Relay Communication Basics

8/12/2019 Relay Communication Basics

http://slidepdf.com/reader/full/relay-communication-basics 1/128

Copyright © SEL 2011

Communications –

Basic



Overview

• Serial Communications

• Ethernet

• Fiber-Optic

• SCADA Protocols

• Peer-to-Peer Protocols

• Ethernet Protocols

• Comm Architectures



Communications Architectures

Serial Network



Serial Communications

Serial is the simplest form of communication

between two devices



Serial Standards

• RS–232

• EIA–485

• Universal Serial Bus (USB)

• RS–422

• G.703

• Many others…



Serial Standards

• RS–232

• EIA–485

• Universal Serial Bus (USB)

• RS–422

• G.703

• Many others…



So What is RS–232?

RS–232 is a ‘Recommended’ Standard by

which two devices communicate♦ General practice recommends distances no

greater than 50 feet over copper media

♦ Standard does not define protocol, only physicalinterface functionality



RS–232 Wiring

• The original RS–232 specification denotes

usage of a 25 pin cable• Modern RS-232 devices use DB9, including

SEL serial products



RS-232 Flow Control (Handshaking)

• Software (XON / XOFF)

• Hardware (RTS / CTS)

• Important to consider when transmissionmedium can require careful timing (wireless

radios)



RS-232 Connector Types

Two different connectors are associated with

two major types of hardware♦ Data Terminal Equipment, or DTE; SEL relays,

meters (IEDs, in general) etc. are DTE

♦ Data Communications Equipment or DCE; SELcommunications devices such as transceivers,media converters, etc. can be DTE or DCE



RS-232 Connector Types (cont)

• DTE will transmit on pin 2 and receive on pin

3• DCE will transmit on pin 3, and receive on

pin 2

• Null modem allows DTE-DTE or DCE-DCEcomms



RS–232 DB9 Pin-Out (DTE)

DB–9M Function Abbreviation

Pin #1 Data Carrier Detect CD

Pin #2 Receive Data RD or RX or RXD

Pin #3 Transmitted Data TD or TX or TXD

Pin #4 Data Terminal Ready DTR

Pin #5 Signal Ground GND

Pin #6 Data Set Ready DSR

Pin #7 Request To Send RTS

Pin #8 Clear To Send CTS

Pin #9 Ring Indicator RI



RS–232 DB9 Pin-Out (DCE)


Pin #1 Data Carrier Detect CD



Pin #4 Data Terminal Ready DTR


Pin #6 Data Set Ready DSR



Pin #9 Ring Indicator RI



“ SEL IED” RS-232 DB9 Pin-Out

(DTE connector)


Pin #1 5 Vdc n/a



Pin #4 + IRIG–B n/a


Pin #6 - IRIG–B n/a



Pin #9 Shield n/a



DTE->DCE Communications

• In serial cable terms, a “straight-thru” cable

is used• ‘C285’ cable w/ 2 x DB9-M ends



DTE->DTE Communications

• In serial cable terms, a “null-modem” cable

is used• ‘C273A’ cable w/ 2 x DB9-M ends



Transmitting Data – How does it

work?

• RS–232 communication is dependent on a

set timing speed at which both pieces ofhardware communicate

• The hardware knows how long a bit shouldbe high or low

• RS–232 also specifies the use of “start” and

“stop” bits



To Talk the Talk…

• Both devices must have the same data rate

to communicate, but they must also know tohandle problems

• Baud rate is the number of changes in thesignal per second, also known as bits persecond, or bps



Common Serial Settings

Most serial communications port settings areread in the following form:

♦ Bits per second (baud, or speed)

♦ Number of data bits

♦ Parity

♦ Number of Stop bits



Speed Limitations

• All serial devices have

an “UART” controller • SEL devices are

typically limited to 57600

baud• Older SEL products may

be limited to 38400, or

even 9600 baud



What is RS–485?

Communications interface using a ‘balanced’

or differential signal process to supportpoint–to–point, point–to–multi–point, andmultiple drop applications



Physical Media: Twisted Pair

Network Topology:Point-to-point, Multi-dropped, Multi-point

Maximum Devices: 32 drivers/receivers

Maximum Distance: 4000 feet

Mode of Operation: Differential

Maximum Baud: 100 kbit/s - 10 Mbit/sVoltage Levels: -7 V to +12 V

RS–485 Specifications



RS-485 Has Better Noise Immunity

Opposing polarities

and twisted pairconductors fortransmit and receive

signals providesimmunity to

magnetically–

induced noise



RS–232 vs. RS–485



RS–485 Full–Duplex

• “4-Wire” Standard

• All device connections are consistent• Only first and last devices in chain connect the

reference wire

• Required for SEL point–to–point or LMD protocols



RS–485 Half–Duplex

• “2-Wire” Standard

• Only one device can talk at a time• Rx and Tx matching polarities are tied together (+

to + and - to -)

• Does not support SEL protocols



RS–485 Half–Duplex

• Half-Duplex Comms imply that receive/transmit beaccomplished on same data lines.

• Two methods to switch rx/tx mode:

♦ - RTS Line “High” on 232 Connector (HW+SW)

♦ - “SDC” – Send Data Control (SW-only)



RS–485 Termination Resistors

• Used to match impedance of 485 TX node tocommunication cabling in use.

• If mismatch is in place, portion of messagereflected back at transmitter, data is truncated.

• Connect +/- (or A/B) pairs of Transmitter /Receiver, only at extreme ends of network

• Use resistors in range of 120-150 ohms.



Serial

Physical media

Copper Fiber optics



Fiber-Optic Serial

• Dual-Transceivers encode serial data over fiber-optic links



Universal Serial Bus (“ USB” )

• Developed as open standard for interconnectionof computing peripheral devices.

• Software Drivers required to determine behaviorof USB connection.



USB/RS232 Converters

• Connect a PC with no physical RS232 ports tolegacy IEDs.

• SEL Solution = C662



Network Communications

• OSI Model

• Physical media♦ copper/twisted pair

♦ fiber optics



Network Communications



What is a ‘Network’?

A collection of two or more elements linked

together for the purposes of sharinginformation, resources, etc.

♦ ARPANET was the world’s first ‘packet

switching’ network

♦ ARPANET successfully passed the firstcommunication packets in 1969



Jump Forward 40+ Years…



The (OSI) Reference Model

Layer Function

Layer 7 Application Interface between NOS

and user’s applicationsoftware

Layer 6Presentation

Data representation

Layer 5 Session Name to address translation,access security

Layer 4 Transport Reliability of transmissionfrom end to end

Layer 3 Network End-to-end addressing(specific to the protocol)

Layer 2 Data Link Media access and addressing(on the same physical wire)

Layer 1 Physical Cables, connectors, wires and

signaling issues

Application Data

Wire/Fiber

• Top 3 layers areapplication-oriented

• Responsible forpresenting theapplication to the user

• Unaware of how dataget to the application

• Lower 4 layers dealwith packaging &delivery of data

• How it is transmitted

• How it is reliably

received

• How it is routed



OSI Stack and Ethernet



Ethernet

• Establishes direct connection betweensender and receiver

• Based on MAC (Layer 2) address



MAC Address



Ethernet Devices - Hubs

Hub: Simple Muxing Device That Redistributes

all Data that it Receives to all Connections• Physical Layer

• Lowest cost• Effectively Obsolete (tough to buy new)



Ethernet Devices - Switches

Switch: Intelligent Muxing Device Monitors

and Redistributes Data to AppropriateConnections; will not Redistribute DetectedBad Data

• Uses Data Link layer (MAC address filtering)

• Additional functions in ‘Managed’ switches



Ethernet Devices - Switches

• Can be used to interconnect differentEthernet cabling mediums (Copper, Fiber,

etc)



Ethernet Devices – Managed Switches

• Advanced Functions provided by managedswitches include:

♦ Port security (disabling, VLAN, priority)

♦ Network Monitoring (SNMP, web interface)

♦ Redundant (ring-style) networking (RSTP)



Ethernet Devices - Routers

Router: Interconnects Two Networks Such as

Substation LAN and Utility WAN• Uses Network Layer/Transport layers

• Commonly used for Network Security• Often contain ‘Firewall’ functions

Eth t M di T



Ethernet Media Types

• CAT5E / CAT6 Twisted Pair Cable, RJ45Connectors

♦ Most common interface standard, cables arerelatively easy to manufacture.

♦ Cable provides acceptable EMI shield for mostindustrial installations.

♦

Maximum cable limit of 300 ft.♦ 10 Mbit/s through to 1000 Mbit/s (gigabit)

Eth t M di T t



Ethernet Media Types cont.

• Fiber optic cable, multi-mode (MM) orsingle-mode (SM)

♦ Common in substation installations, due to EMIimmunity.

♦ Maximum lengths of 15km (MM) and 110km(SM)

♦

10 Mbit/s through to 1000Mbit/s (gigabit)

D t P t l



Data Protocols

P t l Wh t th ?



Protocols – What are they?

• “A formal, defined set of digital messageformats and rules for exchange of data

messages between computing systems”

• Frequently include signaling, authentication

and error detection/correction capabilities

SCADA Protocols



SCADA Protocols

• Follow Master/Slave (or Client/Server)relationship

• SEL Protocol

• Modbus

• DNP 3.0

SEL Protocol



SEL Protocol

• Supported by all SEL IEDs

• Combination of ASCII/Binary data transfermodes.

• Supports auto-configuration of tag data

• Time-stamps supported in target datarange if target is in SER configuration.

SEL Protocol Auto Configuration



SEL Protocol – Auto Configuration

• “CAS” Command – Return Meter and EventReport Configuration Data

• “DNA X” Command – Return completeindex map of relay word bits

SEL Protocol Fast Op Commands



SEL Protocol – Fast Op. Commands

• Two main styles of bits can be written toSEL IEDs – Remote Bits (RBs) and

Breaker Bits (BRs)

• Breaker Bits correspond to OC and CC

targets in Relay Logic• Remote Bits typically used for additional

logic.

Serial Protocols Modbus



Serial Protocols - Modbus

Modbus Protocol



Modbus Protocol

• Referred to as “Modbus/RTU”

• Developed by Modicon for their PLCs• Simple Protocol Used in Many RTUs,

PLCs, and Other IEDs

• Compatible w/ RS-232 and 485

Modbus Register Mapping



Modbus Register Mapping

• Register map defined by manufacturer

• Hard-coded and configurable map arepossible

• All boolean data types are single-bit

registers

• Holding and Input registers are 16-bit

Modicon Addressing



Modicon Addressing

• Modicon Addressing

• 0X Discrete Output / Coils• 1X Discrete Input

• 3X Input Register• 4X Holding Register

Modbus Message Framing



Modbus Message Framing

• Data Request and Response

♦ 1 byte Slave address

♦ 1 byte Function code

♦ n bytes Data bytes

♦ 2 bytes CRC-16 block check

Read Coil Status (01h)



Read Coil Status (01h)

• Reads Status of Various Bits

• Read Up to 1000 Bits per Request• Technically classified as 'Digital Output'

status data type

Read Input Status (02h)



Read Input Status (02h)

• Read Input Status (02h)

• Identical Operation as Read Coil Status(01h)

• Functionally used as 'Digital Input' data

type

Read Holding Register (03h)



Read Holding Register (03h)

• Used to Read From Database Directly

• Data Response Is Entire Register • Read up to 125 Registers per Request

Read Input Register (04h)



ead pu eg s e (0 )

• Functionally identical to Read Holdingregister op-code.

• Many devices will only have a singleregister map and will return the same value

whether op-code 0x03 or 0x04 is used.

Force Single Coil (05h)



g ( )

• On SEL equipment, Operate Remote andBreaker Bits

• Clear Archive Records

• Hold and Release Copies of Data Records

Preset Single Register (06h)



g g ( )

• Write 16-bit value (2 Bytes) Directly to aDatabase Register

• Technically corresponds with Input Registerdata map.

Preset Multiple Registers (10h)



p g ( )

• Write Multiple 16-bit Words of Data toContiguous Database Registers

• Write up to 120 Registers at once

Modbus Error Responses



p

• 01 - Illegal Function

• 02 - Illegal Data Address

• 03 - Illegal Data Value

• 04 - Failure in Associated Device• 06 - Busy, Rejected Message

Modbus Decoding - Poll



• Ex: 01 03 00 00 00 10 DA FC

• 01 = Address of Remote Slave IED

• 03 = “Read Holding Reg” Op-Code

• 00 00 = Start a Holding Reg Addr 00• 00 10 = Return 16 x 16-bit Registers

• DA FC = CRC-16 Error Detection

Modbus Decoding - Response



• Ex: 01 03 20 <DATA> DA FC

• 01 = Address of Remote Slave IED

• 03 = Holding Register Data Type

• 20 = Number of Data Bytes Returned• <DATA> = Raw Holding Register Data

• DA FC = CRC-16 Error Detection

Modbus Protocol Types



• 4 Distinct Flavors of Modbus

♦ Modbus ASCII

♦ Modbus RTU

♦ Modbus RTU over TCP

♦ Modbus/TCP

Modbus Register-Encoding



• How to use 16-bit registers for advanceddata?

♦ 16 Packed Boolean statuses

♦ 32-bit Integers

♦ 32-bit Floating Point

Modbus Packed Booleans



• 16-bit Register is used to store 16individual Bit states:

♦ Given: 0x0A1F = 0000 1010 0001 1111

Bit 0 = IN101 = 1

Bit 5 = IN106 = 0

Bit 15 = IN116 = 0

Modbus 32-bit Integers



• Combine 2 x 16-bit registers into a single32-bit Register:

♦ Host requests 2 registers, combines into 1.

♦ High and Low 16-bit register (order?)

♦ Signed or unsigned?

♦ Windows “Calculator” is a useful tool.

Modbus 32-bit Floating Point



• Combine 2 x 16-bit registers into a single32-bit IEEE754 Floating point Register:

♦ Host requests 2 registers, combines into 1.

♦ High and Low 16-bit register (order?)

♦ 32-bit broken down into sign (1 bit), exponent(8 bits) and mantissa (23 bits)

www.binaryconvert.com



• Free web-site for converting raw binary/hexquantities into formatted data.

DNP3 Protocol



• Master/Slave (Client/Server)-style Protocol

• Overcomes many limitations of earlierSCADA protocols

• Open standard, free for implementation by

any vendor

DNP3 History



DNP3 Introduction



• DNP Intent

♦ Telecontrol

♦ Read / write of database data

♦ SCADA information

SOE (time-stamp retrieval) COS (state-change report)

time synchronization

SBE (select-before-execute)

DNP3 Introduction



• Event Based

♦ Binary change of state

multiple change detection

SOE

♦ Analog % change

♦ Event classes

♦ Event buffer

DNP3 Introduction



• Object Based

♦ Data specification

♦ No direct memory access

♦ Object types

value

change

frozen

♦ Additional attributes

DNP3 Reporting Mechanisms



• A classic example of a Modbus-style pollingrequest

Master requests specific memory area from slave

Slave responds with all data in region




• DNP3 can perform a ‘Static’ or ‘Integrity’Poll

Slave responds with all data of type or all Classes

Master requests all data of a type of Class 0




• The master process can also utilize classpolling to use Report-By-Exception and

improve performance

Master performs periodic Class

0

poll

for

sync

refresh

Master performs regular Class 1,2,3 poll

Slave responds to Class 0 poll with all data

Slave reports event data




• For extremely low-bandwidth connections,unsolicited reporting can be used.

Master performs

occasional

Class 0 poll for sync refresh

Slave reports unsolicited event data

Slave responds to Class 0 poll with all data




• Quiescent polling can also be used, where-by the master process never polls for data

and relies entirely on the slave process toreport changes.

Master does not poll

Slave reports unsolicited event data

DNP3 Protocol Benefits



• Optimized Communication

♦ Event-driven polling

class 0

class 1, 2, 3

♦ Minimum message size




• High Data Integrity

♦ 16-Bit CRC every 16 bytes

♦ Hamming distance of 6

♦ Data link confirmations

♦ Application confirmations




• Structured Evolution

♦ Subset definitions

♦ Object definitions

♦ Standard documentation

♦ Conformance testing♦ User’s group

♦ Technical committee

DNP3 Recent Developments



• ‘Recent’ is defined as 2000-era

• Ethernet LAN/WAN Support

• Virtual Terminal Applications

• File Transfer Capabilities

DNP3 Protocol Structure



• DNP Structure

♦ Modified 3 Layer OSI modelApplication

Presentation

Session

Transport

Network

Data Link

Physical

ApplicationData Link

Physical

DNP3 Message Structure



• Typical DNP3 Message Frame

05 64

DWG: #853_001




• Data-Link Header, every message startswith this.

• 0x0564• Length

• Control Byte• Destination and Source Addresses

• 16-bit CRC

LEN05 64LSB MSB

SOURCE

LSB MSB

CRCDESTINATIONDLC




• Transport and Application Layer includesactual data.

• Transport Header

• Application Header

• Object Header

• Data Block• CRC

APP Header TH CRCDataObject Header




• Application-Layer Object Data

• Object Header

♦ Group

♦ Variation

♦ Qualifier

♦ Range

DataObject Header




• Common Application Layer FunctionCodes:

♦ 01 – Read

♦ 02 – Write

♦ 03 – Select, 04 – Operate, 05-Direct-Operate♦ 23 – Delay Meas, 24 - Record Current Time

♦ 129 – Response

♦ 130 – Unsolicited Response




• Common DNP3 Default Object Types andVariations:

♦ Binary Inputs – Obj 1,2 Var 2

♦ Binary Outputs – Obj 10 Var 2, Obj 12 Var 1

♦ Counters – Obj 20, 22 Var 5

♦ Frozen Counter – Obj 21,23 Var 1

♦ Analog Inputs – Obj 30 Var 4, Obj 32 Var 2

♦ Analog Outputs – Obj 40,41 Var 2♦ Time/Date Objects – Obj 50 Var 1

♦ Class Objects – Obj 60 Var 1,2,3,4

DNP3 Class Data



• Reports “Change Event” data from an IED

• Q: What does Class 1, 2 and 3 data

represent?

• A: Whatever the IED defines it as!

• Typically: Binary = 1, Analog = 2, Counter =3

DNP3 Static vs. Event Data



• Static data from Class 0 object poll

♦ “Current” (snapshot) Value

♦ Does not contain timestamp information

• Event data from Class 1,2,3 object poll

♦ “New Value” from IED event buffer

♦ Timestamp is critical component of message.

DNP3 Message Structure - Options

Obj t T O ti l C t



• Object Type Optional Components

♦ Time-Tag (Change events-only)

♦ Status Flag

Value, Forces, Restart, Online

Point Force (Local or Remote)

Over-Range

DNP3 Message Structure - IIN

IED R ill i l d 2 b t f IIN



• IED Responses will include 2-bytes of IIN(internal indications) bits.

♦ Device trouble, re-start, in-local, corrupt

♦ Time Sync Required

♦ Class 1, 2 or 3 data available

♦ Event Buffer Overflow

♦ Requested objects are unknown

DNP3 Commands

U “C t l R l O t t Bl k” (CROB)



• Use “Control Relay Output Block” (CROB)from host to write to Binary Output Index.

• Supported styles of commands:

♦ Pulse On, Pulse Off

♦ Pulse w/ Trip or Close Qualifier

♦ Latch On, Latch Off

DNP3 Commands – IED Interpretation

IED ill h diff t i t t ti f



• IEDs will have different interpretations ofDNP3 command codes

• Check the device-specific DNP3 appendix

• From SEL-351S-7:

Peer–to–Peer Protocols



• Serial: Mirrored Bits®

• Network: IEC 61850 GOOSE

SEL MIRRORED BITS Review

Relay-to-Relay Logic Communication



Relay to Relay Logic Communication

Proprietary

µ Wave

.....

..... .....

.....

Relay 1

DB9 Connectors

AudioRadio

Other

. . .

. . .

Fiber SEL-28xx

Relay 2

Fiber

SEL-28xx

Other

SEL MIRRORED BITS Communications



• EIA-232 Asynchronous Message (6-O-1)

• 8 Bits of Bidirectional Status or Control

• High Speed – 10 to 20 ms contact xfer time

SEL MIRRORED BITS Communications



Channel

Interfaces and

Communications

Equipment

Relay 1 Relay 2

RMB1 . . . RMB8RMB1 . . . RMB8

Transmit

Receive

Transmit

Receive

TMB1 . . . TMB8 TMB1 . . . TMB8

Channel

1 2 3 4 5 6 7 81 2 3 4 5 6 7 8

1 2 3 4 5 6 7 81 2 3 4 5 6 7 8

Transmit “ Mirrored” to Receive



Relay 1 Relay 2

TR ANSM

IT

RECE

IVE

TR ANSM

IT

RECE

IVE

TMB1

TMB2...

TMB8

RMB1

RMB2...

RMB8

TMB1

TMB2...

TMB8

RMB1

RMB2...

RMB8

1

0...0

0

0...0

0

0...0

1

0...0

Communications Media Requirements



• Full-Duplex Communications

• EIA-232 Serial Port Interface♦ Up to 38400 bps

• Immune to Power System Fault GeneratedTransients

• Acceptable Speed for the Application

Ethernet Protocols

T l t



• Telnet

• FTP• Web / HTTP

• DNP3 / IP• IEC 61850

(SCADA and real-time)

Telnet Protocol

P id Vi t l “T i l” i



• Provide Virtual “Terminal” session onremote host

• Command-line session supported

• No built-in authentication

• TCP port 21



Web / HTTP Protocol

“HyperText Transfer Protocol”



• “HyperText Transfer Protocol”

• Supports HTML Text-file encodinglanguage that provides formatted datainformation from a server to a client.

• Simple Authentication supported

• TCP port 80

DNP3/IP Protocol

• “DNP3 over IP”



• DNP3 over IP

• 99.9% Identical to serial SCADA protocol• Differs only in Time-synchronization

function codes and objects used.

• TCP Port 20000

IEC-61850 Protocol(s)

• Vendor neutral



• Vendor-neutral

• MMS – Classic Client/Server protocol♦ “Tag-Based” Protocol Language

♦ Standardized Naming

• GOOSE – Peer-to-Peer messaging

♦ High-speed data sharing

Communications Architectures

• Star Topology



• Star Topology

• Bussed/Daisy-Chain Topology

• Ring Topology

• Hybrid Ethernet Topologies

• “Classic” SEL Topology

Star Topology



Star Topology

• Benefits:



♦ Flexible for Serial/Ethernet hardware

♦ Independent Data Path to end devices

♦ Quick Concurrent polling of end devices

• Draw-Backs:♦ Additional Comms Cable, More $$$

♦

Occasional use of repeaters required♦ No redundancy

Bussed / Daisy-Chain Topology



Bussed / Daisy-Chain Topology

• Benefits:



Benefits:

♦ Inexpensive communications to many devices

(minimal cabling)

• Draw-Backs:

♦ Round-robin polling delays (slow data updates)

♦ Devices must be addressable (no SEL protocol)

♦ No redundancy

Ring Topology



Ring Topology

• Benefits:



♦ Less cost of cabling

• Draw-Backs:

♦ Extra Configuration

♦ Some devices do not support (for Ethernet,Managed Switches required)

♦ Proprietary Connections

Hybrid Topologies – Redundant Star



Hybrid Topologies – Redundant Star*



Hybrid Topologies – Star/Ring



Hybrid Ethernet Topologies

• Benefits:



♦ Redundant, self-healing Architectures

• Draw-Backs:

♦ Extra $$$ for additional cabling/switches

♦ Extra Configuration

♦ Some devices do not support (Managed

Switches generally required)

“ Classic” SEL Topology

• Communications processor concept• SEL-2032 vs. SEL-3530 RTAC



SEL 2032 vs. SEL 3530 RTAC

• Settings and hardware features

Classic Comm. Processor System

Wireless

Device



Non-SEL Relay

SEL-2407

GPS Clock

Modem

PC

Local HMISCADA Master

M e t e r i n g

E v e n t s

A l a r m s

C o n t r o l s

T i m e S y n c h r o n i z a t i o n

C o n f i g u r a t i o n

SEL RelaySEL Relay

SEL RelaySEL Relay

Device

SEL-3021

Satellite

SEL-2032

Modern Comm. Processor System





Questions?

Documents

Relay Communication Basics