Sicam Rtus SICAM A8000 Series: Protocol Element

___________________________________________________________________________
Preface, Table of Contents

___________________________________________________________________________
Introduction 1
___________________________________________________________________________
Protocol Description 2
___________________________________________________________________________
SICAM RTUs Application Notes 3

SICAM A8000 Series ___________________________________________________________________________
Literature
___________________________________________________________________________
Common Functions DNP3
Protocol Element
DC0-090-2.10
Note
Please observe Notes and Warnings for your own safety in the Preface.
Disclaimer of Liability Copyright

Although we have carefully checked the contents of this publication Copyright © Siemens AG 2017
for conformity with the hardware and software described, we cannot The reproduction, transmission or use of this document or its
guarantee complete conformity since errors cannot be excluded. contents is not permitted without express written authority.
The information provided in this manual is checked at regular Offenders will be liable for damages. All rights, including rights
intervals and any corrections that might become necessary are created by patent grant or registration of a utility model or design,
included in the next releases. Any suggestions for improvement are are reserved.
welcome.
Subject to change without prior notice.

Issuing date: 2017-12-11
Siemens AG Order number: DC0-090-2.10

Preface
This document is applicable to the following product(s):
· SICAM AK 3
· SICAM AK
· SICAM TM
· SICAM A8000 Series
─ CP-8000
─ CP-8021
─ CP-8022
· SICAM EMIC
· SICAM BC
· AK 1703
· AMC 1703
Purpose of this manual
This manual describes the function and the manner of working of the DNP3 protocol and
essentially contains:
· Functional descriptions
Target Group
The document you are reading right now is addressed to users, who are in charge of the
following engineering tasks:
· Conceptual activities, as for example design and configuration

· Creation of the assembly technical documentation using the designated engineering tools
· System parameterization and system diagnostic, using the designated engineering tools
· Technical system maintenance
Note
The functions described in this manual are illustrated with screenshots of the SICAM TOOLBOX II. For
example these pictures show the use of the protocol element in SICAM AK. However they are also valid
- under consideration of the product-specific differences - for the other products.
SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 3

DC0-090-2.10, Edition 12.2017
Preface
Notes on Safety
This manual does not constitute a complete catalog of all safety measures required for
operating the equipment (module, device) in question because special operating conditions
might require additional measures. However, it does contain notes that must be adhered to for
your own personal safety and to avoid damage to property. These notes are highlighted with a
warning triangle and different keywords indicating different degrees of danger.
Danger
means that death, serious bodily injury or considerable property damage will occur, if the appropriate
precautionary measures are not carried out.
Warning
means that death, serious bodily injury or considerable property damage can occur, if the appropriate
precautionary measures are not carried out.
Caution
means that minor bodily injury or property damage could occur, if the appropriate precautionary measures
are not carried out.
Note
is important information about the product, the handling of the product or the respective part of the
documentation, to which special attention is to be given.
Qualified Personnel
Commissioning and operation of the equipment (module, device) described in this manual must be
performed by qualified personnel only. As used in the safety notes contained in this manual, qualified
personnel are those persons who are authorized to commission, release, ground, and tag devices,
systems, and electrical circuits in accordance with safety standards.
Use as Prescribed
The equipment (device, module) must not be used for any other purposes than those described in the
Catalog and the Technical Description. If it is used together with third-party devices and components,
these must be recommended or approved by Siemens.
Correct and safe operation of the product requires adequate transportation, storage, installation, and
mounting as well as appropriate use and maintenance.
During operation of electrical equipment, it is unavoidable that certain parts of this equipment will carry
dangerous voltages. Severe injury or damage to property can occur if the appropriate measures are not
taken:
· Before making any connections at all, ground the equipment at the PE terminal.
· Hazardous voltages can be present on all switching components connected to the power supply.
· Even after the supply voltage has been disconnected, hazardous voltages can still be present in the
equipment (capacitor storage).
· Equipment with current transformer circuits must not be operated while open.
· The limit values indicated in the manual or the operating instructions must not be exceeded; that also
applies to testing and commissioning.
Consider obligatory the safety rules for the accomplishment of works at electrical plants:
1. Switch off electricity all-pole and on all sides!
2. Ensure that electricity cannot be switched on again!
3. Double check that no electrical current is flowing!
4. Discharge, ground, short circuit!
5. Cover or otherwise isolate components that are still electrically active!
4 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

Edition 12.2017, DC0-090-2.10
Table of Contents
1 Introduction ................................................................................................................... 9
1.1 Application ..................................................................................................... 10

1.1.1 Which Protocols are available in which Systems ........................................ 10
1.2 Configuration .................................................................................................. 11
1.2.1 Communication ......................................................................................... 11
1.3 Features and Functions .................................................................................. 14
2 Protocol Description ................................................................................................... 15
2.1 Overview ........................................................................................................ 16

2.2 Technical Specifications ................................................................................. 19
2.3 Limitations ...................................................................................................... 22
2.4 Communication according to DNP3 ................................................................ 23
2.4.1 Data Acquisition through Queries and "unsolicited Responses" .................. 23
2.4.1.1 Continuous Interrogation of a Controlled Station ................................... 25
2.4.1.2 Acknowledgement Procedure ............................................................... 25
2.4.1.3 Failure Monitoring ................................................................................. 27
2.4.2 Station Initialization.................................................................................... 27
2.4.3 Acquisition of Events (transmission of data ready to be sent) ..................... 28
2.4.3.1 Message from the Controlled Station to the Controlling Station ............. 28
2.4.4 General Interrogation, Controlled Station Interrogation ............................... 29
2.4.5 Clock Synchronization ............................................................................... 30
2.4.5.1 Clock Synchronization with NTP (DNPi00 and DNPiA1 only)................. 31
2.4.5.1.1 NTP/SNTP Client “Clock Synchronization with one or several NTP
Servers”........................................................................................... 32
2.4.5.1.2 Integrated NTP Server Clock Synchronization for one or several NTP
Clients ............................................................................................. 35
2.4.6 Command Transmission ............................................................................ 36
2.4.6.1 Message from Controlling Station selectively to a Controlled Station ..... 36
2.4.7 Count Transmission by means of Interrogation Command ......................... 36
2.4.8 Spontaneous Count Transmission ............................................................. 36
2.5 Optimized Parameters for selected Transmission Facilities (serial
communication) .............................................................................................. 37
2.6 Function for the Support of redundant Communication Routes ........................ 42
2.6.1 Redundancy Mode “SICAM RTUs Redundancy” ........................................ 42
2.7 Web Server (DNPi00 only).............................................................................. 43
2.8 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPi00 only) ........... 45
2.8.1 Remote Operation via external Terminal Server (Connection to M-CPU with
TIAX00) ..................................................................................................... 45
2.8.2 Remote Operation via integrated Terminal Server...................................... 46
2.9 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPiA1 only) .......... 47
2.9.1 Remote Operation via TCP/IP HTTP/HTTPS ............................................. 47

DC0-090-2.10, Edition 12.2017
Table of Contents
2.10 DNP3 Protocol Description ............................................................................. 49

2.10.1 PCMBA Modulation Method....................................................................... 49
2.11 Interface Circuits Used ................................................................................... 50
2.12 Message Description for DNP3 (Data Link Layer) ........................................... 51
2.12.1 FT3 Message Format for Messages with variable Lengths ......................... 51
2.12.2 Message Structure for DNP3 ..................................................................... 54
2.12.2.1 LINK Header (message header) ........................................................... 55
2.12.2.2 Transport Header ................................................................................. 58
2.12.2.3 User Data (APDU) ................................................................................ 59
2.12.2.3.1 Application Header (APCI) ............................................................... 60
2.12.2.3.2 Object Header (DUI) ........................................................................ 64
2.12.2.3.3 Data Objects (IO)............................................................................. 65
2.12.2.3.4 Data Index ....................................................................................... 65
2.12.3 Message Examples for DNP3 .................................................................... 65
2.13 Message Conversion ...................................................................................... 66
2.13.1 Status Information General Rules .............................................................. 69
2.13.1.1 Conversion of NT-bit............................................................................. 70
2.13.1.2 Conversion of IV-bit .............................................................................. 70
2.13.1.3 Status Information for Binary Information .............................................. 71
2.13.1.4 Status Information for Measured Values ............................................... 71
2.13.1.5 Status Information for Counter Values .................................................. 71
2.13.2 DNP3 MASTER: Message Conversion in Receive Direction ...................... 72
2.13.2.1 Process Information “Binary Input” ........................................................ 73
2.13.2.2 Process Information “Double Binary Input” ............................................ 77
2.13.2.2.1 Process Information “Binary Output” ................................................ 80
2.13.2.3 Message Conversion Measured Values ................................................ 82
2.13.2.4 Message Conversion of Counts ............................................................ 90
2.13.3 DNP3 MASTER: Message Conversion in Transmit Direction ..................... 96
2.13.3.1 Message Conversion of Commands ..................................................... 97
2.13.3.2 Message Conversion of Binary Output ................................................ 101
2.13.3.3 Message Conversion of Setpoint Values............................................. 103
2.13.4 DNP3 SLAVE: Message Conversion in Transmit Direction ....................... 105
2.13.4.1 Message Conversion of Process Information ...................................... 106
2.13.4.1.1 Conversion to Binary Input ............................................................. 106
2.13.4.1.2 Conversion to Double Binary Input ................................................. 109
2.13.4.2 Message Conversion Measured Values .............................................. 112
2.13.4.3 Message Conversion Counts .............................................................. 120
2.13.5 DNP3 SLAVE: Message Conversion in Receive Direction ........................ 124
2.13.5.1 Message Conversion Commands ....................................................... 125
2.13.5.2 Message Conversion Setpoint Values................................................. 129
2.14 Special Functions ......................................................................................... 132
2.14.1 Sags and Swells for DNP3 Master and Slave........................................... 132
2.14.2 Storing User Data on the BSE (DNP3 Slave) ........................................... 135
2.14.3 Enable SCBO (Check Back Before Operate) ........................................... 136

Edition 12.2017, DC0-090-2.10
Table of Contents
2.14.4 Redundancy Function: Hot Standby ......................................................... 137

2.14.5 State Compression for Measured Value Events ....................................... 138
2.14.6 Link Address Substitution (DNPi00, DNPiA1 and DNPiT1 only)................ 138
2.15 Wildcard TCP/IP Address (DNPiT1).............................................................. 139
2.16 Protocol Element Control and Return Information ......................................... 140
2.16.1 Protocol Element Control Slave ............................................................... 141
2.16.1.1 Control Internal Indication Bit LOCAL.................................................. 141
2.16.1.2 Control Selective Command Disable ................................................... 142
2.16.1.3 Control Command Disable for OFF and ON Command ....................... 143
2.16.1.4 Deactivate/Activate Events ................................................................. 145
2.16.2 Protocol Element Control Master ............................................................. 146
2.16.2.1 Send „Reset Link“ ............................................................................... 146
2.16.3 Protocol Element Return Information ....................................................... 147
2.17 Web Server .................................................................................................. 148
2.17.1 Overview ................................................................................................. 150
2.17.2 Connections ............................................................................................ 151
2.17.3 Routing Transmit ..................................................................................... 152
2.17.4 Routing Receive ...................................................................................... 153
2.17.5 Developer Information - Freespace .......................................................... 154
2.17.6 Developer Information – Dataflow Test .................................................... 155
3 Application Notes...................................................................................................... 157
3.1 General ........................................................................................................ 158

3.1.1 What are Static Data and what are Event Data? ...................................... 158
3.1.2 What are Class 0, 1, 2 or 3 Data? ............................................................ 158
3.1.3 Object Group and Object Variation .......................................................... 159
3.1.4 Use of the Data Index .............................................................................. 159
3.1.5 Unsolicited Response .............................................................................. 159
3.2 Central Function ........................................................................................... 160
3.2.1 Cyclic Data Query.................................................................................... 160
3.2.2 Conversion 2 Single Binary Inputs to 1 Double-Point Information ............. 161
3.3 Controlled Station Function........................................................................... 162
3.3.1 Conversion 1 Double-Point Information to 2 Single Binary Inputs ............. 162

DC0-090-2.10, Edition 12.2017
Table of Contents

Edition 12.2017, DC0-090-2.10
1 Introduction
Contents
1.1 Application ..................................................................................................... 10

1.2 Configuration .................................................................................................. 11
1.3 Features and Functions .................................................................................. 14

DC0-090-2.10, Edition 12.2017
Introduction
1.1 Application
The DNP3 protocol (Distributed Network Protocol) is used in automation units of the systems
SICAM AK, SICAM TM, SICAM BC, SICAM EMIC, SICAM A8000 Serie (CP-8000, CP-8021,
CP-8022), AK 1703 and AMC 1703. It is deployed in the fields of telecontrol and automation.
The protocol is used for the exchange of data - and thereby for the transmission of messages
- over a communication interface to other automation units or devices of other manufacturers.
1.1.1 Which Protocols are available in which Systems
SICAM BC (local SS)
AMC 1703 (local SS)

SM-0551, SM-2551
CP-8021, CP-8022
SICAM CP-8000,
(only CP-5014)
(only CP-4000)
(only CPxxxx)
SICAM EMIC
SICAM MIC
SM-2541
SM-2545
SM-2546
SM-2556
Protocol SM-2558
DNP3 Master (serial) £ n n

DNP3 Slave (serial) £ n n n
DNP3 Master (LAN, TCP/IP) ¨ n
DNP3 Slave (LAN, TCP/IP) ¨ n n n n
↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓ ↓
System
n n n n AK 1703
n n n n n AMC 1703
n n SICAM AK 3
n n n n n SICAM AK
n n n n n SICAM TM
SICAM MIC
n SICAM EMIC
n SICAM A8000
n n n n n n SICAM BC
Legend:
n available
£ available – new functions are no longer implemented on this hardware!
¨ only with external terminal servers (serial-to-Ethernet), e.g. Lantronix or Ruggedcom
DNP3 "serial" is used as protocol
n product discontinued, termination of delivery date exceeded

Edition 12.2017, DC0-090-2.10
Introduction
1.2 Configuration
1.2.1 Communication
For the stations to communicate with each other, suitable transmission facilities and/or
network components may be needed in addition.
Controlling station
System System Element Protocol Element Note

SICAM AK 3 CP-2016/CPCX26 SM-2551/DNPMA0 max. 20 Slaves
CP-2019/PCCX26 SM-0551/DNPMA0
CP-2017/PCCX25
SICAM AK CP-2014/CPCX25 SM-2551/DNPMA0 max. 20 Slaves
CP-2010/CPC25 SM-0551/DNPMA0
CP-2017/PCCX25
CP-2012/PCCE25
SICAM A8000 Series CP-8000/CPC80
SICAM CP-8000 CP-8021/CPC80 DNPMT0 max. 10 Slaves
SICAM CP-8021 CP-8022/CPC80
SICAM CP-8022
CP-8000/CPC80
CP-8021/CPC80 DNPiT2 max. 4 Slaves
CP-8022/CPC80
SICAM BC CP-5014/CPCX55 SM-2551/DNPMA0 max. 20 Slaves
SICAM TM CP-6014/CPCX65 SM-2551/DNPMA0 max. 20 Slaves
AK 1703 CP-2000/CPC00 SM-2551/DNPMA0 max. 20 Slaves

CP-2002/PCCE00 SM-0551/DNPMA0
CP-2002/CE00
CP-2012/CE20
AMC 1703 CP-4000/CCP4x SM-2551/DNPMA0 max. 20 Slaves
CP-4003/CCP4x SM-0551/DNPMA0

DC0-090-2.10, Edition 12.2017
Introduction
Controlled station
System System Element Protocol Element Note

SICAM AK 3 CP-2016/CPCX26 SM-2551/DNPSA0 1 Master as remote station
CP-2019/PCCX26 SM-0551/DNPSA0
CP-2017/PCCX25
CP-2019/PCCX26 SM-2546/DNPi00 Max. 100 remote stations
CP-2017/PCCX25 SM-2556/DNPi00 (Multislave)
CP-2019/PCCX26 SM-2558/DNPiA1 Max. 100 remote stations

CP-2017/PCCX25 (Multislave)
SICAM AK CP-2014/CPCX25 SM-2551/DNPSA0 1 Master as remote station
CP-2010/CPC25 SM-0551/DNPSA0
CP-2017/PCCX25
CP-2012/PCCE25
CP-2017/PCCX25 SM-2546/DNPi00 Max. 100 remote stations
CP-2010/CPC25 SM-2556/DNPi00 (Multislave)
CP-2012/PCCE25
CP-2017/PCCX25 SM-2558/DNPiA1 Max. 100 remote stations

CP-2010/CPC25 (Multislave)
CP-2012/PCCE25
SICAM A8000 Series CP-8000/CPC80 DNPST0 1 Master as remote station
SICAM CP-8022
CP-8000/CPC80 DNPiT1 Max. 4 remote stations
CP-8022/CPC80
SICAM BC CP-5014/CPCX55 SM-2551/DNPSA0 1 Master as remote station
CP-5014/CPCX55 SM-2546/DNPi00 Max. 100 remote stations
CP-5000/CPC55 SM-2556/DNPi00 (Multislave)
CP-5014/CPCX55 SM-2558/DNPiA1 Max. 100 remote stations
SICAM TM CP-6014/CPCX65 SM-2551/DNPSA0 1 Master as remote station
SM-2546/DNPi00 Max. 100 remote stations
SM-2556/DNPi00 (Multislave)
SM-2558/DNPiA1 Max. 100 remote stations
(Multislave)
AK 1703 CP-2000/CPC00 SM-2551/DNPSA0 1 Master as remote station

CP-2002/PCCE00 SM-0551/DNPSA0
CP-2002/CE00
CP-2012/CE20 SM-2556/DNPi00 Max. 100 remote stations
SM-2546/DNPi00 (Multislave)
AMC 1703 CP-4000/CCP4x SM-2551/DNPSA0 1 Master as remote station
CP-4003/CCP4x SM-0551/DNPSA0
SICAM EMIC DNPST0 1 Master as remote station
DNPiT0 Max. 2 remote stations
(Multislave)
Third-party system -- -- According to SICAM RTUs

DNP3 Interoperability

Edition 12.2017, DC0-090-2.10
Introduction
Note when using DNPi00/DNPiT1/DNPiA1

When using the function of the controlled station a controlled station must always be connected with only
one controlling station. The DNP destination address and DNP source address may always only occur one
time in the definition of the network connections (connection definitions). It is not possible to connect
multiple controlled stations (e.g. DNP source address 1000, 1001 and 1002) to the same controlling
station (e.g. DNP destination address 10). Nevertheless and if needed it is possible to substitute the DNP
destination address and the DNP source addres for a maximum of 4 connections (see 2.14.6)
The following examples are possible:
· 1 controlling station with 18 controlled stations

· 1 controlling station with 18 controlled stations and a further controlling station with 10
controlled stations
· 1 controlled station with 1 controlling station
· 3 controlled stations with 3 controlling stations
· Combinations from the preceding points
Note
The present versions of the firmwares DNPi00, DNPiT0, DNPiT1 and DNPiA1 only support the controlled
station functionality.
In a later expansion variant the function of the controlling station will also be supported.

DC0-090-2.10, Edition 12.2017
Introduction
1.3 Features and Functions
General Functions
Unbalanced Multi-Point (multi-point traffic) according to DNP3 over serial or network (TCP/IP)
based transmission facilities
· DNPMx0 is controlling station (Master), DNPSx0 is controlled station (Slave) for DNP3
serial
· DNPix0 and DNPix1 is controlled station (Slave) for DNP over TCP/IP
─ Supported functionality according to:
SICAM RTUs DNP3 Interoperability (DC0-046-2)
─ Data acquisition by polling (station interrogation)
─ Acquisition of events (transmission of data ready to be sent, unsolicited responses)
─ General interrogation, controlled station interrogation
─ Command transmission
─ Transmission of integrated totals
· DNPix2 is controlling station (Master) for DNP over TCP/IP
─ Supported functionality according to:
SICAM RTUs DNP3 Interoperability (DC0-046-2)
─ Data acquisition by polling (station interrogation, event request)
─ General interrogation, controlled station interrogation
─ Command transmission
· Clock synchronization according to NTP (Network Time Protocol) - RFC 1305 1)
─ NTP Client: Clock synchronization with one or more NTP servers
─ NTP Server: integrated NTP server for clock synchronization of one or several
NTP clients
· Optimized parameters for selected transmission facilities 2)
· Functions for supporting redundant communication routes
· Special functions
· SICAM TOOLBOX II connection over LAN/WAN ("remote operation") 1)
─ Connection via proprietary TCP/IP protocol
(one SICAM TOOLBOX II session can be served at the same time)
· Web server 1)
─ Integrated web server to display connection- statistic- and developer information
─ Access to the web server with standard web browser via HTTP (Hyper Text Transfer
Protocol)
______
1) only DNP3 over TCP/IP
2) only DNP3 serial
Note
The above mentioned functions are described in detail in the chapter Protocol Description.
As a third-party system adaptation this protocol element implements only part of the functionality and data
formats of the third-party interface. It is therefore always to be checked for a concrete case of application,
whether the supported functionality corresponds with the functionality required in the project, respectively
which additional functions or adaptations are required.

Edition 12.2017, DC0-090-2.10
2 Protocol Description
Contents
2.1 Overview ........................................................................................................ 16

2.2 Technical Specifications ................................................................................. 19
2.3 Limitations ...................................................................................................... 22
2.4 Communication according to DNP3 ................................................................ 23
2.5 Optimized Parameters for selected Transmission Facilities (serial
communication) .............................................................................................. 37
2.6 Function for the Support of redundant Communication Routes ........................ 42
2.7 Web Server (DNPi00 only).............................................................................. 43
2.8 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPi00 only) ........... 45
2.9 Remote Operation for SICAM TOOLBOX II (LAN/WAN) (DNPiA1 only) .......... 47
2.10 DNP3 Protocol Description ............................................................................. 49
2.11 Interface Circuits Used ................................................................................... 50
2.12 Message Description for DNP3 (Data Link Layer) ........................................... 51
2.13 Message Conversion ...................................................................................... 66
2.14 Special Functions ......................................................................................... 132
2.15 Wildcard TCP/IP Address (DNPiT1).............................................................. 139
2.16 Protocol Element Control and Return Information ......................................... 140
2.17 Web Server .................................................................................................. 148

DC0-090-2.10, Edition 12.2017
Protocol Description
2.1 Overview
The DNP3 protocol (Distributed Network Protocol) is an official communication standard for
telecontrol engineering. The protocol is used as general transmission protocol between control
systems and remote stations.
Typically the messages are transmitted over serial connections (ITU-T V.24 (EIA-232) / ITU-T
V.28 (EIA-422) as well as over a network (TCP/IP) based infrastructure. The DNP3 telecontrol
protocol is standardized and further developed by the DNP Users Group.
The DNP3 protocol defines one controlling station with one or multiple controlled stations.
The controlling station and the controlled stations work with a communication protocol
according to DNP3 in multi-point traffic.
The supported functionality (interoperability) of the various devices can be seen in the device-
specific "DNP3 Device Profile Document" – for SICAM RTUs in the document "SICAM RTUs
DNP3 Interoperability".
A communication protocol for which a controlling station is connected with one or multiple
controlled stations over a communication link in a linear or star configuration is known as multi-
point traffic. The data traffic is controlled by the controlling station, whereby with DNP3, in
contrast to other protocols, the controlled station can also send unsolicited spontaneous data
(=unsolicited responses).
The protocol element DNPMx0 enables the serial communication of one MASTER with up to a
maximum of 20 controlled stations (SLAVES) on a common line.
Every controlled station is assigned an unambiguous station number (DNP source address) in
the range "0 - 65519". The controlling station is also assigned an unambiguous station number
in the range "0 - 65519".
The station number 65535 (0xFFFF) is used for the simultaneous addressing of all stations (=
BROADCAST). With this type of addressing no reply (Response Message) is transmitted from
the SLAVES to the MASTER.
The protocol element DNPSx0 enables the serial communication of one controlled station with
one controlling station.
As “Multi-Slave” the protocol element DNPi00 enables the communication of one or multiple
controlled station(s) with one or multiple controlling stations over Ethernet (LAN/WAN).
A controlled station can only communicate with one unambiguous controlling station.
Note
When using the firmware DNPi00 it is not possible to couple multiple controlled stations to one and the
same controlling station.
Multiple controlled stations can only be connected to different controlling stations.

Edition 12.2017, DC0-090-2.10
With DNP3 a transmission of data can be initiated not only by the MASTER station but also by
the SLAVE station. A data transmission consists either of a "query-response sequence"
(= Query/Response Type) to selectively addressed controlled stations or a simultaneous
addressing of all connected controlled stations (= BROADCAST/NO Response Type).
The cyclic queries or data messages provided for the DNP3 communication protocol are
transmitted by the controlling station. Data from the controlled station to the controlling station
can be transmitted either as direct response to a query or as spontaneous data without
preceding query.
Schematic configuration DNP3 "serial":
DNP3 Master Station

(Ax/ACP 1703)
DNPMx0
DNP3 - protocol (max. 100 stations) – recommended „max. 20 stations“
DNPSx0
DNP3 Slave DNP3 Slave DNP3 Slave
#2 #3 #n
DNP3 Slave #1
Remote Station (Ax/ACP 1703)
n <= 65519
Schematic configuration DNP3 over Ethernet (TCP/IP):
DNP3 Zentralstation Master #1 DNP3 Zentralstation Master #2

(Ax/ACP 1703) (SICAM A8000 (CP-8000, CP-802x) DNP3
DNPMA0 DNPiT2
Zentralstation
serial-Interface LAN-Interface Master #n
LAN-Interface
Serial <-> Ethernet
Konverter
Switch Switch
Ethernet “DNP3 over TCP/IP“
Ethernet “DNP3 over TCP/IP“ Ethernet “DNP3 over TCP/IP“
Switch Switch Switch
Serial <-> Ethernet

Konverter
LAN-Interface LAN-Interface LAN-Interface

DNPi00 **) DNPiT1
DNP3 Slave
DNP3 Slave #1 DNP3 Slave #3 #n
(Ax/ACP 1703) SICAM A8000 (CP-8000, CP-802x)
serial-Interface LAN-Interface
DNPSx0 DNPiA1
DNP3 Slave #2 SICAM AK3, SICAM TM
SICAM AK3, SICAM TM (Ax/ACP 1703)
SICAM A8000 (CP-8000, CP-802x)
**) max. 100 connections per LAN-Interface

DC0-090-2.10, Edition 12.2017
On the application layer the DNP3 communication protocol uses the “unbalanced transmission
procedure“, in order to communicate with more than one slave. However on the link layer the
communication between the two stations takes place as “balanced transmission procedure”.
As a result it is also possible for the slave to send spontaneous data, so-called “unsolicited
responses”, without preceding call of the master.
That means on the one hand, that as primary station the controlling station initiates messages
transmissions and the controlled station processes these and replies or that, in the case of
unsolicited responses, the controlled station starts the message transmission spontaneously
and the controlling station processes these and replies or acknowledges.
In multi-point traffic with polling mode the DNP3 protocol requires only a “half duplex”
transmission medium and can be used in a star or linear structure.
If the controlled stations use the spontaneous data transmission (=unsolicited responses), then
with a "half duplex” transmission medium collisions can occur in the message traffic. Either
because multiple controlled stations or the master and one controlled station begin with the
data transmission at the same time. If collisions are to be completely avoided, then this is only
achieved with a “full duplex” transmission medium and only one controlled station may be
connected to one master.
In all other cases collisions can occur and consequently the data transmission can be
impaired.

Edition 12.2017, DC0-090-2.10
2.2 Technical Specifications
Number of Stations
· max. 100 DNP3 controlled stations *)
Slave Addresses · 0 - 65519, 65535 = BROADCAST

*) because of performance, required response time and limited storage capacity fewer stations are
possible for the serial protocols (max. 20)
Physical Interface
· RS232
· RS485
· LAN (TCP/IP)
Modulation
· PCM Byte-Asynchronous
Supported Baud Rates *)

· 50, 75, 100, 110, 134.5, 150, 200, 300, 600, 1050, 1200, 1800, 2000,
2400, 4800, 9600, 19200, 38400, 56000, 57600, 64000
*) the max. possible baud rate is also determined by the hardware used
Byte Frame
· 8N1 (8E1)
Bit transmission sequence: LSB 1st
(less significant bit is transmitted first)
Message Frame
· Similar to IEC60870-5-1 / FT3
Message Protection
· d=6
16 13 12 11 10 8 6 5 2
CRC g(x) = x + x + x + x + x + x + x + x + x + 1
DNP3 Protocol
Data communication · Master - Slave (Request Response) and “Unsolicited Responses”
control controlled station can transmit spontaneously
· Full duplex or half duplex
Transmission method
Supported DNP3 Formats

· … see SICAM RTUs DNP3 Interoperability (DC0-046-2)

DC0-090-2.10, Edition 12.2017
DNP3 Slave:
Supported IEC60870-5-101/104 message formats in transmit direction
"SICAM RTUs è DNP3" (signal or monitor direction)
· <TI=30> … Single-point information with CP56Time2a time stamp
· <TI=31> … Double-point information with CP56Time2a time stamp
· <TI=34> … Measured value, normalized value with CP56Time2a time
stamp
(15 Bit + polarity sign)
· <TI=35> … Measured value, scaled value with CP56Time2a time
stamp
· <TI=36> … Measured value, short floating point number with
CP56Time2a time stamp
· <TI=37> … Integrated totals with CP56Time2a time stamp
(31 Bit + polarity sign with sequence number)
DNP3 Slave:
Supported IEC60870-5-101/104 message formats in receive direction
"SICAM RTUs ç DNP3" (command or control direction)
· <TI=45> … Single command
· <TI=46> … Double command
· <TI=48> … Setpoint command normalized value
· <TI=49> … Setpoint command scaled value
· <TI=50> … Setpoint command short floating point number
DNP3 Master:
Supported IEC60870-5-101/104 message formats in transmit direction
"SICAM RTUs è DNP3" (command or control direction)
stamp
stamp
· <TI=45> … Single command
· <TI=46> … Double command
· <TI=48> … Setpoint command normalized value
· <TI=49> … Setpoint command scaled value
· <TI=50> … Setpoint command short floating point number
DNP3 Master:
Supported IEC60870-5-101/104 message formats in receive direction
"SICAM RTUs ç DNP3" (signal or monitor direction)
· <TI=31> … Double-point information with CP56Time2a time stamp
stamp
stamp
· <TI=37> … Integrated totals with CP56Time2a time stamp
(31 Bit + polarity sign with sequence number)

Edition 12.2017, DC0-090-2.10
Redundancy
· Redundancy *)
*) is not supported for DNPixy (DNP over Ethernet)!
Parameter Setting
· System technical parameter with SICAM TOOLBOX II
· Process technical parameter with SICAM TOOLBOX II
parameter-settable address conversion in transmit and receive
direction with OPM
Note
formats of the third-party interface. It is therefore to be checked for a concrete case of application, to what
extent the real requirements correspond with the functionality implemented here and to what extent are
additional expansions or adaptations required.

DC0-090-2.10, Edition 12.2017
2.3 Limitations
· DNP3 Master: (DNPMx0)

─ Only selected DNP3 function codes are supported
─ The supported DNP3 functionality (Object/Variation, …) can be seen in the document
SICAM RTUs DNP3 Interoperability (=DNP3 Device Profile Document)
─ File transfer is not supported
─ Maximum 20 stations
─ Max. data index (per data type) = 65535
· DNP3 Slave: (DNPSx0)
─ Only selected DNP3 function codes are supported
─ The supported DNP3 functionality (Object/Variation, …) can be seen in the document
SICAM RTUs DNP3 Interoperability (=DNP3 Device Profile Document)
─ File transfer is not supported
─ Max. data index (per data type) = 65535
· DNP3 over Ethernet: (DNPi00)
─ See DNPSx0
─ No redundancy functionality
· DNP3 over Ethernet: (DNPiT0)
─ See DNPSx0
─ See DNPSx0
· DNP3 over Ethernet: (DNPiA1)
─ See DNPSx0
─ See DNPMx0
Note
formats of the third-party interface. It is therefore to be checked for a concrete case of application, to what
extent the real requirements correspond with the functionality implemented here and to what extent are
additional expansions or adaptations required.

Edition 12.2017, DC0-090-2.10
2.4 Communication according to DNP3
2.4.1 Data Acquisition through Queries and "unsolicited Responses"
The transmission of the data from the controlled stations to the controlling station takes place
either through station-selective station interrogation (interrogation procedure, polling) of the
parameterized DNP3 data objects, controlled by the controlling station or through the
spontaneous transmission of the data from the controlled station to the controlling station with
the DNP3 Service “Unsolicited Responses”.
To reduce collisions in the transmission of data with DNP3 protocol the parameter advanced
parameters | DNP time settings | Timeout transmit delay is to be set differently
in all stations.
The station-selective parameters of the controlling station for the DNP3 protocol, such as
"Stat No", "Link address", "Station enable", "Station failure", "Priority level", "Number of calls"
and "Block class 2 data" are to be set in the parameter station definition.
The 1703-internal station number is to be entered in the field "Stat No".
Station addresses
For the data transmission with DNP3 each station has an unambiguous station address. The
"source address" and "destination address" are always to be entered in DNP3 messages.
In the controlling station and in every controlled station the own station address "source
address" must be set with the parameter advanced parameters | common DNP
settings | Own station number.
Note:
In the controlled station the parameter Common settings | address of the link is identical with the parameter advanced
parameters | common DNP settings | Own station number.
In the controlling station the station numbers of the remote stations "destination addresses"
are to be set in the parameter station definition in the field "Link address".
In the controlled station the station number of the remote station "destination address" is to be
set with the parameter advanced parameters | common DNP settings | destination
station number.
When using the firmware DNPi00 the station parameterization is carried out by means of the
Connection Definition.
With the DNP3 protocol, in monitoring direction either the momentary data of the process
image (static object types) or events (dynamic objects types or events with/without real time
information) are interrogated by the controlling station. The direct transmission of the
commands and setpoint values takes place in control direction. However it is also possible
that the controlled station can also transmit events spontaneously without preceding
interrogation by the controlling station. This involves an unsolicited response.

DC0-090-2.10, Edition 12.2017
Interrogation procedure (Query/Response Cycle)

All data that are to be queried by the DNP3 Master station must be configured using the
systemtechnical parameter spreadsheet advanced parameters | cyclic request for
data located on the protocol element for DNP3 Master. The simplest variant for this is the
query of the DNP3 data classes 0 to 3. Data class 0 contains all static data points (complete
process image) and the data classes 1 to 3 contain the saved events with or without real time
information. Which data are then assigned to which data class can be freely parameterized.
The type, number and address of the data to be transmitted from the controlled station is
specified in the query message. As a response the addressed controlled station sends the
requested data (Response Message) or if an error has been determined in the request (e.g.
address not present in the controlled station), a corresponding error information. Data are
transmitted from the central station (MASTER station) to the controlled stations (SLAVE
station) spontaneously with change.
The interrogation procedure is carried out depending on the set cycle time. There exists no
continuous cycle in the sense of permanent polling of the controlled station. If data are to be
queried, then these queries must be configured in the table mentioned above.
The station-selective parameters of the controlling station for the configuration of the
controlled stations, such as "Stat No", "Link address", "Station enable", "Station failure" are to
be set in the parameter station definition. The station number "Stat No" (0-99) is only
used 1703-internal. The station number "Link address" (0-65519) is used for the
communication on the line to the controlled stations. Parameterized stations can be excluded
from the station interrogation with the parameter "Station enable". The fault signaling of failed
stations can be suppressed with the parameter "Station failure".
Every controlled station is assigned an unambiguous station number in the range "0 - 65519",
whereby the controlling station also occupies an unambiguous station number.
The station number "65535" is used for the simultaneous addressing of all stations (=
BROADCAST). With this type of addressing no reply (Response Message) is transmitted
from the SLAVES to the MASTER.
A listening mode is not supported by the controlling station with DNP3 protocol!

Edition 12.2017, DC0-090-2.10
2.4.1.1 Continuous Interrogation of a Controlled Station
The “continuous cycle” or continuous call of the controlled station for the transmission of user
data or also only for maintaining the connection between controlling station and controlled
station is not supported by the firmware DNPMx0 and DNPi00 and is also not provided in this
form in the definition of the DNP3.0 protocol. The reason for this lies in the possibility for the
controlled station – also without preceding call by the controlling station – to send data
spontaneously. If the communication was occupied by a continuous cycle, then these data
could not be transmitted. Communication faults would then occur due to collisions.
But since it must nevertheless be possible to query data from the controlled station cyclically,
the parameter table “cyclic data query” is available for this purpose. Here a cycle time of at
least 1 second to maximum 35535 seconds can be set for every data query configured there.
If spontaneous data from the controlled station are used (unsolicited response), then the
values used for the cycle time of the queries should not be too small. A precise description of
this parameter table can be found in chapter “Application Notes”.
2.4.1.2 Acknowledgement Procedure
All interrogation messages sent selectively to a controlled station must be responded to or at

least acknowledged by this station. If the acknowledgement on a non-faulty transmission line
is missing for longer than the expected acknowledgement time, transmitted messages are
repeated up to n-times (n can be parameterized). After expiration of the number of retries the
station is marked as faulty.
The DNP3 protocol enables an acknowledgement at link level ("Data Link Layer
Confirmation") and an acknowledgement at application level ("Application Layer
Confirmation").
An acknowledgement at application level ("Application Layer Confirmation") is only then used
for multifragments by the DNP3 protocol implementation in SICAM RTUs if no
acknowledgement at link level is set.
Note
The firmware monitors all received messages for continuous byte reception (message interruption). It has
been shown again and again in the past, that some devices of third-party manufacturers can not maintain
this continuous message transmission and consequently message errors or acknowledgement errors
occur. In this case the parameters advanced parameters | Monitoring times | Character
monitoring time,
advanced parameters | Monitoring times | Character monitoring time “time base”are to
be adapted accordingly. A value of approx. 100 milliseconds can thereby be used.
Acknowledgement at Link Level

The type of acknowledgement at link level ("Data Link Layer Confirmation") can be set in the
controlling station and in the controlled station with the parameter advanced parameters |
common DNP settings | Data link layer confirmation.
Acknowledgement at link level:
· No acknowledgement
· Only for multifragments
· Always expect acknowledgement

DC0-090-2.10, Edition 12.2017
Expected Acknowledgement Time

The required expected acknowledgement time for acknowledgements at link level is set with
the following parameter advanced parameters | Monitoring times |
Expected_ack_time_corr_factor. For this the message transfer time for maximum 292
bytes of a message is to be observed in combination with other possible delays.
Messages Repetition (Retries)

The number of retries for "Data Link Layer Confirmation" for data messages is to be set in the
controlling station and in the controlled station with the parameter Message
retries | Retries for data message SEND/CONFIRM (station selective).
Note:
The parameter Message retries | Retries für Datentelegramm SEND/NO REPLY (broadcast) and the parameter Message
retries | Retries for INIT-messages SEND/CONFIRM (station selective) are presently not evaluated and not supported!
In the controlled station the Retry number for “Unsolicited Responses” can be set separately
with the parameter advanced parameters | common DNP settings | Retrycount for
unsolicited messages.
Acknowledgement at Application Level

If generally no acknowledgement is set at link level, then an acknowledgement at application
level is used by the firmware, at least for multifragments.
The required expected acknowledgement time for acknowledgements at application level is

set with the following parameter advanced parameters | DNP time settings |
Timeout Application Confirmation. For this the message transfer time for a complete
DNP3 message fragment (multiple single messages each with maximum 292 bytes) is to be
observed in combination with other possible delays.
The Retry number for “Application Layer” is taken from the Retry number for “Data Link Layer
Confirmation”.

Edition 12.2017, DC0-090-2.10
2.4.1.3 Failure Monitoring

Both the controlling station and the controlled station are able to monitor the communication.
This can be realized in different ways. Thereby user data can be transmitted subject to
acknowledgement with an acknowledgement request at the level of the link layer and/or the
application layer. It is also possible to detect a failure of the remote station through cyclic
monitoring of the link layer. The parameter advanced parameters | Monitoring
times | Interface_monitoring “cycle time”is used for this. This cycle time is
retriggered with each message subject to acknowledgement and the test message of the link
level is only transmitted after expiration of this time. The value 0 deactivates this test
procedure. In addition, for the master station function the parameter table “cyclic data query”
can be used, in order to ensure failure monitoring.
If a message subject to acknowledgement is not acknowledged or if the acknowledgement is

not received, then a Retry of the message takes place after expiration of the expected
acknowledgement time. This takes place until the maximum number of retries has been
reached.
A station is signaled as failed after expiration of the number of retries. Retries to a controlled
station are thereby always transmitted directly one after the other after expiration of the
expected acknowledgement time i.e. no other controlled stations are interrogated during an
ongoing retry handling. A communication fault is only signaled for failed controlled stations
when this is parameterized accordingly in the parameter "Station failure" of the station
definition.
No more cyclic data queries are allowed for stations that have failed once. A renewed
connection setup takes place at the level of the link layer once per minute (see Station
Initialization).
No data are transmitted from the controlling station to failed controlled stations. The data are
stored in the data storage of the communication function on the basic system element (BSE)
until they are deleted by the dwell time monitoring or are transmitted to the non-failed
controlled station.
2.4.2 Station Initialization
After startup or redundancy switchover the operation of the interface is resumed after
successful station initialization.
The initialization of the link layer of the controlled station is carried out by the controlling
station with:
· Request status of the link layer (REQUEST STATUS OF LINK)

· Normalization of the link layer of the controlled station (RESET OF REMOTE LINK)
Reset Command Function in the Controlled Station

--- no INIT (LINK is immediately active)
RESET of REMOTE LINK · only RESET of REMOTE LINK
REQUEST STATUS OF LINK · FCB-Bit (Frame Count Bit) is initialized
+ · Acknowledgement for RESET of REMOTE LINK is transmitted
RESET of REMOTE LINK to the controlling station
Initialization End
The protocol element for DNP3 Master and DNP3 Slave does not send any “Initialization End
message” to the basic system element.

DC0-090-2.10, Edition 12.2017
2.4.3 Acquisition of Events (transmission of data ready to be sent)
Data of the controlled station that are ready to be sent are stored for transmission in the
controlled station in the DNP3 database on the protocol element or transmitted spontaneously
to the controlling station.
For this all data offered for transmission by the basic system element are transferred from the
protocol element and processed according to the settings in the process technical parameters
on the protocol element.
Note:
The protocol implementation for DNP3 Master and DNP3 Slave for SICAM RTUs uses the "Source Code Library (SCL) for DNP3" of the firm
Triangle Micro Works. This integrated software package essentially controls the data transmission based on DNP3 – the data are stored in
the DNP3 database (=part of the SCL) for the data transmission.
The data are always entered in the process image for “status data” (static data class 0) in the
DNP3 database and thus made ready for interrogation by the controlling station. In addition
the changed data can be entered in the DNP3 database as a sequence of events with or
without real time information in a separate process image for "events" and if used, also
transmitted spontaneously to the controlling station as “unsolicited response”.
In the process image for “status data” always only the current value per DNP3 address is
stored in the DNP3 database and offered for transmission.
In the process image for events (Event Buffer) 250 events are stored in the DNP3 database
for binary information “single binary input”, 250 events for “double binary input”, 250 for
measured values and 100 events for integrated totals.
In the controlled station it can be determined with the parameter advanced
parameters | common DNP settings | delete oldest event if event buffer
overflow whether with "Event Buffer Overflow" the oldest data are to be overwritten or the
most recent data are to be discarded.
If it should be necessary to store more data in the Slave, for example during a communication
failure, then it is possible to buffer these data on the BSE. A more detailed description about
this can be seen in the chapter entitled Special Functions 2.14.2 Storing User Data on the
BSE (DNP3 Slave).
After startup of the protocol element DNPSx0 in the controlled station the data are updated in
the DNP3 database with a system-internal general interrogation. This general interrogation is
generated by the firmware itself directly after startup and distributed in the system. However
the communication to the controlling station is first activated after a delay time.
The delay time is to be set with the parameter advanced parameters | Startup delay
so that on expiration of the delay time all data intended for transmission to the controlling
station are available on the protocol element.
2.4.3.1 Message from the Controlled Station to the Controlling Station
Messages from the controlled station to the controlling station are transmitted from the
controlled station to the controlling station either with station interrogation by the controlling
station (interrogation of parameterized DNP3 addresses or address ranges) or spontaneously
with change with "Unsolicited Responses".
If “Unsolicited Responses” are used, then these are first transmitted after a delay time of 3
seconds, so that any new events occurring within this time can also be transmitted.

Edition 12.2017, DC0-090-2.10
2.4.4 General Interrogation, Controlled Station Interrogation
The function general interrogation (controlled station interrogation) is used to update the
controlling station after the internal initialization (startup or reset) or after a going
communication fault has been detected.
The DNP3 protocol does not define any GI concept, as is used for example in IEC 870-5-101!
To nevertheless establish compatibility to the system Ax/ACP 1703, the GI is realized as
follows:
· On reception of a GI request in the 1703 system all parameterized DNP3 data of data
class 0 (=local static data) are interrogated by the controlled stations and forwarded to the
basic system element with cause of transmission (COT=20 “interrogated by GI”).
· The interrogation of data class 0 is sent to the controlled station and all received data are
converted accordingly.
A general interrogation command triggered in the system “to all” is always forwarded by the
communication function on the basic system element (BSE) station-selective to the protocol
element of the controlling station and also processed station-selective by this.

DC0-090-2.10, Edition 12.2017
2.4.5 Clock Synchronization
Setting the Time, Remote Synchronization

The clock synchronization of the controlled stations (=remote synchronization) can –
controlled by the controlling station – be carried out over the serial communication line. The
remote synchronization is performed cyclically by the controlling station. In the controlling
station the time scale can be set with the parameter advanced parameters | Cycle
time for sending clock synchronization command.
The controlled station can request a clock synchronization from the controlling station. The
time scale for the request of the clock synchronization can be set in the controlled station with
the parameter advanced parameters | Cycle time for sending clock
synchronization command.
The clock synchronization command is always sent station-selective to the controlled stations
from the protocol element of the controlling station.
Note: The most frequent application with time synchronization is, that the clock synchronization is requested by the controlled station.
In the controlling station the time in the clock synchronization command is adjusted before
transmission by the automatically determined transmission time and by a settable correction
time. The correction time is to be set with the parameter advanced parameters |
Settings time management | Correction time for clock synchronization
command.
In the controlled station the time in the clock synchronization command can be adjusted on
reception by a settable correction time. The correction time is to be set with the parameter
advanced parameters | Settings time management | Correction time for
clock synchronization command.
The time base used for the communication between DNP3 devices should always be
according to UTC (Universal Time Coordinated). The time used locally is thereby converted to
UTC in transmit direction and vice versa. In addition a possible correction of a daylight-saving
time can also take place. The following options are available for parameterization, whereby
the transmit and receive direction can be set independently of each other:
advanced parameters | Settings time management | Time format in receive

direction
advanced parameters | Settings time management | Time format in transmit

direction
The following options are available:
· Without conversion (use of the local time) à use received time (without
conversion) or Use local time
· With conversion from/to UTC with daylight-saving time correction à from UTC to local
time incl. DST correction or from local time incl. DST correction to
UTC
· With conversion from/to UTC without daylight-saving time correction à from UTC to
local time without DST correction or from local time without DST
correction to UTC
Note
In the current version the DNP3 protocol defines, that the time in the clock synchronization command must
always be according to UTC (Universal Time Coordinated).
This is supported by the DNP3 protocol for SICAM RTUs for the following firmware from the specified
revision! The previous revisions use exclusively the local time.

Edition 12.2017, DC0-090-2.10
2.4.5.1 Clock Synchronization with NTP (DNPi00 and DNPiA1 only)
The protocol element for DNP3 Slave over Ethernet (DNPi00) support the clock
synchronization of the controlled stations (=remote synchronization) - controlled by the
controlling station – either via DNP3 protocol or via NTP.
When using DNP3 Slave over Ethernet in TM1703emic the clock synchronization via NTP is
implemented on basis system element.
The selection of the time management mechanism is enabled with the parameter time
management | DNP3 Zeitmanagement | enabling Freigabe Zeitsetzen.
Selections for time synchronization:
· DNP3 protocol
· NTP server
The Network Time Protocol (NTP) is a standard for the synchronization of clocks in systems
over IP communication networks. NTP is a hierarchical protocol over which time servers can
determine a common time amongst each other. The NTP protocol determines the delay of
packets in the network and compensates these for the clock synchronization. The NTP
protocol uses port number 123.
The NTP protocol is a Client/Server protocol. NTP clients can request the time from NTP
servers.
The Network Time Protocol (NTP) uses the connectionless network protocol UDP. The NTP
protocol has been developed especially to enable a reliable time tagging over networks with
variable packet delay.
The NTP protocol is defined in the standard "RFC 1305: NTP V3".
The time stamps in NTP are 64 bits long. 32 bits encode the seconds since the 1st January
32
1900 00:00:00 hours, the other 32 bits the seconds fraction. In this way, a time period of 2
−32
seconds (about 136 years) can be represented with a resolution of 2 seconds (about 0.25
nanoseconds).
NTP uses a UTC time scale and supports switching seconds, but not daylight-saving time and
winter time.
NTP uses a hierarchical system of different levels. The level specifies how far the NTP server
is from an external time source. As time source an atomic clock, a DCF77 receiver or a GPS
receiver can be used.
A Layer-1 server is connected directly with a time source and uses this as reference for its
time. A Layer-2 server uses a Layer-1 server as reference and synchronizes itself with other
servers on its level if the connection to the higher level fails.
The highest level is 16 and signifies, that this NTP server has not yet calibrated itself with
other servers. As a rule no more than 4 levels exist, since otherwise the time would deviate
too much.

DC0-090-2.10, Edition 12.2017
2.4.5.1.1 NTP/SNTP Client “Clock Synchronization with one or several NTP Servers”
For the clock synchronization of a component, the time information can be requested from one
or several NTP servers in the network by the protocol element's integrated NTP-Client
function. The NTP servers themselves are synchronized either directly with DCF77 or GPS
receiver, or by interrogating the time information from other NTP servers..
General Functions NTP/SNTP Client
DNPiA1
DNPiT0
DNPiT1
DNPi00
Function
Clock synchronization with NTP servers 2) ü ü 1) ü 1) ü
Number of supported NTP servers ( for redundancy) 4 4 1) 4 1) 4
Cyclic time interrogation of the NTP servers, settable in seconds grid ü ü 1) ü 1) ü

(self-adapting)
Possible accuracy approx. 3 ms 3)
Protocol NTP V3 (Network Time Protocol) according to RFC 1305 ü ü 1) ü 1) ü
Protocol SNTP V4 (Network Time Protocol) according to RFC 2030 ü 1) ü 1) ü

1) In SICAM A8000 or SICAM AK3 with local PRE (PRE without NIP) this function is integrated on
the basic system element
2) The external NTP servers will be synchronized via GPS (or via DCF77 on request);
an external NTP server can handle several automation units
3) Possible accuracy dependent on the quality of the IP network
If the clock synchronization with NTP is activated on a LAN/WAN protocol element, the
transfer of a received clock synchronization command with <TI:=103> to the basic system
element is disabled.

Edition 12.2017, DC0-090-2.10
Parameters for NTP time synchronization (NTP Client):
· NTP time synchronization

The time synchronization by means of NTP is enabled with the parameter time
management | NTP time synchronisation client | NTP time
synchronisation.
The other parameters for NTP time synchronization are only displayed after the function
has been enabled.
· NTP server 1 IP address
NTP server 2 IP address
The protocol firmware supports max. 4 different redundant NTP servers. The time is
always requested from all parameterized NTP servers. The time for the synchronization is
determined by means of a defined algorithm from the times received from the NTP
servers.
For every NTP server the unambiguous IP address of the NTP server is to be
parameterized in the format IPv4 (32 Bit) in dotted decimal notation.
Example: 192.168.122.195
The IP addresses of the NTP servers are to be parameterized
with the parameters time management | NTP time synchronisation
client | NTP server # IP address.
· NTP maximum time deviation
If the deviation of the time between the own component and the NTP server is greater than
the parameterized value, an error is signaled.
The maximum time deviation is to be parameterized with the parameter time
management | NTP time synchronisation client | NTP optimization | NTP
maximum time deviation.
· Max. stratum
If the received stratum number from the NTP server is greater or equal as a parameterized
limit, a warning is indicated. With this monitoring function an non synchronized NTP server
can be detected (e.g. defect or disconnected antenna). If all NTP servers are not
synchronized, the NTP time is not longer synchronous with the world time. In this case the
time of the NTP servers will drift with the quality of the local time of the NTP servers.
The limit of the stratum number for generating a warning is to be parameterized with the
parameter time management | NTP time synchronisation client | max.
Stratum.
· Suppress stratum error
If a 1703 system will be synchronized via several NTP servers, the stratum number may
only differ by 1. If the difference of the stratum number is greater than 1, the protocol
element will generate an error indication "no valid time from server, stratum number
invalid" for the NTP servers with higher stratum number.
If different NTP servers will be used in a project from different providers, the requirement
for the tolerated difference in stratum number can not be guaranteed.
The generation of error can be suppressed with the parameter time management | NTP
time synchronisation client | Suppress stratum error.
Note:
NTP server with higher stratum number (= less accuracy) will not be included in the
processing. Only when NTP servers with lower stratum number will fail, the next NTP
servers will be included in processing. Based on this handling an error indication can be
displayed for a short time.

DC0-090-2.10, Edition 12.2017
Advanced parameters for NTP time synchronization (NTP client):

· NTP minimum cycle time
The interrogation of the time from the NTP server (NTP request) is performed cyclic by the
protocol element in time scale between NTP maximum cycle time and NTP minimum cycle
time.
Note:
With the communication over GPRS the cycle time must not be set too short, since due to
the cyclic time request, corresponding transmission charges accumulate.
See also "NTP cycle time until synchronized" and "NTP maximum cycle time".
· NTP maximum cycle time
See also "NTP cycle time until synchronized" and "NTP minimum cycle time".
· NTP cycle tme until synchronized
Until the 1st synchronization, the interrogation of the time from the NTP servers (NTP-
Requests) can be carried out in a shorter time scale. The time scale is parameterized with
the parameter time management | NTP time synchronisation client | NTP
optimization | NTP cycle time until synchronized. After successful
synchronization, the interrogation of the time is carried out cyclic in a time scale between
"NTP minimal cycle time" and "NTP maximum cycle time". The cycle times are to be
parameterized with the parameters time management | NTP time synchronisation
client | NTP optimization | NTP minimal cycle time, and time management
| NTP time synchronisation client | NTP optimization | NTP maximal
cycle time.
· Error signalization delay
For problems during the interrogation of the time from NTP servers, the signalization of the
error "No valid time from NTP server" can be delayed with the parameter time
management | NTP time synchronisation client | NTP optimization |
Delay error signalization.
By means of that, short-term faults or load problems in the network do not lead to any
error.

Edition 12.2017, DC0-090-2.10
2.4.5.1.2 Integrated NTP Server

Clock Synchronization for one or several NTP Clients
In configurations with less demand on the accuracy for time synchronization, the LAN protocol
firmware in the SICAM RTUs component provides an integrated NTP server for other
systems. This function is helpful if the clock synchronization of the remote terminal unit is
carried out by means of DCF77 receiver, over a serial interface or NTP synchronization via
separate LAN , and in this remote terminal unit other devices are connected over LAN, which
require a time synchronization with NTP.
Through this the additional procurement of an NTP server for the subnet in the remote
terminal unit is not necessary!
The time of the integrated NTP server is controlled by the local time of the component.
The accuracy is therefore dependent on the accuracy of the clock synchronization of the
component itself.
Clock synchronization over LAN: (NTP Server)
· Integrated NTP server for clock synchronization of one or several NTP clients
· Protocol: NTP V4 (for NTP V4 there is actually no public specification available)
· Up to 30 different NTP clients can be served with a time request 1x per minute (this limit is
an experimental value and results from the system load utilization)
· Stratum 7 (based on the achievable accuracy with remote synchronization over serial
communication line)
· The NTP server supports only the request of the time (BROADCAST transmission of the
time is not supported by the integrated NTP server)
· The achievable accuracy is dependent on the accuracy of the clock synchronization of the
component
· Reaction time (transmission of the requested time by the protocol firmware):
Typically 300-900 us
Parameters for NTP time synchronization (NTP Server):
· NTP server
The integrated NTP server function of the LAN/WAN communications firmware is enabled
with the parameter time management | NTP time synchronization server | NTP
server
· Synchronization with invalid time
By means of parameter time management | NTP-time synchronization server |
synchronization before first time set NTP reply messages are sent also when
the time of the SICAM RTUs component is not yet set
By means of parameter time management | NTP-time synchronization server |
synchronization also with invalid time (IV) the master station can stop the
clock synchronization of the remote stations over the serial communication line when the
clock synchronization of the master station fails

DC0-090-2.10, Edition 12.2017
2.4.6 Command Transmission
2.4.6.1 Message from Controlling Station selectively to a Controlled

Station
Station-selective data messages in command direction are always passed into the running
interrogation procedure (station interrogation) by the controlling station with high priority, but
only after termination of the running data transmission service. This can sometimes cause
long delays, if a multifragment is currently being transmitted. Data to be sent from the basic
system element (=BSE) are always prioritized 1:1 versus station interrogations.
Inquiry
An “inquiry” (=parameter-settable station-selective continuous interrogation) to a controlled
station for the transmission of certain data is not supported.
2.4.7 Count Transmission by means of Interrogation Command
Interrogation by means of system message IEC count interrogation

For this the interrogation command “Freeze” in the DNP3 message is converted with the
function code “immediate freeze no acknowledgement” as broadcast message to all stations.
Accordingly the IEC count interrogation should also only be handled as Broadcast and not
station-selective. In parallel all counts which are assigned to the respective counter group are
marked internally for transmission in the firmware.
After the transmission of “immediate freeze…” the counts of every station are interrogated
station-selective and processed and forwarded to the basic system element.
2.4.8 Spontaneous Count Transmission
Besides the transmission of counts by means of count interrogation, the DNP3 controlled
station function can also process and transmit counts spontaneously. For this the counts must
only be assigned to a corresponding event class. Every count configured this way is then
saved as event on reception and transmitted.

Edition 12.2017, DC0-090-2.10
2.5 Optimized Parameters for selected Transmission

Facilities (serial communication)
The protocol element supports selected transmission facilities – the parameters are set fixed
for these – the selection of the transmission facility takes place with the parameter Common
settings | Interface modem. Through the selection of the “freely definable transmission
facility” certain parameters can be set individually.
Apart from this, a transmission facility, that can be freely defined by the user, can be selected,
for which all parameters that are available can be individually set. This is then necessary
when transmission facilities are to be used that are not predefined or if modified parameters
are to be used for predefined transmission facilities.
For the selection of the freely definable transmission facility the parameter Common
settings | Interface modem is to be set to “freely definable”. Only through this are all
supported parameters displayed and able to be parameterized with the required values (see
table with default parameters for transmission facilities).
The parameters for the “freely definable transmission facility” are only displayed for selected
transmission facility “freely definable”.
Note
For reasons of flexibility and since it always involves a coupling to third-party systems, the use of the
“freely definable” transmission facility is recommended.
Baud Rate
In most cases transmission facilities or remote stations only support certain baud rates or
combinations of baud rates in transmit/receive direction – these are to be taken from the
descriptions.
The transmission rate (baud rate) is to be set either separately for transmit/receive direction
with the parameter Common settings | Baud rate receiver and the parameter Common
settings | Baud rate transmitter or for transmit/receive direction together with the
parameter Common settings | Baud rate.
Byte Frame
The byte frame used for the DNP3 protocol can also (partly) be set. For serial data
transmission, as standard the DNP3 protocol uses the byte frame “8E1”. For special
applications the parity bit, or the number of stop bits, can be changed.
With the DNP3 protocol the number of data bits is defined fixed with 8 bits and must not be
changed. The number of data bits used per byte is to be set fixed to 8 bits with the parameter
Common settings | Byte frame | Data bits.
The selection of the parity protection to be used per byte is to be parameterized with the
parameter Common settings | Byte frame | Parity.
The number of stop bits to be used per byte is to be parameterized with the parameter
Common settings | Byte frame | Stop bits.

DC0-090-2.10, Edition 12.2017
Status Lines
For special requirements of the communication equipment the protocol element for DNP3
Master can switch the status lines RTS and DTR fixed to “HIGH”. The RTS status line can be
switched on permanently with the parameter advanced parameters | RTS is
permanent HIGH. The DTR status line can be switched on permanently with the parameter
advanced parameters | DTR immer fix auf HIGH.
Freely definable transmission facility

For the adaptation to different modems or time requirements of third-party systems the
following parameters can be set individually:
· Common settings | free defineable interface modem | electrical interface

[only SM2541]
· Common settings | Asynchron/isochron
· Common settings | Source for receive-/transmit clock (only for “Isochronous”)
· Common settings | free defineable interface modem | Run-out time (tn),
Common settings | free defineable interface modem | Run-out time “time base”
(tn)
· Common settings | free defineable interface modem | Set up time (tv),
Common settings | free defineable interface modem | Set up time “time base”
(tv)
· Common settings | free defineable interface modem | Run-out time (tn),
Common settings | free defineable interface modem | Run-out time “time base”
(tn)
· Common settings | free defineable interface modem | DCD handling
· Common settings | free defineable interface modem | Bounce suppression time
(tbounce)
· Common settings | free defineable interface modem | Disable time (tdis),
Common settings | free defineable interface modem | Disable time “time base”
(tdis)
· Common settings | free defineable interface modem | Stability monitoring time
(tstab)
· Common settings | free defineable interface modem | Continuous level monitoring
time (tcl)
· Common settings | free defineable interface modem | Transmission delay if
countinous level (tcldly)
· Common settings | free defineable interface modem | 5V supply (DSR) [only SM0551,
SM2551]
How the individual time settings are effective for the data transmission can be seen on the
following page in a Timing Diagram.

Edition 12.2017, DC0-090-2.10
Parameter "5 V Supply (DSR)" [only SM-0551, SM-2551]
If necessary the voltage supply of the transmission facility (only 5V) – insofar as this is
adequate – can be set over the status line DSR. The enabling of the voltage supply takes
place with the parameter advanced parameters | 5V supply (DSR). The voltage supply
is only switched to the DSR status line instead of the DSR signal with corresponding
parameter setting.
ATTENTION: Required supply voltage and maximum current consumption of the

transmission facility must be observed!
In addition, for the adaptation of the protocol to the transmission medium used or to the
dynamic behavior of the connected remote station, the following parameters are available:
· advanced parameters | Monitoring times | Character monitoring time,

advanced parameters | Monitoring times | Character monitoring time “time base”
· advanced parameters | Monitoring times | Idle monitoring time,
advanced parameters | Monitoring times | Idle monitoring time “time base”
· advanced parameters | Monitoring times | Character monitoring time,
advanced parameters | Monitoring times | Character monitoring time “time base”
· advanced parameters | Monitoring times | Expected_ack_time_corr_factor
(see Acknowledgement Procedure)
The signal monitoring time is used for message interruption monitoring and message re-
synchronization in receive direction. A message interruption is detected when the time
between 2 bytes of a message is greater than the set signal monitoring time. With message
interruption the running reception handling is aborted and the message is discarded. After a
message interruption is detected a new message is only accepted in receive direction after an
idle time on the line.
The protocol element – insofar as the transmission facility makes this signal available receive-
side – can evaluate the interface signal DCD and e.g. utilize it for monitoring functions.

DC0-090-2.10, Edition 12.2017
Default Parameters for Transmission Facilities with DNPMx0

transmission facility electrical RTS tp tv tn tp_bc tdis DCD tbounce tstab tcl tcldlyz A_I T Z 5 V *)
interface [ms] [ms] [bit] [ms] [ms] [ms] [sec] [ms]
Modem for "4-wire transmission line" RS-232 ON 0 0 3 0 35 YES 5 5 10 200 A I B NO
(SAT-VFM,-WT,-WTK,-WTK-S,CE-0700)
Modem for "2-wire transmission line" RS-232 ↑↓ 0 30 3 0 35 YES 5 5 10 200 A I B NO
(SAT-VFM,-WT,-WTK,-WTK-S,CE-0700)
OPTICAL RS-232 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES
direct connection (RS-485) RS-485 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES
Freely definable
Default Parameters for Transmission Facilities with DNPSx0

transmission facility electrical RTS tp tv tn tp_bc tdis DCD tbounce tstab tcl tcldly A_I T Z 5 V *)
interface [ms] [ms] [bit] [ms] [ms] [ms] [sec] [ms]
OPTICAL RS-232 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES
direct connection (RS-485) RS-485 ↑↓ 0 1 0 0 0 NO 0 0 0 0 A I B YES
Freely definable
Legend:
electrical interface Parameter "electrical interface" [only SM2541]
RTS RTS is switched with each message for the control of the carrier switching of the modem (ON / OFF)
tp Parameter "Pause time (tp)", Parameter "Pause time time base (tp)"
tv Parameter "Set-up time (tv)", Parameter "Set-up time time base (tv)"
tn Parameter "Run-out time (tn)", Parameter "Run-out time time base (tn)"
tp_bc Parameter "Pause time after Broadcast message (tp_bc)", Parameter "Pause time after Broadcast-message_time base (tp_bc)"
tdis Parameter "Disable time (tdis)", Parameter "Disable time time base (tdis)"
DCD Parameter "DCD-evaluation"
tbounce Parameter "Bounce suppression time (tbounce)"
tstab Parameter "Stability monitoring time (tstab)"
tcl Parameter "Continuous level monitoring time (tcl)"
tcldly Parameter "Transmit delay at level (tcldly)"
A_I Parameter "Asynchronous_Isochronous"
T Parameter " Bit cycle (only with Isochronous)" (I=internal, E=external)
Z Parameter "Send clock synchronization command station-selective" (s=selective, B=BROADCAST)
*) Parameter "5 V Supply (DSR)" [only SM0551, SM2551]

Edition 12.2017, DC0-090-2.10
Status Lines & Timing
The following picture shows in detail the dynamic behavior (Timing) with the data transmission using
transmission facilities with switched carrier.
Only for
BROADCAST-
messages
RTS
tverz
tp tv Data transmission tn tp_bc tsw tp tv

Master station
TXD
tPrell tPrell
DCD
tverzRTS
Data transmission
RXD
tsignal tsignal
tdis
t´verzRTS t´verzRTS
t´Prell t´Prell
DCD
t´signal
Remote station
Data transmission
RXD
t'dis
RTS
t'sw tp' t'v Data transmission t'n

TXD
t'verz
Œ Œ
tPrell tPrell
tstab tstab
tdauer
Legend:
RTS ………….. Request to Send
DCD …………. Data Carrier Detect
TXD ……...….. Transmit Data
RXD ……...….. Receive Data
t verzRTS ……….. Processing time of the transmission system
Time delay/time difference between activation of transmit part (RTS á) and receiver ready (DCD á)
t p ………….….. Break time (delay, before transmit part is activated with RTS)
t v ………….….. Setup time (transmission delay, after transmit part was activated with RTS)
t n ………….….. Reset time (delayed switch off of the transmit signal level with RTS after message transmission )
t p_bc ……….….. Break time after BROADCAST-Messages
(some systems require a longer break after the transmission of BROADCAST -messages before the next message
can be sent )
t sw ….....….….. Internal processing time
t signal ….....….. Signal propagation delays (dependent from the used transmission facility/transmission path)
t Prell …...….….. Protective time after positive/negative DCD-edge (debounce of DCD)
t stab …...….….. Stability monitoring time – the new DCD-status is only used for message synchronisation after the expiration of the
stability monitoring time
t dauer …...….….. Continuous level monitoring time
t verz …...….….. Transmission delay – in case of a continuous level a further message transmission will be made at the latest after
the transmission delay
t dis …….….….. Disable time of the receiver after message receiption (to supress faulty signs during level monitoring )
t`x …………….. Corresponding times in the remote stations
Œ …………….. DCD valide

DC0-090-2.10, Edition 12.2017
2.6 Function for the Support of redundant Communication

Routes
To increase the availability, both controlling stations as well as controlled stations can be
designed redundant.
In this chapter the possible redundancy concepts themselves that can be realized are not
described, rather only those functions supported by the protocol element for the support of
redundant communication routes.
The following redundancy control is supported by the controlling station and the controlled
station:
· SICAM RTUs redundancy
2.6.1 Redundancy Mode “SICAM RTUs Redundancy”
The switchover of the redundancy state takes place system-internal by means of redundancy
control messages.
In the controlling/controlled station, in addition a delay for the switchover of the redundancy
state from PASSIVE (=STANDBY) to ACTIVE can be set with the parameter Redundancy |
Delay time passive=>active.
Depending on the redundancy configuration the operating mode of the interface with
redundancy state “PASSIVE” can be set with the parameter Redundancy | Operation if
passiveas follows:
· Interface “TRISTATE” – only listening mode

· Interface “ACTIVE” – only listening mode
· Interface “ACTIVE” – interrogation mode
Listened messages are forwarded from the redundant, non-active controlling/controlled station
to the basic system element (BSE) and passed on in the system by this element with the
identifier “passive” in the status.
In redundant controlling stations that are not active, a failure of the interface is monitored
globally and the failure of controlled stations is monitored station-selective.
The failure of the interface is detected by the STANDBY controlling station by monitoring for
cyclic message reception. The monitoring time is set with the parameter Redundancy |
Listening_mode (failure monitoring time). With reception timeout (active controlling
station or transmission facility of the controlling station has failed) the interface is signaled as
failed.
The failure of a controlled station is detected by the STANDBY controlling station through
station-selective monitoring for cyclic message reception. With station-selective reception
timeout (controlled station or transmission facility of the controlled station has failed) the
controlled station is signaled as failed.
Station-specific active faults are reset in a redundant STANDBY controlling station, if a

faultless message is “listened” by the respective station.

Edition 12.2017, DC0-090-2.10
2.7 Web Server (DNPi00 only)
A web server is integrated into the protocol firmware for internal diagnostic information.
This information can be read out comfortably with a common web browser (e.g. Microsoft
Internet Explorer). For the access to the web server the communications protocol "HTTP
(Hyper Text Transfer Protocol)" is used with the port number 80.
The integrated web server is addressed by means of direct specification of the IP address of
the Ethernet interface of the automation unit.
By default the web server is deactivated for security reasons. Also for security reasons, an
authentication can be configured for the access to the web server (specification of a
password).
· HTTP web server

The integrated web server can if necessary be enabled for access by the user with the
parameter HTTP web server | HTTP web server.
· Password for Authentication
With authentication enabled a password can be established with the parameter HTTP web
server | password for authentication. The access to the integrated web server is
only possible after successful authentication.
Note
The information displayed on web pages is the actual information at open of the web page. The
information of a web page will not be updated automatically!
For updating the web page displayed with Internet explorer use refresh function of Internet Explorer.

DC0-090-2.10, Edition 12.2017
Via the integrated web server the following information can be read out:
· Diagnosis
- Ethernet
MAC address, speed, duplex mode, statistics
- TCP/IP (DNPi)
own network parameter (Own IP address, default gateway, Subnetmask)
number of server connections
- Firmware (actual firmware time)
- Data Link Errors
- Ping
- System informations (Hardware, Software)
· Rangierungen
- Sende-FR alle (loaded detail routing tables in transmit direction on PRE)
- Empfangs-FR alle (oaded detail routing tables in receive direction on PRE)
· Abbilder
- Abbild in Senderichtung (PRE internal data base for transmit direction)
- Abbild in Empfangsrichtun (PRE internal data base for receive direction)
· Entwickler Debug (internal information for software developer)
- Taskstack
- Heap
- Read Memory
- Read Register (Ethernet Controller Configuration)
- Read EEPROM
- Threadx task info (operating system internal information)

Edition 12.2017, DC0-090-2.10
2.8 Remote Operation for SICAM TOOLBOX II (LAN/WAN)

(DNPi00 only)
The remote maintenance of SICAM RTUs components via LAN/WAN can be performed using
"remote operation":
· Remote operation via external Terminal Server (connection to M-CPU with TIAX00)
· Remote operation via integrated Terminal Server
2.8.1 Remote Operation via external Terminal Server

(Connection to M-CPU with TIAX00)
For the remote maintenance of SICAM RTUs components using "remote operation" over
external terminal server, the serial interface of the SICAM TOOLBOX II is connected with a
selected SICAM RTUs component over Ethernet. An external terminal server (=serial to
Ethernet converter) is thereby implemented at the SICAM TOOLBOX II side and at the SICAM
RTUs component side. At SICAM RTUs component side the serial interface of the external
Terminal Server is connected to M-CPU via TIAX00.
The IP address of the selected SICAM RTUs component and the SICAM TOOLBOX II are to
be parameterized in the external terminal servers. All components that can be reached via the
selected SICAM RTUs component can thus be reached for the remote maintenance.
In the SICAM RTUs component and in the SICAM TOOLBOX II, no special parameter settings
are required.
If SICAM RTUs components are used in different LAN/WAN networks, a specific external
terminal server must be used at the SICAM TOOLBOX II side for each LAN/WAN network or
the external terminal server must be re-parameterized accordingly with the programs provided
for this purpose.
A communications protocol based on IEC 60870-5-1 and IEC 60870-5-2 "Balanced" is used
between the SICAM TOOLBOX II and the LAN/WAN communications protocol element.
Here, the "remote operation" over external terminal server is only mentioned for the sake of
completeness, it is not however any special functionality of the LAN/WAN communications
protocol element. In addition, this solution is now rarely implemented (or is only in use on
older plants).
In new plants, now in most cases the "remote operation" for SICAM TOOLBOX II is carried
out via "remote operation" with the integrated terminal server of the SICAM TOOLBOX II and
the LAN/WAN communications protocol element.

DC0-090-2.10, Edition 12.2017
2.8.2 Remote Operation via integrated Terminal Server
For the remote maintenance of SICAM RTUs components using "remote operation" over
external, a transparent connection is established over Ethernet between the SICAM
TOOLBOX II and the integrated terminal server of the protocol element.
The Terminal Server protocol for "remote operation" is based on TCP/IP and is a Client-
Server protocol. The SICAM TOOLBOX II thereby always takes over the client function, the
SICAM RTUs component always the server function.
The connection for "remote operation" is always established by the SICAM TOOLBOX II.
For the Terminal Server protocol a TCP/IP connection must be set up. With the SICAM
TOOLBOX II interfacing, the SICAM TOOLBOX II is Connector and the NIP is Listener. The
Listener-Port number to be used is 2001. If several SICAM TOOLBOX II applications attempt
to setup a connection at the same time, the first SICAM TOOLBOX II wins, the rest are
rejected.
If an error is detected during the remote maintenance of SICAM RTUs components using
"remote operation", then the TCP/IP connection is terminated.
For the "remote operation", a connection is to be set up on the SICAM TOOLBOX II for every
remote station with the following parameters:
· Transmission medium = terminal server, TCP/IP

· IP address of the remote station (IP address or Host ID of the terminal server of the remote
station)
· Port number = 2001
· Delay time
For security reasons the "remote operation" for SICAM TOOLBOX II can be deactivated with
the parameter advanced parameters | remote operation | remote operation. With
"remote operation" deactivated, the Terminal Server protocol over Port 2001 is no longer
handled.
With connection established for the remote maintenance, a warning is generated in the
SICAM RTUs component. If necessary, this warning can be deactivated with the parameter
advanced parameters | remote operation | warning remote operation.
Functionally, the "remote operation" via integrated Terminal Server thereby corresponds with
the interfacing with external terminal server (and TIAX00), only with this solution the
functionality of the terminal server is integrated in the SICAM TOOLBOX II and in the
LAN/WAN communications protocol element.
So that a secure point-to-point connection via integrated Terminal Server protocol is ensured,
a communications protocol based on IEC 60870-5-1 and IEC 60870-5-2 "Balanced" is
implemented between the SICAM TOOLBOX II and the LAN/WAN communications protocol
firmware on the application layer. Terminal Server is thereby used as transport protocol.
The service message formats between SICAM TOOLBOX II and the SICAM RTUs component
are prepared accordingly on the LAN/WAN communications protocol firmware (conversion
from SICAM RTUs internal format and format for SICAM TOOLBOX II) and transferred to the
master service function of the SICAM RTUs component for further processing.

Edition 12.2017, DC0-090-2.10
2.9 Remote Operation for SICAM TOOLBOX II (LAN/WAN)

(DNPiA1 only)
The remote maintenance of SICAM RTUs components via LAN/WAN can be performed using
"remote operation":
· Remote operation via TCP/IP HTTP/HTTPS
Note
For reasons of flexibility and since it always involves a coupling to third-party systems, the use of the
“freely definable” transmission facility is recommended.
At least SICAM TOOLBOX II version 5.11 is needed to use this type of remote operation.
2.9.1 Remote Operation via TCP/IP HTTP/HTTPS
For the remote maintenance of SICAM RTUs components using "remote operation" a
transparent connection is established over TCP/IP, HTTP/HTTPS between the
SICAM TOOLBOX II and the SICAM RTUs component via the protocol element.
For “remote operation" with SICAM TOOLBOX II a proprietary Client-Server protocol is used
for remote maintenance and remote diagnostics of SICAM RTUs components working through
firewalls, NAT and Proxy-Server.
For outgoing connections the SICAM TOOLBOX II uses the standard port 80 for HTTP or
standard port 443 for HTTPS. Therefore no adaption of firewall is required if internet access is
enabled.
The connection for "remote operation" is always established by the SICAM TOOLBOX II.
The SICAM TOOLBOX II thereby always takes over the client function, the SICAM RTUs
component always the server function.
If several SICAM TOOLBOX II applications attempt to setup a connection at the same time,
the first SICAM TOOLBOX II wins, the rest are rejected.
If an error is detected during the remote maintenance of SICAM RTUs components using
"remote operation", then the TCP/IP connection is terminated.
For the "remote operation", a connection is to be set up on the SICAM TOOLBOX II for every
remote station with the following parameters:
· Transmission medium = terminal server, TCP/IP

· IP address of the remote station (IP address or Host ID of the terminal server of the
remote station)
· Port number = 80 (auto detection)
· Delay time

DC0-090-2.10, Edition 12.2017
For security reasons the "remote operation" for SICAM TOOLBOX II can be deactivated with
the parameter advanced parameters | remote operation | remote operation.
With connection established for the remote maintenance, a warning is generated in the
SICAM RTUs component. If necessary, this warning can be deactivated with the parameter
advanced parameters | remote operation | warning remote operation.
So that a secure point-to-point is ensured, a communications protocol based on IEC 60870-5-

1 and IEC 60870-5-2 "Balanced" is implemented between the SICAM TOOLBOX II and the
LAN/WAN communications protocol firmware on the application layer. Terminal Server is
thereby used as transport protocol.
The service message formats between SICAM TOOLBOX II and the SICAM RTUs component
are prepared accordingly on the LAN/WAN communications protocol firmware (conversion
from SICAM RTUs internal format and format for SICAM TOOLBOX II) and transferred to the
master service function of the SICAM RTUs component for further processing.

Edition 12.2017, DC0-090-2.10
2.10 DNP3 Protocol Description
2.10.1 PCMBA Modulation Method
The data are pulse-code-modulated in groups of 8 Bit and transmitted asynchronous. A

USART module in asynchronous mode thereby provides every byte with a byte frame (BF).
Byte frame for DNP3:
1 Start bit
8 Data bits
1 / NO Parity bit (even/no), “no parity” is standard
1 Stop bit
By means of the start and stop bits of the byte frame the synchronization of the receiver takes
place again with each byte.
FB 8 BIT INFORMATION FB
A B C D E
LSB MSB
D1 D2 D3 D4 D5 D6 D7 D8
A: Idle state of the line (binary information "1") between two messages at least 33 bit
(in case of error)
B: Start bit ("0")
C: 8 bit data (possibly frame data or message data), LSB (Least Significant Bit)
is transmitted first
D: Parity bit (even parity)
E: 1 Stop bit ("1")
T: Time for the transmission of a bit (1/transmission rate)
FB: Framing bits of the USART module

DC0-090-2.10, Edition 12.2017
2.11 Interface Circuits Used
The following V.24 interface circuits are used:
TxD <103> transmit data

RxD <104> receive data
GND <102> signal ground
Optionally the following V.24 interface circuits can be used:
RTS <105> Used for switching on the transmit signal level of the
transmission facility
DCD <109> Used for detecting the receive signal level of the
transmission facility

Edition 12.2017, DC0-090-2.10
2.12 Message Description for DNP3 (Data Link Layer)
The DNP3 protocol uses message formats for messages with variable lengths based on
IEC60870-5-1 / format class FT3.
2.12.1 FT3 Message Format for Messages with variable Lengths
The transmission formats and rules for DNP3 are based on the international standard
IEC 60870-5-1 Telecontrol equipment and systems TC 57 Part 5.1, Transmission Frame
Formats Format Class FT3.
The DNP3 protocol uses the FT3 format with UART frame (typically 8N1) for messages with
variable lengths.
Note: FT3 in IEC60870-5-1 is only defined for synchronous data transmission.
Every message begins with a START CHARACTER (2 octets).
The DNP3 protocol uses only START CHARACTER 1 (05H, 64H).

START CHARACTER 1 = "0000 0101 0110 0100"
Representation of one byte (LSB shown right-aligned):
7 6 5 4 3 2 1 0
2 2 2 2 2 2 2 2
D8 D7 D6 D5 D4 D3 D2 D1
D1 basically represents the least significant bit (LSB).
Representation of one byte “Bit sequence on the line”: (E.g.: START CHARACTER 05hex in format
8E1)
Bit sequence
on the line 1 2 3 4 5 6 7 8 9 10 11
Data bits STA D1 D2 D3 D4 D5 D6 D7 D8 P STP
0 1 0 1 0 0 0 0 0 0 1
st
Legend: STA ... Start bit (is transmitted as 1 bit on the line)
STP ... Stop bit
P ........ Parity bit (even)
With the specified transmission rules and character definitions all message formats with d = 6
are protected against faulty information and block displacements (synchronization errors).

DC0-090-2.10, Edition 12.2017
Message Structure for Messages with variable Lengths
The 1st data block (header) of the messages with variable lengths is of fixed length. It begins
with a START CHARACTER (2 octets), ends with a CHECK SEQUENCE and contains up to
14 data octets.
The “LENGTH” – character, which is situated in the header with fixed length, defines the
number of user data octets in the “main part” of a message.
DNP3 message format based on FT3:
27 26 25 24 23 22 21 20
1. Byte START [05 hex]
2. Byte START [64 hex]
(according IEC60870-5-1 / FT3)

3. Byte LENGTH [1 … 255]
DNP3 Message Header

PRM=1 FCB FCV 23 22 21 20
4. Byte DIR Function Code Control Field
PRM=0 0 DFC
Block - 0
5. Byte DESTINATION [LSB]
Destination
Station-Address
6. Byte DESTINATION [MSB]
7. Byte SOURCE [LSB]

Source
Station-Address
8. Byte SOURCE [MSB]
9. Byte CRC [LSB]
10. Byte CRC [MSB]
User-Data [Byte-1]
User-Data [Byte-2]
Length [1 … 255] (excl. CRC)
Block - 1
User-Data [Byte-16]
CRC [LSB] DNP3 User Data
CRC [MSB]
User-Data [Byte-1]
Block – n **)
User-Data [Byte-2]
User-Data [max. Byte-16]
CRC [LSB]
max. n. Byte
CRC [MSB]
**) the last data block may have less than 16 bytes

Edition 12.2017, DC0-090-2.10
Transmission Rules for Messages with variable Lengths
R1 Idle state on the line equals 1-Signal.

R2 The first 2 octets of a message represent the START CHARACTER.
R3 Up to 14 user data octets are supplemented with a 16 Bit CHECK SEQUENCE.
R4 The CHECK SEQUENCE forms a code, which is generated by the polynomial
16 13 12 11 10 8 6 5 2
x + x + x + x + x + x + x + x + x + 1.
The 16 bits of the CHECK SEQUENCE generated by this specification are inverted. R5
If an error according to rule R6 is detected, an idle state with a minimum duration of
L + 6 octets is required, whereby L is the maximum number of user data octets
per message, providing L is < 42 octets.
For L = 42 octets the interval is at least 48 octets.
R6 The receiver checks the signal quality, the START CHARACTER, the CHECK
SEQUENCE, the message length as well as the duration of the idle state after detecting
an error, as defined in rule R5.
If one of these checks produces a negative result, then the message is to be discarded,
otherwise it is to be released for the user.

DC0-090-2.10, Edition 12.2017
2.12.2 Message Structure for DNP3
The DNP3 protocol uses message formats for messages with variable lengths based on
IEC60870-5-1 / format class FT3.
The example shows the schematic structure of a DNP3 message with 3 frames.

Edition 12.2017, DC0-090-2.10
2.12.2.1 LINK Header (message header)
START
st nd
The start field is 2 octets (2 bytes) long. The 1 byte is 0x05 and the 2 byte is 0x64.
LENGTH
The length field is 1 octet long and defines the number of the following bytes in this message
frame, without the CRC bytes necessary for this. The length field includes CONTROL,
DESTINATION, SOURCE field and the user data.
The minimum length = 5, the maximum length is 255.

DC0-090-2.10, Edition 12.2017
CONTROL (control field)

The control field is 1 octet long and contains information about message direction, initiator of
the message transmission, errors and data flow control and function.
Assignment of the control field:
27 26 25 24 23 22 21 20
3 2 1 0
PRM 2 2 2 2 Primary Station to Secondary Station
DIR FCB FCV
=1 Function Code (MASTER ð SLAVE)
27 26 25 24 23 22 21 20
PRM 23 22 21 20 Secondary Station to Primary Station

DIR =0 DFC
=0 Function Code (SLAVE ð MASTER)
Elements of the Control Field for IEC60870-5-101 (End-End)

DIR … Physical transmission direction DIR=1: Message from primary to secondary station
MASTER à SLAVE
DIR=0: Message from secondary to primary station
SLAVE à MASTER
PRM … Primary Bit (=Primary message) PRM=1: Message from a primary station
(=prompting station)
PRM=0: Message from a secondary station
(=responding station)
FCB … Frame Count Bit Changing value for successive SEND/CONFIRM or
(message sequence bit) REQUEST/RESPOND –services per station.
(Retries are sent with the same FCB bit)
FCV … Frame Count Bit valid FCV=0: Changing function of the FCB is invalid
(message sequence bit valid) (not evaluated)
FCV=1: Changing function of the FCB is valid
DFC … Data Flow Control DFC=0: Further messages are accepted
(data flow control) DFC=1: Further messages could cause a data overflow
Function … Function code
The Primary Bit (PRM) is used for every message transmission itself.
Examples:
· If station B sends a single-point information to station A, then this message from station B
is sent with PRM=1 and acknowledged by station A with PRM=0.
· If station A sends a single command to station B, then this message from station A is sent
with PRM=1 and acknowledged by station B with PRM=0.

Edition 12.2017, DC0-090-2.10
Data Link Function Codes:
Function Codes of the Control Field in Messages of the Primary Station (PRM=1)
FC Response Function
Frame Type Service Function FCV Codes permitted
Bit from Secondary
0 SEND-CONFIRM expected Reset Of Remote Link 0 0 or 1
1 SEND-CONFIRM expected Obsolete 0 15 or no response
2 SEND-CONFIRM expected Test function For Link 1 0 or 1
(no response is
acceptable if the link
states are UnReset)
3 SEND-CONFIRM expected Deliver application data, 1 0 or 1
confirmation requested
4 SEND-NO REPLY expected Deliver application data, 0 no response
no confirmation requested
5-8 - Reserved - 15 or no response
9 REQUEST-RESPOND expect. Request Status Of Link 0 11
10-15 - Reserved - 15 or no response
Function Codes of the Control Field in Messages of the Secondary Station (PRM=0)
FC Frame Type Service Function
0 CONFIRM ACK … Positive Acknowledgement
1 CONFIRM NAK … Negative Acknowledgement
2 - 10 Reserved
11 RESPOND Status Of The Link
12, 13 - Reserved
14 - Obsolete
15 - Link Service Not Supported
DESTINATION (=Target Address)

The DESTINATION-Field (destination address) is 2 octets long and specifies the destination
address to which the message object is directed. The destination address 0xFFFF is used as
BROADCAST address.
SOURCE (=Source Address)

The SOURCE-Field (source address) is 2 octets long and specifies the source address from
where the message object has been sent.
CRC (Check Bytes)

A CRC consisting of 2 octets is appended at the end of every message block. The message
header contains START, LENGTH, CONTROL, DESTINATION and SOURCE. The message
header (Block-0) is also protected with a CRC.
The CHECK SEQUENCE forms a code, which is generated by the polynomial
x16 + x13 + x12 + x11 + x10 + x8 + x6 + x5 + x2 + 1.
The rules for message transmission and the methods used for message protection
correspond to hamming distance d=6.

DC0-090-2.10, Edition 12.2017
2.12.2.2 Transport Header
The transport header is contained in every message of a sequence.
7 6 5 4 3 2 1 0
2 2 2 2 2 2 2 2
FIN FIR Sequence number 0 .. 63
FIN: If this bit is set, then this message is the last of a

sequence or a fragment.
FIN = 0 more messages to follow
FIN = 1 last message of a fragment
FIR: This bit is set for the first message of a sequence or a fragment.
FIR =1 first message of a sequence
FIR =0 part message of a sequence
Sequence No.: The sequence number is used to detect the correct message sequences of
fragments. It is used in a range from 0 to 63. For each message of a
fragment, with the exception of the first message of a fragment, the
sequence number is increased by 1. Once the sequence number has
reached the value 63, then the next message of a sequence is sent with the
sequence number 0. With every set FIR bit a new sequence number is
transferred.

Edition 12.2017, DC0-090-2.10
2.12.2.3 User Data (APDU)
The user data (APDU) for DNP3 consists of:
· Application Header (APCI)

· Object Header (DUI)
· Data "Information Object" (IO)

DC0-090-2.10, Edition 12.2017
2.12.2.3.1 Application Header (APCI)
The application header (APCI … Application Protocol Control Information) consists of:
· Application Control (AC)

· Function Code (FC)
· Internal Indication (IIN)
(only contained in Response Header in monitoring direction)
Application Control (AC)
The application control field is used for the detection and use of multifragment messages.
7 6 5 4 3 2 1 0
2 2 2 2 2 2 2 2
FIR FIN CON UNS. Sequence number 0-15 Application Control (AC)
FIR: If this bit is set, then this sequence is the first of a multifragment.
FIR = 0 more sequences to follow
FIR = 1 first sequence of a multifragment
FIN: If this bit is set, then this sequence is the last of a multifragment.
FIN = 0 more messages to follow
FIN = 1 last sequence of a multifragment
CON: This bit is used for the applicative acknowledgement of a fragment.

CON = 0 no acknowledgement is expected
CON = 1 an acknowledgement is expected for this fragment
UNS.: This bit is set when it concerns an unsolicited response (spontaneous

message of the controlled station) or the applicative acknowledgement for
an unsolicited response.
Uns. = 0 no unsolicited response
Uns. = 1 unsolicited response
Sequence No.: The sequence number is used for the detection of the order of individual
fragments and the order of fragments within a multifragment. With every
received application header the sequence number is increased in a range
from 0 to 15.
If an applicative acknowledgement is expected, then this acknowledgement
has the same sequence number as the application header of the remote
station that requested this acknowledgement.

Edition 12.2017, DC0-090-2.10
Application Layer Function Codes (FC)
Supported by
CODE Function Description
DNPMx0 DNPSx0
General function codes
0 Confirm Acknowledgement for a fragment at ü ü
application level
1 Read Interrogation of data ü ü
2 Write Writing/Storage of data ü ü
Function codes for commands
3 Select Select or activate commands or setpoint ü ü
values without command output
4 Operate Output of the selected or activated commands ü ü
or setpoint values
5 direct operate Direct output of commands or setpoint values ü ü
without prior selection
6 direct operate Direct output of commands or setpoint values ü ü
- No Acknowledgement without prior selection
Do not generate any feedback about the
status of the output
Function codes for counters
7 immediate freeze Freeze the data ü ü
8 immediate freeze Freeze the data ü ü
- No Acknowledgement Do not generate any feedback about the
status of the operation
9 freeze and clear Freeze and reset the data ü ü
10 freeze and clear Freeze and reset the data ü ü
11 freeze with time Freeze the data at the specified moment - *) - *)
12 freeze with time Freeze the data at the specified moment - *) - *)
*) the counts are frozen at the moment of reception of the message

DC0-090-2.10, Edition 12.2017
Supported by
DNPMx0 DNPSx0
Application Control Function Codes
13 cold restart Perform restart in the controlled station - ü
14 warm restart Perform reset in the controlled station - -
15 initialize data to defaults Initialize the data with the default values - -
16 initialize application Initialize an application - -
17 start application Start an application - -
18 stop application Stop an application - -
Configuration Function Codes
19 save configuration Save the configuration - -
20 enable unsolicited Enable transmission of spontaneous ü ü
messages messages
21 disable unsolicited Disable transmission of spontaneous ü ü
messages messages
22 assign class The transferred data are assigned a class ü ü
(class 1,2 or 3)
Time Synchronization Function Codes
23 delay measurement Calculation of the message transfer time and ü ü
delay time of the controlled station for the
time synchronization
Reserved
24–120 Reserved - -
121–128 Reserved - -
Function Codes of the Slave

Supported by
DNPMx0 DNPSx0
General function codes
0 confirm Acknowledgement for a fragment at ü ü
application level
129 response Reply to an interrogation of data ü ü
130 unsolicited message Spontaneous message of the controlled ü ü
station without interrogation from the master

Edition 12.2017, DC0-090-2.10
Request Header
The request header is only contained in the first message of a sequence. It consists of the
Application Control and the Function Code. Only the master sends a request header.
7 6 5 4 3 2 1 0
2 2 2 2 2 2 2 2
Function code 0 .. 255 Function Code (FC)
Response Header
The response header is only contained in the first message of a sequence. It consists of the
Application Control, the Function Code and the Internal Indications. Only the slave sends a
response header.
7 6 5 4 3 2 1 0
2 2 2 2 2 2 2 2
Function code 0 .. 255 Function Code (FC)
7 6 5 4 3 2 1 0
Internal Indications
15 14 13 12 11 10 9 8
Every message with user data from the controlled station contains the internal indication in the
response header. The internal indication consists of 16 bit and contains information and errors
of the controlled station.
Bit 0: A message addressed to all controlled stations has been received.

Bit 1: Class 1 data present
Bit 4: The controlled station expects a time synchronization.
Bit 5: Some or all data points are/will be controlled locally (local/remote switch)
Bit 6: Fault in the controlled station
Bit 7: Controlled station restart
Bit 8: The function code is not supported
Bit 9: The requested data are not present in the controlled station.
Bit 10: Error in Qualifier/Index field or in the Range field of the object header
Bit 11: Event memory overflow
Bit 12: The received request is already being executed.
Bit 13: Fault or error in the controlled station parameters
Bit 14: Reserved
Bit 15: Reserved

DC0-090-2.10, Edition 12.2017
2.12.2.3.2 Object Header (DUI)
The object header defines and describes the following data objects for this object header.
The Object Header (DUI … Data Unit Information) consists of:
· Object
· Variation
· Qualifier
· Range
7 6 5 4 3 2 1 0
2 2 2 2 2 2 2 2
Object Object Type
Variation Object Variant
Res. Index Size Qualifier Code Qualifier
Range
Qualifier
The qualifier field determines the number and the structure of the individual data objects for
this object header. The precise use of the Qualifier field is to be taken from the general
description of the DNP protocol.
The Qualifier Code defines how the data objects are addressed and structured and the Index
Size defines how the index of the data objects is formed.
Range
The Range field can be a single index of a data object or a table from a start index and an end
index. The size of the index can be maximum 32 Bit or 42949671295.

Edition 12.2017, DC0-090-2.10
2.12.2.3.3 Data Objects (IO)
The description of the individual data objects is to be taken from the document DNP3 Data
Object Library of the DNP Organization.
2.12.2.3.4 Data Index
Every data object is defined by the object type and the object variant used. Within one object
type the data objects are differentiated by the data index. According to the definition this data
index can be maximum 42949671295. All DNP3.0 firmware variants however support only a
maximum data index of 65535. Consequently a maximum of 65536 data points can be used
for one object type. The same data index may be used for different object types, as the
differentiation of the data is enabled through the object type.
2.12.3 Message Examples for DNP3
Example 1: Test of the link layer (Test Function for Link)

Message is transmitted from the primary station with address = 0 to a
secondary station with address = 1.
27 26 25 24 23 22 21 20
1. Byte START [0x05]
2. Byte START [0x64]
(according IEC60870-5-1 / FT3)

3. Byte LENGTH [0x05] **)
DNP3 Message Header

PRM=1 FCB=1 FCV=1 23 22 21 20
4. Byte DIR=1 Control Field
Funktion Code [0x02]
5. Byte DESTINATION [0x01] [LSB]

Destination Block - 0
Station-Address
6. Byte DESTINATION [0x00] [MSB]
7. Byte SOURCE [0x00] [LSB]

Source
Station-Address
8. Byte SOURCE [0x00] [MSB]
9. Byte CRC [0x52] [LSB]
10. Byte CRC [0x0C] [MSB]
**) CRC Bytes are not includend in LENGTH !

DC0-090-2.10, Edition 12.2017
2.13 Message Conversion
Data in transmit direction are transferred from the basic system element to the protocol
element in SICAM RTUs internal IEC 60870-5-101/104 format. These are converted on the
line by the protocol element to the DNP3 message format and transmitted according to the
transmission procedure of the protocol.
Data in receive direction are converted by the protocol element on the transmission line from
DNP3 format to a SICAM RTUs internal IEC 60870-5-101/104 format and transferred to the
basic system element.
The transformation of the message formats SICAM RTUs « DNP3 and the conversion of the
address information is known as message conversion. The conversion of the address
information is carried out using the process-technical OPM (object-oriented Process Data
Manager) protocol detailed routing.

Edition 12.2017, DC0-090-2.10
With the DNP3 protocol the addressing of the data (DNP Objects) is carried out with “Object /
Variation" and data index. The interrogation of the data by the controlling station can take
place either specifically (e.g.: “Binary Input with Status”) or with a general interrogation
(e.g. “Binary Input - Any Variation”).
The default data types for interrogations with “Any Variation” are to be set in the controlled
station with the following parameters:
· Default data type for "Binary Input (Object 1)"

Can be set with the parameter advanced parameters | Settings default data object
types | for binary input (object 1)
· Default data type for "Binary Input Change (Object 2)"
typesn | for binary input change (object 2)
· Default data type for "Double Binary Input (Object 3)"
typesn | for double binary input (object 3)
· Default data type for "Double Binary Input Change (Object 4)"
typesn | for double binary input change (object 4)
· Default data type for "Binary Output (Object 10)"
types | for binary output (object 10)
· Default data type for "Binary Counter (Object 20)"
typesn | for binary counter (object 20)
· Default data type for "Frozen Binary Counter (Object 21)"
typesn | for frozen binary counter (object 21)
· Default data type for "Binary Counter Change Event (Object 22)"
types | for binary counter change event (object 22)
· Default data type for "Frozen Binary Counter Event (Object 23)"
types | for frozen binary counter event (object 23)
· Default data type for "Analog Input (Object 30)"
typesn | for analog input (object 30)
· Default data type for "Analog Input Change (Object 32)"
typesn | for analog input change(object 32)
· Default data type for "Analog Input Dead band (Object 34)"
typesn | for analog input dead band (object 34)
· Default data type for "Analog Output Status (Object 40)"
Can be set with the parameter advanced parameters | Settings default
data object typesn | for analog output status (object 40)

DC0-090-2.10, Edition 12.2017
With the DNP3 Master the following detailed routing types are available in transmit direction:
· Commands for single or double commands

· Setpoint values for setpoint commands normalized, scaled and short floating point
With the DNP3 Master the following detailed routing types are available in receive direction:
· Binary information as process information for single or double-point information

· Measured values as measured values normalized, scaled and short floating point
· Counts as count 31 Bit + polarity sign with sequence number
The Ax address consists of 5 + 1 bytes:

1. octet of the CAASDU/ region number
2. octet of the CAASDU/ component number
1. octet of the IOA/ module number
2. octet of the IOA/ value number
3. octet of the IOA/ subaddress
Data type (process-technical addressing)
The 3rd party address consists of:

DNP Link Address
DNP Data Index (address of the data point)
DNP Object Group

Edition 12.2017, DC0-090-2.10
2.13.1 Status Information General Rules
7 0
Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Bit 0: Online (status of the data point)

This status is displayed on the IV-status bit of the Ax message.
0 = offline, the acquisition of the data point is possibly invalid.
1 = online, the data point has been correctly acquired.
Bit 1: Restart (restart of the module that acquires this data point)
This status is not supported by the firmware.
0 = normal, normal status
1 = restart, restart of the module
Bit 2: Communication lost (failure of the module that acquires this data point)
This status is displayed on the NT-status bit of the Ax message.
1 = lost, communication failed
Bit 3: Remote Forced Data (the change of the data point was caused by a remote
command.)
This status is used as cause of transmission return information through remote
command (COT=11) in the Ax message.
0 = normal, change without command
1 = remote forced, change through a remote command
Bit 4: Local Forced Data (the change of the data point was caused by a local
command.)
This status is used as cause of transmission return information through local
command (COT=12) in the Ax message.
0 = normal, change without command
1 = local forced, change through a local command

DC0-090-2.10, Edition 12.2017
2.13.1.1 Conversion of NT-bit
For master and slave there is the opportunity to convert the DNP3 status bits “offline” and
“communication lost” in different ways if its needed. These parameters are used:
· Master (ethernet firmwares: DNP3 à Master à) advanced parameters | conversion

DNP3 status bit „offline“
· Slave (ethernet firmwares: DNP3 à Slave à) advanced parameters | conversion of
NT-bit
Master à Slave:
If the DNP3 status bit “communication lost” ist set, then it will be converted into the NT-bit
anyways.
· (defaut) DNP3 status bit “offline” à IV-bit

· DNP3 status bit “offline” à “NT-bit
· DNP3 status bit “offline” à NT-bit and IV-bit
Slave à Master:
· (default) NT-bit à DNP3 status bit “communication lost” (bit 2)

· NT-bit à DNP3 status bit “offline” (bit 2)
· NT-bit à DNP3 status bits “offline” and “communication lost” (bit 0 and bit 2)
Note
This is supported by the DNP3 protocol for SICAM RTUs for the following firmware from the specified
revision!
2.13.1.2 Conversion of IV-bit
For the slave there is the opportunity to use the IV-Bit additionally or alternatively to the NT-bit
as an information for the failure of the data point. Thus will be converted like mentioned
above.
Slave à Master:
· (default) only NT-bit is used for the failure of the data point
· only the IV-bit is used for the failure of the data point
· NT-bit and/or IV-Bit is used for the failure of the data point

Edition 12.2017, DC0-090-2.10
2.13.1.3 Status Information for Binary Information
7 0
0/1 Res. Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Bit 0 to 4: see Status Information General Rules
Bit 5: Chatter Filter (the transmission of the data point was prevented due to too
many changes; bounce suppression)
This status is not supported by the firmware.
1 = filter on, bounce suppression
2.13.1.4 Status Information for Measured Values
7 0
Res. Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Bit 0 to 4: see Status Information General Rules1
Bit 5: Over-Range (overflow of the measuring range)

This status is displayed on the OV-status bit of the Ax message.
0 = normal, no overflow
1 = over-range, overflow of the measuring range
Bit 6: Reference Check (fault with reference check)

This status is displayed on the IV-status bit of the Ax message.
1 = error, error during the reference check
2.13.1.5 Status Information for Counter Values
7 0
Res. Res. Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
Bit 0 to 4: see Status Information General Rules
Bit 5: Roll-Over (overflow of the count range)

This status is used for the count calculation and is used for the detection of a possible
overflow
0 = normal, no overflow
1 = roll-over, overflow of the count range

DC0-090-2.10, Edition 12.2017
2.13.2 DNP3 MASTER: Message Conversion in Receive Direction
Message Conversion in Receive Direction DNP3 ® IEC60870-5-101/104:
DNP3 IEC60870-5-101/104
Object Object Variant Designation Designation TI
Type
1 1, 2 Binary Input Single-point info with real time 30
2 1, 2, 3 Binary Input Change Double-point info with real time 31
3 1, 2 Double Binary Input Double-point info with real time 31
4 1, 2, 3 Double Binary Input Change
10 1, 2 Binary Output Single-point info with real time 30
11 1, 2 Binary Cmd. Status
30 1, 2, 3, 4,5 Analog Input Measured value 15 Bit + sign 34
32 1, 2, 3, 4, 5, 7 Analog Change Event normalized 35
34 1, 2, 3 Analog Input Dead band Measured value 15 Bit + sign 36
40 1, 2, 3 Analog Output Status scaled
Measured value short floating point
20 1, 2, 5, 6 Binary Counter Count 31 Bit + polarity sign with 37
21 1, 2, 5, 6, 9, 10 Frozen Counter sequence number
22 1, 2, 5, 6 Counter Change Event
23 1, 2, 5, 6 Frozen Counter Event
52 2 Time Delay Fine Time synchronization *)
*) Message is only evaluated on PRE

Edition 12.2017, DC0-090-2.10
2.13.2.1 Process Information “Binary Input”
Object format: DNP3 Binary Input
Object type 1 - Variation 01 Type: Static
7 0
7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8
0 0 0 n n-1 n-2 n-3 n-4
Object format: DNP3 Binary Input with Status
7 0
Object format: DNP3 Binary Input Change without Time
Object type 2 - Variation 01 Type: Event
7 0

DC0-090-2.10, Edition 12.2017
Object format: DNP3 Binary Input Change with Time
7 0
LSB
48 Bit absolute time in milliseconds
Since 01.01.1970 00.00 hours
MSB
7 0
Relative time in milliseconds LSB
MSB 0 - 65535

Edition 12.2017, DC0-090-2.10
Address Conversion SICAM RTUs ® DNP3:
The address conversion is parameterized using the OPM (object-oriented process data
manager). For this the detailed routing type “REC_Binary_Input” is available in the protocol
detailed routing with the following entries.
Supported SICAM RTUs message formats:
· 1 single-point Information (TI = 30)

· 1 double-point Information (TI = 31)
SICAM RTUs address:
CASDU1
CASDU2 5-stage freely parameter-settable SICAM RTUs destination address
IOA1 possible: 0 – 255
IOA2
IOA3
TI: type identification:
possible: 30 = single-point information

31 = double-point information
Third-party address:
Link address: Station number of the remote station
DNP data index: Unambiguous address of this data point

possible: 0-65535
Object_Group: Assignment of the data to the DNP object types

possible: - Single Binary Input
- Double Binary Input
- Binary Output
Supplementary information:
None

DC0-090-2.10, Edition 12.2017
Conversion information:
Data type_information: - single-point information

- single-point information inverted
- double-point information status OFF
- double-point information status ON
With this setting the type and the contents of the data is
interpreted.
Note
If a double-point information is to be generated automatically from 2 individual binary inputs, then 2
individual data points must be created and in each case the corresponding signaling bit/data index
assigned for “double-point information status OFF” and “double-point information status ON”.
Conversion_information: - single-point information

- transient information forward only ON
- emulate transient information OFF
- double-point information with faulty and intermediate position
monitoring.
- double-point information without faulty and intermediate
position monitoring.
Through this setting the conversion of the data is defined.
GI behavior: - no forwarding with source-GI

- forwarding with source-GI from the image
With forwarding from the image, with GI data can be
forwarded that are not sent from the remote station with a GI,
e.g. transient information.

Edition 12.2017, DC0-090-2.10
2.13.2.2 Process Information “Double Binary Input”
Object format: DNP3 double binary Input

7 0
7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8
0 0 0 n n-1 n-2 n-3 n-4
Object format: DNP3 Binary Input with Status

7 0
ON OFF Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0

7 0

DC0-090-2.10, Edition 12.2017
Object format: DNP3 Binary Input Change with Time

7 0
LSB
48 bit absolute time in milliseconds
Since 01.01.1970 00.00 hours
MSB

7 0
MSB 0 - 65535

Edition 12.2017, DC0-090-2.10
Address conversion DNP3 à SICAM RTUs:
SICAM RTUs address:
CASDU1
IOA2
IOA3
TI: type identification
possible: 31 = double-point information

possible: 0-65535

possible: - Double Binary Input
none
IEC message conversion:
Data type_information: - double-point information OFF before ON

- double-point information ON before OFF
With this setting the type and the contents of the data are
interpreted.
Conversion_information: - double-point information with faulty and intermediate position

monitoring.
- double-point information without faulty and intermediate
position monitoring.


DC0-090-2.10, Edition 12.2017
2.13.2.2.1 Process Information “Binary Output”
Object format: DNP3 Binary Output

7 0
7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8
0 0 0 n n-1 n-2 n-3 n-4
Object format: DNP3 Binary Output with Status

7 0

Edition 12.2017, DC0-090-2.10
SICAM RTUs address:
CASDU1
CASDU2 5-stage freely parameter-settable SICAM RTUs destination
IOA1 address
IOA3

possible: 0-65535

possible: - Binary Output
none
Data type_information: - single-point information

With this setting the type and the contents of the data is
interpreted.
Conversion_information: - single-point information

- transient information forward only ON
- emulate transient information OFF


DC0-090-2.10, Edition 12.2017
2.13.2.3 Message Conversion Measured Values
Object format DNP3 "32 Bit Analog Input":
Object format DNP3 "32 Bit Frozen Analog Input":
Object format DNP3 "32 Bit Analog Change Event without Time":
Object format DNP3 "32 Bit Frozen Analog Event without Time":
7 0
Status information measured values
LSB
Measured value
-2147483648 to +2147483647
MSB
Object format DNP3 "32 Bit Analog Input without Flag":
Object format DNP3 "32 Bit Frozen Analog Input without Flag":
7 0
LSB
Measured value
-2147483648 to +2147483647
MSB

Edition 12.2017, DC0-090-2.10
Object format DNP3 "32 Bit Frozen Analog Input with Time of Freeze":
Object format DNP3 "32 Bit Analog Change Event with Time":
Object format DNP3 "32 Bit Frozen Analog Event with Time":
7 0
LSB
Measured value
-2147483648 to +2147483647
MSB
LSB
since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017
Object format DNP3 16 Bit Analog Input:
Object format DNP3 16 Bit Frozen Analog Input:
Object format DNP3 16 Bit Analog Change Event without Time:
Object format DNP3 16 Bit Frozen Analog Event without Time:
7 0
Measured value LSB
MSB -32768 to +32767
Object format DNP3 16 Bit Analog Input without Flag:
Object format DNP3 15 Bit Frozen Analog Input without Flag:
7 0
Measured value LSB
MSB -32768 to +32767

Edition 12.2017, DC0-090-2.10
Object format DNP3 16 Bit Frozen Analog Input with Time of Freeze:
Object format DNP3 16 Bit Analog Change Event with Time:
Object format DNP3 16 Bit Frozen Analog Event with Time:
7 0
Measured value LSB
MSB -32768 to +32767
LSB
since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017
Object format DNP3 short floating point Analog Input:
Object format DNP3 short floating point Frozen Analog Input:
Object format DNP3 short floating point Analog Change Event without Time:
Object format DNP3 short floating point Frozen Analog Event without Time:
7 0
LSB
Measured value
short floating point
MSB

Edition 12.2017, DC0-090-2.10
Object format DNP3 short floating point Analog Change Event with Time:
Object format DNP3 short floating point Frozen Analog Event with Time:
7 0
LSB
Measured value
MSB
LSB
Since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017
· Measured value 15 bit + polarity sign normalized (TI = 34)

· Measured value 15 bit + polarity sign scaled (TI = 35)
· Measured value short floating point (TI = 36)
manager). For this the detailed routing type “REC_Analog_Input” is available in the protocol
SICAM RTUs address:
CASDU1
IOA2
IOA3
possible: 34 = measured value 15 bit + polarity sign normalized

35 = measured value 15 bit + polarity sign scaled
36 = measured value short floating point

possible: 0-65535

possible: - analog input
- analog input dead band
- analog output
None

Edition 12.2017, DC0-090-2.10
Adaptation X0: This is the minimum value of the DNP analog value.
Adaptation X100: This is the maximum value of the DNP analog value
Adaptation Y0: This is the minimum value of the SICAM RTUs measured
value.
Adaptation Y100: This is the maximum value of the SICAM RTUs measured
value.
Measured value threshold great:

Change monitoring for measured values
If the delta between old and new value is greater than the
measured value threshold great, then this measured value is
forwarded immediately.
Measured value threshold additive:

Change monitoring for measured values
The change of every single value received is added up
polarity sign correct. If this summation value exceeds the
additive measured value threshold, then the measured value
is forwarded.

DC0-090-2.10, Edition 12.2017
2.13.2.4 Message Conversion of Counts
Object format DNP3 32 Bit Binary Counter:
Object format DNP3 32 Bit Frozen Binary Counter:
Object format DNP3 32 Bit Binary Frozen Counter Change Event without Time:
7 0
Status information counts
LSB
Count
0 to +4294967295
MSB
Object format DNP3 32 Bit Binary Counter without Flag:
Object format DNP3 32 Bit Binary Frozen Counter without Flag:
7 0
LSB
Count
0 to +4294967295
MSB

Edition 12.2017, DC0-090-2.10
7 0
LSB
Count
0 to +4294967295
MSB
7 0
LSB
Count
0 to +4294967295
MSB

DC0-090-2.10, Edition 12.2017
7 0
Count LSB
MSB 0 to +65535
7 0
Count LSB
MSB 0 to +65535

Edition 12.2017, DC0-090-2.10
Object format DNP3 16 Bit Binary Frozen Counter with Time of Freeze:
Object format DNP3 16 Bit Binary Frozen Delta Counter with Time of Freeze:
Object format DNP3 16 Bit Binary Frozen Counter Change Event with Time:
7 0
Count LSB
MSB 0 to +65535
LSB
since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017
· Count 31 Bit + polarity sign with sequence number (TI = 37)
manager). For this the detailed routing type “REC_Counter” is available in the protocol
SICAM RTUs address:
CASDU1
IOA2
IOA3
possible: 37 = count 31 Bit + polarity sign with sequence number

possible: 0-65535

possible: - binary counter
- frozen binary counter
IEC-Group: This parameter setting refers to the counter group in the

Ax system message counter interrogation
possible: - Group 1
- Group 2
- Group 3
- Group 4
Transmit: This parameter defines how the count is to be frozen internally and
transmitted. The count can be interrogated by the remote station
(counter interrogation) or frozen time-controlled. If an event class is
defined, then the time-controlled frozen count is transmitted as event
at the moment of freezing.
possible: - counter interrogation
- 1 minute
- 2 minutes
- 3 minutes
- 5 minutes
- 10 minutes
- 15 minutes
- 30 minutes
- 60 minutes
- spontaneously

Edition 12.2017, DC0-090-2.10
Raw value type: This parameter determines the manner of the conversion.
possible: - absolute value à absolute value
- relative value à absolute value
- absolute value à relative value
- relative value à absolute value
Overflow: Overflow of the count and how the value is used

possible: - 31 bit integer
- 24 bit integer
- 2 decades BCD (99)
- 8 decades BCD (99999999)
- 9 decades BCD (999999999)
- 16 bit integer
- transparent data transfer
The count is calculated according to the following method.
· Calculate the delta between the new DNP3 value and the old DNP3 value (under
consideration of a possible overflow 16 or 32 bit)
· Add this delta value to the internal count
· Perform overflow treatment according to the parameter “overflow” and set the CY bit
The overflow is to be adapted according to the rate of change of the DNP3 count, with greater
changes greater overflows should be used accordingly.
Note
In some cases the RTU does have an individual counter rollover (not 16 or 32 bit). Therefore it is possible
to transfer the received counter values without internal calculation. To use this the following parameters
must be used:
overflow → transparent data transfer
transmit → spontaneously
In this case the IEC counter interrogation and cyclic counter data transfer is not possible anymore.

DC0-090-2.10, Edition 12.2017
2.13.3 DNP3 MASTER: Message Conversion in Transmit Direction
Message Conversion in Receive Direction IEC60870-5-101/104 à DNP3:
IEC60870-5-101/104 DNP3
TI Designation Designation Object Object
Type Variant
45 single command Control Relay Output Block 12 1
46 double command
30 Single-point info with real time Binary Output 10 1
48 Setpoint command 15 bit + sign 32 Bit Analog Output Block 41 1
49 normalized 16 Bit Analog Output Block 2
50 Setpoint command 15 bit + sign scaled short floating point Analog 3
Setpoint command short floating point Output Bl.
34 Measured value 15 Bit + sign Analog Input Dead band 34 1, 2, 3
35 normalized
36 Measured value 15 Bit + sign scaled
Cyclic interrogations Enable/Disable unsolicited 60 2, 3, 4 *)
messages for data class 1, 2 or
3.
Enable or disable spontaneous
message transmission
Assign Class *)
Assign the specified data to
class 1, 2 or 3
Delay Measurement *)
Run time measurement
Time synchronization Time and Date 50 1 *)
Time synchronization
*) message is only created on SIP

Edition 12.2017, DC0-090-2.10
2.13.3.1 Message Conversion of Commands
Object format DNP3 Control Relay Output Block:
7 0
control code
count = 1
LSB
on time (ms)
MSB
LSB
off time (ms)
MSB
0 status

DC0-090-2.10, Edition 12.2017
Count: Counter for the number of command outputs for this command
only Count = 1 is supported by the firmware
Control code:
trip/close clear queue code
Code: 0 = no operation specified (is not evaluated by the firmware)

1 = Pulse ON (pulse sequence OFF à ON à OFF, is used as command ON)
2 = Pulse OFF (pulse sequence ON à OFF à ON, is used as command OFF)
3 = Latch ON (switches the command ON)
4 = Latch OFF (switches the command OFF)
5 – 15 Reserve
Queue: If this bit is set, then the command is repeated following its output
(is not evaluated by the firmware)
Clear: If this bit is set, all commands stored in the queue are cleared
Trip/Close: With this a double command can be executed with one command (data point).
For this the commands TRIP and CLOSE are used.
(is only used/evaluated for double commands)
Status: 0 = No error
1 = The OPERATE-command has been received after the timeout for
SELECT/OPERATE has expired
2 = The OPERATE-command was received without a
SELECT-command being received beforehand
3 = Implausible data in command message
4 = No routing record present for this command
5 = This command state is already active or the internal storage
(Queue) is occupied/full
6 = No output possible due to hardware problems
7 = No output possible because local/remote control not set to REMOTE
8 = No output possible because too many command outputs active at the
same time
9 = No output possible because no adequate authorization
present
10 – 127 reserved
The status information is added by the controlled station and transmitted as
command acknowledgement with the entire command object.

Edition 12.2017, DC0-090-2.10
Address Conversion SICAM RTUs à DNP3:
manager). For this the detailed routing type “TRA_Command” is available in the protocol
· 1 single command (TI = 45)

· 1 double command (TI = 46)
DNP3 address

possible: 0-65535

possible: - binary command (CROB)
Supplementary information
Cmd_ON_time: This parameter determines the command output time for the ON-
command.
Cmd_OFF_time: This parameter determines the command output time for the OFF-
command.
Function_Code: This parameter determines the DNP function code to be added for this
command. In addition it is also defined which type of command
procedure is to be performed.
possible: - select und execute
- direct operate (only the EXECUTE command is used)
- direct operate no ack. (only the EXECUTE command is
used) [with this function code no command status
information is sent by the RTU]

DC0-090-2.10, Edition 12.2017
Control_code: This parameter determines which type of command output is to be

performed for this data point.
possible: - command as LATCH ON/OFF (the output takes place
state-change stored as permanent state)
- command as PULSE ON (pulse command, switch on
command relay for the duration of Cmd_ON_time)
- command as PULSE ON with TRIP (pulse command,
in addition there is a TRIP relay à double command
OFF on one DNP data point)
- command as PULSE ON with CLOSE (pulse command,
in addition there is a CLOSE relay à double command
ON on one DNP data point)
- command as PULSE ON with TRIP/CLOSE (pulse
command, In addition there is a TRIP and CLOSE relay
à double command ON and OFF on one DNP data point)
Command_Point: This parameter defines how the command is to be assigned to the

data point, e.g. whether a data point can execute the ON and the OFF
command or only command of the two (2 data points for one double
command).
possible: - Data point as ON/CLOSE and OFF/TRIP
- Data point only as ON/CLOSE
- Data point only as OFF/TRIP
SICAM RTUs address:
CASDU1
CASDU2 5-stage freely parameter-settable SICAM RTUs source address
IOA2
IOA3
possible: 45 = single command

46 = double command
Every command message is sent back by the controlled station, unless it concerns the
function code "direct operate no acknowledgement”, and in this message the status of the
command output is entered.

Edition 12.2017, DC0-090-2.10
2.13.3.2 Message Conversion of Binary Output
Object format DNP3 Binary Output:
7 0
7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8
0 0 0 n n-1 n-2 n-3 n-4
The firmware however supports only the output of one data point per message.

DC0-090-2.10, Edition 12.2017
manager). For this the detailed routing type “TRA_Command” is available in the protocol
DNP3 address

possible: 0-65535

possible: - binary output
Cmd_ON_time: not used
Cmd_OFF_time: not used
possible: - write
Control_code: not used
Command_Point: not used
SICAM RTUs address:
CASDU1
IOA2
IOA3

Edition 12.2017, DC0-090-2.10
2.13.3.3 Message Conversion of Setpoint Values
Object format DNP3 32 Bit Analog Output Block:
7 0
LSB
Setpoint value
-2147483648 to +2147483647
MSB
0 status
7 0
Setpoint value LSB
MSB -32768 to +32767
0 status
Object format DNP3 Short Floating Point Analog Output Block:
7 0
LSB
Setpoint value
MSB
0 status

DC0-090-2.10, Edition 12.2017
Status: 0 No error
1 The OPERATE-command has been received after the timeout
for SELECT/OPERATE has expired
2 The OPERATE-command was received without a SELECT
command being received beforehand
3 Implausible data in command message
4 No routing record present for this command
5 This command state is already active or the internal storage
6 No output possible due to hardware problems
7 No output possible because local/remote control not set to
REMOTE
8 No output possible because too many command outputs
active at the same time
9 No output possible because no adequate authorization
present
10–127 Reserved
The status information is added by the controlled station and transmitted as command
acknowledgement with the entire command object.
manager). For this the detailed routing type “TRA_Setpoint_Value” is available in the protocol
upported SICAM RTUs message formats:
· Setpoint command normalized (TI = 48)

· Setpoint command scaled (TI = 49)
· Setpoint command short floating point (TI = 50)
DNP3 address

possible: 0-65535

possible: - analog output block
possible: - select und execute
- direct operate (only the EXECUTE command is used)
- direct operate no ack. (only the EXECUTE command is
used) [with this function code no command status
information is sent by the RTU]

Edition 12.2017, DC0-090-2.10
Conversion information
Object_Variation: This parameter determines the format and the data type of the data to
be converted.
possible: - 32 Bit Analog Data
- 16 Bit Analog Data
- short floating point analog data
Supplementary information for setpoint values/measured values:
Adaptation X0: This is the minimum value of the SICAM RTUs analog value.
Adaptation X100: This is the maximum value of the SICAM RTUs analog value
Adaptation Y0: This is the minimum value of the DNP measured value.
Adaptation Y100: This is the maximum value of the DNP measured value.
Every setpoint value message is sent back by the controlled station, unless it concerns the
function code "direct operate no acknowledgement”, and in this message the status of the
setpoint value output is entered.
2.13.4 DNP3 SLAVE: Message Conversion in Transmit Direction
Message Conversion in Transmit Direction IEC60870-5-101/104 ® DNP3:
IEC60870-5-101/104 DNP3
TI Designation Designation Object Object
Type Variant
30 Single-point info with real time Binary Input 1 0, 1, 2
31 Double-point info with real time Binary Input Change 2 0, 1, 2, 3
31 Double-point info with real time Double Binary Input 3 0, 1, 2
Double Binary Input Change 4 0, 1, 2, 3
34 Measured value 15 Bit + sign Analog Input 30 0, 1, 2, 3,
35 normalized Analog Change Event 32 4
36 Measured value 15 Bit + sign scaled 0, 1, 2
37 Count 31 Bit + polarity sign with Binary Counter 20 0, 1, 5
sequence number Frozen Counter 21 0, 1, 5, 9
Frozen Counter Event 23 0, 1, 5
Time synchronization Time Delay Fine 52 2 *)
*) message is created automatically on SIP

DC0-090-2.10, Edition 12.2017
2.13.4.1 Message Conversion of Process Information
2.13.4.1.1 Conversion to Binary Input
Object format DNP3 Binary Input:
7 0
7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8
0 0 0 n n-1 n-2 n-3 n-4
Object format DNP3 Binary Input with Status:
7 0
Object format DNP3 Binary Input Change without Time:
7 0

Edition 12.2017, DC0-090-2.10
Object format DNP3 Binary Input Change with Time:
7 0
LSB
Since 01.01.1970 00.00 hours
MSB
7 0
MSB 0 - 65535

DC0-090-2.10, Edition 12.2017

manager). For this the detailed routing type “TRA_Binary_Input” is available in the protocol
SICAM RTUs address:
CASDU1
IOA2
IOA3

31 = double-point information
Link address: Station number of the remote station (controlling station)

Only for DNPi00

possible: 0-65535
Object variant: Assignment of the data to the DNP object types

possible: - Binary Input
Event class: Assignment of the data point to an event class

possible: - Class 1 data
- Class 2 data
- Class 3 data
- Not used/no class
IEC message conversion: Conversion of the IEC information to the corresponding DNP data
index
possible: - single-point information
- double-point information status OFF (TI 31)
- double-point information status ON (TI 31)
Note
If 2 individual binary inputs are to be generated automatically from one double-point information, then 2
individual data points of the double-point information must be created and in each case the corresponding
status “double-point information status OFF” and “double-point information status ON” assigned to the
respective DNP3 data index.

Edition 12.2017, DC0-090-2.10
2.13.4.1.2 Conversion to Double Binary Input
Object format DNP3 Binary Input:
7 0
7 6 5 4 3 2 1 0
15 14 13 12 11 10 9 8
0 0 0 n n-1 n-2 n-3 n-4
Object format DNP3 Binary Input with Status:
7 0
7 0

DC0-090-2.10, Edition 12.2017
Object format DNP3 Binary Input Change with Time:
7 0
LSB
since 01.01.1970 00.00 hours
MSB
7 0
MSB 0 - 65535

Edition 12.2017, DC0-090-2.10
manager). For this the detailed routing type “TRA_Binary_Input” is available in the protocol
SICAM RTUs address:
CASDU1
IOA2
IOA3
possible: 31 = double-point information

Only for DNPi00

possible: 0-65535

possible: - Double Binary Input

- Class 2 data
- Class 3 data
- Not used/no class
IEC message conversion: Conversion of the IEC information to the corresponding DNP data
index
possible: - Double-point information OFF before ON (TI 31)
- Double-point information ON before OFF (TI 31)

DC0-090-2.10, Edition 12.2017
2.13.4.2 Message Conversion Measured Values
7 0
LSB
Measured value
-2147483648 to +2147483647
MSB
7 0
LSB
Measured value
-2147483648 to +2147483647
MSB

Edition 12.2017, DC0-090-2.10
7 0
LSB
Measured value
-2147483648 to +2147483647
MSB
LSB
since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017
7 0
Measured value LSB
MSB -32768 to +32767
7 0
Measured value LSB
MSB -32768 to +32767

Edition 12.2017, DC0-090-2.10
7 0
Measured value LSB
MSB -32768 to +32767
LSB
since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017
Object format DNP3 short floating point Analog Input:
Object format DNP3 short floating point Frozen Analog Input:
Object format DNP3 short floating point Analog Change Event without Time:
Object format DNP3 short floating point Frozen Analog Event without Time:
7 0
LSB
Measured value
MSB

Edition 12.2017, DC0-090-2.10
Object format DNP3 short floating point Analog Change Event with Time:
Object format DNP3 short floating point Frozen Analog Event with Time:
7 0
LSB
Measured value
MSB
LSB
since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017

manager). For this the detailed routing type “TRA_Analog_Input” is available in the protocol
SICAM RTUs address:
CASDU1
IOA2
IOA3


Only for DNPi00

possible: 0-65535

possible: - Measured value 16 bit
- Measured value 32 bit
- Measured value short floating point

- Class 2 data
- Class 3 data
- Not used/no class

Edition 12.2017, DC0-090-2.10
Adaptation X0: Minimum value of the SICAM RTUs analog value
Adaptation X100: Maximum value of the SICAM RTUs analog value
Adaptation Y0: Minimum value of the DNP measured value
Adaptation Y100: Maximum value of the DNP measured value

Change monitoring for events
If the delta between old and new value is greater than the
measured value threshold, then an event is generated from this.

DC0-090-2.10, Edition 12.2017
2.13.4.3 Message Conversion Counts
7 0
LSB
Count
0 to +4294967295
MSB
7 0
LSB
Count
0 to +4294967295
MSB

Edition 12.2017, DC0-090-2.10
Object format DNP3 32 Bit Binary Frozen Counter with Time of Freeze:
Object format DNP3 32 Bit Binary Frozen Delta Counter with Time of Freeze:
Object format DNP3 32 Bit Binary Frozen Counter Change Event with Time:
7 0
LSB
Count
0 to +4294967295
MSB
LSB
since 01.01.1970 00.00 hours
MSB

DC0-090-2.10, Edition 12.2017
· Count 31 Bit + polarity sign with sequence number (TI = 37)
manager). For this the detailed routing type “TRA_Counter” is available in the protocol
SICAM RTUs address:
CASDU1
IOA2
IOA3
possible: 37 = count 31 Bit + polarity sign with sequence number

Only for DNPi00

possible: 0-65535

possible: - 32 bit count
- 16 bit count
- 32 bit count delta
- 16 bit count delta

- Class 2 data
- Class 3 data
- Not used/no class

Edition 12.2017, DC0-090-2.10
IEC count type: Is the count used as absolute value or as relative value.
possible: - Absolute value
- Relative value
Overflow: Overflow of the count and how the value is used

possible: - 31-bit integer
- 24-bit integer
- 8 decades BCD (99999999)
- 9 decades BCD (999999999)
- 16-bit integer
Transmit: This parameter defines how the count is to be frozen internally and
transmitted. The count can be interrogated by the remote station
(counter interrogation) or frozen time-controlled. If an event class is
defined, then the time-controlled frozen count is transmitted as event
at the moment of freezing.
possible: - counter interrogation
- 1 minute
- 2 minutes
- 3 minutes
- 5 minutes
- 10 minutes
- 15 minutes
- 30 minutes
- 60 minutes
The count is calculated according to the following method.
· Calculate the delta between the new internal value and the old internal value (under
consideration of a possible overflow depending on parameter setting)
· Add this delta value to the last transmitted DNP3 count
· Perform overflow treatment according to DNP3 data type and set the roll-over bit

DC0-090-2.10, Edition 12.2017
2.13.5 DNP3 SLAVE: Message Conversion in Receive Direction
Message Conversion in Receive Direction DNP3 ® IEC60870-5-101/104:
DNP3 IEC60870-5-101/104
Object Object Designation Designation TI
Type Variant
12 1 Control Relay Output Block single command 45
double command 46
41 1 32 Bit Analog Output Block Setpoint command 15 bit + sign 48
2 16 Bit Analog Output Block normalized 49
3 short floating point Analog Setpoint command 15 bit + sign scaled 50
Output Bl. Setpoint command short floating point
60 1, 2, 3, 4 Interrogation data class 0, 1 , *)
2 or 3
60 2, 3, 4 Enable/Disable unsolicited *)
messages for data class 1 , 2
or 3
Enable/Disable spontaneous
message transmission
Assign Class *)
Assign the specified data to
class 1, 2 or 3
Delay Measurement *)
Run time measurement
50 1 Time and Date *)
Time synchronization
*) message is only evaluated on PRE

Edition 12.2017, DC0-090-2.10
2.13.5.1 Message Conversion Commands
Object format DNP3 Control Relay Output Block:
7 0
control code
count = 1
LSB
on time (ms)
MSB
LSB
off time (ms)
MSB
0 status

DC0-090-2.10, Edition 12.2017
Count: Counter for the number of command outputs for this command
only Count = 1 is supported by the firmware
Control code:
trip/close clear queue code
Code: 0 = no operation specified (is not evaluated by the firmware)

1 = Pulse ON (pulse sequence OFF à ON à OFF, is used as command ON)
2 = Pulse OFF (pulse sequence ON à OFF à ON, is used as command OFF)
3 = Latch ON (switches the command ON)
4 = Latch OFF (switches the command OFF)
5 – 15 Reserve
Queue: If this bit is set, then the command is repeated following its output
(is not evaluated by the firmware)
Clear: If this bit is set, all commands stored in the queue are cleared
Trip/Close: If the command is a double command, then only the bits for Trip/Close are
evaluated and transferred in the Ax message
(is only used/evaluated for double commands)
Status: 0 No error
1 The OPERATE-command has been received after the timeout for
2 The OPERATE-command was received without a
7 No output possible because local/remote control not set to REMOTE
8 No output possible because too many command outputs active at the
same time
present
10 Control not permitted
11–127 Reserved

Edition 12.2017, DC0-090-2.10
Address conversion DNP3 ® SICAM RTUs
manager). For this the detailed routing type “REC_Command” is available in the protocol
1 single command (TI = 45)
1 double command (TI = 46)
DNP3 address

Only for DNPi00

possible: 0-65535

possible: not used
IEC command conversion:

This parameter defines, how the DNP command procedure is to be
converted on the IEC-command. The IEC command can be forwarded
with SELECT/EXECUTE or only with EXECUTE. A simulation or
emulation of the SELECT command can also take place, if there is no
SELECT available on the remote station.
possible: - evaluate SELECT/EXECUTE
- simulate SELECT
- ignore/do not forward SELECT
QOC: Qualifier of Command, addition of the command output time

possible: - not determined
- short output time
- long output time
Cmd/Point Index: This parameter determines, how the received commands are to be
converted. The received data index or the configured data point can
be used together for switching on and off or only for the respective
switching on or off. Either a double command or a single command is
transmitted per data index.
possible: - data index as ON/CLOSE and OFF/TRIP
- data index only ON/CLOSE
- data index only OFF/TRIP
DNP command option: It can be determines with this, whether only the protected command
transmission using SELECT/EXECUTE, only the unprotected
command transmission using DIRECT OPERATE or both variants
together are permitted.
possible: - no restriction
- only SELECT/OPERATE
- only DIRECT OPERATE
Bay level LOCAL reference:

This parameter is used in combination with the function of the protocol
element control message for the specific enable or disable of
commands. A detailed description of this function is to be taken from
chapter Protocol Element Control.
possible: - Unambiguous reference number between 1 and 65535

DC0-090-2.10, Edition 12.2017
Cmd OFF interlocking reference:
Cmd ON interlocking reference:

With these two parameters a command disable can be configured in
each case for the ON command and the OFF command. This
reference number is to be entered in the protocol element control as
additional parameter. A detailed description of this function is to be
taken from chapter Protocol Element Control.
possible: - Unambiguous reference number between 1 and 65535
Retrigger Cycle: If a variable command output time – based on the command ON time
in DNP3 control relay output block – is needed, this can be realized by
using the retrigger command (regulated command) function on SICAM
RTUs Hardware. The command output will remain activated as long
as retrigger commands or a stopp command will be received by the
hardware. This is only supported for double point commands (TI=46).
possible: - no retrigger command
- retrigger cycle 1 second
- retrigger cydle 2 seconds
- retrigger cycle 5 seconds
Binary information command state:

The IEC address of a single or double-point information can be
configured in order to accept the current state of the command or its
return information. This is used to transmit the current command state
to a controlling station, if this is requested by it, above all if no
command has been received after a restart and consequently, under
certain circumstances, an implausible value would be transmitted.
RM-CASDU1
RM-CASDU2 5-stage freely parameter-settable SICAM RTUs source address
RM-IOA1 possible: 0 – 255
RM-IOA2
RM-IOA3
SICAM RTUs address:
CASDU1
IOA2
IOA3
possible: 45 = single command

46 = double command
Every command message is sent back by the controlled station and the status of the
command output is entered in this message.

Edition 12.2017, DC0-090-2.10
2.13.5.2 Message Conversion Setpoint Values
7 0
LSB
Setpoint value
-2147483648 to +2147483647
MSB
0 status
7 0
Setpoint value LSB
MSB -32768 to +32767
0 status
Object format DNP3 Short Floating Point Analog Output Block:
7 0
LSB
Setpoint value
MSB
0 status

DC0-090-2.10, Edition 12.2017
Status: 0 No error
1 The OPERATE-command has been received after the timeout for
2 The OPERATE-command was received without a
7 No output possible because local/remote control not set to REMOTE
8 No output possible because too many command outputs active at the
same time
present
10–127 Reserved
Address conversion DNP3 ® SICAM RTUs
manager). For this the detailed routing type “REC_Command” is available in the protocol
· Setpoint command normalized (TI = 48)

· Setpoint command scaled (TI = 49)
· Setpoint command short floating point (TI = 50)
DNP3 address
Only for DNPi00

possible: 0-65535

possible: - 16 Bit measured value/setpoint value
- 32 Bit measured value/setpoint value
- Short floating point measured value/setpoint value
IEC command conversion:

The IEC-command conversion for setpoint values is integrated fixed in
the firmware and does not need to be parameterized. For setpoint
values only EXECUTE is supported or generated. If the remote station
sends setpoint values with SELECT, then the timeout between
SELECT and EXECUTE is nevertheless monitored. In this case
despite this only the EXECUTE message is transferred.

Edition 12.2017, DC0-090-2.10
Every setpoint value message is sent back by the controlled station and the status of the
setpoint value command output is entered in this message.

DC0-090-2.10, Edition 12.2017
2.14 Special Functions
For the interfacing to third-party systems, if necessary the following special functions can be
activated for the adaptation of the message conversion:
2.14.1 Sags and Swells for DNP3 Master and Slave
This concerns a sequence of 4 measured values with the same address. These values are
only transmitted as event with real time and represent a special treatment of a measured
value. In order to differentiate this special measured value processing from the normal
measured value treatment of the measured value, bit 7 of the status information is used. All 4
measured values have this bit set and can thus be unambiguously assigned. For the
transmission of these events the associated measured values are sorted directly one after the
other and transmitted. Possible measured value events – no Sags and Swells events – for
which the time tag is within a Sag and Swell sequence are sorted at the end of this sequence.
So that this function can be used the following global AU-parameters are to be adapted on
MCPU.
The state compression of following type identification must be disabled for Sags and Swells
measured vales using following parameters on MCPU:
· AU common settings | Settings for type identification | TI 34 Measured

value, normalized value | State compression = NO
value, scaled value | State compression = NO
value, short floating pt. number | State compression = NO
Message Conversion Master:

For the already existing measured value a second data point must be created with the same
DNP address but a different IEC address and Object Group = analog input (sags and swells).

manager). For this the detailed routing type “REC_Analog_Input” is available in the protocol

Edition 12.2017, DC0-090-2.10
SICAM RTUs address:
CASDU1
IOA2
IOA3


possible: 0-65535

possible: - analog input (sags and swells)
none
Adaptation X0: This is the minimum value of the DNP analog value.
Adaptation X100: This is the maximum value of the DNP analog value
Adaptation Y0: This is the minimum value of the SICAM RTUs measured value.
Adaptation Y100: This is the maximum value of the SICAM RTUs measured value.

Here the change monitoring is deactivated, every value is transferred.
Measured value threshold additive:

Here the change monitoring is deactivated, every value is transferred.

DC0-090-2.10, Edition 12.2017
Message Conversion Slave:
For the already existing measured value a second data point must be created with the same
DNP address but a different IEC address and Object Variant = 32 bit measured value (sags
and swells), 16 bit measured value (sags and swells) or floating point (sags and swells).

manager). For this the detailed routing type “TRA_Analog_Input” is available in the protocol
SICAM RTUs address:
CASDU1
IOA2
IOA3


possible: 0-65535

possible: - Measured value 16 bit (sags and swells)
- Measured value 32 bit (sags and swells)
- Measured value short floating point (sags and swells)

- Class 2 data
- Class 3 data
- Not used/no class

Edition 12.2017, DC0-090-2.10
The measured value threshold is not evaluated, the data are always
transferred.
2.14.2 Storing User Data on the BSE (DNP3 Slave)
If the existing buffer is insufficient for the event data and more events are to be stored, then
the data can be stored on the BSE. By means of parameter setting this can be activated
separately for binary information or measured values advanced parameters | project
relevant DNP settings | Keep/holding back event data on BSE - binary
indication or advanced parameters | project relevant DNP settings |
Keep/holding back event data on BSE - measured values.
Shortly before the maximum filling level of 94 percent of the internal event buffer is reached,
the corresponding priority level of the single/double-point information or the measured values
on the BSE is disabled. With that all other data of this priority level are stored on the BSE until
this priority level is enabled again or the user data dwell time has expired. The priority level is
only enabled again when the internal event buffers have been transmitted and consequently
are less than 30 percent full.
In addition to the parameter settings of the DNP3 Slave firmware other parameter settings are
to be adapted on the global AU parameters as well as the BSE parameters.
If measured values are also to be buffered on the BSE, then the state compression is to be
switched off for the corresponding type identifications. With state compression activated,
every time only the current value of the measured value is stored or overwritten.
The state compression of following type identification must be disabled for Sags and Swells
measured vales using following parameters on MCPU:

value, normalized value | State compression = NO
value, scaled value | State compression = NO
value, short floating pt. number | State compression = NO
When data is buffered on the BSE in the corresponding rings, then these data are buffered
until the corresponding priority level has been enabled again or the time until the automatic
deleting of the process information has expired.
The behavior can be controlled individually for every interface of a BSE with the parameter
Communication | PRE# | Advanced settings | Failure behavior for process
inform.
The protocol element DNPSx0 requires following settings for priority levels for binary
information and measured values:
· binary information: Communication | PRE# | Advanced settings | Priority

binary information = "High priority" = class 1 data (spontaneous priority 1)"

DC0-090-2.10, Edition 12.2017
· measured values: Communication | PRE# | Advanced settings | Priority

measured values = "Low priority" = class 2 data (spontaneous priority 7)".
Note
Integrated totals (counters) must not be assigned to any of the two previously mentioned priority levels, as
these are then also disabled (Communication | PRE# | Advanced settings | Priority
counters).
When using the selective data flow the corresponding data class is to be set for binary values = class 1
and measured values = class 2.
If the priority level is disabled and the data are buffered on the BSE, then the firmware monitors the
reception of data of the disabled priority level. If data are nevertheless sent from the BSE, then the
firmware generates a transient information for the error diagnosis and in parallel to that an entry in the
internal diagnostic ring, which can be read out with the ST-Emulation (command: IDR). The IEC address
(CASDU, IOA and TK) is displayed.
2.14.3 Enable SCBO (Check Back Before Operate)
This is used for the transmission of the commands and thereby uses one of the methods
deviating from the DNP3 standard for the procedure of SELECT and OPERATE. According to
the DNP3 standard, an already running SELECT ON command for the index 0 is interrupted
by a new SELECT ON command for the index 1 and the new SELECT ON command for the
index 1 is now used instead. The command is therefore only executed if the following
OPERATE ON command for the index 1 is received.
Now if this parameter advanced parameters| project relevant DNP settings |

Enable SCBO (check back before operate)is set to YES, then another method is used
by the firmware.
Variant a (parameter is NO according to the DNP3 standard):

1. Reception of SELECT ON Command Index 0 à Response: Command Status 0 = no error
2. Reception of SELECT OFF Command Index 1 à Response: Command Status 0 = no error
3. Reception of EXECUTE ON Command Index 0 à Response: Command Status 2 = no SELECT
Variant a (Parameter is YES):

2. Reception of SELECT OFF Command Index 1 à Response: Command Status 4 = not supported
3. Reception of EXECUTE ON Command Index 0 à Response: Command Status 0 = no error
Variant b (parameter is NO according to the DNP3 standard):

2. Reception of SELECT OFF Command Index 1 à Response: Command Status 0 = no error
3. Reception of EXECUTE OFF Command Index 1 à Response: Command Status 0 = no error
Variant b (Parameter is YES):

2. Reception of SELECT OFF Command Index 1 à Response: Command Status 4 = not supported
3. Reception of EXECUTE OFF Command Index 1 à Response: Command Status 2 = no SELECT

Edition 12.2017, DC0-090-2.10
2.14.4 Redundancy Function: Hot Standby
This function concerns a special form of redundancy. Thereby 2 interfaces in the same AU are
used for this mode. One interface contains all process data and is parameterized as active
interface. The other interface is set as passive interface. Only messages of the link layer are
processed over the passive interface, e.g. acknowledgements to the controlling station.
Normally user data calls are sent to the active interface and replied by this. The passive
interface only receives and replies messages of the link layer. If the controlling station
determines a problem on the active communication, then from then on it sends the user data
calls to the passive interface. The passive interface detects these user data calls and forwards
these to the active interface as internal container message over the node bus. The active
interface processes this container message as if it had been received from the controlling
station over the serial communication and sends the reply message to the passive interface,
also as internal container message over the node bus, so that it can be sent from there to the
controlling station.
This type of redundancy covers only failures of the transmission facility, but not module
failures of the SIP.
The following parameter settings are necessary for the active interface.
- advanced parameters | project relevant DNP settings | Redundancy used as
hot standby
- advanced parameters | project relevant DNP settings | Target BSE for hot
standby container
- advanced parameters | project relevant DNP settings | Target SSE for hot
standby container
Note
This function is only supported by DNPSx0.
Since the active database alone is responsible for the generation of the user data messages, the
sequence numbers of transport header and application header must synchronous over both interfaces.
This must also be supported by the connected controlling stations.
If the Hot Standby mode is activated, then the SICAM RTUs redundancy must not be used.

DC0-090-2.10, Edition 12.2017
2.14.5 State Compression for Measured Value Events
With the parameter advanced parameters | project relevant DNP settings | Data
compression for analog change events measured value events can be state-
compressed. Then only the last event received is transmitted for the next event interrogation.
Without state compression all events of the measured values are transmitted.
2.14.6 Link Address Substitution (DNPi00, DNPiA1 and DNPiT1 only)
Like already mentioned every connection needs a different DNP destination and DNP source
link address, because the DNP destination link address is used to address the data of the
process technical parameters (telegram conversion).
In a case where the link addresses of several connected DNP3 master stations is defined as
the same DNP destination and/or DNP source link address for every connection and cannot
be changed, it is possible to substitute these link addresses for a maximum of 4 connections.
Nevertheless the link addresses parameterized in the connection table are still used for
internal addressing.
To substitute DNP destination and/or DNP source link address, this have to be activated in
2 stages.
1. Connection table
2. Project relevant settings

Edition 12.2017, DC0-090-2.10
2.15 Wildcard TCP/IP Address (DNPiT1)
With the help of a wildcard TCP/IP address 0.0.0.0 it is possible to establish a connection from
any TCP/IP address (master/client) to the slave (server). There can only be one client having
an active connection to the slave at the time. Any connection attempt by a different client
during a connection is already established, will be refused by the server.
Once the wildcard address is used in the connection definition table, no other connection can
be used. There can only be one connection with the wildcards address 0.0.0.0. If there is
more than one connection and one of them has a wildcard address, the system will produce
an error message and ignore the settings.
The advantage of using a wildcard address is that only one connection in the connection
definition table is needed and therefore the process technical parameters only have to be set
up once for this single connection.
Note
Using the wildcard TCP/IP address may cause security issues, because any TVP/IP address of the same
subnet will be accepted.

DC0-090-2.10, Edition 12.2017
2.16 Protocol Element Control and Return Information
This function is used for the user-specific influencing of the general functions of the protocol
elements.
This function contains two separate independent parts:
· Protocol element control

· Protocol element return information
The Protocol Element Control enables:
· applicative control of the station interrogation

· set control location
· the reachability of stations to be tested
· the suppression of errors with intentionally switched-off stations (Station Service)
The Protocol Element Return Information enables:
· states of certain status lines to be used as process information

· information about the station status/failure to be obtained
Block Diagram
Internal distribution for messages with process information
Protocol element
control
Internal
Transmission route
function
Protocol element
return information Protocol element
Messages with process information

Messages with system information

Edition 12.2017, DC0-090-2.10
2.16.1 Protocol Element Control Slave
For the controlled station the following firmware-specific protocol functions are used.
2.16.1.1 Control Internal Indication Bit LOCAL
With this function the IIN bit LOCAL can be switched on or off for the respective controlled
station (station number). If this IIN Bit is set all commands to this controlled station are
discarded with the command status 7 = LOCAL.
Control function 0 = switch off

Control function 1 = switch on

DC0-090-2.10, Edition 12.2017
2.16.1.2 Control Selective Command Disable
With this function the command output can be disabled or enabled for individual commands.
The configurable additional parameter thereby determines the reference number, which is
used in the process technical parameter setting. If the function is activated, all commands with
this reference number are discarded with the command status 7 = LOCAL.
Control function 4 = switch off command disable

Control function 5 = switch on command disable

Edition 12.2017, DC0-090-2.10
2.16.1.3 Control Command Disable for OFF and ON Command
With this function the command output can be disabled or enabled for the respective
command used, selectively for the OFF or the ON command. The configurable additional
parameter thereby determines the reference number, which is used in the process technical
parameter setting. If the function is activated, all OFF or ON commands with this reference
number are discarded with the command status 10 = Control not permitted.
Control function 2 = switch off command disable

Control function 3 = switch on command disable

DC0-090-2.10, Edition 12.2017

Edition 12.2017, DC0-090-2.10
2.16.1.4 Deactivate/Activate Events
This function can be used to deactivate or activate the building of events.
If events are deactivated, all changed data will not cause any transmission. Neither unsolicited
response will be sent, nor request for change event object groups or request for data class 1,
2 or 3 will be responded with any data in this case. Nevertheless all new incoming data will be
stored in the internal process image and in case of request data class 0 its actual state will be
transmitted to the master.
Every time after start up the events are enabled. To disable the events the protocol element
control function 6 is used, protocol element control function 7 is used to activate the events
again.

DC0-090-2.10, Edition 12.2017
2.16.2 Protocol Element Control Master
2.16.2.1 Send „Reset Link“
This function can be used to send the link layer message “reset link” (link layer primary
function code 0) whenever it is necessary.
Note
Like it is shown in the above picture, a single binary input (TI=30) is used. Please notice that in this case a
falling (negative) edge of this single binary intput needs to be generated before this function can be
activated again with a rising (positive) edge. It could be better to use a single binary command (TI=45)
instead.

Edition 12.2017, DC0-090-2.10
2.16.3 Protocol Element Return Information
The protocol element return information on the basic system element generates messages with
process information in monitoring direction and with that enables states of the protocol element
to be displayed or processed.
There are three different categories of return information:
· Status of the status line

· Status of the stations
· Protocol-specific return information (dependent on the protocol element used)
The assignment of the messages with process information to the return information takes place
on the basic system element with the help of process technical parameters of the ACP 1703
system data protocol element return information.
From which source the parameterized return information are to be generated, is set with the
parameters "Supplementary system element" and "Station number".
Messages for protocol element return information are transmitted from the protocol element to
the basic system element spontaneously with change or as reply to a general interrogation
command.
Possible return information controlling station:
Parameter
Return information Station Remark
function_(PRE)
Status DTR 255 1 = status line active *)
Status DSR 255 1 = status line active *)
Station status 0–99 1 = Station enabled for call cycle
Station failure 0–99 1 = Station failed
*) Statuses of status lines are transmitted from the protocol element to the basic system element
spontaneously with change or as reply to a general interrogation command.
The spontaneous transmission of the current states takes place internally in a 100 ms grid.
ð Status line changes shorter than 100 ms are not guaranteed to be transmitted!
Legend:
Station Station number
0–99 Station of the selected protocol element
255 Station number not used!

DC0-090-2.10, Edition 12.2017
2.17 Web Server
A web server is integrated into the protocol firmware for internal diagnostic information. The
web server is part of basic system element firmware – the PRE specific web pages will be
provided by protocol element firmware.
System Firmware DNP3 PRE specific Web Pages

SICAM AK 3 DNPMA0 DNP3 Master “serial“
SICAM AK
SICAM ACP DNPSA0 DNP3 Slave “serial“
SICAM BC
SICAM TM
DNPiA1 DNP3 TCP/IP Slave
AK1703
AMC1703
DNPMT0 DNP3 Master “serial“ ü
SICAM A8000 Series
SICAM A8000 CP-8000 DNPST0 DNP3 Slave “serial“ ü
SICAM A8000 CP-8021 DNPiT2 DNP3 TCP/IP Master ü
SICAM A8000 CP-8022
DNPiT1 DNP3 TCP/IP Slave ü
The PRE specific web pages can be read out with a common Web Browser, as for instance
Microsoft Internet Explorer ®.
For the access to the web server the communications protocol "HTTP (Hyper Text Transfer
Protocol)" is used with the port number 80 or communications protocol "HTTPS (Hyper Text
Transfer Protocol over SSL/TLS)" is used with the port number 443.
The integrated web server is addressed by means of direct specification of the IP address of
the Ethernet interface of the automation unit.
With SICAM A8000 series (CP-8000, CP-8021, CP-8022), the integrated web server for the
protocol elements PRE0,1, 2, 3 can be reached as follows (example):
https://10.9.19.32/pre1 (pre…0,1, 2, 3)
http://10.9.19.32/pre1 (pre…0,1, 2, 3)
Note
By default the integrated web server is deactivated for security reasons. If needed, it can be
enabled for access by the user with the parameter HTTP web server | HTTP web server.

Edition 12.2017, DC0-090-2.10
Supported PRE specific WEB pages:
· Overview
- Connections
- Routing Transmit
- Routing Receive
· Developer Information
- Freespace
- Dataflow Test
Note
The values displayed on the web pages indicate the current status when the web page is started. The
values of a web page are not updated automatically!
An updating of the web page displayed in the web browser can be performed e.g. by means of the web
browser function “Refresh”.
The web pages will be displayed only in English language!

DC0-090-2.10, Edition 12.2017
2.17.1 Overview
With web page Overview general information of the firmware will be displayed.
Field Note
Firmware Name of firmware
Revision Revision of firmware
Hardware Hardware number (system internal)
Firmware number Firmware number (system internal)
Date and time actual date + time of firmware
Region number Region number (system internal)
Component number Component number (system internal)
BSE Basic system element number (system internal)
ZBG Supplementary system element number “SSE” (internal)
IP address Own IP address of the assigned interface
Default gateway Default gateway of the assigned interface
Subnet mask Subnet mask of the assigned interface
MAC address MAC address of the assigned interface
Redundancy Actual redundancy state of the firmware
Example: DNPiT2

Edition 12.2017, DC0-090-2.10
2.17.2 Connections
With web page Connections detailed information for selective connection will be displayed.
Field Note
Station number 0..99 (SICAM A8000 internal stations number of connection)
IP:Port IP address and port number of connection
Connection TCP OK = TCP connection established
NOK = TCP connection not established
Connection DNP3 link layer OK = DNP3 link layer connection established
NOK = DNP3 link layer connection not established
DNP3 master station (source) DNP3 source address
DNP3 slave station (destination) DNP3 destination address
Name Name of remote station
(station name from parameters for connection definition)
Example: DNPiT2

DC0-090-2.10, Edition 12.2017
2.17.3 Routing Transmit
With web page Routing Transmit detailed information for each selective DNP3 data point in
transmit direction will be displayed.
Field Note
Error Error number
TI IEC60870-5-101/-104 type identification (SICAM A8000 internal) of
specific data point
CASDI1, CASDU2 SICAM A8000 internal IEC60870-5-101/-104 address of
IOA1, IOA2, IOA3 specific data point
DNP3 address DNP3 address of specific data point
DNP3 data index
Object group DNP3 data point type of specific data point
last time sent Date + time of last transmission of specific data point
last COT sent Last transmitted cause of transmission of specific data point
Last dp qual sent Last transmitted DNP3 quality state of specific data point
Last value sent Last transmitted value of specific data point
Example: DNPiT2

Edition 12.2017, DC0-090-2.10
2.17.4 Routing Receive
With web page Routing Receive detailed information for each selective DNP3 data point in
receive direction will be displayed.
Field Note
Error Error number
TI IEC60870-5-101/-104 type identification (SICAM A8000 internal) of
specific data point
DNP3 address DNP3 address of specific data point
DNP3 data index
Object type DNP3 data point type of specific data point
last time rec Date + time of specific data point last received
last COT rec Last received cause of transmission of specific data point
Last dp qual rec Last received DNP3 quality state of specific data point
Last value rec Last received value of specific data point
Example: DNPiT2

DC0-090-2.10, Edition 12.2017
2.17.5 Developer Information - Freespace
With web page Developer Information - Freespace internal information of “Freespace DNP3-
Stack“ of the firmware will be displayed.
Note: This information is helpful for developer in case of problems.
Field Note
Count malloc internal information
Count free internal information
Heap complete (Bytes) internal information
Heap internal (Bytes) internal information
Heap DNP3 protocol stack (Bytes) internal information
Example: DNPiT2

Edition 12.2017, DC0-090-2.10
2.17.6 Developer Information – Dataflow Test
With web page “Developer Information – Dataflow Test” messages transmitted via internal
interface from PRE <-> BSE will be displayed.
The last 200 messages transmitted from PRE <-> BSE will be displayed.
Field Note
Nr. Message number
Dir Direction
PREàBSE: data received via DNP3
BSE àPRE: date to be transmitted via DNP3
TK IEC60870-5-101/-104 type identification (SICAM A8000 internal)
Station SICAM A8000 internal station number of connection
COT SICAM A8000 internal IEC60870-5-101/-104 cause of transmission
origin SICAM A8000 internal IEC60870-5-101/-104 originator
data SICAM A8000 internal IEC60870-5-101/-104 state of data point
quality SICAM A8000 internal IEC60870-5-101/-104 quality of data point
Time Date + time of message transmitted via internal interface
from PRE <-> BSE
Example: DNPiT2

DC0-090-2.10, Edition 12.2017

Edition 12.2017, DC0-090-2.10
3 Application Notes
Contents
3.1 General ........................................................................................................ 158

3.2 Central Function ........................................................................................... 160
3.3 Controlled Station Function........................................................................... 162

DC0-090-2.10, Edition 12.2017
Application Notes
3.1 General
3.1.1 What are Static Data and what are Event Data?
All data that are stored static in the process image are called "static data”. Therefore always
only the current state at the moment of the interrogation is transmitted. Through this a change
of a single-point information from the state OFF to the state ON and back again within
2 interrogations can not be acquired.
However, if also the changes are to be transmitted, then the “event data” are used for that.
Here every change of the signal state is acquired and stored until the next event interrogation
or sent as spontaneous data (unsolicited response).
A single-point information can thus be interrogated as static data (object type = 1, object
variation = 2 à binary input with status) with the respective state at the moment of the
interrogation or also as event data (object type = 2, object variation = 2 à binary input change
event with time), whereby every change is stored and then transmitted on request. To simplify
the interrogation of events, it is possible to assign the event data to an event class. Then an
interrogation to the individual object types no longer needs to be generated, rather the
respective event class is simply interrogated cyclically.
3.1.2 What are Class 0, 1, 2 or 3 Data?
In the controlled station all existing data are assigned to the data class 0 (object type = class
data, object variation = 1). An interrogation of class 0 data is therefore used to transmit the
current state of the entire process image of this station. This is used for the GI, but can also
be used as cyclic query to interrogate those data from the controlled station that are not
available as spontaneous event (comparable with a cyclic background scan with protocol IEC
870-5-101).
Class 1, 2 or 3 data concern exclusively only spontaneous changes. So that these changes
can be transmitted at all as class 1, 2 or 3 data they must be assigned to one of the 3 classes.
Class 1 data thereby have the highest priority and class 3 data the lowest priority. Once the
changes have been assigned to a class, the changes of these data are stored in the controlled
station until the corresponding interrogation of class x data has been received. Now if these
interrogations are transmitted cyclically, then with that it is relatively simple to obtain as quickly
and efficiently as possible only the respective change that has occurred between 2
interrogations of the respective class.
While all existing data points are automatically assigned to the data class 0, as soon as they
are to be transmitted as changes the data points must be actively assigned to an event class
(class 1, 2 or 3 data). With the firmware DNPSx0 and DNPi00 this can be set separately for
every data point via the process technique.

Edition 12.2017, DC0-090-2.10
Application Notes
3.1.3 Object Group and Object Variation
As static or event data the various user data such as binary information, measured values or
counts are differentiated from each other by the object group. Within each object group there
are different object variations. This in turn makes it possible to specify the user data more
precisely, e.g. as measured value with 16 bit, 32 bit or as short floating point. Which object
groups and object variants are supported by a DNP device can be found in the DNP Device
Profile Document (SICAM RTUs DNP3 Interoperability – DC0-046-2).
For the simplification of the data query, for most object groups there exists the object variant 0
= all variants. With that the data to be queried do not need to be defined in more detail in a
data query from the controlling station, rather the controlled station decides which object
variant is sent. For the protocols described here, this is configured with the parameter block
Advanced parameters | Settings default data object types.
3.1.4 Use of the Data Index
Within the object groups (DNP object type) every data point is addressed with the data index,
regardless which object variant (DNP object variation) is used. The data point always remains
the very same, regardless which object variant is used for the respective object group.
The data index can be freely assigned, but as far as possible should always begin at 0 and
also not feature any large gaps. Because with a general interrogation (class 0 data) the data
range of the respective data types to be transmitted always begins with the index 0 and ends
with the largest configured data index for the respective object type. Data that are not present
are transmitted with 0 and status “Offline”. E.g. if the smallest data index used for binary
information (single binary information) begins with 1000, then with an interrogation of this
object type 1000 data objects (data index 0 to 999) will be transmitted without information until
the actual user data begin. This causes unnecessary delays and loads of the transmission
and processing equipment.
3.1.5 Unsolicited Response
As already described a controlled station can also send spontaneous data to a controlling
station, without prior call by the controlling station. This is used e.g. when the transmission
media are to be loaded as little as possible. However, the danger also thereby occurs, that 2
controlled stations send data to a controlling station simultaneously and collisions occur as a
result, especially with serial transmission media. All protocols described here, insofar as they
utilize serial transmission media, are unable to avoid collisions. Therefore if multiple DNPSx0
protocols are used, then the parameter for the retry delay time advanced parameters |
DNP time settings | Timeout unsolicited message retry should be different for all
stations.

DC0-090-2.10, Edition 12.2017
Application Notes
3.2 Central Function
3.2.1 Cyclic Data Query
Up to 64 cyclic queries can be entered in this table.
A query can be sent either to an individual remote station (link address 0 – 65520), to all
connected remote stations separately (link address = 65530) or as broadcast to all remote
stations together (link address = 65535).
The following table contains several examples for cyclic queries. With the first 4 queries (No. 0
to 3) it is already possible to query all static data and all event data in one cyclic time scale.
The following query (No. 4) defines a query of all object variants for the object group of the
static measured values (static analog input) to the controlled station with the DNP destination
address 1. However only the data with the data index 30 to 39 are to be requested thereby.
The last query (No. 5) defines the freezing of all existing static counts of the default object
variant for the object group of static counts (static binary counter) to the controlled station with
the DNP destination address 4.

Edition 12.2017, DC0-090-2.10
Application Notes
3.2.2 Conversion 2 Single Binary Inputs to 1 Double-Point Information
For the case that the controlled station does not support any double binary input data and
instead transmits the double-point information as 2 single-point information items, then it is
possible to convert these 2 single-point information items back to 1 double-point information.
Parameter record for the OFF binary information:
Parameter record for the ON binary information:

DC0-090-2.10, Edition 12.2017
Application Notes
3.3 Controlled Station Function
3.3.1 Conversion 1 Double-Point Information to 2 Single Binary Inputs
For the case that a controlling station does not support any double binary input data, then in
each case the double-point information can be converted to single-point information (single
binary input).
Parameter record for the OFF binary information:
Parameter record for the ON binary information:

Edition 12.2017, DC0-090-2.10
Literature
SICAM RTUs Common Functions System- and Basic System Elements DC0-015-2
SICAM RTUs Platforms – Configuration - Automation Units and Automation DC0-021-2
Networks
Documents on Interoperability
SICAM RTUs DNP3 Interoperability DC0-046-2
International standards
DNP3 Specification www.dnp.org/

Volume 1: DNP3 Introduction
Volume 2: Application Layer
Part 1: Basics
Part 2: Annex
Part 3: State Tables and Diagrams
Supplement 1: Secure Authentication
Volume 3: Transport Function
Volume 4: Data Link Layer
Volume 5: Layer Independent Topics
Volume 6: Basics DNP3 Object Library

Volume 7: IP Networking
Volume 8: Interoperability

DC0-090-2.10, Edition 12.2017
Literature

Edition 12.2017, DC0-090-2.10

Sicam Rtus SICAM A8000 Series: Protocol Element

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sicam Rtus SICAM A8000 Series: Protocol Element

Uploaded by

Copyright:

Available Formats

___________________________________________________________________________

Preface, Table of Contents

SICAM RTUs Application Notes 3

Common Functions DNP3

Disclaimer of Liability Copyright

Subject to change without prior notice.

Siemens AG Order number: DC0-090-2.10

This document is applicable to the following product(s):

Purpose of this manual

· Conceptual activities, as for example design and configuration

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 3

4 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

1.1 Application ..................................................................................................... 10

2 Protocol Description ................................................................................................... 15

2.1 Overview ........................................................................................................ 16

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 5

2.10 DNP3 Protocol Description ............................................................................. 49

6 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

2.14.4 Redundancy Function: Hot Standby ......................................................... 137

3 Application Notes...................................................................................................... 157

3.1 General ........................................................................................................ 158

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 7

8 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

1.1 Application ..................................................................................................... 10

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 9

1.1.1 Which Protocols are available in which Systems

SICAM BC (local SS)

AMC 1703 (local SS)

DNP3 Master (serial) £ n n

10 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

System System Element Protocol Element Note

AK 1703 CP-2000/CPC00 SM-2551/DNPMA0 max. 20 Slaves

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 11

System System Element Protocol Element Note

CP-2019/PCCX26 SM-2558/DNPiA1 Max. 100 remote stations

CP-2017/PCCX25 SM-2558/DNPiA1 Max. 100 remote stations

AK 1703 CP-2000/CPC00 SM-2551/DNPSA0 1 Master as remote station

Third-party system -- -- According to SICAM RTUs

12 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

Note when using DNPi00/DNPiT1/DNPiA1

The following examples are possible:

· 1 controlling station with 18 controlled stations

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 13

1.3 Features and Functions

14 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

2.1 Overview ........................................................................................................ 16

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 15

16 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

Schematic configuration DNP3 "serial":

DNP3 Master Station

DNP3 - protocol (max. 100 stations) – recommended „max. 20 stations“

Schematic configuration DNP3 over Ethernet (TCP/IP):

DNP3 Zentralstation Master #1 DNP3 Zentralstation Master #2

Ethernet “DNP3 over TCP/IP“

Ethernet “DNP3 over TCP/IP“ Ethernet “DNP3 over TCP/IP“

Switch Switch Switch

Serial <-> Ethernet

LAN-Interface LAN-Interface LAN-Interface

**) max. 100 connections per LAN-Interface

SICAM RTUs • SICAM A8000 Series, Common Functions DNP3 17

18 SICAM RTUs • SICAM A8000 Series, Common Functions DNP3

2.2 Technical Specifications

Slave Addresses · 0 - 65519, 65535 = BROADCAST