Description

This document explains how to add and configure an IEC 60870-5-104 slave driver interface. The simulated device points can be accessed through an IEC 60870-5-104 TCP master. It allows exchanging data with any industrial devices through IEC 60870-5-104 Ethernet messaging. Using a standard network interface card, this protocol can be easily and rapidly integrated into any simulation model.

The driver is capable of handling multiple slaves at the same time. Therefore, if more than one slave is needed in the simulation, only one instance of the driver will be needed. Configuring the driver to use multiple slaves is done by adding new instances in the configuration page (this is described in more detail further down in the document).

The driver makes use of asynchronous threads in order to service each slave. The CPU core on which the asynchronous threads are executed can be either the core 0 or a dedicated core. The appropriate signals of the model must be connected to OpInputs/OpOutputs blocks (RT-LAB Configuration panel) to enable the data exchange.

The IEC 60870-5-104 master device connected to the simulated slave can perform the following requests:

Send General interrogation commands to read the entire database
Send Control commands to change the values of the different supported data types
Send Parameter control commands to change the parameters of normalized, scaled and floating points measurands
Send Polling requests commands to retrieve the data from a specific group of points
Send Clock synchronization commands

Each configured point is associated with a specific data group. This group can be the Cyclic group ('C') or a number between 1 and 16. When a point is attached to the Cyclic group, its value will be reported to the master at the configured cyclic message interval rate. When a point is attached to a group number, its value will be reported to the master only if the master polls for the data of the point's group. By default, all registered points are also attached to the General group (0). This means that if the master sends a General interrogation command, it will receive the value of all the registered points. If required, a point can be only attached to the General group. This can be done by setting its group number to be 0.

It is also possible to enable an event scan for each of the supported data types. In this case, single points, double points, regulating steps, and bitstring value changes will be spontaneously reported to the master. The rate at which the database is scanned for changes is configurable. The maximum number of events that can be recorded is also configurable.

When working with normalized, scaled or floating points, a spontaneous change in the value of a point is reported to the master only if the new value is:

Lower than the low limit parameter configured for the specific point
Higher than the high limit parameter configured for the specific point
The change in value is higher than the threshold parameter configured for the specific point

During the simulation, the master can dynamically use the parameter address to change the threshold, smoothing, low limit and high limit values of a given point.

To summarize, there are four different situations when a point value is reported from the IEC 60870-5-104 slave to the IEC 60870-5-104 master:

The point is only attached to the General group (0) and the master sends a General interrogation command
The point is attached to a specific group number and the master sends a poll request to read this specific data group
The point is attached to the Cyclic group (C)
Event scan is enabled for a given data type and a spontaneous change of value event occurs

All these situations are valid for both input and output points. In the case of data being reported by a spontaneous change event, the timestamp of the data change is also reported to the master.

As a note, it is possible to configure a single point input at the same address as a single point output. In this case, the value applied to the corresponding input will appear at the corresponding output. It is the equivalent of having the point configured as an internal loopback. In this case, if the master attempts to set a specific value at the address of this single point, the change will not be effective since the value will always be overwritten by the input value.

An optional option can be used for the floating-point outputs (that are reported from the slave to the master). It is possible to enable RMS calculation on the data point values before being sent to the master.

Please refer to the Limitations section for more information.

Supported Features

Supports TCP protocol

Supported IEC 60870-5-104 commands:

General interrogation
Specific group interrogation
Single point write
Double point write
Regulating step write
Bitstring write
Normalized measurand write
Scaled measurand write
Floating-point measurand write
Clock synchronization

Supports IEC 60870-5-104 point control mode:

Select/Execute
Select only
Execute only

Support multiple slaves

Each slave can have its own IP address (IP aliasing feature)
Each point input can be initialized by the user
Each point can be attached to a specific interrogation group or to the cyclic group
Event scan can be enabled for each data types to trigger spontaneous data report to the master
Each analog point has a configurable low limit, high limit and deadband
Configurable event scan rate
Configurable maximum number of buffered of event for each data types
Configurable cause of transmission (COT) size (1 or 2 octets)

Driver Configuration

The driver is entirely configurable via the RT-LAB GUI. Users can easily add, delete and duplicate IEC 60870-5-104 slaves and their respective data points.

General Configuration

The IEC 60870-5-104 Slave driver is configured within a few pages. The first page contains some generic configurations.

Use an RT core for asynchronous computation: If set to true, the driver will reserve a real-time CPU core for its communication system and will be able to handle a bigger amount of slaves and data points. If set to false, the communication system will default to core 0.
Verbose: If set to true, the entire configuration will be displayed during the loading of the model

Slave Configuration

By default, the driver is configured with one slave that contains one data point of each type.

Each slave has multiple parameters:

Protocol	Only 'TCP' is available for the moment.
TCP port	Specify the TCP communication port. If multiple IEC 60870-5-104 slaves are simulated in the same model on the target IP address, the TCP port used for each device must be different. However, the TCP ports can be the same if the slave are using IP aliases. In all cases, the ASDU address must always be different from one slave device to another
Ethernet adapter	The desired network interface name. The proper interface name should be selected based on the information given by the Linux command "ifconfig".
IP address	Specify the IP address of the slave device. This parameter can be set to AUTO or to the target IP address if the simulated IEC 60870-5-104 slave does not need to have a specific IP address. In this case, the IEC 60870-5-104 master will be able to reach the IEC 60870-5-104 slave using the target IP address. If multiple IEC 60870-5-104 slaves are simulated in the same model on the target IP address, the TCP port used for each device must be different. If another IP address is specified, the device driver will attempt to create an IP alias on the network interface and attach the IEC 60870-5-104 slave to this alias. In this case, the master will be able to reach the slave using the alias IP address. This functionality is interesting to simulate different IEC 60870-5-104 slaves in the same model and have each of them being reachable using their own IP address. To avoid network conflicts, an error will be returned if the IP address is already used on the network. In all cases, the ASDU address must always be different from one slave device to another.
ASDU address	Specify the Application Service Data Unit address (1-255). Must always be different from one slave device to another.
COT size (byte)	Specify the number of octets of the COT field (1 or 2). The master has to select the same COT field size to communicate with the slave device.
Thread delay (ms)	Specify the thread delay, in milliseconds. Writing a value from the model to the IEC 60870-5-104 slave database involves multiple operations to manage event recording and data timestamping. In order to avoid adding a non-deterministic delay to the simulation, the dedicated thread is responsible for reading all the values from the model and updating the database accordingly. This parameter can be modified to tune the thread frequency. It represents the delay, in milliseconds, between each thread iteration. During each iteration, all the outputs are read from the memory space and the values are written into the database through the event manager. The delay is applied at the end of the iteration. Depending on the application requirements, it is possible to set this parameter to zero. However, as the thread is running on CPU core 0, it is suggested to set the delay to a minimum of 1 millisecond to give a chance to the other threads running on this core to have some computing time.
Cyclic message interval (ms)	Specify the 'Cyclic' group message interval in milliseconds. This is the rate at which the IEC 60870-5-104 slave will report the value of the data attached to the Cyclic group.
Event scan (ms)	Rate at which the slave database is scanned in milliseconds.
Event buffer size	Each data type has a buffer to register data changes. This parameter controls the maximum number of events that can be recorded for each data type. If the buffer is not large enough to record all the changes of a given data type, the oldest events will be discarded.
Single point event scan	Specify whether or not the event scan is enabled for the single points. If disabled, single points spontaneous data changes will not be reported to the master.
Double point event scan	Specify whether or not the event scan is enabled for the double points. If disabled, double points spontaneous data changes will not be reported to the master.
Regulating step event scan	Specify whether or not an event scan is enabled for the regulating points. If disabled, regulating steps spontaneous data changes will not be reported to the master.
Bitstring event scan	Specify whether or not the event scan is enabled for the bitstrings. If disabled, bitstrings spontaneous data changes will not be reported to the master.
Normalized event scan	Specify whether or not an event scan is enabled for the normalized values. If disabled, normalized values data changes will not be reported to the master.
Scaled event scan	Specify whether or not the event scan is enabled for the scaled values. If disabled, scaled values data changes will not be reported to the master.
Floating event scan	Specify whether or not the event scan is enabled for the floating-point values. If disabled, floating-point values data changes will not be reported to the master.

Points Configuration

For each slave, different data points can be added/removed using the +/-, for a specific data type. Each data point has its own configuration. The configuration for single points, double points, regulating steps, and bitstrings is similar.

Direction	Can be either an input or an output. Input is data written by the master to be used within the simulation model. An output is a data controlled by the simulation and transmitted to the master.
Name	Specify a name for the data point. This name will be used to assign a configured data point to a sensor. It is very important to carefully the name of each data point since they will be used in the sensor view to select which point to connect to the simulation.
Data address	Specify the address of the data point. This address can be used by the master to control or read the value of this point.
Data group	Specify the data group of the data point. To assign a point to the 'General' group only, set the group to '0' for this point. To attach a point to the 'Cyclic' group, set the group to 'C' for this point. Otherwise, set the group to the desired number (1-16).
Data value	Specify the initial value of the data point. If the point is configured as an input, this value will be applied to the data point before a master connects with the slave and send a command to change the value of the data point. If the point is configured as an output, this field is unused since the value will be configured by the sensor assigned to this data point, in the simulation.

Normalized and scaled data points have some additional different configuration fields. The direction, name, data address, data group and data value fields are the same than for the other data types explained previously. Please note that not all the columns are shown on the image.

Here is a description of each additional configuration fields for these data types:

Threshold address	Address of the threshold parameter for this data point. This address can be used by the master to change the threshold of this data point dynamically during the model execution by sending a Parameter control command.
Threshold value	Initial value of the threshold parameter for this data point. If the event scan is enabled for this specific data type, data will be reported to the master if this threshold is crossed within two consecutive value changes.
Smoothing address	Address of the smoothing parameter for this data point. This address can be used by the master to change the smoothing of this data point dynamically during the model execution by sending a Parameter control command.
Smoothing value	Initial value of the smoothing parameter for this data point.
Low limit address	Address of the low limit parameter for this data point. This address can be used by the master to change the low limit of this data point dynamically during the model execution by sending a Parameter control command.
Low limit value	Initial value of the low limit parameter for this data point. If the event scan is enabled for this specific data type, data will be reported to the master if the value is under the low limit parameter.
High limit address	Address of the high limit parameter for this data point. This address can be used by the master to change the high limit of this data point dynamically during the model execution by sending a Parameter control command.
High limit value	Initial value of the high limit parameter for this data point. If the event scan is enabled for this specific data type, data will be reported to the master if the value is over the high limit parameter.

Floating data points (outputs) have some additional different configuration fields. The direction, name, data address, data group data value, threshold address, threshold value, smoothing address, smoothing value, low limit address, low limit value, high limit address and high limit value fields are the same as for the other data types explained previously.

Here is a description of each additional configuration fields that are only available/editable when the direction is configured as an output:

Enable RMS computation	Enable or disable RMS computation for this output floating-point. When enabled, the RMS value is computed on the configured number of samples before being reported to the master.
RMS Gain	Specify a gain to be applied on the sampled before computing the RMS value.
RMS Sample Size	Specify the number of consecutive samples that will be used to compute the RMS value before reporting it to the master.

Connections

Once the driver has been configured as desired, the user will have to connect points in the model to points in the driver by using the designated RT-LAB GUI. This connection panel will show all the driver's and model's connectable points, once the model has been compiled. It is also possible to make connections on LabVIEW panels.

The driver's connectable points depend on the number of slaves and on the number of points configured by the slave.

The following lists the driver connectable points for a specific slave:

Connectable Name	Description	Direction
Single point inputs	Single points to be controlled by the master.	To model
Single point outputs	Single points reported to the master.	From model
Double point inputs	Double points controlled by the master.	To model
Double point outputs	Double points reported to the master.	From model
Regulating step inputs	Regulating step points controlled by the master.	To model
Regulating step outputs	Regulating step points reported to the master.	From model
Bitstring inputs	Bitstring points controlled by the master.	To model
Bitstring outputs	Bitstring points reported to the master.	From model
Normalized point inputs	Normalized points controlled by the master.	To model
Normalized point outputs	Normalized points reported to the master.	From model
Scaled point inputs	Scaled points controlled by the master.	To model
Scaled point outputs	Scaled points reported to the master.	From model
Floating-point inputs	Floating points controlled by the master.	To model
Floating-point outputs	Floating points reported to the master.	From model

The example model provided with RT-LAB is already packaged with connections between the driver and the model. It can be used to understand how the connections between the model and the driver should be made.

Limitations

The following is a list of the limitations of the driver:

Only TCP/IP communication is supported
Supports a maximum of 255 slaves per model
ASDU address must be different for one slave device to another
RMS value computation is only available for floating-point outputs