of trip phase fault Number of trip earth fault Number of trip thermal overload Number of trip external trip nergy active total MSB nergy active total LSB nergy reactive total MSB nergy reactive total
59. d In this way if 2 frames collide their repetitions will be deferred and the problem will be solved The second case is more complex To avoid collisions insofar as possible one must know the network occupancy state The more reliable this information the more efficient the system It is true that one can forcibly adopt sending only if the network is free However this has its limits since two devices may see the network free and start sending simultaneously Even apart from this case there is always a time lag for detection of network occupancy Let us consider a device going into sending mode Throughout the time needed for detection of this state another device will consider the network as free and will therefore be authorized to send To overcome this it is possible to use collision avoidance Depending on the transmission medium there will be several possible options Non activated or Standard Non activated Standard squelch used for busy state Standard DCD used for busy state The first group of options is proposed when the transmission medium can provide the occupancy state via the DCD signal This is the case when the sent frames are delimited by a signal generally RTS said signal being linked to the DCD or causing its activation case in which the RTS signal causes rising of a carrier detected on DCD by the other device The second group of options is proposed when using a radio medium There are generally 2 signals
60. d lada UJ m gt gt 0 o oo 4 4 Olaf gt AOJO O W gt AR UJ co NT00160 EN 06 Schneider 63 T200 Flair 200C R200 DNP3 8 4 Flair 200C Ki a SMISE 60 hs N interne Dec Hex Flair 200C state Output Block Missing voltage TSSI7 VISU binary Input 28 10 Chager aut fssa VISU Binary put 16 10 Battery faut SR VISU binary mput 17 ii General shutdown frss VISU Binaryimput Battery disconnected T5826 VISU Binary Input 18 12 Bateylow fs VISU Binaryimput Equipment start TSS31 VISU Binary Input Test communication TSS32 VISU Binary Input Input Voltage measure TM42 VISU IE Input Measurechanel 1 __ Y Current P1 TM 1 VISU EN uL Input Current P2 TM26 VISU 16 Bit Analog 41 29 Input Current P3 TM31 VISU EE Baa Input Input Mean phase current TM41 VISU EN uu Input Input Input Input Apparent power TM56 VISU EE Input Active energy CNT101 VISU ieee Gas Input Reactive energy CNT103 VISU ME a NAS Input Fault channel YA UU Fast earth fault TSSTT VISU Binary input 27 i8 Earth faut 72 VISU Binary input 26 TA Fast phase fault fresze visu Binaryimput 30 1E Phase fault TSS7T VISU Binary nput 29 1D Counter fast earth fault CNT7 VISU EE KAKO Input Counter earth fault CNT8 VISU NN uu Mi Ed Input Counter fast
61. e transmission time with the T200s by first sending a transmission delay measurement Delay Measurement Transmission of changes routine transmission The T200 can transmit changes on signals measurement changes upon a change exceeding the dead band upon crossing a threshold and regular measurement reports These changes may be dated or not Counter processing It is possible to freeze the counters Commands Two command modes are available Select then Operate and Direct operate Modification of parameters It is possible to modify certain parameters NT00160 EN 06 Schneider 7 T200 Flair 200C R200 DNP3 3 6 DNP3 IP DNP3 protocol was originally designed for serial point to point communication e g RS 232 with limited support for half duplex serial networks e g RS 485 In order for the T200 to exchange DNP3 messages in a local or wide area network the dnp3 protocol is also implemented over Ethernet via TCP IP protocols We will call it DNP3 IP Its implementation in the ISO model can be interpreted as followed DNP3 layer application DNP3 Protocol TCP UDP Transport layer Ethernet Link layer e Transport layer and protocol characteristics As we can see above the Transport layer of the internet protocol suite consists of two distinct services User Datagram Protocol UDP and Transmission Control Protocol TCP Both protocols are available on the T200 but their use varies according to the application
62. eception of a message at the link level can be implemented at the application level Here one configures the number of times that an application information item will be repeated in the case of non confirmation of reception Configurable from 1 to 10 The customary values are in the range between 2 and 4 NT00160 EN 06 Schneider 11 T200 Flair 200C R200 DNP3 e Application time out This is the delay during which the T200 waits for confirmation of correct reception of the application information item sent The choice of value must take into account any repetitions at the link level It must therefore be greater than the delay between first sending of the frame containing the information and the end of waiting for the last repetition of this frame at the link level e Requires application confirm Setup of the system for checking correct reception of application information is performed or not in this section e Handle requested object unknown bit When a telecontrol network is operational the Supervisor normally requests of the remote terminal units only objects managed by the latter However during the stages of configuration of this network it can occur that the SCADA system requests of a remote terminal unit objects that are non existent in it To facilitate understanding of the non return of these objects the T200 marks a bit in the octet in question with N Internal Indications This bit is called Requested object s unknown
63. elay had not been set The following diagrams show the various types of operation No delay for chaining zero delay Events Message sent by the T200 ti t3 Acknowledgement sent by the t2 t2 Supervisor Allowance for the 2 events by the Supervisor I Delay for chaining zero delay Events Delay for chaining Mo Message sent by the T200 t4 Acknowledgement sent by the t2 Supervisor Allowance for the 2 events by the Supervisor I The network occupancy in the first case is equal to t1 t3 2 x t2 and in the second case to t4 t2 It is greater in the first case On the other hand the SCADA system is informed of the 2 events later in the second case Comment the second event does not reinitiate the delay for chaining e Objects index In the T200 the address ndex of the objects can be coded on 8 or 16 bits 1 or 2 octets In the former case that limits to 256 objects the number of objects of the same Data Objecttype that can be transmitted while in the second case one can have up to 65536 objects of the same general Data Objecttype It is always advisable to limit the size of messages exchanged so one should choose when possible a size of 8 bits Go to 16 bits when the number of objects of the same general Data Object type is greater than 256 e Maximum application re tries A system similar to that for checking correct r
64. erated TSS 57 visu Binaryimput 89 59 nternal faults Motorization power supply failure TS819 Visu Binaryinpu 87 57 Accessoryequipmentpowersupplyfalure TSS20 VISU Binary Input NA NA Chargerfaut TSS21 VISU Binayinpt 85 55 Battery faut TSS22 VISU Binaryimput 86 56 Equpmen aut rss29 visy BinaryInput NA NA Digital Inputs Outputs Digitalinput 1 SS ISU JBiaryInut 76 4C Dijtainu2 3 3 rss2 _ VISU BinaryInput_ 77 4D Digitalinput3 111 T653 ISU Binary Input NA NA Dijtainut4 3 rss visy Binaryimput NA NA Dijtainut5 3 S95 visy BinaryInput_ NA NA Dijtaliput 86 VISU Binaryinput NA NA Dijtainut7 rss7 VISU 1Binaryinput NA NA Dijtaliput8 3 88 VISU Binaryinput NA NA Digtalouput2posion TSD6 VISU 1Binaryinput NA NA Digital output 2 command TCD 6 EXPL Control Relay NA NA Output Block Digital output 3 position TSD 7 visu Binary Input Digital output 3 command TCD7 EXPL Control Relay NA NA Output Block MIAO NT00160 EN 06 Schneider 69 T200 Flair 200C R200 DNP3 8 6 R200 ATS100 Object type cross reference table Object type T200 F200C Designation Comment SPS TSS DI Single Point Status DPS TSD DDI Double Point Status SPC TCS DO Single Point Co
65. everal classes Class 0 is used for static data T200 states classes 1 2 and 3 for dynamic data changes The operating procedure without Unsolicited Response function is generally as follows e When it starts up the Supervisor initializes the link to the first T200 e t sets the T200 time where necessary e It repatriates the T200 states either by requesting class O objects or by reading the various types of objects e It goes to the following T200 Then the Supervisor works by polling e It regularly repatriates all the T200 states either by requesting class O objects or by reading the various types of objects Or e trepatriates only changes of state and thereby maintains its database The Supervisor can send a command to the T200s at any time In this operating procedure the SCADA system controls the communication load Operation is simple but results in intense use of communication media because the more quickly one wants to be informed of a change the more often the T200s must be interrogated The polling cycle limit corresponds to the shortest cycle for interrogating all the T200s This interchange is mostly unproductive because in most cases the T200 interrogated has nothing to report on this subject see for example in section 5 2 Tracing interchange with the Supervisor Energizing the T200 the window in which appears a Request for class 1 2 or 3 data polling The operating procedure when the Unso
66. gt CC 2 ConfirmACK 05 64 05 00 02 00 0100 50 08 16 40 48 437 RIU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 51 App FIR1 FIN 1 CON 0 Seq 7 Fc 129 05 64 20 73 02 00 01 00 24 E6 F3 C7 81 00 00 0A 02 28 01 00 04 00 81 02 02 28 8A 34 01 00 20 00 81 45 A9 8F D3 1201 A1 BA i 16 40 48 496 CC 1 Confirm ACK m 05 64 05 80 01 00 02 00 CE DI 34 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 In Unsolicited Response operation Direct Operate mode The supervisor sends the order An application confirmation is sent by the T200 followed by the change of position of the device Below an order is sent to switch 1 Index 4 0004 in hexadecimal The corresponding change of position Index 32 0020 in hexadecimal is normally returned by the T200 17 16 47 027 CC 2 gt RTU 1 UserData Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 1Fc 5 Control Relay Output Block Qual 17x Qty 1 05 64 18 D3 01 00 02 00 78 36 CO C105 0C 01 17 01 04 81 01 01 00 00 00 00 00 39 2E 00 00 00 FF FF 17 16 47 056 RTU 1 gt CC Confirm ACK 05 64 05 00 02 00 01 00 50 08 17 16 47 098 RTU 1 gt CC User Data Transport FIN 1 FIR 1 Seq 62 App FIR 1 FIN 1 CON 0 Seq 1 Fc 129 05 64 1A 73 02 00 01 00 0C D3 FE C181 00 00 0C 01 17 01 04 81 01 01 00 00 00 1D 45 00 00 00 00 00 FF FF 17 16 47 151 CC 2 gt RIU Confirm ACK 05 64 05 80 01 00 02 00 CE DI 17 16 49 059 RTU 1 gt CC User Data Transport FIN 1 FIR 1 Seq 63 Ap
67. irm ACK 05 64 05 80 01 00 02 00 CE D3 Comment After time setting the Time synchronisation required from the master bit is no longer marked in the corresponding N octet sent by the T200 28 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 The Control Centre will now request all the T200 states so as to have a real image of the T200 To do so it sends a request for class 0 objects 10 56 59 923 CC 2 gt RIU 1 User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 5 Fe 1 Class 0 Data Qual 06x 05 64 0H D3 01 00 02 00 E9 DD CO C5 01 3C 01 06 E1 FF 10 56 59 955 RTU 1 gt CC 2 ConfirmACK 05 64 05 00 02 00 01 00 50 08 10 56 59 997 RTU 1 gt CC 2 UserData Transport FIN 1 FIR 1 LEE App FIR 1 FIN 1 CON 0 Seq 5 Fc 129 IIN1 Device Restart 05 64 7C 7302 00 01 00 2A E7 C4 C58180 00 01 01 01 20 00 20 0001010101BA A0 23 00 23 00 00 01 01 01 3C 00 3D 00 00 01 01 01 0E EE 44 00 45 00 00 01 0101 4C 00 4E 00 00 01 01 01 6D 31 52 00 53 00 00 01 01 01 55 00 58 00 00 0A 02 01 AA 01 04 00 04 00 81 DA 02 01 07 00 07 00 01 0A 02 01 65 B9 15 00 15 00 00 TE 02 01 CO 00 CO 00 00 00 00 1E 60 BE 0101 C1 00 C1 00 00 00 00 00 80 14 01 01 46 00 74 AG 46 00 01 9F 01 00 00 51 18 10 57 00 180 CC 2 gt RTU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 The T200 returns all the static objects for which a transmission address has been configured The Supervisor now has a correct representation of the T200 It can
68. is dealt with 6 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 3 4 Data The DNP3 protocol specifies the data that can be exchanged and the form in which they are transmitted Among the numerous items of information to which the protocol gives access there are binary inputs with or without additional indications analogue inputs in several formats counters in several formats digital outputs analogue outputs in several formats These data called objects in the DNP3 protocol will be described in detail further on 3 5 Functionalities Reading all the states of a T200 This can be performed according to two methods by the SCADA It can perform Class 0 Data Reading method generally used or perform a set of Reading operations concerning each type of object of the T200 The latter will send back in reply the state of all the static data first methods or the state of all the objects corresponding to the types requested second methods on condition that a transmission address has been defined for each of these objects Time setting This can be performed by the Supervisor either individually for each T200 with confirmation by the latter that it has received correctly or all at once by broadcast for all the T200s on a given transmission medium In this case the T200s in question do not reply On those media that offer a repetitive transmission delay the SCADA can correct the synchronization of th
69. is priority is left at 0 Min random delay Max random delay The random timeout added to the wait related to the priority is in a range between the minimum and maximum values defined here There are no typical values for these parameters Setting should be performed taking into account the following comments The timeouts are to be set according to the sending time for a frame The smaller the minimum timeout the smaller the added timeout can be The greater the difference between the minimum timeout and the maximum timeout the smaller the risk of sending by two T200s at the same time The preceding condition is achieved by increasing the maximum timeout But allowance should be made for the fact that the greater this timeout the longer the T200 risks waiting before sending Generally therefore one opts for a value that will not be too high The ideal solution therefore is to choose parameters in accordance with the above rules and then refine them in the field The other parameters concern the signal used to obtain the network occupancy state Squelch active level Depending on the equipment the squelch active state will be a low level or a high level One should therefore choose here the appropriate level Squelch protect The squelch is an occupancy signal provided by analogue type radio equipment With this transmission medium the transmission conditions vary with time For example the transmission conditio
70. ition of these frames will be performed first at the SCADA end and then at the T200 end If the values had been identical they would have been executed simultaneously thus creating a new collision Requires data link confirm There are two ways of handling a sent frame The Send No reply expected service entails no confirmation by the equipment for which it is destined This service corresponds to the choice No The Send Confirm expected service requires confirmation by the destination It corresponds to the choice Yes The Send No reply expected service makes it possible to reduce the number of frames exchanged and hence accelerate the flow of information over a link However it should be avoided on noisy transmission media messages are frequently disturbed and in this case the sender does not know that the frame has not been received correctly It is therefore in practice usable only on dependable media Such media are links such as RS 232 links optical fibre links etc on which the speeds are generally very high This explains why it is generally not used However it is possible to configure it Delay before first emission To prevent several T200 s calling at the same time to indicate a common event it is possible to configure different waiting times for each of the T200 s before they go into call mode Calls to the SCADA system will then be deferred and will not interfere with one another Application layer Sends unsolici
71. ject to a class you must go to the variable configuration screen Schneider d Electric MSS EASERGY D gi Maintenance Settings T Ka Variable name Type Address EIS Switch state TEDI 4 r of ions pres TCD25 Active energy preset TCD28 Reactive enerqy preset TCD37 gt Switch state TSDI 32 Status T5549 68 DI aux T5551 Earth fault 18871 61 MY Presence TSS 3 Bl Phase fault TSS77 60 Number of operations CNT1 LII Current P1 TM2 Current P2 TM3 z Current P3 TM4 10 current TMS Mean phase current TMG 192 Power factor TM Parameters Setup Page Variable Configuration You must then open the window relating to the variable object selected NT00160 EN 06 Schneider 19 T200 Flair 200C R200 DNP3 We have selected below the Default SF6 variable a Schneider EASERGY amp E e C t r C Administrator Diagnostic Maintenance Settings Digital input configuration General parameters Variable name sre Fault Type C Double Single Logical address rss y Class Switch state 1 Access DISPLAY y Internal address p D External address o A ActiveInactive status definition Inactive 0 Disable Active 1 Enable Activate Log configuration On status change On active V On inactive V On status change On active On inactive Alarm level scada 7 Delayed alarm fo C Hours C Minutes Seconds Parameters Setup P
72. k Qual 17x Qty 1 05 64 18 D3 01 00 02 00 78 36 D2 CD 05 OC 01 17 01 04 41 01 01 00 00 00 00 00 FB D9 00 00 00 FF FF 16 09 24 358 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 16 09 24 400 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 57 App FIR 1 FIN 1 CON 0 Seq 13 Fc 129 05 64 1A 73 02 00 01 00 0C D3 F9 CD 81 00 00 OC 01 17 01 04 4101 01 00 00 00 6C 05 00 00 00 00 00 FF FF 16 09 24 453 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Below one of the Supervisor polling operations 16 09 25 190 CC 2 gt RTU 1 User Data Transport FIN 1 FIR 1 Seq 19 App FIR 1 FIN 1 CON 0 Seg 14 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 F3 01 00 02 00 1E 01 D3 CE 01 3C 02 06 3C 03 06 3C 04 06 BF 56 16 09 25 219 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 16 09 25 261 RTU 1 gt CC 2 UserData Transport FIN 1 FIR 1 Seq 58 App FIR 1 FIN 1 CON 0 Seq 14 Fc 129 05 64 DA 53 02 00 01 00 90 B3 FA CE B1 00 00 BB A8 16 09 25 295 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Comment The SCADA system could have requested only objects of the class corresponding to the expected object In response to one of the polling operations change of state 16 09 26 393 CC 2 gt RIU 1 User Data Transport FIN 1 FIR 1 Seq 20 App FIR 1 FIN 1 CON 0 Seq 15 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x
73. lest to manage at the Supervisor end because the latter completely controls the transmission load but the most restrictive with regard to the transmission media and operation in which all the classes used are declared as operating in Unsolicited Response mode the hardest to manage at the Supervisor end because the Supervisor no longer has control over the dialogue load and at the remote terminal unit end because the latter must manage a collision avoidance system but which does not heavily load the transmission media UDP User Datagram Protocol Protocol used over an IP link which can be used by the T200 for the DNP3 IP protocol W Write Time and Date Time setting message sent by the Supervisor This date and time setting can be corrected when the transmission delay is constant for this transmission time Writing The Supervisor works by Writing or Reading data to or from the remote terminal units 44 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 7 Interoperability Documents 7 1 Implementation Table OBJECT REQUEST RESPONSE slave must parse master must parse Func Qual Func Qual Obj Var Description Codes Codes Codes Codes dec hex dec hex 1 0 Binary Input All Variations 1 22 00 01 06 1 1 Binary Input 1 00 01 06 129 130 00 01 1 2 Binary Input with Status 1 00 01 06 12
74. licited Response function is used is generally as follows e When it starts up the Supervisor initializes the link to the first T200 e t sets the T200 time where necessary e It repatriates the T200 states either by requesting class O objects or by reading the various types of objects e It goes to the following T200 nka a T200 starts up It initializes the link e It indicates to the SCADA system that it has just started by setting the Device restart bit in the corresponding octet of the IIN Internal Indications e The Supervisor sets the T200 time where necessary e lt then requests the T200 states either by requesting class O objects or by reading the various types of objects Then messages are sent only to provide unknown information For example when a change occurs the T200 will call the SCADA system via the Unsolicited Response function This will make it possible to initiate dialogue and the SCADA system will then retrieve the change Likewise the Supervisor will send messages to the T200 when the operator requests order execution This operating mode does not heavily load the communication facilities a device speaks only when it has something to say On the other hand the SCADA system no longer controls the data flow because it can be called at any time Collisions between messages can occur when at a given point in time several devices take control to speak We shall see further on how this problem of collisions
75. ly failure SS19 visu BinaryInpt 87 57 Accessory equipment power supply failure TSS20 Visu Binary Input NA NA SS21 visu Binary Input 85 55 S822 visu Binary Input 86 56 s547 visu Biaryinput NA NA o 2 D 2 2 c o Ke PF o N harger fault attery fault ault detector link defect Digital inputs 55274 65275 655276 55277 655278 65545 55546 55547 55548 55549 SS550 SS817 65818 55819 s5820 65821 55822 Digital input 8 VISU Digital input 9 Digital input 10 Digital input 11 Digital input 12 Digital input 13 Digital input 14 Digital input 15 Digital input 16 Digital input 17 Digital input 18 Digital input 19 Digital input 20 Digital input 21 Digital input 22 Digital input 23 Binary Input 109 Binary Input 116 Binary Input 121 inary Input 122 Digital input 1 VISU 76 Digital input 2 VISU 77 Digital input 3 VISU 84 Digital input 4 VISU 5 Digital input 5 VISU Digital input 6 VISU Digital input 7 TSS273 VISU 108 C VISU 7 VISU VISU VISU EER NE VISU EERS c B Binary Input 123 Binary Input 140 B B inary Input 141 inary Input 148 Binary Input 153 154 155 172 VISU VISU VISU VISU VISU VISU VISU VISU ISU A gt Binary Input 173 Binary Input 180 Binary Input 185 186 187 O e y 3 N N Bad lada lada d
76. ly one request for class 1 objects Being now informed of restarting of the T200 the Supervisor will perform time synchronization For systems in which the message transmission delay is constant it is possible to correct synchronization of the transmission delay The Supervisor then sends a Delay measurement message which makes it possible to measure the time required for transmission 09 12 41 211 CC 2 gt RIU 1 User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 3 Fc 23 05 64 08 D3 01 00 02 00 B9 4E CO C3 17 69 17 09 12 41 240 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 RIU 1 2CC 2 UserData Transport FIN 1 FIR2 1 Seq 2 App FIR 1 FIN 1 CON 0 Seq 3 Fc 129 IINT Time Required Device Restart 05 64 10 73 02 00 01 00 67 6F C2 C3 8190 00 34 02 07 01 AF 00 FB 1B 09 12 41 326 CC 2 gt RIU 1 Confirm ed 05 64 05 80 01 00 02 00 CE D3 Then it sends the time setting message Write Time and Date 09 47 41 311 CC 2 gt RIU 1 User Data Transport FIN 1 FIR 1 Seq 0 App FIR 1 FIN 1 CON 0 Seq 4 Fc 2 Time and Date Qual 07x Qty 1 05 64 12 F3 01 00 02 00 4E 92 CO C4 02 32 0107 01 18 AB 4C D2 12 01 E7 EF 10 47 59 214 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 10 47 59 256 RIU 1 CC 2 UserData Transport FIN 1 FIR 1 Seq 3 App FIR 1 FIN 1 CON 0 Seq 4 Fc 129 IIN1 Device Restart 05 64 0A 53 02 00 01 00 90 B3 C3 C4 8180 00 92 4A 10 47 59 290 CC 2 gt RIU 1 Conf
77. n 0 and 65534 Serveur Client Architecture Process used to exchange DNP3 messages over an IP network using TCP protocol In our case the T200 is associated to the server the supervisor to the client State Bit representing the state of a binary input Status Octet representing a Binary Input with Status object This octet contains among other things the State bit which gives the Binary Input state T Time synchronisation required from the master Bit 4 of the first octet of the Internal Indications IIN indicating that the T200 needs date and time setting This bit is marked after T200 energizing or when a period exceeding the time configured in the Clock Validity section has elapsed since the last time setting NT00160 EN 06 Schneider 43 T200 Flair 200C R200 DNP3 ICP Transport Control Protocol Protocol used over an IP link which can be used by the T200 for the DNP3 IP protocol U Unsolicited Response The basic operation of the DNP3 Protocol is of the master slave type in which the Supervisor is master and the remote terminal units are the slaves However when Unsolicited Response operation is validated the remote terminal units are authorized to call the Supervisor and in that case act as master In the T200 when Unsolicited Response is enabled one can select the classes for which this operation is permitted One can thus have all possible organizations between operation without Unsolicited Response the simp
78. ng Event selected through configuration software Timeouts while waiting for Data Link Confirm O None OFixedat O Variable M Configurable Complete Appl Fragment None OFixedat__ O Variable O Configurable Application Confirm None LlFixedat L1 Variable M Configurable Complete Appl Response M None OFixedat__ O Variable O Configurable Others When Configurable value selected through configuration software Sends Executes Control Operations WRITE Binary Outputs SELECT OPERATE DIRECT OPERATE DIRECT OPERATE NO ACK Count gt 1 Pulse On Pulse Off Latch On Latch Off Queue Clear Queue M Never O Never O Never O Never M Never O Never M Never O Never O Never M Never M Never O Always M Always M Always M Always O Always O Always O Always M Always M Always O Always O Always O Sometimes O Sometimes O Sometimes O Sometimes L Sometimes M Sometimes O Sometimes O Sometimes L Sometimes O Sometimes O Sometimes only with Trip or Close delay value set through configuration software O Configurable O Configurable O Configurable O Configurable O Configurable O Configurable O Configurable O Configurable O Configurable O Configurable O Configurable 52 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 FILL OUT THE FOLLOWING ITEMS FOR MASTER DEVICES ONLY Expects Binary Input Change Events O Configurable att
79. ns are altered depending on whether or not there are leaves on the trees Therefore reception levels generally vary throughout the year Accordingly the squelch is related to the value to which its detection level has been set This setting is normally performed in the field and in periods when reception is least satisfactory However despite all the precautions taken squelch detection may become active permanently or over long periods of time This means that in this case the T200 is therefore no longer authorized to send To avoid this squelch protection can be activated When it is activated this protection system will ensure that when the squelch is active at the time when the T200 wants to send and when it remains active permanently during the time defined below sending by the T200 will be authorized after this time Tsqu squelch protect This time is the time referred to above The customary value is approximately 10 s Explanatory diagrams Normal case Squelch T200 sending The T200 needs to send here waiting for waiting for free network calculated time 14 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 Case of permanent squelch with squelch protection The T200 needs to send here Squelch T200 sending waiting for set time without squelch protection The T200 needs to send here Squelch T200 sending The T200 is not authorized to send
80. ntrol Possibly associated to an SPS DPC TCD DDO Double Point Control Possibly associated to a DPS MV TM AI Measured Value On 16 and 32 bits APC AO Analogue Point Control On 16 and 32 bits INC CNT Integer Control On 16 and 32 bits used for presettable counters Access 70 A Administrator ADMIN O Operator EXPL M Monitoring VISU Index Index Dec Hex RTU Specific Data 8 6 1 RTU data Automatism ATSI00 O DPC 7212 1C2Ch Go to parallel ATStOO ACO BTA O DPC 7216 1C30h GotoS1 ATSI00 O DPE 7218 1C32n Goto Of Afstw O DPE 7220 1C34h Goto Sa ATSto0 O DPC 7222 1C36h Goto S1 amp S2 ATS100 BTA O DPC 7224 1C38h Automatism state ATS100 D DPS 9292 244Ch Automatism has started ATS100 D SPS 8015 iF4Fh Automatismlocked ATS1o0 D SPS 8016 1F50h RTU Digital VO data Digital ouput R200 o Dra 7200 pican Digital output Ro o oe 7202 Dgtsoupua Ro o DPO 7204 iC2dh Dgtsoupu4 Roo o e 7206 Doubedgtaloupui2 R20 O DPC 7208 iC28h Double digital output 34 Re O DPC 7210 1C2Ah Digital output ATSI00 ACOIBTAj O DPC 7200 1C20h Digtaloupu2 ATS00 ACO BTA O DPO 7202 ich Dgtaoupui R20 D DPS 9280 Digital ouiput2 Roo D Digtaroutput3 Roo D Digital ou
81. ol code for Control Relay Output Block This octet contains different parameters describing the command refer to standard DNP V3 00 for details and only some combinations are accepted by the equipment The accepted combinations are 0x03 code 3 Latch On Trip close 00 gt Close operation 0x04 code 4 Latch Off Trip close 00 gt Open operation 0x41 code 1 Pulse On Trip close 01 gt Close operation 0x81 code 1 Pulse On Trip close 10 gt Open operation Other values of the Control Code will be rejected with the status 3 Request not accepted Concerning the other parameters of the Control Relay Output Block Count must be equal to 1 On Time and Off Time are not handled sa Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 8 Object addressing In the following tables will be found the default settings for the object addresses The addresses defined here are compatible with the information object addresses of the series 2 T200s In these tables do not appear objects which may have been acquired by the T200 in MODBUS protocol on the optional link to accessory equipment This is because their configuration is completely free in relation to the DNP3 protocol type information object address and the only rule to be obeyed is of course not to use for one object an address used for another object
82. onfirm ACK 05 64 05 80 01 00 02 00 CE D3 Comment it is possible to have mixed operation Some objects are placed in a class for which the Unsolicited Response mode is authorized and others in a class for which this mode is not authorized In general objects for which the SCADA system must know any change rapidly for example switch opening fault current flow etc are placed in class 1 for which Unsolicited Response is validated and objects which merely provide operating help for example voltage measurement etc are placed in class 2 for which the Unsolicited Hesponse function is not validated The SCADA system is thus upon calling informed rapidly of essential events class 1 while acquiring additional information class 2 at its own pace 32 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 Telecontrol In operation without Unsolicited Response Direct Operate mode The Control Centre interrupts its T200 polling to send the command For this command there is first an application acknowledgement by the T200 Here the conditions required for execution of a telecontrol are met the T200 is in remote mode there is no command in progress etc The T200 executes the order The SCADA system continues polling on the T200 until change of state is obtained following the command 16 09 24 328 CC 2 gt RTU 1 User Data Transport FIN 1 FIR 1 Seq 18 App FIR 1 FIN 1 CON 0 Seq 13 Fc 5 Control Relay Output Bloc
83. ource Address which specifies the sender of the message and a Destination Address which indicates for whom the message is destined These addresses are coded on 2 octets The Destination Address For messages sent by the T200 is the address of the SCADA system In that case it is configured in the SCADA Address section It can take any value between O and 65534 For messages received by the T200 and which are destined for it it corresponds to its own identification address It is configured in the Device Address section It can take any value between 0 and 65534 The value 65535 is reserved as Destination Address for broadcast messages messages destined for all the devices The broadcast address can for example be used by the Supervisor for time setting of all remote terminal units Device restart Bit 7 of the first octet of the nternal Indications IIN indicating that the T200 has just started It is reset by the Supervisor Direct operate In this command execution mode the command when it is authorized is executed upon receiving this message The wanted selection relay is actuated and after verification it is the turn of the execution relay During all the command sequences checks are performed Any detected anomaly causes immediate stoppage of the command E Enhanced Performance Architecture 3 layer transmission model used in the IEC 60870 5 101 standard simplified version of the 7 layer ISO model G Global Request
84. p FIR 1 FIN 1 CON 0 Seq 17 Fc 130 05 64 20 53 02 00 01 00 79 FE FF D182 00 00 0A 02 28 01 00 04 00 01 02 02 28 5B DC 01 00 20 00 01 C3 A0 BO D3 12 01 AE CD 17 16 49 119 Confirm ACK Comment The exchanges are far more limited than in operation without Unsolicited Response the Supervisor not having to perform polling on the T200 to repatriate the change of switch position Select then Operate mode Here again there are far fewer exchanges than in operation without Unsolicited Response The Supervisor first performs selection 08 16 45 413 CC 2 gt RIU 1 User Data Transport FIN 1 FIR 1 Seg 0 App FIR 1 FIN 1 CON 0 Seq 4 Fc 3 Control Relay Output Block Qual 17x Qty 1 05 64 18 F3 01 00 02 00 25 2E CO C4 03 OC 01 17 0104 4101 01 00 00 00 00 00 CD AD 00 00 00 FF FF 08 16 45 443 RTU 1 gt CC 2 Confirm ACK 05 64 05 00 02 00 01 00 50 08 08 16 45 485 RTU 1 gt CC 2 User Data Transport FN 1 FIR 1 Seq 7 App FIR 1 FIN 1 CON 0 Seq 4 Fc 129 05 64 1A 53 02 00 01 00 51 CB C7 C4 81 00 00 OC 01 17 01 04 41 01 01 00 00 00 62 77 00 00 00 00 00 FF FF 08 16 45 537 CC 2 gt RIU 1 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 NT00160 EN 06 Schneider 35 T200 Flair 200C R200 DNP3 Then it sends the execution order which causes the change of position to be sent by the T200 User Data Transport FIN 1 FIR 1 Seq 1 App HR 1 FIN 1 CON 0 Seq 5 Fe 4 Control Relay Output Block Qual 17x Qty 1 05 64 18 D3 01 00 02
85. plementarity P Polling This word designates a method for repatriation of information from the T200 The Supervisor interrogates each T200 in succession so that it may return its information Since the information objects may be distributed among several classes it is possible for the SCADA system to retrieve these objects at different rates Positive confirmation Message returned following receipt of a frame to confirm to the sender that it has been received correctly Also called Ack for Acknowledge 42 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 R Reading The Supervisor works by Reading or Writing data to or from the remote terminal units Reading Class O data This message sent by the Supervisor enables it to acquire the complete state of the T200 at the time of interrogation The T200 sends back in reply all the static objects for which an external address Index has been configured Requested object s unknown This bit transmitted in the Internal Indications allows the T200 to indicate that it does not handle the requested object This bit disturbs some Supervisors To avoid this problem it is possible to deactivate it by the configuration settings in the Requested object s unknown bit management section Reset of remote link Sent frame allowing resynchronization of the 2 ends of a link for a direction of communication S Select then Operate In this command execution mode the command when i
86. ption In this case time setting of the T200 is performed from the GPS The clock will be declared invalid only after power up or after expiry of the time without the GPS providing valid time setting data The user will then be notified when he receives a time tagged event that the GPS is not working correctly When the operating mode with Unsolicited Response is selected and saved an additional window opens in the Protocol Parameters screen This window is related to the problem of collisions that can occur when the T200 calls to transmit an Unsolicited Response see 3 3 Transmission modes It depends on the transmission medium used For point to point systems telephone GSM the window is that which conventionally appears when these types of media are used It is therefore described in the T200 User Manual in the chapter corresponding to such media 12 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 For multipoint systems radio radio type leased line etc the following window appears General protocol parameters Port2 Radio external with mode Collision avoidance Off Y Collision avoidance Collisions may occur between frames sent by the SCADA and frames sent by a remote terminal unit between frames sent by various remote terminal units It is often easy to limit their consequences in the former case A different link timeout see above will be set at the SCADA end and at the remote terminal unit en
87. rally make a request for class 0 objects so as to obtain an exact image of the T200 e Function code not implemented octet 2 bit O The function code received is not managed by the T200 This should normally not occur except in the commissioning phase e Requested object s unknown octet 2 bit 1 The requested object is unknown to the T200 This should normally not occur except in the commissioning phase By configuration one can inhibit its management by the T200 bit always at 0 in this case because some SCADA systems are disturbed by this bit see 4 1 General configuration of the protocol Management of the requested object unknown bit e Error in received parameters octet 2 bit 2 This bit enables the T200 to report any errors of formatting of the received information This should normally not occur except in the commissioning phase e Overflow octet 2 bit 3 Can indicate to the T200 that one of the queues of objects of class 1 2 or 3 has overflowed and that events have been lost as a consequence The operation of these queues is as follows An object is placed in the queue that is assigned to it until the queue is saturated The overflow bit is then marked New events are no longer stored until the queue following polling by SCADA becomes 40 empty again to avoid any repetitive saturation desaturation phenomena It is at this time that the bit goes low It is recommended that following an overflow
88. rameters Setup Page Variable Configuration name of variable under the External Address heading This address is entered in the form address class For example 251 2 will be put for an object of ndex 251 and class 2 By default all dynamic objects are placed in class 1 As a result the address 1 configuration is equivalent to the address configuration The user is free to use the dynamic classes as he wants He may use only a single dynamic class if he wants When performing a breakdown into the 3 classes important items switch position fault current flow etc are generally placed in class 1 operating help items current value voltage etc in class 2 and items of a maintenance or statistical nature number of switch operations active energy etc in class 3 This makes it possible when operating without Unsolicited Response to have rapid polling on class 1 to be rapidly informed of any major change on the telecontrol network to have less rapid polling on class 2 every 15 min for example and slow polling on class 3 every day every month etc In Unsolicited Response mode the advantage is slighter except if this mode is authorized for one class and not for the others One can then have all types of organization combining Unsolicited Response operation for class 1 for example polling for class 2 for example and reading at the request of the operator class 3 for example Clock synchronization This function is
89. s Codes dec hex dec hex 21 0 Frozen Counters All Variations 1 22 00 01 06 21 1 32 Bit Frozen Counter 1 00 01 06 129 130 00 01 21 2 16 Bit Frozen Counter 1 00 01 06 129 130 00 01 21 3 32 Bit Frozen Delta Counter 1 00 01 06 129 130 00 01 21 4 16 Bit Frozen Delta Counter 1 00 01 06 129 130 00 01 21 5 32 Bit Frozen Counter with Time of Freeze 21 6 16 Bit Frozen Counter with Time of Freeze 21 7 32 Bit Frozen Delta Counter with Time of Freeze 21 8 16 Bit Frozen Delta Counter with Time of Freeze 21 9 32 Bit Frozen Counter without Flag 1 00 01 06 129 130 00 01 21 10 16 Bit Frozen Counter without Flag 1 00 01 06 129 130 00 01 21 11 32 Bit Frozen Delta Counter without Flag 21 12 16 Bit Frozen Delta Counter without Flag 22 0 Counter Change Event All Variations 1 06 07 08 22 1 32 Bit Counter Change Event without Time 1 06 07 08 129 130 17 28 22 2 16 Bit Counter Change Event without Time 1 06 07 08 129 130 17 28 22 3 32 Bit Delta Counter Change Event without Time 1 06 07 08 129 130 17 28 22 4 16 Bit Delta Counter Change Event without Time 1 06 07 08 129 130 17 28 22 5 32 Bit Counter Change Event with Time 22 6 16 Bit Counter Change Event with Time 22 7 32 Bit Delta Counter Change Event with Time 22 8 16 Bit Delta Counter Change Event with Time Schneider Electric NT00160 EN 06 T200 Flair 200C R200 DNP3
90. s 3 Data Qual 06x 05 64 11D3 01 00 02 00 43 19 C2 CA 01 3C 02 06 3C 03 06 3C 04 06 45 3D 09 39 15 351 RTU 1 gt CC Confirm ACK 05 64 05 00 02 00 01 00 50 08 09 39 15 393 RTU 1 gt CC User Data Transport FIN 1 FIR 1 Seq 46 App FIR 1 FIN 1 CON 0 Seq 10 Fc 129 05 64 0A 53 02 00 01 00 90 BI EE CA 81 00 00 1A 52 09 39 15 433 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Transport FIN 1 FIR 1 Seq 3 App FIR 1 FIN 1 CON 0 Seg 11 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 F3 01 00 02 00 1E 01 C3 CB 01 3C 02 06 3C 03 06 3C 04 06 2C C7 09 39 17 695 RTU 1 gt CC Confirm ACK 05 64 05 00 02 00 01 00 50 08 09 39 17 738 RIU 1 gt CC User Data Transport FIN 1 FIR 1 Seq 47 App FIR 1 FIN 1 CON 0 Seq 11 Fe 129 05 64 0A 73 02 00 01 00 CD AB EF CB 81 00 00 F4 B3 09 39 17 771 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 09 39 20 010 User Data Transport HN 1 FIR 1 Seq 4 App FIR 1 FIN 1 CON 0 Seq 12 Fc 1 Class 1 Data Qual 06x Class 2 Data Qual 06x Class 3 Data Qual 06x 05 64 11 D3 01 00 02 00 43 19 C4 CC 01 3C 02 06 3C 03 06 3C 04 06 C1 BA 09 39 20 039 Confirm ACK 05 64 05 00 02 00 01 00 50 08 09 39 20 081 User Data Transport FIN 1 FIR 1 Seq 48 App FIR 1 FIN 1 CON 0 Seq 12 Fc 129 05 64 18 53 02 00 01 00 E6 ED FO CC 81 00 00 02 02 28 01 00 52 00 01 00 21 34 DC 16 D7 120175 4E 09 39 20 133 Confirm ACK 05 64 05 80 01 00 02 00 CE D3 Transport FIN 1 FIR 1 Seq 5
91. s at 1 The bits found in the two octets of N Internal Indications are processed as follows All stations message received octet 1 bit 0 Marked after receiving a message addressed to all the remote terminal units destination address 65535 reset after the following response of the T200 Class 1 data available octet 1 bit 1 Class 2 data available octet 1 bit 2 Class 3 data available octet 1 bit 3 When the T200 has data to be transmitted in a class the corresponding bit is marked It disappears when there are no longer any data in the corresponding class to be transmitted Time synchronisation required from the master octet 1 bit 4 This bit is marked at start up of the T200 and when the clock validity time has expired since the last time synchronization received by the T200 see above 4 1 General configuration of the protocol Clock validity It is reset when the T200 receives a time setting sent by the SCADA system Station in local mode octet 1 bit 5 This bit indicates the T200 operating mode local remote Device trouble octet 1 bit 6 Indicates that the T200 has detected an operating problem NT00160 EN 06 Schneider 25 T200 Flair 200C R200 DNP3 e Device restart octet 1 bit 7 Indicates restarting of the T200 This enables the Supervisor to know that the database he has relating to the T200 possibly does not reflect reality As a consequence he will gene
92. s the T200 to designate itself in Send mode as Source Address or recognize itself in Receive mode as Destination Address It can take any value between 0 and 65534 Address 65535 non configurable is used by the Control Centre to address all the remote terminal units Global Request In that case the T200 like the other remote terminal units does not reply to the SCADA NT00160 EN 06 Schneider 9 T200 Flair 200C R200 DNP3 Link layer Maximum data link re tries When data transmission fails disturbed frame the link layer controls repetition of the frame Here one sets the number of times that this frame will be repeated without confirmation of a correct reply before the link is declared as cut Configurable from 1 to 10 The customary values are in the range between 2 and 4 Link time out This is the time during which the T200 waits for acknowledgement of the frame sent by it After this time it will repeat the frame or declare the link invalid as mentioned above The choice of a value depends on the speed of transmission The higher the speed the lower the value that will be inserted In systems in which the frames sent by the T200 can come into collision with the frames sent by the Control Centre it is important to insert a timeout value greater than that appearing at the SCADA end For example if the SCADA and the T200 send at the same time frames which come into collision half duplex type operation repet
93. several T200 can send periodically and spontaneously their measurements to a SCADA Balanced mode Therefore collisions can occurred and the SCADA won t be able to receive all T200 changes of state Solution We provide a new parameter for each T200 which delays the sending of periodic measurements Example We have three equipments that send their measurements every 15 minutes We introduce a delay of 1mn for 7200 B and a delay of 3mn for 7200 C T200 A PEE uc O alarms MESA Delay Os T200 B Radio exchanges SCADA Delay 1mn T200 C Delay 3mn gt If the next sending is scheduled at 3 15 pm T200 A will send its alarm at 3 15 pm whereas T200 B will send it at 3 16 pm and T200 C will send it at 3 18 pm Settings The new parameter appears on the protocol page only if a radio modem has been selected and if unsolicited responses are allowed General protocol parameters Port 2 Radio external with mode Measures with time lag fa s Number of repetitions Timeout Cyclic period Remark Make sure that all settings have been defined properly Time lag cyclic period number of repetitions in case of failure Timeout caller communication delay Time lag should be defined last Collision avoidance Off bd 22 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 4 5 R200 ATS100 configuration of the protocol a The protocol configuration can be found under Set
94. sociated Communication Systems DNP3 has been adopted by the IEEE C 2 Task Force It was developed by Harris Distributed Automation Products In November 1993 responsibility for the specification of future developments and ownership of the protocol were transferred to the DNP3 Users Group Thus DNP3 is a public open protocol 3 2 ISO Model DNP3 is based on the standards of the International Electrotechnical Commission IEC Technical Committee TC57 Working Group 03 which worked on a standard protocol for telecontrol applications based on a 3 layer ISO model EPA Enhanced Performance Architecture which is a simplified version of the 7 layer ISO model User layer Application layer The three layers used are as follows e Physical layer e Data link layer e Application layer Data link layer Physical layer 5S D 3 3 Transmission modes The DNP3 protocol operates in master slave mode if Unsolicited Response operation is not used or in master master mode if this operation is used In the master slave mode the Supervisor is the master and the T200 as slave merely responds to the master s requests In the T200 use of the Unsolicited Response function or not is determined by configuration the conditions of this are detailed further on Where it is used the SCADA system can inhibit it or activate it remotely NT00160 EN 06 Schneider 5 T200 Flair 200C R200 DNP3 The information objects are broken down into s
95. ssage transmission security due to use of the FT3 format is adequate and does not require use of a parity for character transmission e Number of stop bits Two stop bits can be configured instead of one bit NT00160 EN 06 Schneider 17 T200 Flair 200C R200 DNP3 e Frame error on idle interval The T200 being able to operate in IEC 60870 5 101 protocol is capable of detecting a gap greater than 1 bit between 2 characters of a frame If this detection is configured as causing rejection of the frames having this feature transmission security is increased but this is not necessary the security ensured by the FT3 format being adequate This also makes it possible to return sooner to resynchronization waiting But this configuration implies that the Supervisor and the modems involved in the transmission circuit ensure that there are no gaps While this is sometimes true with regard to the Supervisor it is not true for many modems case of packet transmission between modems There is therefore no advantage in setting Yes for this parameter but the possibility of doing so is left to the user 18 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 4 4 Specific configurations of the objects transmitted As mentioned above dynamic objects the result of changes can be divided into 3 classes class 1 class 2 and class 3 At any given time the Supervisor may request only the objects specific to a particular class To assign an ob
96. t is authorized is executed in two stages The T200 first receives a select message It then receives an execute message It then checks that the same device is involved If this check is satisfactory it executes the command sequence Throughout the command s duration checks are performed Any detected anomaly causes immediate stoppage of the command Moreover if after receiving the select message an excessive time elapses without the T200 receiving the execute message the command is cancelled This time is configured in the Selection Timeout section Send Confirm expected When the sender uses this transmission service the receiver must confirm to it that it has received the frame Send No reply expected When the sender uses this transmission service it expects no confirmation by the receiver of correct frame reception Source Address Exchanges between the T200 and the SCADA system contain a Source Address which specifies the sender of the message and a Destination Address which indicates for whom the message is destined These addresses are coded on 2 octets Source Adaress for messages sent by the T200 this is the address which allows the T200 of identify itself on the network It is configured in the Device Address section It can take any value between 0 and 65534 for messages received by the T200 it corresponds to the address of the SCADA system It is configured in the SCADA Address section It can take any value betwee
97. ted responses It is here that the operating mode is chosen When one chooses Yes the Unsolicited Response function is controlled Class 1 class 2 class 3 The Unsolicited Response function when it is validated see above may be used only for certain classes of objects This selection is made by checking the boxes of the classes for which one wants to use this operation For example one wants certain events considered important for control to generate spontaneous sending to the SCADA system whereas others useful for control but not essential do not cause spontaneous sending by the T200 In that case the former will be placed in c ass 1 and the latter in class 2 or 3 Sending of an Unsolicited Response will be validated for class 1 by checking the corresponding box but not for classes 2 and 3 by leaving their boxes deselected 10 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 e Unsolicited wait delay So as to limit traffic which can be advantageous when using multipoint media such as radio it may be desirable to group several items of information in a single frame rather than send this information at a rate of one information item per frame By setting this delay for chaining one ensures that before sending a new information item upon a change the configured delay is waited so that if another change occurs during this delay this change can be grouped together with that which one would have sent alone if this d
98. tings 1 SCADA communication 1 Devic Protocol Jevice Variables Most parameters are similar to T200 F200C and described in chapter 4 1 Classes El synoptic view Single line Signals E SCADA communication Protocol Ethernet port Serial port Protocol Parameters DNP3 DNP3 Parameters Configuration Port 4 Scada address 2 Device address E ads Scada address 2 Device address ft uis Scada address 2 Device address f1 Link layer Maximum data link re IEEE es Ron o Port tries 3 Link time out x1ms 1000 1 Requires data link Delay before first emission confirm x1ms Maximum data link re lE uem Port tries 3 Link time out x1ms 1000 3 o Requires data link Delay before first emission Yes v o confirm x1ms ooo fo Yes v la Link time out x1ms 000 Requires data link Y Delay before first emission es v confirm x1ms E Application layer Class1 Available Yes v Sends unsolicited responses No w Class2 Available No Class3 Available No w Unsolicted walt delay 1000 Objects Index bits 16 v port ims 1 pusa E Application time out x1ms 50000 Requires application Handle requested object confirm No M unknown bit Yes i Select Timeout x1s 5 Clock validity x1s 3600 eks double bit binary Yes v TM read mode Standard vw There are some slight differences e TM Read Mode
99. tion only 09 34 17 508 RTU 1 gt CC 2 User Data Transport FIN 1 FIR 1 Seq 40 App FIR 1 FIN 1 CON 0 Seq 19 Fc 130 05 64 18 53 02 00 01 00 ES ED E8 D3 82 00 00 02 02 28 01 00 52 00 81 5A 89 2F FE D8 D7 1201 75 4E 09 34 17 558 CC 2 gt RIU 1 ConfirmACK 05 64 05 80 01 00 02 00 CE D3 Here the exchanges are greatly reduced there is no longer any need for polling 40 Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 6 Glossary Binary Input Single and double signals are treated as objects of the Binary Input type Broadcast The Supervisor can send a message to all the remote terminal units This is called broadcasting The Destination Address in that case equals 65535 In this case the addressees will not reply to the received frame the service used is then mandatorily the Send No reply expected service C Class The objects are broken down into 4 classes Class 0 is assigned to static objects a static object corresponding to the state of an item at a given time single signal measured value etc The supervisor therefore makes a request for class 0 objects to obtain a complete and representative image of the T200 at a given time Classes 1 2 and 3 are used for dynamic objects a dynamic object corresponding to an event relating to a static object change of signal threshold crossing by a measurement etc The dynamic class of an object is configured in the window relating to the variable Pa
100. tput4 Roo D Doubedgtaloupui2 R20 D Double digital output 34 R200 D Double digital input 2 Rao D E Doubedgtalput34 R200 D EE Schneider NT00160 EN 06 T200 Flair 200C R200 DNP3 Digital ouiputt____ ATS100 ACO BTA D DPS 9280 2440h Digital output2 ATSIO0 ACO BTA D DPS 9282 2442h Source transfer in progress ATS100 ACO BTA D DPS 9284 2444h 1F44h 1F45h EDU D D Digtelinpdt8 R200 D Digitalinput R200_ D Dgialinu5 R200 D Dgtainut6 1 Ro D SPS 8006 1F4oh Digtelinpdt7 R200 D SPS 8007 1F47h Digtelinpdt8 Rao D SPS 8008 1F48h Digtelinpdt1 ATSi00 ACOIBTA D SPS 8001 iF4ih Digialinput2 ATS100 ACO BTA D SPS 8002 1F42h Digialinput3 J ATS100 ACOBTA D SPs 8003 F43h Digialinput4 JATS100 ACO BTA D SPS 8004 1F44h Voltage presence St JATS100 ACO BTA D SPS 8005 1F45h ATS100 ACO BTA D SPS 8006 1F46h Transfer locking ATS100 ACO BTA D SPS 8007 1F47h ATS100 ACO BTA D SPS 8008 1F4sn Internal temperature R200 ATSI00 D MVI6 800 320 200 ATSI00 D SPS 8000 1F40h 200 ATS100 D SPS 8009 iF oh 200 ATSI00 D SPS 8010 1F4Ah 200 ATS100 D SPS 8011 1F4Bh 200 ATS100 R200 ATS100 pu DID 8 6 2 Global data e qe 9 Tene Dec Hex Restart 24 4

You cannot Flash but only read this

Contents

Download Pdf Manuals

Related Search

Related Contents