Ug TLC 120328

Rec 15, Rec 25
RC_5_1
Telecommunication
Use Guide
Contents
1. General
Abbreviations
2. Telecommuication Interface
TCI configuration
3. DNP3 protocol
Overview
Device profile
DNP3 application layer
DNP3 transport layer
DNP3 data link layer
Physical layer
10
10
12
38
40
47
3
4
5
4. Modbus Protocol
Overview
Application layer
Modbus data link layer
Physical layer
52
52
61
64
6
7
5. IEC 60870-5-104 Protocol

Overview
Interoperability list
Application layer
Link layer
Physical layer
66
66
76
82
82
6. Hardware Specification
RTU connection
Phone modem
Radio-modem
GSM modem
RS485 converter
84
85
85
85
85
7. Application Guide
88
General
Abbreviations
ABR
ACK
ASDU
APCI
APDU
AR
BF
CA
Char
CO
CON
CRC
CTS
CU
DCD
DCF
DIR
DNP3
DRVM
DSR
DTR
EF
FCB
FIFO
FUN
HL
IED
IIN
INT
LS
MPM
OBJ
OC
PRM
Prot
PSM
PTT
Q
RAM
RC
RCM
RI
RTU
TCI
SBO
SEF
UINT
UD
UF
UR
UV
VAR
VU
Automatic Backfeed Restoration

Acknowledgement
Application Service Data Unit
Application Protocol Control Information
Application Protocol Data Unit
Auto-reclosing
Bolted Fault Protection
Collision Avoidance
Character
Close/Open operations
Confirmation
Cyclic Redundancy Check
Clear To Send
Current Unbalance Protection
Data Carrier Detect
Data Flow Control Bit
Direction Control Bit
Distributed Network Protocol
Driver Module
Data Set Ready
Data Terminal Ready
Earth Fault Protection
Frame Count Bit
First In First Out
Function Code
Hot Line Tag
Intelligent Electronic Device
Internal Indication
Integer
Loss Of Supply Protection
Micro-processing Module
Object
Over-current Protection
Primary Message Bit
Protections
Power Supply Module
Push-To-Talk
Qualifier
Random Access Memory
Recloser Control
Recloser Control Module
Ring Indicator
Remote Telecommunication Unit
Telecommunication Interface
Select Before Operate
Sensitive Earth Fault Protection
Unsigned Integer
User Defined Signals
Under-frequency Protection
Unsolicited Response
Under-voltage Protection
Variation
Voltage Unbalance Protection
Telecommunication
Interface
Telecommunication interface (TCI) provides control and indication via RTU connected to serial port 6 located in the
rear of RCM.
If TCI mode is set Disable no control and indication functions are supported via RTU connected to port 6 (refer to
Design description for details).
TCI is a user-configurable interface. Configuration includes selection of applicable protocol and RTU in accordance
with the following table.
TCI Configuration
2
Protocol setting can be set up by one of the following values: DNP3, Modbus or IEC104.
Depending on protocol selected, the RTU setting has different options, given in table below.
Protocol
RTU applicable range
RTU default value
RTU
Radio modem
Phone modem
GSM modem
RS485-RS232 converter
Direct connection
Radio modem
TCP/IP Network
TCP/IP Network
Modbus
IEC104
The scope of generated indication and control data depends on the configuration, i.e. only data related to selected
RTU and protocol are generated.
DNP3 Protocol
Overview
DNP3 is based on the standards of the International Electro technical Commission (IEC) Technical Committee 57,
Working Group 03 who have been working on an OSI 3 layer "Enhanced Performance Architecture" (EPA) protocol
standard for telecontrol applications. DNP3 has been selected as a Recommended Practice by the IEEE C.2 Task Force;
RTU to IED Communications Protocol. For further information refer to www.dnp.org.
Triangle MicroWorks, Inc. DNP3 Slave Source Code Library Version 3.00 is used for present DNP3 slave implementation,
which complies with DNP 3.0 Subset Definition Level 3, and contains some functionality beyond Subset Level 3.
Presentation of data in DNP3 is different from generally used one. So, it is strongly recommended for those not
familiar with this subject to go through the following section before switching to DNP3 description. Note that in the
description data formats and designations described below will be used without special references.
Device Profile
3
DNP V3.00
DEVICE PROFILE DOCUMENT
Vendor Name: Tavrida Electric
Device Name: Recloser Control (RC), using the Triangle MicroWorks, Inc. DNP3 Multi-Port Slave Source Code
Library, version 3.00.
Highest DNP Level Supported:

For Requests:
Level 3

For Responses: Level 3
Device Function:

Master

Slave
Notable objects, functions, and/or qualifiers supported in addition to the Highest DNP Levels Supported (the
complete list is described in the attached table):
For static (non-change-event) object requests, request qualifier codes 00 and 01 (start-stop), 07 and 08 (limited
quantity), and 17 and 28 (index) are supported in addition to request qualifier code 06 (no range or all points).
Static object requests received with qualifiers 00, 01, 06, 07, or 08, will be responded with qualifiers 00 or 01.
Static object requests received with qualifiers 17 or 28 will be responded with qualifiers 17 or 28. For change-event
object requests, qualifiers 17 or 28 are always responded.
16-bit and 32-bit Analog Change Events with Time are supported.
The read function code for Object 50 (Time and Date), variation 1, is supported.
Maximum Data Link Frame Size (octets):

Transmitted: Configurable from 64 up to 292

Received
292
Maximum Application Fragment Size (octets):

Transmitted:
2048

Received:
2048
Maximum Data Link Retries:

None

Fixed at ____

Configurable from 0 to 255
Maximum Application Layer Retries:

None

Configurable
Requires Data Link Layer Confirmation:

Never

Always

Sometimes

Configurable as: Never, Sometimes (only for multi-frame messages), or Always.
Requires Application Layer Confirmation:

Never

Always

When reporting Event Data

When sending multi-fragment responses

Sometimes

Configurable as: Only when reporting Event Data or When reporting event data and multi
fragment messages.
10
Timeouts while waiting for:

Data Link Confirm:
Complete Appl. Fragment:
Application Confirm:
Complete Appl. Response:
None
None
None
None
Fixed at ____
Fixed at ____
Fixed at ____
Fixed at ____
Variable
Variable
Variable
Variable
Others:
Configurable

Transmission Delay:

Inter-character Timeout:
Tx Delay
Char Timeout
Fixed at

Select/Operate Arm Timeout:
SBO Timeout fixed at 5 sec.
Configurable

Need Time Delay:

Unsolicited response retry delay:

Unsolicited offline interval:
Need Time Delay

Retry Delay
Offline Interval
Configurable
Configurable
Configurable
Configurable
Sends/Executes Control Operations:

WRITE Binary Outputs

SELECT/OPERATE
DIRECT OPERATE
DIRECT OPERATE NO ACK
Never
Never
Never
Never
Always
Always
Always
Always
Sometimes
Sometimes
Sometimes
Sometimes
Configurable
Configurable
Configurable
Configurable
Count > 1
Pulse On
Pulse Off
Latch On
Latch Off
Never
Never
Never
Never
Never
Always
Always
Always
Always
Always
Sometimes
Sometimes
Sometimes
Sometimes
Sometimes
Configurable
Configurable
Configurable
Configurable
Configurable
Queue
Clear Queue
Never
Never
Always
Always
Sometimes
Sometimes
Configurable
Configurable
Reports Binary Input Change Events when no specific

variation requested:
Reports time-tagged Binary Input Change Events when no

specific variation requested:
Never
Only time-tagged
Only non-time-tagged
Configurable, Sequence of event conception
Never
Binary Input Change With Time
Binary Input Change With Relative Time
Configurable
Sends Unsolicited Responses:
Sends Static Data in Unsolicited Responses:
Never
Configurable
Only certain objects
Sometimes (attach explanation)
ENABLE/DISABLE UNSOLICITED Function
codes supported
Never
When Device Restarts
When Status Flags Change
No other options are permitted.
Default Counter Object/Variation:
Counters Roll Over at:
No Counters Reported
Configurable
Default Object: 20
Default Variation: Configurable
Point-by-point list attached
No Counters Reported
Configurable (attach explanation)
16 Bits
32 Bits
Other Value:
Point-by-point list attached
Sends Multi-Fragment Responses:

Yes

No
11
DNP3 Application Layer

The user sends Application User Data to the Application Layer where it is converted to ASDU (Application Service
Data Unit). In DNP, the Application User Data is converted into multiple ASDUs. Each ASDU is then prefixed by APCI
(Application Protocol Control Information) which is then packaged as an APDU. In DNP, each APDU that is part of the
larger multi-APDU is referred to as a fragment and there is a restriction that each fragment contains complete data
objects only and that the function code portion of the APCI (Application Protocol Control Information) is identical
in each fragment of the same message or multi-APDU. That is, there will be no fragmentation of information objects
between APDUs and the same operation must be requested of each object in the message. This is to ensure that
each fragment on its own can be processed and also implies that each ASDU contains only complete data objects. In
reverse, the Application Layer receives multiple APDU (one at a time) where it removes the APCI to obtain the ASDU
and assembles the ASDUs into Application User Data.
Protocol States
The following figure illustrates Application layer state flow diagram
3
Warm restart
Normal
Cold restart
Figure 1
Application layer state flow diagram
States description
State
Normal
Warm restart
Cold restart
12
Description
In this state the functions described in sections below are fully supported
In this state the functions described in sections below are supported
In addition the following actions are executed:
. Change event buffers are cleared
. Last reported binary counters are zeroed
. Last reported analogue inputs are zeroed
. Unsolicited response counter (refer to DNP3 application layer indication data) is zeroed
. Timeouts counter (refer to DNP3 application layer indication data) is zeroed
In this state the functions described in sections below are not supported
The following actions are executed:
. unsolicited response mode and DNP3 objects settings are cleared from RAM and
restored from flash memory
. 7-th internal indication bit in first octet is set to 1 (refer to Internal indications)
. if Unsolicited response mode is enable, NULL unsolicited response is sent (refer to
Unsolicited responses).
Transitions description
Transition
Condition
Reception of warm restart request (#3)
Reception of cold restart request (#2)
Execution of actions specified above for warm restart state (generally it takes from 10 to
100ms)
Reception of request for writing 0 into 8-th internal indication bit (#31)
Application layer settings

General settings
Setting
Applicable range
Factory default
Confirmation mode
Events only/Events and multi-fragments
Events and multi-fragments
Confirmation timeout
0 to 3600s
15s
Maximum fragment size
512 to 4096 octets
2048
Time synchronization
interval
0 to 64800 min
1440 min
Cold restart delay
0 to 65530 ms, step size 10 ms
5000ms
Warm restart delay
1000ms
Other settings are given in corresponding paragraphs of current section.
Binary Inputs
The following binary inputs are supported: Closed, Dummy on, Remote on, Lockout, AR initiated, Protection active, RC door open, RCM fault, Malfunction, Warning, Prot on, AR on, EF on, SEF on, HL on,
ABR on, Group 1 on, Group 2 on, Group 3 on, Group 4 on, UD signal (1...12) on, IOI input (1...12) on.
Binary inputs settings

Applicable range
Factory default
Enable/Disable
Enable for Dummy on, Closed, Remote on, Lockout, AR initiated,

RC door open, Malfunction, Warning, Prot on, AR on, EF on,
SEF on, HL on, Group 1 on, Group 2 on, Group 3 on, Group 4
on; Disable for others
Index
0 to 999
1 for Dummy on; 2 for Closed; 3 for Remote on; 4 for

Lockout; 5 for AR initiated; 6 for RC door open; 7 for
Malfunction; 8 for Warning; 9 for Prot on; 10 for AR on; 11
for EF on; 12 for SEF on; 13 for HL on; 14 for Group 1 on,
15 for Group 2 on, 16 for Group 3 on, 17 for Group 4 on; NA
for others
Class
0/1/2/3
1 for Lockout; 2 for Malfunction; 3 for Warning; 0 for others
Setting
Mode
13
The binary input data field consists of one binary octet. Each bit has particular title as indicated in the table below
Bit #
Bit titl
Activation/deactivation conditions
ONLINE
Always set to 1
RESTART
Always set to 0
COMM_LOST
Always set to 0
REMOTE_FORCED
Always set to 0
LOCAL_FORCED
Always set to 0
CHATTER_FILTER
Always set to 0
RESERVED
Always set to 0
STATE
Always repeats to corresponding binary signal
Bits sequence is as follows: 76543210

Binary inputs are requested/responded in different formats (variations).
The following table presents overview of the applicable variations
Variation #
DNP3 title
Description
Size
Binary input without status
7-th bit only
1 bit
Binary input with status
The entire octet
1 octet
Binary inputs change event

When 7-th bit of a particular binary input mapped for Class 1, 2 or 3 changes, new value of this binary input together
with relevant date and time is added into Change event binary inputs buffer. Fig.1 and attached table illustrate an
example of evolution of change event binary inputs buffer for the particular dynamics of a 7-th bit of a binary input
having Index 1 and mapped for Class 1 (taken for example and assuming that this binary input has been the only one
mapped for Class 1, 2 or 3 and being subject for change within analyzed timeframe).
Figure 2
Analyzed dynamics of the 7-th bit
14
Reference time
Change event binary inputs buffer

Index
Class
Binary input
Absolute time
T1
1000 0001
t1
1000 0001
t2
0000 0001
t2
1000 0001
t1
0000 0001
t2
1000 0001
t3
1000 0001
t1
0000 0001
t2
1000 0001
t3
0000 0001
t4
T2
T3
T4
Stored values of binary inputs are downloaded from buffer following relevant solicited and unsolicited responses. In
case of solicited response only requested data is downloaded (refer to the description of solicited responses below).
In case of class I (I=1/2/3) unsolicited response all binary inputs mapped for class I are downloaded (refer also to
description of unsolicited responses below). This buffer is also cleared in Warm or Cold restart states (refer also to
Application layer states description).
Binary Outputs
The list of binary outputs is given in Table below.
Event signal generated at binary
output deactivation
Set Dummy on
Event signal generated at

binary output activation
Set Dummy on from TCI
Set Dummy off from TCI
Close
Close request from TCI
Trip request from TCI
Set Prot on
Set Prot on from TCI
Set Prot off from TCI
Set AR on
Set AR on from TCI
Set AR off from TCI
Set EF on
Set EF on from TCI
Set EF off from TCI
Set HL on
Set HL on from TCI
Set HL off from TCI
Set ABR on
Set ABR on from TCI
Set ABR off from TCI
Set Group 1 on
Set Group1 on from TCI
NA
Set Group 2 on
NA
Set Group 3 on
NA
Set Group 4 on
NA
Erase protection counters
Erase protection counters from TCI
NA
Erase energy meters
Erase energy meters from TCI
NA
Erase logs
Erase logs from TCI
NA
Erase TCI counters
Erase TCI counters from TCI
NA
Erase UD counters
Erase UD counters from TCI
NA
Set UD signal (1...12) on
Set UD signal (1...12) on from TCI
Set UD signal (1...12) off from TCI
Binary output
15
Binary outputs settings

Setting
Applicable range
Mode
Enable/Disable
Index
0 to 999
Factory default
Enable for Dummy on, Closed, Prot on, AR on, EF on, SEF
on, HL on, Group 1 on, Group 2 on, Group 3 on, Group 4 on;
Disable for others
1 for Dummy on; 2 for Closed; 3 for Prot on; 4 for AR on; 5 for
EF on; 6 for SEF on; 7 for HL on; 8 for Group 1 on, 9 for Group 2
on, 10 for Group 3 on, 11 for Group 4 on; NA for others
The binary output data field consists of one binary octet. Each bit has particular title as indicated in the table below.
Bit titl
ONLINE
Always set to 1 when binary signal Remote on=1, set to 0 if

Remote on=0 for all binary outputs except of Trip; for which
always set to 1
RESTART
Always set to 0
COMM_LOST
Always set to 0
REMOTE_FORCED
Always set to 0
LOCAL_FORCED
Always set to 0
CHATTER_FILTER
Always set to 0
RESERVED
Always set to 0
1)
Bit #
STATE
If state is 0 it can be activated at reception request #12, #13 or

sequence of requests #10 and #11 split by time interval not
exceeding 5s if control code is Latch on/Pulse on or Close (the
latter for binary outputs Dummy on and Closed only) 1)
If state is 1 it can be deactivated at reception request #12, #13 or
sequence of requests #10 and #11 split by time interval not
exceeding 5s if control code is Latch off/Pulse off or Trip (the
latter for binary outputs Dummy on and Closed only) 1)
Refer also to description of the content of the data field for requests ##10-13
Bits sequence is as follows: 76543210

Binary outputs are requested/responded in different formats (variations).
16
Variation #
DNP3 title
Description
Size
Binary output without status
7-th bit only
1 bit
Binary output with status
The entire octet
1 octet
Binary Counters
The values of the following counters can be transmitted.
Data point
Designation
Range
A-phase active energy
Wa
0 to 9999999
B-phase active energy
Wb
0 to 9999999
C-phase active energy
Wc
0 to 9999999
Three-phase active energy
W3ph
0 to 9999999
A-phase reactive energy
Ea
0 to 9999999
B-phase reactive energy
Eb
0 to 9999999
C-phase reactive energy
Ec
0 to 9999999
Three-phase reactive energy
E3ph
0 to 9999999
BF trips
0 to 30000
OC trips
0 to 30000
EF trips
0 to 30000
SEF trips
0 to 30000
VU trips
0 to 30000
UV trips
0 to 30000
OV trips
0 to 30000
CU trips
0 to 30000
UF trips
0 to 30000
LS trips
0 to 30000
AR OC reclosures
0 to 30000
AR SEF reclosures
0 to 30000
AR UV reclosures
0 to 30000
AR OV reclosures
0 to 30000
AR UF reclosures
0 to 30000
ABR reclosures
0 to 30000
Total CO
0 to 30000
Mechanical wear
0 to 100
Contact wear
0 to 100
Load profile filling
0 to 100
Event log filling
0 to 100
Fault profile filling
0 to 100
Malfunction log filling
0 to 100
Change messages filling
0 to 100
Comms log filling
0 to 100
Transmitted frames
0 to 65535
Received frames
0 to 65535
CRC errors
0 to 65535
Timeouts
0 to 65535
Unsolicited responses
0 to 65535
Class 1 buffer filling
0 to 500
0 to 500
0 to 500
17
Binary counters settings

Setting
Mode
Enable/Disable
Factory default
Enable for Three phase active energy, Three phase reactive energy,
OC trips, EF trips, SEF trips, AR OC reclosures, AR SEF
reclosures, AR UV reclosures, AR UV reclosures, Mechanical wear,
Contact wear; Disable for others
0 to 999
1 for Three phase active energy, 2 for Three phase reactive energy, 3
for OC trips, 4 for EF trips, 5 for SEF trips, 6 for AR OC reclosures,
7 for AR SEF reclosures, 8 for Mechanical wear, 9 for Contact wear;
NA for others
Deadband
See analogue inputs

range
107 for XXX energy points, 104 for XXX trips, XXX reclosures and
Total CO points, 100 for XXX filling and XXX wear points, 65535 for
Transmitted frames, Received frames, CRC errors, Timeouts and
Class
0/1/2/3
Index
Applicable range
0 for all
The binary counters data field has the following structure

Field
Status
Value
Generation rule
Size (binary octets)
Applicable range
1 octet
NA
4 octets (32 bits)
0 to 232-1
Current value of corresponding

counter (refer also to the Table
above)
Refer to the table below
Each status bit has particular title as indicated in the table below
18
Bit #
Bit titl
ONLINE
Always set to 1
RESTART
Always set to 0
COMM_LOST
Always set to 0
REMOTE_FORCED
Always set to 0
LOCAL_FORCED
Always set to 0
ROLLOVER
DISCONTINUITY
RESERVED
Activates in the following cases:

. prior to generation solicited responses #9, #11 and #13 if counter
value exceed 216-1
. prior to generation unsolicited responses #5 and #7 if counter
value exceeds 216-1
. at addition new data into change event binary counter buffer if
binary counter default variation is 2 and its value exceeds 216-1
Deactivates in the following cases:
. prior to generation solicited responses #8, #10 and #12 or #9,
#11 and #13 if counter value does not exceed 216-1
. prior to generation unsolicited response #4 and #6 or #5 and #7 if
counter value does not exceed 216-1
. at addition new data into change event binary counter buffer if
binary counter default variation is 1 or 2 and its value does not
exceeds 216-1
. at counter erasure (i.e. when its value drops to 0)
Activates at counter erasure (i.e. when its value drops to 0)
Deactivates at first counter increment (following erasure)
Always set to 0
Status bits sequence is as follows 76543210

Binary counters are requested/responded in different formats (variations).
Variation #
DNP3 title
Description
Size
32-bit binary counter
Status field followed by Value field (in original 32bit format)
5 octets
Status field followed by 16-bit value transformed from

the 32-bit value presented in Value field. Transforma16-bit binary counter tion rule is as follows:
If original value exceeds 216-1 resultant value is 216-1
Otherwise all bits are the bits of the original value
3 octets
Last reported binary counters and change event binary counters

When difference between value of a particular binary counter mapped for Class 1, 2 or 3 and its last reported value
reaches selected deadband (refer to Binary counters settings) new last reported value of this counter is generated.
Simultaneously this value together with relevant date and time is added into Change event binary counters buffer.
Fig. 2 and attached table illustrate an example of evolution of last reported value and change event binary counters
buffer for the particular dynamics of a binary counter value having index 7 and mapped for Class 2 (taken for example
and assuming that this counter has been the only one mapped for Class 1, 2 or 3 and being subject for change within
analyzed timeframe).
Figure 3
Analyzed dynamics of the counter value (Deadband
for this counter in the present example is set to 4)
Reference time
Last reported
value
Index
Status
Value
Absolute time
Class
T1
0000 0001
t1
T2
0000 0001
t1
0000 0001
t2
0000 0001
t1
0000 0001
t2
0000 0001
12
t3
0000 0001
t1
0000 0001
t2
0000 0001
12
t3
0000 0001
16
t4
T3
T4
12
16
Stored values of binary counters are downloaded from buffer following relevant solicited and unsolicited responses. In
case of solicited response only requested data is downloaded (refer to the description of solicited responses below).
In case of class I (I=1/2/3) unsolicited response all binary counters mapped for class I are downloaded (refer also to
description of unsolicited responses below). This buffer is also cleared in Warm or Cold restart states (refer also to
Application layer states description).
Last reported binary counters are zeroed in Warm or Cold restart states (refer also to Application layer states
description).
19
Analogue Inputs
The analogue inputs listed in table below are supported.
Data point
A-phase current
B-phase current
C-phase current
Residual current
Positive sequence current
Negative sequence current
Positive sequence voltage related to Source +
Positive sequence voltage related to Source Negative sequence voltage related to Source +
Negative sequence voltage related to Source Frequency measured from Source +
Frequency measured from Source A-phase power factor
B-phase power factor
C-phase power factor
Three-phase power factor
A-phase to earth voltage from Source +
A-phase to earth voltage from Source B-phase to earth voltage from Source +
B-phase to earth voltage from Source C-phase to earth voltage from Source +
C-phase to earth voltage from Source AB phase-to-phase voltage from Source +
AB phase-to-phase voltage from Source BC phase-to-phase voltage from Source +
BC phase-to-phase voltage from Source CA phase-to-phase voltage from Source +
CA phase-to-phase voltage from Source A-phase active power
B-phase active power
C-phase active power
Three phase active power
A-phase reactive power
B-phase reactive power
C-phase reactive power
Three phase reactive power
Residual battery capacity
MPM manufacturing number
PSM manufacturing number
DRVM manufacturing number
A-phase fault current
B-phase fault current
C-phase fault current
Residual fault current
Positive sequence fault current
Negative sequence fault current
Positive sequence fault voltage
Negative sequence fault voltage
Fault frequency
20
Designation
Range
Coefficient
Ia
Ib
Ic
In
I1
I2
U1 +
U1 U2 +
U2 F+
FPFa
PFb
PFc
PF3ph
Ua +
Ua Ub +
Ub Uc +
Uc Uab +
Uab Ubc +
Ubc Uca +
Uca Pa
Pb
Pc
P3ph
Qa
Qb
Qc
Q3phc
0 to 7000
0 to 7000
0 to 7000
0 to 7000
0 to 7000
0 to 7000
0.0 to 18.0
0.0 to 18.0
0.0 to 18.0
0.0 to 18.0
40.00 to 65.00
40.00 to 65.00
-1.00 to 1.00
-1.00 to 1.00
-1.00 to 1.00
-1.00 to 1.00
0.0 to 18.0
0.0 to 18.0
0.0 to 18.0
0.0 to 18.0
0.0 to 18.0
0.0 to 18.0
0 to 30000
0 to 30000
0 to 30000
0 to 30000
0 to 30000
0 to 30000
-65535 to 65535
-65535 to 65535
-65535 to 65535
-65535 to 65535
-65535 to 65535
-65535 to 65535
-65535 to 65535
-65535 to 65535
0 to 100
0 to 2147483648
0 to 2147483648
0 to 2147483648
0 to 7000
0 to 7000
0 to 7000
0 to 7000
0 to 7000
0 to 7000
0.0 to 18.0
0.0 to 18.0
0.0 to 65.00
1
1
1
1
1
1
10
10
10
10
100
100
100
100
100
100
10
10
10
10
10
10
10
10
10
10
10
10
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
10
10
100
Analogue inputs settings

Setting
Applicable range
Factory default
Enable/Disable
Enable for A-phase current, B-phase current, C-phase current,

Residual current, Frequency measured from Source+ side, Frequency
measured from Source- side, Three phase power factor; Disable for
others
Index
0 to 999
1 for A-phase current, 2 for B-phase current, 3 for C-phase current,

4 for Residual current, 5 for Frequency measured from Source +side,
6 for Frequency measured from Source- side, 7 for Three phase power
factor; NA for others
Deadband
1 to 65535
Class
0/1/2/3
Mode
1000 for voltages, 100 for others
0 for all
The analogue input data field has the following structure

Size
(binary octets)
Applicable range
Refer to the table below
1 octet
NA
Current value of corresponding numerical value

multiplied by relevant transformation
coefficient (refer to table above)
4 octets
0 to 232-1
Field
Status
Analogue input value
Generation rule
Each status bit has particular title as indicated in the table below
Bit #
Bit titl
ONLINE
Always set to 1
RESTART
Always set to 0
COMM_LOST
Always set to 0
REMOTE_FORCED
Always set to 0
LOCAL_FORCED
Always set to 0
Activates in the following cases:
. prior to generation solicited response #15, #17 and #19 if
absolute value of analogue input exceeds 216-1
. prior to generation solicited response #9 and #11 if absolute
value of analogue input exceeds 216-1
OVER_RANGE
REFERENCE_ERR
Always set to 0
RESERVED
Always set to 0
Status bits sequence is as follows 76543210

Analogue inputs are requested/responded in different formats (variations).
21
Variation #
DNP3 title
Description
Size
32-bit analogue input
Status field followed by 16-bit value transformed

from the value presented in Value field.
Transformation rules are as follows:
7-th (sigh) bit of the second octet of the resultant
value is always the 7-th (sigh) bit of the forth octet of
16-bit binary counter
the original value.
If absolute original value exceeds 215-1, all bits of the
resultant value (except of the sign bit) are 1
Otherwise all bits (except of the sign bit) are
corresponding bits of the original value
Status field followed by Value field in original

(32-bit) format
5 octets
3 octets
Last reported analogue inputs and change event analogue inputs

When difference between value of a particular analogue input mapped for Class 1, 2 or 3 and its last reported value
exceeds selected deadband (refer to Analogue inputs settings) new last reported value of this input is generated.
Simultaneously this value together with relevant date and time is added into Change event analogue inputs buffer.
Fig. 3 and attached table illustrate an example of evolution of last reported value and change event analogue input
buffer for the particular dynamics of an analogue input value having index 5 and mapped for Class 3 (taken for
example and assuming that this analogue input has been the only one mapped for Class 1, 2 or 3 and being subject
for change within analyzed timeframe).
Figure 4
Analyzed dynamics of the analogue input value
(Deadband for this analogue input is set to 50)
Last reported
value
Index
Status
Value
Absolute time
Class
T1
50
0000 0001
50
t1
T2
100
0000 0001
50
t1
0000 0001
100
t2
0000 0001
50
t1
0000 0001
100
t2
0000 0001
150
t3
0000 0001
50
t1
0000 0001
100
t2
0000 0001
150
t3
0000 0001
100
t4
T3
T4
22
Reference time
150
100
Stored values of analogue inputs are downloaded from buffer following relevant solicited and unsolicited responses.
In case of solicited response only requested data is downloaded (refer to the description of solicited responses
below). In case of class I (I=1/2/3) unsolicited response all analogue inputs mapped for class I are downloaded
(refer also to description of unsolicited responses below). This buffer is also cleared in Warm or Cold restart states
(refer also to Application layer states description).
Last reported analogue inputs are zeroed in Warm or Cold restart states (refer also to Application layer states
description).
Strings
Data point
Value
MPM software version
S02.06.0X:MPM/TEL-04E v XX.YY1)
1) - X and Y varies from 0 to 9
Strings settings
Setting
Applicable range
Factory default
Mode
Enable/Disable
Enable for all
Index
0 to 999
1 for MPM software version
Default Variations
Applicable range
Factory
default
Binary input Object 01
1 (Binary input)/ 2 (Binary input with status)
Binary input Object 02
1 (Binary input change event without time)/ 2 (Binary input change

event with time)/ 3 (Binary input change event with relative time)
Binary output Object 10
1 (Binary output)/ 2 (Binary output status)
Binary counter Object 20
32-bit binary counter)/ 2 (16-bit binary counter)
1 (32-bit counter change event)/ 2 (16-bit binary counter without

time)/ 5 (32-bit counter change event with time)/ 6 (16-bit binary
counter with time)
1 (32-bit analogue input)/ 2 (16-bit analogue input)
Analogue input Object 32
1 (32-bit analogue change event without time)/ 2 (16-bit analogue

change event without time)/ 3 (32-bit analogue change event with
time)/ 4 (16-bit analogue change event with time)
Volts (V) / Kilovolts (kV)
Kilovolts (kV)
Setting
Units of voltage points
Change Event Buffers

Change event binary inputs
This file is arranged as a FIFO buffer containing up to 500 readings.
Each reading includes the following fields
Field
Size
Index
2 octets
Binary input
1 octet
Absolute time
6 octets
Class
3 bits
23
Data related to each reading (binary input value and absolute time) are requested/responded in different formats
(variations).
The following table presents overview of the variations applicable within the scope of the present implementation
Variation #
DNP3 title
Description
Size
Change event binary input without time
Binary input field
1 octet
Change event binary input with time
Binary input field followed by Absolute

time field
7 octets
Change event binary counters

Field
Size
Index
2 octets
Status
1 octet
Value
4 octets
Absolute time
6 octets
Class
3 bits
Data related to each reading (value, status and absolute time) are requested /responded in different formats
(variations).
Variation #
DNP3 title
32-bit change event binary

counter without time
Status field followed by Value field
5 octet

counter without time

the value presented in Value field1)
3 octets

counter with time
Status field followed Value field followed by Absolute

time field
11 octets

counter with time

the value presented in Value field1), followed by
Absolute time field
9 octets
1)
Description
for transformation rules refer to Binary counters
Change event analog inputs

24
Field
Size
Index
2 octets
Value
4 octet
Status
1 octets
Absolute time
6 octets
Class
3 bits
Size
Data related to each reading (value, status and absolute time) are requested /responded in different formats
(variations).
Variation #
DNP3 title
32-bit change event analogue

input without time
Status field followed by Value field
5 octet

input without time

the value presented in Value field1)
3 octets

input with time
Status field followed Value field followed by

Absolute time field
11 octets

input with time

the value presented in Value field1), followed by
Absolute time field
9 octets
1)
Description
Size
for transformation rules refer to Analogue inputs
Internal Indications
First octet
1)
Bit
Activation/Deactivation conditions
IIN1.0
Activates after reception broadcast message, i.e. message with slave address fitting
the range 65533-65535 (refer also to data link settings)
Deactivates after reception another request or after unsolicited response
IIN1.1
Activates when binary input, binary counter or analogue input mapped for class 1 is
logged into change event buffer.
Deactivates when all binary inputs, binary counters or analogue inputs mapped for
class 1 are downloaded from change event buffers
IIN1.2
IIN1.3
IIN1.4
Activates when time synchronization interval 1) expired since last time

synchronization procedure
Deactivates after time synchronization
IIN1.5
Activates/deactivates at deactivation/activation binary input Remote on
IIN1.6
Activates/deactivates at activation/deactivation binary input Internal fault
IIN1.7
Activates after reception cold restart request (#2)

Deactivates after reception request for writing 0 into 8-th internal indication bit (#31)
Refer to general settings
25
Second octet
Bit
Activation/Deactivation conditions
IIN2.0
Activates after reception request with invalid function code

Deactivates after reception request with valid function code or after generation
unsolicited response
IIN2.1
Activates after reception request with invalid object or variation code

Deactivates after reception request with valid object or variation code or after
generation unsolicited response
IIN2.2
Activates after reception request with invalid qualifier, range or data fields
Deactivates after reception request with valid qualifier, range or data fields or after
generation unsolicited response
IIN2.3
Activates at overflow of any change event buffer

Deactivates when buffer overflow is eliminated
IIN2.4
Not supported within the scope of the present implementation (always set to 0)
IIN2.5
Not supported within the scope of the present implementation (always set to 0)
IIN2.6
Reserved (always set to 0)
IIN2.7
Reserved (always set to 0)
DNP3 Application Requests

Application request format
Application request represents a binary file comprising in general case of the several fragments.
At this each fragment contains in general case the following fields: request header, object header and data. Object
header-data fields in general case are repeated several times in one request.
Table below represents general structure of the request fragment having two object header-data fields (taken for
example)
Field
Subfield
Application control
1 octet
Used for data flow control, in particular

defines first/last fragment in the request, etc
Function code
1 octet
Defines function to be performed
Object group
1 octet
Defines DNP3 objects for which mentioned

function shall be applied
Variation
1 octet
Defines format in which data related to the

mentioned objects shall be responded
Qualifier
1 octet
Defines size and content of the range field
Range
From 0 to 4 octets 1)
Defines range of data for which mentioned

function shall be applied
Data
Data
Depends on the content

of the response 2)
Object header
See above
See above
See above
Data
See above
See above
See above
Request header
Object header
Meaning
Defines data that shall be processed

(applicable only for requests 10-13 and 23
as defined in the section below)
1) depending on the qualifier, refer also to the object header content description
2) refer also to the section describing content of the data field
26
Application control
The following table presents description of the particular bits of the application control
Description
Bit #
Bit title
FIR
FIN
Last fragment bit; set by master station to 1 for the last fragment in relevant
application request
CON
Meaningless to requests; always set to 0
UNS
Meaningless to requests; always set to 0
3 to 0
SEQ
Sequence; indicates fragment sequence number; master station increments this number
by 1 with any new fragment sent; after reaching 15 master station turns this number to
0 at sending next fragment
First fragment bit; set by master station to 1 for the first fragment in relevant
application request
Valid object header and function codes

The following table presents all values of function codes, object groups, variations, qualifiers and ranges relevant for
valid requests within the scope of the present DNP3 implementation (where FUN stays for Function code, OBJ
stays for Object group, VAR stays for Variation, Q stays for Qualifier).
#
FUN
OBJ
VAR
RANGE
Meaning
NA
NA
NA
NA
Confirmation message
13
NA
NA
NA
NA
Request for DNP3 cold restart
14
NA
NA
NA
NA
Request for DNP3 warm restart
0/1/2
0x00/0x01
nm 1)
0/1/2
0x06
NA
Request for reading all enabled binary inputs
0/1/2
0x06
NA
Request for reading all change event binary inputs
0/1/2
0x07/0x08
n 2)
Request for reading n latest values of the change

event binary inputs
10
0/1/2
0x00/0x01
nm 1)
Request for reading enabled binary outputs having

indexes 3) from n to m
10
0/1/2
0x06
NA
10
12
0x17/0x28
Request for selecting binary output
11
12
0x17/0x28
Request for operating pre-selected binary output
12
12
0x17/0x28
Request for operating binary output (that has not

been pre-selected)
13
12
0x17/0x28
Request for operating binary output (that has not

been pre-selected) without response
14
20
0/1/2
0x00/0x01
nm 1)
15
20
0/1/2
0x06
NA
Request of reading all enabled binary counters
16
22
0/1/2/5/6
0x06
NA
Request of reading all change events binary counters
17
22
0/1/2/5/6
0x07/0x08
n 2)

event binary counters
18
30
0/1/2
0x00/0x01
nm 1)
Request for reading enabled binary inputs having

Request for reading all enabled binary outputs
Request for reading enabled binary counters having

Request for reading enabled analogue inputs having

27
FUN
OBJ
VAR
RANGE
19
30
0/1/2
0x06
NA
Request for reading all enabled analogue inputs
20
32
0/1/2/3/4
0x06
NA
Request for reading all change event analogue inputs
21
32
0/1/2/3/4
0x07/0x08
n 3)

event analogue inputs
22
50
0/1
0x07
Request for reading absolute time
23
50
0x07
Request for writing absolute time
24
60
0x06
NA
Request for reading all enabled data points mapped

for class 0 3)
25
60
2/3/4
0x07/0x08
n 2)

event binary inputs, binary counters or analogue
inputs mapped for class 1/2/3 3)
26
20
60
2/3/4
0x06
NA
Request for enabling Class 1/2/3 unsolicited responses
27
21
60
2/3/4
0x06
NA
Request for disabling Class 1/2/3 unsolicited responses
60
1/2/3/4
0x06
NA
0x00/0x01
nm 1)
Request for assigning Class 0/1/2/3 to:

. enabled binary inputs having indexes3) from n to m
0x06
NA
20
0x00/0x01
nm 1)
20
0x06
NA
284)
22
nm
1)
. all enabled binary inputs

. enabled binary counters having indexes3) from n to m
. all enabled binary counters
. enabled analogue inputs having indexes3) from n to m
30
0x00/0x01
30
0x06
NA
. all enabled analogue inputs

Request for measuring communication channel delay
time
29
23
NA
NA
NA
NA
30
80
0x00/0x01
nm 4)
31
80
0x00/0x01
77
32
110
0x00/0x01
nm 1)
33
110
0x06
NA
1) Notation
Meaning
Request for reading internal indications having

Request for writing 0 into internal indication bit
having index 6) 7
Request for reading enabled strings having indexes 3)
from n to m
Request for reading all enabled strings
nm means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is
ranged from 0 to 255; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 1000. These
values are also referred to as start-stop indexes
2) For qualifiers 0x07 and 0x17 n is a single octet value ranged from 0 to 255; for qualifiers 0x08 and 0x28 n is
a double octet value ranged from 0 to 1000
3) Refer to Application layer: Binary inputs/Binary counters/Analogue inputs settings
4) Notation nm means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is
ranged from 0 to 15; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 15. These values
are also referred to as start-stop indexes
5) Strings 2 to 6 in this request are optional, though at least one must present
6) Refer to Internal indications
28
Data field content for request ##10-13

For requests ##10-13 data field includes a single index-object code combination
If requested qualifier is 17 index field consists of 1 octet and is ranged from 0 to 255; it consists of two octets and is
ranged from 0 to 1000 if qualifier is 28.
Each object code consists of 11 octets. The following table describes object coding relevant for the present
implementation
Data field
Size
Meaning
Range
Control code
1 octet
Defines operation to be performed
Count
1 octet
Determines how many times the control shall be executed 1)
On time
4 octets
Defines output activation time after request acceptance 2)
0 to 2 32-1
Off time
4 octets
Defines output deactivation time after request acceptance 2)
0 to 2 32-1
Status
1 octet
Meaningless for request
1/2/3/4/64/128 3)
1
1)
Always 1 within the scope of the present implementation

Any value ignored within the scope of the present implementation, refer also to Application layer: Binary outputs
3)
These codes are also referred to as Pulse on/Pulse off/Latch on/Latch off/Trip/Close correspondingly
2)
Data field content for request #23

For request #23 data field includes 6 octets, reflecting absolute time counted in ms since Jan 1 1970.
DNP3 Application Responses

Solicited Responses
Solicited responses are generated following requests from master station. If total response size exceeds maximum
fragment size (refer to general settings) it is split into fragments not exceeding this value.
If confirmation mode is set for Events only for responses containing change events (## 3, 4, 10-13, 16-19) RC
interrupts transmission after each fragment waiting for the confirmation from master station during selected
confirmation timeout. RC restarts transmission after reception confirmation from master station or expiration
confirmation timeout.
If confirmation mode is set for Events and multi-fragments RC provides similar behaviour for other multi-fragment
responses.
In all other cases RC transmits requested data without intentional interruptions.
Solicited response represents a binary file comprising in general case of the several fragments.
Each fragment in general case has the following fields: response header, object header and data. Object header-data
fields in general case are repeated several times in one response.
Table below represents general structure of the response having two object header-data fields (taken for example)
29
Field
Subfield
Meaning
Application control
1 octet
Used for data flow control, in particular defines

first/last fragment in the response, whether
confirmation is requested, etc
Function code
1 octet
Defines response as solicited (function code 129)
Internal indications
2 octets
Contains information about success/failure to

explicitly execute request
Object group
1 octet
Defines responded DNP3 object
Variation
1 octet
Defines format of the responded data
Qualifier
1 octet
Range
From 0 to 8 octets 1)
Response header
Object header
1)
2)
Defines range of responded data
Depends on the content In general case contains responded data and its
of the response 2)
indexes
Data
Data
Object header
See above
See above
See above
Data
See above
See above
See above
depending on the qualifier as described in Valid object header - data combinations

refer to the description of the data field content in Valid object header - data combinations
Application control (see table below)

Generation rules
Bit #
Bit title
FIR
FIN
Set to 1 if particular fragment is the last one in relevant response. Always set to 1 for
single-fragment responses
CON
Set to 1 if confirmation mode is Events and multi-fragments (refer to general settings)
UNS
Always set to 0 for solicited response
3 to 0
SEQ
This value increments by 1 at generation each solicited response. If this value reaches
15 it will be set to 0 for the next solicited response
Set to 1 if particular fragment is the first one in relevant response. Always set to 1 for
Function code - responded function is 129.

Internal indications (see relevant section above).
30
Object header-data combinations

If request is invalid RC responds with the response #21 (empty response).
RC may respond with one or several object header-data fields to each requested object header-data fields. Several
object header-data fields are responded if within requested range some particular objects are disabled. For example,
if requested range is 09 (n=0, m=9) and objects having indexes 3, 4 and 6 are disabled; respond will contain three
object header-data fields having ranges 02, 55, and 79.
The following table presents correlation between valid requests and object header-data fields of relevant responses.
For content of particular requests and responses refer to corresponding sections.
Object header-data fields #(s)

in relevant response
Request #
Number of object header-data fields
NA
NA
NA
NA
NA
NA
1/2, if requested VAR=1/2 or if requested

VAR=0 and default VAR=1/2 1)
Several if there are disabled binary inputs within nm

range, else 1

VAR=0 and default VAR=1/2
Several if there are disabled binary inputs within 0n

range, else 1

Always 1

Always 1

Several if there are disabled binary outputs within nm

range, else 1

Several if there are disabled binary outputs within 0n

range, else 1
10
Always 1
11
Always 1
12
Always 1
13
NA
Always 1
14

Several if there are disabled binary counters within nm

range, else 1
15

Several if there are disabled binary counters within 0n

range, else 1
16
10/11/12/13, if requested VAR=1/2/5/6 or

Always 1
requested VAR=0 and default VAR=1/2/5/6
17

Always 1
18
14/15, if requested VAR=1/2 or if requested VAR=0 and default VAR=1/2
Several if there are disabled analogue inputs within nm

range, else 1
19
14/15, if requested VAR=1/2 or if requested VAR=0 and default VAR=1/2
Several if there are disabled analogue inputs within 0n

range, else 1
20

Always 1
21
16/17/18/19, if requested VAR=1/2/3/4

or if requested VAR=0 and default
VAR=1/2/3/4
Always 1
22
20
Always 1
23
20
Always 1
31
Object header-data fields #(s)

in relevant response
Request #
24
25
1)
Number of object header-data fields
1/2, if default VAR=1/2
Several if there are disabled binary inputs within the

range of binary inputs mapped for Class 0, else 1
Several if there are disabled binary counters within the

range of binary counters mapped for Class 0, else 1
Several if there are disabled analogue inputs within the

range of analogue inputs mapped for Class 0, else 1
Always 1
10/11/12/13, if default VAR=1/2/5/6
Always 1
16/17/18/19, if default VAR=1/2/3/4
Always 1
26
NA
NA
27
NA
NA
28
21
Always 1
29
22
Always 1
30
23
Always 1
31
NA
NA
32
24
Several if there are disabled strings within nm range, else 1
33
24
Several if there are disabled strings inputs within 0n

range, else 1
This notation shall be read as follows: Response #1 if requested variation is 1 or if requested variation is 0 and
default variation is 1; Response #2 if requested variation is 2 or if requested variation is 0 and default variation is 2
Status codes for response #7

The following table describes conditions of generation of particular status codes for response #7.
Note that if several conditions are in force status code related to higher priority condition will be responded. These
priorities are as follows (from high to low): NO_SELECTTIMEOUTFORMAT_ERRORNOT_SUPPORTEDLOCAL
ALREADY_ACTIVESUCCESS
32
Generation condition
Status code
Code title
SUCCESS
In all cases except of the listed below
TIMEOUT
At reception request #11 preceded by request #10 received 5s before and earlier
NO_SELECT
FORMAT_ERROR
At reception requests ##10-13 with control codes other than Latch on/Latch
off/Pulse on/Pulse off/Close/Trip
NOT_SUPPORTED
At reception requests ##10-13 with control codes Close/Trip for another than
Dummy on and Closed binary input
ALREADY_ACTIVE
At reception requests ##10-13 with control code Latch on/Pulse on/Close (the
latter for binary inputs Dummy on and Closed only) for binary output which
state is 1
At reception requests ##10-13 with control code Latch off/Pulse off/Trip (the
latter for binary inputs Dummy on and Closed only) for binary output which
state is 0
LOCAL
At reception requests ##10-13 when RC is in local mode (except of reception

requests ##10-13 with control codes Latch off/Pulse off/Trip applied for binary
output Closed)
At reception request #11 that has not been preceded by request #10
Valid object header data combinations

The following table describes object header-data fields valid within the scope of the present implementation, where
OBJ stays for Object group, VAR for Variation, Q for Qualifier.
#
1
2
OBJ
VAR
RANGE
DATA
0x00/0x01
ij 1)
7-th (state) bits of binary inputs having indexes 5) ranged from i to j

(refer also to section below)
0x00/0x01
ij 1)
Binary inputs having indexes 5) ranged from i to j
2)
n pairs of index 5)-change event binary input without time 6)
0x17/0x28
0x17/0x28
n 2)
n pairs of index 5)-change event binary input with time 6)
10
0x00/0x01
ij 1)
7-th (state) bits of binary outputs having indexes 5) ranged from i to

j (refer also to section below)
10
0x00/0x01
ij 1)
Binary outputs having indexes 5) ranged from i to j
12
0x017/0x08
20
0x00/0x01
ij 1)
32-bit binary counters having indexes 5) ranged from i to j
20
0x00/0x01
ij 1)
16-bit binary counters having indexes 5) ranged from i to j
10
22
0x17/0x28
n 2)
n pairs of index 5)-32-bit change event binary counter without time
2)
n pairs of index 5)-16-bit change event binary counter without time
Refer to section below
11
22
0x17/0x28
12
22
0x17/0x28
n 2)
n pairs of index 5)-32-bit change event binary counter with time
13
22
0x17/0x28
n 2)
n pairs of index 5)-16-bit change event binary counter with time
14
30
0x00/0x01
ij 1)
32-bit analogue inputs having indexes 5) ranged from i to j
15
30
0x00/0x01
ij 1)
16-bit analogue inputs having indexes 5) ranged from i to j
16
32
0x017/0x08
n pairs of index 5)-32-bit change event analogue input without time
17
32
0x017/0x08
n 2)
n pairs of index 5)-16-bit change event analogue input without time
18
32
0x017/0x08
n 2)
n pairs of index 5)-32-bit change event analogue input with time
2)
n pairs of index 5)-16-bit change event analogue input with time
19
32
0x017/0x08
20
51
NA
NA
NA
Absolute time
NA
NA
NA
NA
NA
22
52
0x07
18
23
80
0x00/0x01
ij 4)
Current values of internal indication bits having indexes ranged from

i to j
24
110
29 3)
0x00/0x01
ij 1)
Current values of strings having indexes 5) ranged from i to j
21
7)
1) Notation ij means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is
ranged from 0 to 255; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 1000. These
values are also referred to as start-stop indexes
2) For qualifier 0x17 n and index in data field are single octet values ranged from 0 to 255; for qualifier 0x28 n
and index in data field are double octet values ranged from 0 to 1000
3) Responded string length (always 29 within the present implementation)
4) Notation ij means sequence of two numerical values; for qualifier 0x00 each value is a single octet one, and is
ranged from 0 to 15; for qualifier 0x01 each value is a double octet one, and is ranged from 0 to 15. These values
are also referred to as start-stop indexes
5) Refer to Application layer: Binary inputs/Binary outputs/Binary counters/Analogue inputs/ Strings settings
6) For details refer to Internal indications
7) Empty response including just response header field
33
Data field structure for response #1 and #5

State bits of the requested binary inputs/outputs in this response are packed into integer number of octets. State bit
of the binary input/output with index i has the lowest order. State bit of the binary input/output with index i+1 has
next order to the lowest one, and so on. Bits related to not requested binary inputs/outputs are zero. For example for
the object header-data fields 1 with the range field is 35, assuming that binary inputs 3, 4 and 5 have state bits 1,
0 and 1 respectively, data field will be represented by a single octet 0000 0101 (0x05 in hexadecimal format).
Data field content for response #7
Data field includes a single index-object code combination
Each object code consists of 11 octets. The following table describes object coding relevant for the present
implementation (for details refer also to DNP3 Specification: Object library)
1)
2)
3)
Data field
Size
Meaning
Range
Control code
1 octet
Defines performed operation
Count
1 octet
Determines how many times the control has been executed 1)
On time
4 octets
Meaningless within the scope of the present implementation
0 to 10 32-1
Off time
4 octets
Meaningless within the scope of the present implementation
0 to 10 32-1
Status
1 octet
Contains information about success/failure to execute

requested operation and failure reason (if applicable)
1/2/3/4/64/128 2)
0 to 5, and 7 3)
Always 1 within the scope of the present implementation

These codes are also referred to as Pulse on/Pulse off/Latch on/Latch off/Trip/Close correspondingly
Refer also to Application layer: Solicited responses
Unsolicited Responses
Unsolicited responses may be of 1/2/3 class.
Class I (I=1/2/3) unsolicited response is initiated when Unsolicited response mode=Enable (refer to Unsolicited
response settings), i-th minus one bit of unsolicited response mask is 1, and when total number of binary signals,
binary counters and analogue events stored in relevant change event buffers and mapped for class I exceeds selected
threshold level (refer also to Unsolicited responses settings). After each unsolicited response RC waits for
confirmation request from master station during selected Confirmation timeout (refer to general settings). If
confirmation is not received within this time interval, RC resends unsolicited response after selected Retry delay
(refer to general settings). Number of unsolicited response retries is determined by likely general setting. If after all
responses confirmation still has not been received, RC resumes another batch of retries following selected Offline
interval (refer to general settings). This rules apply for the entire unsolicited response if its size does not exceed
Maximum fragment size (refer to relevant general setting) or if confirmation mode is set to Events only.
If unsolicited response size exceeds Maximum fragment size and confirmation mode is set to Events and
multi-fragments this rule applies for each fragment. The following picture presents an example of data flow for
unsolicited response consisting of two fragments with the Number of retries set to 2
Figure 5
Example of unsolicited response generation
34
UR stays for Unsolicited response, CON for Confirmation message (refer also to Application layer responses),
DT for Data transfer, Trd for Retry delay, Toff for Offline interval, Tcon for Confirmation timeout.
Unsolicited response represents a binary data file comprising in general case of the several fragments.
Each fragment contains in general case the following fields: response header, object header and data. Object
header-data fields are generally repeated several times in one response.
Table below represents general structure of unsolicited response having two object header-data fields (taken for
example)
Field
Subfield
Application
control
1 octet
Response header
Function code 1 octet
Meaning
Used for data flow control, in particular defines first/
last fragment in the response, whether confirmation is
requested, etc; refer to Application layer description
for details
Defines response as unsolicited (function code 130)
Internal
indications
2 octets
Contains information about success/failure to explicitly

execute request
Object group
1 octet
Defines responded DNP3 object
Variation
1 octet
Defines format of the responded data
Qualifier
1 octet
Range
1 or 2 octets depending on the qualifier

(refer to the table
below)
Defines range of responded data
Data
Data
From 1 to 11 octets
depending on the
content of reported
data
Contains responded data
Object header
See above
See above
See above
Data
See above
See above
See above
Count
Application control (see table below)

Generation rules
Bit #
Bit title
FIR
FIN
Set to 1 if particular fragment is the last one in relevant response. Always set to 1 for
CON
Always set to 1 for unsolicited responses
UNS
Always set to 1 for unsolicited responses
3 to 0
SEQ
This value increments by 1 at generation each unsolicited response. If this value reaches
15 it will be set to 0 for the next unsolicited response
Set to 1 if particular fragment is the first one in relevant response. Always set to 1 for
Function code - Responded function is 130.

Internal indications, refer to relevant section for details.
35
Object header-data combinations

In general case unsolicited response includes several object header-data fields ##2-11.
Number of these fields corresponds to Class I (I=1/2/3) threshold level (refer to Unsolicited response settings), i.e.
number of Class I events stored in all change event buffers at the moment of unsolicited response generation.
Object header-data fields start from the earliest change event.
Responded variations of the change event binary inputs/binary counters/analogue inputs coincide with their default
variations (refer to Default variations settings).
Qualifier is 0x17 when responded object index fits the range from 0 to 255 and to 0x28 when this index exceeds 255.
Valid object header-data combinations

The following table presents object header-data fields valid within the scope of the present implementation (OBJ
stays for Object group, VAR for Variation, Q for Qualifier).
1)
2)
3)
OBJ
VAR
NA 1) NA 1)
RANGE
NA 1)
NA 1)
DATA
NA
0x17/0x28
Combination of index 2)-change event binary input without time 3)
0x17/0x28
Combination of index 2)-change event binary input with time 3)
22
0x17/0x28
Combination of index 2)-32-bit change event binary counter without time 3)
22
0x17/0x28
Combination of index 2)-16-bit change event binary counter without time 3)
22
0x17/0x28
Combination of index 2)-32-bit change event binary counter with time 3)
22
0x17/0x28
Combination of index 2)-16-bit change event binary counter with time 3)
32
0x17/0x28
Combination of index 2)-32-bit change event analogue input without time 3)
32
0x17/0x28
Combination of index 2)-16-bit change event analogue input without time 3)
10
32
0x17/0x28
Combination of index 2)-32-bit change event analogue input with time 3)
11
32
0x17/0x28
Combination of index 2)-16-bit change event analogue input with time 3)
This unsolicited response is also called NULL unsolicited response

For index meaning refer to Application layer: binary inputs/binary counters/analogue inputs settings; for qualifier
0x17 index is a single octet value ranged from 0 to 255, for qualifier 0x28 index is a double octet value ranged
from 256 to 1000;
For details refer to Change event buffers
Unsolicited response settings
36
Setting
Applicable range
Factory default
Unsolicited response mode
Enable/Disable
Enable
Class 1 threshold level
1 to 500
1 to 500
1 to 500
Retry delay
1 to 86400s
60s
Number of retries
0 to 255
255
Offline interval
0 to 86400s
300s
Unsolicited respons mask

The unsolicited mask data field includes three bits having the following order
Bit #
I-th bit of unsolicited response mask is activated following request 26 with VAR=I+1 (where I has range from 1
to 3)
I-th bit of unsolicited response mask is deactivated following request 27 with VAR=I+1 (where I has range from 1
to 3)
Uploading Settings via DNP3

Classes for particular data points are assigned following reception of request #28
Control Command Set date and time

This control command is activated at reception request #23.
The absolute time field of this command is the data field of the said request.
Applications Layer Indication Data

Data point
Generation rules
Timeouts
Increments with appearance of every confirmation timeout, drops to zero at generation

event signal Erase TCI counters
Increments with appearance of every unsolicited response, drops to zero at generation event
signal Erase TCI counters
The number of binary inputs, binary counters and analogue inputs currently stored in
relevant change event buffers and mapped for class 1
Last timeout time
Date and time of last confirmation timeout appearance
Last unsolicited
response time
Date and time of last appearance of unsolicited response
37
DNP3 Transport Layer

Transport layer serves two main functions:
. it assembles application layer request fragments from transport layer requests
. it disassembles application layer solicited and unsolicited responses into sequence of transport layer responses
This element does not have user configurable settings
Transport Layer Requests

Transport layer assembles each fragment of the application layer request from the valid sequence of relevant transport
layer requests. Sequence of transport layer requests is valid if it complies with the following rules:
. Requests have rising sequence number (SEQ subfield)

. First segment has FIR bit raised
. The other segments have FIR bit set to 0
. Last segment has FIN bit raised
. The other segments have FIN bit set to 0
In this case relevant application layer request fragment is the sequence of data presented in transport layer requests.
For example, the following sequence of transport layer requests (segments) is valid:
Transport layer request 1: FIN=0 FIR=1 SEQ=23 Data=Block1
It will result in assembly of the application layer request fragment consisting of the data blocks 1, 2 and 3
Transport layer request with FIR and FIN bit raised corresponds to single-frame application layer request. In this case
it presents the data carried by relevant transport layer request.
Transport layer requests represent binary files (also referred to as transport segments) comprising in general case of
the header block followed by data block. Table below represents general structure of the transport layer request
Field
Subfield
Size
FIN
1bit
Last segment bit; when set indicates that this particular

segment is the last one in relevant application fragment
FIR
1bit
First segment bit; when set indicates that this particular

segment is the first one in relevant application fragment
(refer also to Application requests)
SEQ
6bits
Sequence; indicates frame sequence number; master station

increments this number by 1 with any new segment sent;
after reaching 63 master station turns this number to 0 at
sending next segment
NA
From 1 to 249 octets Data used for configuration application layer requests
Transport header
Data
38
Meaning
Transport Layer Responses

If particular fragment of solicited or unsolicited application layer response has such a size (S) that the
value (IM(S)1) + R(S)2) + 2 + 10) exceeds maximum frame size (refer to Data link settings) transport layer
disassembles this response into sequence of several transport responses.
At this each transport layer response starts with the transport header as described in Transport layer responses.
Transport layer raises FIR bit for the first segment in said sequence, and FIN bit for the last one. The value set in SEQ
subfield increments by 1 at generation each transport layer response. If this value reaches 63 it will be set to 0 for
the next transport layer response.
If size of the particular solicited or unsolicited response does not exceed 249, transport layer forms a single transport
layer response where data carried by this response corresponds to the said solicited/unsolicited response.
Transport layer responses represent binary files (also referred to as transport segments) comprising in general case of
the header block followed by data block. Table below represents general structure of the transport layer response
1)
Integer multiply modulo 16

2) Remainder modulo 16
Field
Transport header
Data
Subfield
Size
Meaning
FIN
1bit
Last segment bit; when set indicates that this particular

segment is the last one in relevant application fragment
(refer also to Solicited/Unsolicited responses)
FIR
1bit
First segment bit; when set indicates that this particular

segment is the first one in relevant application fragment
(refer also to Solicited/Unsolicited responses)
SEQ
6bits
Sequence; indicates response transport segment sequence

number; for generation details refer to Transport layer
description
NA
From 1 to 249 octets
Application layer data; for generation details refer to

Transport layer description
39
DNP3 Data Link Layer

Data link layer provides bi-directional data transport (from master station to RC transport layer and vise versa).
In masterslave data transfer direction this is achieved by:
. Configuration data received from master station into frames having defined structure;
. Rejection frames with invalid structure.
It slavemaster data transfer direction data link layer assures delivery of data received from Transport layer into
master station using mechanism of confirmations.
Data link layer settings

3
Name
Applicable range
Factory default
Master address
0 to 65534
Slave address
0 to 65534
Confirmation mode
Never/Sometimes/Always
Never
Confirmation timeout
0 to 60s
3s
Maximum retries
0 to 255
Maximum frame size
1)
64 to 292
2
1)
292
Validate master address
Enable/Disable
Disable
Self-addressing
Enable/Disable
Enable
When it is 292, includes data link header (10 octets) and 16 user data blocks; 15 of which contain 18 octets
(16 for user data and 2 for CRC) and the last one 12 octets (10 for user data and 2 for CRC)
Data Link Layer RC Requests

RC requests are generated following acceptance of relevant transport layer responses. At this all data presented in
transport layer response are used as user data in RC data link layer request. The other fields of the request are filled
following description presented in RC requests. If Confirmation mode (refer to settings) is set to Always RC
repeats the request after expiration of time interval Confirmation timeout if during this time interval positive
acknowledgement has not been received from master station (refer also to Data link layer master responses). At
this total number of retries does not exceed set up value of Maximum retries (refer to settings) even if no
confirmation from master station is received.
These requests represent binary files comprising in general case of the header block followed by optional data blocks
(up to 16 of them). This file is often referred to as a frame. Table below represents structure of the frame having
two user data blocks (taken as example)
40
Field
Subfield
START
2 octets
The first octet is always 0x05

The second octet is always 0x64
1 octet
The LENGTH subfield specifies the count of non-CRC

octets which follow in the header and data blocks. This
count includes the CONTROL, DESTINATION and SOURCE
subfields in the header and the USER DATA subfields in
the body. CRC subfields are not included in the count.
The minimum value for this subfield is 5, indicating
only the header is present, and the maximum value is
255.
CONTROL
1 octet
The CONTROL subfield contains information about

frames direction, transmission initiator, data flow
control and function to be performed. For details refer
also to the table below
DESTINATION
2 octets
This subfield contains master station address for RC

requests
SOURCE
2 octets
This subfield contains slave station (RC) address for RC

requests
CRC
2 octets
16-bit CRC; includes START, LENGTH, CONTROL,

DESTINATION and SOURCE subfields
USER DATA
16 octets for all but

last user data blocks
CRC
2 octets
USER DATA
From 0 to 16 octets
the last user data
block which is not
16-th;
From 0 to 10 octets
for 16-th user data
block
CRC
2 octets
LENGTH
Header Block
(Block 0)
User Data Block 1
User Data Block 2
Meaning
User data to be transferred to master station

16-bit CRC; includes all USER DATA related to relevant
user data block
User data to be transferred to master station

user data block
The following table describes detail structure of the CONTROL subfield relevant for master station requests.
Bits
Size (in bits)
Meaning
DIR
1 bit
Direction control bit; always 0 for RC requests
PRM
1 bit
Primary message bit; always 1 for RC request
FCB
1 bit
This bit is meaningless for RC requests; always 0
DFC
1 bit
Data flow control bit; defines whether RC is capable of

accepting new request with user data
FUNCTION CODE
4 bits
Defines function to be performed:

3 deliver user data with acknowledgement
4 deliver user data without acknowledgement
41
The following table describes length, control and user data fields relevant for valid RC requests (other fields are the
same for all RC request; they are described in the general request structure presented above).
1)
Length
Control
User data
Meaning
6+N
0x43 or 0x53 1)
1 transport layer octet and N

application layer octets
Deliver user data with confirmation
6+N
0x44 or 0x54 1)

Deliver user data without confirmation
DFC bit is activated/deactivated depending on data link layer ability to accept new requests containing user data;
refer also to Data link layer description for details
Data Link Layer RC Responses

The following table describes correlation between master station requests and relevant RC responses.
Master station request
Relevant RC response
Reset link states
Positive acknowledgement
Test link states
Not applicable
Request link status
Link status
Request with not-supported function
Link service not supported
Invalid request
Negative acknowledgement
Note that master station requests are recognized as invalid in the following cases:
. Any CRC sum is corrupted (refer also to Data link layer master requests)
. Slave address received from master station (refer to data link layer master requests) does not comply with the
Slave address (refer to settings) with Self-addressing set to Disable (refer to settings)
. Slave address received from master station (refer to Data link layer master requests) complies neither with the
Slave address nor the broadcast address 0xFF 0xFC with Self-addressing set to Enable
. Master address received in master station request (refer to relevant section) does not comply with the Master
address (refer to settings) when Validate master address setting is set to Enable
. Request has been received during Confirmation timeout interval (refer to settings) after generation RCE request
with Confirmation mode setting being set to Always
. For Test link states and Deliver user data with confirmation requests has FCB bit different from what is expected
by DNP3 data link layer (data link layer expects this bit to be 1 in the request following Reset link states request;
and then being toggled after each RC Positive acknowledgment response)
42
These requests are consequently responded with the negative acknowledgement.

The data link layer responses represent binary sequence comprising of the header block having the following structure.
Field
Subfield
START
2 octets
The first octet is always 0x05.

The second octet is always 0x64.
LENGTH
1 octet
Always 5 for RC responses
CONTROL
1 octet

frames direction, transmission initiator, ability to
accept new master station requests containing user
data and requests acceptance. For details refer also to
the table below
DESTINATION
2 octets

responses
SOURCE
2 octets

responses
CRC
2 octets
16-bit CRC. START, LENGTH, CONTROL, DESTINATION and

SOURCE subfields are included when calculating this CRC
Header Block
(Block 0)
Meaning
The following table describes detail structure of the CONTROL subfield relevant for master station responses.
Bits
Size (in bits)
DIR
1 bit
Direction control bit; defines transmission direction;

always 0 for RC responses
PRM
1 bit
Primary message bit; defines transmission initiator;

always 0 for RC responses
FCB
1 bit
This bit is meaningless for RC responses; always 0
DFC
1 bit
Data flow control bit; defines whether RC is capable of

accepting new request with user data
FUNCTION CODE
4 bits
Meaning
Defines result of the requested function processing:

0 positive acknowledgement
1 negative acknowledgement
11 Report link status request successfully processed;
link status reported
15 requested function is not supported
The following table describes control subfields relevant for valid RC responses (other fields are the same for all RC
responses; they are described in the general response structure presented above).
Control
Meaning
0x00 or 0x10 1)
1)
Positive acknowledgment; request has been accepted
0x01 or 0x11
1)
Negative acknowledgement; request has not been accepted
0x0B or 0x1B
1)
Response to Request link status request
0x0F or 0x1F
1)
Requested function code is not supported
DFC bit is activated/deactivated depending on data link layer ability to accept new requests containing user data;
refer also to Data link layer description for details
43
Data Link Layer Master Requests

These requests represent binary files comprising in general case of the header block followed by optional user data
blocks (up to 16 of them). This file is often referred to as a frame. Table below represents structure of the frame
having 2 user data blocks (taken for example).
Field
Subfield
START
2 octets

1 octet
The LENGTH subfield specifies the count of non-CRC

octets which follow in the header and data blocks. This
count includes the CONTROL, DESTINATION and SOURCE
subfields in the header and the USER DATA subfields in
the body. CRC subfields are not included in the count.
The minimum value for this subfield is 5, indicating
only the header is present, and the maximum value is
255.
CONTROL
1 octet

frames direction, transmission initiator, data flow control and function to be performed. For details refer also
to the table below
DESTINATION
2 octets
For master station requests this subfield contains either

slave station (RC) address or broadcast (0xFF 0xFC)
address
SOURCE
2 octets
This subfield contains master station address for master

station requests
CRC
2 octets
16-bit CRC; includes START, LENGTH, CONTROL, DESTINATION and SOURCE subfields
USER DATA
16 octets for all but

last user data blocks
CRC
2 octets
LENGTH
3
Header Block
(Block 0)
User Data Block 1
USER DATA
User Data Block 2
CRC
44
Meaning
User data to be transferred to transport layer

user data block
From 0 to 16 octets
for the last user data
block which is not
16-th;
User data to be transferred to transport layer
From 0 to 10 octets
for 16-th user data
block
2 octets

user data block
The following table describes the structure of the CONTROL subfield relevant for master station requests.
Bits
Size (in bits)
Meaning
DIR
1 bit
Direction control bit; always 1 for master station requests
PRM
1 bit
Primary message bit; always 1 for master station request
1 bit
Frame count bit; master station toggles this bit every

time after reception RC response with positive
acknowledgement (refer also to section Data link layer
RC responses)
1 bit
Frame count valid bit; master station raises this bit when
slave station (RC) must check FCB bit; this is relevant
only for Test link states and Deliver user data with
confirmation requests (refer to the list of valid requests
below)
4 bits
Defines function to be performed:

0 reset link states
2 test link states
3 deliver user data with confirmation
4 deliver user data without confirmation
9 report link status
5,6,7,8,10,11,12,13,14,15 function not supported
(reserved)
FCB
FCV
FUNCTION CODE
The following table describes length, control and user data fields relevant for valid master station requests (other
fields are the same for all master station requests; they are described in the general request structure presented above).
1)
2)
3)
4)
5)
Length
Control
User data
Meaning
0xC0
NA
Reset link states 1)
0xF2 or 0xD2 2)
NA
Test link states 3)
6+N
0xF3 or 0xD3 2)

6+N
0xE4 or 0xC4 2)

0xE9 or 0xC9 2)
NA
Report link status 4)
0xEX or 0xCX 5)
NA
Request with not supported (reserved)

function
This request is used for synchronization data link; after its reception slave station expects next request with FCB
bit raised
Master station toggles FCB bit every time after reception Positive acknowledgement response. Therefore valid
request is determined by previous data exchange history: if previous request (preceding Positive acknowledgement
response) had FCB bit set to 1, valid request must have FCB bit set to 0; and vice versa
This request generally follows Reset link states requests; it is used to check that data link is synchronized, i.e.
slave receives FCB bit in accordance with its expectations
This is a dummy request used for receiving DFC bit only, i.e. getting information whether RC is ready to accept
next request containing user data
X=5,6,7,8,A,B,C,D,E,F
45
Data Link Layer Master Responses

These responses represent binary files comprising of the header block having the following structure
Field
Subfield
Meaning
START
2 octets

LENGTH
1 octet
Always 5 for master station responses
1 octet
The CONTROL subfield contains information about frame

direction, transmission initiator, data flow control and
RC requests acceptance. For details refer also to the
table below
CONTROL
Header Block
(Block 0)
DESTINATION 2 octets

responses
SOURCE
2 octets

responses
CRC
2 octets
16-bit CRC. START, LENGTH, CONTROL, DESTINATION and

SOURCE subfields are included when calculating this CRC
The following table describes detail structure of the CONTROL subfield relevant for master station responses.
Bits
Size (in bits)
Meaning
DIR
1 bit
Direction control bit; defines transmission direction;

always 1 for master station responses
PRM
1 bit
Primary message bit; defines transmission initiator;

always 0 for master station responses
FCB
1 bit
Frame count bit; This bit is not used in Master responses;

always 0
DCF
1 bit
Data flow control bit; defines whether Master station is

capable of accepting new request with user data
FUNCTION CODE
4 bits
Defines result of the requested function processing:

0 positive acknowledgement
1 negative acknowledgement
The following table describes control subfields relevant for valid RC responses (other fields are the same for all RC
responses; they are described in the general response structure presented above).
Control
Meaning
0xA0 or 0x80 1)
0xA1 or 0x81
1)
46
1)
Positive acknowledgment; request has been accepted

Negative acknowledgement; request has not been accepted
Master station toggles FCB bit every time after reception Positive acknowledgement response
Data link layer indication data

Data point
Transmitted frames
Received frames
CRC errors
Last transmitted frame time

Last received frame time
Last CRC error time
Generation rule
Each frame transmitted to physical layer increments this
counter by unit;
The value drops to 0 in two cases:
. at next increment after reaching 65535
. at activation Erase TCI counters control signal
Each frame received from physical layer increments this counter
by unit;
Each discovered CRC error increments this counter by unit;

Absolute time corresponding to transmission of the last frame
to physical layer
Absolute time corresponding to reception of the last frame from
physical layer
Absolute time corresponding to discovery of the last CRC error
Physical Layer
Physical layer provides interface between selected RTU and communication protocols via RS232 port. Functionality of
physical layer depends on the selected RTU.
Physical layer settings include settings of RS232 port and RTU settings. Refer to Section Application guide for
details of configuration of settings.
Direct connection and Converters do not have user configurable settings.
47
Port Settings
Port RS232 settings shall fit settings of the selected RTU RS232 port. For settings details refer to Hardware
specification section and TIA/EIA-232-F and ITU v.28 standard requirements.
Setting
48
Applicable range
Factory default for

Factory default
Phone modem, GSM Factory default
for
modem and direct for radio modem
RS485-232
connection
converter
Baud rate
300/600/1200/2400/4800/9600/
115200
19200/38400/57600/115200
1200
115200
Duplex mode
Half/Full
Full
Half
Half
Parity
None/ Even/Odd
None
None
None
Stop bits
1/2
DTR mode
Ignore/Control
Control
Ignore
Ignore
DTR on level
High/Low
High
High
High
RTS mode
Ignore/ Flow Control/Control PTT
Flow Control
Control PTT
Ignore
RTS on level
High/Low
High
High
High
DSR mode
Ignore/Monitor High/Monitor Low Monitor High
Ignore
Ignore
CTS mode
Ignore
Ignore
DCD mode
Monitor High
Ignore
Inactivity time
0 to 600 s
180 s (for modem),

15 s (for direct)
15 s
15 s
DTR low time
50 to 5000ms, step size 10ms
500 ms
500 ms
500 ms
DCD fall time
700 ms
700 ms
700 ms
Transmission delay 0 to 5000 ms, step size 10 ms
50 ms
50 ms
Pre-transmission
time
0 to 5000 ms
10 ms
5 ms
Post-transmission
time
0 to 5000 ms
10 ms
5 ms
RTU supply check
Enable/Disable
Enable
Enable
Enable
CA mode
Enable/Disable
NA
Enable
Enable
CA min idle time
NA
2000 ms
2000 ms
CA max
random delay
NA
5000 ms
5000 ms
RTU Settings
Radio Modem Settings
Setting
Applicable Rang
Factory default
Preamble
Enable/Disable
Disable
Preamble char
Preamble last char
0x00 to 0xFF
1)
0x55
0x00 to 0xFF
1)
0xFF
Repeat count
0 to 25
Phone Modem and GSM Modem Settings

Setting
Line mode
Autodial interval
Dial prefix
1)
2)
Applicable Rang
Leased/Switched
0 to 255 s
String, starting with command prefix
32 chars max length
2),
Factory default for

Phone Modem
Factory default for GSM
Switched
NA
ATD
ATD
Dial numbers
String, containing 5 dialing numbers 2),

32 chars max length for each string
NA
NA
Init string
String, starting with command prefix 2),

255 chars max length
ATZ
ATZ
Hang up command

ATH
ATH
Off hook command

None
None
Auto answer On

ATS0=2
ATS0=2
Auto answer Off

ATS0=2
ATS0=2
Connection timeout
0 to 255 s
60 s
60 s
Response time
0 to 255 s
3s
3s
Disable
Disable
Not Assigned
Not Assigned
Protection mode
Enable/Disable
Trusted numbers
String, containing 5 dialing numbers 2),

32 chars max length for each string
Hexadecimal
For string format description refer to description of HY-YES compatible modems
49
TCI Indication Data

The following table describes generation rules related to TCI indication data.
Data point
Transmitted Bytes
Received Bytes
Collisions
3
Call attempts
Call un-answered
Call busy
Call drop outs
Incrementing condition
Erasure condition
Applicable RTU
Transmission of any byte results in

counter increment by unit
Activation of Erase TCI

counters control signal
All
Reception of any byte results in

counter increment by unit

All
Finding relevant frequency occupied

immediately before transmission
(due to activity of other radio
modem) results in counter increment
by unit

Radio modem, Converter
Any call attempt results in counter

increment by unit

Phone modem, GSM

modem
Unsuccessful call attempt due to

absence of answer results in counter
increment by unit

Phone modem, GSM

modem
Unsuccessful call attempt due to

status busy results in counter
increment by unit

Phone modem, GSM

modem
Premature interruption of
established communication link
given outstanding response results
in timer increment by unit

Phone modem, GSM

modem
RS232 standards are defined by EIA/TIA (Electronic Industries Alliance /Telecommunications Industry Association).
RS232 specifies both the physical and electrical characteristics of the interface. RS232 is practically identical to ITU
V.24 (signal description and names) and V.28 (electrical). RS232 is an Active LOW voltage driven interface and
operates at +12V to -12V where:

Signal = 0 (Low) > +3.0V

Signal = 1 (High) < -3.0V
For example, RC may command that DTR output be ignored and the hardware executes this command and puts - 12
volts on the DTR pin. A modem (or other device) that receives this DTR signal may behave in different ways. If a
modem has been configured a certain way, it will hang up the telephone line when DTR is ignored. Depending on
configuration the modem may ignore this signal or act in other way, when DTR is ignored (turned off).
The same is applicable for all 6 signal lines. RS232 Line signals are represented in Table bellow.
50
Signal
Designation
State
DCD
Data Carrier Detect
High /Low
DTR
Data Terminal Ready
High /Low
DSR
Data Set Ready
High /Low
RTS
Request To Send
High /Low
CTS
Clear To Send
High /Low
RI
Ring Indicator
High /Low
Modbus Protocol
51
Overview
MODBUS protocol is a messaging structure developed by Modicon in 1979, used for establishing master/client-server
communication between intelligent devices.
It is de-facto standard truly open and the most widely used network protocol in the industrial manufacturing
environment. Refer to www.modbus.org for details.
Only RTU serial transmission mode is supported in this implementation.
Downloading/uploading of settings and logs is not supported as Modbus has very limited support of file data transfer.
Application Layer
Settings
Application layer settings include the following groups of settings: coils, discrete inputs, holding registers and input
registers (see settings in corresponding paragraphs below).
Coils
The following coils are supported: Close, Set Dummy on, Set Prot on, Set AR on, Set EF on, Set SEF on,
Set HL on, Set ABR on, Set Group 1 on, Set Group 2 on, Set Group 3 on, Set Group 4 on, Erase protection
counters, Erase energy meters, Erase logs, Erase TCI counters, Set UD signal (1...12) on.
For each coil the following settings are applicable.
Setting
Applicable range
Factory default
Mode
Enable/Disable
Enable for Close, Set Dummy on, Set Prot on, Set AR on, Set EF
on, Set SEF on, Set HL on, Set ABR on, Set Group 1 on, Set Group
2 on, Set Group 3 on, Set Group 4 on; Disable for others
Enable/Disable
00001 to 00999
00001 for Close; 00003 for Set Dummy on; 00004 for Set Prot on;
00005 for Set AR on; 00006 for Set EF on; 00007 for Set SEF on;
00008 for Set HL on; 00009 for Set ABR on; 00010 for Set Group 1
on, 000011 for Set Group 2 on, 00012 for Set Group 3 on, 00013 for
Set Group 4 on; NA for others
Number
Value of an enabled J-th coil is set to 1 in the following cases:

. Reception request 5 with N=J-1 and M=0xFF00
. Reception request 7 if N+1JN+M and relevant value in the data field is 1
Value of an enabled J-th coil is set to 0 in the following cases:
. Reception request 5 with N=J-1 and M=0x0000
. Reception request 7 if N+1JN+M and relevant value in the data field is 0
52
Discrete Inputs
The following discrete inputs are supported: Closed, Dummy on, Remote on, Lockout, AR initiated,
Protection active, RC door open, RCM fault, Malfunction, Warning, Prot on, AR on, EF on, SEF on,
HL on, ABR on, Group 1 on, Group 2 on, Group 3 on, Group 4 on, UD signal (1...12) on, IOI input
(1...12) on.
For each discrete input the following settings are applicable
Setting
Mode
Number
Applicable range
Factory default
Enable/Disable
10001 for Dummy on; 10002 for Closed; 10003 for Remote on; 10004
for Lockout; 10005 for AR initiated; 10006 for RC door open; 10007
for Malfunction; 10008 for Warning; 10009 for Prot on; 10010 for
AR on; 10011 for EF on; 10012 for SEF on; 10013 for HL on; 10014
for ABR on; 10015 for Group 1 on; 10016 for Group 2 on; 10017 for
Group 3 on; 10018 for Group 4 on; NA for others
10001 to 10999
10001 for Dummy on; 10002 for Closed; 10003 for Remote on;
10004 for Lockout; 10005 for AR initiated; 10006 for RC door open;
10007 for Malfunction; 10008 for Warning; 10009 for Prot on; 10010
for AR on; 10011 for EF on; 10012 for SEF on; 10013 for HL on;
10014 for ABR on; 10015 for Group 1 on; 10016 for Group 2 on;
10017 for Group 3 on; 10018 for Group 4 on; NA for others
Holding Registers
Represent 2 octet binary files
The following holding registers are supported within the scope of the present implementation:
. Absolute time high
. Absolute time medium
. Absolute time low
. Year
. Month
. Hours
. Minutes
. Seconds
. Milliseconds
For each holding register the following settings are applicable.
Setting
Applicable range
Factory default
Mode
Enable/Disable
Enable for Absolute time high, Absolute time medium, Absolute time
low, Year, Month, Day, Hours, Minutes, Seconds, Milliseconds
40001 to 40999
40001 for Absolute time high; 40002 for Absolute time medium; 40003
for Absolute time low; 40004 for Year, 40005 for Month, 40006 for
Day, 40007 for Hours, 40008 for Minutes, 40009 for Seconds,
40010 for Milliseconds, NA for others
Number
Value of an enabled J-th holding register is the data field value in the following cases:
. Reception request 8 with N+1JN+3 if holding registers Absolute time high/medium/low have numbers
40001+N/40002+N/40003+N respectively
. Reception request 8 with N+1JN+7 if holding registers Year/Month/Day/Hour/Minutes/Seconds/Milliseconds have
numbers 40001+N/40002+N/40003+N/40004+N/40005+N/40006+N/40007+N respectively
53
Input Registers
The following input registers are supported within the scope of the present implementation:
Input register
54
Relevant indication
data point
Notation
Transformation
coefficient
A-phase current
A-phase current
UINT16
B-phase current
B-phase current
UINT16
C-phase current
C-phase current
UINT16
Residual current
Residual current
UINT16
UINT16
UINT16
Positive sequence voltage related to Source+
Positive sequence voltage

related to Source+
UINT16
10
Positive sequence voltage related to Source-

related to Source-
UINT16
10
Negative sequence voltage related to Source+
Negative sequence voltage

related to Source+
UINT16
10
Negative sequence voltage related to Source-

related to Source-
UINT16
10
Frequency measured from Source +
Frequency measured from

Source +
UINT16
100
Frequency measured from Source -
Frequency measured from

Source -
UINT16
100
A-phase power factor
UINT16
100
UINT16
100
UINT16
100
UINT16
100
A-phase to earth voltage from Source +
A-phase to earth voltage

from Source +
UINT16
10
A-phase to earth voltage from Source -
A-phase to earth voltage

from Source -
UINT16
10
B-phase to earth voltage from Source +
B-phase to earth voltage

from Source +
UINT16
10
B-phase to earth voltage from Source -
B-phase to earth voltage

from Source -
UINT16
10
C-phase to earth voltage from Source +
C-phase to earth voltage

from Source +
UINT16
10
C-phase to earth voltage from Source -
C-phase to earth voltage

from Source -
UINT16
10
AB phase-to-phase voltage from Source +
AB phase-to-phase voltage
from Source +
UINT16
10
AB phase-to-phase voltage from Source -
AB phase-to-phase voltage
from Source -
UINT16
10
BC phase-to-phase voltage from Source +
BC phase-to-phase voltage
from Source +
UINT16
10
BC phase-to-phase voltage from Source -
BC phase-to-phase voltage
from Source -
UINT16
10
CA phase-to-phase voltage from Source +
CA phase-to-phase voltage
from Source +
UINT16
10
CA phase-to-phase voltage from Source -
CA phase-to-phase voltage
from Source -
UINT16
10
Notation
Transformation
coefficient
A-phase active power
INT32
INT32
INT32
INT32
INT32
INT32
INT32
INT32
UINT16
INT32
INT32
DRVM manufacturing number low
DRVM manufacturing
number
INT32
UINT16
INT32
INT32
INT32
INT32
INT32
INT32
INT32
INT32
BF trips
BF trips
UINT16
OC trips
OC trips
UINT16
EF trips
EF trips
UINT16
SEF trips
SEF trips
UINT16
VU trips
VU trips
UINT16
UV trips
UV trips
UINT16
OV trips
OV trips
UINT16
Input register
A-phase active power high
A-phase active power low
B-phase active power high
B-phase active power low
C-phase active power high
C-phase active power low
Three phase active power high
Three phase active power low
A-phase reactive power high
A-phase reactive power low
B-phase reactive power high
B-phase reactive power low
C-phase reactive power high
C-phase reactive power low
Three phase reactive power high
Three phase reactive power low
MPM manufacturing number high
MPM manufacturing number low
PSM manufacturing number high
PSM manufacturing number low
DRVM manufacturing number high
A-phase active energy high

A-phase active energy low
B-phase active energy high
B-phase active energy low
C-phase active energy high
C-phase active energy low
Three-phase active energy high
Three-phase active energy low
A-phase reactive energy high
A-phase reactive energy low
B-phase reactive energy high
B-phase reactive energy low
C-phase reactive energy high
C-phase reactive energy low
Three-phase reactive energy high
Three-phase reactive energy low
Relevant indication
data point
55
Input register
CU trips
UF trips
LS trips
AR OC reclosures
AR SEF reclosures
AR UV reclosures
AR OV reclosures
AR UF reclosures
ABR reclosures
Total CO
Mechanical wear
Contact wear
Event log filling
Comms log filling
Transmitted frames (Modbus) high
Transmitted frames (Modbus) low
Received frames (Modbus) high
Received frames (Modbus) low

CRC errors (Modbus)
Timeouts (Modbus)
Exception responses
Relevant indication data

point
CU trips
UF trips
LS trips
AR OC reclosures
AR SEF reclosures
AR UV reclosures
AR OV reclosures
AR UF reclosures
ABR reclosures
Total CO
Mechanical wear
Contact wear
Event log filling
Comms log filling
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
UINT16
Transformation
coefficient
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
Transmitted frames (Modbus)
UINT32
Received frames (Modbus)
UINT32
CRC errors (Modbus)

Timeouts (Modbus)
Exception responses
UINT16
UINT16
UINT16
1
1
1
Notation
Values of input registers are generated on the basis of relevant indication data.
For indication data point using notation UINT16 (unsigned integer) relevant input register is generated with the aid
of the following procedure:
a) Indication data point is multiplied by relevant transformation coefficient
b) Resultant value is converted into 16-bit format
For indication data points using notation INT16 relevant input register generated with the aid of the following
procedure:
a) Absolute value of the indication data point is multiplied by relevant transformation coefficient
b) Resultant value is converted into 15-bit format
c) This value forms first 15-n bits of the input register
b) 16-th bit of this register is set to 0 if relevant indication data point is positive and 1 otherwise
For indication data point using notation UINT32 relevant input registers are generated with the aid of the following
procedure:
a) Indication data point is multiplied by relevant transformation coefficient
b) Resulting value is converted into 32-bit format
c) First 16 bits form input register ended with the word low
d) Bits from 17-th to 32-d form input register ended with the word high
For indication data point using notation INT32 relevant input registers are generated with the aid of the following
procedure:
a) Absolute value of the indication data point is multiplied by relevant transformation coefficient
b) Resulting value is converted into 31-bit format
c) First 16 bits form input register ended with the word low
d) Bits from 17-th to 31-st form first 15-n bits of the input register ended with the word high
e) 32-d bit of this register is set to 0 if relevant indication data point is positive and 1 otherwise
56
For each input register the following settings are applicable

Setting
Mode
Number
Applicable range
Enable/Disable
30001 to 30999
Factory default
Residual current, Positive sequence current, Negative sequence
current, Positive sequence voltage related to Source+ side, Positive
sequence voltage related to Source- side, Negative sequence voltage
related to Source+ side, Negative sequence voltage related to Sourceside, Frequency, indicated value of Source + side, Frequency, indicated
value of Source- side, A-phase power factor, B-phase power factor,
C-phase power factor, Three phase power factor, Three phase active
energy high, Three phase active energy low, Three phase reactive energy
high, Three phase reactive energy low, OC trips, EF trips, SEF trips,
AR reclosures, SEF reclosures, Mechanical wear, Contact wear,
Disable for others
30001 for A-phase current, 30002 for B-phase current, 30003 for
C-phase current, 30004 for Residual current, 30005 for Frequency
measure from Source +, 30006 for Frequency measured from source ,
30007 for Three phase power factor, 30008 for Three phase active
energy high, 30009 for Three phase active energy low, 30010 for Three
phase reactive energy high, 30011 for Three phase reactive energy low,
30012 for OC trips, 30013 for EF trips, 30014 for SEF trips, 30015 for
AR reclosures, 30016 for SEF reclosures, 30017 for Mechanical wear,
30018 for Contact wear, NA for others
Control Data
Event signals
Event signals are generated following relevant changes of coils as indicated in table below.
Event signal
Trip request from TCI
Close request from TCI
Set Dummy on from TCI
Set Dummy off from TCI
Set Prot on from TCI
Set Prot off from TCI
Set AR on from TCI
Set AR off from TCI
Set EF on from TCI
Set EF off from TCI
Set SEF on from TCI
Set SEF off from TCI
Set HL on from TCI
Set HL off from TCI
Set ABR on from TCI
Set ABR off from TCI
Set Group 1 on from TCI
Erase protection counters from TCI
Erase energy meters from TCI
Condition of generation
Coil "Close" is deactivated
Coil "Close" is activated
Coil "Set Dummy on" is activated
Coil "Set Dummy on" is deactivated
Coil "Set Prot on" is activated
Coil "Set Prot on" is deactivated
Coil "Set AR on" is activated
Coil "Set AR on" is deactivated
Coil "Set EF on" is activated
Coil "Set EF on" is deactivated
Coil "Set SEF on" is activated
Coil "Set SEF on" is deactivated
Coil "Set HL on" is activated
Coil "Set HL on" is deactivated
Coil "Set ABR on" is activated
Coil "Set ABR on" is deactivated
Coil "Set Group 1" on is activated
Coil "Erase protection counters" is activated
Coil "Erase energy meters" is activated
57
Event signal
Condition of generation
Erase logs from TCI
Coil "Erase logs" is activated
Erase TCI counters from TCI
Coil "Erase TCI counters" is activated
Set UD signal (1...12) on from TCI
Coil "Set UD signal (1...12) on" is activated
Set UD signal (1...12) off from TCI
Coil "Set UD signal (1...12) on" is deactivated
Set date and time request

This request is generated following acceptance request 8 resulted in writing new values to holding registers Absolute
time high/medium/low or Year/Month/Day/Hours/Minutes/Seconds/Milliseconds.
In the first case values of the holding registers Absolute time high/medium/low form highest, medium and lowest
pairs of octets of the absolute time.
In the second case absolute time in milliseconds is calculated on the basis of newly written values of holding
registers with reference to the 1-st of January 1970.
Modbus Application Responses

Application response represents a binary file comprising of function and data fields as indicated in the table below.
Field
Function code
1 octet
Data
58
Meaning
Defined function that has been performed
Depends on the content of the

Define data to which mentioned function applies
response (refer to the table below)
The following table represents all responses valid within the scope of the present implementation (where FUN stays
for function code)
FUN
Data
Data field size
PQ 1)
Response with the values of M sequential coils (for M

meaning refer to request 1)
PQ 2)
Response with the values of M sequential discrete

inputs (for M meaning refer to request 2)
PQ 3)
Response with the values of P/2 sequential holding

registers
PQ 4)
Response with the values of P/2 sequential input

registers
PQ 5)
4 octets
Response with the newly written value of the coil

having address P
PQ 6)
4 octets
Response with the newly written value of the holding

register having address P
15
PQ 7)
4 octets
Response confirming writing of Q sequential coils

having address starting with P
16
PQ 8)
4 octets
Response confirming writing of Q sequential holding

registers having address starting with P
128, 135148,151-250
1 octet
Exception response (i.e. claiming impossibility to

execute request) to invalid requested function
10
129, 130
1 octet
Exception response to invalid address of coil or

discrete input (in requests 1 or 2)
11
129, 130
1 octet
Exception response to invalid number of coils or

discrete inputs (in requests 1 or 2)
12
131, 132
1 octet
Exception response to invalid address of register (in

requests 3 or 4)
13
131, 132
1 octet
Exception response to invalid number of registers (in

requests 3 or 4)
14
133
1 octet
Exception response to invalid coil address (in request

5)
15
133
1 octet
Exception response to invalid coil value (in request 5)
16
133
1 octet
Local mode exception response (to request 5)
17
134
1 octet
Exception response to invalid holding register address

(in request 6)
18
134
1 octet
19
134
1 octet
Exception response to request 6 9)
20
149
1 octet
Exception response to invalid address of coils (in

requests 7)
21
149
1 octet
Exception response to invalid number of coils (in

request 7)
22
149
1 octet
23
150
1 octet
Exception response to invalid address of registers (in

request 8)
24
150
1 octet
Exception response to invalid number of registers (in

request 8)
25
150
1 octet
Exception response to non-consistent range of holding

registers or local mode exception response (to request 8)
Meaning
59
Application responses are generated following reception relevant application requests in accordance with the
following correlation table.
Application request
Relevant application
response
Valid request 1
Response 1
Valid request 2
Response 2
Valid request 3
Response 3
Valid request 4
Response 4
Valid request 5
Response 5
Valid request 6
Response 6
Valid request 7
Response 7
Valid request 8
Response 8
Any request with invalid function code
Exception response 9
Requests 1 or 2 referred to coil/discrete input numbers not fitting applicable range
Requests 1 or 2 with the number of coils/discrete inputs not fitting range 1 to 1000
Requests 3 and 4 referred to holding/input register numbers not fitting applicable range
Requests 3 and 4 with the number of registers not fitting range from 1 to 125
Request 5 referred to coil number not fitting applicable range
Request 5 with invalid coil value (neither 0xFF00 not 0x0000)
Request 5 when RC is set in local mode (does not apply to Trip request, i.e. setting 0 to
coil Close)
Request 6 referred to holding register number not fitting applicable range
Request 6 when RC is set in local mode
Request 6
Request 7 referred to coil numbers not fitting applicable range
Request 7 with the number of coils not fitting range from 1 to 1000
Request 7 when RC is set in local mode
Request 8 referred to holding register numbers not fitting applicable range
Requests 8 with the number of registers not fitting range from 1 to 123
Request 8 when RC is set in local mode or referred to non-consistent range of registers10) Exception response 25
1) Where
P is a single octet value ranged from 1 to 125, and Q is a value having P octets
P is a single octet value ranged from 1 to 125, and Q is a value having P octets
3) Where P is even, single octet value ranged from 2 to 250, and Q is a value having P octets
4) Where P is even, single octet value ranged from 2 to 250, and Q is a value having P octets
5) Where P and Q are double octet values such as P does not exceed 999 and Q is either 0xFF00 or 0x0000
6) Where P and Q are double octet values such as P does not exceed 999
7) Where P and Q are double octet values such as P+Q does not exceed 1000
8) Where P and Q are double octet values such as P+Q does not exceed 1000
9) In this implementation existing holding registers cannot be written separately (refer also to section Holding
registers in Modbus application layer
10) For details refer to section Holding registers
2) Where
60
The following table defines responded data for responses 1 to 8.

Response
Responded value of P
Responded value of Q
If N is divisible by 8, P=N/8; else

P=N/8+1
First M bits are current values of requested coils; remaining

P*8-M bits are set to 0
If N is divisible by 8, P=N/8; else

P=N/8+1)
First M bits are current values of requested discrete inputs;

remaining P*8-M bits are set to 0
2*M
First pair of octets is current value of holding register with

address N; second pair of octets is current value of holding
register with address N+1; and so on
2*M
First pair of octets is current value of input register with

address N; second pair of octets is current value of input
register with address N+1; and so on
0xFF00 if current value of coil with address N (P) is 1; else

0x0000
6-8
Modbus Application Layer Indication Data

Data point
Generation rule
Sending each exception response increments this counter by unit;
activation of Erase TCI counters event signal resets this counter to 0
Exception responses
Last exception response time
Date and time related to last sent exception response
Modbus Data Link Layer

Data Link Settings
Setting
Range
Factory default
Slave address
Automatic timeout mode
Reception timeout
From 1 to 247
Enable/Disable
From 1 to 60000 ms
1
Enable
500ms
Modbus Application Requests

Application request represents a binary file comprising of function and data fields as indicated in the table below.
Field
Function code
1 octet
Data
Meaning
Defined function to be performed
Depends on the content of the

Define data to which mentioned function shall be applied
request (refer to the table below)
61
The following table represents all requests valid within the scope of the present implementation (where FUN stays for
function code)
FUN
Data
Data field size
Meaning
NM 1)
4 octets
Request for reading M sequential coils having

numbers starting with N+1
NM 2)
4 octets
Request for reading M sequential discrete

inputs having number starting with N+10001
NM 3)
4 octets
Request for reading M sequential holding

registers having numbers starting with
N+40001
NM
4)
4 octets
Request for reading M sequential input

registers having numbers starting with
N+30001
NM 5)
4 octets
Request for writing (i.e. setting 1 or 0) a

single coil having number N+1
NM 6)
4 octets
Request for writing M (i.e. setting M value)

into a single holding register having number
N+10001
NMLK 7)
From 6 to 130
octets
Request for writing (i.e. setting 1 or 0) M

sequential coils having numbers starting with
N+1
NMLK 8)
From 7 to 251
octets
Request for writing (i.e. setting relevant value)

M sequential holding registers having numbers
starting with N+40001
Application request is generated following acceptance of the relevant Modbus master request, which is accepted
under the following conditions:
. Request contains address 0 or slave address 9)
. CRC has been received within selected reception timeout 10) after address acceptance if automatic timeout mode 11)
has been disabled
. CRC has been received during timeout of 4500/baud rate 12) if automatic timeout mode has been enabled
. CRC appeared to be correct
At this protocol unit data containing in master station request represents Modbus application request.
1) Where
N and M are double octet values such as N+M does not exceed 1000
N and M are double octet values such as N+M does not exceed 1000
3) Where N and M are double octet values such as N+M does not exceed 1000 and M does not exceed 125
4) Where N and M are double octet values such as N+M does not exceed 1000 and M does not exceed 125
5) Where N and M are double octet values such as N does not exceed 999 and M is either 0xFF00 or 0x0000
6) Where N and M are double octet values such as N does not exceed 999
7) Where N and M are double octet values such as N+M does not exceed 1000; L is a single octet value defining size
of K and equal to integral multiple of M or integral multiple of M plus 1 (depending on whether M is divisible by 8
or not), so it cannot exceed 125; K is a value having L octets and containing requested coils values
8) Where N and M are double octet values such as N+M does not exceed 1000 and M does not exceed 123; L is a
single octet value defining size of K, and equal to 2M, so it cannot exceed 246; K is a value having L octets and
containing requested registers values
9) Refer to relevant setting
12) Refer to relevant RS232 port setting for details
2) Where
62
Modbus Master Requests

These requests represent binary files comprising of slave address, protocol data unit and CRC fields as in indicated in
the table below
Field
Address
Protocol data unit
CRC
Meaning
Slave address ranged from 0 to 247; at this
address 0 corresponds to broadcast message
1 octet
From 5 to 252 octets depending on
the content of the request 1)
2 octets
Data to be transferred to Application layer

16-bit CRC (cyclic redundancy check)
Modbus RC responses
These responses represent binary files comprising of slave address, protocol data unit and CRC fields as in indicated in
the table below
Field
Address
Protocol data unit
CRC

1 octet
Meaning
Slave address ranged from 1 to 247
From 2 to 252 octets depending on

Data transferred from Application layer
the content of the response 2)
2 octets
16-bit CRC (cyclic redundancy check)
RC responses are generated following acceptance of relevant Modbus application responses. At this all data presented
in Modbus application response are used as Protocol data unit in Modbus RC data response. Data presented in
address field is Slave address (refer to section Settings). 16-bit CRC is calculated following standard rule.
1) Refer
2) Refer
also to Modbus application requests for details

also to Modbus application responses for details
63
Modbus data link layer indication data
Data point
Data type
Generation rule
Transmitted frames
Counter
Sending each Modbus RC response increments

this counter by unit; activation of Erase TCI
counters event signal resets this counter to 0
Range 0 to
65535
Received frames
Counter
Receiving each Modbus master request increments this counter by unit; activation of Erase
TCI counters event signal resets this counter to
0
Range 0 to
65535
CRC errors
Counter
Discovering each CRC error increments this counter by unit; activation of Erase TCI counters
event signal resets this counter to 0
Range 0 to
65535
Timeouts
Counter
Inability to receive CRC within set up timeout

increments this counter by unit; activation of
Erase TCI counters event signal resets this
counter to 0
Range 0 to
65535
Last transmitted frame

time
Date and time
Date and time related to last frame transmitted

to application layer
1 ms resolution
Last received frame time
Date and time
Date and time related to last frame received from

master station
1 ms resolution
Last CRC error time
Date and time
Date and time related to last discovered CRC

error
1 ms resolution
Last timeout time
Date and time
Date and time related to appearance of the last

timeout
1 ms resolution
Physical Layer
Refer to information presented in paragraph 3. DNP3 Protocol, subclause Physical layer.
64
Note
IEC 60870-5-104 Protocol
65
Overview
IEC 60870-5-104 (IEC 104) protocol is an extension of IEC 101 protocol with the changes in transport, network, link
& physical layer services to suit the complete network access. The standard uses an open TCP/IP interface to network
to have connectivity to the LAN (Local Area Network) and routers with different facility (ISDN, X.25, Frame relay etc.)
can be used to connect to the WAN (Wide Area Network). Application layer of IEC 104 is preserved same as that of IEC
101 with some of the data types and facilities not used. There are two separate link layers defined in the standard,
which is suitable for data transfer over Ethernet & serial line (PPP - Point-to-Point Protocol). The control field data of
IEC104 contains various types of mechanisms for effective handling of network data synchronization.
Interoperability List
This companion standard presents sets of parameters and alternatives from which subsets must be selected to
implement particular telecontrol systems. Certain parameter values, such as the choice of structured or
unstructured fields of the information object address of ASDUs represent mutually exclusive alternatives. This
means that only one value of the defined parameters is admitted per system. Other parameters, such as the listed set
of different process information in command and in monitor direction allow the specification of the complete set or
subsets, as appropriate for given applications. This clause summarizes the parameters of the previous clauses to
facilitate a suitable selection for a specific application. If a system is composed of equipment stemming from different
manufacturers, it is necessary that all partners agree on the selected parameters. The interoperability list is defined as
in IEC 60870-5-101 and extended with parameters used in this standard. The text descriptions of parameters which are
not applicable to this companion standard are strike-through (corresponding check box is marked black).
NOTE: In addition, the full specification of a system may require individual selection of certain parameters for certain
parts of the system, such as the individual selection of scaling factors for individually addressable measured values.
The selected parameters are marked in the white boxes as follows:
Function or ASDU is not used
X Function or ASDU is used as standardized (default)
R Function or ASDU is used in reverse mode
B Function or ASDU is used in standard and reverse mode

The possible selection (blank, X, R, or B) is specified for each specific clause or parameter.
A black check box indicates that the option cannot be selected in this companion standard.
System or device
(system-specific parameter, indicate definition of a system or a device by marking one of the following with X)
System definition (Definition for Master and Slave)
Controlling station definition (Master)
X Controlled station definition (Slave)
Network configuration
(network-specific parameter, all configurations that are used are to be marked X )
Point-to-point
Multipoint-partyline
66
Multiple point-to-point
Multipoint-star
Physical layer
(network-specific parameter, all interfaces and data rates that are used are to be marked X)
Transmission speed (control direction)
Unbalanced interchange
Circuit V.24/V.28
Circuit V.24/V.28
Standard
Recommended if >1200 bit/s
Balanced interchange
Circuit X.24/X.27
100 bit/s
2 400 bit/s
2 400 bit/s
56 000 bit/s
200 bit/s
4 800 bit/s
4 800 bit/s
64 000 bit/s
300 bit/s
9 600 bit/s
9 600 bit/s
600 bit/s
19 200 bit/s
1 200 bit/s
38 400 bit/s
Transmission speed (monitor direction)

Circuit V.24/V.28
Circuit V.24/V.28
Standard
Recommended if >1200 bit/s
Balanced interchange
Circuit X.24/X.27
100 bit/s
2 400 bit/s
2 400 bit/s
56 000 bit/s
200 bit/s
4 800 bit/s
4 800 bit/s
64 000 bit/s
300 bit/s
9 600 bit/s
9 600 bit/s
600 bit/s
19 200 bit/s
1 200 bit/s
38 400 bit/s
Link layer
(network-specific parameter, all options that are used are to be marked X. Specify the maximum frame length. If a
non-standard assignment of class 2 messages is implemented for unbalanced transmission, indicate the Type ID and
COT of all messages assigned to class 2.)
Frame format FT 1.2, single character 1 and the fixed time out interval are used exclusively in this companion
standard.
Link transmission procedure
Address field of the link
Balanced transmission
not present (balanced transmission only)
Unbalanced transmission
One octet
Frame length
Two octets
Maximum length L
(number of octets)
structured

unstructured
When using an unbalanced link layer, the following ASDU types are returned in class 2 messages
(low priority) with the indicated causes of transmission:
The standard assignment of ASDUs to class 2 messages is used as follows:
Type identification
Cause of transmission
9, 11, 13, 21 <1>

67
A special assignment of ASDUs to class 2 messages is used as follows:

Type identification
Note: (In response to a class 2 poll, a controlled station may respond with class 1 data when there is no class 2 data
available).
Application layer
Transmission mode for application data
Mode 1 (Least significant octet first), as defined in clause 4.10 of IEC 60870-5-4, is used exclusively in this
companion standard.
Common address of ASDU
(system-specific parameter, all configurations that are used are to be marked X)
One octet
Two octets
Information object address

One octet
Two octets
structured
X unstructured
X Three octets
One octet

X Two octets (with originator address). Originator address

is not used and set to zero.
Length of APDU
(system-specific parameter, specify the maximum length of the APDU per system) Length of the APDU must be
configurable with a maximum length of 253 (default). The maximum length may be reduced per system.
253 Maximum length of APDU per system (configurable)

Selection of standard ASDUs
Process information in monitor direction
(station-specific parameter, mark each Type ID X if it is only used in the standard direction, R if only used in the
reverse direction, and B if used in both directions). In this project Reversed direction is not used, however
the interfaces must be able to communicate in Reversed direction in the future.
68

X <1> :=
Single-point information
M_SP_NA_1
<2> :=
Single-point information with time tag
M_SP_TA_1
X <3> :=
Double-point information
M_DP_NA_1
<4> :=
Double-point information with time tag
M_DP_TA_1
<5> :=
Step position information
M_ST_NA_1
<6> :=
Step position information with time tag
M_ST_TA_1
<7> :=
Bitstring of 32 bit
M_BO_NA_1
<8> :=
Bitstring of 32 bit with time tag
M_BO_TA_1
X <9> :=
Measured value, normalized value
M_ME_NA_1
<10> :=
Measured value, normalized value with time tag
M_ME_TA_1
X <11> :=
Measured value, scaled value
M_ME_NB_1
<12> :=
Measured value, scaled value with time tag
M_ME_TB_1
X <13> :=
Measured value, short floating point value
M_ME_NC_1
<14> :=
Measured value, short floating point value with time tag
M_ME_TC_1
X <15> :=
Integrated totals
M_IT_NA_1
<16> :=
Integrated totals with time tag
M_IT_TA_1
X <17> :=
Event of protection equipment with time tag
M_EP_TA_1
<18> :=
Packed start events of protection equipment with time tag
M_EP_TB_1
X <19> :=
Packed output circuit information of protection equipment with time tag
M EP_TC_1
<20> :=
Packed single-point information with status change detection
M_PS_NA_1
<21> :=
Measured value, normalized value without quality descriptor
M_ME_ND_1
X <30> :=
Single-point information with time tag CP56Time2a
M_SP_TB_1
X <31> :=
Double-point information with time tag CP56Time2a
M_DP_TB_1
<32> :=
Step position information with time tag CP56Time2a
M_ST_TB_1
<33> :=
Bitstring of 32 bit with time tag CP56Time2a
M_BO_TB_1
X <34> :=
Measured value, normalized value with time tag CP56Time2a
M_ME_TD_1
X <35> :=
Measured value, scaled value with time tag CP56Time2a
M_ME_TE_1
X <36> :=
Measured value, short floating point value with time tag CP56Time2a
M_ME_TF_1
X <37> :=
Integrated totals with time tag CP56Time2a
M_IT_TB_1
<38> :=
Event of protection equipment with time tag CP56Time2a
M_EP_TD_1
<39> :=
Packed start events of protection equipment with time tag CP56Time2a
M_EP_TE_1
<40> :=
Packed output circuit information of protection equipment with time tag CP56Time2a M_EP_TF_1
Process information in control direction

(station-specific parameter, mark each Type ID X if it is only used in the standard direction, R if only
used in the reverse direction, and B if used in both directions)
X <45> :=
Single command
C_SC_NA_1
X <46> :=
Double command
C_DC_NA_1
<47> :=
Regulating step command
C_RC_NA_1
X <48> :=
Set point command, normalized value
C_SE_NA_1
69

X <49> :=
Set point command, scaled value
C_SE_NB_1
X <50> :=
Set point command, short floating point value
C_SE_NC_1
<51> :=
Bitstring of 32 bit
C_BO_NA_1
X <58> :=
Single command with time tag CP56Time 2a
C_SC_TA_1
X <59> :=
Double command with time tag CP56Time 2a
C_DC_TA_1
<60> :=
Regulating step command with time tag CP56Time 2a
C_RC_TA_1
X <61> :=
Set point command, normalized value with time tag CP56Time 2a
C_SE_TA_1
X <62> :=
Set point command, scaled value with time tag CP56Time 2a
C_SE_TB_1
X <63> :=
Set point command, short floating point value with time tag CP56Time 2a
C_SE_TC_1
<64> :=
Bitstring of 32 bit with time tag CP56Time 2a
C_BO_TA_1
System information in monitor direction

(station-specific parameter, mark with an X if it is only used in the standard direction, R if only used
in the reverse direction, and B if used in both directions)
X <70> :=
End of initialization
M_EI_NA_1
System information in control direction

X <100> :=
Interrogation command
C_IC_NA_1
X <101> :=
Counter interrogation command
C_CI_NA_1
X <102> :=
Read command
C_RD_NA_1
X <103> :=
Clock synchronization command
C_CS_NA_1
X <104> :=
Test command
C_TS_NA_1
X <105> :=
Reset process command
C_RP_NA_1
X <106> :=
Delay acquisition command
C_CD_NA_1
X <107> :=
Test command with time tag CP56time2a
C_TS_TA_1
Parameter in control direction

X <110> :=
Parameter of measured value, normalized value
P_ME_NA_1
X <111> :=
Parameter of measured value, scaled value
P_ME_NB_1
X <112> :=
Parameter of measured value, short floating point value
P_ME_NC_1
X <113> :=
Parameter activation
P_AC_NA_1
File Transfer
70
<120> :=
File ready
F_FR_NA_1
<121> :=
Section ready
F_SR_NA_1
<122> :=
Call directory, select file, call file, call section
F_SC_NA_1
<123> :=
Last section, last segment
F_LS_NA_1
<124> :=
Ack file, ack section
F_AF_NA_1
<125> :=
Segment
F_SG_NA_1
<126> :=
Directory {blank or X, only available in monitor (standard) direction}
F_DR_TA_1
Type Identifier and Cause of Transmission Assignments

(station-specific parameters)
Shaded boxes are not required.
Black boxes are not permitted in this companion standard
Blank = Function or ASDU is not used.
Mark Type Identification/Cause of transmission combinations:
X if only used in the standard direction
R if only used in the reverse direction
B if used in both directions
1
<1>
<2>
<3>
<4>
<5>
<6>
<7>
<8>
<9>
<10>
<11>
<12>
<13>
<14>
<15>
<16>
<17>
<18>
<19>
<20>
<21>
<30>
M_SP_NA_1
M_SP_TA_1
M_DP_NA_1
M_DP_TA_1
M_ST_NA_1
M_ST_TA_1
M_BO_NA_1
M_BO_TA_1
M_ME_NA_1
M_ME_TA_1
M_ME_NB_1
M_ME_TB_1
M_ME_NC_1
M_ME_TC_1
M_IT_NA_1
M_IT_TA_1
M_EP_TA_1
M_EP_TB_1
M_EP_TC_1
M_PS_NA_1
M_ME_ND_1
M_SP_TB_1
unknown information object address
unknown common address of ASDU
unknown cause of transmission
unknown type identification
20 37
10 11 12 13 to to 44 45 46 47
36 41
X
X
request by group <n> counter request
interrogated by group <number>
file transfer
return info caused by a local cmd
return info caused by a remote cmd
activation termination
deactivation confirmation
deactivation
activation confirmation
activation
request or requested
initialized
spontaneous
background scan
Type identification
periodic, cyclic
X
71
<31>
<32>
<33>
<34>
<35>
<36>
<37>
<38>
<39>
<40>
<45>
<46>
<47>
<48>
<49>
<50>
<51>
<70>
<100>
<101>
<102>
<103>
<104>
<105>
<106>
<107>
<110>
<111>
<112>
<113>
<120>
<121>
<122>
<123>
<124>
<125>
<126>
72
M_DP_TB_1
M_ST_TB_1
M_BO_TB_1
M_ME_TD_1
M_ME_TE_1
M_ME_TF_1
M_IT_TB_1
M_EP_TD_1
M_EP_TE_1
M_EP_TF_1
C_SC_NA_1
C_DC_NA_1
C_RC_NA_1
C_SE_NA_1
C_SE_NB_1
C_SE_NC_1
C_BO_NA_1
M_EI_NA_1*
C_IC_NA_1
C_CI_NA_1
C_RD_NA_1
C_CS_NA_1
C_TS_NA_1
C_RP_NA_1
C_CD_NA_1
C_TS_TA_1
P_ME_NA_1
P_ME_NB_1
P_ME_NC_1
P_AC_NA_1
F_FR_NA_1
F_SR_NA_1
F_SC_NA_1
F_LS_NA_1
F_AF_NA_1
F_SG_NA_1
F_DR_TA_1*
X
X
X
X
X
X
X
unknown information object address
unknown common address of ASDU
unknown cause of transmission
deactivation confirmation
unknown type identification
deactivation
request by group <n> counter request
activation confirmation
interrogated by group <number>
activation
file transfer
request or requested
return info caused by a local cmd
initialized
return info caused by a remote cmd
spontaneous
activation termination
background scan
Type identification
periodic, cyclic
20 37
10 11 12 13 to to 44 45 46 47
36 41
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
X
Station initialization
(station-specific parameter, mark X if function is used)
X Remote initialization
Cyclic data transmission
(station-specific parameter, mark X if function is only used in the standard direction, R if only used in the reverse
direction, and B if used in both directions)
X Cyclic data transmission

Read procedure
X Read procedure
Spontaneous transmission
X Spontaneous transmission
Double transmission of information objects with cause of transmission spontaneous
(station-specific parameter, mark each information type X where both a Type ID without time and corresponding Type
ID with time are issued in response to a single spontaneous change of amonitored object)
The following type identifications may be transmitted in succession caused by a single status change of an
information object. The particular information object addresses for which double transmission is enabled are defined
in a project-specific list.
Single-point information M_SP_NA_1, M_SP_TA_1, M_SP_TB_1 and M_PS_NA_1
Double-point information M_DP_NA_1, M_DP_TA_1 and M_DP_TB_1
Step position information M_ST_NA_1, M_ST_TA_1 and M_ST_TB_1
Bitstring of 32 bit M_BO_NA_1, M_BO_TA_1 and M_BO_TB_1 (if defined for a specific project)
Measured value, normalized value M_ME_NA_1, M_ME_TA_1, M_ME_ND_1 and M_ME_TD_1
Measured value, scaled value M_ME_NB_1, M_ME_TB_1 and M_ME_TE_1
Measured value, short floating point number M_ME_NC_1, M_ME_TC_1 and M_ME_TF_1
Station interrogation
X global
X group 1
X group 7
X group 13
X group 2
X group 8
X group 14
X group 3
X group 9
X group 15
X group 4
X group 10
X group 5
X group 11
X group 6
X group 12
X group 16
Assignment of points to each group is configurable.

73
Clock synchronization
(station-specific parameter, mark X if function is only used in the standard direction, R if only used in
the reverse direction, and B if used in both directions)
X Clock synchronization
Command transmission
(object-specific parameter, mark X if function is only used in the standard direction, R if only used in
X Direct command transmission
X Direct set point command transmission
X Select and execute command
X Select and execute set point command
X C_SE ACTTERM used
X No additional definition
Short pulse duration (duration determined by a system parameter in the outstation)
Long pulse duration (duration determined by a system parameter in the outstation)
X Persistent output
X Supervision of maximum delay in command direction of commands and set point commands

Maximum allowable delay of commands and set point commands
Configurable
Transmission of integrated totals
(station- or object-specific parameter, mark X if function is only used in the standard direction, R if
only used in the reverse direction, and B if used in both directions)
X Mode A: Local freeze with spontaneous transmission
X Mode B: Local freeze with counter interrogation

Mode C: Freeze and transmit by counter interrogation commands
X Mode D: Freeze by counter interrogation command, frozen values reported spontaneously
X Counter read
X Counter freeze without reset
X Counter freeze with reset
X Counter reset
X General request counter
X Request counter group 1

Parameter loading
X Threshold value
Smoothing factor
Low limit for transmission of measured value
High limit for transmission of measured value
74
Parameter activation
X Act/deact of persistent cyclic or periodic transmission of the addressed object

Test procedure
X Test procedure
File transfer
(station-specific parameter, mark X if function is used).
File transfer in control direction
Transparent file
Transmission of disturbance data of protection equipment
Transmission of sequences of events
Transmission of sequences of recorded analogue values
File transfer in monitor direction

Transparent file
Background scan
X Background scan
Acquisition of transmission delay
X Acquisition of transmission delay

Definition of time outs
Parameter
Default value
T0
30 seconds
T1
15 seconds
T2
10 seconds
T3
20 seconds
Remarks
Range
Selected value
Time out of connection establishment
1-255
Configurable
Time out of send or test APDUs
1-255
Configurable
1-255
Configurable
1-255
Configurable
Range
Selected value
1 - 32767
Configurable
1 - 32767
Configurable
Time out for acknowledges in case of no data

messages t2 < t1
Time out for sending test frames in case of a
long idle state
Maximum number of outstanding I format APDUs k and latest acknowledge

Parameter
Default value
12 APDUs
8 APDUs
Remarks
Maximum difference receive sequence
number to send state variable
Latest acknowledge after receiving w I-format
APDUs
75
Portnumber
Parameter
Value
Remarks
Port number
2404
Configurable
RFC 2200 suite

RFC 2200 is an official Internet Standard which describes the state of standardization of protocols used in the
Internet as determined by the Internet Architecture Board (IAB). It offers a broad spectrum of actual standards used
in the Internet. The suitable selection of documents from RFC 2200 defined in this standard for given projects has to
be chosen by the user of this standard.
X Ethernet 802.3
Serial X.21 interface
Other selection from RFC 2200:
Application Layer
Application layer settings
General settings
Name
Description
Default
Binary points events buffer size
Event-buffer size for binary points (SP and DP

types)
50-1000
1000
Analog points events buffer size
Event-buffer size for analog points (ME and IT

type)
50-1000
500
Common address of ASDU
Common address ASDU (slave address)
0-65534
Accept broadcast messages
Receive broadcasting messages (address 0xFFFF)
On/Off
Off
Maximum length of APDU
Max size of APDU (in bytes)
10-253
253
Cyclic data transmission mode
Cyclic data transfer (see mentioned below interval

ME points sending period)
On/Off
Off
0-65534
120
On/Off
Off
0-65534
60
Cyclic data transmission timeout Cyclic data transfer period (in seconds)
76
Range
Background scan mode
Background scanning of ME, SP and DP points (see

interval below)
Background scan timeout
Background scan timeout (in sec)
SBO timeout
Allowed delay of Operate after Select (in seconds)
1-60
Clock valid period
Time after which Invalid Time flag becomes

active. Flag deactivates at TCI synchronization (in
minutes)
0-65534
1440
(=24 hours)
Allowed delay for timestamp

commands
Allowed delay for commands with Time label (if

command was transferred via network longer than
this, it is refused to be performed)
1-60
5 seconds
Timestamp of spontaneous
single points
Timestamp at spontaneous events of single points
On/Off
On
Timestamp of command info

single points
Timestamp at single point of command information

transfer
On/Off
On
Timestamp of single points read

reply
Timestamp at requested single point transfer
On/Off
Off
double points
Timestamp at spontaneous double point transfer
On/Off
On
Name
Description
Range
Default
Timestamp of command info

double points
Timestamp at double point of command info

transfer
On/Off
On
Timestamp of double points

read reply
Timestamp at requested double point transfer
On/Off
Off
Measurement points type
Type of points for measured values
Normalized/
Scaled/Float
Float
measurement points
Timestamp at spontaneous transfer of measured

values
On/Off
On
Timestamp of measurement
points read reply
Timestamp at requested measured values transfer
On/Off
Off
integrated totals
Timestamp at spontaneous transfer of integrated

totals
On/Off
On
Timestamp of interrogated
integrated totals
Timestamp at integrated totals during poll of

counters
On/Off
Off
Other settings are given in corresponding paragraphs of current section.
Single bit binary status points

List of supported single bit binary status points: Closed, Dummy on, Remote on, Lockout, AR initiated,
Protection active, RC door open, RCM fault, Malfunction, Warning, Prot on, AR on, EF on, SEF on,
HL on, ABR on, Group 1 on, Group 2 on, Group 3 on, Group 4 on, UD signal (1...12) on, IOI input
(1...12) on, Spontaneous buffer full 1).
1)
- Spontaneous buffer full becomes 1 if one of event-buffers is filled (ME/IT of SP/DP); it becomes 0 if both
buffers become 50% empty
Settings of single bit binary status points

Setting
Applicable range
Factory default
Enable/Disable
Enable for Closed, Dummy on, Remote on, Lockout, AR

initiated, Protection active, RC door open, RCM fault,
Malfunction, Warning, Prot on, AR on, EF on, SEF on,
HL on, ABR on, Group 1 on, Group 2 on, Group 3 on,
Group 4 on; Disable for others
Address
1-100000
1001 for Closed; 1002 for Dummy on; 1003 for Remote on;
1004 for Lockout; 1005 for AR initiated; 1006 for Protection
active; 1007 for RC door open; 1008 for RCM fault; 1009 for
Malfunction; 1010 for Warning; 1011 for Prot on; 1012 for
AR on; 1013 for EF on; 1014 for SEF on; 1015 for HL on;
1016 for Group 1 on, 1017 for Group 2 on, 1018 for Group 3
on, 1019 for Group 4 on; NA for others
Group
1-16
1 for all points
Spontaneous
Enable/Disable
Enable for all points
Mode
77
Double bit binary status points

List of supported double bit binary points is the same as list of single bit binary points (see above).
Settings of double bit binary status points
Setting
Applicable range
Factory default
Mode
Enable/Disable
Enable for Closed, Dummy on, Remote on, Lockout, AR

initiated, Protection active, RC door open, RCM fault,
Malfunction; Disable for others
Address
1-100000
2001 for Closed; 2002 for Dummy on; 2003 for Remote on;
2004 for Lockout; 2005 for AR initiated; 2006 for Protection
active; 2007 for RC door open; 2008 for RCM fault; 2009 for
Malfunction; NA for others
Group
1-16
1 for all points
Spontaneous
Enable/Disable
Single bit binary command points
The following single bit binary command points are supported: Close, Set Dummy on, Set Prot on, Set AR on,
Set EF on, Set SEF on, Set HL on, Set ABR on, Set Group 1 on, Set Group 2 on, Set Group 3 on, Set
Group 4 on, Erase protection counters, Erase energy meters, Erase logs, Erase TCI counters, Set output
(1...12) on.
Settings of single bit binary command points
78
Setting
Applicable range
Factory default
Mode
Enable/Disable
Enable for Close, Set Dummy on, Set Prot on, Set AR on,
Set EF on, Set SEF on, Set HL on, Set ABR on, Set Group 1
on, Set Group 2 on, Set Group 3 on, Set Group 4 on; ;
Address
1-100000
10001 for Close, 10002 for Set Dummy on, 10003 for Set Prot
on, 10004 for Set AR on, 10005 for Set EF on, 10006 for Set
SEF on, 10007 for Set HL on, 10008 for Set ABR on, 10009
for Set Group 1 on, 10010 for Set Group 2 on, 10011 for Set
Group 3 on, 10012 for Set Group 4 on, 10013 for Erase
protection counters, 10014 for Erase energy meters, 10015 for
Erase logs, 10016 for Erase TCI counters; NA for others
Required Select
Enable/Disable
Double bit binary command points

The following double bit binary command points are supported: Close, Set Dummy on, Set Prot on, Set AR
on, Set EF on, Set SEF on, Set HL on, Set ABR on, Set Group 1 on, Set Group 2 on, Set Group 3 on,
Set Group 4 on, Erase protection counters, Erase energy meters, Erase logs, Erase TCI counters, Set output
(1...12) on.
Settings of single bit binary command points
Setting
Mode
Applicable range
Factory default
Enable/Disable
Enable for Close, Set Dummy on, Set Prot on, Set AR on,
Set EF on, Set SEF on, Set HL on, Set ABR on, Set Group 1
on, Set Group 2 on, Set Group 3 on, Set Group 4 on; ;
Erase protection counters; Erase energy meters; Erase logs;
Erase TCI counters; Disable for others
1-100000
20001 for Close, 20002 for Set Dummy on, 20003 for Set Prot
on, 20004 for Set AR on, 20005 for Set EF on, 20006 for Set
SEF on, 20007 for Set HL on, 20008 for Set ABR on, 20009
for Set Group 1 on, 20010 for Set Group 2 on, 20011 for Set
Group 3 on, 20012 for Set Group 4 on, 20013 for Erase
protection counters, 20014 for Erase energy meters, 20015 for
Erase logs, 20016 for Erase TCI counters; NA for others
Address
Required Select
Enable/Disable
Measurement points
List of measurement points
Name of point
Deadband range
Factory defaults
Address
Deadband
Deadband address
A-phase current
0-7000
3001
100
30001
B-phase current
0-7000
3002
100
30002
C-phase current
0-7000
3003
100
30003
Residual current
0-7000
3004
100
3004
0-7000
3005
100
30005
0-7000
3006
100
30006

related to Source+
0.0-18.0
3007
30007

related to Source-
0.0-18.0
3008
30008

related to Source+
0.0-18.0
3009
30009

related to Source-
0.0-18.0
3010
30010
Frequency, indicated value of

Source - side
0.00-20.00
3012
30012
0.00-1.00
3013
30013
0.00-1.00
3014
30014
0.00-1.00
3015
30015
0.00-1.00
3016
30016
A-phase to earth voltage from

Source +
0.0-18.0
3017
30017
79
Name of point
Deadband range
A-phase to earth voltage from Source
Factory defaults
Address
Deadband
Deadband address
0.0-18.0
3018
30018
B-phase to earth voltage from Source +
0.0-18.0
3019
30019
B-phase to earth voltage from Source
0.0-18.0
3020
30020
C-phase to earth voltage from Source +
0.0-18.0
3021
30021
C-phase to earth voltage from Source
0.0-18.0
3022
30022
AB phase-to-phase voltage from Source +
0.0-18.0
3023
30023
AB phase-to-phase voltage from Source
0.0-18.0
3024
30024
BC phase-to-phase voltage from Source +
0.0-18.0
3025
30025
BC phase-to-phase voltage from Source
0.0-18.0
3026
30026
CA phase-to-phase voltage from Source +
0.0-18.0
3027
30027
CA phase-to-phase voltage from Source
0.0-18.0
3028
30028
A-phase active power
0-65535
3029
100
30029
0-65535
3030
100
30030
0-65535
3031
100
30031
0-65535
3032
100
30032
0-65535
3033
100
30033
0-65535
3034
100
30034
0-65535
3035
100
30035
0-65535
3036
100
30036
0-65535
3037
100
30037
0-65535
3038
32767
30038
0-65535
3039
32767
30039
DRVM manufacturing number
0-65535
3040
32767
30040
A-phase fault current
0-7000
3041
100
30041
B-phase fault current
0-7000
3042
100
30042
C-phase fault current
0-7000
3043
100
30043
Residual fault current
0-7000
3044
100
30044
Positive sequence fault current
0-7000
3045
100
30045
Negative sequence fault current
0-7000
3046
100
30046
Positive sequence fault voltage
0.0-18.0
3047
30047
Negative sequence fault voltage
0.0-18.0
3048
30048
Fault frequency
0.00-20.00
3049
30049
Settings of measurement points
80
Setting
Applicable range
Factory default
Mode
Enable/Disable

Residual current; Disable for others
Address
1-100000
<See table above>
Group
1-16
1 for all points
Spontaneous
Enable/Disable
Deadband
<See table above>
<See table above>
Deadband address
1-100000
<See table above>
Integrated totals

List of integrated totals
Name of point
Deadband range
Factory defaults
Address
Deadband
Deadband address
0-65535
4001
1000
0-65535
4002
1000
0-65535
4003
1000
0-65535
4004
1000
0-65535
4005
1000
0-65535
4006
1000
0-65535
4007
1000
0-65535
4008
1000
BF trips
0-30000
4009
OC trips
0-30000
4010
EF trips
0-30000
4011
SEF trips
0-30000
4012
VU trips
0-30000
4013
UV trips
0-30000
4014
OV trips
0-30000
4015
CU trips
0-30000
4016
UF trips
0-30000
4017
LS trips
0-30000
4018
AR OC reclosures
0-30000
4019
AR SEF reclosures
0-30000
4020
AR UV reclosures
0-30000
4021
AR OV reclosures
0-30000
4022
AR UF reclosures
0-30000
4023
ABR reclosures
0-30000
4024
Total CO
0-100
4025
Mechanical wear
0-100
4026
100
Contact wear
0-100
4027
100
0-100
4028
100
Event log filling
0-100
4029
100
0-100
4030
100
0-100
4031
100
0-100
4032
100
Comms log filling
0-100
4033
100
Transmitted frames
0-65535
4034
Received frames
0-65535
4035
CRC errors
0-65535
4036
Timeouts
0-65535
4037
Spontaneous sent
0-65535
4038
Spontaneous buffer filling
0-2000
4039
81
Settings of integrated totals

Setting
Applicable range
Factory default
Enable for A-phase active energy, B-phase active energy,
C-phase active energy, Three phase active energy, A-phase
reactive energy , B-phase reactive energy , C-phase reactive
energy , Three-phase reactive energy, Malfunction log filling;
Disable for others
Mode
Enable/Disable
Address
1-100000
<See table above>
Group
1-4
1 for all points
Spontaneous
Enable/Disable
Deadband
<See table above>
<See table above>
Timeout
0-744 hours
<See table above>
Link Layer
Link layer settings
5
Name
Description
Range
Default
T0
Connection timeout (in seconds)

(counting from TCP connection established to data transfer starts)
1-255
30
T1
Confirmation waiting timeout (in seconds)
1-255
15
T2
Confirmation-package waiting timeout at data transfer idle (in

seconds)
1-255
10
T3
Test-package sending timeout at data transfer idle (in seconds)
1-255
20
Allowed number of packages to be send without receiving of confirmation
1-32767
12
Allowed number of packages to be received without sending of

confirmation
1-32767
Range
Default
IP address of LAN interface of RC
Format of
IP address*
192.168.0.1
Network mask on LAN interface of RC
Format of
IP address*
255.255.255.0
Physical Layer
Physical layer settings
Name
IP address
Netmask
Port
Allowed
master IP
address
1..5
Description
Port number of LAN interface RC

List of allowed IP addresses (if this list is filled with 0.0.0.0
values, any IP is allowed)
1-65535
2404
Format of
IP address*
(empty)
* - No limits. User shall be responsible for correct typing of IP address. Input field is the same as for existing TDI
Local interface IP address setting.
82
Hardware Specification
83
RTU Connection
RTU shall be connected to RS232 port 6.
Pin-outs of RTU RS232 connector X9 (male)
Contact
Designation
State
DCD
Data Carrier Detect
RX
Received Data
TX
Transmitted Data
DTR
Data Terminal Ready
GND
Signal Ground
DSR
Data Set Ready
RTS
Request To Send
CTS
Clear To Send
RI
Ring Indicator
Note: RS232 ports of RC/TEL are not isolated from communication line.
Pin-outs of the cables suitable for RTU connection (standard DTE-DCE cables) are shown in the tables below.
Cable RTU - RS232 port (25 to 9)

To Modem, 25 pin D male connector
To Recloser, 9 pin D female connector
Signal description
Pin number
Pin Number
Signal description
DCD
DCD
RXD
RX
TXD
TX
DTR
20
DTR
GND
GND
DSR
DSR
RTS
RTS
CTS
CTS
RI
22
RI
Cable RTU - RS232 port (9 to 9)

To Modem, 9 pin D male connector
84
To Recloser, 9 pin D female connector
Signal description
Pin number
Pin Number
Signal description
DCD
DCD
RXD
RX
TXD
TX
DTR
DTR
GND
GND
DSR
DSR
RTS
RTS
CTS
CTS
RI
RI
Phone Modem
Hayes-compatible phone modems are supported (see recommended modems in the table below).
Model
Designation
State
IG6000 Industrial Grade Modem 336
NetComm Limited Pty Ltd (www.netcomm.com.au)
RS232
VT-MODEM-1
SIXNET (www.sixnetio.com)
RS232
Radio-Modem
All radio modems are fall upon the National Radio Regulatory of Frequency Management body and need to have
license to work in dedicated frequency band. Recommended radio-modems are presented in the table below.
Model
Supplier
Interdface
DR200/DR900
Trio DataCom Pty. Ltd.(www.trio.com.au)
RS232
NX1530
Nexion Data System Pty. Ltd.(www.nexiondata.com)
GSM Modem
Hayes-compatible GSM modems are supported (see recommended modem in the table below).
Model
Supplier
Interdface
FASTRACK Modem 1206 (GSM/GPRS)
WAVECOM S.A. (www.wavecom.com)
RS232
RS485 Converter
The converter shall provide at least 2000VAC optical isolation of data signals and ground. In addition the converter
shall provide isolated power supply for the RS-485 side. The recommended modem is given in the table below).
Model
485LDRC9
Supplier
B&B Electronics Manufacturing Company
(www. bb-elec.com)
Interdface
RS232
85
86
Application Guide
87
Ref. to OSM automatic circuit recloser for details of RTU installation and power supply connection.
Recommendations about TCI settings application are given in the table below.
Element
Protection Settings
Recommendations
TCI configuration
Radio modem/Phone
DCE and port modem/GSM modem/
Select RTU type used in TCI
type
RS485-RS232 converter/
Direct connection
Protocol
DNP3/Modbus
Select protocol type used in TCI
300/600/1200/2400/48
00/9600/19200/38400/
57600/115200
Transmission rate in bits per second.

Set appropriate baud rate according to your modem specification. Greater
baud rate is more preferable. Note: the majority of modems determines
baud rate by receiving first AT chars.
Duplex type
Half/Full
Defines whether receiving and transmission can occur at the same time
(full-duplex) or not (half-duplex). Half-duplex mode requires from DCE the
following capabilities:
. Enable transmitter only during transmission time;
. Disable receiver during transmission time. Full is applicable for the
majority of modems
Parity
None/Even/Odd
None; the majority of modems uses this setting by default
Stop bits
1/2
1 for the majority of modems
DTR mode
Ignore/Control
Data Terminal Ready line.

DTR signal on this circuit indicates whether DTE is ready to begin
communication. It can be used to instruct DCE to abort current function
(e.g. hang up).
Some DCE may need this signal in one of predefined states. Set
appropriately DTR line for such devices.
Some devices have no DTR line. In this case the setting should be set to
Ignore. If Ignore mode is assigned, DTR is set to ON or OFF condition
and does not controlled further.
If Control mode is assigned, DTE present on this line ON whenever it is
ready to transmit or receive data. In this mode, RC controls the modem
using this signal. RC sets DTR on for the modem to accept commands, and
sets DTR off to terminate a call.
DTR on level
High/Low
Refer to the modem specification for applicable DTR on level.
DTR low
time, ms
50 to 5000ms
Time interval during which DTR shall be OFF to reset DCE.
RTS mode
Ignore/Flow control/
Control PTT
Request To Send line.

If it is set to Flow control, the RTS ON indicates that DTE is ready to
receive data. If Ignore mode is assigned, RTS is set to ON or OFF and not
controlled.
If set to Control PTT (PTT stands for Push To Talk), this signal controls
the data channel transmit function of the DCE. The RTS ON causes the DCE
to assume that the data channel is in transmit mode. RTS ON instructs
DCE to accept data from the DTE.
If Control PTT mode is set, RC sets RTS to ON and starts counting Pre Tx
Time; and sets RTS to OFF after data transmission is completed and Post
Tx Time is expired.
RTS on level
High/Low
Refer to the modem specification for applicable RTS on level.
Ignore/Monitor High/
Monitor Low
Data Set Ready line.

DSR signal indicates whether the DCE is ready to operate.
If DSR is set to Monitor, DTE watches this line and sends data or
commands to DCE only if the signal is ON. RC requires the modem to
set DSR high in response to RC setting DTR high prior to continuing call
initiation. Once a call has been initiated, the status of DSR is no longer
monitored.
If DTE sets DTR line to ON, and DCE does not acknowledge it with DSR ON,
RTU malfunction will be reported.
Port
Baud rate
DSR mode
88
Element
Protection Settings
Recommendations
CTS mode
Monitor Low
Clear To Send line.

CTS set to ON indicates that DCE is prepared to accept data from DTE.
If a modem supports RTS/CTS handshaking, the CTS parameter should be
set into Monitor. In this mode, the RC requires the modem to set CTS high
in response to the RC setting RTS high prior to proceeding. CTS
monitoring is active for the entire duration of the call. CTS is used by the
modem for DTE flow control. When the modem turns CTS off, the buffer
inside the modem is full and it cannot accept any more data. RC will send
data only when CTS is ON.
If CTS mode is set to Monitor and the signal is OFF during 30s when DTE
is ready to send data or commands, RTU malfunction will be reported.
If CTS is assigned to Ignore, DTE sends data irrespective of the state of
CTS line.
DCD mode
Monitor Low
Data Carrier Detect line.

If the modem does not support DCD signal, the DCD parameter should be
set into Ignore. In this case the modem is considered to be online, when
CONNECT string is received and offline, when NOCARRIER string is received.
DCD fall
time, ms
0 to 25500 ms
Time interval between receiving DCD OFF and closing connection. The
parameter is typical of dialup connections.
0 to 600 s
If during this time no reception activity on physical layer is present, the

communication link is closed.
If Inactivity time is set to zero, the setting does not affect behaviour on
physical layer.
0 to 5000 ms
Minimum time between receiving the last character from RTU and starting
of transmission the first character to RTU. This has particular use in
multi-drop (e.g., RS485) or Radio-modem communication environments
where a master shall be given time to disable its transmitting hardware
before it is ready to receive data from the slave device.
Inactivity
time, s
Transmission
delay, ms
Pre-transmission time,
0 to 5000 ms
ms
Time interval between setting RTS on and starting sending data.
Post-transmission
time, ms
0 to 5000 ms
Time interval between sending the last character of data and setting RTS
OFF.
Enable/Disable
RTU supply check setting depends on modem power supply connection.

If RTU supply is provided by RC (RCM connector 10), RTU supply check
may be set to Enable. In this case RC will transmit data only if RTU power
supply is sent On.
CA mode
Enable/Disable
CA is applied for point-multi-point communications and prevents devices

from attempting to start transmission at the same time.
CA is implemented as a time delay equal to (Minimal idle time
+ Random maximum delay x Random number).
Where Random number is between 0 and 1 and generated automatically.
CA min idle
time, ms
0 to 120000 ms
Used to calculate random access time.
CA max
random time, 0 to 120000 ms
ms
Used to calculate random access time.
RTU supply
check
Radio modem
Preamble
Enable/Disable
Preamble is required by some modems, normally by radio, for

synchronization purposes. If Enable, the Repeat count of Preamble char +
Preamble last char characters will be transmitted at the beginning of each
data link frame, prior to sending data.
Preamble
char
0x00 to 0xFF
Preamble ASCII character. Represented by its hexadecimal equivalent.
89
Element
Preamble
last char
Protection Settings
0x00 to 0xFF
Repeat count 0 to 25
Recommendations
Final ASCII character of the preamble. With preamble enabled and default
settings, data packet are preceded by preamble 0x55, 0x55, 0x55, 0xFF.
The last char is required to detect the end of preamble.
Number of times the Preamble char is repeated.
Phone modem/GSM modem

Leased/Switched
Type of line the modem is connected to. In Leased line mode RC does not
attempt to disconnect the modem after inactivity time is expired.
Autodial
interval, s
0 to 255 s
Time interval between the failure of the connection and next attempt of
establishing connection.
Set the appropriate value. Default value is 3 s. Optimal value depends on
many factors: how many devices try to connect to the master, how long
one call on the average is etc.
Dial prefix
String, starting with

command prefix, 32
chars max length
TCharacters, which go before dialling number. In the majority of cases, it

is DP or DT. If ignoring the dial tone and sending a zero for internal calls
is required, ATX3DT prefix can be used.
Line mode
Dial number 1
Dial number 2 String, containing 5
dialing numbers, 32
Dial number 3
chars max length for
Dial number 4 each string
Dial number 5
Init string

command prefix , 255
chars max length
Set in accordance with init string of the modem.
Hang up
command

chars max length
Refer to the modem specification for relevant AT command. For the

majority of modems it is ATH. It will be used by RC, if DTR node is set to
Ignore.
Off hook
command

chars max length
Refer to the modem specification for relevant AT command. For the

majority of modems it is ATH1. If the modem does not need special
command to go off hook (the majority of modems does not), leave this
field blank.
Auto answer
On

chars max length
The command is used to enable modem auto answer mode, i.e.

automatically receive incoming call after the preset number of beeps.
The string length is limited by modem properties.
Auto answer
Off

chars max length
The command is used to disable modem auto answer mode, i.e. modem
will not receive incoming calls. The command is sent to modem every
time before Port is closed.
The string length is limited by modem properties.
During this time the dialup connection between modems shall be
established after dial string was sent to modem. If the time is expired
and the connection is not established, the autodial algorithm is applied.
This parameter is 60 s by default and it is enough for the majority of
modems. However, for long distances or slow equipment the connection
timeout can be set longer.
Connection
timeout
0 to 255 s
Response
time
0 to 255 s, 0 not
applicable
If the modem does not respond to control command, such as Init, Hang
up string etc, within Response time, RC sends the Init string to modem
after Autodial interval. Not applicable for dialing numbers.
Enable/Disable
If Mode is Enable connection will be established with modems having

dial numbers from Trusted numbers list only. This mode can be used only
with the modems supporting Calling Line Identification Presentation
(CLIP) function. If Mode is Enable, at least one Trusted number should
be specified, otherwise connection will not be established.
If Mode is Disable Trusted numbers settings are ignored.
Protection
mode
90
Numbers by which the Master can be reached. Do not include AT prefix or

DP, DT prefix, numbers only.
Element
Protection Settings
Recommendations
Trusted
number 1
Trusted
number 2
Trusted
number 3
Trusted
number 4
String, containing 5
dialing numbers, 32
chars max length for
each string
Dial numbers used for protected dial. Trusted phone number consists of
the chars 0-9.
Trusted
number 5
Modbus
Slave address 1 to 247
Set required Slave address
Automatic
timeout
mode
Enable/Disable
In this mode RC calculates reception timeout using the formula 4500/

baud rate, set in Port settings.
1 to 60000 ms
Receive message timeout starts when the address is received. If CRC has
not been received before timeout is expired, the request will be deleted
from the buffer. The setting is used when Automatic timeout mode is
disabled.
Reception
timeout
DNP3
Data Link Layer (DL)

Slave address 0 to 65534
Set required Slave address
Master
address
0 to 65534
Set required Master address
Confirmation
mode
Never/Sometimes/
Always
This parameter is used to determine if or when RTU may request

confirmation on data link layer frames transmitted to the master.
0 to 60s
Timeout value, in seconds, used to wait for master confirmation on

previous data link frame transmitted with a request for confirmation. This
value is independent of AL Confirmation timeout; if link confirmations are
used (see DL Confirmation mode), the application confirmation timer is
not started until a link confirmation is received.
Number of
retries
0 to 255
The maximum number of times IED will re-transmit a link layer frame
for which a confirmation had been requested but not received within DL
Confirmation timeout. Note that this number is in addition to the initial
attempt to transmit the frame; i.e., if the value of this parameter is 2,
then an unsuccessful transmission will send a total of 3 identical frames.
Maximum
frame size
64 to 292
Set maximum transmitted frame size.
Enable/Disable
Specify whether RC checks the source address in received frames. DNP3

frames contain both a source address field and a destination address field.
If the setting is Disable, RC does not check the source address and
frames with destination address of slave will be accepted.
If the setting is Enable, RC will check that both source and destination
addresses matches those set in RC, before the frame is accepted.
Self-addressing Enable/Disable
Specify whether self address functionality is applicable for this slave

device as specified by DNP Technical Bulletin 2003-003 Self-Address
Reservation. Slave will respond to address 0xfffc as though it received a
request for its configured address. It will respond with its own address, so
the master can automatically discover the slave address.
Confirmation
timeout
Validate
master
address
Application Layer (AL)
Confirmation
mode
Events only/Events and

multi-fragments
This parameter is used to determine if or when IED may request

confirmation from the DNP3 master of application layer frames
transmitted to the master:
Events - only when reporting event data.
Events and Mult - when reporting events or multi-fragment messages.
91
Element
Protection Settings
Recommendations
Confirmation
timeout
0 to 3600s
Timeout value, in seconds, used to wait for master confirmation on

previous response to the master containing a request for confirmation.
This value is independent of DL Confirmation timeout; if link
confirmations are being used (see DL confirmation mode), the application
confirmation timer is not started until a link confirmation is received.
This parameter is also used as part of the control for when an
unconfirmed unsolicited response can be re-generated and re-transmitted.
See Unsolicited Retry Delay.
It shall be checked the condition that
AL Confirmation timeout >= ((DL maximum retries + 1) x DL confirmation
timeout x 7).
Maximum
fragment
size
512 to 4096 octets
Set maximum fragment size.
0 to 69120 min
The amount of time, in minutes, after IED will request time

synchronization from master by means of set of need time Internal
Indication (IIN) bit. This value indicates the rate at which the internal
clock of IED becomes out-of-sync with the masters clock. If this
parameter is set to 0, the need time IIN bit will never be set.
Cold restart delay
The time, in ms, returned in a response to a request from a master for a

cold restart. The master is thereby notified to wait this amount of time
after receiving the response before it can resume polling IED.
IED actions:
- Session is closed and then open;
- Unsolicited response mask and Enable flag are restored from settings;
- Unsolicited NULL response is sent to Master.
0 to 65530 ms
The time, in ms, returned in a response to a request from a master for a

warm restart. The master is thereby notified to wait this amount of time
after receiving the response before it can resume polling IED.
IED actions:
- Object event buffers and unsolicited response event counters are
cleared;
- Binary counters and Analogue Inputs last reported values are zeroed;
- Frozen counters is become unfrozen;
- Unsolicited response mask has the same value as before warm restart is
started;
- Unsolicited NULL response is not sent to Master.
Time synchronization
Cold restart
delay
7
Warm restart
delay
Unsolicited Response (UR)
92
Unsolicited
response
mode
Enable/Disable
If Mode is Enable, URs are permitted; if Disable, they are not. If

permitted, IED will transmit an initial null UR, and will continue to send
it until an application layer confirmation of it is received from the master.
From that point on, the master must issue an UR Enable request
message for one or more of the three event classes of data (class 1, 2, or
3) before any more UR messages will be transmitted.
If false, then UR enable and UR Disable messages from the DNP3
Master device will not be allowed a Bad Configuration Internal
Indication (IIN) response will be returned.
Class 1
buffer
threshold
Class 2
buffer
threshold
Class 3
buffer
threshold
1 to 500
UR Class buffer threshold is used to specify conditions under which an UR

is generated. For each class, if the number of events that have occurred
for that class meets or exceeds this value, then an UR will be generated.
Element
Retry delay
Number of
retries
Offline
interval
Protection Settings
Recommendations
1 to 86400s
This parameter specifies the minimum amount of time between

unsuccessfully confirmed URs.
If an UR is not confirmed within AL Confirmation timeout, this parameter
controls how soon another UR will be sent. If this parameter is zero or
less than AL Confirmation timeout, the "retry" UR will be sent as soon as
AL Confirmation timeout expires.
During the time set by AL Confirmation timeout, any received read
request received from the master will be postponed until after AL
Confirmation timeout has expired. If multiple read requests are received,
only the last read request would be postponed; the previous read-requests
will be ignored entirely.
0 to 255
The maximum number of times IED will re-transmit an unsolicited

response without receiving a confirmation from a Master at an interval
defined by UR Retry delay. Once this value is reached, the unsolicited
response will continue to be retransmitted but at a potentially different
interval defined by UR Offline interval.
0 to 86400s
If an UR has been retried UR Retries times without a confirmation then

this parameter defines the time interval between URs from that point
forward. It allows the interval between retries to be increased if no
confirmation is being received while still allowing an infinite number of
URs.
Default variations
Binary
inputs
1/2
Variation with which Slave will respond to Poll Class 0 from Master. Set 1
if responding in compact format (just 7-th bit) is preferable, otherwise
set 2
Binary
inputs
1/2
change event
Set 1 if responding without change event time is preferable, otherwise set

2
Binary
outputs
1/2
Set 1 if responding in compact format (7-th bit) is preferable, otherwise

set 2
Binary
counters
1/2
Set 1 if responding in 32-bit format is preferable, otherwise set 2
Binary
counters
1/2/5/6
change event
Set 1 if responding in 32-bit format without change event time is

preferable;
preferable;
Set 5 if responding in 32-bit format with change event time is preferable;
Set 6 if responding in 16-bit format with change event time is preferable
Analogue
inputs
Set 1 if responding in 32-bit format is preferable, otherwise set 2
1/2
Analogue
inputs
1/2/3/4
change event

preferable;
preferable;
Set 3 if responding in 32-bit format with change event time is preferable;
Set 4 if responding in 16-bit format with change event time is preferable
RC settings for IEC 104 protocol are usually determined by SCADA of a network which the particular recloser is joining.
93
Date:
94
Australia
China
Germany
Tavrida Electric Australia Pty Ltd.

5/490 Frankston Dandenong Road
Carrum Downs Victoria 3201
Australia
Phone: + 61 3 97867444
Fax:
+ 61 3 90119681
E-Mail: info@tavrida.com.au
Web:
www.tavrida.com.au
Tavrida Electric Beijing Ltd.

First Floor West, Building 11, No. 28 Yuhua Road,
Area B, Beijing Airport Industrial Zone,
101300 Beijing, China
Phone: + 86 (10) 80492474/-5474
Fax:
+ 86 (10) 80497114
E-Mail: info@tavrida.cn
Web:
www.tavrida.cn
Tavrida Electric GmbH

Georgstr. 7
88069 Tettnang
Germany
Phone: + 49 (0) 7542 9467851
Fax:
+ 49 (0) 7542 9467861
E-Mail: info@tavrida.de
Web:
www.tavrida.de
India
South Africa
Switzerland
Tavrida Electric India Private Limited

15 NC, Block-A, New Alipore
Kolkata - 700 053
West Bengal, India
Phone: + 91 33 2488 1715/3260 8634
Fax:
+ 91 33 2488 1766
E-Mail: info@tavrida.in
Web:
www.tavrida.in
Tavrida Electric Africa (Pty) Ltd.

Cnr. Van Dyk and Commissioner Streets
Boksburg East, Gauteng
Republic of South Africa
Phone: + 27 11 9142199
Fax:
+ 27 11 9180584
E-Mail: info@tavrida.co.za
Web:
www.tavrida.co.za
Tavrida Electric AG
Rheinweg 4
8200 Schaffhausen
Switzerland
Phone: + 41 (0) 52 630 26 00
Fax:
+ 41 (0) 52 630 26 09
E-Mail: info@tavrida.ch
Web:
www.tavrida.ch
This document is copyright and is intended for users and distributors of Tavrida Electric product. It contains information that is
the intellectual property of Tavrida Electric and the document, or any part thereof, should not be copied or reproduced in any
form without written permission from Tavrida Electric.
22441100000000000000
Doc_UG_4(EN_5), rev. A
Tavrida Electric applies a policy of ongoing development and reserves the right to change product without notice.
Tavrida Electric does not accept any responsibility for loss or damage incurred as a result of acting or refraining from action
based on information in this Installation and Operating Instructions.

Ug TLC 120328

Загружено:

Сведения о документе

Оригинальное название

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

Ug TLC 120328

Загружено:

Авторское право:

Доступные форматы

Rec 15, Rec 25

5. IEC 60870-5-104 Protocol

Automatic Backfeed Restoration

RTU applicable range

RTU default value

Maximum Application Fragment Size (octets):

Maximum Data Link Retries:

Maximum Application Layer Retries:

Requires Data Link Layer Confirmation:

Timeouts while waiting for:

SBO Timeout fixed at 5 sec.

Need Time Delay

Sends/Executes Control Operations:

WRITE Binary Outputs

Reports Binary Input Change Events when no specific

Reports time-tagged Binary Input Change Events when no

Sends Unsolicited Responses:

Sends Static Data in Unsolicited Responses:

No other options are permitted.

Default Counter Object/Variation:

Counters Roll Over at:

Sends Multi-Fragment Responses:

DNP3 Application Layer

Reception of warm restart request (#3)

Reception of cold restart request (#2)

Application layer settings

Events only/Events and multi-fragments

Events and multi-fragments

Maximum fragment size

512 to 4096 octets

Cold restart delay

0 to 65530 ms, step size 10 ms

Warm restart delay

0 to 65530 ms, step size 10 ms

Other settings are given in corresponding paragraphs of current section.

Binary inputs settings

Enable for Dummy on, Closed, Remote on, Lockout, AR initiated,

1 for Dummy on; 2 for Closed; 3 for Remote on; 4 for

1 for Lockout; 2 for Malfunction; 3 for Warning; 0 for others

Always repeats to corresponding binary signal

Bits sequence is as follows: 76543210

Binary input without status

7-th bit only

Binary input with status

The entire octet

Binary inputs change event

Change event binary inputs buffer

Event signal generated at

Set Dummy off from TCI

Close request from TCI

Trip request from TCI

Set Prot on from TCI

Set Prot off from TCI

Set AR on from TCI

Set AR off from TCI

Set EF on from TCI

Set EF off from TCI

Set HL on from TCI

Set HL off from TCI

Set ABR on from TCI

Set ABR off from TCI

Set Group1 on from TCI

Set Group2 on from TCI