IEC 60870-5 explained

IEC 60870 part 5 [1] is one of the IEC 60870 set of standards which define systems used for telecontrol (supervisory control and data acquisition) in electrical engineering and power system automation applications. Part 5 provides a communication profile for sending basic telecontrol messages between two systems, which uses permanent directly connected data circuits between the systems. The IEC Technical Committee 57 (Working Group 03) have developed a protocol standard for telecontrol, teleprotection, and associated telecommunications for electric power systems. The result of this work is IEC 60870-5. Five documents specify the base IEC 60870-5:

The IEC Technical Committee 57 has also generated companion standards:

IEC 60870-5-101/102/103/104 are companion standards generated for basic telecontrol tasks, transmission of integrated totals, data exchange from protection equipment & network access of IEC101 respectively.

IEC 60870-5-101

IEC 60870-5-101 [IEC101] is a standard for power system monitoring, control & associated communications for telecontrol, teleprotection, and associated telecommunications for electric power systems. This is completely compatible with IEC 60870-5-1 to IEC 60870-5-5 standards and uses standard asynchronous serial tele-control channel interface between DTE and DCE. The standard is suitable for multiple configurations like point-to-point, star, multidrop etc.

Features

Frame format

The character format of IEC 101 uses 1 bit each for start, stop and parity, as well as 8 data bits. FT1.2 (defined in IEC 60870-5-1) is used for frame format of IEC 101 which is suitable for asynchronous serial communication with Hamming distance of 4. This uses 3 types of frame formats -Frame with variable length ASDU, Frame with fixed length & single character. Single character is used for acknowledgments, fixed length frames are used for commands & variable lengths are used for sending data. The details of variable length frame is given below

IEC 101 Frame Format, Variable length
Data unitNameFunction
Start FrameStart CharacterIndicates start of Frame
Length Field (*2)Total length of Frame
Start Character (repeat)Repeat provided for reliability
Control FieldIndicates control functions like message direction
Link Address (0,1 or 2)Normally used as the device / station address
Data Unit IdentifierType IdentifierDefines the data type which contains specific format of information objects
Variable Structure QualifierIndicates whether type contains multiple information objects or not
COT (1 or 2)Indicates causes of data transmissions like spontaneous or cyclic
ASDU Address (1 or 2)Denotes separate segments and its address inside a device
Information ObjectInformation Object Address (1 or 2 or 3)Provides address of the information object element
Information Elements (n)Contains details of the information element depending on the type
Information Object-2-----
----------
Information Object-m
Stop FrameChecksumUsed for Error checks
Stop CharIndicates end of a frame

Types supported

--

IEC 60870-5-103

IEC 60870-5-103 [IEC103] is a standard for power system control and associated communications. It defines a companion standard that enables interoperability between protection equipment and devices of a control system in a substation. The device complying with this standard can send the information using two methods for data transfer - either using the explicitly specified application service data units (ASDU) or using generic services for transmission of all the possible information. The standard supports some specific protection functions and provides the vendor a facility to incorporate its own protective functions on private data ranges.

Frame format

IEC 103 uses FT1.2 (defined in IEC 60870-5-1) for frame format having options of Frame with variable length, Frame with fixed length & single character similar to IEC 101. Single character is used for acknowledgments, fixed length frames are used for commands & variable lengths are used for sending data. However the frame format of IEC 103 differs from IEC 101 in information object address which is split into function type (ftype) and information number (inumber) in IEC 103. Also IEC 103 can have only single information object in a frame whereas IEC 101 can have multiple information objects. Many of the field sizes are also restricted in IEC 103. The details of variable length frame is given below

IEC 103 Frame Format, Variable length
Data unitNameFunction
Start FrameStart CharacterIndicates start of Frame
Length Field (*2)Total length of Frame
Start Character (repeat)Repeat provided for reliability
Control FieldIndicates control functions like message direction
Link Address (1 or 2)Normally used as the device / station address
Data Unit IdentifierType IdentifierDefines the data type which contains specific format of information objects
Variable Structure QualifierIndicates whether type contains multiple information objects or not
COTIndicates causes of data transmissions like spontaneous or cyclic
ASDU AddressDenotes separate segments and its address inside a device
Information ObjectFunction TypeProvides function type of the protection equipment used
Information NumberDefines the information number within a given function type
Information Elements (n)Contains details of the information element depending on the type
Stop FrameChecksumUsed for Error checks
Stop CharIndicates end of a frame

Supported Types

IEC 60870-5-104

IEC 60870-5-104 (IEC 104) protocol is an extension of IEC 101 protocol with the changes in transport, network, link & physical layer services to suit the complete network access. The standard uses an open TCP/IP interface to network to have connectivity to the LAN (local area network) and routers with different facility (ISDN, X.25, Frame Relay etc.) can be used to connect to the wide area network (WAN). Application layer of IEC 104 is preserved same as that of IEC 101 with some of the data types and facilities not used. There are two separate link layers defined in the standard, which is suitable for data transfer over Ethernet & serial line (PPP - Point-to-Point Protocol). The control field data of IEC104 contains various types of mechanisms for effective handling of network data synchronization.

The security of IEC 104, by design has been proven to be problematic,[2] as many of the other SCADA protocols developed around the same time. Though the IEC technical committee (TC) 57 have published a security standard IEC 62351, which implements encryption tunneling and network monitoring in an effort to address attacks such as packet replay and man-in-the-middle. Due to the increase in complexity and cost, system owners are reluctant to roll this out on their networks.

External links

Notes and References

  1. Gordon R. Clarke et al, Practical modern SCADA protocols: DNP3, 60870.5 and related systems, Newnes, 2004
  2. Maynard. Peter. McLaughlin. Kieran. Haberler. Berthold. Towards Understanding Man-In-The-Middle Attacks on IEC 60870-5-104 SCADA Networks. 2nd International Symposium for ICS & SCADA Cyber Security Research 2014. 11 September 2014. 30–42. 10.14236/ewic/ics-csr2014.5. 9781780172866. 30 June 2015. free.