IEC 870-5-104 Scan Task User's Guide
IEC 870-5-104 Scan Task User's Guide
Windows SCADA
IEC 870-5-104 Scan Task
User’s Guide
____________________________________________
January 5, 2011
This manual describes the functionality and data entry requirements for
the IEC 870-5-104 scan task used in the Windows SCADA system.
The content of this manual has been carefully checked for accuracy. However, if you find
any errors, please notify Survalent Technology Corporation.
Revisions
Date Description
April 4, 2005 Initial version.
July 27, 2005 Added a special control address to send “Reset Application” command.
February 15, 2007 Allow code 0 (“use default value”) in control interval.
July 7, 2008 Checked the “Unstructured” box for Information Object Address in the
protocol profile.
September 29, 2009 Updated the device profile to show that “Counter request” and “General
request counter” are supported.
1 Introduction 1-1
4 RTU 4-1
4.1 RTU Data Fields—General ........................................................................................................ 4-1
4.1.1 RTU Address.......................................................................................................................... 4-2
4.1.2 Network ................................................................................................................................. 4-2
4.1.3 Scout ...................................................................................................................................... 4-2
4.1.4 Status Point ............................................................................................................................ 4-2
4.1.5 Fast Scan Point ....................................................................................................................... 4-2
4.1.6 Switches ................................................................................................................................. 4-2
4.2 RTU Data Fields—Connections ................................................................................................. 4-3
4.2.1 Host Name ............................................................................................................................. 4-3
4.2.2 Host Port ................................................................................................................................ 4-4
4.2.3 Dial-up ................................................................................................................................... 4-4
4.3 RTU Data Fields—Switches ...................................................................................................... 4-4
4.3.1 Port Switch Point .................................................................................................................... 4-4
4.3.2 Switch Port after ..................................................................................................................... 4-5
4.3.3 Channel Switch Point, Switch Channel after ........................................................................... 4-5
4.4 RTU Data Fields—Statistics ...................................................................................................... 4-5
4.4.1 Percentage Communication Point ........................................................................................... 4-6
4.4.2 Total Message Count .............................................................................................................. 4-7
4.4.3 Good Message Count.............................................................................................................. 4-7
4.4.4 Bad Message Count ................................................................................................................ 4-7
4.4.5 Timeout Count ....................................................................................................................... 4-7
4.4.6 Send Message Count .............................................................................................................. 4-7
4.4.7 Dial-up Override Interval ........................................................................................................ 4-7
4.4.8 Dial-up Status......................................................................................................................... 4-7
4.4.9 Time of Last Good Poll .......................................................................................................... 4-8
4.5 RTU Data Fields—Scout............................................................................................................ 4-8
This document describes the operation and database requirements of the IEC 870-5-104 scan task in the
Windows SCADA system.
Communication lines
RTUs
Status and controls
Analog points
You can monitor communications between this scan task and your RTUs, using the ScanMon utility. This is
described in chapter 7.
The scan task described in this document conforms to the specifications described in the IEC 870-5
documents listed in Table 1-1. Chapter 8 contains a conformance profile for the IEC 870-5-104 scan task.
This document assumes you have some familiarity with the protocol involved. Terms specific to the IEC
870-5-104 protocol are used throughout, without defining them. If you need clarification, you may want to
read:
Your RTU vendor’s protocol documentation
2.1 Introduction
The IEC 870-5-104 scan task consists of two layers within a single process:
Transportation layer
This is the lower layer that provides the transport functions of TCP/IP to the application layer.
Application layer
This is the upper layer that schedules polling, parses responses from the RTUs, and interfaces to the
rest of the SCADA system.
IEC 870-5-104 Scan Task User’s Guide Operation of Scan Task 2-1
Windows SCADA
2.2 Initialization
At startup, and on detection of RTU restart, the scan task performs the following initialization functions:
Establish connection
Start Data Transfer (STARTDT command)
Download time
Download analog exception deadbands
All-data poll
The scan task downloads the time using the “clock synchronization” command.
The scan task downloads analog exception deadbands using “parameter of measured value” commands.
In these commands, the “kind of parameter” field is set to “threshold”. The IEC 870-5-104 scan task does
not support smoothing factors or high/low limits.
In the master station, each analog point is assigned a deadband code, via the Exception Window field on
the SCADA Explorer. See section 6.5, Exception Window, for more details.
An analog exception deadband value is also downloaded to an analog point whenever you perform an
Activate function on the point. To change a point's deadband, change the Exception Window field for the
point using the SCADA Explorer, and then force the corresponding deadband value to be downloaded by
performing an Activate operation from a map or tabular display.
If the deadband values are modified, the easiest way to force a reload of all the deadbands is to reboot or
failover the system, or to rebuild the appropriate scan tables (via the SCADA Explorer).
As described in section 6.1, Telemetry Address, it is possible to specify that a point not have a deadband
downloaded to the RTU. In this case, the RTU is expected to use a default deadband value for the point.
While this is useful in reducing the communication bandwidth expended in downloading deadbands at
RTU initialization, the trade-off is that you cannot temporarily adjust the deadband by the mechanism
described above.
An all-data (integrity) poll of one RTU is performed using the General Interrogation command.
IEC 870-5-104 Scan Task User’s Guide Operation of Scan Task 2-2
Windows SCADA
2.3 Normal Polling
There is no application-level poll for exceptions. The transport layer of the scan task continuously sends,
in round-robin order, to all of the RTUs that are defined on its communication line, the numbered
supervisory request (S Format). If an RTU has exceptions that it wishes to report, it will report them.
In addition, on request from the operators and application programs, the scan task issues control and set
point commands.
to one RTU, in round-robin order, at every all-data poll interval. See section 3.1.4, Polling
Parameters.
on request by the operator (via an Activate command directed to the RTU point).
The present implementation of the IEC 870-5-104 scan task does not support group interrogations.
When you trigger an integrity poll by Activating an RTU point, the scan task sets the condition code of all
of the analog and status points on the RTU to telemetry failed (indicated by the letter “F” displayed beside
each point). Then, as the requested values are returned by the RTU, the telemetry failed indicators clear.
2.5 Accumulators
At an interval specified by the Accumulator field of the Polling Parameters section of the communication
line definition, the scan task broadcasts a “freeze without reset” command to all RTUs.
If the freeze broadcast is accepted and confirmed, it is followed by a sequence of round-robin supervisory
polls for accumulators. An accumulator poll consists of a request for integrated totals.
For each accumulator value returned, the scan task computes and scales the delta, and either stores the
scaled delta into the assigned database point or adds it to the assigned database point, depending on the
point’s input format code. If the RTU returns integrated totals with time tags, the time information is
discarded.
IEC 870-5-104 Scan Task User’s Guide Operation of Scan Task 2-3
Windows SCADA
If an accumulator poll fails, the scan task updates the accumulator points on that RTU using a delta value
of zero.
The interval at which time syncs are broadcast is specified by the Time Sync Interval field of the Polling
Parameters section of the communication line definition. See section 3.1.4, Polling Parameters.
2.7 Control
On a control operation, the scan task first places the RTU on fast scan, which means that after every Nth
poll, the scan task will re-poll the RTU on fast scan. This is so that any status changes as a result of the
control about to be performed can be reported as quickly as possible. The parameter N, called the
interleave factor, can be set via the channel section of the communication line editor. See section 3.2,
Communication Line Data Fields—Channel.
Next, the appropriate sequence of control messages is transmitted to the RTU. In a select-before-
operate control, the scan task first issues a select request. On reception of the select checkback, the
scan task then issues the execute command and expects an execute checkback from the RTU.
If the scan task does not receive a select or execute checkback within a response timeout, it declares a
checkback timeout.
After the control is complete (meaning that the expected status change either was received or has timed
out), the scan task takes the RTU off fast scan.
IEC 870-5-104 Scan Task User’s Guide Operation of Scan Task 2-4
Windows SCADA
Not Topical Point value is updated.
Condition code is set to telemetry failed “F”.
Invalid Point value is NOT updated.
Condition code is set to telemetry failed “F”.
On a poll error, such as a timeout or a message security error, the scan task places the RTU on “error
scan”. This means that it re-polls the RTU that had the communication error after every Nth normal poll,
where “N” is a user-settable interleave factor that is usually set to one or two (see section 3.2,
Communication Line Data Fields—Channel). The RTU is maintained on error scan until a good response
is received or until the retry count expires, whereupon the RTU is declared failed.
Failed RTUs continue to be polled, but less frequently. On each round-robin poll sequence, only one failed
RTU is polled.
This feature may be used to make use of redundant terminal servers and/or redundant communication
lines, or to implement a fault-tolerant “looped” communication line. In the latter case, a break in the line
would cause the scan task to poll the RTUs on one side of the break using one port, and poll the RTUs on
the other side of the break using the other port. The advantage of such an arrangement is that a single
break in the communication line causes no loss of communication with any RTU.
IEC 870-5-104 Scan Task User’s Guide Operation of Scan Task 2-5
Windows SCADA
3 Communication Line Point
This chapter describes how to define a communication line for the IEC 870-5-104 scan task. You should
be familiar with the discussion of communication lines in DB-401, Point Database Editing Guide before
proceeding. In this document, only the items that are specific to the IEC 870-5-104 scan task are
discussed in detail.
The SCADA Explorer is used to create or modify a communication line’s definition. The dialog box that
allows you to do that has several tabs, each of which includes different data. You will normally begin on
the General tab, which is illustrated in Figure 3-1.
This is the name that identifies the protocol to be used to communicate with the RTUs connected to this
communication line. For the IEC 870-5-104 scan task, choose the name IEC 60870-5-104 from the drop-down
list.
Set this flag if you want the scan task to start automatically when the SCADA system starts up, either initially,
or as the result of a failover.
This area includes fields for the communication status point (which is required) and for six other points. If
you specify points, they must already exist in the database.
To create the points, you could abandon the editing of this communication line, and go to the desired
station in the SCADA Explorer. But you may prefer to temporarily start a second copy of SCADA Explorer,
and use it to create the necessary points.
These associated points must not be telemetered. Their values are written by the scan task. Therefore
they will not need telemetry addresses of their own. Since they are special in this regard, you should
consider designating separate User Types for these points.
Status Point
The first Associated Point is not optional, and must be a status point. This point will be used by the
scan task to indicate the Up or Down status of the communication line.
The scan task will set the point to its normal state when the communication line is working (i.e. there
is successful communication with at least one RTU), and to the abnormal state when it is failed.
Timeout Point
The IEC 870-5-104 scan task does not make use of this analog point to count timeouts. Instead, it
uses an analog point defined on each RTU to maintain a count of timeouts for each RTU. See
section 4.4.5, Timeout Count.
Bad Messages
The IEC 870-5-104 scan task does not make use of this analog point to count bad messages.
Instead, it uses an analog point defined on each RTU to maintain a count of bad messages for each
RTU. See section 4.4.4, Bad Message Count.
Unexpected Messages
The IEC 870-5-104 scan task does not make use of this analog point to count unexpected messages.
Port Switch
The IEC 870-5-104 scan task does not make use of this status point when switching between ports.
Instead, on each RTU there is a status point to indicate which port is used to communicate with that
RTU. See section 4.3.1, Port Switch Point.
Current RTU
The IEC 870-5-104 scan task does not make use of this analog point.
Various timers are specified to control the rate of certain events. Integrity (all-data) polls, accumulator
(integrated total) polls, and time synchronization commands are described in more detail in section 2.4,
Integrity Poll, section 2.5, Accumulators, and section 2.6, Time Sync.
All Data
This field specifies the all-data poll interval (in seconds). You should use this to specify how
frequently you want integrity polls on this communication line. Remember that only one RTU will
receive an all-data poll at each All Data poll interval.
Accumulator
This field specifies the interval between Accumulator Freeze commands (which precede each poll for
frozen data). If you want to retrieve frozen counters from any RTUs on this communication line, you
must define this interval.
Hourly Offset
You may offset the Accumulator polls (above) from the “top of the hour” by entering the desired
number of seconds here. Otherwise, an accumulator poll will be issued at the top of each hour, and at
the specified Accumulator interval thereafter.
In many instances, sending time sync messages to the RTUs as they request them will be sufficient.
No periodic “all stations” time sync messages will be needed, and you can leave this field blank.
This field allows you to specify certain “command line” switches to control the behavior of the scan task.
The switches supported by the IEC 870-5-104 scan task are described below. Specify each switch you
need by entering /name=value in this field. You do not need to add a space or punctuation (other than
the “/”) between switches.
/TMSYNC
This switch should be set to 1 if the periodic time sync is required, or 0 if not.
/RTUADDRESSSIZE
This switch specifies the RTU address length. It can be set to 1 if the RTU address is 1 octet wide,
or 2 if it is 2 octets wide. If this switch is not configured, 2 octets is assumed by default.
IEC 870-5-104 protocol only supports the 2-octet RTU address. Since this is the default, it is not
necessary to make use of this switch.
/OBJADDRESSSIZE
This switch specifies the length of the object address. It should be set to 1, 2 or 3 if the object
address is 1, 2 or 3 octets wide, respectively. If this switch is not configured, 3 octets is assumed by
default.
IEC 870-5-104 protocol only supports the 3-octet information object address. Since this is the
default, it is not necessary to make use of this switch.
/W
This switch assigns a value to parameter “W”, which causes the receiver (the scan task) to send an
acknowledgement after every “W” number of received I_Format ASDUs. By default, “W” has a value
of 0, which causes the scan task to send an acknowledgement at the earliest possible time, i.e. the
next normal poll.
/T2
This switch assigns a value (in seconds) to parameter “T2”, which is a time interval at the end of
which the scan task sends an acknowledgement even if less than “W” messages have been received
(see /W above). The default value of “T2” is 0, which disables timed acknowledgements.
/Log
This option specifies to the scan task that it is to log communications to a file. The file will be created
in the folder specified when Windows SCADA was installed. The default folder is C:\Program
Files\Quindar\ScadaServer. The file name is comprised of the protocol name, the communication
line ID and the current date. For example, a file from communication line 4 on December 22, 2004
would be named IEC1014-2004-12-22.log.
The logging that you will find in this file is the same as the logging that is displayed by the ScanMon
utility.
3.2.1 Network
This specifies the type of communication network to be used. It can be set to COMM for communication
lines that will communicate directly through a serial port on the SCADA host (i.e. a COM port known to
Windows), or TCP/IP for connections that rely on the TCP/IP network. Choose Use RTU only if you will be
specifying the connection information individually for each RTU (for example, if each RTU has its own IP
address). Refer to DB-401 Point Database Editing Guide for more detail.
The IEC 870-5-104 protocol does not support serial port communication, so please do not set this
parameter to COMM.
3.2.2 Mode
This is a drop-down list that can be set to either Poll or Quiescent. If Poll is chosen, the scan task
performs regular round-robin exception polling. Quiescent means the scan task does not poll, but accepts
unsolicited messages from the RTUs.
For IEC 870-5-104, select Poll, even though it also accepts unsolicited messages from the RTUs.
This parameter specifies the time to wait (in seconds) between each poll, when operating in Poll mode.
This parameter specifies the time to wait, in milliseconds, for a synchronization character of the
spontaneous response from the RTU. The time includes the transmission time of the request itself.
This parameter specifies the time to wait, in milliseconds, for a complete response from the RTU. The
time includes the transmission time of the request itself.
This parameter specifies the time to wait, in milliseconds, for a connection attempt to the RTU.
This specifies the minimum time delay, in milliseconds, that the scan task is to execute between all
transmissions on this communication line.
This field specifies the number of times the scan task is to retry polling an RTU that is not responding,
before giving up and declaring the RTU failed. If omitted, the scan task defaults to three retries.
This parameter specifies how often the scan task is to interrupt its normal round robin polling to perform a
fast-scan poll or a retry after error. If the interleave factor is 2, for example, then the scan task will check
for fast scan or error retry requirements after every 2 normal polls.
3.2.12 Dial-Up
The communication channel provides for up to two communication ports. If information is provided for
both ports, the scan task can switch from one to the other if communication using the first port is not
successful. Normally, at least one port is required to create a functional communication line (except when
connections are defined for each RTU, as described in section 4.2, RTU Data Fields—Connections).
Each port corresponds to a physical or logical connection from the host computer to the communication
medium. The type of Network (see section 3.2.1, Network) determines how these fields are used. For
COMM networks, the port means a serial port attached to the host computer. For TCP/IP networks, a port
Refer to DB-401 for a detailed discussion of the Port Parameters not described here.
Host Name
For RS232 communication lines, this must be the name that identifies the serial port, in the form
COMn, where n is a unique number. This is the same name that Windows knows the port by.
For TCP/IP communication lines, this will usually be the name that identifies the other device that we
are communicating with over the network. It may be the RTU itself, or more commonly, a terminal
server. Alternatively, it may be a fixed IP address of the form nnn.nnn.nnn.nnn.
Host Port
For a TCP/IP connection, there will be a TCP/IP port number that must be entered here. For terminal
servers, the port number of the desired serial port should be entered. Consult the terminal server
documentation to determine which port numbers to use.
The IEC 870-5-104 protocol requires that the port number must be 2404, so enter this number
here.
The IEC 870-5-104 protocol does not support serial communication ports. These fields are therefore
not used in the scan task.
Retry Count
This field contains the number of times the scan task is to retry polling an RTU that is not responding,
before switching to the other port (if one has been defined).
To set the number of tries that the IEC 870-5-104 scan task is to make before switching ports, specify
a value in the definition of each RTU on this communication line. See section 4.3.2, Switch Port after.
This chapter describes how to define an RTU for the IEC 870-5-104 scan task. Only the items that are specific
to the IEC 870-5-104 scan task are included in this discussion.
The SCADA Explorer is used to create or modify an RTU’s definition. The dialog box that allows you to do that
has several tabs, each of which includes different data. You will normally begin on the General tab, which is
illustrated in Figure 4-1.
Each RTU must have a unique address on the communication line. RTU addresses do not have to be
assigned sequentially. Enter the actual IEC 870-5-104 address of the RTU here. For the IEC 870-5-104
scan task, the valid range for individual RTU numbers is 1 to 65534. The scan task uses RTU number
65535 for messages that are broadcast to all RTUs.
4.1.2 Network
If you have specified connection information on the communication line (in section 3.2, Communication
Line Data Fields—Channel), then you should set this to Use ComLine. But if your communication line is
set to Use RTU, then you must choose TCP/IP here. This makes the fields on the Connections page
available for you to specify individual connection information for this RTU (see section 4.2, RTU Data
Fields—Connections).
4.1.3 Scout
This field is not used by the IEC 870-5-104 scan task, so leave it unchecked.
This is the name of a status point that will be used by the scan task to indicate the communication status
of the RTU. You must define this point. It is not optional.
This is the name of a status point that can be used as a switch to speed up polling of the RTU. Setting
this point to a value of “1” causes the scan task to place this RTU on “fast scan” (i.e. poll this RTU more
frequently than others, based on the interleave factor). Setting this point to a value of “0” causes the scan
task to take the RTU off fast scan.
If this field is left blank, the RTU will still be fast scanned automatically during control operations, but you
will not be able to initiate fast scan yourself.
4.1.6 Switches
This field allows you to specify certain “command line” switches to control how the scan task deals with
this RTU. The switches that are supported by the IEC 870-5-104 scan task are described below. Specify
each switch you need by entering /name=value in this field. You do not need to add a space or other
punctuation between switches.
/Step
Set this switch to 0 if 1-step parameter activation is required, or set it to 1 if 2-step parameter
activation is required.
/EvtAckLimit
This switch is used to specify the maximum number of received I_format APDUs for the scan task to
acknowledge after the last acknowledgement. Its value is in the range of 1 to 32767. If this switch is
not present, a default value of 8 is used.
Note: The value of this switch should not exceed two-thirds of the maximum number of outstanding
(e.g. unacknowledged) I_Format APDUs in the RTU, which is normally a configurable parameter of
the RTU. Consult the RTU user’s manual for the actual value.
/FrzMode
This switch is used to specify the desired freeze mode for interrogation of counters. Set this switch to
0 if “read-without-freeze-or-reset” mode is required. Set it to 1 if “freeze-without-reset” is required.
The connection information will only be available if you have set the Network type to TCP/IP (see section
4.1.2, Network).
This is the host name or IP address that identifies the device that the scan task is communicating with
over the network (e.g. RTU network interface).
For a TCP/IP connection, there will be a TCP/IP port number that must be entered here. In a terminal
server, it may correspond to the hardware port on the server (for example, port 2003 might correspond to
rd
the 3 terminal server port). Port numbers below 1024 are normally not used, since they are reserved for
other well-known TCP/IP protocols used on the network.
The IEC 870-5-104 protocol requires that the port number must be 2404, so enter this number
here.
4.2.3 Dial-up
If this RTU is on a communication line that has two ports defined (section 3.2.13, Port Parameters), or the
RTU is on a TCP/IP network and has two connections specified (section 4.2, RTU Data Fields—
Connections), this status point is required. The point is used to show which port the RTU is currently
being polled on. When the point’s value is 0, the scan task is using the first port. When the status point’s
value is 1, the scan task is using the second port.
Whenever it wants to poll an RTU, the scan task first tries the port currently indicated by the RTU’s port
switch status point. If the poll fails, the scan task places the RTU on “error scan” and retries. If the retry
count expires, the scan task switches to the other port (and sets the RTU’s port switch status point
You can force the scan task to either port by manually setting the port switch status point.
The port switch status point should be defined as a non-alarm point because you don’t want to be
bothered by alarms on this point when the scan task is constantly switching ports hunting for a dead RTU.
If the port switch point is defined and the scan task switches ports while the RTU is up, it notifies the
operators via a separate alarm of the form:
While the scan task is using one particular port for an RTU, it does not check the other port for availability.
Such checks can be made manually by manually setting the port switch point. If you do this, don’t forget
to remove the manual set, or the scan task will not be able to switch ports when it needs to. If you define
the port switch point as a control point associated with a dummy scan task, then you don’t have to worry
about manual set. Alternatively, you can automate the forced switching process via a command
sequence.
Enter the number of consecutive error responses (timeouts, wrong replies, security errors, etc.) that will
be tolerated before the scan task switches from the current port to the other one (if two communication
ports are defined).
The IEC 870-5-104 scan task does not presently support channel switching, so leave these fields blank.
This is an analog point to contain a percent active communication statistic (100% means no errors have
occurred). The statistic is calculated by passing 0s and 1s through a low-pass digital filter, where 0 is
input to the filter on a communication error and 1 is input on a communication success. Errors include
timeouts, security (checksum) errors and wrong replies.
xi 1 K xi (1 K ) ui
where:
If this point is not specified, then no percent communication statistic is calculated for this RTU. If the
channel currently being used for this RTU is quiescent, the point’s value is set to zero.
This is an analog point to contain a count of all messages received from this RTU. You can use this, in
comparison with the three counters discussed below, to evaluate the communication with this RTU.
This is an analog point to contain a count of correct messages received from the RTU. It is incremented
whenever a correctly formed reply is received, and was expected.
This is an analog point to contain a count of incorrect messages received from the RTU. The bad
message count is incremented whenever an incorrectly formed reply is received (including security
errors), or when the reply was not the one expected (either the RTU number or the function code in the
message was incorrect, for example).
This is an analog point to contain a count of communication timeout errors (no response errors). The
timeout count is incremented once each time the number of bytes of data from the RTU falls short of the
expected number.
This is an analog point to contain a count of all messages transmitted by the scan task. It is incremented
each time a message is successfully sent. This will be the total of all polls, control commands, setpoint
commands, and broadcasts sent to this RTU.
This is not used by the IEC 870-5-104 scan task. Leave this field blank.
This is not used by the 870-5-104 scan task. Leave this field blank.
IEC 870-5-104 Scan Task User’s Guide RTU 4-7
Windows SCADA
4.4.9 Time of Last Good Poll
This is not used by the 870-5-104 scan task. Leave this field blank.
This chapter describes how to define status points on the Station Editor for the IEC 870-5-104 scan task.
The Edit Status Point dialog from the SCADA Explorer is illustrated in Figure 5-1.
Indication only
Control only
Combined indication and control
depending on whether a telemetry address and any control addresses are specified for it.
5.1 Telemetry
This page defines the telemetry address, the two control addresses, and related items. You should
consider the RTU to be part of the telemetry address too, since you may have another point with the
same address on this communication line, although it is on a different RTU.
Consult DB-401, Point Database Editing Guide, for a discussion of the fields not mentioned in this
document, including the External Name and Type.
Each of the three addresses specifies the location of an input or output within the RTU, and is made up of
four fields labeled A, B, C, and D. These fields represent different things in each type of address.
The telemetry address specifies the location of the status point within the RTU. The meaning of the parts
of the address is given in Table 5-1. If this point is to be a telemetered point, select the RTU that will
provide the data, tick the checkbox for Telemetry Address, and fill in the required A, B, C, and D fields.
IEC point numbers (“A” address) for all points of all types are unique in most cases, but it is not necessary
to be the case for this scan task. See your RTU vendor’s documentation for the appropriate IEC point
numbers to use. Point number 65535 is reserved for use with a special setpoint associated with control
intervals. See section 5.4.1, Downloaded Control Interval.
If the object is not a 32-bit bitstring, set the value of “C” to zero.
Below, the formats are referred to by code (ID) number, but you will select them from a list of user-defined
names. If IEC 870-5-104 is the only scan task on your system, the formats can be given names that
describe their function. But if multiple scan tasks are being
used, they may use the same format numbers for different If you are in doubt about which
purposes, so you may not be able to come up with a better format code is which, look at their
name. In that case you may prefer to name them for the ID definitions using SCADA Explorer.
numbers listed here.
Format Code 1
Format code 1 specifies normal processing of single bits. That is, received bit values of 0 and 1 are
stored in the database as 0 and 1 respectively.
Format Code 2
Format code 2 specifies inverted single bit processing. That is, received bit values of 0 and 1 are
stored in the database as 1 and 0 respectively.
These format codes allow dual-bit status points from the RTU to be mapped in four different ways into
a consistent internal database representation. The internal representation is shown in the table
below:
Note that if any read response (whether exception or all-data) reports both bits of a dual-bit point as
changed, then there will be two transitions recorded for the point.
Format Code 3
This format code specifies “low bit on = open” and “high bit on = closed”. When both bits are off, the
point is in transition.
Format Code 4
This format code specifies “low bit on = closed” and “high bit on = open”. When both bits are off, the
point is in transition.
Format Code 5
This is equivalent to format 2 inverted. It specifies “low bit off = closed” and “high bit off = open”.
When both bits are on, the point is in transition.
Format Code 6
This is equivalent to format 4 inverted. It specifies “low bit off = open” and “high bit off = closed”.
When both bits are on, the point is in transition.
Format 8
Format 8 specifies inverted pass-through processing for dual-bit points. Both bits received from the
RTU are complemented and then stored into the database as is.
5.3 Control
The open (0) and close (1) control addresses that can be defined for each status point give the location of
one or two control relays in the RTU. The meaning of the parts of each address is given in Table 5-10.
You must tick the checkbox next to any address you intend to use.
Set “C” and “D” to zero if the control is not a bitstring command.
The test command (control type 105) does not operate any equipment. It causes the scan task to issue a
message that exercises the data link and application layers. A test command is logged on the event
printer(s). If the test command fails, a checkback failure message is also logged.
Note:
It is not illegal to use double commands with single-point information points or single commands with
double-point information points.
The Scout RTU can be configured to accept direct controls on all single commands, or on all double
commands, or both.
The IEC 870-5-104 protocol does not itself support a continuously variable control interval. It only allows
the master station to specify the use of a short pulse or a long pulse or to latch the control indefinitely.
The length of the short and long pulses are configured in the RTU. Table 5-12 lists the legal control
interval values.
The Scout RTU does not support the “persistent output” function. It does, however, support download of
control intervals. See the next paragraph.
If your RTU is a Scout RTU, it is possible to have the desired control interval downloaded from the master
to the RTU. When the control interval value is greater than 3, the scan task assumes that the value
represents the desired pulse width in milliseconds. In this case, immediately prior to issuing the control,
the scan task issues a direct setpoint control to the RTU to object 65535 with a setpoint value equal to the
desired control interval. The RTU records the setpoint value as the current control interval. The scan
task then issues the control with a control interval code of zero. The control interval code of zero tells the
RTU to use the control interval value that was previously downloaded via the special setpoint.
If the checkback to the special setpoint fails, the scan task declares a checkback failure on the control
point and does not proceed with the control.
A successfully downloaded control interval is retained in the RTU for all subsequent controls issued with
control interval code zero. The scan task makes use of this feature to avoid issuing special setpoints if
subsequent controls are for the same previously downloaded control interval. This feature reduces the
number of special setpoints that need to be issued in closed loop pulse control applications such as AGC
(Automatic Generation Control).
A control that uses the RTU’s default values (i.e. control interval codes 1, 2 or 3) does not disturb any
previously downloaded control interval, neither in the RTU nor in the scan task. For example:
On the first instance of a control that requires a pulse width (control interval) of 150 ms, the scan task
will issue a special setpoint for 150 and then issue the control with a control interval code of zero.
If the next control has a control interval code of 1 or 2, the scan task will simply issue the control with
that control interval code. The RTU will use its corresponding default (short or long) pulse width, but
will not forget the 150 ms downloaded control interval.
If the next control again requires a 150 ms pulse width, the scan task will skip sending the special
setpoint and just issue the control with a control interval code of zero.
If the next control now requires a pulse width of 250 ms, the scan task will issue a special setpoint for
250 and then issue the control with a control interval code of zero. Both the scan task and the RTU
now remember that the current downloaded control interval is 250.
Note:
The downloaded control interval feature is a feature of Scout RTUs only. If your RTU is not from
Survalent Technology, you have to use control interval codes 1, 2 or 3 only.
Don’t create a setpoint (or any point, in fact) with point number 65535. Manually issuing a setpoint to
setpoint number 65535 causes the value to be registered as a downloaded control interval in the RTU
but not in the scan task. If the scan task happens to skip the special setpoint on the next control, you
will get an incorrect pulse width on the next control.
For an AGC control, it is necessary to use an analog point as the control interval specification, so that the
AGC program can select the size of the pulse (by setting the value of the control interval point) before
each raise or lower control.
If your RTUs are not from Survalent Technology, you must set the width of the short and long pulses to 1
and 2, respectively, on the AGC Unit Tuning editor, and set the control interval point’s scale factor to
unity. See chapter 7, AGC Unit Tuning Editor, in the Automatic Generation Control Database Guide
(document number AGC-104). The actual pulse widths must be set in the RTU.
If your RTUs are from Survalent Technology, then you can enter the actual pulse widths on the AGC Unit
Tuning editor. The advantages are two-fold:
You don’t have to adjust the pulse widths at the RTU when tuning the AGC control loops. You adjust
them at the master station (via the AGC Tuning editor).
Since the values maintained in the AGC Unit Tuning editor are the actual pulse width values as opposed
to codes 1 and 2, your AGC system is more completely documented within the master station’s AGC
database.
This chapter describes how to define analog points for the IEC 870-5-104 scan task. The Edit Analog
Point dialog from the SCADA Explorer is illustrated in Figure 6-1.
Accumulators (integrated totals), setpoints (analog outputs) and step position points should be defined as
analog points.
The meaning of the parts of the address is given in Table 6-1. If this point is to be a telemetered point,
tick the checkbox for Telemetry Address, select the RTU that will provide the data, and fill in the required
address.
Although IEC point numbers (“A” address) for all points of all types are required to be unique in most
cases, this scan task also supports those cases where point numbers of the different point types are not
unique. See your RTU vendor’s documentation for the appropriate IEC point numbers to use. Point
number 65535 is reserved for use with a special setpoint associated with control intervals. See section
5.4.1, Downloaded Control Interval.
In the case of measured values, how a value that is received from the RTU is converted to an engineering
value in the master station is not determined by the object type code that you assign using the “B”
address. It’s determined by the object type that the RTU uses to transmit the value. The purpose of
having multiple measured value object types as opposed to just one is to specify how to download the
exception deadbands. For each measured value point, the point type indicates whether to download a
deadband or not, and if so, which deadband table and which format (normalized, scaled, short floating
point) to use. See section 6.5, Exception Window.
The “C” and “D” parts of the telemetry address are presently not used for the IEC 870-5-104 scan task. It
may be used in a future implementation, however, so set it to zero for now.
To determine the appropriate scale factor and offset, you can use the two formulas below:
(2) Offset = Min engineering value - (Scale factor * Min raw value)
where the Max and Min engineering values are the values you want to see, and the Max and Min raw
values are the range of values obtained from the RTU.
200 - 100
Scale Factor = _________ = 0.0625
2000 - 400
You can check your work by using the resulting scale factor and offset to convert a mid-point raw value.
In this case, a mid-point raw value of 1200 scales to the expected engineering value of 150 meters.
The zero clamp deadband is specified in engineering units, and is applied to points with format code 1 or
2 only. See section 6.2, Input Format Code.
You can use this to eliminate the annoying couple of amps or volts that often show up on a dead line
because of sensor noise or slight miscalibration. Or in a pipeline application, you can eliminate extremely
low pressure or flow readings in an empty pipe. For example, if the zero clamp deadband is 3.0, then any
input value which converts to between +3.0 and -3.0 engineering units will be clamped to zero.
This field is only meaningful if the RTU reports analog data on an exception basis and if the RTU supports
download of individual exception deadbands for each point.
The condition of the point is set to “Calculated from manually set data”, which will
cause an asterisk to be displayed beside the value.
If the current closed bit number is not zero (i.e. at least one bit is on), the point’s
value is set to the last stored value before this transition.
If the new value returned is zero (i.e. all bits are off), the point is set to a value of
999.
6.7 Setpoints
Setpoints are defined as analog points with device class “Set-Point” and with the following telemetry
addressing:
Don’t use setpoint number 65535. Point number 65535 is reserved for use with a special setpoint
associated with control intervals. See section 5.4.1, Downloaded Control Interval.
The “C” and “D” part of the address are presently not used for setpoints. Set their values to zero.
If bitstring (B = 113), use format code 5 or 6 (note that this type of control is not currently supported)
A client program called ScanMon is provided that allows you to monitor logging from various programs
within the SCADA system. ScanMon is discussed in detail in SM-400, Survalent SCADA System
Manager’s Guide for Windows.
Once ScanMon is connected to the IEC 870-5-104 scan task for the desired communication line, it will log
all communication with one or all of its RTUs. You can use the information shown in the log to diagnose
communication difficulties you may be having, or to confirm that the SCADA system is receiving the
expected data.
For example, if your communication line has an internal ID number of 6, then the name you need is
IEC1046.
Next, choose exactly what communication you want to monitor. You can specify the desired RTU via the
RTU Address field, and you can choose the type of information to include in the log from the Log Type
drop-down list.
The support for ScanMon that is built into the IEC 870-5-104 scan task includes the log types shown in
Table 7-1. The other choices you may find in the list are not intended for use with this scan task.
Hex Log as above, but include a listing of every byte sent or received, in
hexadecimal.
Errors Only Only log messages containing errors (e.g. timeouts or security errors).
A sample of typical ScanMon output is shown in Figure 7-2 using Hex logging. (Lines containing “... ... ...”
indicate where sections of the log have been removed so that an example of an all-data poll could be
included.)
14:38:00.820 IEC1046 <1972> P--> ["%NORMAL", 22] "User Data, Confirm Expected" (I_Format)
68 14 00 00 00 00 67 01 06 00 16 00 00 00 00 16 03 26 0E 02
03 05
Send Sequence: 0 Receive Sequence: 0
Host: 10.0.1.89
ASDU:103 "Clock Synchronization" Single=1
Cause:6 "Activation" Positive:0 Test:0 Common Addr:22
Obj Addr:0 05/03/02 14:38:00.790 Valid:0 Summer:0
14:38:00.820 IEC1046 <1972> P<-- [Success, 17] "Ack" (I_Format)
68 0F 00 00 00 00 05 01 05 00 16 00 F4 01 00 00 00
Send Sequence: 0 Receive Sequence: 0
Host: 10.0.1.89
ASDU:5 "Step Position" Single=1
Cause:5 "Request or Requested" Positive:0 Test:0 Common Addr:22
Step Point 500=0 Normal
14:38:01.371 IEC1046 <1972> P--> ["%NORMAL", 18] "User Data, Confirm Expected" (I_Format)
68 10 02 00 02 00 6E 01 06 00 16 00 4D 04 00 00 00 41
Send Sequence: 1 Receive Sequence: 1
Host: 10.0.1.89
ASDU:110 "Measured Value Parameter, Normalized" Single=1
Cause:6 "Activation" Positive:0 Test:0 Common Addr:22
PARM MVN 1101=0 QPM 1 "Threshold Value" Change:1 Operation:0
... ... ...
14:38:08.942 IEC1046 <1972> mail from TSTAT, request 1004 (Output status)
14:38:08.952 IEC1046 <1972> P--> ["%NORMAL", 16] "User Data, Confirm Expected" (I_Format)
68 0E 06 00 1A 00 2D 01 06 00 16 00 2C 01 00 85
Send Sequence: 3 Receive Sequence: 13
Host: 10.0.1.89
ASDU:45 "Single Command" Single=1
Cause:6 "Activation" Positive:0 Test:0 Common Addr:22
SCO 300=1 "ON" Select Short Pulse (1)
Notes:
The scan tasks only log to the destination specified by the most recent ScanMon command. If you, for
example, start a ScanMon at your computer, and then someone else starts a ScanMon at another
computer, the output in your window will stop.
On a scan table rebuild, the scan task process stops and restarts. Any ScanMon that was previously
going on will stop. If you wish to continue monitoring, you will need to start logging again.
This chapter contains the conformance profile of the Windows SCADA implementation of the IEC 870-5-
104 scan task.
In the conformance table that starts on the next page, each option that is supported by the present
implementation of the IEC 870-5-104 scan task is checked.
Mode 1 (Least significant octet first) as defined in clause 4.10 of IEC 870-*5-4, is used exclusively in this companion
standard.
Cause of Transmission
1 Octet
2 Octets (with originator address)
File Transfer
<120> := File ready F_FR_NA_1
<121> := Section ready F_SR_NA_1
<122> := Call directory, select file, call file, call section F_SC_NA_1
<123> := Last section, last segment F_LS_NA_1
<124> := Ack file, ask section F_AF_NA_1
<125> := Segment F_SG_NA_1
<126> := Directory F_DR_TA_1
Station Initialization
Remote Initialization
Read procedure
Read procedure
Spontaneous transmission
Spontaneous transmission
General Interrogation
global
group 1 group 7 group 13
group 2 group 8 group 14
group 3 group 9 group 15
group 4 group 10 group 16
group 5 group 11
group 6 group 12 Addresses per group have to be defined
Clock Synchronization
Clock synchronization
Command Transmission
Direct command transmission Select and execute command
Direct set-point command transmission Select and execute set-point command
No additional definition C_SE ACTTERM used
Short pulse duration (duration determined by a system parameter in the outstation)
Long pulse duration (duration determined by a system parameter in the outstation)
Persistent output
User’s Guide Device Profile Document 8-4
IEC 870-5-104 Scan Task
Supervision of maximum delay in comman direction of commands and set point commands
Maximum allowable delay is configurable
Parameter Loading
Threshold value Smoothing factor
Low limit for transmission of measured value High limit for transmission of measured value
Parameter Activation
act/deact of persistent cyclic or periodic transmission of the addressed object
Test procedure
test procedure
File transfer
File transfer in monitor direction
File transfer in control direction
Background scan
background scan