Date of circulation /647/MCR. Safety EMC Environment Quality assurance

Transcription

1 IEC/TC or SC: TC 57 Title of TC/SC: Power system control and associated communications Also of interest to the following committees Project number IEC Amed. 1 Ed.1 Date of circulation Supersedes document 57/647/MCR COMMITTEE DRAFT (CD) Closing date for comments Functions concerned: Safety EMC Environment Quality assurance Secretary: THIS DOCUMENT IS STILL UNDER STUDY AND SUBJECT TO CHANGE. IT SHOULD NOT BE USED FOR REFERENCE PURPOSES. RECIPIENTS OF THIS DOCUMENT ARE INVITED TO SUBMIT, WITH THEIR COMMENTS, NOTIFICATION OF ANY RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE AND TO PROVIDE SUPPORTING DOCUMENTATION. Title: Amendment 1 to IEC Ed.1: Telecontrol equipment and systems - Part 5-104: Transmission protocols - Functional enhancements to IEC Introductory note Copyright 2003 International Electrotechnical Commission, IEC. All rights reserved. It is permitted to download this electronic file, to make a copy and to print out the content for the sole purpose of preparing National Committee positions. You may not copy or "mirror" the file or printed version of the document, or any part of it, for any other purpose without permission in writing from IEC. FORM CD (IEC)

2 2 INTERNATIONAL ELECTROTECHNICAL COMMISSION TECHNICAL COMMITTEE NO. 57 POWER SYSTEMS CONTROL AND ASSOCIATED COMMUNICATION A Companion standard of telecontrol protocol series IEC Draft Part 5 : Telecontrol equipment and systems : Transmission protocols Section 104 A1 : Functional enhancements to IEC Revision 1.0 This draft has been prepared by working group WG03

3 3 INTRODUCTION This amendment to the IEC has been prepared by Working Group 03 "Transmission protocols" of the International Committee TC57 "Telecontrol equipment and systems". It contains some clarifications and enhancements to the standard and adds a new clause defining the use of redundant s. NORMATIVE REFERENCES [1] IEC : 2000, Telecontrol equipment and systems - Part 5: Transmission protocols Section 104: Network access for IEC using standard transport profiles.

4 4 5 DEFINITION OF APPLICATION PROTOCOL INFORMATION APCI 5.1 Protection against loss and duplication of messages Figure 10: Modify Figure 10 (shown below) to show t2 starting from the time of receiving the first unconfirmed frame. Thus t2 becomes the timeout of the oldest unconfirmed frame; not the most recently received unconfirmed frame: Station A Internal counters V after APDU was sent or received Ack 0 time out t2 V(S) 0 V(R) I (0,0) I (1,0) I (2,0) Station B Internal counters V after APDU was sent or received V(S) V(R) 0 Ack 0 S(3) 3 Figure 10 Undisturbed sequences of numbered I format APDUs acknowledged by an S format APDU Figure 11: The receiving station should send an S-frame to confirm the data frames that it has received prior to performing an active close. This permits the sending station to identify which frames have been received prior to the being closed. These frames may be deleted from the sending station. When the is reopened, the frame numbers are reset. Modify Figure 11 as shown below and add the corresponding note: Station A Internal counters V after APDU was sent or received Ack V(S) V(R) I (0,0) I (2,0) S(1) Station B Internal counters V after APDU was sent or received V(S) V(R) Ack sequence error 1 active close Active open follows, see figures 17 to 20 Note: To avoid retransmission of APDU s that have already been accepted, an S-frame may be sent prior to the active close. Figure 11 Disturbed sequence of numbered I format APDUs

5 5 Figure 12: The separate timer t1 in figure 12 should be associated with the transmission of each individual APDU. If a confirmation of an APDU is received before the timeout expires, that timeout is cancelled. The expiring timeout t1 shown in the original figure 12 applies for APDU 2, which is not confirmed. The timer t1 associated with APDU 1 is cancelled when S(1) is received. Modify figure 12 to show a timer for each APDU transmitted, and that the timer for APDU 1 is cancelled before it expires. Station A Internal counters V after APDU was sent or received Ack V(S) V(R) Station B Internal counters V after APDU was sent or received V(S) V(R) Ack I (0,0) 1 1 S (1) active close 2 time out cancelled X time out t1 1 Active open follows, see figures 17 to 20 Figure 12 Time out in case of a not acknowledged last I format APDU

6 6 5.3 Transmission control using Start/Stop Amend this clause with the following text and the figures: A state transition diagram for the Start/Stop procedure when a single is used between two stations is shown in Figure 17 below. Controlled Station receives: start Controlling Station receives: NOTE: The Controlling Station takes the initiative for establishing a TCP CON(Error) TCP established CON(Error) STARTDT_ACT [] / STARTDT_ACT [] / or I-frame [] / Pending STARTED CON(Error) STARTDT_CON [] / or I-frame / STARTED or I-frame [] / STOPDT_ACT [] / - [unconfirmed I-frames] / Pending STOPPED or I-frame [] / NOTE: I-frames received AFTER the STOPDT_ACT has been send can only happen when the Controlled Station has sent these I-frames BEFORE it has received the STOPDT_ACT Pending UNCONFIRMED STOPPED or I-frame [] / S-frame received and STOPDT_CON []/ CON(Error) STOPPED STOPDT_CON[no unconfirmed I-frames] / CON(Error) Figure 17- State transition diagram for Start/Stop procedure

7 7 STOPDT act stops the transmission of I-frames immediately. It is required, however, that the Controlling station confirms all received messages before sending STOPDT act, and that the Controlled station confirms all received messages before returning STOPDT con. This is similar to the case with the pending unconfirmed message at closure, see Figure 11. Anyway, if unconfirmed messages exist in the Controlling station, the Controlled station sends the STOPDT con after it has sent an S-frame to acknowledge these messages. If unconfirmed messages exist in the Controlled station, the Controlled station sends the STOPDT con when an S-frame acknowledging any unconfirmed message is received or when t1 expires. If t1 expires (confirmation timeout) the will be closed. After any re-establishment, unconfirmed messages may be transmitted when the STARTDT procedure is completed, if required by the user process. 5.4 Port number Replace the text in clause 5.4 with the following text: Every TCP address consists of an IP address and a port number. Every equipment connected to the TCP-LAN has its individual IP address, while the standard port number for IEC is defined to be 2404, confirmed by IANA. The server (controlled station) uses the port number 2404 in all cases, both for the listening port and the established s. The client (controlling station) is free to use ephemeral port numbers, e.g. as allocated by the client s TCP/IP implementation.

8 8 7 MAPPING OF SELECTED APPLICATION DATA UNITS AND FUNCTIONS TO THE TCP SERVICES 7.1 Station initialisation (6.1.5 to in ) Modify the original Figure 19 as shown below to indicate that End of Initialisation is optional: Application function of CONTROLLING STATION Communication services Application function of CONTROLLED STATION active open *) <CTL=SYN> Start of local initialization e.g. Power on active open *) timeout t 0 **) <CTL=SYN> Initialization of the controlled station timeout t 0 **) active open *) <CTL=SYN> passive open <CTL=SYN, ACK> Controlled station is available after local initialization ESTABLISHED <CTL=ACK> ESTABLISHED A_ENDINIT <SEND=M_EI> A_ENDINIT.req (optional) Controlled station is available after local initialization Following function: general interrogation *) The content of the data field is not defined in this standard **) The timer t0 specifies when the open is cancelled, and not, when open is retried

9 9 Figure 19: Local initialisation of the controlled station 7.5 General interrogation (6.6 in ) Add the following lines before A_ENDINT.req : A_GENINBREAK.req send C_IC DEACT A_GENINBREAK.ind receive C_IC DEACT A_GENINBREAK.res send C_IC DEACTCON A_GENINBREAK.con receive C_IC DEACTCON 7.8 Transmission of integrated totals (6.9 in ) Delete the following lines: A_IBREAK.req send C_CI DEACT A_IBREAK.ind receive C_CI DEACT A_IBREAK.res send C_CI DEACTCON A_IBREAK.con receive C_CI DEACTCON 8 ASDUs FOR PROCESS INFORMATION IN CONTROL DIRECTION WITH TIME TAG Substitute the following text in first paragraph A controlled station receiving a command or setpoint which has exceeded the maximum allowable delay (system-specific parameter) is then able to take appropriate actions with the following text: A controlled station receiving a command or set point which has exceeded the maximum allowable delay (system-specific parameter) will not return a protocol response (i.e. the Controlled station does not return a positive ACTCON nor a negative ACTCON). This is because the confirmation could be significantly delayed, and might not readily be associated with the original request. The command is passed to the controlled station application so that it can identify that the command was received too late, but MUST NOT perform any command action. 8.7 TYPE IDENT 64 C_BO_TA_1 There is no S/E bit in the Bitstring command, hence only direct commands can be used and command deactivation makes no sense. Delete the following lines describing valid Causes of Transmission: <8> := deactivation. <9> := deactivation confirmation

10 TYPE IDENT 107 C_TS_TA_1 Substitute text: TSC is a binary counter which counts the number of the test commands. After a reset the counter restarts with an initial value of 0 with new text: The requesting station may choose any value of TSC. The TSC in the response must match the request, and the time in the response must also exactly match the time in the request. 9 INTEROPERABILITY 9.5 Application layer Substitute the following lines in sub-clause Length of APDU : The maximum length of the APDU is 253 (default). The maximum length may be reduced by the system. Maximum length of APDU per system with the following lines: The maximum length of APDU for both directions is 253. It is a fixed system parameter. Maximum length of APDU per system in control direction Maximum length of APDU per system in monitor direction Substitute text in sub-clause System information in monitor direction with the following text (to match the interoperability list of IEC Ed. 2): System information in monitor direction (station-specific parameter, mark with an X if it is only used in the standard direction, R if only used in the reverse direction, and B if used in both directions) <70> :End of initialization M_EI_NA_1 Update matrix in subclause Type Identifier and Cause of Transmission Assignments to reflect that Causes of Transmission 8 and 9 cannot be used with Bitstring commands (C_BO_NA_1 and C_BO_TA_1) Substitute text in sub-clause Definition of time outs : Maximum range of values for all timeouts: 1 to 255 s, accuracy 1 s with text:

11 11 Recommended range for timeouts t0 - t2 Recommended range for timeout t3 : 1s to 255s, accuracy 1s : 0s to 48hrs, accuracy 1s Long timeouts for t3 may be needed in special cases where satellite links or dialup s are used (e.g. to establish and collect values only once per day or week). For dialup s it may be necessary to give up the supervision completely. This is achievable by setting the timeout t3 to zero. Add the following clause to describe redundancy: 10 REDUNDANT CONNECTIONS 10.1 Introduction The companion standard [1] defines network access for the IEC standard using the well known TCP/IP transport profile, and mainly focuses on the use of a single TCP. In many cases, however, redundancy may be required to provide a fast and reliable communication recovery in case of a communication failure. In this case multiple redundant s should be established between the two stations. This document describes a method for redundant s that should cover most of the issues related to redundancy, i.e. redundancy in case of wide area network failure, LAN failure and even end system failure (if redundant end systems) General requirements Redundant communication in a system using IEC can be achieved by providing the possibility to establish more than one logical between two stations. A logical is defined by a unique combination of two IP-addresses and two port-numbers, namely controlling station IP-address/port-number pair and controlled station IP-address/port-number pair. Connection establishment is performed by the controlling station in case of a controlled station as a partner, or by a fixed selection (parameter) in case of two equivalent controlling stations or partners, as stated in [1]. The station that performs the establishment is in either case referred to as the controlling station (station A) in the subsequent description, while the partner station is referred to as the controlled station (station B). The following general rules apply to this specification of redundant s: 1. The controlling and controlled station must be able to handle multiple (N) logical s 2. Only one logical is active sending/receiving user data at a time, and only this is in started state 3. The controlling station decides which one of the N s to be active 4. The N logical s represent one redundancy group 5. All logical s of a redundancy group must be supervised by test frames as described in [1] 6. A redundancy group must rely upon only one process image (database / event buffer) 7. If more than one controlling station need to access the same controlled station simultaneously, each controlling station must obtain its own redundancy group (process image) 8. If the controlled station uses a separate physical LAN interface for each redundancy group it can identify the s belonging to each redundancy group by means of its own IP-addresses. In case of only a single physical LAN interface the controlled station must know the corresponding sets of IP-addresses per controlling station if more than one redundancy group is needed.

12 12 The logical which is enabled for user data transfer (started) at any time is defined to be the active, while the others are standby s. Selection of active is performed by means of the unnumbered control functions (U-frames) STARTDT/STOPDT as in [1] and according to the State transition diagram in fig. 34. As stated in rule 3 above, selection and switchover of active is always initiated by the controlling station, and is managed by the transport interface or higher layers. Selection of active after station initialisation is performed by transmitting a STARTDT_ACT on the desired active. Similarly, switchover in case of a failure ( failover) is performed by transmitting a STARTDT_ACT on the standby that is selected to take over. The controlled station (station B) always understands the on which it last received a STARTDT_ACT as the active. It confirms the activation request by issuing a STARTDT_CON. The whole activation procedure is completed when the STARTDT_CON is received in the controlling station. Manual switchover can be performed by first issuing a STOPDT_ACT on the currently active and then a STARTDT_ACT on the selected new active. This will gracefully terminate data transfer on the first before it is resumed on the new. The controlling and/or controlled station must regularly check the status of all established s to detect any communication problems as soon as possible. This is done by sending TESTFR frames as described in [1] paragraph 5.2. Send and receive counters on each within a redundancy group continue their functionality independent of the use of STARTDT/STOPDT.

13 Initialisation of controlling station The sequential procedure for initialisation of the controlling station with N redundant s is shown in fig. 30 below. After restart of station A, the logical s to station B are brought up according to the initialisation procedure shown in fig. 18 of [1]. After establishment stopped state is always default, and one of the s (e.g. 1) is therefore changed from stopped into started state to enable user data transfer on this. The ENDINIT.req (optional but recommended, figures 30 and 31) may always be useful to advise the other station that the sending station is now ready to respond to an interrogation request. In case of initialisation of the controlling station it is only issued if data in reverse direction is defined. The controlling station shall initiate a Station Interrogation procedure as soon as possible after the completion of making one of the s active as shown in figures 30 and 31. Application function of Comm.serv. Comm.serv. Application function of controlling station (Station A) conn. 1 conn. N controlled station (Station B) active open ESTABLISHED <CTL=SYN> <CTL=SYN,ACK> <CTL=ACK> ESTABLISHED <CTL=SYN> <CTL=SYN,ACK> ESTABLISHED <CTL=ACK> ESTABLISHED send STARTDT U (STARTDT act) U (STARTDT con) receive STARTDT STARTED A_ENDINIT.req (optional) <SEND=M_EI> A_ENDINIT.ind Following function: Station interrogation U (TESTFR con) U (TESTFR con) Following function: Station interrogation (if reverse direction defined) Active conn. The sequential interrelationship between the procedures on the s is not fixed. For example establishment of the s may be started and go on in parallel. Figure 30: Initialisation of controlling station with redundant s

14 Initialisation of controlled station The sequential procedure for initialisation of the controlled station with N redundant s within a single redundancy group is shown in fig. 31. While the controlled station is down, timeout occurs when the controlling station attempts to establish the s. After restart of the controlled station the s are established according to fig. 19 of [1], but no user data is transmitted from the controlled station until started state on one is established. Any subsequent user data, starting with the ENDINIT.req (optional but recommended) and Interrogation procedures will now be transferred on this. Application function of Comm.serv. Comm.serv. Application function of controlling station (Station A) conn. 1 conn. N controlled station (Station B) active open active open <CTL=SYN> Timeout t0 <CTL=SYN> controlled station "off" active open Timeout t0 <CTL=SYN> ESTABLISHED <CTL=SYN,ACK> <CTL=ACK> ESTABLISHED active open <CTL=SYN> ESTABLISHED send STARTDT U (STARTDT act) <CTL=SYN,ACK> <CTL=ACK> ESTABLISHED controlled station "on" U (STARTDT con) receive STARTDT STARTED A_ENDINIT.ind <SEND=M_EI> A_ENDINIT.req (optional) Following function: Station interrogation U (TESTFR con) U (TESTFR con) Following function: Station interrogation (if reverse direction defined) The sequential interrelationship between the procedures on the s is not fixed. For example establishment of the s may be started and go on in parallel. Active conn. Figure 31: Initialisation of controlled station with redundant

15 User data from controlling station If communication fails on the currently started (e.g. m) when the controlling station attempts to transmit user data (e.g. a command ASDU), a (preferably automatically) switchover will be performed. The sequential procedure in this case is shown in fig. 32. If physically redundant s exist, switchover strategy has to be decided. One would generally prefer to first switch to a physically separate. When transmission timeout (t1) has elapsed, one of the standby s ( n) is made active using the STARTDT function. The ASDU is then directed to the new active either by re-transmitting the ASDU on this or by terminating an ongoing application function and reinitiating it towards the new. The failed is eventually closed by both sides, and reopening is regularly retried by the controlling station until the error has been corrected and the is re-established. Any subsequent user data (e.g. events) are now transmitted on the new active. A switchover will also be performed whenever a TESTFR_ACT on the active fails and hence reports a communication error on this. Care should be taken that data are not lost during a switchover. A station interrogation procedure may thus be necessary but is not mandatory after a switchover has been performed. The controlled station must only acknowledge user data received on the on which it last received a STARTDT_ACT (the active ).

16 16 Application function of Comm.serv. Comm.serv. Application function of controlling station (Station A) conn. m conn. n controlled station (Station B) Active conn. U (TESTFR con) COMMAND (example) <SEND=CMD> U (TESTFR con) Timeout t1 Active close <CTL=FIN> U (STARTDT act) receive STARTDT STARTED U (STARTDT con) Timeout t0 <SEND=CMD> CLOSED COMMAND (repeated) <SEND=CMD> COMMAND (repeated) Timeout t1 <CTL=FIN> Active close Active open Timeout t0 <CTL=SYN> CLOSED Timeout t0 U (TESTFR con) The sequential interrelationship between the procedures on the two s is not fixed, except when switchover occurs. Active conn. Figure 32: Redundant s - user data from controlling station

17 User data from controlled station If communication fails on the active when the controlled station (station B) attempts to transmit user data (e.g. an event ASDU), the controlled station must wait for the controlling station (station A) to detect the failure and perform a switchover before the ASDU can be retransmitted on one of the standby s. A sequential procedure to illustrate this case is shown in fig. 33. After acknowledgement timeout (t1) on the active (e.g. n) the controlled station performs an active close of the. A STARTDT_ACT will then eventually be received on one of the standby s ( m) as a result of a timeout (t1) in the controlling station to a TESTFR frame on the currently active but failed. The selected standby now becomes the new active, and the pending event is retransmitted on this. In general any unconfirmed user data will be retransmitted on the new active after a switchover has been performed, including potential unconfirmed ACTCONs or ACTTERMs. The failed is eventually also closed by the controlling station on its side, and reopening is then regularly retried until the error has been corrected and the is re-established. The controlling station must not acknowledge user data received on a which is not active.

18 18 Application function of Comm.serv. Comm.serv. Application function of controlling station (Station A) conn. m conn. n controlled station (Station B) Active conn. U (TESTFR con) U (TESTFR con) <SEND=SPONT> EVENT (example) Timeout t1 <CTL=FIN> Active close Timeout t3 Timeout t0 CLOSED U (TESTFR con) Timeout t1 Active close <CTL=FIN> U (STARTDT act) receive STARTDT STARTED U (STARTDT con) Timeout t0 CLOSED <SEND=SPONT> EVENT (repeated) Active open <CTL=SYN> U (TESTFR con) Timeout t0 The sequential interrelationship between the procedures on the two s is not fixed, except when switch occurs. Active conn. Figure 33: Redundant s - user data from controlled station

19 State transition diagram Fig. 34 below shows the state transition diagram for the STARTDT/STOPDT procedure of a that belongs to a redundancy group. Controlled Station receives: start Controlling Station receives: NOTE: The Controlling Station takes the initiative for establishing a TCP CON(Error) TCP established CON(Error) STARTDT_ACT [] / STARTDT_ACT [] / or I-frame [] / Pending STARTED CON(Error) STARTDT_CON [] / Other STARTDT [] / NOTE: Other STARTDT means STARTDT_ACT on other within the redundancy group or I-frame / STARTED or I-frame [] / STOPDT_ACT [] / Other STARTDT [] / - [unconfirmed I-frames] / Pending STOPPED or I-frame [] / Other STARTDT [] /Tx STOPDT_CON NOTE: I-frames received AFTER the STOPDT_ACT has been send can only happen when the Controlled Station has sent these I-frames BEFORE it has received the STOPDT_ACT Pending UNCONFIRMED STOPPED or I-frame [] / S-frame received and STOPDT_CON []/ or other STARTDT [] /Tx STOPDT_CON CON(Error) STOPDT_CON [no unconfirmed I-frames] / STOPPED CON(Error) Figure 34: State transition diagram for a belonging to a redundancy group

20 20. As can be seen from the diagram, the difference to the single diagram of clause 5.3 is the way in which the stopped state of an active can be reached. Two possibilities now exist: 1) The controlling station issues a STOPDT_ACT on the active 2) The controlling station issues a STARTDT_ACT on one of the other s within the redundancy group In the first case, if unconfirmed I-frames exist in either the controlling or the controlled station when a STOPDT_ACT is sent/received, the currently active transits to a pending unconfirmed stopped state. The controlling/controlled station must now wait for an S-frame to acknowledge these I-frames before a STOPDT_CON can be received/sent and the can reach the final stopped state. In the second case the currently active transits immediately from the started state (or any other state) to the stopped state, without any STOPDT_ACT being transmitted on any. As no user data will be acknowledged on a stopped, potentially unconfirmed I-frames in either the controlling or controlled station will be retransmitted on the new which has been activated by the STARTDT_ACT. Regardless of how a is set to the stopped state, either station may thereafter close the pertinent (ref. clause 5.3). The will be closed anyway (when timer t1 expires) if unconfirmed I- frames exist in either station, due to missing S-frame acknowledgements. As also can be seen from the state transition diagram, any received U-frame must always be confirmed by the receiving station, regardless of the state of the when the U-frame was received. It should be possible to set the values of the timers t0 t3 individually for each within a redundancy group System topology examples In this clause two system topology examples are shown to illustrate how the described method can be used to accomplish redundancy in different systems Cluster system Figure 35 below shows a system where the controlling station is constituted by a cluster, i.e. the controlling station consists of two redundant front ends or servers. The cluster (station A1 and A2) communicates towards the controlled station (station B) via a network that is also redundant. Network redundancy can be achieved by establishing two physically separate networks or by creating two subnets via segmentation. Altogether four logical s can be established between the controlling and controlled station according to figure 35, two s from each of the redundant servers. The two s will follow two physically separate routes, represented by the solid and dotted lines in figure 35. All four s belong to the same redundancy group. In case of a communication media (network or router) failure a switchover will be performed primarily to the second on the same server. In case of a server failure a switchover to the opposite server and consequently one of the s from this server will be performed.

21 21 CONTROLLING STATION STATION A1 Application 101 Transport Interface Application 101 Transport Interface STATION A2 TCP/IP TCP/IP LAN interf. 1 LAN interf. 2 LAN interf. 1 LAN interf. 2 Router Router Network X.25,FR,ISDN... Network X.25,FR,ISDN... Router LAN interf. TCP/IP STATION B Transport Interface Application 101 CONTROLLED STATION Figure 35: Cluster system with one redundancy group Dual master system Figure 36 illustrates a system where two controlling stations (masters) communicate with the same controlled station. In this case two redundancy groups are required, and each controlling station must connect to a separate instance of the protocol within the controlled station. Each of the two protocol instances will have their own database / event buffer (process image) Two logical s can be established from station A1 towards station B1, both belonging to the same redundancy group. Station A2 supports only a single towards station B2, belonging to a separate redundancy group. The protocol instances in the controlled station may be logically or physically separate depending on hardware redundancy requirements. In case of logically separate instances it is although possible to direct all s within all redundancy groups to a single physical LAN interface in the controlled station.

22 22 CONTROLLING STATIONS Application 101 Application 101 STATION A1 Transport Interface Transport Interface STATION A2 TCP/IP TCP/IP LAN interf. 1 LAN interf. 2 LAN interf. Router Router Router Network X.25,FR,ISDN... Network X.25,FR,ISDN... Router Router LAN interf. 1 LAN interf. 2 TCP/IP TCP/IP STATION B1 Transport Interface Transport Interface STATION B2 Application 101 Application 101 CONTROLLED STATION Figure 36: Dual master system with two redundancy groups