An ICCP link is built in two steps: first a TCP connection between the two centers, then an application association. In the association each center identifies itself with its AP-title and AE-qualifier, and this is checked against the bilateral table. The transport, session and presentation selectors must match at both ends or the connection is rejected.
Short answer
An ICCP (TASE.2, IEC 60870-6) link between two control centers is formed in two stages. First a TCP/IP connection is opened between the addresses of the two centers. Then an application association is established, where each center identifies itself and the other checks that it is authorized according to the bilateral table. If the first fails, the problem is in the network; if the second fails, it is in identification. The protection of real-time data between control centers that CIP-012 requires is covered in NERC CIP-012: Communications Between Control Centers.
Stage 1: the TCP connection
ICCP runs over TCP/IP. The transport layer gives the upper layers a reliable point-to-point connection, controls flow and sequence, and detects errors. At opening, the SYN flag starts the TCP session. The FIN flag closes the connection when both parties agree that communication is finished.
If this stage fails, the problem is in the network: a wrong address or port, a firewall that blocks, or a route that does not exist. In a network capture it appears as an initiation request with no reply or one that is rejected.
Stage 2: identifying yourself at each layer
With TCP open, ICCP uses the transport, session and presentation layers of the OSI model. Each one identifies the service access point with a selector, a string of octets:
| Identifier | Layer | What it identifies |
|---|---|---|
| TSEL | Transport | The transport access point |
| SSEL | Session | The session access point |
| PSEL | Presentation | The presentation access point |
| AP-title | Application | The title of the application entity |
| AE-qualifier | Application | The qualifier that distinguishes an application instance on the server |
The two centers must agree on these values before connecting, and they are recorded in the bilateral table. At each layer, a different value produces a rejection: the connection is not established. To find which one failed, compare against a network capture, where the successful and the failed request can be told apart.
Association types
The association is the application relationship between the two centers. There are three types, all over TCP:
- Client. It initiates communication and requests the services.
- Server. It accepts the connection and responds to the client’s requests.
- Bidirectional. One center acts as client of the other and, at the same time, as server over the same channel. It can be active or passive, depending on who initiates the request; once established, the services are the same in both directions.
- Must both centers request data from each other?
- Yes: Bidirectional association: one initiates it (active), the other accepts (passive)
- No: Does only one of them query data from the other?
- Yes: The one that queries is the client and the other is the server
- No: They do not need an ICCP association
Association operations
The association has three operations:
- Initiate (association). It establishes the link with the application characteristics. The AP-title and the AE-qualifier are validated against the bilateral table to grant access only to what was agreed.
- Conclude. It closes the connection normally, for example because of a configuration change.
- Abort. It closes the link because of a failure, for example the request of a service that is not implemented.
The security of this channel, with certificates and encryption, is covered in IEC 62351-4: MMS and TASE.2.
Frequent mistakes
- Fixing the network when the TCP connection already opens: the fault is in identification.
- A selector, the AP-title or the AE-qualifier with a different value at one end.
- Two centers that define the association as client on both sides, with no server to accept it.
How we can help
The association between control centers is the part that takes the most time in commissioning, because it requires agreeing on values with the other party. At Tiza Group we configure and test ICCP links, from the selectors to the bilateral tables. See our SCADA and gateway integration or write to us to quote it.
Related guides
- ICCP / TASE.2 (IEC 60870-6): link between control centers
- ICCP: conformance blocks 1 to 5
- ICCP: report by exception and transfer sets
- Redundant gateway and dual link to the control center
- NERC CIP-012: Communications Between Control Centers
References
- IEC 60870-6-503, TASE.2 Services and protocol, and IEC 60870-6-702, Functional profile: associations, bilateral table and identification of the application entity.
- IEC 62351-4, Security for profiles including MMS.
- RFC 793, Transmission Control Protocol.
Frequently asked questions
Why does the TCP connection open but the association is not formed?
Because TCP only connects the devices. The association requires the transport, session and presentation selectors, the AP-title and the AE-qualifier to match what the other center expects according to the bilateral table. A single different value is enough for it to be rejected.
What is the difference between a client, server and bidirectional association?
In a client association, the center initiates and requests data. In a server association, it accepts and responds. In a bidirectional one, each center is client and server of the other over the same connection, and either can initiate it.
How does the problem look in a network capture?
Wireshark shows the opening and closing of a successful TCP connection, and also the failed initiation request. Comparing one with the other shows at which step it was rejected.