IEC 60870-5-101: Telegram structure

Telegram format with fixed length

The telegram with fixed length is normally used for link layer services. In special cases this format with fixed length can also be used as an
acknowledgement instead of a single character.

Single character

The single character is normally used in order to confirm data link services and user data.

E5H = ACK : Positive acknowledge

A2H = not used !

Function codes of the control field in messages sent from the primary station (PRM = 1)

Function Frame type Service function FCV

0 Send/ CONFIRM expected Reset remote link 0

1 Send/ CONFIRM expected Reset user process 0

2 Balanced: Send/ CONFIRM expected Test function for link 1

3 Send/ CONFIRM expected User data 1

4 Send/ NO REPLY expected User data 0

5 reserved

6 Reserved for special use by agreement.

7 Reserved for special use by agreement.

Unbalanced: Request for access demand/ RESPOND Expected response specifies access
8 0
expected demand

9 Request/ RESPOND expected Request status of link 0

10 Unbalanced: Request/ RESPOND expected Request user data class 1 1

11 Unbalanced: Request/ RESPOND expected Request user data class 2 1

12 reserved

13 reserved

14 Reserved for special use by agreement.

15 Reserved for special use by agreement.

Function codes numbers in the control field used from the secondary station (PRM = 0)

Function Frame type Service function

0 CONFIRM ACK : Positive acknowledgement

1 CONFIRM NACK : Message not accepted, link busy

2 reserved

3 reserved

4 reserved

5 reserved

6 Reserved for special use by agreement.

7 Reserved for special use by agreement.

8 Unbalanced: RESPOND User data

9 Unbalanced: RESPOND NACK : Requested data not available

10 reserved

11 RESPOND Status of link or access demand

12 reserved

13 Reserved for special use by agreement.

14 Link service not functioning

15 Link service not implemented

Link control field :

RES/ DIR Unbalanced transmission: Reserved

Balanced transmission: Physical transmission direction ( direction )

DIR = 1 : Data from controlling ( Master ) to controlled ( Slave ) station.
DIR = 0 : Data from controlled ( Slave ) to controlling ( Master ) station.

PRM Primary message : primary bit ( primary message )

0 = message from a secondary ( controlled ) station.

1 = message from a primary ( controlling ) station.

FCB Primary message: frame count bit

Alternating bit for consecutive SEND/ CONFIRM or REQUEST/ RESPOND messages per station. The primary station
alternates the FCB bit for each new SEND/ CONFIRM or REQUEST/ RESPOND transmission service directed to the
same secondary station.

If an expected reply is timed out ( missing ), then the same SEND/ CONFIRM and REQUEST/ RESPOND service is
repeated with the same frame count bit.
In case of a reset command the FCB bit is always zero, and upon receipt of these commands the secondary station
expects always that the following primary message is set with FCV = valid ( FCV = 1 ) in order to have the opposite value
of FCB ( i.e. FCB = 1 ).

FCV Primary message : frame count bit valid

0 = alternating function and FCB bit is invalid

1 = alternating function and FCB bit is valid
 SEND/ NO REPLY services, broadcast messages and other transmission services that tolerate the duplication or the
deletion of information output do not alternate the FCB bit and indicate this by a cleared FCV bit.

ACD/ RES Balanced transmission : Reserved

Unbalanced transmission : Access demand

Secondary message : Access demand

There are two classes of message data provided, namely class 1 and class 2. Secondary stations indicate the primary
station with it that data of class 1 are ready for transmission.

0 = no access demand on transmission of data class 1

1 = access demand on transmission of data class 1

The transmission of data class 1 is normally used for events or for messages with high priority. Class 2 data transmission
is normally used for cyclic transmission or for low priority.

DFC Secondary message : data flow control

0 = more messages are accepted

1 = further messages can cause a data overflow

Secondary ( responding ) stations indicate with this message to the initiating ( primary ) station that an immediate
succession of a further message may cause a buffer overflow.

Functions code ( FCT ) :

The function codes are described in the chapter <IEC 60870-5-101 : Simulation> later in this document.

Link address fields :

Transmission procedures of the link layer are using the control field and an optional link address field.

The link address is a number for a communication interface that is used from a controlling station for the connection. It is only used as
address in the communication network itself and shall not be part of the total address of a data point.

According to the standard this parameter can consist of 0, 1 or 2 octets. 0 is only valid for balanced transmission.

Type-identification ( TypeID ) :

The value ZERO is not used. The range of numbers 1 up to 127 is used for standard definitions from IEC 60870-5-101 standard. The range
128 up to 135 is reserved for routing of messages. The numbers 136 up to 255 are used for special use.

The range of numbers 128 to 255 is private and not defined in the standard, but it is recommended that the data unit identifier fields of
private ASDUs have the same format as standard ASDUs.

The following table shows the definition of Type-identification numbers for process and system information in monitor and control direction.

Process information in monitoring direction :

1 Single point information M_SP_NA_1

2 Single point information with time tag M_SP_TA_1

3 Double point information M_DP_NA_1

4 Double point information with time tag M_DP_TA_1

5 Step position information M_ST_NA_1

6 Step position information with time tag M_ST_TA_1

7 Bit string of 32 bit M_BO_NA_1

8 Bit string of 32 bit with time tag M_BO_TA_1

9 Measured value, normalized value M_ME_NA_1

 10 Measured value, normalized value with time tag M_ME_TA_1

11 Measured value, scaled value M_ME_NB_1

12 Measured value, scaled value with time tag M_ME_TB_1

13 Measured value, short floating point value M_ME_NC_1

14 Measured value, short floating point value with time tag M_ME_TC_1

15 Integrated totals M_IT_NA_1

16 Integrated totals with time tag M_IT_TA_1

17 Event or protection equipment with time tag M_EP_TA_1

18 Packed start events of protection equipment with time tag M_EP_TB_1

19 Packed output circuit information of protection equipment with time tag M_EP_TC_1

20 Packed single point information with status change detection M_PS_NA_1

21 Measured value, normalized value without quality descriptor M_ME_ND_1

Process telegrams with long time tags ( 7 octets ) :

30 Single point information with time tag CP56Time2a M_SP_TB_1

31 Double point information with time tag CP56Time2a M_DP_TB_1

32 Step position information with time tag CP56Time2a M_ST_TB_1

33 Bit string of 32 bit with time tag CP56Time2a M_BO_TB_1

34 Measured value, normalized value with time tag CP56Time2a M_ME_TD_1

35 Measured value, scaled value with time tag CP56Time2a M_ME_TE_1

36 Measured value, short floating point value with time tag CP56Time2a M_ME_TF_1

37 Integrated totals with time tag CP56Time2a M_IT_TB_1

38 Event or protection equipment with time tag CP56Time2a M_EP_TD_1

39 Packed start events of protection equipment with time tag CP56time2a M_EP_TE_1

40 Packed output circuit information of protection equipment with time tag CP56Time2a M_EP_TF_1

Process information in control direction :

45 Single command C_SC_NA_1

46 Double command C_DC_NA_1

47 Regulating step command C_RC_NA_1

48 Set point command, normalized value C_SE_NA_1

49 Set point command, scaled value C_SE_NB_1

50 Set point command, short floating point value C_SE_NC_1

51 Bitstring 32 bit C_BO_NA_1

Command telegrams with long time tag ( 7 octets ) :

 58 ( IEC 104 ) Single command with time tag CP56Time2a C_SC_TA_1

59 ( IEC 104 ) Double command with time tag CP56Time2a C_DC_TA_1

60 ( IEC 104 ) Regulating step command with time tag CP56Time2a C_RC_TA_1

61 ( IEC 104 ) Set point command, normalized value with time tag CP56Time2a C_SE_TA_1

62 ( IEC 104 ) Set point command, scaled value with time tag CP56Time2a C_SE_TB_1

63 ( IEC 104 ) Set point command, short floating point value with time tag CP56Time2a C_SE_TC_1

64 ( IEC 104 ) Bitstring 32 bit with time tag CP56Time2a C_BO_TA_1

System information in monitoring direction:

70 End if initialization M_EI_NA_1

System information in control direction:

100 (General-) interrogation command C_IC_NA_1

101 Counter interrogation command C_CI_NA_1

102 Read command C_RD_NA_1

103 Clock synchronization command C_CS_NA_1

104 Test command C_TS_NB_1

105 Reset process command C_RP_NC_1

106 Delay acquisition command C_CD_NA_1

107 ( IEC 104 ) Test command with time tag CP56Time2a C_TS_TA_1

Parameter in control direction:

110 Parameter of measured value, normalized value P_ME_NA_1

111 Parameter of measured value, scaled value P_ME_NB_1

112 Parameter of measured value, short floating point value P_ME_NC_1

113 Parameter activation P_AC_NA_1

File transfer:

120 File ready F_FR_NA_1

121 Section ready F_SR_NA_1

122 Call directory, select file, call file, call section F_SC_NA_1

123 Last section, last segment F_LS_NA_1

124 Ack file, ack section F_AF_NA_1

125 Segment F_SG_NA_1

126 Directory F_DR_TA_1

127 ( IEC 104 ) QueryLog – Request archive file F_SC_NB_1

 Variable structure qualifier :

The SQ bit specifies the method of addressing of the following information objects or elements.

SQ = 0 Each single element or a combination of elements is addressed by the information object address. The ASDU may consist of
one or more than one equal information object. The number of objects is binary coded (number of objects) and defines the
number of the information objects.

SQ = 1 <="" font="">A sequence of equal information objects ( e.g. measured values of identical format ) is addressed by the
information object address. The information object address specifies the associated address of the first information element
of the sequence. The following information elements are identified by numbers continuously by + 1 from this offset. The
number of objects is binary coded (number of elements) and defines the number of the information elements. In case of a
sequence of information elements only one information object per ASDU is allocated.

number objects/ = 0 : ASDU contains no information object

elements > 0 : ASDU contains one or more ( number ) information objects or elements

Cause of transmission ( COT ) :

The cause of transmission directs the ASDU to a specific application task ( program ) for processing. ASDUs in control direction are
confirmed application services and may be mirrored in monitor direction with different causes of transmission. The value ZERO is not used.

P/ N The P / N-bit indicates the positive or negative confirmation of an activation requested by a primary application function. In the
case of irrelevance the P/N-bit is zero.

T In addition to the cause the test-bit defines ASDUs which were generated during test conditions. The test bit is used e.g. to test
transmission and equipment without controlling the process.

...

1 periodic, cyclic

2 background interrogation

3 spontaneous

4 initialized init

5 interrogation or interrogated req

6 activation act

7 confirmation activation actcon

8 deactivation deact

9 confirmation deactivation deactcon

10 termination activation actterm

11 feedback, caused by distant command

12 feedback, caused by local command

 13 data transmission

...

20 interrogated by general interrogation inrogen

21-36 interrogated by interrogation group 1-16

37 interrogated by counter general interrogation

38-41 interrogated by interrogation counter group 1-4

...

44 type-Identification unknown

45 cause unknown

46 ASDU address unknown

47 information object address unknown

Originator address :

The originator address directs mirrored ASDUs and interrogated ASDUs in monitor direction (e.g. interrogated by a general interrogation) to
the source that activated the procedure ( in case of redundant systems ).

If the originator address is not used and there is more than one single source in a system defined, the ASDUs in monitor direction have to be
directed to all relevant sources of the system. In this case the specific affected source has to select its specific ASDUs..

Common adddress of ASDU :

The common address is associated with all objects in an ASDU. The global address is a broadcast address directed to all stations of a
specific system (broadcast address ). ASDUs with a broadcast address in control direction have to be answered in monitor direction by the
address that is the specific defined common address ( station address ). According to the standard this parameter can consist of 1 or 2
octets.

Information object address :

The information object address is used as destination address in control direction and as source address in monitor direction.

The third octet is only used in case of structuring the information object address in order to define unambiguous addresses within a specific
system. In all cases the maximum number of different object addresses is limited to 65 535 ( as for two octets ). If the information object
address is not relevant ( not used ) in some ASDUs, it is set to zero.