Preface

Table of Contents

Communication Interfaces 1
Reyrolle 7SR5 IEC 61850 2
Communication Protocol
7SR5
DNP3 TCP 3
DNP3 4
V2.40
Modbus TCP 5
Modbus RTU 6
Manual
IEC 60870-5-103 7
Additional Features 8
Commissioning and Diagnostics 9
Troubleshooting 10

C53000-L7040-C013-1
 NOTE

i For your own safety, observe the warnings and safety instructions contained in this document, if available.

Disclaimer of Liability Copyright

Subject to changes and errors. The information given in Copyright © Siemens 2023. All rights reserved.
this document only contains general descriptions and/or The disclosure, duplication, distribution and editing of this
performance features which may not always specifically document, or utilization and communication of the content
reflect those described, or which may undergo modifica- are not permitted, unless authorized in writing. All rights,
tion in the course of further development of the products. including rights created by patent grant or registration of a
The requested performance features are binding only when utility model or a design, are reserved.
they are expressly agreed upon in the concluded contract.
Document version: C53000-L7040-C013-1.01
Edition: 04.2023
Version of the product described: V2.40
Preface

Purpose of the Manual

This manual contains information about:

• Communication within the Reyrolle 7SR5 device family and to higher-level control centers

• Setting parameters in Reydisp Manager 2

• Information on commissioning

Target Audience
This manual is mainly intended for protection system engineers, commissioning engineers, persons entrusted
with the setting, testing and maintenance of automation, selective protection and control equipment, and
operational crew in electrical installations and power plants.

Scope
This manual applies to the Reyrolle 7SR5 device family.

Reyrolle 7SR5, Communication Protocol, Manual 3

C53000-L7040-C013-1, Edition 04.2023
Preface

Further Documentation

[dw_7SR5_furtherdocumentation_communicationprotocolmanual, 4, en_US]

• Device manuals
Each device manual describes the functions and applications of a specific Reyrolle 7SR5 device. The
printed manual for the device has the same informational structure.

• Hardware manual
The hardware manual describes the hardware building blocks and device combinations of the Reyrolle
7SR5 device family.

• Operating manual
The operating manual describes the basic principles and procedures for operating and installing the
devices of the Reyrolle 7SR5 device family.

• Communication protocol manual

The communication protocol manual contains a description of the protocols for communication within
the Reyrolle 7SR5 device family and to higher-level network control centers.

• Security manual
The security manual describes the security features of the Reyrolle 7SR5 devices and Reydisp Manager 2.

• Product information
The product information includes general information about device installation, technical data, limiting
values for input and output modules, and conditions when preparing for operation. This document is
provided with each Reyrolle 7SR5 device.

• Engineering Guide
The engineering guide describes the essential steps when engineering with Reydisp Manager 2. In
addition, the engineering guide shows you how to load a planned configuration to a Reyrolle 7SR5 device
and update the functionality of the Reyrolle 7SR5 device.

4 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Preface

• Virtual Relay
The virtual relay allows a user to view, control and manipulate a virtual Reyrolle 7SR5 device. The virtual
relay is a tool that can facilitate training and understanding of the controls and functions on a Reyrolle
7SR5 device.

• Reyrolle 7SR5 catalog

The Reyrolle 7SR5 catalog describes the Reyrolle 7SR5 Reyrolle devices and the system features.

• Easy Protection Relay Selector for Reyrolle and SIPROTEC

This tool gives a quick guidance to find a protection relay of SIPROTEC 5, SIPROTEC 4, SIPROTEC Compact,
Reyrolle which would fit your needs.

Additional Support
For questions about the system, contact your Siemens sales partner.

Customer Support Center

Our Customer Support Center provides a 24-hour service.
Siemens AG
Smart Infrastructure – Protection Automation Tel.: +49 911 2155 4466
Customer Support Center E-Mail: [email protected]

Training Courses
Inquiries regarding individual training courses should be addressed to our Training Center:
Siemens AG
Siemens Power Academy TD Phone: +49 911 9582 7100
Humboldtstraße 59 E-mail: [email protected]
90459 Nuremberg Internet: www.siemens.com/poweracademy
Germany

Notes on Safety
This document is not a complete index of all safety measures required for operation of the equipment (module
or device). However, it comprises important information that must be followed for personal safety, as well
as to avoid material damage. Information is highlighted and illustrated as follows according to the degree of
danger:

! DANGER
DANGER means that death or severe injury will result if the measures specified are not taken.
² Comply with all instructions, in order to avoid death or severe injuries.

! WARNING
WARNING means that death or severe injury may result if the measures specified are not taken.
² Comply with all instructions, in order to avoid death or severe injuries.

Reyrolle 7SR5, Communication Protocol, Manual 5

C53000-L7040-C013-1, Edition 04.2023
Preface

! CAUTION
CAUTION means that medium-severe or slight injuries can occur if the specified measures are not taken.
² Comply with all instructions, in order to avoid moderate or minor injuries.

NOTICE
NOTICE means that property damage can result if the measures specified are not taken.
² Comply with all instructions, in order to avoid property damage.

NOTE

i Important information about the product, product handling or a certain section of the documentation
which must be given attention.

OpenSSL
This product includes software developed by the OpenSSL Project for use in OpenSSL Toolkit (http://
www.openssl.org/).
This product includes software written by Tim Hudson ([email protected]).
This product includes cryptographic software written by Eric Young ([email protected]).

6 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
Table of Contents

Preface.......................................................................................................................................................... 3

1 Communication Interfaces......................................................................................................................... 11
1.1 Overview.......................................................................................................................... 12
1.2 USB Communication Interface........................................................................................... 14
1.3 RS485 Connection (Com1) ............................................................................................... 15
1.4 Ethernet........................................................................................................................... 18

2 IEC 61850.................................................................................................................................................... 27
2.1 Introduction......................................................................................................................28
2.1.1 Use in 7SR5 Devices.....................................................................................................28
2.2 Protocol Characteristics in Reydisp Manager 2....................................................................29
2.2.1 Selecting the IEC 61850 Edition .................................................................................. 29
2.3 IEC 61850 Structure.......................................................................................................... 32
2.3.1 Overview of the IEC 61850 Structure........................................................................... 32
2.4 Exporting.......................................................................................................................... 33
2.4.1 Export Formats in Reydisp Manager 2.......................................................................... 33
2.4.2 Exporting IEC 61850 Description Files.......................................................................... 33
2.5 IEC 61850 System Configurator.........................................................................................35
2.5.1 Integration with the Siemens IEC 61850 System Configurator...................................... 35
2.5.2 Network Settings......................................................................................................... 36
2.5.3 IEC 61850 System Configurator................................................................................... 37
2.5.4 Importing an SCD into Reydisp Manager 2 Project Device............................................. 37
2.5.5 Importing an SCD into a Station in System Configurator............................................... 37
2.6 Protocol Properties and Implementation............................................................................ 38
2.6.1 IEC 61850 Structure of a 7SR5 Device.......................................................................... 38
2.6.2 IEC 61850 Services...................................................................................................... 39
2.6.3 Reporting.................................................................................................................... 40
2.6.3.1 What is a Report?................................................................................................... 40
2.6.3.2 Datasets.................................................................................................................41
2.6.3.3 Static Reporting..................................................................................................... 42
2.6.3.4 Testing Protection Indications.................................................................................44
2.6.4 File Transfer................................................................................................................ 45
2.6.5 Control via IEC 61850.................................................................................................. 46
2.6.6 Measured Values and Measured-Value Description....................................................... 48
2.6.7 Device Time.................................................................................................................50
2.6.7.1 Description............................................................................................................ 50
2.6.7.2 Determining the ClockNotSynchronized Value........................................................ 52
2.6.7.3 Determining the ClockFailure Value........................................................................ 53
2.6.8 Asset Management......................................................................................................53

Reyrolle 7SR5, Communication Protocol, Manual 7

C53000-L7040-C013-1, Edition 04.2023
Table of Contents

3 DNP3 TCP.................................................................................................................................................... 55
3.1 Protocol Characteristics..................................................................................................... 56
3.1.1 Protocol Structure........................................................................................................56
3.1.2 Transfer through Ethernet........................................................................................... 61
3.1.3 Functional Scope......................................................................................................... 62
3.1.4 Fault Record Transfer...................................................................................................67
3.1.5 Buffered Events........................................................................................................... 68
3.1.6 Amount of Mappable Information................................................................................68
3.1.7 Additional Information................................................................................................ 68
3.2 Settings and Properties..................................................................................................... 71
3.2.1 Settings for Communication through Ethernet............................................................. 71

4 DNP3........................................................................................................................................................... 79
4.1 Protocol Characteristics..................................................................................................... 80
4.1.1 Functional Scope......................................................................................................... 80
4.1.2 Miscellaneous............................................................................................................101
4.2 Settings and Properties................................................................................................... 102
4.2.1 Setting for the Serial connection................................................................................ 102
4.2.2 Device Mapping and configuration.............................................................................103

5 Modbus TCP.............................................................................................................................................. 125

5.1 Protocol Characteristics................................................................................................... 126
5.1.1 Modbus TCP use in 7SR5 Devices............................................................................... 126
5.1.2 Protocol Structure......................................................................................................126
5.1.3 Exception Response of Modbus Slave......................................................................... 126
5.1.4 Supported Modbus Addresses.................................................................................... 126
5.1.5 Supported Modbus Functions.................................................................................... 127
5.1.6 Data Type Definition.................................................................................................. 127
5.1.7 Multi-Connection to Master via Modbus..................................................................... 130
5.1.8 Operating Modes.......................................................................................................130
5.1.9 Parallel Running with IEC 61850................................................................................ 130
5.2 Settings and Properties................................................................................................... 132
5.2.1 Device Mapping and Configuration............................................................................ 134

6 Modbus RTU..............................................................................................................................................137
6.1 Protocol Characteristics................................................................................................... 138
6.1.1 Device Mapping and configuration.............................................................................147
6.2 Settings and Properties................................................................................................... 152

7 IEC 60870-5-103........................................................................................................................................155
7.1 Protocol Characteristics................................................................................................... 156
7.2 Settings and Properties................................................................................................... 163

8 Additional Features.................................................................................................................................. 169

8.1 Activation of Services...................................................................................................... 170
8.2 List of Required Open Ports............................................................................................. 171
8.3 Reydisp Manager 2 Protocol............................................................................................ 172
8.4 Ethernet Time Zone........................................................................................................ 173
8.5 SNTP...............................................................................................................................174

8 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Table of Contents

8.6 IEEE 1588....................................................................................................................... 177

8.7 RSTP............................................................................................................................... 179
8.8 PRP................................................................................................................................. 183
8.9 HSR.................................................................................................................................184
8.10 SNMP..............................................................................................................................185
8.11 EN100 Homepage...........................................................................................................195
8.12 Secure MMS....................................................................................................................206
8.13 Syslog.............................................................................................................................207
8.14 Modbus Client.................................................................................................................208

9 Commissioning and Diagnostics.............................................................................................................. 211

9.1 Prerequisite.....................................................................................................................212
9.2 Settings of the Internal Switches..................................................................................... 214
9.3 Diagnostic Information for DNP3 or Modbus.................................................................... 215
9.4 Diagnostic Information for Time Synchronization.............................................................220
9.5 Further Checks................................................................................................................221

10 Troubleshooting....................................................................................................................................... 223
10.1 RS485 Serial Communication.......................................................................................... 224
10.2 7SR5 to Reydisp Manager 2 from USB port.......................................................................225
10.3 Ethernet Communication................................................................................................ 226

Reyrolle 7SR5, Communication Protocol, Manual 9

C53000-L7040-C013-1, Edition 04.2023
10 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
1 Communication Interfaces

1.1 Overview 12
1.2 USB Communication Interface 14
1.3 RS485 Connection (Com1) 15
1.4 Ethernet 18

Reyrolle 7SR5, Communication Protocol, Manual 11

C53000-L7040-C013-1, Edition 04.2023
Communication Interfaces
1.1 Overview

1.1 Overview
The relay data communication facility is compatible with control and automation systems and PCs running
Reydisp Manager 2 suite of software. The relay can provide the following:

• Operational information

• Post-fault analysis

• Parameter interrogation

• Device configuration
This section describes how to use the communication interface with a control system or interrogating a
computer. An appropriate software application within the control system or on the interrogating computer is
required to access the interface.
The device data communication facility incorporates the protocols selected by you and provides compatibility
with control and automation systems.
This section specifies connection details and configuration capabilities for the device over serial and Ethernet
connections using the IEC 60870-5-103, DNP3 serial, DNP3 TCP, Modbus RTU, Modbus TCP protocols and IEC
61850.
You can download the configuration software from www.siemens.com/reyrolle.
This section specifies connection details and lists the information available through the individual protocols.

Figure 1-1 7SR5 Size 6 Device (Front) Figure 1-2 7SR5 Size 12 Device (Front)

Figure 1-4 7SR5 Size 12 Device (Rear)

Figure 1-3 7SR5 Size 6 Device (Rear)

The device provides 1 front USB communication interface on the fascia and 1 RS485 (Com1) on the rear
along with 2 Ethernet ports on the rear. The Ethernet ports can be ordered for connection with Electrical RJ45
or Optical LC access. The access to the communication settings for the USB port is available from the front
menu structure via the keypad setting menu Communications or through the parameter configuration PC
software.

12 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Communication Interfaces
1.1 Overview

Communication interface

• USB
The Com2-USB port is used for configuring the device with Reydisp Manager 2 software and allows the
updating of firmware and downloading of device data files.
For security reasons the USB port can be configured to be switched Off.

• Com1-RS485
The Com1-RS485 port can be used for DNP3 Serial, IEC 60870-5-103 or Modbus RTU communications to
a substation SCADA, integrated control system, or engineer remote access.
The port can be independently mapped to the DNP3 Serial, IEC 60870-5-103, Modbus Client, or
Modbus RTU protocol or switched off in the device configuration.

• • Comx-Ethernet
The Ethernet ports can be used for IEC 61850, Modbus TCP, and DNP3 TCP communications to a substa-
tion SCADA, integrated control system, or engineer remote access using Reydisp Manager 2 configuration
software.
For security reasons the Ethernet ports are configured by defualt to have IP address 0.0.0.0, and are
therefore not operational.

NOTE

i Not all device models support Modbus Client. The protocol selection option is only visible when 49TS
Temperature Sensor Supervision inputs are included in the device configuration and internal
sensors are not available in the hardware.

Reyrolle 7SR5, Communication Protocol, Manual 13

C53000-L7040-C013-1, Edition 04.2023
Communication Interfaces
1.2 USB Communication Interface

1.2 USB Communication Interface

The USB communication port is connected to the relay using a standard USB connector type B and to the PC
using a standard USB connector type A.
A USB connection type B is provided for local connection to a PC on the device front fascia. A cover provides
protection for the connector against pollution and humidity.
USB User interface
Connection USB type B

Insulation class PELV (Protective Extra Low Voltage) (According to IEC 60255‑27)

When Reydisp Manager 2 software is installed, a suitable USB driver is installed in the PC automatically, by
default the IP address of the USB port is 192.168.2.1.
The USB communication interface on the relay and its associated settings are located in the Configura-
tion/Communications menu. When connecting to Reydisp using this connection, the default settings can
be used without changing any settings.

Table 1-1 USB Interface (Com2)

Setting Name Range/Options Default Setting Notes

USB Mode Local Local – See Device Operation
Remote mode for further informa-
Local or Remote tion.

[dw_7SR5_communication_to_front_USB_port, 1, en_US]

Figure 1-5 Communication to Front USB Port

14 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Communication Interfaces
1.3 RS485 Connection (Com1)

1.3 RS485 Connection (Com1)

The 2 wire RS485 communication port is located on the rear of the device and can be connected using a
suitable RS485 120 Ω shielded twisted pair cable.

Table 1-2 RS485 Data Communication Interface

Physical layer Electrical

Connection (RS485)

Recommended cable 120 Ω screened twisted pair (STP) cable

Recommended external RTU 120 Ω, 0.5 W
terminating resistor Last relay 120 Ω, 0.5 W
Connectors Pin crimp

The RS485 electrical connection to the SCADA can be used in a single or multi-drop configuration.
When the bus is constantly driven by the master or a long line is used (>50 m) then termination may be
required – a 120 Ω 1/2 W resistor at each end of the bus connected between the A and B terminals.
When the bus is driven with an ADE converter, the terminating resistor will not normally be required.

NOTE

i If any comms errors are encountered in either situation, then apply or remove termination as appropriate.

The polarity of the signal terminals is marked as A and B which is in line with the RS485 standard. When the
bus is in the idle state and no communication is taking place, the polarity of terminal B is more positive that
of terminal A. These terminals can be used to identify the polarity of any equipment to be connected, typically
measured at each terminal in turn to ground. Figure 1-8 shows the connection of the device to a termination
network at the end of the bus and suits the idle state.
The polarity marking is often found to be reversed or marked as ± on other equipment so care is required. If
the devices are connected in reverse, then communication to all devices is disturbed without any damage. If
problems are experienced during commissioning, perform the connections in reverse.
The maximum number of relays that can be connected to the bus is 64.
When using the RS485 interface, you must configure the following settings in the following settings on the
Communications menu:

Table 1-3 RS485 Interface (Com1)

Setting Name Range/Options Default Setting Notes

COM1-RS485 OFF OFF – The protocol is used
Protocol DNP3 to communicate on the
Modbus RTU standard RS485 connec-
tion.
IEC 60870-5-103
Modbus Client is not avail-
Modbus Client
able in all device models.
COM1-RS485 0 to 254 for IEC 60870-5-103 1 – To identify the relay,
Station address 1 to 247 for Modbus RTU provide an address within
0 to 65534 for DNP3 the range of the relevant
protocol. Each relay in
a network must have a
unique address.

Reyrolle 7SR5, Communication Protocol, Manual 15

C53000-L7040-C013-1, Edition 04.2023
Communication Interfaces
1.3 RS485 Connection (Com1)

Setting Name Range/Options Default Setting Notes

COM1-RS485 75 19200 – The baud rate set on all
Baud rate 110 the relays connected to
150 the control system must
be the same as the one
300
set in accordance with the
600 master device.
1200
2400
4800
9600
19200
38400
57600
115200
230400
COM1-RS485 NONE NONE – The parity set on all the
Parity ODD relays connected to the
EVEN control system must be
the same as the one set
in accordance with the
master device.
COM1-RS485 Local Local or Remote – –
Mode Local or Remote
Remote

NOTE

i When setting dependencies are enabled, some parameters may not be visable from the device fascia.

Connection – 2 Wire

[dw_connection2wire, 1, en_US]

Figure 1-6 Communication to Multiple Devices using RS485 1 pair screened connection

16 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Communication Interfaces
1.3 RS485 Connection (Com1)

Connection – 1.5 Pair Wire

[dw_connection_1.5wire, 2, en_US]

Figure 1-7 Communication to Multiple Devices using RS485 1.5 pair screened connection

[dw_7SR5_RS485PortComm, 1, en_US]

Figure 1-8 RS485 Biasing Connection Polarity

Display of RS485 Information on the Device

The information about the RS485 connection is displayed on the device HMI in the Instruments/Communi-
cation Meters.
The display shows:

• Com1-RS485

• Tx1 – Transmitted Data

• Rx1 – Received Data

• Rx1 Errors

Reyrolle 7SR5, Communication Protocol, Manual 17

C53000-L7040-C013-1, Edition 04.2023
Communication Interfaces
1.4 Ethernet

1.4 Ethernet
Ethernet Interface
Integrated Ethernet Interface
The device is supplied with 2 integrated Ethernet ports. Ordering options allow the user to select between
Electrical RJ45 or Optical LC interfaces.
This terminal is used to load the device with Reydisp Manager 2 device configuration using Ethernet. This
terminal also enables IEC 61850, Modbus TCP, and DNP3 TCP Ethernet communication.

Electrical Ethernet Interface (RJ45)

Interface Integrated ethernet interface

Connection

(1) LED 1: Green

(2) LED 2: Yellow
Connector type 2 x RJ45
Baud rate 100 Mbit/s
Maximum line length 20 m with ethernet patch cable CAT 5/CAT 6
Insulation class SELV (IEC 60255‑27)
Connector interface design Corresponds to IEEE 802.3, 100Base‑TX
Recommended cable Minimum: Category 5 S/FTP (shielded/screened twisted pair)
Test voltage (with regard to socket) AC 500 V 50 Hz
Indication Yellow Continuously lit: 100 Mbit Not lit: 10 Mbit
Green Flashing: Telegram reception Continuously lit: No communication

Pin Signal Signal Description

1 ETH_TX_P Transmit data +
2 ETH_TX_N Transmit data -
3 ETH_RX_P Receive data +
4 – –

18 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Communication Interfaces
1.4 Ethernet

Pin Signal Signal Description

5 – –
6 ETH_RX_N Receive Data -
7 – –
8 – –
Screen Shield potential

Optical Ethernet Interface (LC)

Physical layer Fibre optic

Connectors

Recommended fibre 62.5 μm/125 μm glass fibre with duplex‑LC connector

Transmission speed 100 MBit/s
Optical wavelength 1300 nm
Max. line length 2 km for 62.5 μm/125 μm and 50 μm/125 μm optical fibres
Transmit Power Minimum Typical Maximum
50 μm/125 μm, NA1 = 0.2 -24 dBm -21 dBm -17 dBm
62.5 μm/125 μm, NA1 = 0.275 -20 dBm -17 dBm -14 dBm
Reciever sensitivity Maximum -12 dBm
Minimum -31 dBm
Optical budget Minimum 7 dB for 50 μm/125 μm, NA1 = 0.2
Minimum 11 dB for 62.5 μm/125 μm, NA1 = 0.275
Interface design Corresponds to IEEE 802.3, 100Base-FX
Laser class 1 as per EN 60825-1/-2 With the use of 62.5 μm/125 μm and 50 μm/125 μm optical
fibres

Device Parameters
When using the Ethernet interface, you must configure the following settings in the following settings on the
Communications menu:

Table 1-4 Ethernet Protocol (Ch1/Ch2)

Setting Name Range/Options Default Setting Notes

Ethernet Mode Local Remote – See Device Oper-
Remote ation mode for
Local or Remote further information.

1 Numerical aperture (NA = sin θ (launch angle))

Reyrolle 7SR5, Communication Protocol, Manual 19

C53000-L7040-C013-1, Edition 04.2023
Communication Interfaces
1.4 Ethernet

Network Parameters
When using the Ethernet interface, you must configure the following network settings in the following
settings on the Configure Interface menu:
This can only be done from the PC software tool.

[sc_7SR5_ReydispManager2IPAddressTab, 2, --_--]

Figure 1-9 Configure Interface Menu

MAC Address
The MAC address is a transparent address that is permanently stored in the module. It is a worldwide unique
identifier for the module. That means the devices can be integrated into any network. The user can only read
the MAC address but not change it. The MAC address can be viewed on the device fascia in the Instruments >
Communications meter.

IP Address
The IP address is also a unique identifier for a TCP/IP link. It is a 32-bit-wide number.
The IP address is assigned during configuration of a network in a station. It can be set during device parame-
terization for a stand alone device and can also be set in the IEC 61850 System Configurator when the
device is associated with a station.

20 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Communication Interfaces
1.4 Ethernet

Subnet Mask
This mask must be set according to the addressing scheme of the network.

Gateway Address
This is the IP address of the gateway. It is required whenever an address outside the LAN of the station is to be
accessed. It can be set during device parameterization for a stand alone device and can also be set in the IEC
61850 System Configurator when the device is associated with a station.

NOTE

i The IP address 192.168.2.1 of the front port is reserved and should never be used in the network.

SNTP Address
This address is also a TCP/IP address with which the 2 time servers, settings for the IP address, subnet mask,
and gateway can be accessed in the network to ensure precise time synchronization of all devices.

PTP
IEEE 1588 network clock support can be enabled and the clock type and profile selected. Ordinary Clock Slave
only, profile IEC 61850-9-3:2016 and Domain 0 are the only supported options and no change is possible.

Syslog Server
The IP address and associated port for up to 2 Syslog servers can be enabled and configured. The syslog
server provides a security audit trail which chronologically acquires and categorizes security-relevant events
according to the origin and severity. The 7SR5 devices automatically send the security-relevant events to an
external syslog-server.

SNMP
This protocol has been implemented in order to have access to information in a network in which other units,
such as external switches, are administered as well. On the basis of this protocol, the accessible information
can be invoked with any MIB browser. The MIB descriptions required for this are available on the internet
at www.siemens.com/reyrolle. In particular, the statuses of the 2 lines are readable via SNMP using a MIB
browser. This protocol is implemented in all modules.

Display of the Network Parameters on the Device

The parameters of the interfaces can be viewed on the device display. This is done by entering the operating
menu from the initial display via the menu key.
There, displays are accessible via the Instruments/Communication Meters.
The display includes:

• Mac address

• IP address

• Subnet mask

• Gateway

• NTP sync

• Link type
This shows the settings with which the device is working and that constitute part of the parameter set. The
settings can only be changed via the Reydisp Manager 2 parameterization system.

Reyrolle 7SR5, Communication Protocol, Manual 21

C53000-L7040-C013-1, Edition 04.2023
Communication Interfaces
1.4 Ethernet

Operation of Ethernet Interface

The Ethernet interface can be operated optionally with or without integrated switch function. This applies
for the electrical as well as the optical interface. This function can be selected via the parameterization. The
Ethernet modules are compatible with the EN100 modules of the Reyrolle 7SR1/2 series devices and SIPROTEC
4 and 5 series. If the RSTP protocol or the HSR protocol is active, the modules of the 7SR1/2, SIPROTEC 4 series
and the SIPROTEC 5 series can be operated in a ring.
When using 7SR1/2 or SIPROTEC 4 devices with module firmware ≤ V4.05 and SIPROTEC 5 devices, the
maximum allowable number of participants is 30 devices. When using 7SR1/2, devices, or SIPROTEC 4 devices
with module firmware ≥ V4.07 and SIPROTEC 5 devices, the maximum allowable number of participants is 40
devices. When using 7SR5 devices, the maximum allowable number of participants is 40 devices.
Figure 1-14 shows operation of the Ethernet modules with integrated switch function. All devices of a station
are shown which are connected to one another by means of optical fibers. The devices form optical rings.
In addition, 2 switches are used on the substation controller for the SICAM PAS. The 2 switches take the
requirements for the redundancy into account.

Network Structures
The Ethernet communication interface is available in both electrical and optical versions. Both types are
provided with an integrated switch functionality. This makes it possible to integrate the devices into almost all
network structures together with third-party components.
The network structures are independent of the serial communication protocol (IEC 60870-5-103, DNP3 and
Modbus).
The interfaces on the devices can be used in different operating modes. A distinction is drawn between the
operating modes Line and Switch.

Simple Structure
Such a structure always requires so-called switches. A switch is a device to which devices are connected via
2 or more connections. It forms the hub at the center of a star topology. Switches can be interconnected to
produce networks of different sizes.

[dw_7SR5_DeviceConnected1Link, 1, en_US]

Figure 1-10 7SR5 Devices Connected Via 1 Link

As is shown in Figure 1-10, one device is connected to each port of a switch. The link shown is an Ethernet
link. The modules have 2 connectors of which only one is active at any one time. The connector selection
is detected automatically by the module. This type of structure can be realized with all module types. The
redundancy type has to be set to 'Line' mode.

Line Mode
Ethernet modules have generally 2 interfaces which are designed for either electrical or optical interfacing.
This means that they can communicate via 2 Ethernet cables, but not simultaneously. The second channel
is a standby. This results in the network structures shown in Figure 1-11 illustrating connection of 2 links to
different switch ports. The redundancy type has to be set to Line mode.

22 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Communication Interfaces
1.4 Ethernet

[dw_7SR5_DeviceConnected2Link, 1, en_US]

Figure 1-11 7SR5 Devices Connected Via 2 Links

The 2 physical links are monitored for their connection. This enables generation and output of a message if a
link is broken. This message is to be found in the message buffer and can be routed to contacts, LED, or in the
logic editor (CFC).

PRP-Structure
The PRP structure (Parallel Redundancy Protocol according to IEC 62439-3:2012) provides communication over
2 independent networks (LAN A and LAN B) simultaneously. As shown in the following figure both networks
may under no circumstances be connected to one another. Siemens recommends building both networks
identically. Connect LAN A with channel 1 and LAN B with channel 2.

[dw_7SR5_DeviceConnected2Networks, 1, en_US]

Figure 1-12 7SR5 Devices Connected Via 2 Independent Networks (LAN A and LAN B)

In case of an interrupted network communication the device switches seamlessly.

Channel Switchover in “Line” Mode

If the active link, i.e. the link transmitting data between the device and the external switch, is broken,
the interruption is detected and signaled by the link mentioned above. When an interruption is detected,
switch to the second channel is performed immediately so that data exchange can continue almost without
interruption. The interruption signal is then transmitted via the standby channel.
Failure of the external switch
If both links are connected to ports in different switches, failure of one external switch does not interrupt the
connection with the master. All devices with an active link via the failed switch switchover to their second
link that is connected to another switch, and operation can continue. The external switches are normally
connected via a ring structure, so that they realize their own redundancy between themselves.

Ring Structure
Ring structures mean that all devices are connected in a ring, as shown in Figure 1-14. However, this
operating mode requires 2 ports which actively transmit data. This includes an appropriate network control
system. The prerequisite for such a structure is the integrated switch functionality.

Switch Function (Internal Switch)

The switch function provides the connection with the device, as well as a connection with the 2 other ports
which then implement a ring structure. This 3-port switch is controlled so that only those telegrams which are

Reyrolle 7SR5, Communication Protocol, Manual 23

C53000-L7040-C013-1, Edition 04.2023
Communication Interfaces
1.4 Ethernet

intended for the device are actually routed to it. Telegrams transmitted by the device are fed into the data
stream on the ring. The basic structure of such an integrated switch is shown in Figure 1-13.

[dw_7SR5_PrincipleOfIntegralSwitch, 1, en_US]

Figure 1-13 Principle of Integral Switch

Operating Mode RSTP

This operating mode allows the kind of structure shown in Figure 1-14. Its characteristic feature is that all
devices are arranged in a ring; one or more external switches must be integrated into this ring for the output
of data, e.g. for display or for transmission into a different network.

[dw_7SR5_DevicesWithIntegratedSwitch, 1, en_US]

Figure 1-14 7SR5 Devices with Integrated Switch

If the ring which includes the devices and the switch is broken, the ring becomes a line, and the functionality
is maintained almost without interruption. If the ring is broken in a second place, the structure cannot handle
the resulting double error any more, and one part of the line will be disconnected. This means that only single
errors resulting from a broken ring can be handled.

HSR Structure
The devices are arranged in rings in the HSR structure (High-availability Seamless Redundancy according to IEC
62439-3:2012) shown in the following figure. The procedure does not have parameters of its own.

[dw_7SR5_DevicesConnectedInRings, 1, en_US]

Figure 1-15 7SR5 Devices Connected in Rings

A seamless switchover will take place if an interruption in communication occurs in a network. All components
in HSR rings must support HSR. If you do not want to connect HSR-enabled devices, use special switches that
support HSR.

24 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Communication Interfaces
1.4 Ethernet

Updating the Device Configuration via Rear Ethernet Port Communication Modules in the PRP Structure
If the device is updated using Reydisp Manager 2 over the Ethernet port, the device will revert to Line Mode
and not be available for IEC 61850, Modbus TCP, and DNP3 TCP communication. If the Reydisp Manager 2
PC is inserted to the PRP network via a RedBox (Redundancy Box), the communication to the terminal device
continues to function in the PRP structure with the Line Mode network redundancy protocol.

NOTE

i Communication problems can occur if you insert a PC as SAN (Single Attached Node) into a PRP structure,
for example, by loading the configuration when using IEC 61850. Therefore, Siemens recommends using a
PC in a PRP network with a RedBox (Redundancy Box).

Reyrolle 7SR5, Communication Protocol, Manual 25

C53000-L7040-C013-1, Edition 04.2023
26 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
2 IEC 61850

2.1 Introduction 28
2.2 Protocol Characteristics in Reydisp Manager 2 29
2.3 IEC 61850 Structure 32
2.4 Exporting 33
2.5 IEC 61850 System Configurator 35
2.6 Protocol Properties and Implementation 38

Reyrolle 7SR5, Communication Protocol, Manual 27

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.1 Introduction

2.1 Introduction

2.1.1 Use in 7SR5 Devices

The IEC 61850 protocol is implemented on an Ethernet interface. This permits communication between the
client and the server for substation automation via the IEC 61850 MMS protocol (MMS – Manufacturing
Message Specification) and GOOSE messages (GOOSE – Generic Object-Oriented Substation Event). The
Ethernet interface comes with 2 RJ45 connectors or with 2 duplex-LC interfaces for a 1300-nm fiber-optic
connection. The physical interface is always duplicated to permit redundant networks. The Ethernet module
has 1 IP address.
You can use Reydisp Manager 2 to set the IEC 61850 protocol for the Ethernet module. It is also used to
make all necessary network settings. Various editors are available for the different protocol services listed in
the IEC 61850 Standard. The IEC 61850 object image of a device can be configured flexibly to meet your
requirements. 7SR5 devices support the Editions 1 and 2 of IEC 61850. To provide complete compatibility with
existing Edition 1 devices, you can use Reydisp Manager 2 to switch the IEC 61850 server of the device to the
Edition 1 mode. The IEC 61850 server then operates together with Edition 1 clients and exchanges GOOSE
messages with Edition 1 devices.
The IEC 61850 modules must be provided with special information for parameterization.

Storage of the Parameter Set

During device start-up, the parameter set of the device is first activated for the Ethernet module and then the
module is started.

Information in the Parameter Set

The parameter set contains extensive information, such as the individual objects for the devices to which the
objects of the IEC 61850 must be mapped. The user has no part in this mapping. The user may view it but not
change it. However, devices with different function scope and type have different mappings.

Network Parameterization
This block of parameters describes settings that concern the entire IEC 61850 network within a substation.
These settings are especially relevant for parameterization of peer-to-peer data traffic using GOOSE. The
parameters themselves are unavailable to the user. The parameterization of the network is performed with the
IEC 61850 System Configurator whose online help can be used to obtain detailed information.

IEC Object Description via ICD File

The IEC 61850 protocol represents the necessary objects of the devices externally. These objects are contained
in an ICD file in compliance with the standard. This file is contained in the parameterization system and is
essential for integrating devices into a network. The same goes for devices of other manufacturers.
For these, too, a description must exist in an ICD file if they are to be integrated into a network. ICD files can
be imported and exported by Reydisp Manager 2, which is necessary for integration of devices from other
manufacturers and of 7SR5 devices in Non-Reyrolle networks.

Station Description via SCD File

A complete station is formed by several devices. These components have various communication connections
between them that must be parameterized. The description of all devices,and their settings and interrelations
are grouped together in the station description file. The file itself is created and processed using the IEC 61850
System Configurator. The IEC 61850 System Configurator is started from the station in Reydisp Manager 2.
SCD files can also be imported and exported there.

28 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.2 Protocol Characteristics in Reydisp Manager 2

2.2 Protocol Characteristics in Reydisp Manager 2

2.2.1 Selecting the IEC 61850 Edition

To begin the engineering of 7SR5 systems with IEC 61850, create a project and specify the IEC 61850 edition
individually for each device.

NOTE

i Edition 1 is the default setting.

You can set the edition for each device individually.
If you have selected Edition 1, you can upgrade to Edition 2. Switching from Edition 2 to Edition 1 is not
possible however, because functionality would be lost.
If you export project or device configuration data, they are exported in the established edition.

When adding a new 7SR5 device to the Reydisp Manager 2 project the user is required to enter the IEC 61850
IED name and selection between Edition 1 and Edition 2 of the standard. For IEC 61850, you can make the
following setting changes after the initial adding of the device for IEC 61850 in Reydisp Manager 2 under
Device > Properties:

[sc_7SR5_IEC61850Settings, 1, --_--]

Figure 2-1 Device Settings for IEC 61850

Parameters Meaning
IEC 61850 Edition Selection between Edition 1 or Edition 2 of the protocol.
IEC IED Name Each device must be given a unique IED name which must start with a letter
and must not contain spaces.
Only alpha numeric characters are accepted and no special characters.
Maximum length is 13 characters.

Adding an IEC Station

² Open the project tree.
² Right-click on the folder in the project tree.
The element New Station is displayed.

Reyrolle 7SR5, Communication Protocol, Manual 29

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.2 Protocol Characteristics in Reydisp Manager 2

[sc_7SR5_ReydispManager2NewStation, 2, --_--]

Figure 2-2 New Station Option

² Click New Station.

The new station is created.

[sc_7SR5_ReydispManager2NewStationProjectTree, 2, --_--]

Figure 2-3 New Station Created

NOTE

i You cannot cut, copy, or paste IEC stations.

Assigning a Device to an IEC Station

In the Station Configuration Editor, the list of devices that can be assigned to an IEC station is
displayed with the device name, IEC 61850 IED name, and location information columns under the Unas-
signed devices group.

NOTE

i The following devices can be displayed in the Available devices group:

• Devices with activated IEC capability.

• Devices that do not yet belong to the IEC station.

² Select one or more of the devices displayed under Unassigned devices.

30 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.2 Protocol Characteristics in Reydisp Manager 2

² With the Add button, you can assign the device or devices to an IEC station.
- or -
² Close the Station Configuration window.

Upgrade of the IEC 61850 Edition within the IEC Station

You can upgrade the IEC 61850 Edition of the devices within the IEC station from Edition 1 to Edition 2. When
the station is opened in the system configurator tool the IEC station will be automatically given the edition of
the highest edition of any of the assigned devices.

NOTE

i In devices that are not yet assigned to the IEC station, the Edition of the devices remains set as in the
devices. In this case, only devices that have the same Edition as the IEC station can later be assigned to this
IEC station.

² In the IEC 61850 stations section, click the desired IEC station and select the context menu Properties.
² In the dialog, under IEC Edition, select IEC 61850 Edition 2 and click OK.

[sc_update_IEC_edition_station, 4, en_US]

Figure 2-4 Change of the IEC 61850 Edition in the IEC Station

A warning indication appears.

[sc_update_IEC_edition_station_warning, 3, en_US]

Figure 2-5 Warning in Case of a Change of the IEC 61850 Edition in the IEC Station

² Click Yes. If you click No your change is discarded.

Reyrolle 7SR5, Communication Protocol, Manual 31

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.3 IEC 61850 Structure

2.3 IEC 61850 Structure

2.3.1 Overview of the IEC 61850 Structure

The IEC 61850 structure indicates the hierarchical arrangement of the IEC 61850 elements in an application.

Application Structure and IEC 61850 Structure

The following table illustrates the assignment between the application structure and the IEC 61850 structure:
Application Structure IEC 61850 Structure
Function FN Logical device(s) (LD)
Function block FB Logical node(s) LN
Data object DO Data object DO

An application in 7SR5 devices is organized into functions. Functions can consist of one or more function
blocks.
The IEC 61850 structure is created when the device functions are added or removed in Reydisp Manager 2
Function configuration:

• The function can be added or removed from the configuration tool, this will add or remove the logical
node from the device. From function 50 Overcurrent with the function 50-1 included in the device
configuration the logical node becomes A50PTOC1 in the IEC 61850 structure. The prefix and suffix of a
logical node are predefined.

[sc_7SR5_Function50DeviceConfiguration, 1, --_--]

Figure 2-6 Function 50 Device Configuration

This IEC 61850 structure view is arranged in the 7SR5 devices with the logical devices PROT, CTRL, MEAS, and
DR predefined as fixed values. In the logical devices the function blocks are logical nodes. Logical nodes and
the superordinate controlling nodes are displayed in the sequence (Logical device, Logical node, Data object
and Data attributes).

[sc_7SR5_Function50LogicalNode, 1, --_--]

Figure 2-7 Logical Node A50PTOC1

32 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.4 Exporting

2.4 Exporting

2.4.1 Export Formats in Reydisp Manager 2

Export files permit interoperable data exchange of IEC 61850 data between the configuration tools of various
manufacturers. They can be used for documentation purposes or in other IEC 61850 configurators.
The following export formats are available at the device level to export device-specific IEC 61850 data:
Data Format Meaning Export Source Import Target
ICD IED Capability Description Device — Device —
SCD Substation Configuration Description — IEC — IEC Station
Station
MICS RTF/HTML Model Implementation Conformance Device — — —
Statement
HTML Protocol settings from IEC 60870-5-103, Device — — —
Modbus & DNP3 Serial
Zip Export project for archive — Project — Project

MICS
This file is the XML description of the device data model in a rich text or HTML format for documentation and
information purposes.

2.4.2 Exporting IEC 61850 Description Files

IEC 61850 description files include, for example, ICD. They include descriptions of the performance properties
of an IED.
² In order to export IEC 61850 description files, highlight the device in the project tree.
² Select the Export ICD function from the Tasks window.
The export dialog appears. You can select a location to save the ICD file and name the file.

[sc_7SR5_ExportICD, 1, --_--]

Figure 2-8 Export ICD

Exporting MICS
² In order to export the MICS file, highlight the device in the project tree.
The MICS file is an XML file. 2 other files are exported. These files enable formatting the MICS XML file for
visualization and for printing with a browser or for using an XML editor. Siemens recommends exporting
these files into a separate directory, for example, c:/Temp/MICS.
² Select the Export IEC61850 MICS function from the Tasks window.
The export dialog appears. You can select a location to save the ICD file and name the file .

Reyrolle 7SR5, Communication Protocol, Manual 33

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.4 Exporting

[sc_7SR5_ReydispManager2ExportIEC61850MICS, 1, --_--]

Figure 2-9 Export IEC 61850 MICS

The homepage of the MICS file is displayed in the browser when saved as a HTML file and opened.
The subsequent pages show all IEC 61850 logical devices and logical nodes of the device. From there, you can
navigate via hyperlinks to the further details. You can navigate through the entire IEC 61850 data structure of
the device and find all the definitions of data objects in the chapters of the data types. You can also save as
an .rtf file but the browser view is more comfortable.

[sc_7SR5_MICSFileHomepage, 1, --_--]

Figure 2-10 Homepage of the MICS File

34 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.5 IEC 61850 System Configurator

2.5 IEC 61850 System Configurator

2.5.1 Integration with the Siemens IEC 61850 System Configurator

System Parameterization
System parameterization is only performed after parameterization of the device. The Digsi IEC 61850 System
Configurator is used to do this. Alternatively a 3rd party tool can be used.
As part of system parameterization, the ICD files of each device are imported and the complete station is
assembled using the information they contain. Distribution of the IP and multicast addresses as well as subnet
masks is performed in the IEC 61850 System Configurator. It is also used to produce and parameterize the
inter-device communication, i.e. the link from objects of one device to those of other devices. This defines and
routes direct flows of information between devices.
Only after completion of system parameterization is the parameter sets generated for the individual devices.
These now contain the links with other devices in the network and only then is the complete station fully
functional. The station-wide parameterization information can be exported in an SCD file.
² Create a new IEC 61850 station by clicking Add New Station under IEC 61850 Stations in the Project
tree.
A new IEC 61850 station IEC station 1 is created.
² Select the IEC 61850 station and assign the devices as described in 2.2 Protocol Characteristics in Reydisp
Manager 2

NOTE

i You can only assign a device to one station.

² Open the IEC 61850 System Configurator if installed.

[sc_7SR5_SysConfig, 1, --_--]

Figure 2-11 System Configurator

NOTE

i The Digsi system configurator can be purchased as a standalone IEC 61850 System Configuration tool
and is not installed with Reydisp Manager 2. If Digsi is already installed on the PC with a licensed system
configurator, Reydisp Manager 2 will automatically detect and use it.

² Check the Edition number of the Station in the Devices > Station > Properties.

Reyrolle 7SR5, Communication Protocol, Manual 35

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.5 IEC 61850 System Configurator

[sc_7SR5_SysConfigEditionNumberCheck, 1, --_--]

Figure 2-12 Edition Number Check

² Change the Edition number of the Station in the Devices > Station > Properties if required.

[sc_7SR5_SysConfigEditionNumberChange, 1, --_--]

Figure 2-13 Edition Number Change

2.5.2 Network Settings

The network is shown as a tree. The root of the tree is the station to which subnets are assigned that then
contain devices.
The station, devices, and subnets can be assigned a comment or description text.

Subnets
The start address, subnet mask, and standard gateway can be set for subnets. The baud rate of the network
and type of network are also displayed. It is not necessary to change them.
The start address is only important for automatic assignment of the network addresses of the devices. In this
case, addresses are assigned to the devices starting at this address.

Devices Settings
The devices can be selected and set like subnets. The setting dialog that opens initially shows the device
properties.
In addition to the freely assignable name, the device type, device version, and manufacturer of the device are
also visible. Moreover, the ability for peer-to-peer communication, for routing, and for providing a time signal
are displayed. The only settable value is the IP address.

Setting of Routing
The setting for routing is an essential feature of the IEC 61850 System Configurator. Only then is it possible
for the devices to intercommunicate directly. Routing has its own setting dialog that lists all the devices it
contains.
Routing itself is performed by defining an application, selection of devices, and their objects that intercommu-
nicate.

Memory Management
The storage used for “Buffered Reports” of the communication module is physically restricted. The same
amount of storage capacity is provided to every report control block for the buffering of the reports per
default . The user has, however, the ability to assign individual amounts of the storage capacity dialog
controlled using the IEC 61850 System Configurator.

36 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.5 IEC 61850 System Configurator

2.5.3 IEC 61850 System Configurator

You can find more information on the following topics in the IEC 61850-System Configurator manual:

• GOOSE applications:
– GOOSE communication
– Creating a GOOSE application

• Report applications:
– Creating a report application
– Configuring the dataset
– Report control blocks

• Export of SCD/SED files

• Export of IID/CID files

2.5.4 Importing an SCD into Reydisp Manager 2 Project Device

² Select the device to import the station to.

²

Click the icon .

- or -
² Select the file from the correct location and press open.

2.5.5 Importing an SCD into a Station in System Configurator

² Select the IEC 61850 station.

² Open the Station System Configurator.
² Select Station > Import > IEC61850 station.

[sc_7SR5_IEC61850Import, 1, --_--]

Figure 2-14 Import From the IEC 61850 Station

² Locate the file to be imported and close the system configurator.

Reyrolle 7SR5, Communication Protocol, Manual 37

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

2.6 Protocol Properties and Implementation

2.6.1 IEC 61850 Structure of a 7SR5 Device

The logical devices are given with the following designations:

• PROT

• CTRL

• MEAS

• DR

[sc_7SR5_DeviceDesignations, 1, --_--]

Figure 2-15 Logical Device Designations

The logical devices contain the tripping stages, for example, protection function stages, and the superordinate
stages that control them as logical nodes.
In the logical devices the function blocks are logical nodes. Logical nodes and the superordinate controlling
nodes are displayed in the sequence (Logical device, Logical node, Data object and Data attributes).

[sc_7SR5_LogicalDeviceFunctionBlock, 1, --_--]

Figure 2-16 Logical Device Function Block

The 7SR5 device has a fixed number of Generic I/O logical nodes, GGIO class. The GGIO's can be configured
to interface with the 7SR5 device signals through the Reylogic editor in Reydisp Manager 2. A combination of
single point and double point inputs and outputs are available, with and without quality bits.
The 7SR5 device also has a fixed number of single point and double point controls with Normal or Enhanced
security and also for direct operate and select before operate options.

38 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

[sc_7SR5_SingleDoublePoints, 1, --_--]

Figure 2-17 Single and Double Points

The signals are connected within the device by dragging onto the diagram and connecting to another signal.
The signals can be used in combination with user logic diagrams or connected directly.

[sc_7SR5_UserLogicDiagram, 1, --_--]

Figure 2-18 User Logic Diagram

2.6.2 IEC 61850 Services

You can find details in PICS (Protocol Implementation Conformance Statement) which is included in the 7SR5
PIXIT document (C53000-T5040-C031-1) available to download from the website.
7SR5 devices support the following IEC 61850 services:

GOOSE Messages
Datasets are created in the device by GOOSE applications. This takes place in the logical node LLN0 of a logical
device. You can specify where these datasets are created.
The first object configured in a GOOSE message from a logical device creates a dataset for a GOOSE message
in LLN0. Further objects are configured in this dataset and added to this dataset, even if they originated in
other LDs. Alternatively, if you wish to send objects in different datasets, you can also create a new GOOSE
application and thus a new dataset.

NOTE

i Sending objects in different datasets generates unnecessary data traffic, since each dataset created is
transmitted via its own GOOSE message.

Reyrolle 7SR5, Communication Protocol, Manual 39

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

The dataset is sent as a GOOSE message and distributed to all network participants in the form of multicast
telegrams. If participants wish to receive specific objects in a GOOSE message, the user can select these
objects via the system configuration and receive them later online.
GOOSE messages are transmitted with high priority and repeated at an interval of a few milliseconds in the
event of a spontaneous change of the data object. You set the repetition time in the IEC 61850 System
Configurator.
You can find more information on GOOSE parameterization and on creating a GOOSE application in the
System Configurator manual.

Control Commands
You can control an object in a device with control commands. By using the control model Select Before
Operate, you can actuate a circuit breaker reliably, for instance. Commands without feedback can be
executed in the device as well, for example, resetting the LEDs (LED Reset) by the client.
You can find more information on the configuration and control of switching objects in chapter 2.6.5 Control
via IEC 61850.

2.6.3 Reporting

2.6.3.1 What is a Report?

When using IEC 61850 in switchgear as well, you must test communication between protection devices and
the substation automation technology just as you do with the other protocols. This requires, among other
things, the knowledge of the power system protection technician who selects and generates the signals sent
to the substation control system. Testing these connections is a basic part of commissioning.
The IEC 61850 Standard defines various types of communication.
For classic communication, for example, between the substation control system and a bay unit, the Standard
describes various services based on the data model:

• Control for controlling

• Report for transmission of indications and measured values

There are static and dynamic reports. You can find more detailed information on this in chapter 2.6.3.3 Static
Reporting.
The following sections describe reports involving data exchange between a protection or bay unit (server) and
the substation automation technology (client) and its tests. Reports are transmitted over Ethernet connections
via TCP/IP (Transmission Control Protocol/Internet Protocol).
Data objects (indications) of a device are summarized as a list in a report. For instance, indication changes,
caused for example, by a raising and cleared protection tripping event, are transmitted spontaneously from
server to client. Therefore, the client does not have to query the server cyclically, as is the case with serial
protocols, but automatically receives a notification of the event, for example, an indication change or a
change of the measured value.
If the server permits, it is also possible to have cyclic transmission of data and general interrogation. The event
control of data transmission is a property that is contained in the attributes of each report. You can affect
these properties by using the IEC 61850 System Configurator.

40 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

Buffered and Unbuffered Reports

The Standard distinguishes between Buffered Reports and Unbuffered Reports. The Buffered Report is used
most frequently today.

• Buffered Report
In the case of a Buffered Report Control Block (BRCB), internal events trigger immediate transmission
of reports. If the connection between the server and client is interrupted, indication changes in the
protection device are stored. As soon as the connection has been reestablished, these indications are
transmitted to the substation control system with a time stamp and the attribute Historic. To enable
saving to a practicable limit – as recommended in the standard – the server must have adequate storage
capacity. If an uninterrupted connection exists between the client and server, for example, in the case of
controlled operation in a switchgear, then the behavior of both procedures appear identical from the user
view of the substation control system.

• Unbuffered report
In the case of an Unbuffered Report Control Block (URCB), internal events trigger immediate transmis-
sion of reports. If there is no connection or if the transport data flow is not fast enough, events can be
lost.
Datasets are needed for reports.
Client LNs can be set. ICD files from the client are imported. Here, you will find the IP address. With this, you
can assign the report to the client. This ensures that only this client will receive the report. You can do these
settings in the System Configurator.
You can find information on subscribing to reports in the IEC 61850 Browser.

2.6.3.2 Datasets

Static and Dynamic Datasets

Every IEC 61850 service relies on data from the data model. This requires Datasets that reference actual
values in the model.
There are report datasets with data for this report, for example, indication of the positions of the disconnector
switch and circuit breaker in the feeder. These datasets can be created statically or dynamically.

Static Datasets
In the case of a static dataset, the number of indications and measured values is specified in the Report
Editor. Once these configuration data are loaded into the server, the client can no longer change the contents
of the configuration data. A fixed report that the client can retrieve is stored in the server. Changing the
number/scope of the indications requires new parameterization followed by loading to the server.
The benefit is that the data provided by a server are stored in an SCD configuration file (Station Configuration
Description). The drawback is that the settings in the server must be changed if the number/scope of indica-
tions is changed for the substation automation technology. The 7SR5 device has 2 configurable RCB in each
logical node and 100 in each of the 4 logical devices.

Dynamic Datasets
In the case of dynamic datasets, the settings in the server do not need to be changed when the number/scope
of indications changes. The client has 2 opportunities to read all data points that the server can potentially
make available:

• Offline with a configuration file (ICD or SCD file), for example, in a SICAM substation automation tech-
nology.

• Online by connection establishment to the server, for example, in the IEC Browser Test tool.
The client specifies the information that a report from a device should contain. Thus, the content of a report
is not fixed, but rather can be changed while the system is operating. The parameters set in the server do not
have to be changed.

Reyrolle 7SR5, Communication Protocol, Manual 41

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

In this way, the client can be set to watch for special indications or measured values, for instance, for only a
specific period. It can then create a report in the server, retrieve this report in order to obtain the information
and then delete the report. No classic protocol offers this flexibility.

NOTE

i Siemens supports the concept of dynamic datasets.

You can find additional information on the creation of datasets in the System configurator manual.
You can find information on creating and checking datasets in the Siemens IEC 61850 Browser PC application
tool which is distributed with DIGSI.

2.6.3.3 Static Reporting

What Is a Static Report?

In a static report, the datasets are generated by the configuration in the IEC 61850 System Configurator. Such
a dataset contains the data objects that are to be transmitted to an IEC 61850 client. This dataset is associated
with a report. There are numerous possible configurations for a report.

IEC 61850 View in the System Configurator

The devices provide a system configurator with all of the information that can be transmitted to a client
(substation control system) or between servers in the form of an ICD or IID file. In the case of protection
functions, the manufacturer specifies the number/scope of the indications. For control functions, you establish
the number/scope of indications with the configuration tool of the server. The IEC 61850 Standard defines
how this information is displayed in a separate XML scheme called SCL (Substation Configuration Language).
The system configurator displays the indication texts (Description column) together with the IEC 61850 texts
(Name column).

[sc_syscon_reports_structure, 2, en_US]

Figure 2-19 Structure in the System Configurator

Only names (designations) from the data model (IEC texts) are transmitted between client and server. In this
way, only the IEC texts can be seen in the case of eavesdropping of the Ethernet by a network sniffer.
Indications and measured values from the server of an IEC 61850 station are configured in a static report. For
this purpose, the devices are displayed as information sources in terms of their IEC 61850 structure.

Configuration of a Static Report in the System Configurator

Device View
Select only information from the Device view that you wish to configure in the report. For this, create data-
sets. Describe the datasets using the properties dialog in the IEC 61850 System Configurator. The functional

42 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

constraint data attribute (FC/DA) mapping can be changed as required to include or exclude information by
checking/unchecking the selection box for that attribute from the drop down list.

[sc_7SR5_DatasetProperties, 1, --_--]

Figure 2-20 Properties of the Dataset

Drag elements from the Source catalog into the dataset.

Right-click the dataset and select Insert report to add a ReportControlBlock (in this case: Protection) to this
dataset. You also select between a Buffered report and an Unbuffered report.

[sc_7SR5_StaticReport, 1, --_--]

Figure 2-21 Properties of a Static Report

You can find more detailed information on the Optional fields and the Trigger options in the chapter on
Report Control Blocks in the System Configurator manual.
The server specifies these properties for the report and they cannot be changed. Under Report number, you
can see the report ID (rptID). You can find the dataset under this ID to review.

Reyrolle 7SR5, Communication Protocol, Manual 43

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

All protection indications that are to be transmitted to the client are added to the dataset with the name
Protection.

[sc_7SR5_StaticReportIndications, 1, --_--]

Figure 2-22 Static Report with Protection Device Indications from the Overcurrent Protection

Server
The buffers in which the indications are located in the device are specified in the server on a manufacturer-
specific basis.
The properties of the report (dataset, trigger conditions…) are saved in so-called Report Control Blocks (RCB).
You can also change the dataset names that the system suggests (dataset) in the properties dialog of the
dataset.
To make it easier to find the data during the subsequent review, Siemens recommends that you change the
dataset name. In the example, the name of the dataset is changed to Protection.

[sc_7SR5_PropertiesDialog, 1, --_--]

Figure 2-23 Properties Dialog for a Dataset with Protection Device Indications

Test Mode
All data objects can be identified with a test flag. If the function block to which the data object belongs is in
Test mode, then the test flag for a date object has been set. However, not all objects that are received via
communication are identified with the test flag by the test mode of the function block. Input proxy objects, for
example, contain the test flag that was received via communication.
The Test mode of a function block can be simulated by the following actions:

• The function block has been placed in test mode by the parameter Mode or by the controllable Mod.

• The entire device has been placed in the application test mode (HMI: Device functions/Operating modes/
test).
If the reports have been configured, the data are written to an SCD file (Substation Configuration Description
File) after the export. This file is important for loading the data in the device that is simultaneously the
IEC 61850 server. To import indication lists into the client, use the SCD file. In this way, the client knows the
scope of the reports and the datasets that contain the information. This standardized data exchange is a great
benefit compared to previous substation control protocols in which manufacturer-specific indication lists are
exchanged in proprietary file formats or manually. The SCD file can be exported from the IEC 61850 System
Configurator and is available as an input to the test program.

2.6.3.4 Testing Protection Indications

Using Reports to Test Protection Indications

² Create a report for the protection indication and connect the dynamic dataset with the control block.
² Operate the protection element by secondary inject
- or -

44 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

² Use binary inputs that trigger the protection application in order to pick up the protection indication.

Protection Indication on the IEC Browser

² Select the Reporting field.
- or -
² Click the Auto Refresh button in the IEC client.
² Pick up the protection indication.
This will enable you to detect changes on the device via the client.

2.6.4 File Transfer

File transfer is used to transmit fault records from a server to a client. The fault records, such as defined in
the COMTRADE standard, are stored in the server as a configuration file (.cfg) and a binary data file (.dat).
The analysis program reads both files and can then display the fault record with analog and binary traces. This
requires special analysis programs, for example, SIGRA or Reydisp Evolution 32.
The configuration file contains, among other information:

• All analog and binary traces contained in the fault record

• Names of the traces

• Sampling rate
The raw data for these traces are contained in the data file, which is stored as a binary COMTRADE file in the
device.
An IEC 61850 client can retrieve a directory of the fault record from the device. It can later transmit the
records from the device with MMS file transfer. You can find more information in the PIXIT, PICS, TICS IEC
61850 Manual.

NOTE

i Fault records can also be read from the device by Reydisp Manager 2 and viewed in Reydisp Evolution 32.
Transmission to Reydisp Manager 2 does not use the IEC 61850 protocol, but instead uses a compressed
and encrypted protocol.

The IEC 61850 Standard defines a SETTING-GROUP-CONTROL-BLOCK model (SGCB). This model allows an
item to have several values that can be used individually. It provides mechanisms for switching between
several values of one or more data objects. Related values form the settings group.
The device supports up to 4 different settings groups that can be configured with Reydisp Manager 2. The
SGCB of a 7SR5 device is found in the logical node LLN0 of the logical device (LD) PROT.
The following structure is defined for the SGCB model:
SGCB Class
Attribute Name Attribute Type Read and Write Access Description
(Read (r)/Write (w))
NumOfSG INT8U r The attribute NumOfSG
identifies the total
number of available
settings groups.
n = NumOfSG
ActSG INT8U w The attribute ActSG iden-
tifies the values of the
settings group that are in
the active buffer.
Admissible range: 1 to n

Reyrolle 7SR5, Communication Protocol, Manual 45

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

SGCB Class
Attribute Name Attribute Type Read and Write Access Description
(Read (r)/Write (w))
EditSG INT8U w 7SR5 does not support
setting edit in a specific
settings group, only active
group change via ActSG.
Admissible range: 0
CnfEdit BOOLEAN w Not supported as EditSG,
Setting change not
supported.
LactTm TimeStamp r The attribute LActTm
designates the time at
which the SelectActi-
veSG service was edited.
Services
SelectActiveSG
GetSGCBValue

2.6.5 Control via IEC 61850

7SR5 devices support 3 control models defined in the standard:

• Direct without feedback monitoring

• Direct with feedback monitoring

• SBO (Select Before Operate) with feedback monitoring

NOTE

i When using IEC 61850 over the front USB port, control functions will only be enabled when the device is in
Remote mode, as IEC 61850 control is designated as a Remote SCADA protocol for control functions.

The next figure shows the command sources, command types, and control models.

46 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

[dw_7SR5_ControlViaIEC61850.vsd, 1, en_US]

Figure 2-24 Command Sources, Command Types and Control Models

SBO control models support the operate-once variant. The command may only be interrupted if it conforms
with the standard.
A control model is preset for all objects.

[sc_7SR5_ControlModel, 1, --_--]

Figure 2-25 Control Model Selectable Nodes

Reyrolle 7SR5, Communication Protocol, Manual 47

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

For controllable objects that are coupled to the process, Siemens and the standard recommend always
selecting the control models with enhanced security (feedback monitoring).
According to the standard, commands with test state indicator are supported. This implies that a test
command can be only implemented if the object Beh of the associated LNs has the value test.
The IEC 61850 protocol permits testing the switching commands for their operability prior to implementation.
Test bits allow the interlocking devices to be switched on and off. The interlocking check bit affects which
command checks are to be performed.
7SR5 devices have an IEC 61850 Check Bits parameter in the Device setting file which is set to Disa-
bled by default. This means the test attribute is disregarded and the interlocking check is always performed
for the synchrocheck and interlocking, where applicable.

[sc_7SR5_CheckBits, 1, --_--]

Figure 2-26 IEC 61850 Check Bits

• If the Device parameter IEC 61850 Check Bits is set to enabled the test bit will be checked.

• If the test bit is set, it will be treated like the Interlocking and synchrocheck conditions will be tested
and the switching command will be executed only if all other command checks prove to be successful.

• If the synchrocheck is not switched on for a circuit breaker and a switching command with the respective
test bit is transmitted via IEC 61850 to the device, this switching command will be rejected with a
negative acknowledgment OPR-. If the synchronization function is not a part of the Circuit-breaker
function group, the test bit will be ignored and the switching command will be executed if all other
command checks prove to be successful.

• If the test bit is not set, it will be treated like the non-interlocked switching mode. If the Interlocking
function block is not available in the Circuit-breaker function group, the interlocking conditions will
not be tested and the switching command will be executed if all other command checks prove to be
successful.

2.6.6 Measured Values and Measured-Value Description

In order to detect the measured values in the buffer or transmission via reports, the application of the
deadband is important.

48 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

Measured values instMag are only forwarded with the deadband mechanism if they change outside of an
adjustable window. The window is defined as an upper and lower limit, a percentage of the actual measured
value.

NOTE

i The summation takes place every 1 s.

If the measured value instMag deviates from the deadband value mag, then the amount of the difference of
these 2 values will be added. If over time the accumulated sum exceeds the upper limit db (deadband value),
the deadband value mag will be set to the current value of instMag, and the sum will be reset to 0.
By using the trigger option TrgOp=dchg, the deadband value mag can be saved in the buffer or can be
reported. After setting the trigger option TrgOp=dchg, the device may wait several milliseconds before the
report is sent.

[sc_dia_iec, 1, --_--]

Figure 2-27 Diagram on the Behavior of Values

The diagram illustrates the relationship between the following values:

• Measured value instMag (instCVal.mag)

• Deadband value mag (CVal.mag)

• Upper limit db (deadband value)

The upper limit db is used as a unit of 0.001 % and refers as a percentage to the currently measured
value.

• Accumulated sum, referred to simply as sum

The deadband value mag changes significantly slower than the measured value instMag.

[sc_7SR5_DBValue, 1, --_--]

Figure 2-28 Example of db Value

The figure shows the db value in the Siemens IEC Browser PC application tool which is distributed with DIGSI.

Reyrolle 7SR5, Communication Protocol, Manual 49

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

[sc_7SR5_InstMagValue, 1, --_--]

Figure 2-29 instMag and mag Values

Large differences between instMag and mag lead to the repeated updating of mag.
Small differences between instMagand mag lead to an infrequent change of mag.

NOTE

i Since db is a percentage of the measured value, very small measured values and increased noise may cause
a flood of mag indications. An additional threshold in the device prevents a flood of indications.
If spontaneous changes do not need to be sent quickly, reports with measured values can also be trans-
mitted cyclically.

2.6.7 Device Time

2.6.7.1 Description
The SNTP protocol can be used for time synchronization via Ethernet networks.
If Ethernet is selected in the device parameters as either the Master or Back up time source the time synchro-
nization would be performed via the Ethernet network; this option is available both for electrical and optical
interfaces.
In addition to this synchronization protocol, other options are available for the 7SR5 devices. Selection
is performed in Reydisp Manager 2 device parameterization. If such a method has been activated, time
synchronization via the Ethernet network is not performed and each device must be set for the selected time
synchronization method.

[sc_7SR5_MasterTimeSource, 1, --_--]

Figure 2-30 Device Parameter Time Source Setting

50 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

The Ethernet time zone must also be configured as the Ethernet will use UTC which may differ from the device
local time.

[sc_7SR5_EthernetTimezone, 2, --_--]

Figure 2-31 Device-Time Messages – Example LN/LTIM

The SNTP ICD file(s) must be added as a device to the Station in the IEC 61850 configurator.

[sc_7SR5_AddIECDevice, 1, --_--]

Figure 2-32 Add IEC 61850 Device

The SNTP devices are shown in the station properties and must be configured as the Primary and Secondary
clock source from the drop down list. Each SNTP must have a unique IP address.
An SNTP file is supplied with RDM2. See 8.5 SNTP.

Reyrolle 7SR5, Communication Protocol, Manual 51

C53000-L7040-C013-1, Edition 04.2023
IEC 61850
2.6 Protocol Properties and Implementation

[sc_7SR5_StationProperties, 1, --_--]

Figure 2-33 Station Properties for IEC 61850 Clock

7SR5 devices support both Edition 1 and Edition 2 according to IEC 61850-7-2. In Edition 2, the logical
attributes LeapSecondsKnown, ClockFailure, ClockNotSynchronized, and the value TimeAccuracy are
maintained in each time stamp. In Edition1, these signals contain default values. Thus, the interoperability
for substation automation technologies is ensured for both editions.

Status and Accuracy

The internal clock of the 7SR5 device reaches the steady state of ±1 ms after a maximum of 15 minutes of a
healthy synchronization. This internal accuracy cannot be measured here because a precise trigger option is
not available. For checking purpose, a binary input is often triggered (configured: without a software filter,
with recalculation of the hardware filtering time). Such measurement, however, including jitter in binary input
processing, has deviations of approx. ±3 ms.

Time Fault Indication

A time fault indication is output when the clock server does not respond to inquiries of the device (after the
configured Sync Lost delay monitoring time has expired. From now on, the status of type time fault is set in
the time stamp of all indications. The bit clock failure in the IEC 61850-8-1 will be set accordingly in the time
stamp of the Data Object.
The time fault indication does not appear when the SNTP server itself has no connection to the time source
(e.g. no antenna signal, ...) and sends clock signals to all devices according to its internal accuracy. However,
at start-up, as long as no connection has been established with the SNTP server or the time synchronization
message indicates a stratum greater than 3, the bit ClockNotSynchronized will be set in the time stamp of
the Data Object, to indicate that the clock has not yet been synchronized.
With a synchronized device, the following values are set:

• TimeAccuracy = 10

• ClockNotSynchronized = false

• ClockFailure = false
With an unsynchronized device, the following values are displayed for all indications:

• TimeAccuracy = 10

• ClockNotSynchronized = true
These sources are considered as perfect – apart from a measured offset to device time.

2.6.7.2 Determining the ClockNotSynchronized Value

After device startup, this value is first set to true. Through a 1st synchronization using one of the set sources,
it changes to false.
However, if no more synchronization telegrams are received for the set time Fault indication after (default:
600 s), then the value is set to ClockNotSynchronized = true.
If the value ClockFailure is set, then also ClockNotSynchronized is always set.

52 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 61850
2.6 Protocol Properties and Implementation

The status of ClockNotSynchronized corresponds to the state of the message Time sync. error right up to
startup. However, the message status at startup is off. If no synchronization takes place, for parameterized
sources, this status changes to on after Fault indication after.

2.6.7.3 Determining the ClockFailure Value

If hardware errors occur on the time components, the logical value ClockFailure is set to true.
This value is set at startup until a valid time can be read from the clock module buffered with the button cell or
until the time can be set manually (HMI, Reydisp Manager 2) or by a parameterized synchronization source.
If ClockFailure is set, ClockNotSynchronized = true.
The status of the message Clock fail corresponds to the status of the value.

2.6.8 Asset Management

You can monitor firmware and configuration statuses across the entire plant. Attributes of the devices are
used for this purpose.
The following versions and information are made available for asset management via the IEC 61850 interface.
Asset IEC 61850 Name Note
Device Firmware Version Every LPHD.DCPhyNam.swRev Version V02.20 is displayed as 02.20.xx
Communication Module Firm- Every LLNO.DCNamPlt.swRev Version V01.20 is displayed as 01.20.xx
ware Version
User Configuration Every Displayed as date and time of sent file.
LLNO.DCNamPlt.configRev
Vendor LPHD.PhyName.vendor
Serial Number LPHD.PhyName.serNum
Product Code HW Version LPHD.PhyName.hwRev
Device Type MLFB LPHD.PhyNam.model

Reyrolle 7SR5, Communication Protocol, Manual 53

C53000-L7040-C013-1, Edition 04.2023
54 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
3 DNP3 TCP

3.1 Protocol Characteristics 56

3.2 Settings and Properties 71

Reyrolle 7SR5, Communication Protocol, Manual 55

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

3.1 Protocol Characteristics

3.1.1 Protocol Structure

Description
DNP3 has a graded architecture. Instead of the OSI model, however, a simplified 3-layer model suggested
by the IEC is used. This model was named Enhanced Performance Architecture (EPA) by the IEC. However,
DNP3 adds a 4th layer, a pseudo transport layer, with which messages can be segmented. The graphics were
taken from the DNP3-Spec-V1-Introduction-20071215.pdf standard.

[dw_epadia, 1, en_US]

Figure 3-1 EPA Diagram

The 7SR5 device supports the DNP3, level 2 version.

You can find additional information in the standard IEEE 1815 at http://standards.ieee.org/.

Physical Layer
The physical layer mainly deals with the physical media through which the protocol is transferred. The physical
layer deals with, for example, the condition of the media (free or occupied) and the synchronization through
the media (start and stop).
DNP3 most frequently uses a simple, asynchronous serial transmission like RS232 or RS485 with physical
media like pilot wires and optical fiber. Moreover, the transmission can take place through Ethernet.

56 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.1 Protocol Characteristics

[dw_dalila, 1, --_--]

Figure 3-2 Physical Layer

Data-Link Layer
The data link layer manages the logical connection between the transmitter and the receiver of the informa-
tion and improves the fault tolerance of the physical line. This is achieved with DNP3 by starting every data
transmission package with a data head, and a 16 bit CRC (cyclic redundancy check) is executed for every
16 bytes of the package.
A package is a part of the complete message transferred through the physical layer. The maximum size of a
data package is 256 bytes. Each package has a 16-bit source address and a 16-bit target address, which can
also be a general address (0xFFFF).
The 10-byte data link layer head contains:

• Address information

• 16-bit start code

Reyrolle 7SR5, Communication Protocol, Manual 57

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

• Frame length

• Data link control byte

The data link control byte displays the cause of the data transmission and the status of the logical connection.
The data link control byte can have the following values:

• ACK (data link confirmation)

• NACK (negative confirmation)

• Connection needs to be reset

• Connection is reset

• Data link confirmation from the package required

If a data link confirmation is needed, the receiver must respond with an ACK data package if the package
was received and the CRC checks were successful. If no data link confirmation is requested, no response is
required.

Pseudo Transport Layer

The pseudo transport layer segments application messages in multiple data transmission packages.
The pseudo transport layer implements an individual byte function code for every package. The byte function
code displays what the data transmission package is:

• The 1st package of a message

• The last package of a message

• Both (for individual message packages)

The function code delivers a running package number. This subsequent package number is increased with
each package and allows the receiver's transport layer to analyze the package.

[dw_trfnct, 1, --_--]

Figure 3-3 Pseudo Transport Layer

Application Layer
The application layer responds to received messages and creates messages based on the necessity and
availability of the user data. As soon as messages are available, they are sent to the pseudo transport layer.
The messages are segmented here, sent to the data link layer and transferred through the physical layer.
If the data that is to be sent is too large for an individual application message, a number of application
messages can be created and sent in a sequential manner. Each message is an independent application
message. Their only connection with each other is the label in all messages that says that more messages will
follow. Only the last message does not contain this label. Each application message refers to a fragment due
to the fact that the user data may be fragmented. A message can thus be a single fragment message or a
multi-fragment message.
Application packages from DNP3 slaves are normally responses to queries. A DNP3 slave can also send a
message without a request, thus, an unsolicited response.
As in the data link layer, application fragments can be sent with a confirmation request. An application
confirmation indicates that a message was not only received, but rather it was also syntactically analyzed
without any errors. A data transmission confirmation or an ACK indicate only that the transmission package
was received and that the CRC checks were error-free.
Each application package begins with an application layer header, followed by one or more object heads/
object data. The application layer header contains an application control code and an application function
code.

58 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.1 Protocol Characteristics

If one of the following conditions is fulfilled, then the application control code contains labels:

• The package is a multi-package message.

• An application layer acknowledgment is requested for the package.

• The package is not requested.

The application control code contains a continual application layer number. With this application layer
number, the receiving application layer can recognize alien packages or lost packages.
The application function code in the header of the application layer indicates the cause or the requested
function in the message. While DNP3 allows a number of data types in a single message, it also allows only an
individual query for a data type within the message.
Examples for application function codes include:

• Acknowledgments for confirmation on the application layer

• Read and write

• Select and execute (SBO (select before operate), controls)

• Direct control (for switching objects without SBO)

• Save and delete (for counters)

• Restart

• Enable and disable non-requested messages

• Selection of the classes

The application function code in the header of the application layer applies for all object headers. Thus, the
application function code applies for all data within the message package.

Reyrolle 7SR5, Communication Protocol, Manual 59

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

[dw_aplay_1, 1, --_--]

Figure 3-4 Application Layer – Part 1

60 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.1 Protocol Characteristics

[dw_aplay_2, 1, --_--]

Figure 3-5 Application Layer – Part 2

3.1.2 Transfer through Ethernet

Requirements for the Physical, Transport, and Application Layers

The transmission through Ethernet takes place according to the same specifications as transmission through
serial connections. Only the method for the time synchronization through the network must be changed.
All requirements in the other protocol layers can be applied. Connection packages are transported in an
unchanged manner through the Ethernet protocol suite under the control of the data link layer.

Acknowledgements
If the 7SR5 devices communicate through Ethernet, they must not work with confirmations from the physical
layer (CONFIRMED_USER_DATE). If necessary, the confirmations must be used by the application layer. For
confirmations of the application layer, there is no difference between IP networks (IP = Internet protocol) and
serial channels.

Reyrolle 7SR5, Communication Protocol, Manual 61

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

Message Transmission
As soon as the data-link layer has established a TCP connection (TCP = Transmission Control Protocol), the
physical layer of DNP3 can transmit packages as needed. The type of query (requested or not requested) does
not depend on the type of connection.
The 7SR5 devices support dual DNP3 Ethernet masters on the same Ethernet module.
A typical case for each DNP3 master is as follows:

• TCP connection is established with a device

• Class 1, 2, 3, 0 request is executed once

The data integrity is checked.

• Non-requested transmission is made possible

• Work is continued in this mode.

3.1.3 Functional Scope

The following table identifies which object variations, function codes and qualifiers the DNP3 IP implementa-
tion of the Multi-Functional Protective Relay will support in both request messages and in response messages.
For static (non-change-event) objects, requests sent with qualifiers 00, 01, 06, 07, or 08, will be responded
with qualifiers 00 or 01.
Requests sent with qualifiers 17 or 28 will be responded with qualifiers 17 or 28.
For change-event objects, qualifiers 17 or 28 are always responded.

Table 3-1 Triangle MicroWorks, Inc. DNP 3.0 Slave Source Code Library

Objects Request Response

Object Varia- Description Function Codes Qualifier Codes Function Codes Qualifier Codes
No. tion (dec) (hex) (dec) (hex)
No.
1 0 Binary Input – 1 (read) 00, 01 (start-
Any Variations stop)
06 (no range)
07, 08 (limited
qfy)
17, 28 (index)
1 1 Binary Input with 1 (read) 00, 01 (start- 129 (response) 00, 01 (start-
Status stop) stop)
06 (no range) 17, 28 (index)
07, 08 (limited
qfy)
17, 28 (index)
2 0 Binary Input 1 (read) 06 (no range, or
Change – Any all)
Variations 07, 08 (limited
qfy)
2 2 Binary Input 1 (read) 06 (no range, 129 (response) 17, 28 (index)
Change with all) 130 (unsol. resp)
Time 07, 08 (limited
qfy)

62 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.1 Protocol Characteristics

Objects Request Response

Object Varia- Description Function Codes Qualifier Codes Function Codes Qualifier Codes
No. tion (dec) (hex) (dec) (hex)
No.
10 0 Binary Output – 1 (read) 00, 01 (start-
Any Variations stop)
06 (no range, or
all)
07, 08 (limited
qfy)
17, 28 (index)
10 2 Binary Output 1 (read) 00, 01 (start- 129 (response) 00, 01 (start-
with Status stop) stop)
06 (no range, or 17, 28 (index)
all)
07, 08 (limited
qfy)
17, 28 (index)
12 1 Control Relay 3 (select) 17, 28 (index) 129 (response) echo of response
Output Block 4 (operate)
5 (direct op)
6 (dir. op, noack)
20 0 Binary Counter – 1 (read) 00, 01 (start-
Any Variations stop)
06 (no range, or
all)
07, 08 (limited
qfy)
17, 28 (index)
20 1 32-bit Binary 1 (read) 00, 01 (start- 129 (response) 00, 01 (start-
Counter (with stop) stop)
Flag) 06 (no range, or 17, 28 (index)
all)
07, 08 (limited
qfy)
17, 28 (index)
22 0 Counter Change 1 (read) 06 (no range, or
Event – Any all)
Variations 07, 08 (limited
qfy)
22 1 32-bit Counter 1 (read) 06 (no range, or 129 (response) 17, 28 (index)
Change Event all) 130 (unsol. resp)
without Time 07, 08 (limited
qfy)
30 0 Analog Input – 1 (read) 00, 01 (start-
Any Variations stop)
(default variation 06 (no range, or
= 2) all)
07, 08 (limited
qfy)
17, 28 (index)

Reyrolle 7SR5, Communication Protocol, Manual 63

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

Objects Request Response

Object Varia- Description Function Codes Qualifier Codes Function Codes Qualifier Codes
No. tion (dec) (hex) (dec) (hex)
No.
30 2 16-bit Analog 1 (read) 00, 01 (start- 129 (response) 00, 01 (start-
Input (used for stop) stop)
measured 06 (no range, or 17, 28 (index)
values) all)
07, 08 (limited
qfy)
17, 28 (index)
32 0 Analog Change 1 (read) 06 (no range, or
Event – Any all)
Variations 07, 08 (limited
(default = 2) qfy)
32 2 16-bit Analog 1 (read) 06 (no range, or 129 (response) 17, 28 (index)
Change Event all) 130 (unsol. resp)
without Time 07, 08 (limited
qfy)
50 1 Time and Date 1 (read) 07 (limited qfy = 129 (response) 07 (limited qfy =
1) 1)
2(write) 07 (limited qfy =
1)
60 1 Class 0 Data 1 (read) 06 (no range, or
all)
60 2 Class 1 Data 1 (read) 06 (no range, or
all)
07, 08 (limited
qfy)
60 3 Class 2 Data 1 (read) 06 (no range, or
all)
07, 08 (limited
qfy)
60 4 Class 3 Data 1 (read) 06 (no range, or
all)
07, 08 (limited
qfy)
70 3 File Command 25 (open) 5b (free format)
70 4 File Command 26 (close) 5b (free format) 129 (response) 5B (free format)
Status 30 (abort) 130 (unsol. resp)
70 5 File Transfer 1 (read) 5b (free format) 129 (response) 5B (free format)
130 (unsol. resp)
70 6 File Transfer 129 (response) 5B (free format)
Status 130 (unsol. resp)
70 7 File Descriptor 28 (get file info) 5b (free format) 129 (response) 5B (free format)
130 (unsol. resp)
80 1 Internal Indica- 2 (write) 00, 01 (start-
tions stop)
(Index must = 4
or 7)

64 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.1 Protocol Characteristics

Table 3-2 DNP3 IP Device Profile Documents

DNP3 IP
DEVICE PROFILE DOCUMENT
Vendor Name: Siemens AG
Device Name: 7SR5
Highest DNP Level Supported: Device Function:
For Requests: Level 2 ☐ Master
For Responses: Level 2 ☒ Slave
Notable objects, functions, and/or qualifiers supported in addition to the Highest DNP Levels Supported (the
complete list is described in the attached table):
For static (non-change-event) object requests, request qualifier codes 07 and 08 (limited quantity), and 17
and 28 (index) are supported. Static object requests sent with qualifiers 07, or 08, will be responded with
qualifiers 00 or 01.
16-bit and 32-bit Analog Change Events without Time may be requested.
Sequential file transfer, Object 70, variations 3 through 7, are supported.
Maximum Data Link Frame Size (octets): Maximum Application Fragment Size (octets):
Transmitted: 292 Transmitted: 2048
Received: 292 Received: 2048
Maximum Data Link Re-tries: Maximum Application Layer Re-tries:
☒None ☒None
☐Fixed ☐Configurable from 0 to 65535
☐Configurable from 0 to 65535

Reyrolle 7SR5, Communication Protocol, Manual 65

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

Requires Data Link Layer Confirmation:

☒Never
☐Always
☐Sometimes
☐Configurable
Requires Application Layer Confirmation:
☐Never
☐Always
☒When reporting Event Data (Slave devices only)
☒When sending multi-fragment responses (Slave devices only)
☐Sometimes
☐Configurable
Timeouts while waiting for:
Data Link Confirm: ☒None ☐Fixed at ____☐Variable ☐Configurable
Complete Appl. Fragment: ☒None ☐Fixed at ____ ☐Variable ☐Configurable
Application Confirm: ☐None ☐Fixed at ____ ☐Variable ☒Configurable
Complete Appl. Response: ☒None☐ Fixed at ____ ☐Variable ☐Configurable
Others:
Transmission Delay: no intentional delay Select/Operate
Timeout: configurable (default 5 s)
Need Time Interval: fixed to 60 s
Unsolicited Notification Delay: configuarble (default 5 s)
Unsolicited Response Retry Delay: configurable (default 5 s)
Sends/Executes Control Operations:
WRITE Binary Outputs ☒Never ☐Always ☐Sometimes ☐Configurable
SELECT/OPERATE ☐Never ☒Always ☐Sometimes ☐Configurable
DIRECT OPERATE ☐Never ☒Always ☐Sometimes ☐Configurable
DIRECT OPERATE – NO ACK ☐Never ☒Always ☐Sometimes ☐Configurable

Count > 1 ☒Never ☐Always ☐Sometimes ☐Configurable

Pulse On ☐Never ☒Always ☐Sometimes ☐Configurable
Pulse Off ☒Never ☐Always ☐Sometimes ☐Configurable
Latch On ☐Never ☒Always ☐Sometimes ☐Configurable
Latch Off ☐Never ☒Always ☐Sometimes ☐Configurable

Queue ☒Never ☐Always ☐Sometimes ☐Configurable

Clear Queue ☒Never ☐Always ☐Sometimes ☐Configurable
Note: CONTROL RELAY OUTPUT BLOCK parameters (count, on-time, off-time) are ignored.
Reports Binary Input Change Events when no specific Reports time-tagged Binary Input Change Events
variation requested: when no specific variation requested:
☐Never ☐Never
☒Only time-tagged ☒Binary Input Change With Time
☐Only non-time-tagged ☐Binary Input Change With Relative Time
☐Configurable to send one or the other ☐Configurable

66 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.1 Protocol Characteristics

Sends Unsolicited Responses: Sends Static Data in Unsolicited Responses:

☐Never ☒Never
☒Configurable ☐When Device Restarts
☐Only certain objects ☐When Status Flags Change
☐Sometimes (attach explanation)
☒ENABLE/DISABLE UNSOLICITED Function codes No other options are permitted.
supported
Default Counter Object/Variation: Counters Roll Over at:
☐No Counters Reported ☐No Counters Reported
☐Configurable ☐Configurable (attach explanation)
☒Default Object 20 and Default Variation 01 ☐16 Bits
Default Variation: ☒32 Bits
☐Point-by-point list attached ☐Other Value: _____
☐Point-by-point list attached
Sends Multi-Fragment Responses:
☒Yes
☐No
☐Configurable
Sequential File Transfer Support:
Append File Mode ☐Yes ☒No
Custom Status Code Strings ☐Yes☒No
Permissions Field ☒Yes ☐No
File Events Assigned to Class ☐Yes ☒No
File Events Send Immediately ☐Yes ☒No
Multiple Blocks in a Fragment ☐Yes ☒No
Max Number of Files 1

3.1.4 Fault Record Transfer

The file transfer can be used to transfer a fault record (Object 70). The Rcd Made message can be used to
query the availability of the fault record. When the message is mapped and there is a new fault in the device
the message is transferred. Cyclical reading of the directory is also possible. If there are files in the directory
then there are also fault records. Specifically, the transfer takes place as follows:
The following steps are required to read the directory:

• Reading of the directory with File Transport Object (obj 70 var 7)

• Waiting for the response

• If the read operation was successful, the master station increases the block number and reads the next
block.

• If the status indicator Last is set in the response, the master station closes the file with File Operation
Status Object (obj 70 var 4).
Every fault record is identified by an existing file. The following information is transferred for this:

• File Name Offset

• File Name Size

• File Type

• File Size

• Time Of Creation

• Permissions

Reyrolle 7SR5, Communication Protocol, Manual 67

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

• Request ID

• File Name
The master station can now select the required fault. The transfer takes place in the same manner as with
reading the directory.

3.1.5 Buffered Events

Table 3-3 Maximum Number of Buffered Events

Event Numbers Note

Binary input change: DNP3 IP 100 as sequence of events All changes will be entered in the
Object 2 event list, also multiple events from
the same data object. In case of
overflow, the internal indication
IIN2.3 bit EVENT_BUFFER_OVER-
FLOW is set and the oldest event
is lost. This internal indication
remains set and is reported to the
DNP3 IP master until there is again
storage in the event buffer for at
least one event.
Counter change: DNP3 IP Object 22 10 most recent events If a data object changes multiple
Analog input change: DNP3 IP 50 most recent events times without the previous event
Object 32 being sent, then a new event will
overwrite the value already stored
in the event list.

3.1.6 Amount of Mappable Information

The following information can be mapped:

Information Maximum Mappable Amount
Indications + Controllables at Tx 5000
Controllables at Rx 5000
Settings at Tx Not supported
Measurements at Tx 5000
Counters at Tx 5000

NOTE

i All addresses must use values of 5000 or less.

3.1.7 Additional Information

The mapping of the commands occurs like the mapping of messages. Here, object group 12 is preset.

Scaling Measured Values

The measured values between the 7SR5 device and the DNP3 master are transferred as integer values in 16-bit
format. 16 bits correspond with a range from -32768 to 32767.

68 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.1 Protocol Characteristics

Converting Measured Values

Before the transfer of a measured value through DNP3, the measured values must be converted in the 7SR5
device. The measured values are scaled.
The scaling of a measured value determines the form of transmission. These forms of transmission are:

• Value type

• Scaling factor as configured in the CT/VT configuration

Changing the Setting Group

Switching on a setting group simultaneously switches off the currently active setting group. Transmission of
the off value is insignificant for the switching of the setting group and is rejected by the 7SR5 device.

Control Mode Remote

Control mode from DNP3 is only allowed when the device Ethernet port is set to Remote mode or Local or
Remote mode.

Scaling Factor
The measured value is multiplied in the 7SR5 device by the scaling factor.
The internal values are scaled as defined in the scaling values parameterized in Reydisp Manager 2, to 16 bit
integers for sending in DNP3.

Percent Values
For percent values, Siemens recommends a scaling factor of 100. This results in an interpretation of the
integer measured value (measured valueInteger) through DNP3 with a measured value from ± 32 767. This
corresponds with a percentage value of ± 327.67%.

Primary Values
The position of the decimal point and the respective unit are determined for primary values based on the
parameterized rated variables configured in the CT/VT ratio menu of the device configuration.

Multiplier
In addition for analogue inputs the communications editor allows a multiplier factor to be specified for each
point, the value is multiplied by this factor before transmission. The multiplier could be used to scale values to
fit in specific data variants, for example, if you have a value of 5.678 and need to send it back as a 16 bit 2, set
the multiplier to 1000 and it will be send as 5678 keeping the precision.

Dead Band
For analogue inputs the communications editor allows a dead band factor to be specified for each point. This ±
dead band specifies the window outside of which an event is generated.

Mapping on the Object Status

The following table shows mapping on the object status.

Table 3-4 Mapping on the Object Status

IEC 61850 Implementation Preferred DNP3 Implementation

Attribute Name Attribute Type Value/Value Point Type Point Count or Comment
Range Note
PACKED LIST – – – –
validity CODED ENUM Good – ONLINE set if –
good
Questionable – COMM_LOST –

Reyrolle 7SR5, Communication Protocol, Manual 69

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.1 Protocol Characteristics

IEC 61850 Implementation Preferred DNP3 Implementation

Attribute Name Attribute Type Value/Value Point Type Point Count or Comment
Range Note
detailQual PACKED LIST – – – –
overflow BOOLEAN DEFAULT – ROLLOVER –
FALSE
outOfRange BOOLEAN DEFAULT – OVER_RANGE –
FALSE
badReference BOOLEAN DEFAULT – REFERENCE_ERR –
FALSE
oscillatory BOOLEAN DEFAULT – CHATTER_FILTER –
FALSE
failure BOOLEAN DEFAULT – OFFLINE –
FALSE
oldData BOOLEAN DEFAULT – COMM_LOST –
FALSE
inconsistent BOOLEAN DEFAULT – DISCONTINUITY –
FALSE
inaccurate BOOLEAN DEFAULT – – –
FALSE
source CODED ENUM Process – – –
Substituted – LOCAL_FORCED –
test BOOLEAN DEFAULT – LOCAL_FORCED –
FALSE
operatorBlocked BOOLEAN DEFAULT – LOCAL_FORCED –
FALSE

70 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.2 Settings and Properties

3.2 Settings and Properties

3.2.1 Settings for Communication through Ethernet

During parameterization, make the following settings for the communication on the Ethernet module
between systems control and the device via DNP3:

[sc_7SR5_EnableDNP3TCP, 2, --_--]

Figure 3-6 Enable DNP3 TCP – Services in Ethernet Interface

[sc_7SR5_SettingsforDNP3, 1, --_--]

Figure 3-7 Settings for DNP3 – Device Configuration

Device Mapping and Configuration

Each specific device model will have a unique configuration file.
The supported information available for each device can be viewed using the Reydisp Manager 2 PC software
tool in the mapping file.
This protocol can be used on the USB port for testing purposes but primarily it should be used on the rear
ethernet ports.
The configuration allows the enabling/disabling of points, editing addresses, class, scaling, multiplier, and
deadband where applicable in the associated tab.

Reyrolle 7SR5, Communication Protocol, Manual 71

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.2 Settings and Properties

Table 3-5 The information types in the configuration tool have the following fixed format:

Binary Output Status Points

Object Number: 10
Request Function Codes supported: 1 (Read)
Default Variation reported when variation 0 requested: 2 (Binary Output Status)
Control Relay Output Blocks/Binary Output Status Object
Number: 12
Request Function Codes supported: 3 (select), 4 (operate), 5 (direct operate), 6 (direct operate, no ack)
Binary Input Points
Static (Steady-State) Object Number: 1 Change
Event Object Number: 2
Request Function Codes supported: 1 (read)
Static Variation reported when variation 0 requested: 1 (Binary Input with Status)
Change Event Variation reported when variation 0 requested: 2 (Binary Input Change with Time)
Counters
Static (Steady-State) Object Number: 20 Change
Event Object Number: 22
Request Function Codes supported: 1 (read)
Static Variation reported when variation 0 requested: 1 (32-bit Counter with Flag)
Change Event Variation reported when variation 0 requested: 1 (32-bit Counter without Time)
Analog Inputs
Static (Steady-State) Object Number: 30 Change
Event Object Number: 32
Request Function Codes supported: 1 (read)
Static Variation reported when variation 0 requested: 02 (16-bit Analog Input)
Change Event Variation reported when variation 0 requested: 02 (Analog Change Event without Time)

72 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.2 Settings and Properties

[sc_7SR5_DNP3TCPOptions, 1, --_--]

Figure 3-8 DNP3 TCP Configuration

The Options tab provides the general and unsolicited DNP3 TCP parameters.
On completing any parameter and configuration changes select the Apply option.

Time Synchronization with DNP3 TCP

DNP3 TCP offers an own time synchronization from the DNP3 TCP outstations using object number 50 var 1.
During configuration of the 7SR5 device in Reydisp Manager 2, set the time synchronization parameters for
time synchronization via DNP3 TCP in the same manner as for SNTP:

• In device parameter settings: Source of time synchronization

• Master/Back up time source: Ethernet

• Ethernet Interface SNTP: Enable the Primary Timer Server and Enter the IP Address, subnet mask and
Standard Gateway information
The following DNP3 TCP-specific parameters are relevant for time synchronization via DNP3 TCP:

Reyrolle 7SR5, Communication Protocol, Manual 73

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.2 Settings and Properties

Parameter Description
Enable time sync. Determines whether the device (DNP3 TCP outstation) expects and eval-
uates time synchronization from DNP3 TCP master.
Time sync. master: First connected/ Determines in case of 2 connected DNP3 TCP clients which one acts as
Server 1/Server 2 time master for the time synchronization via DNP3 TCP.
If only 1 client is connected, this one is also the time master.
Time sync. is UTC Acc. to "Time Synchronization" in DNP3 IP Spec. Vol. 5, the time for
DNP3 TCP time synchronization shall (since Jan. 1st, 2008) correspond
to Universal Time Coordinated, UTC.
This setting is used to support DNP3 TCP clients which send time
synchronization in local time but should normally remain unchanged
to default value.

NOTE

i For time synchronization with NTP or DNP3 TCP, at least one NTP server must be configured in the IEC
61850 System Configurator.

If DNP3 TCP time synchronization is enabled, the DNP3 TCP master shall perform time synchronization to the
outstation periodically every 55 s to 61 s, because the time control algorithm in the 7SR5 devices is based on a
cyclical synchronization within this time period.
The accuracy of the time synchronization via DNP3 TCP protocol is 5 ms when time telegrams are being
recieved continuously in the interval stated previously.
Additionaly, the internal indication IIN1.4 bit NEED_TIME is set in a telegram to the DNP3 TCP master if
the device needs time synchronization (Is set all 60 s if no time synchronization message is recieved).
If 2 DNP3 TCP clients are connected to the device, the parameter Time sync. master determines which
client acts as time master. Time syncronization messages from the client which is not the time master are
rejected. The IIN1.4 bit NEED_TIME is only set in telegrams to the DNP3 TCP client which is the time
master.

Table 3-6 The DNP3 TCP-specific parameter Enable time sync. determines whether SNTP or DNP3
TCP is used for time synchronization:

Source Time Synchro- SNTP Server is Config- Setting EnableDNPTime- Result

nization Selection in ured in Station Configu- Synch
Reydisp Manager 2 rator
Ethernet Yes = 0: SNTP is used Device is synchronized
from SNTP (no time
requests with IIN1.4 to
a DNP3 TCP master
and time telegrams from
DNP3 TCP master are
rejected)
= 1: DNP3 TCP is used Device is synchronized
from DNP3 TCP

74 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.2 Settings and Properties

Source Time Synchro- SNTP Server is Config- Setting EnableDNPTime- Result

nization Selection in ured in Station Configu- Synch
Reydisp Manager 2 rator
Ethernet No Not relevant No time synchronization
(no time requests with
IIN1.4 to a DNP master
and time telegrams from
DNP3 TCP master are
rejected)
Other than Ethernet (e.g. Not relevant Device is synchronized
serial, binary input) from the selected source
(no time requests with
IIN1.4 to a DNP3 TCP
master and time tele-
grams from DNP3 TCP
master are rejected)

DNP3 TCP time objects contain the number of milliseconds from the DNP3 TCP time epoch, which is defined
as 1970-01-01 00:00:00.000 UTC. Before transmitting internally from the virtual EN100 to the 7SR5 device,
the local time correction factor that is configured for SNTP time synchronization (and which contains the time
zone and daylight saving time factors is added; only if Time sync. is UTC parameter is set to 1 (default).

Table 3-7 IP Settings in the Module Setting

Parameter Name Description Settings

Outstation address Link address of the 7SR5 device Permitted range = 1 to 61439
Default setting = 1
Master address (#1) Address of the DNP3 master Permitted range = 1 to 61439
Default setting = 100
Master address (#2) Address of the DNP3 master Permitted range = 1 to 61439
Default setting = 101
Validate DNP addresses Specifies if the stack should vali- Off = (default setting)
date the source address in the On =
receive frames.
Note: DNP3 frames contain both a
source and destination address.
Enable unsolicited reponses You specify whether unsolicited Off = The unsolicited responses
responses are configured with this is not configured and can never
parameter. be switched on from a connected
master (default setting).
On = The unsolicited responses
is configured and must be made
possible after the 1st unsolicited
response from the master.
Unsolicited retry delay If no unsolicited response was sent Default setting = 5 s
within the Unsolicited class
max delay parameter, then this
parameter regulates how often
a different unsolicited response
should be sent.
Unsolicited max retries This parameter regulates the Default setting = 3
maximum number of unsolicited
retries.

Reyrolle 7SR5, Communication Protocol, Manual 75

C53000-L7040-C013-1, Edition 04.2023
DNP3 TCP
3.2 Settings and Properties

Parameter Name Description Settings

Unsolicited class n max events This parameter regulates a condi- Default setting = 5 s
tion of the nonrequested transmis-
sion for every class of changed
events (class 1, class 2, and class
3).
If the number of events per
class corresponds to this value or
exceeds this value, then an unsoli-
cited response will be sent.
Unsolicited class n max delay This parameter regulates a condi- Default setting = 5 s
tion of the nonrequested transmis-
sion for every class of changed
events (class 1, class 2, and class
3).
If the time after an event corre-
sponds to this value or exceeds this
value, an unsolicited response will
be transmitted. Also sent if only 1
event occurred.
Unsolic. confirm. time-out Time until the receiver confirmed Default setting = 3 s
the non-requested response. If an
inquiry is received to read, then the
read query will first be answered.
The unsolicited response is then
not transmitted.
TCP port number (#1) Port number in the range of 1 to Default setting = 20000
61439
TCP port number (#2) Port number in the range of 1 to Default setting = 20001
61439
IP address filter (#n) Enables or disables filtering of Default setting = None
Master IP addresses.
Application timeout The receiver waits a desired Default setting = 5 s
amount of time until the previous
response is confirmed. If the confir-
mation of the application layer is
used together with the link confir-
mation, then make sure that the
time-out of the application layer
(ApplTimeout) is long enough in
order to end all transmissions.
The following formula describes
this requirement:
AppConTime-out > LinkConTime-
out * (Link retries + 1)

76 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3 TCP
3.2 Settings and Properties

Parameter Name Description Settings

Enable time sync. The receiver waits a desired Off = (default setting)
amount of time until the previous On =
response is confirmed. If the confir-
mation of the application layer is
used together with the link confir-
mation, then make sure that the
time-out of the application layer
(ApplTimeout) is long enough in
order to end all transmissions.
The following formula describes
this requirement:
AppConTime-out > LinkConTime-
out * (Link retries + 1)
Time sync. master The receiver waits a desired First connected
amount of time until the previous Server 1 (default setting)
response is confirmed. If the confir- Server 2
mation of the application layer is
used together with the link confir-
mation, then make sure that the
time-out of the application layer
(ApplTimeout) is long enough in
order to end all transmissions.
The following formula describes
this requirement:
AppConTime-out > LinkConTime-
out * (Link retries + 1)
Time sync. is UTC The receiver waits a desired Off =
amount of time until the previous On = (default setting)
response is confirmed. If the confir-
mation of the application layer is
used together with the link confir-
mation, then make sure that the
time-out of the application layer
(ApplTimeout) is long enough in
order to end all transmissions.
The following formula describes
this requirement:
AppConTime-out > LinkConTime-
out * (Link retries + 1)
Application keep alive timeout The receiver waits a desired Default setting = 20 s
amount of time until the previous
response is confirmed. If the confir-
mation of the application layer is
used together with the link confir-
mation, then make sure that the
time-out of the application layer
(ApplTimeout) is long enough in
order to end all transmissions.
The following formula describes
this requirement:
AppConTime-out > LinkConTime-
out * (Link retries + 1)

The other required IP settings are taken from the module setting.

Reyrolle 7SR5, Communication Protocol, Manual 77

C53000-L7040-C013-1, Edition 04.2023
78 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
4 DNP3

4.1 Protocol Characteristics 80

4.2 Settings and Properties 102

Reyrolle 7SR5, Communication Protocol, Manual 79

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

4.1 Protocol Characteristics

Description
This document gives a general description of the DNP3 (Distributed Network Protocol v3) protocol and its
implementation on the Reyrolle relay platform. It is not a description of the functionality of each specific relay,
you must still refer to the documentation of a device for detailed information.
This protocol can be set to use the RS485 port.

4.1.1 Functional Scope

The following table provides a “Device Profile Document” in the standard format defined in the DNP3 Subset
Definitions Document. While it is referred to in the DNP3 Subset Definitions as a “Document,” it is in fact a
table, and only a component of a total interoperability guide. The table, in combination with the Implementa-
tion Table provided and the Point List Tables provided should provide a complete configuration/interoperability
guide for communicating with a device implementing the Triangle MicroWorks, Inc. DNP3 Slave Source Code
Library.
DNP V3.0
DEVICE PROFILE DOCUMENT
Vendor Name: Siemens Protection Devices
Device Name: 7SR5 using the Triangle MicroWorks, Inc. DNP3 Slave Source Code Library, Version 3.
Highest DNP Level Supported: Device Function:
For Requests: Level 3 ☐ Master
For Responses: Level 3 ☒ Slave
Notable objects, functions, and/or qualifiers supported in addition to the Highest DNP Levels Supported (the
complete list is described in the attached table):
For static (non-change-event) object requests, request qualifier codes 07 and 08 (limited quantity), and 17
and 28 (index) are supported. Static object requests sent with qualifiers 07, or 08, will be responded with
qualifiers 00 or 01.
Output Event Object 11 is supported.
Maximum Data Link Frame Size (octets): Maximum Application Fragment Size (octets):
Transmitted: 256 Transmitted: 2048
Received: 256 Received: 2048
Maximum Data Link Re-tries: Maximum Application Layer Re-tries:
☐None ☒None
☐Fixed ☐Configurable
☒Configurable from 0 to 65535 (Default 3)

80 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

Requires Data Link Layer Confirmation:

☐Never
☐Always
☐Sometimes
☒Configurable as: Never, Only for multi-frame messages, or Always
Requires Application Layer Confirmation:
☐Never
☐Always
☒When reporting Event Data (Slave devices only)
☒When sending multi-fragment responses (Slave devices only)
☐Sometimes
☐Configurable as: “Only when reporting event data”, or “When reporting event data or multi-fragment
messages.”
Timeouts while waiting for:
Data Link Confirm: ☐None ☐Fixed at ____☐Variable ☒Configurable (2 sec)
Complete Appl. Fragment: ☒None ☐Fixed at ____ ☐Variable ☐Configurable
Application Confirm: ☐None ☐Fixed at ____ ☐Variable ☒Configurable (10 sec)
Complete Appl. Response: ☒None☐ Fixed at ____ ☐Variable ☐Configurable
Others:

Transmission Delay, (Configurable, default 0 sec)

Select/Operate Arm Timeout, (Configurable, default 5 sec)

Need Time Interval, (Configurable, default 30 minutes)

Unsolicited Notification Delay, (Configurable, default 5 seconds)

Unsolicited Response Retry Delay, (Configurable (between 3 - 9), default 5 seconds)

Unsolicited Offline Interval, (Configurable, default 30 seconds)

Binary Change Event Scan Period, (Polled; Not Applicable)

Double Bit Change Event Scan Period, (Unsupported; Not Applicable)

Analog Change Event Scan Period, (Unsupported; Not Applicable)

Counter Change Event Scan Period, (Unsupported; Not Applicable)

Frozen Counter Change Event Scan Period, (Unsupported; Not Applicable)

String Change Event Scan Period, (Unsupported; Not Applicable)

Virtual Terminal Event Scan Period, (Unsupported; Not Applicable)
Sends/Executes Control Operations:
WRITE Binary Outputs ☒Never ☐Always ☐Sometimes ☐Configurable
SELECT/OPERATE ☐Never ☒Always ☐Sometimes ☐Configurable
DIRECT OPERATE ☐Never ☒Always ☐Sometimes ☐Configurable
DIRECT OPERATE – NO ACK ☐Never ☒Always ☐Sometimes ☐Configurable

Count > 1 ☒Never ☐Always ☐Sometimes ☐Configurable

Pulse On ☐Never ☐Always ☒Sometimes ☐Configurable

Reyrolle 7SR5, Communication Protocol, Manual 81

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

Pulse Off ☐Never ☐Always ☒Sometimes ☐Configurable

Latch On ☐Never ☐Always ☒Sometimes ☐Configurable
Latch Off ☐Never ☐Always ☒Sometimes ☐Configurable

Queue ☒Never ☐Always ☐Sometimes ☐Configurable

Clear Queue ☒Never ☐Always ☐Sometimes ☐Configurable

Attach explanation if 'Sometimes' or 'Configurable' was checked for any operation.

Reports Binary Input Change Events when no specific Reports time-tagged Binary Input Change Events
variation requested: when no specific variation requested:
☐Never ☐Never
☐Only time-tagged ☐Binary Input Change With Time
☐Only non-time-tagged ☐Binary Input Change With Relative Time
☒Configurable to send one or the other ☒Configurable
Sends Unsolicited Responses: Sends Static Data in Unsolicited Responses:
☐Never ☒Never
☒Configurable ☐When Device Restarts
☐Only certain objects ☐When Status Flags Change
☐Sometimes (attach explanation)
☒ENABLE/DISABLE UNSOLICITED Function codes No other options are permitted.
supported
Default Counter Object/Variation: Counters Roll Over at:
☐No Counters Reported ☐No Counters Reported
☒Configurable ☐Configurable (attach explanation)
☐Default Object ☐16 Bits
Default Variation: ☒32 Bits
☒Point-by-point list attached ☐Other Value: _____
☒Point-by-point list attached
Sends Multi-Fragment Responses:
☒Yes
☐No
☐Configurable
Sequential File Transfer Support:
File Transfer Support ☐Yes ☒No
Append File Mode ☐Yes ☒No
Custom Status Code Strings ☐Yes☒No
Permissions Field ☐Yes ☒No
File Events Assigned to Class ☐Yes ☒No
File Events Send Immediately ☐Yes ☒No
Multiple Blocks in a Fragment ☐Yes ☒No
Max Number of Files Open 0

DNP3 Serial consists of a set of functions and a library of data types, called Groups (or sometimes Objects),
upon which they may be performed. The functions include commands such as Read, Write, Select and
Operate. Not all the functions and data groups need be implemented, although the devices must respond
correctly, for example, by returning object unknown, to an unimplemented command or group.
A full list of the DNP3 Serial data groups is given in Table below. At present we specifically support groups
associated with Analogue Inputs, Binary Inputs and Binary Outputs as well as standard groups e.g. Time and
Date etc.
For simplicity, for now, Analogue Inputs can be thought of as read only meters, Binary Inputs as read only
Booleans (True or False) and Binary Outputs as read / write Booleans.

82 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

Table 4-1 Functional Implementation Table

EVENT FORMAT
Static Object Number Description Supported
0 Device Attributes ✗
1 Binary Input ✓
2 Binary Input Event ✓
3 Double Bit Binary Input ✓
4 Double Bit Binary Input Event ✓

10 Binary Output ✓
11 Binary Output Event ✓
12 Binary Command ✓
13 Binary Output Command Event ✓

20 Counter ✓
21 Frozen Counter ✓
22 Counter Event ✓
23 Frozen Counter Event ✓

30 Analogue Input ✓
31 Frozen Analogue Input ✗
32 Analogue Input Event ✓
33 Frozen Analogue Input Event ✗
34 Analogue Input Dead Band ✓

40 Analogue Output Status ✗

41 Analogue Output ✗
42 Analogue Output Event ✗
43 Analogue Output Command Event ✗

50 Time and Date ✓

51 Time and Date CTO ✓
52 Time Delay ✓

60 Class Objects ✓

70 File Control ✗

80 Internal Indications ✓
81 Device Storage ✗
82 Device Profile ✗
83 Data Set ✗

85 Data Set Prototype ✗

86 Data Set Descriptor ✗
87 Data Set ✗
88 Data Set ✗

Reyrolle 7SR5, Communication Protocol, Manual 83

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

EVENT FORMAT
Static Object Number Description Supported
90 Application Identifier ✗
91 Status of Requested Operation ✗

100 Floating Point ✗

101 Binary Coded Decimal (BCD) ✗
102 Unsigned Integer ✗

110 Octet String ✗

111 Octet String Event ✗
112 Virtual Terminal Output Block ✗
113 Virtual Terminal Event Data ✗

120 Authentication ✗

The following table identifies which object variations, function codes, and qualifiers the Triangle MicroWorks,
Inc. DNP 3.0 Slave Source Code Library supports in both request messages and in response messages. For
static (non-change-event) objects, requests sent with qualifiers 00, 01, 06, 07, or 08, will be responded with
qualifiers 00 or 01. Requests sent with qualifiers 17 or 28 will be responded with qualifiers 17 or 28. For
change-event objects, qualifiers 17 or 28 are always responded.
In the table below, underlined text as 00, 01 (start stop) indicates Subset Level 3 functionality (beyond Subset
Level 2).
In the table below, italic text as 07, 08 (limited qty) indicates functionality beyond Subset Level 3.

Table 4-2 Triangle MicroWorks, Inc. DNP 3.0 Slave Source Code Library

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
1 0 Binary Input – 1 (read) 00, 01 (start-
Any Variation 22 (assign stop)
class) 06 (no range,
or all)
07, 08
(limited
qty)
17, 27, 28
(index)
1 1 Binary Input 1 (read) 00, 01 (start- 129 00, 01 (start-
stop) (response) stop)
06 (no range, 17, 28 2
or all)
07, 08
(limited
qty)
17, 27, 28
(index)

2 For static (non-change-event) objects, qualifiers 17 or 28 are only responded when a request is sent with qualifiers 17 or 28,
respectively. Otherwise, static object requests sent with qualifiers 00, 01, 06, 07, or 08, will be responded with qualifiers 00 or 01.
(For change-event objects, qualifiers 17 or 28 are always responded.)

84 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
1 23 Binary Input 1 (read) 00, 01 (start- 129 00, 01 (start-
with Status stop) (response) stop)
06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
2 0 Binary Input 1 (read) 06 (no range,
Change – Any or all)
Variation 07, 08
(limited qty)
2 1 Binary Input 1 (read) 06 (no range, 129 17, 28 (index)
Change or all) (response)
without Time 07, 08 130 (unsol.
(limited qty) resp)
2 23 Binary Input 1 (read) 06 (no range, 129 17, 28 (index)
Change with or all) (response)
Time 07, 08 130 (unsol.
(limited qty) resp)
2 3 Binary Input 1 (read) 06 (no range, 129 17, 28 (index)
Change with or all) (response)
Relative Time 07, 08 130 (unsol.
(limited qty) resp)
3 0 Double Bit 1 (read) 00, 01
Input – Any 22 (assign (start-
Variation class) stop)
06 (no
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)

3 A Default variation refers to the variation responded when variation 0 is requested and/or in class 0, 1, 2, or 3 scans. Default
variations are configurable; however, default settings for the configuration parameters are indicated in the table above.

Reyrolle 7SR5, Communication Protocol, Manual 85

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
3 13 Double Bit 1 (read) 00, 01 129 00, 01
Input (start- (response) (start-
stop) stop)
06 (no 17, 28 3
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
3 2 Double Bit 1 (read) 00, 01 129 00, 01
Input with (start- (response) (start-
Status stop) stop)
06 (no 17, 28 3
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
4 0 Double Bit 1 (read) 06 (no
Input Change range, or
– Any Varia- all)
tion 07, 08
(limited
qty)
4 1 Double Bit 1 (read) 06 (no 129 17, 28
Input Change range, or (response) (index)
without Time all) 130
07, 08 (unsol.
(limited resp)
qty)
4 2 Double Bit 1 (read) 06 (no 129 17, 28
Input Change range, or (response) (index)
with Time all) 130
07, 08 (unsol.
(limited resp)
qty)
4 33 Double Bit 1 (read) 06 (no 129 17, 28
Input Change range, or (response) (index)
with Relative all) 130
Time 07, 08 (unsol.
(limited resp)
qty)

86 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
10 0 Binary Output 1 (read) 00, 01 (start-
– Any Varia- 22 (assign stop)
tion class) 06 (no range,
or all)
07, 08
(limited
qty)
17, 27, 28
(index)
10 1 Binary Output 1 (read) 00, 01 129 00, 01
(start- (response) (start-
stop) stop)
06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
1 (write) 00, 01
(start-
stop)
10 23 Binary Output 1(read) 00, 01 (start- 129 00, 01 (start-
Status stop) (response) stop)
06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
11 0 Binary Output 1 (read) 06 (no
Change – Any range, or
Variation all)
07, 08
(limited
qty)
11 1 Binary Output 1 (read) 06 (no 129 17, 28
Change range, or (response) (index)
without Time all) 130
07, 08 (unsol.
(limited resp)
qty)

Reyrolle 7SR5, Communication Protocol, Manual 87

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
11 23 Binary Output 1 (read) 06 (no 129 17, 28
Change with range, or (response) (index)
Time all) 130
07, 08 (unsol.
(limited resp)
qty)
12 0 Control Relay 22 (assign 00, 01
Output Block class) (start-
stop)
06 (no
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
12 1 Control Relay 3 (select) 17, 28 (index) 129 echo of
Output Block 4 (operate) (response) request
5 (direct op)
6 (dir. op,
noack)
12 2 Pattern 3 (select) 7 (limited 129 echo of
Control Block 4 quantity) (response) request
(operate)
5 (direct op)
6 (dir. op,
noack)
12 3 Pattern Mask 3 (select) 00, 01 (start- 129 echo of
4 stop) (response) request
(operate)
5 (direct op)
6 (dir. op,
noack)
13 0 Binary Output 1 (read) 06 (no
Command range, or
Event – Any all)
Variation 07, 08
(limited
qty)
13 13 Binary Output 1 (read) 06 (no 129 17, 28
Command range, or (response) (index)
Event without all) 130
Time 07, 08 (unsol.
(limited resp)
qty)

88 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
13 2 Binary Output 1 (read) 06 (no 129 17, 28
Command range, or (response) (index)
Event with all) 130
Time 07, 08 (unsol.
(limited resp)
qty)
20 0 Binary 1 (read) 00, 01 (start-
Counter – Any 22 (assign stop)
Variation class) 06 (no range,
or all)
07, 08
(limited
qty)
17, 27, 28
(index)
7 (freeze) 00, 01 (start-
8 (freeze stop)
noack) 06 (no range,
9 (freeze or all)
clear) 07, 08
10 (frz. cl. (limited
noack) qty)
20 1 32-Bit Binary 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter (with stop) (response) stop)
Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
20 2 16-Bit Binary 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter (with stop) (response) stop)
Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
20 3 32-Bit Delta
Counter (with
Flag)
20 4 16-Bit Delta
Counter (with
Flag)

Reyrolle 7SR5, Communication Protocol, Manual 89

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
20 53 32-Bit Binary 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter stop) (response) stop)
(without Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
20 6 16-Bit Binary 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter stop) (response) stop)
(without Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
20 7 32-Bit Delta
Counter
(without Flag)
20 8 16-Bit Delta
Counter
(without Flag)
21 0 Frozen 1 (read) 00, 01 (start-
Counter – Any 22 (assign stop)
Variation class) 06 (no range,
or all)
07, 08
(limited
qty)
17, 27, 28
(index)
21 1 32-Bit Frozen 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter (with stop) (response) stop)
Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)

90 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
21 2 16-Bit Frozen 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter (with stop) (response) stop)
Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
21 3 32-Bit Frozen
Delta Counter
(with Flag)
21 4 16-Bit Frozen
Delta Counter
(with Flag)
21 5 32-Bit Frozen 1 (read) 00, 01 129 00, 01
Counter (start- (response) (start-
(without Time stop) stop)
Of Freeze) 06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
21 6 16-Bit Frozen 1 (read) 00, 01 129 00, 01
Counter (start- (response) (start-
(without Time stop) stop)
Of Freeze) 06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
21 7 32-Bit Frozen
Delta Counter
(with Time Of
Freeze)
21 8 16-Bit Frozen
Delta Counter
(with Time Of
Freeze)

Reyrolle 7SR5, Communication Protocol, Manual 91

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
21 93 32-Bit Frozen 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter stop) (response) stop)
(without Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
21 10 16-Bit Frozen 1 (read) 00, 01 (start- 129 00, 01 (start-
Counter stop) (response) stop)
(without Flag) 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
21 11 32-Bit Frozen
Delta Counter
(without Flag)
21 12 16-Bit Frozen
Delta Counter
(without Flag)
22 0 Counter 1 (read) 06 (no range,
Change Event or all)
– Any Varia- 07, 08
tion (limited qty)
22 13 32-Bit Counter 1 (read) 06 (no range, 129 17, 28 (index)
Change Event or all) (response)
(without 07, 08 130 (unsol.
Time) (limited qty) resp)
22 2 16-Bit Counter 1 (read) 06 (no range, 129 17, 28 (index)
Change Event or all) (response)
(without 07, 08 130 (unsol.
Time) (limited qty) resp)
22 3 32-Bit Delta
Counter
Change Event
(without
Time)
22 4 16-Bit Delta
Counter
Change Event
(without
Time)

92 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
22 5 32-Bit Counter 1 (read) 06 (no 129 17, 28
Change Event range, or (response) (index)
(with Time) all) 130
07, 08 (unsol.
(limited resp)
qty)
22 6 16-Bit Counter 1 (read) 06 (no 129 17, 28
Change Event range, or (response) (index)
(with Time) all) 130
07, 08 (unsol.
(limited resp)
qty)
22 7 32-Bit Delta
Counter
Change Event
(with Time)
22 8 16-Bit Delta
Counter
Change Event
(with Time)
23 0 Frozen 1 (read) 06 (no range,
Counter Event or all)
(Variation 0 is 07, 08
used to (limited qty)
request
default varia-
tion)
23 13 32-Bit Frozen 1 (read) 06 (no range, 129 17, 28 (index)
Counter Event or all) (response)
07, 08
(limited qty)
23 2 16-Bit Frozen 1 (read) 06 (no range, 129 17, 28 (index)
Counter Event or all) (response)
07, 08
(limited qty)
23 3 32-Bit Frozen
Delta Counter
Event
23 4 16-Bit Frozen
Delta Counter
Event
23 5 32-Bit Frozen 1 (read) 06 (no 129 17, 28
Counter Event range, or (response) (index)
(with Time) all) 130
07, 08 (unsol.
(limited resp)
qty)

Reyrolle 7SR5, Communication Protocol, Manual 93

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
23 6 32-Bit Frozen 1 (read) 06 (no 129 17, 28
Counter Event range, or (response) (index)
(with Time) all) 130
07, 08 (unsol.
(limited resp)
qty)
23 7 32-Bit Frozen
Delta Counter
Event (with
Time)
23 8 16-Bit Frozen
Delta Counter
Event (with
Time)
30 0 Analog Input - 1 (read) 00, 01 (start-
Any Variation 22 (assign stop)
class) 06 (no range,
or all)
07, 08
(limited
qty)
17, 27, 28
(index)
30 1 32-Bit Analog 1(read) 00, 01 (start- 129 00, 01 (start-
Input stop) (response) stop)
06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
30 23 16-Bit Analog 1(read) 00, 01 (start- 129 00, 01 (start-
Input stop) (response) stop)
06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)

94 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
30 3 32-Bit Analog 1(read) 00, 01 (start- 129 00, 01 (start-
Input without stop) (response) stop)
Flag 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
30 4 16-Bit Analog 1(read) 00, 01 (start- 129 00, 01 (start-
Input without stop) (response) stop)
Flag 06 (no range, 17, 28 2

or all)
07, 08
(limited
qty)
17, 27, 28
(index)
30 5 short floating 1(read) 00, 01 129 00, 01
point (start- (response) (start-
stop) stop)
06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
30 6 long floating 1 (read) 00, 01 129 00, 01
point (start- (response) (start-
stop) stop)
06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
31 0 Frozen Analog
Input – Any
Variation
31 1 32-Bit Frozen
Analog Input
31 2 16-Bit Frozen
Analog Input

Reyrolle 7SR5, Communication Protocol, Manual 95

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
31 3 32-Bit Frozen
Analog Input
(with Time of
freeze)
31 4 16-Bit Frozen
Analog Input
(with Time of
freeze)
31 5 32-Bit Frozen
Analog Input
(without Flag)
31 6 16-Bit Frozen
Analog Input
(without Flag)
32 0 Analog 1 (read) 06 (no range,
Change Event or all)
– Any Varia- 07, 08
tion (limited qty)
32 1 32-Bit Analog 1 (read) 06 (no range, 129 17, 28 (index)
Change Event or all) (response)
without Time 07, 08 130 (unsol.
(limited qty) resp)
32 2 16-Bit Analog 1 (read) 06 (no range, 129 17, 28 (index)
Change Event or all) (response)
without Time 07, 08 130 (unsol.
(limited qty) resp)
32 3 32-Bit Analog 1 (read) 06 (no 129 17, 28
Change Event range, or (response) (index)
with Time all) 130
07, 08 (unsol.
(limited resp)
qty)
32 43 16-Bit Analog 1 (read) 06 (no 129 17, 28
Change Event range, or (response) (index)
with Time all) 130
07, 08 (unsol.
(limited resp)
qty)
32 5 short floating 1 (read) 06 (no 129 17, 28
point Analog range, or (response) (index)
Change Event all) 130
without Time 07, 08 (unsol.
(limited resp)
qty)

96 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
32 6 long floating 1 (read) 06 (no 129 17, 28
point Analog range, or (response) (index)
Change Event all) 130
without Time 07, 08 (unsol.
(limited resp)
qty)
32 7 short floating 1 (read) 06 (no 129 17, 28
point Analog range, or (response) (index)
Change Event all) 130
with Time 07, 08 (unsol.
(limited resp)
qty)
32 8 long floating 1 (read) 06 (no 129 17, 28
point Analog range, or (response) (index)
Change Event all) 130
with Time 07, 08 (unsol.
(limited resp)
qty)
33 0 Frozen Analog
Event – Any
Variation
33 1 32-Bit Frozen
Analog Event
(without
Time)
33 2 16-Bit Frozen
Analog Event
(without
Time)
33 3 32-Bit Frozen
Analog Event
(with Time)
33 4 16-Bit Frozen
Analog Event
(with Time)
33 5 Short Floating
Point Frozen
Analog Event
33 6 Long Floating
Point Frozen
Analog Event
33 7 Extended
Floating Point
Frozen Analog
Event

Reyrolle 7SR5, Communication Protocol, Manual 97

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
34 0 Analog Input 1 (read) 00, 01
Deadband (start-
(Variation 0 is stop)
used to 06 (no
request range, or
default varia- all)
tion) 07, 08
(limited
qty)
17, 27, 28
(index)
34 1 16 bit Analog 1 (read) 00, 01 129 00, 01
Input Dead- (start- (response) (start-
band stop) stop)
06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
2 (write) 00, 01
(start-
stop)
07, 08
(limited
qty)
17, 27, 28
(index)
34 23 32 bit Analog 1 (read) 00, 01 129 00, 01
Input Dead- (start- (response) (start-
band stop) stop)
06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
2 (write) 00, 01
(start-
stop)
07, 08
(limited
qty)
17, 27, 28
(index)

98 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
34 3 Short Floating 1 (read) 00, 01 129 00, 01
Point Analog (start- (response) (start-
Input Dead- stop) stop)
band 06 (no 17, 28 2
range, or
all)
07, 08
(limited
qty)
17, 27, 28
(index)
2 (write) 00, 01
(start-
stop)
07, 08
(limited
qty)
17, 27, 28
(index)
50 0 Time and Date
50 1 3 Time and Date 1(read) 07, 08 129 07 (limited
(limited qty) (response) qty = 1)
2(write) 00, 01
(start-
stop)
07, 08
(limited
qty)
17, 27, 28
(index)
50 3 Time and Date 2(write) 07 (limited
Last Recorded qty)
Time
51 1 Time and Date 129 (limited qty =
CTO (response) 1)
130 (unsol.
resp)
51 2 Unsynchron- 129 (limited qty =
ized Time and (response) 1)
Date CTO 130 (unsol.
resp)
52 1 Time Delay 129 (limited qty =
Coarse (response) 1)
52 2 Time Delay 129 (limited qty =
Fine (response) 1)
60 0 Not Defined
60 1 Class 0 Data 1 (read) 06 (no range,
or all)

Reyrolle 7SR5, Communication Protocol, Manual 99

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.1 Protocol Characteristics

OBJECT REQUEST RESPONSE

(Library will parse) (Library will respond with)
Object Variation Description Function Qualifier Function Qualifier
Number Number Codes Codes Codes Codes
(dec) (hex) (dec) (hex)
60 2 Class 1 Data 1 (read) 06 (no range,
or all)
07, 08
(limited qty)
20 (enbl. 06 (no range,
unsol.) or all)
21 (dab.
unsol.)
22 (assign
class)
60 3 Class 2 Data 1 (read) 06 (no range,
or all)
07, 08
(limited qty)
20 (enbl. 06 (no range,
unsol.) or all)
21 (dab.
unsol.)
22 (assign
class)
60 4 Class 3 Data 1 (read) 06 (no range,
or all)
07, 08
(limited qty)
20 (enbl. 06 (no range,
unsol.) or all)
21 (dab.
unsol.)
22 (assign
class)
80 1 Internal Indi- 1 (read) 00, 01 (start- 129 00, 01 (start-
cations stop) (response) stop)
2 (write) 4 00 (start-stop)
index=7
No Object (function code 13 (cold
only) restart)
No Object (function code 14 (warm
only) restart)
No Object (function code 23 (delay
only) meas.)
No Object (function code 24 (record
only) current time)

4 Writes of Internal Indications are only supported for index 7 (Restart IIN1-7)

100 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.1 Protocol Characteristics

4.1.2 Miscellaneous

DNP3 Serial also provides functionality for time synchronizing, writing control commands etc. For details
about these aspects refer to Table 4-2.

Reyrolle 7SR5, Communication Protocol, Manual 101

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

4.2 Settings and Properties

4.2.1 Setting for the Serial connection

The settings for the rear serial communications are located in the Communications menu of the setting tree.
DNP3 Serial as implemented is a classic master and slave arrangement, with 1 master and numerous slaves
in a system. Each device, including the master, is assigned a unique address in the range 0 – 65520. Other
addresses are reserved for specific purposes, for example, 65535 is for broadcast commands.

[sc_7SR5_CommunicationsMenu, 2, --_--]

Figure 4-1 Communications Menu in the Settings Tree

Setting name Range Default Setting Notes

Station Address 0 to 254 (IEC 0 1 to As required An address must
60870-5-103) be given to identify
0 to 247 (Modbus- the relay. Each relay
RTU) must have a unique
0 to 65534 (DNP3) address.
COM1-RS485 OFF, IEC IEC 60870-5-103 DNP3 Sets the protocol
Protocol 60870-5-103, used to communi-
Modbus-RTU, DNP3 cate on the RS485
connection.
COM1-RS485 Baud 75 110 150 300 600 19200 As Required The baud rate set
Rate 1200 2400 4800 on all of the relays
9600 19200 38400 connected to the
57600 115200 same RS485 bus
230400 must be the same as
the one set on the
master device.

102 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

Setting name Range Default Setting Notes

COM1-RS485 Parity NONE, ODD, EVEN NONE As Required The parity set on
all of the relays
connected to the
same RS485 bus
must be the same
and in accordance
with the master
device.
COM1-RS485 Mode Local, Remote, Local Remote Remote Selects whether the
Or Remote port is Local or
Remote.
DNP3 Unsolicited DISABLED ENABLED DISABLED As Required When Enabled
Mode unsolicited event
transmission can
be controlled
by the Master.
When Disabled the
Master requests are
ignored.
DNP3 Destination 0 to 65534 0 As Required Setting is only
Address visible when COM1
Protocol is set to
DNP3. The address
of the Master to
which unsolicited
events will be sent.
DNP3 Application 5 ..to 300 s 10 s As Required Specifies the
Timeout response timeout for
the Application layer
confirmation

4.2.2 Device Mapping and configuration

Each specific device model will have a unique configuration file.

The supported information available for each device can be viewed using the Reydisp Manager 2 PC Software
Commincation Editor tool. The device template must be installed and selected.

Unsolicited Events
DNP3 Serial offers a mode, unsolicited events, where slave devices may send events without being polled
by the master. To do this the slave must be set to allow unsolicited events, and must have a destination
address for the master to which they are sent. These features are enabled and available via two settings on
the communications menu. When the slave allows unsolicited events the master can enable and disable this
feature at will. When the slave device starts it is by default disabled, therefore to use it one of the first things
the master must do is set it to enabled.

Reyrolle 7SR5, Communication Protocol, Manual 103

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

[sc_7SR5_CommunicationsMenu, 2, --_--]

Figure 4-2 Basic Setting Parameters

In addition further configuration is available via the Advanced Configuration within the Communications
Editor configuration file in Reydisp Manager 2 when the DNP3 Serial tab is selected, see Figure 4-4.
Unsolicited mode is enabled / disabled on a per class basis. Any combination of the three event classes can be
enabled for unsolicited mode. Therefore, for example, you may put events into class 1 that you want sent as
unsolicited, while classes 2 and 3 are polled.
You can create a table with entries as shown in Figure 4-4.
To access the Advanced Configuration window the user must click on the following icon.

[sc_7SR5_DNP3AdvancedConfig, 1, --_--]

Figure 4-3 Icon for Advanced Configuration Window

104 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

[Platform Communications Protocol Manual Unsolicited Events2, 2, --_--]

Figure 4-4 Advanced Configuration

Parameter: DNP3 > Advanced Settings > Offline Poll Period (s)

• Default: Disabled
Default setting: 10 s
This setting selects the period to re-establish communication for an offline poll.

Reyrolle 7SR5, Communication Protocol, Manual 105

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

Parameter: DNP3 > Advanced Settings > Confirm Mode

• Default: Disabled
Default setting: Never
This setting is to set a link layer confirmation, if required. Setting options are Never, Sometimes, and
Always.

Parameter: DNP3 > Advanced Settings > Confirm Timeout (s)

• Default: Disabled
Default setting: 2 s
This setting is the maximum time to wait for a link layer confirmation.

Parameter: DNP3 > Advanced Settings > Max Retries

• Default: Disabled
Default setting: 3
This setting sets the maximum number of link layer retries if link layer confirms timeout.

Parameter: DNP3 > Advanced Settings > Receive Frame Timeout (s)

• Default: Disabled
Default setting: 15 s
This setting selects the maximum time to wait for a complete frame after a valid sync frame character is
received.

Parameter: DNP3 > Advanced Settings > First Char Transmit Wait Time (ms)

• Default: Disabled
Default setting: 0 ms
This setting is the minimum wait time after a character is received before the device will transmit a
character.

Parameter: DNP3 > Advanced Settings > Link Status Period (s)

• Default: Disabled
Default setting: 0 s
This setting configures the keep alive period to send link requests if no frames have been received.

Parameter: DNP3 > Advanced Settings > Enable Self Address

• Default: Disabled
Default setting: Disabled
This setting selects if the self address functionality is enabled on this slave device.

Parameter: DNP3 > Advanced Settings > Multi-Fragment Response Allowed

• Default: Disabled
Default setting: Enabled
This setting allows the use of multi fragment message responses.

106 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

Parameter: DNP3 > Advanced Settings > Multi-Fragment Confirm

• Default: Disabled
Default setting: Enabled
This setting is enabled if confirmations are requested for frames within a multi fragment response.

Parameter: DNP3 > Advanced Settings > Select Timeout (s)

• Default: Disabled
Default setting: 5 s
This setting is the maximum amount of time that a select will remain valid before the corresponding
operate is received.

Parameter: DNP3 > Advanced Settings > Respond Need Time

• Default: Disabled
Default setting: Enabled
This setting selects if after start up the device will set the Need time INN bit.

Parameter: DNP3 > Advanced Settings > Clock Valid Period (m)

• Default: Disabled
Default setting: 30 m
This setting selects the duration the device clock will remain valid after receiving a DNP3 Serial time
synchronization.

Parameter: DNP3 > Advanced Settings > Allow Multi-CROB Requests

• Default: Disabled
Default setting: Enabled
This setting is to allow the use of multiple Control Relay Output Block (CROB) requests.

Parameter: DNP3 > Advanced Settings > Send Unsolicited when online

• Default: Disabled
Default setting: Disabled
This setting selects if unsolicited responses will be sent when the session comes online.

Parameter: DNP3 > Advanced Settings > Max Retries

• Default: Disabled
Default setting: 3
This setting selects the maximum number of unsolicited retries allowed. After this is exceeded the offline
retries timeout is applied.

Parameter: DNP3 > Advanced Settings > Unsolicited Retry Delay (s)

• Default: Disabled
Default setting: 5 s
This setting is to select the delay period after an unsolicited confirm timeout before retrying the
response.

Reyrolle 7SR5, Communication Protocol, Manual 107

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

Parameter: DNP3 > Advanced Settings > Unsolicited Offline Retry Delay (s)

• Default: Disabled
Default setting: 30 s
This setting selects the time after the Max retries to wait before retrying the unsolicited response
after an unsolicited timeout.

Parameter: DNP3 > Advanced Settings > Unsolicited Class 1 Max Delay (s)

• Default: Disabled
Default setting: 5 s
This setting selects the maximum amount of time after an event before an unsolicited class 1 response is
generated when unsolicited events are enabled.

Parameter: DNP3 > Advanced Settings > Unsolicited Class 2 Max Delay (s)

• Default: Disabled
Default setting: 5 s
This setting selects the maximum amount of time after an event before an unsolicited class 2 response is
generated when unsolicited events are enabled.

Parameter: DNP3 > Advanced Settings > Unsolicited Class 3 Max Delay (s)

• Default: Disabled
Default setting: 5 s
This setting selects the maximum amount of time after an event before an unsolicited class 3 response is
generated when unsolicited events are enabled.

Parameter: DNP3 > Advanced Settings > Unsolicited Class 1 Max Events

• Default: Disabled
Default setting: 5
This setting selects the maximum number of events that are stored before an unsolicited class 1 response
is generated when unsolicited events are enabled.

Parameter: DNP3 > Advanced Settings > Unsolicited Class 2 Max Events

• Default: Disabled
Default setting: 5
This setting selects the maximum number of events that are stored before an unsolicited class 2 response
is generated when unsolicited events are enabled.

Parameter: DNP3 > Advanced Settings > Unsolicited Class 3 Max Events

• Default: Disabled
Default setting: 5
This setting selects the maximum number of events that are stored before an unsolicited class 3 response
is generated when unsolicited events are enabled.

Point Indexes
Each Group will have one or more data points associated with it. DNP3 does not define the content of a data
point, this is entirely down to the implementer or end user. The data points are usually numbered from 0. As

108 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

an example, a simple device may have 3 Analogue Inputs (0-2), 5 Binary Inputs (0-4) and 2 Binary Outputs
(0-1). Note, that that same index can be used for different Groups, illustrated in Table 4-3.

Table 4-3 Example Point Map 1

Analogue Input Binary Input Binary Output

0 0 0
1 1 1
2 2 –
– 3 –
– 4 –

The point indexes need not be continuous, although for efficiency it is not recommended that large gaps are
left in the sequence. For example, the 3 Analogue Inputs may be points 0-1 and 4. This is useful if some
models of a device omit certain features and you wish to keep the bulk of the documentation the same,
illustrated in Table 4-4.

Table 4-4 Example Point Map 2

Analogue Input Binary Input Binary Output

0 0 0
1 1 1
2
3
4 4

The communications editor allows changing of the point index for a particular point, and setting whether that
point is enabled in the device, as illustrated in Figure 4-5.

[sc_7SR5_PointIndexes, 1, --_--]

Figure 4-5 Setting the Point Index and Enabled Fields (Binary Inputs)

Reyrolle 7SR5, Communication Protocol, Manual 109

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

Reading Specific Data

In addition to reading all data or polling for events, the master can read a specific point or range of points
from a Group as it requires. For example, if it only wants to read Binary Inputs 2 and 3 it can do so. This is the
efficient way to read the present value of a point which is not in an event class without doing a full class 0
poll.
The range must be continuous with no unallocated points. Point mapping should be configured as a contin-
uous range to efficiently use this method.

Classes
DNP3 data points are arranged into four classes 0, 1, 2 and 3.
Class 0 (or static data) contains all the active points in the device. The master station will periodically perform
a poll of class 0, which is similar to IEC 870-5-103 General Interrogation, to populate its database with the
present values from a device. It cannot be changed at run time, the only way to remove a point from Class 0 is
to disable it or disable the function using the communications editor.
Classes 1, 2 and 3 (or event data) contain a sub set of the points within Class 0 and are used to report event
data. Unlike static data event data is usually time-stamped when something happens. The time stamp and
format variation can be configured in the Communications editor. Originally it was assumed that the three
classes would represent some sort of priority of data, e.g. high, medium and low, however this is not defined
by the standard and it is left up to the user to define the meaning, if any, of each class. The master can assign
and remove points from classes 1, 2 and 3 at run time. A class can contain a mixture of points from different
data Groups. For the purpose of reporting events a point can be assigned to any combination of classes 1, 2 or
3 or none, as illustrated in Table 4-5.

Table 4-5 Example Class Map

Class 1 Class 2 Class 3

Analogue Input 0 – – –
Analogue Input 1 – – ✓
Analogue Input 2 – ✓ –
Binary Input 0 – ✓ ✓
Binary Input 1 ✓ – –
Binary Input 2 ✓ – ✓
Binary Input 3 – – –
Binary Input 4 – – –
Binary Output 0 ✓ ✓ –
Binary Output 1 ✓ ✓ ✓

Default classes for points can be assigned by the Communications Editor, as illustrated in Figure 4-6, these
classes can then be reassigned by the master at run time.

110 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

[sc_7SR5_Classes, 1, --_--]

Figure 4-6 Setting the Default Class (Binary Inputs)

The master can poll for event data for any combination of classes 1, 2 and 3. An event will only be reported if
the point is assigned to a class polled by the master. If a point is not assigned to class 1, 2 or 3 it will not be
reported as an event.
The reported status of Binary Inputs can be inverted by selecting the Iv field in the Communications
editor.

Analogue Inputs
Table 4-6 lists Analog Inputs (Object 30). It is important to note that 16-bit and 32-bit variations of Analog
Inputs, Analog Output Control Blocks, and Analog Output Statuses are transmitted through DNP as signed
numbers.
The “Default Deadband,” and the “Default Change Event Assigned Class” columns are used to represent the
absolute amount by which the point must change before an analog change event will be generated, and once
generated in which class poll (1, 2, 3, or none) will the change event be reported.
The default analog input event buffer size is set to 30.

Reyrolle 7SR5, Communication Protocol, Manual 111

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

[Platform Communications Protocol Manual Analogue Inputs1, 2, --_--]

The implementations of DNP3 support Analogue Inputs via Data Groups 30 (static) and 32 (events). Each
of these groups divides into the variants listed below, followed by an example of how they are set in the
communications editor.

Table 4-6 Data Group 30 Variants

Group 30 Variant Name Description

1 Analogue Input – 32 bit The inputs are sent as a
with flag 32 bit integer with an 8
bit quality flag.
2 Analogue Input – 16 bit The inputs are sent as a
with flag 16 bit integer with an 8
bit quality flag.
3 Analogue Input – 32 bit The inputs are sent as a
without flag 32 bit integer.

112 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

Group 30 Variant Name Description

4 Analogue Input – 16 bit The inputs are sent as a
without flag 16 bit integer.
5 Analogue Input – single The inputs are sent as a
precision, floating point 32 bit float, conforming
with flag to IEEE-754 standard,
with an 8 bit quality flag.

[sc_7SR5_AnalogueInputs, 1, --_--]

Figure 4-7 Setting the Analogue Input Group 30 Variant

Table 4-7 Data Group 32 Variants

Group 32 Variant Name Description

1 Analogue Input Event – The inputs are sent as a
32 bit without time 32 bit integer without a
time.
2 Analogue Input – 16 bit The inputs are sent as a
without time 16 bit integer without an
absolute time.
3 Analogue Input – 32 bit The inputs are sent as
with time a 32 bit integer with an
absolute time.
4 Analogue Input – 16 bit The inputs are sent as a
with time 16 bit integer with a time.

Reyrolle 7SR5, Communication Protocol, Manual 113

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

Group 32 Variant Name Description

5 Analogue Input – single The inputs are sent as a
precision, floating point 32 bit float, conforming
without time to IEEE-754 standard,
without a time.
7 Analogue Input – single The inputs are sent as a
precision, floating point 32 bit float, conforming
with time to IEEE-754 standard,
with an absolute time.

[sc_7SR5_AnalogueInputsGrp32, 1, --_--]

Figure 4-8 Setting the Analogue Input Group 32 Variant

In addition for Analogue Inputs the communications editor allows a multiplier factor to be specified for each
point, the value is multiplied by this factor before transmission. The multiplier could be used to scale values
to fit in specific data variants, for example, if you have a value of 5.678 and need to send it back as a 16 bit
integer, e.g. g30v2, set the multiplier to 1000 and it will be send as 5678 keeping the precision. Setting the
multiplier is illustrated below.

114 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

[sc_7SR5_AnalogueInputsInpMult, 1, --_--]

Figure 4-9 Setting the Analogue Input Multiplier

Also for Analogue Inputs the communications editor allows a dead band factor to be specified for each point.
This ± dead band specifies the window outside of which an event is generated. The % flag specifies that the
dead band value should be treated as a percentage. Setting both parameters is illustrated below.

Reyrolle 7SR5, Communication Protocol, Manual 115

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

[sc_7SR5_AnalogueInputsInpDeadBand, 1, --_--]

Figure 4-10 Setting the Analogue Input Dead Band and Percentage Flag

Binary Inputs

Binary Input Points

The default binary input event buffer size is set to allow 100 events.
DNP3 support Binary Inputs via Data Groups 1 (static) and 2 (events). Each of these groups divides into the
variants listed in Table 4-8, followed by an example of how they are set in the communications editor.

Table 4-8 Data Group 1 Variants

Group 1 Variant Name Description

1 Binary Input – Packed The inputs are sent in a
Format packed format with 1 bit
per input.
2 Binary Input – With Flags The inputs are sent indi-
vidually 1 byte per input
with additional quality
bits.

116 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

[sc_7SR5_BinaryInputGrp1, 1, --_--]

Figure 4-11 Setting the Binary Input Group 1 Variant

Table 4-9 Data Group 2 Variants

Group 2 Variant Name Description

1 Binary Input Event – The inputs are sent indi-
Without Time vidually 1 byte per input
with additional quality
bits.
2 Binary Input Event – With As above + 48 bit absolute
Absolute Time time
3 Binary Input Event – With As 1 + 16 bit relative time
Relative Time

Reyrolle 7SR5, Communication Protocol, Manual 117

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

[sc_7SR5_BinaryInputGrp2, 1, --_--]

Figure 4-12 Setting the Binary Input Group 2 Variant

In addition for Binary Inputs the communications editor allows an inversion flag to be set, to invert the values
before transmission, as illustrated in Figure 4-13.

[sc_7SR5_BinaryInputInvFlag, 1, --_--]

Figure 4-13 Setting the Binary Input Invert Flag

118 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

Binary Output Status Points and Control Relay Output Blocks

Figure 4-14 shows both the Binary Output Status Points (Object 10), Events (Object 11) and the Control Relay
Output Blocks (Object 12).
While Binary Output Status Points are included here for completeness, they are not often polled by DNP3
Masters. It is recommended that Binary Output Status points represent the most recent DNP “commanded”
value for the corresponding Control Relay Output Block point. Because many, if not most, Control Relay
Output Block points are controlled through pulse mechanisms, the value of the output status may in fact be
meaningless. Binary Output Status points are not recommended to be included in class 0 polls.
As an alternative, it is recommended that “actual” status values of Control Relay Output Block points be looped
around and mapped as Binary Inputs. (The “actual” status value, as opposed to the “commanded” status value,
is the value of the actuated control. For example, a DNP control command may be blocked through hardware
or software mechanisms; in this case, the actual status value would indicate the control failed because of the
blocking. Looping Control Relay Output Block actual status values as Binary Inputs has several advantages:

• It allows actual statuses to be included in class 0 polls,

• It allows change event reporting of the actual statuses, which is a more efficient and time-accurate
method of communicating control values, and it allows reporting of time-based information associated
with controls, including any delays before controls are actuated, and any durations if the controls are
pulsed.
The default select/control buffer size is large enough to hold 10 of the largest select requests possible.

Reyrolle 7SR5, Communication Protocol, Manual 119

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

[Platform Communications Protocol Manual Binary Inputs4, 2, --_--]

Figure 4-14 Binary Outputs

Communication editor PC software can be used to enable/ disable each information, specify the point number,
Class, Object Variables, CROB mask and invert the point information, as illustrated below.
Binary Outputs via Data Groups 10 (static) and 11 (events) are supported. Each of these groups divides into
the variants listed in Table 4-10, followed by an example of how they are set in the communications editor.

Table 4-10 Data Group 10 Variants

Group 10 Variant Name Description

1 Binary Output – Packed The outputs are sent in a
Format packed format with 1 bit
per input.
2 Binary Output – With The outputs are sent indi-
Flags vidually 1 byte per input
with additional quality
bits.

120 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

[sc_7SR5_BinaryOutputGrp10, 1, --_--]

Figure 4-15 Setting the Binary Output Group 10 Variant

Table 4-11 Data Group 11 Variants

Group 11 Variant Name Description

1 Binary Output Event – The outputs are sent indi-
Without Time vidually 1 byte per input
with additional quality
bits.
2 Binary Output Event – As above + 48 bit absolute
With Absolute Time time

[sc_7SR5_BinaryOutputGrp11, 1, --_--]

Figure 4-16 Setting the Binary Output Group 11 Variant

In addition for Binary Outputs the communications editor allows an inversion flag to be set, to invert the
values before transmission, as illustrated in Figure 4-17.

Reyrolle 7SR5, Communication Protocol, Manual 121

C53000-L7040-C013-1, Edition 04.2023
DNP3
4.2 Settings and Properties

[sc_7SR5_BinaryOutputInvFlag, 1, --_--]

Figure 4-17 Setting the Binary Output Invert Flag

Binary Output Commands

The implementations of DNP3 Serial support Binary Output Commands via Data Group 12 - Binary Output
Command. As these commands are sent by the master it is its responsibility to choose whether to use variant
1 CROB (Control Relay Output Block) or 2 PCB (Pattern Control Block).
The communications editor allows setting which CROB commands are allowed in a Binary Output Command.
Depending on the command there will be a sub-set of PULSE-ON, PULSE-OFF, LATCH-ON, LATCH-OFF, Paired
Trip, and Close.

NOTE

i The pulse or latch functionality is defined by the function being controlled and is independent of the
command format. The pulse, latch and trip and close selection is provided only to provide compatibility
with the command format of different master systems.

[sc_7SR5_BinaryCommandCROBMask, 1, --_--]

Figure 4-18 Setting the Binary Command CROB Mask

122 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 DNP3
4.2 Settings and Properties

Double Bit Input

The implementations of DNP3 Serial supports the double bit input.

[sc_7SR5_DoubleBitInput, 1, --_--]

Figure 4-19 Double Bit Input Tab

Counters
The implementations of DNP3 Serial supports counters.

[dw_7SR5_Counters, 1, en_US]

Figure 4-20 Counter Tab

(1) Frozen counters are also supported and points can be selected in the Fz column in the Communi-
cations editor.

Reyrolle 7SR5, Communication Protocol, Manual 123

C53000-L7040-C013-1, Edition 04.2023
124 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
5 Modbus TCP

5.1 Protocol Characteristics 126

5.2 Settings and Properties 132

Reyrolle 7SR5, Communication Protocol, Manual 125

C53000-L7040-C013-1, Edition 04.2023
Modbus TCP
5.1 Protocol Characteristics

5.1 Protocol Characteristics

5.1.1 Modbus TCP use in 7SR5 Devices

The Modbus TCP protocol is implemented on the Ethernet interface. This permits communication between the
master and the slave for substation automation via the Modbus TCP protocol. The Ethernet interfaces come
with 2 RJ45 connectors or with 2 duplex-LC interfaces for a 1300-nm fibre optic connection. The physical
interface is always duplicated to permit redundant networks. The Ethernet interface has 1 IP address.
The device supports the use of IEC 61850 protocol and the Modbus TCP at the same time.
Reydisp Manager 2 is used for the configuration of the Modbus TCP protocol.

Storage of the Parameter Set

During device start-up, the parameter set of the device is first activated for the Ethernet interface and then the
interface is started.

Information in the Parameter Set

The parameter set contains extensive information, such as the individual information for the devices config-
uration which can be mapped. This is carried out automatically by Reydisp Manager 2 during the device
function configuration and the user has no part in this mapping. Devices with different function scope and
type have different available information.

5.1.2 Protocol Structure

Modbus registers are 16 bit registers. There is not a standard as to how they are used; sometimes multiple
registers are used to hold a data value. This section describes the Modbus data types we are using. Where a
data type occupies more than one register, it is required that the number of consecutive registers are reserved.
For example, if a two register data point starts at 30101, it is required that register 30102 is also reserved and
so the next available register would be 30103.

5.1.3 Exception Response of Modbus Slave

If the Modbus slave receives a command from the Modbus master which cannot be processed (for example,
a request to read a non-existent register), then the slave answers with an exception-response message. The
following table shows the exception codes that are signaled in an exception-response message to the Modbus
master by the Modbus slave of the 7SR5 device.

Table 5-1 Exception Response

Exception Code Exception Response Description

Message
01 ILLEGAL_FUNCTION The Modbus slave of the 7SR5 device does not support the
function code used in the query by the Modbus master.
02 ILLEGAL_DATA_ADDRESS The register address is not configured in the Modbus slave.
03 ILLEGAL_DATA_VALUE The Modbus master tries to write to a register with illegal
data.

5.1.4 Supported Modbus Addresses

Each data type has a Modbus point address between 0001 and 9999, with a single digit prefix defining the
data type.

126 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus TCP
5.1 Protocol Characteristics

• 0xxxx – Coils

• 1xxxx – Inputs (Read only)

• 3xxxx – Status Registers (Read only)

• 4xxxx – Holding Registers

The complete list of points for a specific device configuration can be viewed and edited in Reydisp Manager 2
device configuration, Modbus TCP mapping file.

5.1.5 Supported Modbus Functions

The Modbus slave of the 7SR5 device supports the following Modbus functions:
Function Name Description Broadcast
Function Code
Supported
1 Read Coil Status Reading one or several coil-status no
registers of the Modbus slave. The
coil-status registers reflect the ON/OFF
status of discrete outputs of the 7SR5
device.
2 Read Input Status Reading one or several input-status no
registers of the Modbus slave. The
input-status registers reflect the
ON/OFF status of discrete inputs and
the status of the protection function of
the 7SR5 device.
3 Read Holding Registers Reading one or several holding regis- no
ters of the Modbus slave. The holding
registers contain device-status indica-
tions, measured values, mean values
and metered measurand.
4 Read Input Registers Reading one or several input regis- no
ters of the Modbus slave. The input
registers contain recorded measured
values.
5 Force Single Coil Writing (force to ON or OFF) one coil- no
status register.
15 Force Multiple Coils Writing (force to ON or OFF) multiple no
coil-status registers
16 Preset Multiple Registers Writing holding registers for resetting no
counters and setting the time.

5.1.6 Data Type Definition

Single-Point Indications: SPS

You can read single point indications by function code 1 or 2 via Modbus TCP. All these single point indications
are CDC (Common Data Class) types defined in IEC 61850-7-3.
Different data structures are used with different function codes.
For more information, refer to the following tables:

Table 5-2 Reading SPS by Read Coil Status (FC1) or Read Input Status (FC2)

Bit x
Value

Reyrolle 7SR5, Communication Protocol, Manual 127

C53000-L7040-C013-1, Edition 04.2023
Modbus TCP
5.1 Protocol Characteristics

Double Point Status

You can read double point indications, such as DPS (Double-point status), by function code 1 or 2 via Modbus
TCP.
Different data structures are used with different function codes.
For more information, refer to the following tables:

Table 5-3 Reading DPS by Read Coil Status (FC1) or Read Input Status (FC2)

Bit x+1 Bit x

Value

Single Point Control

You can send Single Point Control (SPC) by function code 5.

Table 5-4 Sending SPC by Force Single Coil (FC5)

Bit x
Value

Range of values: 0 = Off

1 = On

Double Point Control

You can send Double Point Control (DPC) by function code 15.

Table 5-5 Sending DPC by Force Multiple Coils (FC15)

Bit x+1 Bit x

Value

Range of values: 0 = Not allowed

1 = Off
2 = On
3 = Not allowed

Time Set and Counter Reset

You can send the time and reset device counters by function code 16.

Table 5-6 Sending Preset Multiple Registers (FC16)

Holding Register x+1 Holding Register x

Byte 3 Byte 2 Byte 1 Byte 0
(MSB:Most Significant (LSB:Least Significant Byte )
Byte )
Value

Range of values (Integer 32): -2 147 483 648 to 2 147 483 647

Time Meter
The time and date are set using 4 holding registers, by default starting at 40065. The time is loaded into these
registers by a Modbus client in the following format:
Holding Register x Holding Register x+1 Holding Register x+2 Holding Register x+3
Milliseconds Hours Minutes Months Days Day of Week Year – 1900

128 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus TCP
5.1 Protocol Characteristics

The time will be activated when written. Alternatively, the Use Set Time and Date Register can be
enabled, default holding register 40069, to signal activating the loaded time. The time registers do not update
and will always show the last written time.

Measurements
You can read measured values, such as MV (Measured Value), by function code 4.
The MV input register type can be selected in the Reydisp Manager 2 Modbus mapping file. The options
provided are Integer 16, Integer 32 or Float 32. The multiplier can also be selected from a predefined list.

Table 5-7 Reading MV by Read Input Register (FC4)

Holding Register x Holding Register x+1

Byte 3 (MSB) Byte 2 Byte 1 Byte 0 (LSB)
Value

Table 5-8 Reading MV by Read Input Register (FC4) Integer 16

Holding Register x
Byte 1 (MSB) Byte 0 (LSB)
Value

Range of values (Float 32): -3.4 ⋅ 1038 to 3.4 ⋅ 1038

0 ⋅ 7F8000001 = NaN (Not a Number)
Range of values (Integer 32): -2 147 483 648 to 2 147 483 647
Range of values (Integer 16): -32768 to 32767

Binary Counter Reading

You can read counter values, such as Binary Counter Reading (BCR), by function code 3.
The counters have a fixed type of either Integer 16 or Integer 32 as defined in the mapping file. They also have
a fixed scaling and mulitplier.

Table 5-9 Reading BCR by Read Holding Register (FC3)

Holding Register x Holding Register x+1

Byte 3 (MSB) Byte 2 Byte 1 Byte 0 (LSB)
Value

Range of values -2 147 483 6485 to 2 147 483 647

(Integer 32):

Device Information
Modbus master can read the device information fixed in the 7SR5 device. Encoded as ASCII text. Registers are
Read Only. Read using FC3.
Item Register Address Description
Communication ref 40001 to 40008 Example: 4E45h 3031h 0030h
Means: EN100
Communication module 40009 to 40010 Example: 0014h 0100h
firmware revision 0.1.20.0

5 The minimum value -2 147 483 648 indicates that the value is not valid.

Reyrolle 7SR5, Communication Protocol, Manual 129

C53000-L7040-C013-1, Edition 04.2023
Modbus TCP
5.1 Protocol Characteristics

Item Register Address Description

Device MLFB code 40011 to 40026 Example: 5337h 3552h 3131h 2D31h 4131h 3141h
2D31h 4130h 3041h
7SR5111-1AA11-0AA0
Date and time of mapping 40027 to 40034 Example: 3430h 3930h 3032h 3031h 3330h 3231h
data generation 3030h 0030h
4th Sept. 20 10:03:12.000

NOTE

i Address 40035 to 40048 are reserved for device information.

5.1.7 Multi-Connection to Master via Modbus

General
7SR5 supports multi-connection via Modbus as follows:

• Maximum 2 Modbus masters connect to the Modbus slave (7SR5 device) simultaneoulsy.
The port number for each Modbus TCP port can be configured, see 5.2.1 Device Mapping and Configuration.

[dw_7SR5_ExampleModbusConnection, 1, en_US]

Figure 5-1 Example Connection

The device can also communicate simultaneously using Modbus TCP over the front USB and rear ethernet
ports when configured using different ports.
Configuration TCP Port Number (#1) Default: TCP Port Number (#2) Default: Note
Scenario 502 504
1 Rear Ethernet Rear Ethernet Port addresses
2 Rear Ethernet Front USB must not be the
same.
3 Front USB Rear Ethernet

5.1.8 Operating Modes

The behavior of the protocol does not depend on the operating mode of the device.

5.1.9 Parallel Running with IEC 61850

7SR5 device supports the Modbus TCP and IEC 61850 protocols running on the same Ethernet interface.

130 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus TCP
5.1 Protocol Characteristics

The following restrictions are recommended:

• IEC 61850 clients: maximum 6 IEC 61850 clients communicate with 7SR5 device at one time.

• GOOSE (Generic Object Oriented Substation Event): maximum 5 GOOSE applications/datasets per device,
with 50 data objects in total. Use the standard settings of the communication profile PriorityLow in
GOOSE parameters of the IEC 61850 GOOSE application.
The recommendations mentioned in the preceding paragraph are not fixed. For example, you can configure
and download more GOOSE applications with more data objects as source and destination to the device.
Higher GOOSE load can lead to a delayed transmission.

Reyrolle 7SR5, Communication Protocol, Manual 131

C53000-L7040-C013-1, Edition 04.2023
Modbus TCP
5.2 Settings and Properties

5.2 Settings and Properties

If supported by the device template, Modbus TCP can be enabled by the end user. For security reasons it is
disabled by default and has no IP address configured.

Enabling Modbus TCP

Select the device in the project tree.
Open the Ethernet Interface from the task area.
Modbus TCP is enabled using the Services tab of the Ethernet Interface task.

[sc_7SR5_DNP3Configuration, 2, --_--]

Figure 5-2 Enable Modbus TCP

To enable the Ethernet port to use the Modbus TCP master as a time source the Enable Primary Time Server
must be selected in the Configure Interface, Time Synch tab. The IP address, subnet mask and standard
gateway should be configured in accordance with the network parameters for operation and 5.1.7 Multi-
Connection to Master via Modbus.

132 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus TCP
5.2 Settings and Properties

[sc_7SR5_ReydispManager2SNTPTab, 3, --_--]

Figure 5-3 Enable Primary Time Server

Once Modbus TCP is enabled, a resource file will be available within main device configuration view as shown
in Figure 5-4.

[sc_7SR5_ModbusTCPResourceFile, 1, --_--]

Figure 5-4 Modbus TCP Resource File

Reyrolle 7SR5, Communication Protocol, Manual 133

C53000-L7040-C013-1, Edition 04.2023
Modbus TCP
5.2 Settings and Properties

5.2.1 Device Mapping and Configuration

Each specific device model will have a unique configuration file.

The supported information available for each device can be viewed using the Reydisp Manager 2 PC software
tool in the Mapping file.
This protocol can be used on the USB port for testing purposes but primarily it should be used on the rear
ethernet ports.

[sc_7SR5_ModbusTCPConfiguration, 1, --_--]

Figure 5-5 Modbus TCP Configuration

The Options tab provides the General Modbus TCP parameters.

On completing any parameter and configuration changes select the Apply option.

134 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus TCP
5.2 Settings and Properties

Setting Name Range Default Setting Notes

Slave Address 1 to 247 1 As required An address must be
given to identify the
device. Each device
must have a unique
address.
This needs to match
the Unit Identi-
fier field sent by
the Modbus client.
TCP Port Number #1 100 to 65535 502 502 Selects the Trans-
Recommended, mission Control
although flexible Protocol port used
range is provided by the Modbus
server to listen and
receive data.
TCP Port Number #2 100 to 65535 504 504 Selects the Trans-
Recommended, mission Control
although flexible Protocol port used
range is provided by a second Modbus
server to listen and
receive data.
Coil Broadcast Yes Yes Yes Selects if the device
Message No shall be allowed
to broadcast coil
messages.
Holding Register Yes Yes Yes Selects if the device
Broadcast Message No shall be allowed to
broadcast holding
register messages.
Enable Time Disabled Disabled As required Selects if time
Synchronization Enabled synchronization is
enabled from
Modbus TCP. Should
not be used when
SNTP is used.
Use Set Time and Disabled Disabled As required Selects if time
Date Register Enabled and date register
can be updated
for acceptance of
previous written
clock synchroniza-
tion data or when
disabled the time
data is set at the
time of writing.

Reyrolle 7SR5, Communication Protocol, Manual 135

C53000-L7040-C013-1, Edition 04.2023
Modbus TCP
5.2 Settings and Properties

Setting Name Range Default Setting Notes

Allow ‘Force Single Disabled Disabled As required When enabled both
Coil’ for Double Enabled single and multiple
commands coils may be forced,
when disabled only
multiple coils may
be forced.
SLAVE_DEVICE_BUSY Yes No As required When selected
for ‘Data Invalid’ No only Read Input
Error register and Write
commands are
executed. When not
selected a bit in the
Diagnostics Register
indicates ‘Data Inva-
lid’.

NOTE

i If the Modbus time synch is Enabled, the Modbus TCP master shall perform time synchronization to the
slave periodically. The time source information sent from the NTP server will be rejected.

136 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
6 Modbus RTU

6.1 Protocol Characteristics 138

6.2 Settings and Properties 152

Reyrolle 7SR5, Communication Protocol, Manual 137

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.1 Protocol Characteristics

6.1 Protocol Characteristics

Description
This section describes the Modbus RTU protocol implementation in the relays. This protocol is used for the
communication with a suitable control system. This section provides a general description of the Modbus RTU
serial protocol and its implementation on the Reyrolle relay platform. It is not a description of the functionality
of each specific relay.
This protocol can be set to use the RS485 port.

NOTE

i Please note, not all data addresses will apply to all models. The exact information for a particular 7SR5
device model can be viewed in the Reydisp Manager 2 configuration using the Serial Comms & Events tool.

Protocol Structure
Modbus registers are 16 bit registers. There is not standard as to how they are used; sometimes multiple
registers are used to hold a data value. This section describes the Modbus data types we are using. Where a
data type occupies more than one register, it is required that the number of consecutive registers are reserved.
For example, if a two register data point starts at 30101, it is required that register 30102 is also reserved and
so the next available register would be 30103.
The number of registers required for each data type is shown in the table below:
Data Type # Registers required
EVENTCOUNT 1
EVENT 8
FP_32BITS_3DP 2
UINT16 1
UINT32 2
STR32 16
STR64 32
TIMEMETER 4

Data Types
EVENTCOUNT
Single register containing the number of event records stored, refer below.

EVENT
Modbus does not define a method for extracting events; therefore a private method has been defined based
on that defined by IEC 60870-5-103.
The EVENTCOUNT register contains the current number of events in the relays event buffer. The EVENT
registers contains the earliest event record available. The event record is 8 registers (16 bytes) of information,
whose format is described below. When this record has been read it will be replaced by the next available
record. Event records must be read completely; therefore the quantity value must be set to 8 before reading.

FP_32BITS_3DP
A real value transmitted as a 32 bit integer scaled and fixed point to three decimal places, for example, 12.345
would be sent as 12345.

UINT16
A 16 bit unsigned integer.

UINT32

138 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.1 Protocol Characteristics

A 32 bit unsigned integer.

STR32
A 32 byte String.

STR64
A 64 byte String.

TIMEMETER
A 4 register (8 byte) Time Meter formatted as shown below
Byte Key Description
0 ms L Milliseconds low byte
1 ms H Milliseconds high byte
2 Mi Minutes (MSB = invalid, time not
set > 23 hours)
3 Ho Hours (MSB - Summer time flag)
4 Da Days
5 Mo Months
6 Ye L Years low byte
7 Ye H Years high byte (If Not Used = 0)

Modbus Address
The Modbus point address.
Each data type has an address between 0001 and 9999, with a single digit prefix defining the data type.
0xxxx = Coils
1xxxx = Inputs (Read Only)
3xxxx= Status Registers (Read Only)
4xxxx= Holding Registers
Examples of requests and responses are given. If an invalid address is sent or the data is not available an
exception code will be returned.

Coils (0xxxx)
The coils are read and written by functions 1 (Read Coil Status) and 5 (Write Coil Status) respectively. Writing
to a coil is the mechanism we use to make Modbus perform a command, e.g. closing an output relay.
The Read Coil Status function will return an exception code 2 if any of the addresses in a range are invalid. The
addresses listed with an (*) cannot be read (polled) as their value is indeterminable. They are listed as write
only coils for sending commands to the device.
The Write Coil Status function will return an exception code (2) if the address is invalid, or if the command
cannot be executed. Some addresses listed above are ON only commands, rather than ON/OFF, sending OFF
to these addresses will also return exception code 2.

Example Reading Coils

Request the output relay coils 1 to 11. The start address is 01075, as per the Modbus standard this is sent by
the master without the 0xxxx identification and has 1 subtracted from it to make it zero based indexing i.e.
1075 - 1 = 1074 (0x0432). The quantity is set to 11 bits for the 11 output relays. In this example the slave
address is 1. All values are shown in hex notation. The response shows only output relay 1 is on.

Reyrolle 7SR5, Communication Protocol, Manual 139

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.1 Protocol Characteristics

Request Example
Slave Address 0x01
Function Code 0x01
Start Address Hi 0x04
Start Address Lo 0x32
Quantity of outputs Hi 0x00
Quantity of outputs Lo 0x0b
CRC Lo 0xdd
CRC Hi 0x32

Response Example
Slave Address 0x01
Function Code 0x01
Byte Count 0x02
Output status 1-8 0x01
Output status 9-11 0x00
CRC Lo 0xb8
CRC Hi 0x6c

Example Writing Coil

Request settings group 3 to be selected. The address is 00025, therefore sent as 25 - 1 = 24 (0x0018). The
command is on = 0xFF00. The slave address is 1.
Request Example
Slave Address 0x01
Function Code 0x05
Start Address Hi 0x00
Start Address Lo 0x18
Output Value Hi 0xff
Output Value Lo 0x00
CRC Lo 0x0c
CRC Hi 0x3d

Response Example
Slave Address 0x01
Function Code 0x05
Start Address Hi 0x00
Start Address Lo 0x18
Output Value Hi 0xFF
Output Value Lo 0x00
CRC Lo 0x0c
CRC Hi 0x3d

Inputs (1xxxx)
The input addresses are read by function 2 (Read Input Status). The Read Input Status function will return an
exception code 2 if any of the addresses in a range are invalid.
Example Reading Inputs
Request the status inputs 1 to 4. The start address is 10027, as per the Modbus standard this is sent by the
master without the 1xxxx identification and has 1 subtracted from it to make it zero based indexing i.e. 27 - 1

140 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.1 Protocol Characteristics

= 26 (0x001A). The quantity is set to 4 bits for the 4 inputs. In this example the slave address is 1. All values
are shown in hex notation. The response shows none of the status inputs is on.
Request Example
Slave Address 0x01
Function Code 0x02
Start Address Hi 0x00
Start Address Lo 0x1a
Quantity of inputs Hi 0x00
Quantity of inputs Lo 0x04
CRC Lo 0x58
CRC Hi 0x0e

Response Example
Slave Address 0x01
Function Code 0x02
Byte Count 0x01
Input status 1-4 0x00
CRC Lo 0xa1
CRC Hi 0x88

Input Registers (3xxxx)

The read input registers are returned as either a fixed point number or a string. Fixed point numbers will be
either 16 bits (1 register/word) or 32 bits (2 registers/words). The value may be scaled by the value in the
Scaling column of the above table, for example, a number sent as 1013 which is scaled by 1000 is equal to
1.013. The units of measure for the values are given in the Scaled Units column and refer to when any scaling
has been removed.

NOTE

i Only one of these measurands can be read per poll.

Event Record
Modbus does not define a method for extracting events; therefore a private method has been defined based
on that defined by section 5 IEC 60870-5-103.
Register 30001 contains the current number of events in the relays event buffer. Register 30002 contains
the earliest event record available. The event record is 8 registers (16 bytes) of information, whose format is
described below. When this record has been read it will be replaced by the next available record. Event records
must be read completely; therefore the quantity value must be set to 8 before reading. Failing to do this will
result in an exception code 2. If no event record is present the exception code 2 will be returned. The event
address should be polled regularly by the master for events.
Format
The format of the event record is defined by the zero byte. It signifies the type of record which is used to
decode the event information. The zero byte can be one of the following.

Table 6-1 Event Types

Type Description
1 Event
2 Event with Relative Time
4 Measurand Event with Relative Time

Table 6-2 describes the fields in the event record.

Reyrolle 7SR5, Communication Protocol, Manual 141

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.1 Protocol Characteristics

Table 6-2 Event Mnemonics

Key Description
FUN Function Type, as defined for IEC 870-5-103, refer to
section 5.
INF Information Number, as defined for IEC 870-5-103,
refer to section 5.
DPI Measurand Event with Relative Time, values 1 = OFF,
2 = ON.
ms L Time Stamp Milliseconds low byte
ms H Time Stamp Milliseconds high byte
Mi Time Stamp Minutes (MSB = invalid, time not set > 23
hours)
Ho Time Stamp Hours (MSB = Summer time flag)
RT L Relative Time low byte
RT H Relative Time high byte
F# L Fault Number low byte
F# H Fault Number high byte
Meas Measurand format R32.23, sent least significant byte
first

Table 6-3, Table 6-4, and Table 6-5 show the fields in the different event records as they are returned.

Table 6-3 Event Type 1 Format

Byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Content 1 0 FUN INF DPI 0 0 0 0 0 0 0 ms L ms Mi Ho
H

Table 6-4 Event Type 2 Format

Byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Content 2 0 FUN INF DPI RT L RT H F# L F# H 0 0 0 ms L ms Mi Ho
H

Table 6-5 Event Type 4 Format

Byte 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Content 4 0 FUN INF Meas RT L RT H F# L F# H ms L ms Mi Ho
H

Example
Request the event registers. The address is 30002, as per the Modbus standard this is sent by the master
without the 3xxxx identification and has 1 subtracted from it to make it zero based indexing (i.e. 1 = 0x0001).
The quantity is set to 8 registers. In this example the slave address is 1. All values are shown in hex notation.
The response shown is a type 1 event
Request Example
Slave Address 0x01
Function Code 0x04
Start Address Hi 0x00
Start Address Lo 0x01
Quantity of input Reg. Hi 0x00
Quantity of input Reg. Lo 0x08

142 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.1 Protocol Characteristics

Request Example
CRC Lo 0xa0
CRC Hi 0x0c

Response (1) Example

Slave Address 0x01
Function Code 0x04
Byte Count 0x10
Type 0x01
Reserved 0x00
FUN 0xa0
INF 0x19
DPI 0x01
Reserved 0x00
Reserved 0x00
Reserved 0x00
Reserved 0x00
Reserved 0x00
Reserved 0x00
Reserved 0x00
ms L 0x52
ms H 0x6c
Mi 0xad
Ho 0x17
CRC Lo 0x06
CRC Hi 0xbd

Table 6-6 and Table 6-7 illustrate type 2 and 4 event records.

Table 6-6 Type 2 Event Records

Response (2) Example

Slave Address 0x01
Function Code 0x04
Byte Count 0x10
Type 0x02
Reserved 0x00
FUN 0xa0
INF 0x54
DPI 0x02
RT L 0x00
RT H 0x00
F# L 0x41
F# H 0x30
Reserved 0x00
Reserved 0x00
Reserved 0x00
ms L 0x38
ms H 0x09
Mi 0xba

Reyrolle 7SR5, Communication Protocol, Manual 143

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.1 Protocol Characteristics

Response (2) Example

Ho 0x17
CRC Lo 0x92
CRC Hi 0xb5

Table 6-7 Type 4 Event Records

Response (4) Example

Slave Address 0x01
Function Code 0x04
Byte Count 0x10
Type 0x04
Reserved 0x00
FUN 0xa4
INF 0x47
Meas Lo 0x00
Meas 1 0x80
Meas 2 0x1d
Meas Hi 0x44
RT L 0x00
RT H 0x00
F# L 0x00
F# H 0x00
ms L 0xb2
ms H 0x11
Mi 0xba
Ho 0x17
CRC Lo 0x79
CRC Hi 0xb1

Table 6-8 is an example of the exception response returned when no event records are available.

Table 6-8 Example of Exception Response to Event Record Request

Request Response
Slave Address 0x01
Function Code 0x84
Exception Code 0x02
CRC Lo 0x00
CRC Hi 0x43

Table 6-9 Holding Registers (4xxxx)

Address Description FORMAT SIZE (WORDS)

40001 Set Time Time 8 4

The holding register addresses listed in Table 6-9 are read by function 3 (Read Holding Registers) and written
by function 16 (Write Multiple Registers).
Register 40001 contains the devices time. The time must be read or written in one step; therefore the quantity
should be 4 registers. Failing to do this will result in an exception code 2. The time format is 8 bytes as follows.
Table 6-10 describes the fields in the time.

144 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.1 Protocol Characteristics

Table 6-10 Time Stamp Mnemonics

Key Description
ms L Time Stamp Milliseconds low byte
ms H Time Stamp Milliseconds high byte
Mi Time Stamp Minutes (MSB = invalid, time not set > 23
hours)
Ho Time Stamp Hours (MSB = Summer time flag)
Da Time Stamp Days
Mo Time Stamp Months
Ye L Time Stamp Years low byte
Ye H Time Stamp Years high byte (Not Used)

Table 6-11 shows the fields in the time as they are returned.

Table 6-11 Time Format

Byte 0 1 2 3 4 5 6 7
Content ms L ms H Mi Ho Da Mo Ye L Ye H

Examples
Request time registers. The address is 40001, as per the Modbus standard this is sent by the master without
the 4xxxx identification and has 1 subtracted from it to make it zero based indexing. The quantity is set to 4
registers. In this example the slave address is 17. All values are shown in hex notation. The time returned is
00:08:05.340, 2/Jan/00.
Request Example
Slave Address 0x01
Function Code 0x03
Start Address Hi 0x00
Start Address Lo 0x00
Quantity of inputs Hi 0x00
Quantity of inputs Lo 0x04
CRC Lo 0x44
CRC Hi 0x09

Response Example
Slave Address 0x01
Function Code 0x03
Byte Count 0x08
ms L 0xdc
ms H 0x14
Mi 0x08
Ho 0x00
Da 0x02
Mo 0x01
Ye L 0x00
Ye H 0x00
CRC Lo 0x9d
CRC Hi 0xef

Reyrolle 7SR5, Communication Protocol, Manual 145

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.1 Protocol Characteristics

Set time registers. Again the address is 40001. The quantity is set to 8 registers. In this example the slave
address is 17. All values are shown in hex notation. The time being set is 16 hours, 5 minutes, 30563
(0x7763) ms and the date 29 October 03.
Request Example
Slave Address 0x01
Function Code 0x10
Start Address Hi 0x00
Start Address Lo 0x00
Quantity of inputs Hi 0x00
Quantity of inputs Lo 0x04
Byte Count 0x08
ms L 0x63
ms H 0x77
Mi 0x05
Ho 0x10
Da 0x1d
Mo 0x0a
Ye L 0x03
Ye H 0x00
CRC Lo 0x10
CRC Hi 0x48

Response Example
Slave Address 0x01
Function Code 0x10
Start Address Hi 0x00
Start Address Lo 0x00
Quantity of inputs Hi 0x00
Quantity of inputs Lo 0x04
CRC Lo 0xc1
CRC Hi 0xca

The floating point value in a type 4 event record is defined by IEC 60870-5-103 being a Real value 32 bits wide
with a 23 bit fraction, 8 bit exponent and 1 bit sign, encoded as shown in Table 6-12.

Table 6-12 Floating Point Value

MSB LS
B
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
S Exponent Fraction

The value is transmitted in little endian format, Least Significant Byte (LSB) first, Most Significant Byte (MSB)
last.

146 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.1 Protocol Characteristics

NOTE

i In the RTU mode, message frames are separated with a silent interval of at least 3.5 character times and the
time interval is also called t3.5. The Modbus RTU master provides the t3.5 delay for responding to another
query.
The following silent interval time equation is implemented in the 7SR5 Relay:
tdelay required = 11 bits ⋅ 3.5/b
Where, b = baud rate in bit/s
tdelay for 7SR5 = tdelay required + 10 ms tolerance

[dw_time-setting_message-frame, 1, en_US]

Figure 6-1 Time Settings for Message Frame

tp = Pause time (pause before RTS = ON)

tv = Setup time (transmission delay after RTS = ON)
tn = Hold time (pause time after sending before RTS = tOFF)
ts = Hold receiver disabled after RTS = OFF
rdis = Disable receiver when using half duplex protocol

NOTE

i Only active when ts = 0

NOTE

i Only tp or ts must be equal to tdelay for the 7SR5 Relay.

6.1.1 Device Mapping and configuration

The implementation of Modbus supports the reading and writing of coils.

The communications editor allows the following items to be configured by the user.
EN - Enable
This check box enables each point in the Modbus data map. A point must be enabled to be accessed via
Modbus.
Name
The internal name of the point.
Address
The address of the coil in the data map.

Reyrolle 7SR5, Communication Protocol, Manual 147

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.1 Protocol Characteristics

[Platform Communications Protocol Manual Settings and Properties2, 2, --_--]

The implementation of Modbus supports the reading inputs.

The communications editor allows the following items to be configured by the user.
EN - Enable
This check box enables each point in the Modbus data map. A point must be enabled to be accessed via
Modbus.
Name
The internal name of the point.
Address
The address of the input in the data map.

148 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.1 Protocol Characteristics

[Platform Communications Protocol Manual Settings and Properties3, 2, --_--]

The implementation of Modbus supports the reading of input registers.

The communications editor allows the following items to be configured by the user.
EN - Enable
This check box enables each point in the Modbus data map. A point must be enabled to be accessed via
Modbus.
Name
The internal name of the point.
Address
The starting address of the register in the data map.
Format
The format of the register(s) in the data map. Definitions of format are given in the above section.
Multiplier
This column specifies the value a point is multiplied by before being transmitted. For example, it can be used
to scale a value to fit within the precision of a storage unit. A real value of 1.234 converted to a 16 bit integer
would be 1. Therefore, it may be first multiplied by 1000 giving 1234 which would then be stored as 1234. It
can be any floating point number.

Reyrolle 7SR5, Communication Protocol, Manual 149

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.1 Protocol Characteristics

[Platform Communications Protocol Manual Settings and Properties4, 2, --_--]

NOTE

i Note: The image above shows all fields which are possible to edit. For some versions of device firmware not
all fields will be available for changing

The implementation of Modbus supports the reading and writing to holding registers.
The communications editor allows the following items to be configured by the user.
EN - Enable
This check box enables each point in the Modbus data map. A point must be enabled to be accessed via
Modbus.
Name
The internal name of the point.
Address
The starting address of the register in the data map.
Format
The format of the register(s) in the data map. Definitions of format are given in the above section
Multiplier
This column specifies the value a point is multiplied by before being transmitted. For example, it can be used
to scale a value to fit within the precision of a storage unit. A real value of 1.234 converted to a 16 bit integer
would be 1. Therefore, it may be first multiplied by 1000 giving 1234 which would then be stored as 1234. It
can be any floating point number.

150 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.1 Protocol Characteristics

[Platform Communications Protocol Manual Settings and Properties5, 2, --_--]

NOTE

i Note: The image above shows all fields which are possible to edit. For some versions of device firmware not
all fields will be available for changing

Reyrolle 7SR5, Communication Protocol, Manual 151

C53000-L7040-C013-1, Edition 04.2023
Modbus RTU
6.2 Settings and Properties

6.2 Settings and Properties

Setting for the Serial connection
The Modbus RTU protocol implementation in the relays is used for the communication with a suitable control
system.
This protocol can be set to use the USB or RS485 ports. The relay can communicate simultaneously on all ports
regardless of protocol used.
Each device must be given an address to enable communication and can be set by the Communication
Interface:Device Address. A device with the default address of 0 will not be able to communicate.

[sc_7SR5_CommunicationsMenu, 2, --_--]

Setting name Range Default Setting Notes

COM1-RS485 Station 0 to 254 (IEC 0 1 to As required An address must be
Address 60870-5-103) given to identify the
0 to 247 (Modbus device. Each device
RTU) must have a unique
0 to 65534 (DNP3) address.
COM1-RS485 OFF, IEC Off Modbus RTU Sets the protocol
Protocol 60870-5-103, used to communi-
Modbus RTU, DNP3 cate on the RS485
connection.
COM1-RS485 Baud 75 110 150 300 600 38400 As Required The baud rate set
Rate 1200 2400 4800 on all of the relays
9600 19200 38400 connected to the
57600 115200 same RS485 bus
230400 must be the same as
the one set on the
master device.

152 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Modbus RTU
6.2 Settings and Properties

Setting name Range Default Setting Notes

COM1-RS485 Parity NONE, ODD, EVEN EVEN As Required The parity set on
all of the relays
connected to the
same RS485 bus
must be the same
and in accordance
with the master
device.
COM1-RS485 Mode Local, Remote, Local Remote Remote Selects whether the
Or Remote port is Local or
Remote.

Reyrolle 7SR5, Communication Protocol, Manual 153

C53000-L7040-C013-1, Edition 04.2023
154 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
7 IEC 60870-5-103

7.1 Protocol Characteristics 156

7.2 Settings and Properties 163

Reyrolle 7SR5, Communication Protocol, Manual 155

C53000-L7040-C013-1, Edition 04.2023
IEC 60870-5-103
7.1 Protocol Characteristics

7.1 Protocol Characteristics

Description
This section provides a general description of the IEC 60870-5-103 (henceforth 103) serial protocol and its
implementation on the Reyrolle relay platform. It is not a description of the functionality of each specific relay.
This protocol is used for the communication with a suitable control system. The control system or local PC
acts as the master in the system with the relay operating as a slave responding to the master’s commands.
The implementation provides event information, time synchronizing, commands and measurands and also
supports the transfer of disturbance records.
This protocol can be set to use the rear RS485 port.

NOTE

i This section is also not a description of the 103 standard, although it will include a brief description of the
relevant parts of the protocol as it is intended that significant knowledge of 103 is not required to use this
document.

NOTE

i Where necessary, comparison will be made to other protocols, DNP3 Serial and Modbus RTU. In addition
where configuration is available via the Communications Editor examples will be shown.

Protocol Structure
IEC 60870 part 5 was developed by IEC Technical Committee 57 Working Group 3 as a standard for sending
telecontrol messages between 2 systems. It comprises 5 documents which define the Transmission Protocols,
listed in the following table.

Table 7-1 IEC 60870 Part 5 Documents

Prefix Description
IEC 60870-5-1 Transmission frame formats
IEC 60870-5-2 Link transmission procedures
IEC 60870-5-3 General structure of application data
IEC 60870-5-4 Definition and coding of application information
elements
IEC 60870-5-5 Basic application functions

The protocol IEC 60870-5-103 is structured on the 3-layer model:

• Physical layer

• Data-link layer

• Application layer

Physical Layer
The physical layer specifies the transmission medium for the protocol.
Data transmission can be implemented as follows:

• Via optical fibers

• Via a wire-bound transmission system

The 7SR5 device supports the wire-bound transmission type and takes place via an RS485 interface.

156 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 60870-5-103
7.1 Protocol Characteristics

Data-Link Layer
The connections between a substation automation and the protection device must be executed via an
unbalanced link. This thereby prevents several protection devices from transmitting simultaneously. The
IEC 60870-5-103 protocol uses exclusively the format class FT 1.2 defined in IEC 60870-5-1 (transmission
formats). At the same time, formats with fixed and variable length as well as the single character E5H are
permissible.
The telegram with variable length is used for transmission of the user data between the monitoring and
monitored station and in the opposite direction.

[dw_tgrvlg, 3, en_US]

Figure 7-1 Telegram with Variable Length

The telegram with fixed length is intended for services of the data-link layer. In special cases, this format with
fixed length is used as an acknowledgment instead of an individual character.

[dw_tgrflg, 3, en_US]

Figure 7-2 Telegram with Fixed Length

The individual character is used to acknowledge service data of the data-link layer and user data.
E5H = ACK: Positive acknowledgment

Reyrolle 7SR5, Communication Protocol, Manual 157

C53000-L7040-C013-1, Edition 04.2023
IEC 60870-5-103
7.1 Protocol Characteristics

Application Layer
The application layer describes the Data Units (Data Units (DU)) for the transport telegrams. The 7SR5 platform
supports the following functions:

• Standard DUs in monitoring direction

• Standard DUs in control direction

ASDU Functions

ASDU 1 – Time-tagged message (Direction – Monitor) Message containing an event defined by FUN and INF,
a double point information (DPI) state, and a short
time (no date).
ASDU 2 – Time-tagged message with relative time As ASDU 1 plus a relative time offset from the start of
(Monitor) the fault in milliseconds and a fault number.
ASDU 3 – Measurands I (Monitor) Measurand frame, defined as containing one of four
measurand groups. The groups are {I}, {I,V}, {I,V,P,Q}
or {IN, VN}. Alternative measurands could be sent by
defining private FUN and INF values.
ASDU 4 – Time-tagged Measurands with relative time Message containing an “Analogue” event. As ASDU 2
(Monitor) except rather than the DPI state contains an analogue
value. The only value defined by 103 is “Fault Loca-
tion X in ohms”. Other values can be sent via this
method with different FUN and INF values defined.
ASDU 5 – Identification Message (Monitor) Message sent in response to an Initialisation (Reset)
command from the master. Contains manufacturer
and compatibility information.
ASDU 6 – Time Synchronization (Control & Monitor) Message sent by the master to instigate a synchro-
nization of the time. It contains a long time (time
& date) for synchronisation. If it is sent as a non-
broadcast message this ASDU will be returned by the
outstation to confirm the synchronisation.
ASDU 7 – Initiation of general interrogation (Control) Sent by the master to start a GI sequence from an
outstation. The GI messages are returned after class
1 polls by the master. This message contains an iden-
tifier allowing returned messages to be synchronized
to a request.
ASDU 8 – Termination of general interrogation Message sent by the outstation at the end of its GI
(Monitor) sequence to inform the master it is complete.
ASDU 9 – Measurands II (Monitor) Measurand message very similar to ASDU 3. It is
possible to truncate the fixed content by reducing the
measurand count in the frame.
ASDU 10 – Generic Data (Control & Monitor) We do not support Generic Data.
ASDU 11 – Generic Information (Monitor) We do not support Generic Information.
ASDU 20 – General command (Control) Message sent by the master to send a command to
the outstation. The command is defined by the FUN
and INF numbers. The command option is ON or OFF.
This message contains an identifier allowing returned
messages to be synchronized to a command.
ASDU 21 – Generic command (Control) We do not support Generic Commands.
ASDU 23 – List of recorded disturbances (Monitor) Message sent by the outstation to announce the
availability of disturbance records to the master.
Contains a listing of up to 8 records, each is identified
by a fault number and a long time stamp.

158 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 60870-5-103
7.1 Protocol Characteristics

ASDU 24 – Order for disturbance data transmission Message sent by the master to request part of
(Control) a disturbance record. Various commands are avail-
able, for example Request Disturbance Data, Request
Channel, Request Tags, Abort Channel etc.
ASDU 25 – Acknowledgement for disturbance data Message sent by the master to acknowledge part of
transmission (Control) a disturbance record. Various acknowledgements are
available.
ASDU 26 – Ready for transmission of disturbance data Sent by the outstation to announce the first part
(Monitor) of a disturbance data record is available. Contains
information such as Number of Channels, Number of
Elements per Channel, Interval between Elements etc.
ASDU 27 – Ready for transmission of a channel Sent by the outstation to announce an analogue
(Monitor) channel of a disturbance data record is available.
Contains information about the channel such Channel
Number and Scaling Factors.
ASDU 28 – Ready for transmission of tags (Monitor) Sent by the outstation to announce the (binary) tags
of a disturbance data record are available.
ASDU 29 – Transmission of tags (Monitor) Message containing binary tags, sent by the outsta-
tion. There are a maximum of 25 tags per message,
therefore it is likely there will be several of these
message to send all the tags. Each tags contains FUN
and INF numbers and a DPI state.
ASDU 30 – Transmission of disturbance values Message containing analogue disturbance values,
(Monitor) sent by the outstation. There are a maximum of 25
values per message, therefore it is likely there will be
several of these message to send all the values. Each
value is a 16 bit number.
ASDU 31 – End of transmission (Monitor) Sent by the outstation to announce the end of part of
the disturbance data transmission. Various announce-
ments are available.
ASDU 253 – Private Data - Termination of data Sent by the outstation to terminate a private
transfer (Monitor) (Reydisp) data transfer before it is complete.
ASDU 254 – Private Data – Not last frame (Control & Sent by the outstation, contains a segment of data
Monitor) of a private (Reydisp) data transfer. Depending of the
size of data transferred, a number of these segments
may be required, or non is the response is small, see
below.
ASDU 255 – Private Data – Last frame (Control & Sent by the outstation, contains the last segment of
Monitor) data of a private (Reydisp) data transfer. It is func-
tionally identical to ASDU 254. There will always be
one of these segments returned by the outstation,
depending of the size of data transferred it may be
the only segment required.

Cause of Transmission
All ASDUs sent by 103 are tagged with a cause of transmission (COT) from the table listed below.

Table 7-2 IEC60870-5-103 Cause of Transmission

Control Direction (Sent To Relay) Function Type Monitor Direction (Sent From
Relay)
1 Spontaneous
2 Cyclic
3 Reset Frame Count But (FCB)
4 Reset Communication Unit (CU)

Reyrolle 7SR5, Communication Protocol, Manual 159

C53000-L7040-C013-1, Edition 04.2023
IEC 60870-5-103
7.1 Protocol Characteristics

Control Direction (Sent To Relay) Function Type Monitor Direction (Sent From
Relay)
5 Start / Restart
6 Power On
7 Test Mode
Time Synchronization 8 Time Synchronization
Initiation of General Interrogation 9 General Interrogation
10 Termination of General Interroga-
tion
11 Local Operation
12 Remote Operation

General Command 20 Positive Acknowledgement of

Command
21 Negative Acknowledgement of
Command

Transmission of Disturbance Data 31 Transmission of Disturbance Data

Generic Write Command 40 Positive Acknowledge Generic

Write Command
41 Negative Acknowledge Generic
Write Command
Generic Read Command 42 Valid Data Response to Generic
Read Command
43 Invalid Data Response to Generic
Read Command
44 Generic Write Confirmation

The cause of transmission (COT) column of the ‘Information Number and Function’ table lists possible causes
of transmission for these frames. The following abbreviations are used:

Table 7-3 IEC 60870-5-103 Cause of Transmission Abbreviations

Abbreviation Description
SE spontaneous event
T test mode
GI general interrogation
Loc local operation
Rem remote operation
Ack command acknowledge
Nak Negative command acknowledge

NOTE

i Note: Events listing a GI cause of transmission can be raised and cleared; other events are raised only.

Function Type and Information Number

Data points in 103 are identified with two codes, a Function Type (FUN) and an Information Number (INF).
The following table lists the standard function types that are defined. In addition private function types have
been defined.

160 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 60870-5-103
7.1 Protocol Characteristics

Table 7-4 IEC 60870-5-103 Function Types

FUN Description Mnemonic

128 Distance Protection t(z)
160 Overcurrent Protection I>>
176 Transformer Differential Protection ΔIT
192 Line Differential Protection ΔIL
254 Generic Function Type GEN
255 Global Function Type GLB

A list of information numbers corresponding to standard types is defined. In addition private INF numbers
have been defined for the private INF numbers. The following table gives an extract of the list of standard INF
numbers and the functions under which they are used.

Table 7-5 IEC 60870-5-103 Extract of INF Numbers

INF Description Function

0 Time Synchronization GLB
48 Earth Fault L1 t(z), I>>
64 Start / Pick-Up L1 t(z), I>>, ΔIL
68 General Trip t(z), I>>, ΔIT, ΔIL
78 Zone 1 t(z)
86 Trip Measuring System L1 ΔIT
90 Trip I> I>>
148 Measurands IL1,2,3, VL1,2,3, P, Q, f t(z)

List of Function Codes Used in Reyrolle Devices

FUN Description Mnemonic

60 Reyrolle General
61 Reyrolle General Alarm
70 Reyrolle Status/Binary Inputs
75 Virtual Input/Output
80 Reyrolle Plant Controls/Binary
Outputs
85 Reyrolle GGIO
90 Reyrolle LED
91 Reyrolle LED Pick Up
160 Overcurrent Protection I>>
164 Reyrolle Overcurrent Protection
176 Transformer Differential Protection ΔIT
182 Reyrolle General
183 Reyrolle General
185 Reyrolle General
187 Reyrolle General
189 Reyrolle General
190 Reyrolle General
200 Reyrolle Control Commands
254 Generic Function Type GEN
255 Global Function Type GLB

Reyrolle 7SR5, Communication Protocol, Manual 161

C53000-L7040-C013-1, Edition 04.2023
IEC 60870-5-103
7.1 Protocol Characteristics

Classes
103 divides functions into two classes, 1 and 2. Class 1 is high priority data, for example, Time Tagged
Messages (Events). Class 2 is low priority, usually Measurands, sent with COT of cyclic.
The usual procedure for a master station is to poll each outstation periodically for class 2 data. If this data
exists it is returned. If class 1 data exists the master is informed as part of the response and can then
concentrate on polling that outstation while the class 1 data is available.

Initialisation
Before communications can take place the master sends a reset message to each outstation to synchronize the
communications systems. Until the outstation receives this message it will not respond.

Time Synchronization
103 specifies a Time Synchronization procedure where the master broadcasts a message, containing the
synchronize time, to all outstations.

General Interrogation
General Interrogation (GI) is the process by which the master stating polls all the (enabled) data points in a
device to populate its database with the present values. Usually only bi-state points are returned during GI,
points which only have one state, e.g. trips, are not returned.

Command Transmission
103 sends command to an outstation using the FUN and INF numbers with an ON or OFF command state.
Note, some commands may only support the ON command, for example, switching characteristic – the new
characteristic becomes active, the old one is automatically deactivated. Events will usually be sent confirming
the new state of a point. They use the same FUN and INF numbers as the command.

Blocking Mode
During Blocking Mode all indication messages generated by the outstation are not transmitted. In addition
functions such as General Interrogation are immediately terminated. General Commands are rejected and
returned with negative acknowledgement. Time Synchronization and Initialisation functions will still operate.

Measurand Information
Information from the analogue channels of the 7SR5 device is provided in the measurand data as ASDU 9.
Details of the type of information and format is provided in the device manual. The measurands are cyclic with
a refresh rate of 5 seconds or a change greater than a fixed % window. The time multiplier for the values are
fixed.

Disturbance Data
Disturbance Data is transmitted as ASDU 31, as a series of Tags representing binary points, which use the
FUN and INF numbers, and channels of analogue data representing currents and voltages etc. Each analogue
channel has scaling factors to convert from raw samples to Primary or Secondary quantities. Disturbance data
is NOT transmitted as COMTRADE records. To convert to COMTRADE addition processing must be performed
after the record is downloaded. 103 supports Disturbance records via ASDU 23-31. Reydisp supports wave-
forms that can be converted to Comtrade.
The disturbance record information provided for a particular 7SR5 device is detailed in the device manual.

Generic Services
We do not support Generic Services.

162 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 60870-5-103
7.2 Settings and Properties

7.2 Settings and Properties

Setting for the Serial Connection
The rear communication port can be used to connect with a SCADA system using the IEC 60870-5-103
protocol.
The settings for the rear communication port are located in the Communications menu of the setting tree.
IEC 60870-5-103 as implemented is a classic master and slave arrangement, with 1 master and numerous
slaves. Other addresses are reserved for specific purposes, for example, 255 is for broadcast commands.
Each relay must be given an address to enable communication and can be set by the Communication Inter-
face:Relay Address. A relay with the default address of 0 will not be able to communicate.

[Platform Communications Protocol Manual IEC60870-5-103 Image3, 1, --_--]

Figure 7-3 Settings Editor

Setting name Range Default Setting Notes

COM1-RS485 Station 0 to 254 (IEC 0 1 to As required An address must
Address 60870-5-103) be given to identify
0 to 247 (Modbus the relay. Each relay
RTU) must have a unique
0 to 65534 (DNP3 address.
Serial)
COM1-RS485 OFF, IEC Off IEC 60870-5-103 Sets the protocol
Protocol 60870-5-103, used to communi-
Modbus RTU, DNP3 cate on the RS485
Serial connection.
COM1-RS485 Baud 75 110 150 300 600 38400 As Required The baud rate set
Rate 1200 2400 4800 on all of the relays
9600 19200 38400 connected to the
57600 115200 same RS485 bus
230400 must be the same as
the one set on the
master device.

Reyrolle 7SR5, Communication Protocol, Manual 163

C53000-L7040-C013-1, Edition 04.2023
IEC 60870-5-103
7.2 Settings and Properties

Setting name Range Default Setting Notes

COM1-RS485 Parity NONE, ODD, EVEN None As Required The parity set on
all of the relays
connected to the
same RS485 bus
must be the same
and in accordance
with the master
device.
COM1-RS485 Mode Local, Remote, Local Remote Remote Selects whether the
Or Remote port is Local or
Remote.

Device mapping and configuration

Each specific relay model will have a unique configuration file.
The supported information available for each device can be viewed using the Reydisp Manager 2 PC Software
Commincation Editor tool. The device template must be installed and selected.
The communications editor can be used to specify FUN and INF numbers for data points, and to enable or
disable data points within the device, as illustrated below.
The display text allows the user to Edit the text displayed by 7SR5 device fascia Event log when viewing the
relays Event on the LCD.

[Platform Communications Protocol Manual IEC60870-5-103 Image4, 2, --_--]

Figure 7-4 Setting the FUN and INF values

164 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 60870-5-103
7.2 Settings and Properties

Measurands

Table 7-6 The following measurand information is applicable to the 7SR51 and 7SR57 non-directional
devices.

FUN INF Description ASDU COT

190 148 Measurand IL1,2,3 9 Cyclic – Refresh rate
IL1 (2.4x) 5 seconds or value
change greater than
IL2 (2.4x) Window 1 %.
IL3 (2.4x)
190 16 Measurand Max IL1,2,3 9 Cyclic – Refresh rate
IL1 Max (2.4x) 5 seconds or value
change greater than
IL2 Max (2.4x) Window 1 %.
IL3 Max (2.4x)

Table 7-7 The following measurand information is applicable to the 7SR5 directional devices.

FUN INF Description ASDU COT

190 148 Measurand IL1,2,3, VL1,2,3, P, Q, F, VL1-2,L2-3,L3-1 9 Cyclic – Refresh rate
IL1 (2.4x) (Window 1%) 5 seconds or value
change greater than
IL2 (2.4x) (Window 1%) Window x %.
IL3 (2.4x) (Window 1%)
VL1 (1.2x) (Window 1%)
VL2 (1.2x) (Window 1%)
VL3 (1.2x) (Window 1%)
P (2.4x) (Window 1%)
Q (2.4x) (Window 1%)
F (1.2x) (Window 0.1%)
VL12 (1.2x) (Window 1%)
VL23 (1.2x) (Window 1%)
VL31 (1.2x) (Window 1%)
190 17 (7SR51 Measurand Max IL1,2,3, VL1,2,3, P, Q, VL1-2,L2-3,L3-1 9 Cyclic – Refresh rate
and IL1 Max (2.4x) (Window 1%) 5 seconds or value
7SR57) change greater than
IL2 Max (2.4x) (Window 1%) Window x %.
21
(7SR54) IL3 Max (2.4x) (Window 1%)
VL1 Max (1.2x) (Window 1%)
VL2 Max (1.2x) (Window 1%)
VL3 Max (1.2x) (Window 1%)
P Max (2.4x) (Window 1%)
Q Max (2.4x) (Window 1%)
VL12 Max (1.2x) (Window 1%)
VL23 Max (1.2x) (Window 1%)
VL31 Max (1.2x) (Window 1%)

Reyrolle 7SR5, Communication Protocol, Manual 165

C53000-L7040-C013-1, Edition 04.2023
IEC 60870-5-103
7.2 Settings and Properties

Table 7-8 The following measurand information is applicable to the 7SR54 transformer devices.

FUN INF Description ASDU COT

190 10 W1 IL1,2,3 9 Cyclic – Refresh rate
IL1 (2.4 x) 5 seconds or value
change greater than 1
IL2 (2.4 x) %.
IL3 (2.4 x)
190 12 W2 IL1,2,3 9 Cyclic – Refresh rate
IL1 (2.4 x) 5 seconds or value
change greater than 1
IL2 (2.4 x) %.
IL3 (2.4 x)
190 14 W3 IL1,2,3 9 Cyclic – Refresh rate
IL1 (2.4 x) 5 seconds or value
change greater than 1
IL2 (2.4 x) %.
IL3 (2.4 x)
190 16 W1 Max IL1,2,3 9 Cyclic – Refresh rate
IL1 (2.4 x) 5 seconds or value
change greater than 1
IL2 (2.4 x) %.
IL3 (2.4 x)
190 18 W2 Max IL1,2,3 9 Cyclic – Refresh rate
IL1 (2.4 x) 5 seconds or value
change greater than 1
IL2 (2.4 x) %.
IL3 (2.4 x)
190 20 W3 Max IL1,2,3 9 Cyclic – Refresh rate
IL1 (2.4 x) 5 seconds or value
change greater than 1
IL2 (2.4 x) %.
IL3 (2.4 x)

Disturbance Data
The following Disturbance Recorder channel (ACC) numbers apply to the 7SR5 device.

NOTE

i Not all information is available in all device models.

FUN ACC Description

182 1 V1
182 2 V2
182 3 V3
182 4 V4
182 5 Ia
182 6 Ib
182 7 Ic
182 8 W1 Ia
182 9 W1 Ib
182 10 W1 Ic

166 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 IEC 60870-5-103
7.2 Settings and Properties

FUN ACC Description

182 11 W2 Ia
182 12 W2 Ib
182 13 W2 Ic
182 14 W3 Ia
182 15 W3 Ib
182 16 W3 Ic
182 17 Ig-1
182 18 Ig-2
182 19 Ig-3

Reyrolle 7SR5, Communication Protocol, Manual 167

C53000-L7040-C013-1, Edition 04.2023
168 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
8 Additional Features

8.1 Activation of Services 170

8.2 List of Required Open Ports 171
8.3 Reydisp Manager 2 Protocol 172
8.4 Ethernet Time Zone 173
8.5 SNTP 174
8.6 IEEE 1588 177
8.7 RSTP 179
8.8 PRP 183
8.9 HSR 184
8.10 SNMP 185
8.11 EN100 Homepage 195
8.12 Secure MMS 206
8.13 Syslog 207
8.14 Modbus Client 208

Reyrolle 7SR5, Communication Protocol, Manual 169

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.1 Activation of Services

8.1 Activation of Services

The following additional Ethernet services are available for the integrated Ethernet interface of the device:

• Reydisp protocol
For connection to the Reydisp PC configuration tool.

• SNTP Simple Network Time Protocol (SNTP) for the Ethernet module
This protocol is supported for the time synchronization over an Ethernet network.

• IEEE 1588 Precision Time Protocol (PTP)

This protocol is supported for the time synchronization over an Ethernet network.

• SNMP Simple Network Management Protocol (SNMP)

Provides monitoring information about the device to the network-management system.

• Syslog Protocol
Provides the device security log over the ethernet communication to 1 or 2 syslog servers.

• Homepage
Homepage for the Ethernet module. Ethernet communication modules provide a diagnostic function,
password setting and Communication firmware uploading. With the IP address/home, the page can be
viewed with a browser.

• Line Mode
Activates the line structure.

• Switch Mode
Activates the switch structure.
You can select the following network redundancy protocols:

• RSTP
Activates the Rapid Spanning Tree Protocol (RSTP) for the Ethernet module. This protocol will be needed
for redundant ring structures in the Ethernet networks.

• PRP
Activates the Parallel Redundancy Protocol (PRP) for the Ethernet module. With the PRP structure,
communication takes place simultaneously over 2 independent networks.

• HSR
Activates the High Availability Seamless Redundancy Protocol (HSR) for the Ethernet module. With the
HSR structure, the devices are arranged in rings.
The parameters associated with the above features are configured in Reydisp Manager 2 device configuration
Ethernet Interface.
The device can support a Modbus Client implementation for connecting an external Temperature Sensor
monitoring box to the rear RS485 port in devices that do not provide built in temperature sensor hardware.

170 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.2 List of Required Open Ports

8.2 List of Required Open Ports

Table 8-1 List of Required Open Ports

Service Layer 4 Layer 7 Typical Client Port Typical Server

Protocol Protocol Client Server Port
Reydisp Manger to TCP HTTPS PC: Reydisp >1024 7SR5 443
7SR5 device Manager 2
Reydisp Manger to UDP DTLS PC: Reydisp >1024 7SR5 50000
7SR5 device Manager 2
PC to 7SR5 device via TCP HTTPS PC: Web browser >1024 7SR5 443
EN100 homepage
PC to 7SR5 device via TCP HTTPS PC: Web browser >1024 7SR5 443
WebUI
IEC 61850, MMS, TCP IEC 61850 IEC 61850 client >1024 7SR5 102
Reporting
Time synch. SNTP UDP SNTP 7SR5 123 SNTP clock server 123
Time synch. PTP PTP V2 – 7SR5 – PTP clock server –
Monitoring via UDP SNMPv3 PC: SNMP client >1024 7SR5 161
Simple Network (e.g. SICAM PAS)
Management
Protocol (SNMPv3)
Modbus TCP TCP Modbus Substation SCADA >1024 7SR5 502
DNP3 TCP TCP DNP3 Substation SCADA >1024 7SR5 #1 20,000
#2 20,001
Syslog client UDP – 7SR5 – Syslog server 514

You can find more information about supported communication protocols in the 7SR5 Communication Proto-
cols Manual.

NOTE

i The Modbus TCP also supports port 504 and can be configured in Reydisp Manager 2. The syslog port
default is 514 but can be modified in Reydisp Manager 2. The DNP3 server ports can be configured in
Reydisp Manager 2.

Reyrolle 7SR5, Communication Protocol, Manual 171

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.3 Reydisp Manager 2 Protocol

8.3 Reydisp Manager 2 Protocol

There are 2 ways to connect from Reydisp Manager 2 to a device:

• Via USB

• Via an Ethernet interface

NOTE

i Only a Reyrolle device can be connected with Reydisp Manager 2 via USB.

Reydisp Manager 2 and the 7SR5 device are authenticated. The necessary certificates are contained in the
device upon delivery.

172 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.4 Ethernet Time Zone

8.4 Ethernet Time Zone

If the source of the time synchronism is from the device Ethernet port the device local time can be set using
the Ethernet Timezone function. The device time is set with an offset time relative to UTC reference and can
also include an automatic summertime switchover.

[sc_7SR5_EthernetTimezone, 2, --_--]

Figure 8-1 Ethernet Time Zone

Configuration
A drop down selection is provided for the Timezone offset. If a summertime switchover is required the
selection should not be selected and the summertime dates and offset time selected.

NOTE

i Both the time zone offset and the Summertime offset are set relative to UTC.

Reyrolle 7SR5, Communication Protocol, Manual 173

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.5 SNTP

8.5 SNTP
Protocol Description
For time synchronization via Ethernet according to SNTP, a time server must be present in the network. 1 or
2 time servers are supported. This time server must also be able to address the different time requirements of
the devices as defined in SNTP. Time servers can be reached through an IP address.
The Simple Network Time Protocol is used to synchronize clocks via the Internet. With SNTP, client devices can
synchronize their clocks with a time server via the Internet.
SNTP enables a time resolution of 1 ms. When considering similar runtimes, SNTP can determine the average
runtime of a synchronization telegram between the client and the server in the Ethernet network. This
transmission time can be taken into account in the terminal device and improves synchronization of terminal
devices.
The following settings can be configured in Reydisp Manager 2 device Ethernet Interface.
When the 7SR5 devices are not part of a station the SNTP can be configured in Reydisp Manager 2 using the
Configure Interface tool and Time Synch tab.

[sc_7SR5_ReydispManager2SNTPTab, 3, --_--]

Figure 8-2 Time Synch Tab

The SNTP servers are configured in the IEC 61850 system configurator when the 7SR5 device are allocated to a
Station and the options in Reydisp Manager 2 configuration will be greyed out and not available to configure.

174 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.5 SNTP

The NTP servers are integrated as Other IEC 61850 communicators via an ICD File which is included in Reydisp
Manager 2.

[sc_7SR5_Tools_Export IEC61850, 2, --_--]

Figure 8-3 Tools Menu

The first server functions as preferred server to ensure that all equipment runs with the same master clock if
possible. The second server is available as redundancy.
Status and Accuracy
The internal clock of the 7SR5 device reaches the steady state of ±1 ms after max. 15 minutes of a healthy
synchronization. This internal accuracy cannot be measured here because a precise trigger option is not
available. For checking purpose, a binary input is often triggered (configured: without a software filter, with
recalculation of the hardware filtering time). Such measurement, however, including jitter in binary input
processing, has deviations of approx. ±3 ms.
Time Fault Indication
A time fault indication is output when the clock server does not respond to inquiries of the 7SR5 device (after
the configured monitoring time has expired, in this example 10 minutes). From now on, the status of type
time fault is set in the time stamp of all indications. The bit clock failure in the IEC 61850-8.1 will be set
accordingly in the time stamp of the Data Object.
The time fault indication does not appear when the SNTP server itself has no connection to the time source
(e.g. no antenna signal, ...) and sends clock signals to all devices according to its internal accuracy. However,
at start-up, as long as no connection has been established with the SNTP server or the time synchronization
message indicates a stratum greater than 5, the bit ClockNotSynchronized will be set in the time stamp of the
Data Object, to indicate that the clock has not yet been synchronized.

Operation of the Redundant Time Server

The first, primary server remains the preferred server so that all devices, if possible, operate with the same
master clock.
The 7SR5 ethernet module interrogates both SNTP servers cyclically every minute. It normally synchronizes
itself on the first parameterized primary SNTP server. If the first SNTP server doesn't respond to a query twice
successively within the 1 minute polling interval, the time synchronization switchovers to the secondary,
second server. Further switchover criteria are:

• The server shows alarm on the response telegram (variable leap = 3)

• The Stratum of the server is 0 (unknown) or greater than 5

• The current time is indicated with 0 (if no reception)

• The running time of the telegram in the net is greater than 5 ms

The switchover will be prevented if the second server delivers no considerably better time signal, i.e. if the
server only was attainable last for less than 10 minutes, if it announces alarm or its Stratum is 0 or greater
than 5, or it indicates the current time with 0 or the running time of the telegram in the net is greater than 5
ms. In all of these cases the device is then no longer synchronized. It runs with the internal ms time base and
the last valid drift. After the parameterized time delay the device announces a time disturbance signal.
While the module is synchronizing on the second server, it also interrogates the first server. The switch back
to the first server will only take place if it has performed an acceptable quality for 10 minutes as already
mentioned. The switch back is delayed as long as all conditions are fulfilled.
At the startup of the module the first server will be interrogated, about 5 seconds later the second server, too.
The time of the first server will also be taken if the Stratum is 0 or greater than 5 or the second server offers a
better Stratum 5 seconds later.
The announcement of a time disturbance signal works purely from the view of the device. I.e. it will only be
announced if the device is no longer synchronized from the module.

Reyrolle 7SR5, Communication Protocol, Manual 175

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.5 SNTP

For the redundant SNTP client on the module this means that the announcement of the time disturbance
signal will not be issued during a successful switchover on the second server. If the time delay of the
indication is parameterized on the minimum value of 2 minutes in the device, which corresponds to a twice
repeated failure, then the behavior isn't determined and the indication could possibly appear. So for a defined
behavior the time delay for the time disturbance indication has to be parameterized up to at least 3 minutes.
The time delay for the time disturbance indication is not available as a parameter on the module and therefore
can neither be tested nor be used for an adapted switchover time (the above mentioned 10 min).
While switching back to the first SNTP server no time disturbance indication will appear because the transition
takes place without loss of synchronization.

176 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.6 IEEE 1588

8.6 IEEE 1588

Protocol Description
The IEEE 1588 protocol is used for the synchronization of clocks via network communication.
The IEEE 1588 accuracy is 1 ms in line with other functionality of the device.

The 7SR5 uses clock type OC Slave Only.

OC Slave Only stands for Ordinary Clock Slave Only. This kind of clock is used for high accuracy time
synchronization. In case of OC Slave Only, the PTP (PTP Protocol) port or port pair never changes into the
master state.

The 7SR5 uses clock profile IEC 61850-9-3:2016.

The 7SR5 uses clock domain number 0.

Line mode and switch mode are supported.

Redundancy protocols supported are:

• HSR

• PRP

• RSTP

NOTE

i The 7SR5 devices do not support PTP messages that have VLAN tags.

Configuration
The following settings can be configured in Reydisp Manager 2 device Ethernet Interface. The IEEE 1588 may
be enabled or disabled from this page. The remaining parameters are fixed as described previously.

Reyrolle 7SR5, Communication Protocol, Manual 177

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.6 IEEE 1588

[sc_7SR5_ReydispManager2IEEETab, 1, --_--]

Figure 8-4 IEEE 1588 Enabled

178 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.7 RSTP

8.7 RSTP
Description
The Rapid Spanning Tree Protocol (RSTP) serves for the reorganization of the network structure in the event of
an error. In other words, RSTP reroutes the data to another path after the failure of a network path.
Parameter Settings for Networks
The setting parameters for the RSTP are located in the Ethernet Interface Device configuration tasks area in
Reydisp Manager 2.

[sc_7SR5_EthernetInterfaceIcon, 1, --_--]

Figure 8-5 Ethernet Interface Icon

Double-click the Ethernet Interface and select the Redundancy tab to change the configuration.
The values are either entered directly or selected from a drop down list of available options.

Reyrolle 7SR5, Communication Protocol, Manual 179

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.7 RSTP

[sc_7SR5_ReydispManager2RedundancyTab, 3, --_--]

Figure 8-6 Redundancy Tab

NOTE

i In this document bridge and switch refer to the same thing.

On completion select OK. The chosen parameters will be sent to the device when the configuration is sent
to the device. Please refer to the 7SR5 Engineering Guide for further detailed information on configuring a
device.

180 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.7 RSTP

Parameter Name Settings

Hello Time This time determines at what intervals the Hello Time
telegrams are transmitted.
1 s or 2 s
Standard setting = 2 s
Max Age Time The extent of a network is relevant when setting the
value.
MaxAge is a meter that counts down with each pass
through a bridge. Each switch must be able to reach
the root switch. For this reason, the MaxAge has to be
set such that the value on all paths to the root bridge
can never be 0. If this condition is not met, then the
network will break down and will not regenerate on
its own. This results in constant topology changes.
6 to 40
Standard setting = 40
Forward Delay The bridge Forward Delay Time setting is only rele-
vant if an STP switch is active in the network. In such
a case, the Forward Delay Time determines the recon-
figuration time of the network after an interruption.
Siemens recommends not changing the Forward
Delay Time setting.
4 s to 30 s
Standard setting = 21 s
Transmit Count Transmit Hold Count is a meter that applies to all
ports of the bridge. It limits the number of RSTP tele-
grams per port transmitted in sequence and without
delay.
When this telegram is transmitted, only one more
telegram per second is transmitted.
For a highly meshed system, a Transmit Hold Count
that is set low will result in a significant slowing of
the reconfiguration when the root switch fails.
Siemens recommends not changing the Transmit
Hold Count setting.
1 to 10
Standard setting = 10
Bridge Priority Bridge priority establishes the position of the bridge
in the network. The lower the value, the higher the
priority. The bridge with the highest priority is the
root bridge.
Siemens recommends setting the priority of the root
bridge to 0.
Siemens recommends setting the priority of the
replacement root bridge, which should be located
right next to the root bridge, to 4096. The replace-
ment root bridge should replace the root bridge in
case of a failure.
Siemens recommends setting the priority of all other
devices and bridges to 32 768.
0 to 61 440, in increments of 4096
Standard setting = 32 768

Reyrolle 7SR5, Communication Protocol, Manual 181

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.7 RSTP

Parameter Name Settings

Bridge Identifier The priority value of a bridge consists of the bridge
priority and bridge identifier.
The bridge identifier therefore provides a finer grada-
tion of the switches. This enables you to set the loca-
tion of the alternate switches in the network.
Siemens recommends not changing the default
setting of 2048.
0 to 4095
Standard setting = 2048
Cost Style The costs indicate the quality of a line. The higher
the value, the worse the line. In IEEE Std 802.1D™
– 2004, this value is established depending on the
velocity. For example, for 100 Mbit, path costs of 200
000 are defined. The setting is included in the valence
calculation of the vector.
Siemens recommends not changing this setting.
0 to 200 000 000
Standard setting = 200 000

RSTP Cooperation with Siprotec 5

In the network topology where 7SR5 and EN100 based devices are connected, the parameter Cost Style
must be the same value (200000 or 200001) in all devices.
In an RSTP network topology containing both 7SR5 and SIPROTEC 5 devices in the same ring, the Cost Style
must be set to 200001 on all devices.

182 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.8 PRP

8.8 PRP
PRP (Parallel Redundancy Protocol) is a redundancy protocol for Ethernet networks. This protocol is specified
in the norm IEC 62439-3. In comparison to conventional redundancy procedures, for example, RSTP (Rapid
Spanning Tree Protocol, IEEE 802.1D-2004), PRP offers a switchover without interruptions. This avoids a dead
time in the event of a fault, and thus the highest availability.
Previous redundancy methods are based on mechanisms where the power-system components (switches and
bridges) agree with each other and find the best communication path for normal operation.
In the event of a fault, for example, in a cable, an optical fiber, or in case of a switch failure, the interruption
is detected and alternative paths are found in the network and connected. No communication can take place
during this switching procedure. Depending on the size and on the configuration of the Ethernet network, this
state can last for 10 ms up to around 1 s. A protocol extension in the end device is not necessary in this case
because the protocol is implemented in the switches.
PRP adopts a different approach.
The redundancy procedure is generated in the end device itself. The procedure is simple: The redundant
end device has 2 Ethernet interfaces with the same address (DAN, Double Attached Node). Then, the same
indication is sent twice, with PRP (parallel) via 2 separated networks. Both indications are unambiguously
identified with a sequence number.
The receiver takes the information that arrives first, stores the ID of the information in a duplicate filter using
the source address and the sequence number of the information. Thereby, the receiver recognizes the 2nd
redundant information and discards it.
If the 1st indication is missing, the 2nd indication with the same information arrives via the other network.
This redundancy avoids a switchover of the network and is therefore a redundancy without interruption. The
end device does not forward any indication to the other network.
In addition, it is possible to use one of the 2 networks for the transmission of not redundant indications. To do
so, connect a SAN (Single Attached Node) device to a network. In this way, a PRP end device can communicate
with a SAN end device (in a not redundant way). If you wish to connect a SAN end device in a redundant
way to a PRP system, use a REDBOX (redundancy box). This REDBOX provides PRP functionality externally as
an inline device. However, the PRP procedure also presents a disadvantage: You are buying the increased
redundancy function at the cost of a duplicate network (2x switches, cables).

NOTE

i Both networks must not be connected as this causes Ethernet double addressing and this can result in
malfunctions!

There are 2 versions of PRP: PRP-0 and the successor PRP-1. Siemens implements PRP-1.

Reyrolle 7SR5, Communication Protocol, Manual 183

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.9 HSR

8.9 HSR
Like PRP, HSR (High Availability Seamless Redundancy Protocol) is specified in the norm IEC 62439-3. Both
protocols provide a redundancy without switchover.
The basic function can be found in the definition of PRP. With PRP, the same indication is sent via 2 separated
networks. In contrast to that, with HSR, the indication is sent twice in both directions of the ring. The receiver
gets the indication via 2 ways in the ring, takes the 1st indication, and discards the 2nd (see PRP). Whereas
a PRP end device does not forward any indication, an HSR node has a switch function. Thus, the HSR node
forwards indications in the ring that are not addressed.
In order to avoid circling indications in the ring, special measures are defined in the case of HSR. SAN (Single
Attached Node) end devices can only be connected with a REDBOX in the case of HSR. PRP systems and HSR
systems can be coupled in a redundant way with 2 REDBOXES.

184 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.10 SNMP

8.10 SNMP
Description
The SNMP protocol is implemented in all 7SR5 devices.
Devices with firmware earlier than V02.20, with communication firmware earlier than V01.20 SNMPv2 is
supported.
Device firmware from V02.20, with communication firmware greater than V01.20, SNMPv3 with security
features is supported and SNMPv2 can not be used. The security features cover both strong authentication
and encryption (privacy) according to RFC 3414 and RFC 3415.
Usage of SNMPv3 is strongly recommended over earlier SNMP versions for security reasons.
The SNMP can be enabled and disabled in the Ethernet device configuration Services tab as shown in
Figure 8-7 or from the security page on the homepage by entering the maintenance password.

[sc_7SR5_DNP3Configuration, 2, --_--]

Figure 8-7 Enable/Disable SNMP

SNP3v3 Features
Security is a weak aspect in SNMP versions 1 through 2c. These versions of SNMP do not support logon
with password and user names; instead, communities were used. The disadvantage is that every user in the
network with a suitable program can read data and even change values. For additional security, in 7SR5
devices you cannot change any settings or values of the device via SNMP, except for settings affecting SNMP.

SNMPv3 Password Definitions

• USM-MIB (RFC3414, 2574)

• VACM-MIB (RFC3415, 2575)

You can find standard MIB information under http://www.snmplink.org/OnLineMIB/Standards.
.SNMPv3 offers improved authentication and privacy. 2 predefined user accounts exist in the device, with
different access levels.
The user usmUserTables are managed via an MIB browser software tool. The tables and passwords can
also be reset from the fascia using the Reset Passwords feature, see device manual for further information on
resetting passwords.

Table 8-2 Predefined User Accounts

User Name Authentication Authentication Encryption Encryption Access

Password Password
initial No No No No Read
templateMD5 HMAC-MD5 12345678 DES 12345678 Read, Write
templateSHA HMAC-SHA-1 12345678 DES 12345678 Read, Write

Reyrolle 7SR5, Communication Protocol, Manual 185

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.10 SNMP

The manner in which you create groups and users as well as change passwords depends on the SNMP
manager application used.

NOTE

i Connecting to the 7SR5 with SNMPv3 noAuthNoPriv template user ‘initial’, you can only read the MIBs
and datagram captured by wireshark in plaintext.

NOTE

i For security reasons, Siemens recommends removing these initial standard users, creating your own users,
and assigning passwords. Up to 16 users are allowed to be added into USM table. The corresponding SNMP
tree structures and tables for user management are readable and writable (USM-MIB). You can find more
information in the RFC documentation: USM-MIB (RFC 3414, 2574) and VACM-MIB (RFC3415, 2575).

NOTE

i Initial users can be restored via this webpage: https://IP-address/resetsnmpv3 and entering the Mainte-
nance password or using the Reset passwords feature on the device fascia.

The user can manage and configure the access in usmUserTable via the MIB Browser, which includes:

• View users
View existing SNMP users.

• Clone user
Create a new SNMPv3 user from an existing one. The new user has the same parameters as the clone-
from user. The new user has no access right to connect 7SR5 before it is binded to a group

• Delete user
Delete the existing SNMPv3 user.

• Enable/Activate user
Enable a disabled SNMPv3 user and change the row status from notInService(2) to active(1).

• Disable/Deactivate user
Disable the active SNMPv3 user and change the row status from active(1) to notInService(2).

• Authentication Password change

Change the authentication password to a new one.

• Privacy Password change

Change the privacy password to a new one.
An MIB2 browser and the associated description file is required to detect the module information or module
statuses using SNMP. MIB browsers allow to display SNMP information objects and their content.
In Figure 8-8 the product of iReasoning has been used, but any browser with a comparable scope will be
suitable.
The file SipEthernet.mib and digitalgridproductinventory.mib describes the available information objects and
allows to display them. The MIB can be found in the internet under http://www.siemens.com/Reyrolle.

186 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.10 SNMP

[sc_7SR5_IReasoning, 1, --_--]

Figure 8-8 iReasoning MIB Browser

Display of Link and RSTP Information

To display the information, the MIB file must first be loaded into the browser. Next, the IP address of the
desired device is set, and the information can be retrieved from the device. These settings and the operator
action can vary from one browser to the next.

Essential information on link and RSTP

Figure 8-9 shows the most essential items of information. The first 2 items are the status of the 2 interfaces
and the functionalities of RSTP.
If the module is operated as a switch, both channels must be active (Link Up). Data is transmitted and received
on both channels.

Role of the ports

The role of the ports is to allow to detect interruptions in the ring. A ring structure may have a physical
interruption. In that case the associated link is also set unavailable (LinkDown). The role of the port is then
disabled.
The physical connection via this port is interrupted, which means an error.

Logic break point in the ring

In normal operation with RSTP, however, the ring is broken at one point in the network in order to prevent
telegrams from circulating endlessly, which would make network operation impossible. The roles designated
and root indicate that there is no logic break point at the ports, i.e. that the logic break point is not located on
the connection between this port and the other device. Only one device in the ring shows the roles alternate
and designated, with the logic break point being located at the alternate port.
If the ports show the combination alternate-designated or backup-designated, the logic break point is located
at the port which is identified as alternate or backup. Knowing about the logic break point is useful for
commissioning (see also Figure 8-9).

Reyrolle 7SR5, Communication Protocol, Manual 187

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.10 SNMP

Port status
The port status only changes when the network is reconfigured due to an error. The logic break point is
then closed. The corresponding ports then take on the status discarding, in which no payload data is yet
transmitted; only administration information, such as changes of the role of a port, is transmitted. The status
which follows, learning, is only transitory because of the fixed address setting of the internal switches; still
no payload data is transmitted. The status forwarding characterizes the normal state, in which payload data
telegrams are transmitted.

[sc_7SR5_IReasoningEssentialInfo, 1, --_--]

Figure 8-9 iReasoning Essential Information

Display of GOOSE Information

GOOSE information can be displayed quite easily with SNMP. Only the MIB file SipGoose.mib is necessary.
The detail view in Figure 8-10 shows the 2 counters for the GOOSE telegrams.
The counter nRxMatchedTel shows the telegrams which have passed the multicast filter.
The counter nRxMismatchTel shows the number of telegrams revoked by the check of the further GOOSE
Parameters.

Multicast filter setting

In the present case only those telegrams are received which are intended for the device. The number of
blocked telegrams provides information of the network load due to other multicast telegrams. Both counters
also allow the correct setting of the multicast filter, provided that the number of multicast circuits is known.
Where there are several multicast circuits, some of which are not routed to the device, the counter nRxMis-
matchTel in this device must have a value that is not zero. If this is not the case, the filter setting is wrong,
and overloads in the communication may be the consequence. This display is of particular importance for the
commissioning of plants containing devices whose multicast addresses have not been routed using Reydisp
Manager 2 system configurator.
This filter is automatically set in Reydisp Manager 2 system configurator during the configuration of GOOSE
messages in the IEC 61850 System Configurator.

188 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.10 SNMP

[sc_7SR5_GooseTelegramInfo, 1, --_--]

Figure 8-10 GOOSE Telegram Information

Display of RSTP Parameters

The RSTP parameters are set and changed in Reydisp Manager 2. A read access to these parameters is also
possible via SNMP. Using the MIB file ReyOptical.mib, the following information is displayed.
The display shown in Figure 8-11 visualizes the RSTP parameters set in Reydisp Manager 2. They correspond to
the values shown in the display.
Figure 8-11 on the left shows that all existing MIB files can be loaded into the browser. This provides a tool
that allows to monitor all 7SR5 devices throughout the network with regard to their accessible information.
The devices can thus be integrated into the customer's power system management, and can be monitored
automatically.

Reyrolle 7SR5, Communication Protocol, Manual 189

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.10 SNMP

[sc_7SR5_RSTP Parameter Settings, 1, --_--]

Figure 8-11 RSTP Parameter Settings

For instance, the overall information about the ring allows to monitor its physical and logic state.

190 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.10 SNMP

Display of RSTP information using the BRIDGE-MIB

[sc_7SR5_RSTPInfo, 1, --_--]

Figure 8-12 RSTP Information

Table listing
For single information there are descriptions in the Bridge MIB.mib.
Name Value
dot1dBaseBridgeAddress.0 00-00-02-82-08-80
dot1dBaseNumPorts.0 2
dot1dBaseType.0 transparent-only
dot1dBasePort.1 1
dot1dBasePort.2 2
dot1dBasePortIfIndex.1 1
dot1dBasePortIfIndex.2 2
dot1dBasePortCircuit.1 .0.0
dot1dBasePortCircuit.2 .0.0
dot1dBasePortDelayExceededDiscards.1 0
dot1dBasePortDelayExceededDiscards.2 0
dot1dBasePortMtuExceededDiscards.1 0
dot1dBasePortMtuExceededDiscards.2 0
dot1dStpProtocolSpecification.0 ieee8021d
dot1dStpPriority.0 34951
dot1dStpTimeSinceTopologyChange.0 269
dot1dStpTopChanges.0 0
dot1dStpDesignatedRoot.0 0x10 0x00 0x00 0x0A 0xDC 0x02 0x5D 0xC0
dot1dStpRootCost.0 0

Reyrolle 7SR5, Communication Protocol, Manual 191

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.10 SNMP

Name Value
dot1dStpRootPort.0 2
dot1dStpMaxAge.0 40
dot1dStpHelloTime.0 2
dot1dStpHoldTime.0 100
dot1dStpForwardDelay.0 21
dot1dStpBridgeMaxAge.0 40
dot1dStpBridgeHelloTime.0 2
dot1dStpBridgeForwardDelay.0 21
dot1dStpPort.1 1
dot1dStpPort.2 2
dot1dStpPortPriority.1 128
dot1dStpPortPriority.2 128
dot1dStpPortState.1 Blocking
dot1dStpPortState.2 Forwarding
dot1dStpPortEnable.1 Enabled
dot1dStpPortEnable.2 Enabled
dot1dStpPortPathCost.1 200000
dot1dStpPortPathCost.2 200000
dot1dStpPortDesignatedRoot.1 0x10 0x00 0x00 0x0A 0xDC 0x02 0x5D 0xC0
dot1dStpPortDesignatedRoot.2 0x10 0x00 0x00 0x0A 0xDC 0x02 0x5D 0xC0
dot1dStpPortDesignatedCost.1 400000
dot1dStpPortDesignatedCost.2 400000
dot1dStpPortDesignatedBridge.1 0x80 0x34 0x08 0x00 0x06 0x86 0x58 0xB4
dot1dStpPortDesignatedBridge.2 0x80 0x34 0x08 0x00 0x06 0x86 0x58 0xA7
dot1dStpPortDesignatedPort.1 0x80 0x02
dot1dStpPortDesignatedPort.2 0x80 0x01
dot1dStpPortForwardTransitions.1 0
dot1dStpPortForwardTransitions.2 0

Setting and Properties

The SNMP is enabled by default in the 7SR5 device.

Setting for SNMPv3

The following example setting uses the iReasoning tool, but any browser with a comparable scope will be
suitable.
The parameters of the desired user should be configured in the Advanced configuration. For this example we
are using the default user templateMD5 shown in Table 8-2.
Address: xxx.xxx.xxx.xxx
Port: 161
USM User: templateMD5
Security Level: auth, priv
Auth Algorithm: MD5
Auth Password: 12345678
Privacy Algorithm: DES
Privacy Password: 12345678

192 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.10 SNMP

[sc_7SR5_SNMPAgentAdvancedProperties, 1, --_--]

Figure 8-13 SNMP Agent Advanced Properties

When connected the Manage SNMPv3 USM Users is used to view and configure the users.

[sc_7SR5_ManageSNMPUsers, 1, --_--]

Figure 8-14 Manage SNMPv3 USM Users

Reyrolle 7SR5, Communication Protocol, Manual 193

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.10 SNMP

The default users are displayed and users can be modified using the Activate, Deactivate and the passwords
changed using the relevant tool. In addition the users can be deleted or cloned. Using the Clone option new
users are created from the template user (or existing created user) with the same parameters but the user has
no access rights to the 7SR5.

[sc_7SR5_DefaultUserParameters, 1, --_--]

Figure 8-15 Default User Parameters

The passwords for the new user should now be changed.

Users should then modify the vacm security group table to bind the security of the user and create access for
the group using the vacm Access Table.

194 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.11 EN100 Homepage

8.11 EN100 Homepage

Description
The ethernet module is provided with a homepage, which can be invoked on all devices using the respective IP
address. Figure 8-16 shows an example of a homepage. The homepage is invoked by entering the IP address
of the device combined with home in the address line of the browser on the PC (e.g.: https://172.16.52.53/
home with IP = 172.16.52.53 set with Reydisp Manager 2). The homepage can also be entered from the
device fascia USB port using the front port IP, https://192.168.2.1/home. In special cases it may be useful to
read out the contents of the system log and send them to the hotline.

[sc_7SR5_EthernetEN100Homepage, 2, --_--]

Figure 8-16 Homepage of Ethernet EN100 Module

The module homepage always shows at its end the version and creation date of the software version loaded
on the module.
The homepage is not required in normal operation, and does not contain any relevant information for it. The
following pages (Table 8-3) on the left area of the homepage contains information for commissioning. They
contain operational information and internal error messages.

Table 8-3 Further Pages

Page Description
Statistics Shows relevant information of Ethernet
System Log Shows information of system behavior, being produced from operation
time
Connection Log Contains information about Client-Server-Connection
Startup Contains information about run-up behavior and configuration settings
respecting network and GOOSE Parameters
Error Log Contains internal error messages
SNTP Contains information about settings and condition of time synchroniza-
tion
PTP Contains information about settings and conditions of PTP IEEE 1588
time synchronization
RSTP Contains information about settings and condition of the network
redundancy
Diagnostics Shows specified parameter of modules, which are accessible by Siemens
on demand
PRP Logs HSR/PRP, contains information about network statistics
Upload Code Provide the way to upload EN100 software via web
Set Passwords Goes to the link where Reydisp Manager 2 connection password and
maintenance password can be set or changed separately

Reyrolle 7SR5, Communication Protocol, Manual 195

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.11 EN100 Homepage

Page Description
Setup Secure Engineering Access Enables secure maintenance connection
Setup SNMP Service Enables SNMPv3 or SNMPv1/v2 function
Secure MMS Not supported
Modbus TCP Contains information about settings and condition of the network
redundancy
DNP3 TCP Contains information about settings and condition of the network
redundancy
Security Resetting of access, SNMP users, and passwords

In normal operation the error buffer display is empty, as shown in Figure 8-17. The maintenance password
must be set to view the page.

[sc_7SR5_ErrorLogBuffer, 1, --_--]

Figure 8-17 Error Log Buffer

System Log
The system log serves to display internal information. A detail of the startup procedure is shown in
Figure 8-18. However, detailed insider knowledge is necessary to interpret the information displayed.

[sc_7SR5_SystemLog, 1, --_--]

Figure 8-18 Detail of System Log

Connection Log
The connection log shows the logs of connection details to the EN100 module.

196 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.11 EN100 Homepage

[sc_7SR5_ConnectionLog, 1, --_--]

Figure 8-19 Detail of Connection Log

GOOSE Event Log

The GOOSE event log displays the GOOSE subscription as soon as changes occur (data value or quality
from GOOSE Publisher or the result of an internal processing in subscriber, e.g. after a communication
interruption). The GOOSE repetitions are not logged in this page. Figure 8-20 shows the Web page of GOOSE
log. Table 8-4 shows the description of each item in GOOSE log.

[sc_7SR5_GooseLog, 1, --_--]

Figure 8-20 Detail from GOOSE Event Log

Table 8-4 Information Description on GOOSE Event Log Page

Name Description
No. Index of the events logged since module start
Rel. time (ms) Number of milliseconds since module start
Date & Time Time within the device at time of event (depends on device synchroniza-
tion)
Source MAC MAC address of the processed GOOSE publisher
Object Contains internal error messages
Value Internal number pointing to the element in the GOOSE dataset that has
changed (the according Data Object can be read in startup log)
State Internal value for the quality of the changed object, corresponding e.g.
to valid (0)/invalid (40)
st num Number of state change of received GOOSE message which is processed
sq num Sequence number of received GOOSE message which is processed
Dataset GOOSE Control Block Reference containing the changed object

Statistics
The statistics show a detail from the information which is available for special purposes and concerns data
transmission, including switches. Figure 8-21 shows a detail. The number of faulty symbols is of particular
importance, because it indicates a poor link quality. This value is incremented when switching on/off, or on a
break of the link. The number must not vary during operation.

Reyrolle 7SR5, Communication Protocol, Manual 197

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.11 EN100 Homepage

[sc_7SR5_Statistics, 1, --_--]

Figure 8-21 Detail from the Statistics

Important Information to be found on the Statistic Page

Table 8-5 contains the most important values to interpret the statistics. Set points are only given if they are
static. If they are not, the entry remains empty.

Table 8-5 Information Values on the Statistic Page

Name Set Point Description

RxFrames Counter for telegrams received which are
forwarded to module applications and the
TCP/IP stack.
BD out of sequence 0 Counter for receive buffer overflows in
the communications processor. This value
must always be zero.
Miss Counter for telegrams received that do not
match the MAC address of the device.
Broadcast Counter for broadcast telegrams received
Multicast Counter for multicast telegrams registered
More than 0x5f0 Bytes Counter for telegrams (1520 bytes)
that are too long. Such telegrams are
discarded.
Non Octett 0 Counter for the number of bits which
cannot be divided by 8. If this value is not
equal to zero, there may be problems on
the transmission link. This can also be the
case if the link is physically broken.
CRC Error 0 Counter for telegrams received with a CRC-
check error. Indicates possible problems
on the transmission link.
Overrun 0 Counter for receive buffer overflow. Indi-
cates possible performance problems of
the Ethernet controller.
Truncated 0 MAC-internal counter. Counter for reduced
telegrams received (> 2 kb)

198 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.11 EN100 Homepage

Name Set Point Description

TxFrames 0 Counter of telegrams transmitted.
no transmit buffer 0 Incrementing can only happen if the colli-
sion or retransmission volume is very high.
FNS queue overflow 0 Counts broadcast telegrams which were
not evaluated because of a processor over-
load. Activation usually due to circulating
telegrams.
Frames Loss 0 Counts of discarded received telegrams;
if more than 1000 such telegrams have
arrived per second. Can only occur with
circulating telegrams.
MaxRxBDs Max. level of the receiving buffer.
RxLoopMax 0 Counter for receiving buffer overrun.
RxOverload 0 Counter for receiving overload. Receiving
telegrams are lost.
TxDef 0 Counts the ’defers’ when sending frames.
An incrementation of the counter indicates
that half duplex mode is set.
TxHB 0 Heartbeat counter
TxLC 0 Late Collision counter
TxRL 0 Counts violations of the retransmission
limit
TxRC 0 Counts retransmissions. Indicates colli-
sions
TxUN 0 Counts ’Buffer underrun’
TxCSL 0 Counts ’Carrier sense lost’
MaxTxBD Max. level of the transmitting buffer.
nGooseHit Counts the GOOSE telegrams received
nGooseMiss Counts the GOOSE telegrams which
passed the multicast filter, but are not
addressed to the device (e.g. by incorrect
GOOSE-parameterization).
Relative time Momentary value of the relative time
counter. This is a 32 bit counter which is
incremented once per millisecond. Starts
at 120000 (is equal to appr. 49 days, after
it reboots with 0).
Module CPU load Efficiency CPU
txPacketChan1/2 Counts of data packages, which was sent
by the port.
rxPacketChan1/2 Counts of all data packages, which was
received by the port.
FilterSrcChan1/2 Counter of all received data packages,
which doesn’t agree with all received data
packages of the source address with the
own address.
FilterDstChan1/2 Counter of all received data packages,
which doesn’t agree with all received data
packages of the destination address with
the own address.
FilterCRCErrCnt Chan1/2 0 Counter of data packages with CRC error

Reyrolle 7SR5, Communication Protocol, Manual 199

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.11 EN100 Homepage

Name Set Point Description

FilterLenErrCnt Chan1/2 0 Counter of data packages, which are too
long or too short. The acceptable length is
64 bytes to 1518 bytes.
FilterSymErrCnt Chan1/2 0 Counter of received symbol errors on the
line (4b5b value is invalid). This moni-
toring is completed by the Phy.
overflowExtCnt Chan1/2 0 No counter for this value.
overflowIntCnt Chan1/2 0 No counter for this value.
overflowIntTraCnt 0 No counter for this value.
OptLevelChan1/2 > 2300 Level of the optical receiver in mV. Should
not be less than is connected.
EPLD Version Current EPLD version
Malloc Size Primary storage management
Data Size, Code Size, NORMAL pool, ENTRY Primary storage management
pool, GOOSE pool, WEAK pool

The information shown in Figure 8-22 are used for the analysis of broadcast telegram operations.
Max Broadcasts from lists the 4 most frequent broadcasts since the module was started. They are
generated from Broadcasts from and contain the following information:

• MAC address of the broadcast transmitter (MAC)

• Quantity of this broadcast during the last 4 m (n)

• Number of successive identical telegrams (GI)

• Length of telegrams (Len)

• Relative time (Rz)

Broadcasts from lists the current broadcasts in the running 4-minute interval. Each line contains 2 trans-
mitters with the following:

• MAC address of the broadcast transmitter (MAC)

• Number of broadcasts since the interval started (n)

• Number of successive identical telegrams (GI)

• Length of telegrams (Len)

The last line shows the current protocol software version and the time of generation.

[sc_7SR5_StatisticsPt2, 1, --_--]

Figure 8-22 Statistics, Part 2

200 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.11 EN100 Homepage

PRP
The following figure shows the PRP homepage. The main values of the PRP homepage are described in
Table 8-6.

[sc_7SR5_PRPHomepage, 1, --_--]

Figure 8-23 PRP Homepage

Table 8-6 Contents of PRP Homepage

Entry Meaning
LinkStatusChan1/2 Link status message
txPacketChan1/2 Number of data packages sent from the port
rxPacketChan1/2 Number of data packages received by the port
txPacketChan1/2 10s Number of data packages sent from the port within the last 10 seconds
rxPacketChan1/2 10s Number of data packages received by the port within the last 10
seconds
SeamlessConnections Number of modules, that have an active seamless connection. The value
must be < 512
CorrectLanChan1/2 Number of PRP-packages, that have been received with a correct
PRPLAN-ID
WrongLanChan1/2 Number of PRP-packages, that have been received with a wrong
PRPLAN-ID. If this counter is unequal to 0 there may be a wiring error.
A wiring error is present, if for example not all modules on the network
have channel 1 connected to LAN A and channel 2 to LAN B
CorrectLanChan1/2 10s Number of PRP-packages, that have been received with a correct
PRPLAN-ID within the last 10 seconds
WrongLanChan1/2 10s Number of PRP-packages, that have been received with a wrong
PRPLAN-ID within the last 10 seconds

HSR
The following figure shows the HSR homepage. The relevant values of the HSR homepage are described in
Table 8-7.

Reyrolle 7SR5, Communication Protocol, Manual 201

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.11 EN100 Homepage

[sc_7SR5_HSRHomepage, 1, --_--]

Figure 8-24 HSR Homepage

Table 8-7 Contents of HSR Homepage

Entry Meaning
LinkStatusChan1/2 Indication of link status
txPacketChan1/2 Number of data packages transmitted through the port
rxPacketChan1/2 Number of data packages received through the port
txPacketChan1/2 10s Number of data packages transmitted through the port in the last 10
seconds
rxPacketChan1/2 10s Number of data packages received through the port in the last 10
seconds
SeamlessConnections Number of modules with an existing seamless connection. This value
must be < 512
DeletedDuplicates1/2 Number of packages that were removed from the ring via the HSR
duplicate filter
DeletedDuplicates1/2 10s Number of packages that were removed from the ring via the HSR
duplicate filter st 10 seconds

SNTP
The 1st lines includes:

• Detail on the primary or currently active (primary or secondary) NTP server

• IP-address of the NTP server if connected

• Current time of the device which receives the synchronization from the module. Within the first minutes
after start-up of the device the time can differ from the time of the module for some milliseconds since
the device tries to bring the current time into line jump free.
The 2nd and 3rd lines are not relevant.
The 5th and 6th line contain some variables in table form from the received NTP telegrams of the primary and
secondary server as well as the time since the last received telegram and the time at the moment arising from
the synchronization of the module.

202 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.11 EN100 Homepage

The 2 tables for the max. 16 last received NTP telegrams and a short legend follow to this.

[sc_7SR5_SNTP, 1, --_--]

Figure 8-25 SNTP

PTP
Provides status, Clock Type and protocol information. Provides Offset time information and current device
time. Provides Grand Master ID and other information. Provides Last Synchronization information.

[sc_7SR5_PTP, 1, en_US]

Figure 8-26 PTP

Modbus TCP
The device will only display the information for the protocol that is enabled in the configuration, either DNP3
TCP or Modbus TCP.

DNP3 TCP
The device will only display the information for the protocol that is enabled in the configuration, either DNP3
TCP or Modbus TCP.

Reyrolle 7SR5, Communication Protocol, Manual 203

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.11 EN100 Homepage

RSTP
The 1st and 2nd line show the current values of role and status of the ports 1 and 2.
The 4th line shows the detected neighbors of the module detected in the ring at port 1 and 2 over RSTP
telegrams.
A listing of important RSTP information about the bridge and the 2 ports follows.

[sc_7SR5_RSTP, 1, --_--]

Figure 8-27 RSTP

Topology Change Count

A counter is available which registers changes of the network topology. Increases are generated during the
phase of commissioning typically. In a stable network the counter doesn’t change. Ramp up counters are
showing bad connections (e.g. loose connection). They show instability in the network and the operator has
to analyze the situation and resolve the problems.

204 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.11 EN100 Homepage

NOTE

i Under Actual of the bridge information the RSTP parameters obtained by the root are listed. These parame-
ters must be identical with them adjusted on the module.
The current transmit count usually is 0 durably. If it increases or already had reached a high value before (>
20) then it indicates that the ring had changed down on the slower RSTP algorithm.

Reyrolle 7SR5, Communication Protocol, Manual 205

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.12 Secure MMS

8.12 Secure MMS

Description
The product does not support Secure MMS and the following message is displayed in the information page.

[sc_7SR5_SecureMMS, 1, --_--]

Figure 8-28 Secure MMS Message

206 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.13 Syslog

8.13 Syslog
The 7SR5 devices and Reydisp Manager 2 provide a security audit trail which chronologically acquires and
categorizes security-relevant events according to the origin and severity.
The 7SR5 devices automatically send the security-relevant events to an external syslog-server. The transmis-
sion of the security events to the configured syslog server(s) takes place spontaneously and without a confor-
mation via UDP (User Datagram Protocol) when the security event occurs.
A later readout of the recorded security-events from the device-local security event buffer is possible.
The security events are in English. For further information please refer to the 7SR5 Security manual C53000-
H7050-C027-1.

Reyrolle 7SR5, Communication Protocol, Manual 207

C53000-L7040-C013-1, Edition 04.2023
Additional Features
8.14 Modbus Client

8.14 Modbus Client

Description
Some models in the 7SR5 device range can be connected to an external 7XV5662-6AD10 Temperature
measuring unit for temperature sensor information. If the device has the feature enabled the Modbus Client
setting is available for selection from the RS485 protocol parameter options.
This protocol can be set to use the RS485 port.

Settings and Properties

The settings for the rear RS485 communications are located in the communication menu of the setting tree.
Modbus-Client is implemented on the device specifically for connection to the external RTD box. The connec-
tion is designed to connect to a single 7XV5662-6AD10 Temperature measuring unit (RTD box).

NOTE

i The 49TS function must be enabled in the Function configuration for the setting parameter to be visible.

[sc_7SR5_ModbusClient, 2, --_--]

Figure 8-29 Modbus Client

208 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Additional Features
8.14 Modbus Client

Table 8-8 Settings Menu

Configuration > Data Storgae

Parameter Range Default Setting Notes
COM1-RS485 Protocol IEC 60870-5-103, Modbus RTU, Off Modbus Set the
DNP3, Off, Modbus Client Client protocol
for RTD
box
connec-
tion
COM1-RS485 Station address 0 to 254 for IEC 60870-5-103 0 As Set the
1 to 247 for Modbus RTU required address of
0 to 65534 for DNP3 the RTD
box
COM1-RS485 Baud rate 75, 110, 150, 300, 600, 1200, 38400 9600 or Set the
2400, 4800, 9600, 19200, 38400, 19200 baud rate
57600, 115200, 230400 to the
same as
RTD box
COM1-RS485 Parity NONE, ODD, EVEN NONE As Set the
required parity to
the same
as the RTD
box
COM1-RS485 Mode Local, Remote, Local or Remote Remote Remote

The setting parameters must match those selected on the RTD equipment, the RTD box options are shown in
Table 8-9. For further information on the RTD box refer to TR1200 Operating Instructions.

Table 8-9 RTD Box Options

Baud Rate Data Bits Parity Stop Bit

9600, 19200 8 Even, Odd, None 1 (at parity None: 2)

The interface parameters are factory set to 9600 baud, 8 bits, even parity, 1 stop bit.
The RTU mode is used.
The TR 1200 acts in the BUS system as a slave with an adjustable address from 1 to 247.

Reyrolle 7SR5, Communication Protocol, Manual 209

C53000-L7040-C013-1, Edition 04.2023
210 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
9 Commissioning and Diagnostics

9.1 Prerequisite 212

9.2 Settings of the Internal Switches 214
9.3 Diagnostic Information for DNP3 or Modbus 215
9.4 Diagnostic Information for Time Synchronization 220
9.5 Further Checks 221

Reyrolle 7SR5, Communication Protocol, Manual 211

C53000-L7040-C013-1, Edition 04.2023
Commissioning and Diagnostics
9.1 Prerequisite

9.1 Prerequisite

NOTE

i In this chapter, the commissioning procedure is presented in compressed form. All components must be
installed and operating properly.

Creating a List of Addresses

NOTE

i With the aid of an address list, you can obtain an overview of the network topology. This list contains all
important information about the devices. In this way, you can find any errors quickly.
Siemens thus recommends that you first create a list of component addresses immediately. The list must
contain the following information at a minimum:

• Device type

• Product code

• Serial number

• Firmware version in the device

• Firmware version in the module

• IP address – when configured

When the serial communication port is connected the following information should also be recorded.
When the RS485 is not to be used the port should be set to Off in the device configuration/communica-
tions/COM1-RS485 Protocol parameters.

• Com 1-RS485 station address

• Com-1 Baud rate

• Com-1 Parity
IP settings can be read only after the devices have been initialized, that is, the parameter sets have been
loaded into the devices Subnet mask.

• Standard gateway

• MAC address
The MAC addresses can be read directly on the display of the device in the communications meters.

• IED name under IEC 61850 for each device

It makes sense to also obtain the above-mentioned information for third-party devices, for example,
switches.
Supplement this list with a description of the network topology. This topology description explains how the
devices are connected to one another.
To obtain information about devices from the competition, follow the procedure in the Manuals.
Once the list is complete, check whether any IP addresses or Com-1 address appear twice. MAC addresses
do not appear twice when network components are identified unambiguously.

RS485 Connection
The RS485 should be connected and all wiring checked. The RS485 data comms link will be broken for that
particular device element if it is withdrawn from the case or is not powered but the chain of communication to
the other devices is maintained.
A suitable PC software test tool may be used to confirm communication to the devices and check data points
and signals. Data points can be edited in the Communications editor tool in the device configuration and the

212 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Commissioning and Diagnostics
9.1 Prerequisite

preferred configuration uploaded to the devices. Each of the 3 serial protocols supported in the 7SR5 device
allow different parameterization according with the standard.
All signals used by the SCADA system over the RS485 connection should be initiated in the device and
confirmed as received by the SCADA system.

Ethernet Communication Ring Structure

Start-up Ring Structure

The system is correctly set up and can now be switched on. Before power on, the ring containing the devices
must be interrupted at one point6. The power-on sequence is as follows:

• Break ring structure at one point.7

• Energize switch. After power on wait for about 20 seconds.

• Energize devices. Siemens recommends to energize the devices in the order in which they are arranged
in the ring. After power on, you should wait for each device to start up before the next device is
energized.8

• Close the ring.

Check the accessibility
After commissioning of the network, the accessibility of the components in the ring must be checked. After
connecting a PC to an external switch, all IP addresses can be accessed using the PC browser. The IP address
is entered directly. This connection allows checking of the external switches. The settings of the modules
integrated in the devices can be found on the respective device home page.
The home page address always has the format https://IP-address/home.
One example of a setting is https://172.16.52.55/home.
For commissioning and supervision supported tools are available from http://www.siprotec.com.

NOTE

i Modules can work both in line and in switch mode. Their home page is therefore different. The mode is set
in Reydisp Manager 2 device configuration.

After these preliminary steps have been completed, you have an operational ring structure in which further
settings can be made.

6 This is strongly recommended in order to build up a stable ring structure.

7 Interrupting the ring can speed up the startup; if this is not done, effects similar to those described in the next footnote can occur.
8 Generally, neither the order of energizing nor the wait time are relevant. With RSTP, however, time-outs can cause a delay in building
up the connection.

Reyrolle 7SR5, Communication Protocol, Manual 213

C53000-L7040-C013-1, Edition 04.2023
Commissioning and Diagnostics
9.2 Settings of the Internal Switches

9.2 Settings of the Internal Switches

Activate RSTP
Activate the RSTP mode using Reydisp Manager 2. This invokes a menu that contains all RSTP-relevant settings.
Set the bridge priority – The internal switches should be set to the lowest bridge priority (i.e. the
highest priority number) in the system.
The setting is the same for all switches. Siemens recommends a value of 32768.
Port Priority – This setting does not exist in internal switches.
Age Time – This value is set to 2 seconds.
Max Age Time – Here a value of 40 seconds is set. This ensures that even rings with up to 30 devices will
work.
Transmit Count – Must be set to 100.
Set the edge ports Further Checks – Setting not available.
Port Security – Setting not available.
Far Error Fault Indication – This feature is set by default, no setting by the user is required.

NOTE

i Please note that the basic default settings may differ. You should make the settings recommended here.

214 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Commissioning and Diagnostics
9.3 Diagnostic Information for DNP3 or Modbus

9.3 Diagnostic Information for DNP3 or Modbus

The device will only display the information for the protocol that is enabled in the configuration, either DNP3
TCP or Modbus TCP.

Diagnostic Information DNP 3 TCP or Modbus TCP

Table 9-1 Instrumentation – Communication Meters

Name Value
DNP1/Modbus1 Connected/Disconnected
IP1 - Master 1 IP address
Send x Recieve x Quantity of sent messages to master 1
Quantity of received messages from master 1
Errors Quantity error messages
DNP2/Modbus2 Connected/Disconnected
IP2 Master 2 IP address
Send x Recieve x Quantity of sent messages to master 2
Quantity of received messages from master 2
Ethernet Time Source No Time Source or which source the Ethernet channel
is receiving the time source

Diagnostic Data at the Device

Table 9-2 Displayed Values and their Description

Name Values Description

Channel name Text Internal channel description
Protocol State Running/Stopped State display for the protocol
(current state)
Received Bytes Number of bytes Received Bytes
Sent Bytes Number of bytes Sent Bytes
Master Address Number Address of the master
Slave Address Number Address of the slave
Unsolicited Message On/off Unsolicited transmission
ReportDealed Number Telegrams arranged from device to
module
ReportGot Number Telegrams sent from device to
module
TCP or Uart TCP or Uart Connection via Ethernet or serial
Baud rate Number Set baud rate
(for serial communication only)
Parity EVEN/ODD/NONE Set parity
(for serial communication only)
DataBit 7/8 Set data bits
(for serial communication only)
StopBit 1 or 2 Set stop bits
(for serial communication only)
IPPort Number Number of the IP port
(for Ethernet communication only)

Reyrolle 7SR5, Communication Protocol, Manual 215

C53000-L7040-C013-1, Edition 04.2023
Commissioning and Diagnostics
9.3 Diagnostic Information for DNP3 or Modbus

Name Values Description

SubNetMask Number Subnet mask
(for Ethernet communication only)
Gateway Number Gateway
(for Ethernet communication only)

Diagnostic Data via Device Home Page

EN100 has a homepage which you can open by entering the IP address of the device. To open the HTML page,
proceed as follows:
Enter the IP address of the device in the browser according to the following rule: https://IP address/home. For
example: https://192.168.2.1/home. The EN100 homepage opens.

[sc_7SR5_EthernetEN100Homepage, 2, --_--]

Figure 9-1 EN100 Homepage

In the navigation pane (menu at the top), click the entry DNP TCP.
The DNP3 TCP diagnosis page opens.

[sc_7SR5_DNP3IPDiagnosisPage, 1, --_--]

Figure 9-2 DNP3 TCP Diagnosis Page

This page offers statistic data that is useful for communication diagnosis (e.g. telegram and error counters
as well as the IP of the connected DNP3 TCP master). Additionally, the main protocol-specific settings made
during DNP3 TCP configuration in the mapping file are shown and give an overview with which parameters
DNP3 TCP is running on the module.

216 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Commissioning and Diagnostics
9.3 Diagnostic Information for DNP3 or Modbus

The parameters displayed on the diagnosis page correspond to the DNP3 TCP-specific parameters and the
DNP3 TCP networking parameters.

Table 9-3 Additional Remarks to Links

Clear statistics (link) Pressing this link resets all statistic values (telegram
and error counters) to zero.
Update statistics (link) The HTML page is not updated automatically. Press
this link to update the statistic values (all values will
then be read again from the EN100 module).

Table 9-4 Additional Remarks to Statistics and Parameters

Connected It is shown whether a DNP client is connected to

this DNP server – yes or no – and additionally if
time synchronization via DNP3 TCP is executed, the
text Time synch. shows which client acts as time
master.
DNP Client IP address: Port IP address and TCP port number of the client which
is currently connected to the server or was connected
last to the server.
Enable DNP time synchronization The value yes is shown if on the one hand the
parameter EnableDnpTimeSynch is set to 1, but on
the other hand no SNTP server is configured in the
Ethernet interface SNTP configurator.
no – Enable DNP time synchronization = no
yes – Enable DNP time synchronization = yes and
SNTP server is configured
yes – Enable DNP time synchronization = yes but no
SNTP server is configured

In the navigation pane (menu at the top), click the entry Modbus TCP.
The Modbus TCP diagnosis page opens.

Reyrolle 7SR5, Communication Protocol, Manual 217

C53000-L7040-C013-1, Edition 04.2023
Commissioning and Diagnostics
9.3 Diagnostic Information for DNP3 or Modbus

[sc_7SR5_ModbusTCPDiagnosisPage, 1, --_--]

Figure 9-3 Modbus TCP Diagnosis Page

This page offers statistic data that is useful for communication diagnosis (e.g. telegram and error counters as
well as the TCP of the connected Modbus TCP master). Additionally, the main protocol-specific settings made
during Modbus TCP configuration in the mapping file are shown and give an overview with which parameters
Modbus TCP is running on the module.

NOTE

i The entry Connection/Security log in the navigation pane is also relevant for Modbus TCP and DNP3 TCP.
The following events are entered:

• Establishing a new connection with a client

• Closing a connection

• Rejecting a connection (unknown IP address or server already connected)

218 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Commissioning and Diagnostics
9.3 Diagnostic Information for DNP3 or Modbus

[sc_7SR5_EthernetEN100ConnectionSecurityLog, 1, --_--]

Figure 9-4 EN100 Module – Connection/Security Log

Reyrolle 7SR5, Communication Protocol, Manual 219

C53000-L7040-C013-1, Edition 04.2023
Commissioning and Diagnostics
9.4 Diagnostic Information for Time Synchronization

9.4 Diagnostic Information for Time Synchronization

These meters are under the Communication Meters menu.

SNTP Meter
This is 1 meter that scrolls across the display.
SNTP Meter 9 Meter 10 Meter 11
Not configured No primary NTP No secondary NTP server NTP1/2 sync 999/999
server
Configured NT1*<IpAddress> NT2<IpAddress> NTP1/2 sync 036/019

IEEE 1588 (PTP) Meters

There are 2 meters
IEEE 1588 Synch ID Meter
Not configured Time source from <source e.g. SNTP>
Configured Time from PTP <Sync sequence ID e.g. 12345>
IEEE 1588 Grand Master Clock ID Meter
Not configured –
Configured <64 bit ID of form xx:xx:xx:xx:xx:xx:xx:xx>

9 Shows details of Primary Server

10 Shows details of Secondary Server
11 Shows seconds since last time synch recieved from each server

220 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Commissioning and Diagnostics
9.5 Further Checks

9.5 Further Checks

Check the Accessibility
After making all settings and loading the parameters, all components must be accessible through their IP
address.
This must be possible both with a closed and an interrupted ring.
If a device cannot be accessed, the reasons might be:

• A device connected by a line link to an external switch is connected.

• A device integrated into a ring is not available.

• A ring structure is broken at more than one point, so that some of the devices are not available.

Check the Home Pages

The home page of the devices is available at address https://IP address/home. For further details see
8.11 EN100 Homepage. To be on the safe side, you should check with the statistic page the for the most
important points as listed:

• RSTP-Role Chan1/2 = Alternate/Root

If the devices are arranged in a ring, and the ring is closed and connected to the external switches which
are also on, one device on the statistic page must always display this text. If none of the devices in the
ring does, the ring is physically broken.

• FilterSymErrCntChan1/2 = 0/2753
If these 2 counters are incremented during stable operation of the device, and with neither of the 2
adjacent devices turned off, there is a poor FO connection. This can be due to an excessive attenuation
by the coupling devices, or to a defective cable.

• FNS queue overflow = 0

If this display is not equal zero, this suggests that there are circulating broadcast telegrams.

• Frames Loss = 0
A value that is not zero indicates circulating multicast telegrams.

Reyrolle 7SR5, Communication Protocol, Manual 221

C53000-L7040-C013-1, Edition 04.2023
222 Reyrolle 7SR5, Communication Protocol, Manual
C53000-L7040-C013-1, Edition 04.2023
10 Troubleshooting

10.1 RS485 Serial Communication 224

10.2 7SR5 to Reydisp Manager 2 from USB port 225
10.3 Ethernet Communication 226

Reyrolle 7SR5, Communication Protocol, Manual 223

C53000-L7040-C013-1, Edition 04.2023
Troubleshooting
10.1 RS485 Serial Communication

10.1 RS485 Serial Communication

Devices do not Communicate in a Multidrop Network
Siemens recommends proceeding as follows:

• Check that all relays are powered up with auxiliary power supply.

• Check the polarity of rear communication terminal and connection.

• Check that all relays have unique addresses.

– Modbus in the range 1 to 247
– IEC 60870-5-103 in the range 1 to 254
– DNP3 Serial in the range 1 to 65534

• Check if RS485 terminating resistor is required and in circuit.

• Fit pull up/pull down resistors if required.

• Check no more than 64 devices are connected to the bus.

• The bus polarity for the connection is shown in Figure 10-1.

[dw_7SR5_RS485PortComm, 1, en_US]

Figure 10-1 Communication to Multiple Devices using RS485 (Standard Port)

• Check the communication settings are set on the device parameter settings.
– Correct Protocol
– Parity
– Baud rate

• Check protocol settings match those on the communication master device or SCADA system.

Signals are not Received by Master

• Check the communication parameters are configured in the Reydisp Manager 2 communication file for
the particular protocol.

• Check polling for correct address point.

• For Modbus ensure polling is for adjacent points.

224 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023
 Troubleshooting
10.2 7SR5 to Reydisp Manager 2 from USB port

10.2 7SR5 to Reydisp Manager 2 from USB port

Siemens recommends proceeding as follows:

• Check the communication cable is connected properly.

• Check that the USB driver is installed correctly.

• Check there is not a conflict between the Reydisp Manager 2 port IP address and another IP address on
the PC in the PC Network connections configuration.

Reyrolle 7SR5, Communication Protocol, Manual 225

C53000-L7040-C013-1, Edition 04.2023
Troubleshooting
10.3 Ethernet Communication

10.3 Ethernet Communication

The subject of this chapter is troubleshooting problems with the Ethernet interface. First, here are the
essential points that can prevent correct working.

No link established
If the device does not connect, first check the installation. Has the link to the switch been correctly established
and have the right cables been used (no crossover cables!)? Has the correct cable been used for a direct link
with the PC (crossover cables must be used in this case!)? Is the switch functioning correctly and is its supply
voltage OK? Correct functioning of a link can be seen by the link status LED.
IP address
Has an IP address been set in the device? If this setting has not been made and there is also no DHCP server in
the network, it will not be possible to establish a link. To validate the IP address, it is possible to execute a ping
from the network to the device's IP address.
Subnet mask
Has the subnet mask been correctly set? The subnet mask results from the addressing scheme used in the
network segment.
Remote access not possible
Has the gateway address been correctly set in the device? If it is not correct, it will not be possible to access a
device via 2 or more networks.
No time synchronization via Ethernet
Is there a time server in the network and what is its address? Has the address been correctly set in the device?
Is the device correctly parameterized for use of time synchronization via Ethernet? If the time server is a PC,
is the Windows time service deactivated and the correct NTP service started? Ensure the Modbus TCP or DNP3
TCP is not active when the SNTP server is being used and vise versa.

226 Reyrolle 7SR5, Communication Protocol, Manual

C53000-L7040-C013-1, Edition 04.2023