Substation RTU and Gateway: Functions, Protocols

Short answer

The substation RTU and gateway are the link between the substation and the control centers. They collect signals, measurements and events from the IEDs and the wiring, translate them to the protocol each center asks for (IEC 60870-5-104, DNP3 or others) and execute remote commands. A configuration error shows up at the control center as a false signal or a command that does not arrive.

What the RTU and the gateway are

The remote terminal unit (RTU) is the device that acquires the signals of a substation, such as positions, alarms and measurements, and sends them to a remote control center, from which it also receives commands. The first RTUs read everything through direct wiring from the equipment.

The substation gateway is a protocol converter and data concentrator. It collects information from relays, bay controllers and meters over the station network, and delivers it to one or several control centers in the protocol each one requires.

In today’s substations the boundary has blurred: the same device has input and output cards, speaks several protocols and runs logic. That is why RTU, gateway or data concentrator are used for very similar devices.

Main parts

Processor or CPU, sometimes redundant in hot standby.
Binary and analog input and output modules for hardwired signals.
Ethernet and serial communication ports toward the station and the control centers, with network redundancy when required.
Time synchronization from a GPS clock by SNTP/NTP, IRIG-B or PTP.
Power supply, normally from the substation battery bank and charger.
Configuration software with the signal database and the mapping between protocols.

How it works

Toward the substation, the gateway acts as a client or master: it reads data from the IEDs over IEC 61850 (MMS), DNP3 or Modbus, and receives spontaneous events with their time stamp. Toward the control centers it acts as a server or slave: it publishes that data with the agreed addresses and waits for commands. The gateway’s client and server roles, its point database and command testing are covered in Protocol Gateway: DNP3, Modbus and IEC 61850.

In the middle is the mapping: each IED data point is associated with an address in the remote protocol, with its type (single, double, measurement, counter), its scale and its deadband. The signal list, agreed with the system operator or the utility, is the document that governs all that work.

The gateway also stores events in memory while the link is down, manages several control centers at once, applies permissions on commands and can run simple automation.

Protocols

IEC 60870-5-104: protocol over TCP/IP widely used toward control centers in Latin America and Europe.
IEC 60870-5-101: its serial version, on older links.
DNP3 (IEEE 1815): common in North America and in many distribution companies.
IEC 61850: inside the substation, between IEDs and gateway.
Modbus RTU and Modbus TCP: common in industry, solar plants and meters.

Types

Transmission substations (high and extra-high voltage): redundant gateways with several control centers and strict availability and cybersecurity requirements.
Distribution (medium voltage): compact RTUs in small substations, reclosers and network devices, with cellular or radio links.
Industry: gateways between the plant substation relays and the plant SCADA or distributed control system.
Solar plants: concentrators that integrate inverters, meters, a weather station and relays, and deliver data to the utility and to the owner’s control center.

What is configured at each point

The user manual for the IEC 60870-5-104 slave of the ABB COM600 station (version 3.4, English) is a good example of the granularity of a gateway. The gateway takes the IED data with its IEC 61850 model and presents it as a virtual device to the control center. For each point, among other parameters, the following is decided:

Data type and format: single or double indication, normalized or scaled measurement, and whether the value is sent inverted.
Transmission class: spontaneous data are assigned to class 1 or class 2 (class 1 by default), and each point has a priority that sets how it is ordered in the queues.
Time tag: none, short or long (long by default). The manual warns that the long tag cannot be used with scaled values.
Event queues: maximum sizes of the measurement and state-change queues (1000 entries each by default in that manual). There is also a threshold, expressed as a percentage of the measurement queue capacity. Once it is exceeded, a point’s new measurement replaces the oldest one of that same point. When a queue fills, the device flags it as an event.
Event time: the gateway can send events in UTC or local time and handles daylight saving time in commands with a time tag.
Clock synchronization: the slave can accept or ignore the control center’s synchronization messages, and it is decided whether a time stamp is valid even if the clock has not been synchronized. Synchronization with IRIG-B or SNTP and loss of synchronization determine whether those stamps are reliable.
Communication redundancy: supports several local IP addresses for redundant links. It is the basis of what IEC 60870-5-104 calls redundancy groups, in which the control center keeps several connections and only one is active.
File transfer: can be enabled (disabled by default) to transfer files from the IEDs, and the file names are built with an object address assigned to each source IED.

A practical criterion follows: the signal list is not enough with an address and a text; it must set type, class, time tag, scale and behavior when the link is down, and those decisions are later validated with point-to-point tests. If a link keeps dropping, the diagnosis is in DNP3 or IEC 104 link that drops. The auxiliary-service signals a discrete I/O RTU collects, and how they are wired and time-stamped, are described in Station Service RTU.

Cybersecurity

The gateway is the substation’s door to the outside. It must apply role-based access control, activity logging, closing of unnecessary ports and services and, when specified, encryption and authentication per IEC 62351. The IEC 62443 family gives the framework for industrial control systems. Remote engineering access must go through a controlled path, never through a port open to the internet.

Commissioning and maintenance tests

Factory and site tests of the configuration against the signal list.
Point-to-point with the control center: each signal, measurement and command, with addresses, texts and scales.
Event avalanche: many signals at once, to verify that none are lost or reordered.
Redundancy: switchover of CPU, power supplies and links.
Time synchronization and accuracy of the stamps.
Cybersecurity review: users, default passwords, ports and logs.
Integration with end-to-end tests when trips or permissives travel over the network.

Common faults

Badly mapped addresses or data types: an alarm that arrives as another, or a double point sent as single.
Badly adjusted scales or deadbands, which saturate the channel or hide changes.
Events with the reception time instead of the IED time.
Loss of time synchronization.
Insufficient buffer that loses events during a fault.
Redundancy configuration that leaves two devices active or none.
Changes in an IED that are not reflected in the gateway.

Testing, configuration and commissioning with Tiza Group

At Tiza Group we configure and test RTUs and gateways of the main brands, and perform point-to-point tests with control centers and the commissioning of the communications system of substations, industry and solar plants, in Colombia, or elsewhere on request. Write to us with the brand, model and protocols you need.

References

IEC 60870-5-101 and IEC 60870-5-104, telecontrol protocols.
IEEE 1815, DNP3.
IEC 61850-8-1, mapping to MMS and GOOSE.
IEC 62351, security of power system communications.
IEC 62443, security of industrial automation and control systems.
IEEE C37.1, SCADA and automation systems for substations.
ABB, Station Automation COM600 3.4: IEC 60870-5-104 Slave (OPC) User’s Manual, 1MRS755384 (English): point configuration, queues, time and redundancy.

Frequently asked questions

What is the difference between an RTU and a gateway?

The RTU was born to read hardwired inputs and outputs and send them to a control center. The gateway translates between protocols, for example from IEC 61850 in the substation to IEC 60870-5-104 toward the control center. Today many devices do both.

Why do events arrive at the control center with the wrong time?

Almost always because of lost time synchronization in the gateway or the IEDs, a badly configured time zone, or because the gateway puts its own reception time instead of the IED's. Check the time source and the time stamp configuration.

What is a point-to-point test with the control center?

It means verifying each signal on the agreed list, one by one, from the source in the field to the control center screen, and each command in the opposite direction. It confirms addresses, texts, scales and sense of each data point.