IEC 60870-5-104 is the telecontrol protocol that carries substation data and commands to the control center over TCP/IP. It uses the application layer of IEC 60870-5-101 (the same ASDUs, data types and causes of transmission) and adds an APCI header with sequence numbers, k and w windows and t0 to t3 timers that supervise the link.
What IEC 60870-5-104 is and which standard defines it
IEC 60870-5-104 is the telecontrol standard that carries, over TCP/IP, the same messages that IEC 60870-5-101 uses on serial links. Its title says it: network access for IEC 60870-5-101 using standard transport profiles. It takes the application layer of the 101 and replaces its link layer with TCP. The current version is edition 2 (2006) with its amendment 1 (2016), which devotes a whole chapter to redundant connections.
The standard includes no security mechanisms: it says so explicitly in its scope. Security is added with the IEC 62351 series.
Where it is used and why
It is the typical link between the substation gateway or RTU and the control center SCADA, the highest level of the substation communications architecture. It also joins regional control centers with field devices that have an IP link, such as reclosers with radio or cellular. Inside the substation, IEDs usually speak IEC 61850 and the gateway translates toward 104. When 104 makes sense, and when IEC 61850, DNP3 or Modbus does, is compared in IEC 61850, IEC 104, DNP3 and Modbus: which to use. How to test a link with a server or client simulator is described in IEC 104: Testing a Link with Client and Server Simulators.
It is used because it is an open standard, known to every SCADA vendor, with spontaneous reporting of changes, millisecond time tags, select-before-operate commands and permanent link supervision. The requirements of each control center (signal list, types, addresses) are agreed with the corresponding operator: the system operator, or the utility the installation connects to.
How it works
Transport. The controlled station acts as the TCP server and listens on port 2404, registered with IANA for IEC 60870-5-104. The control station (the SCADA) opens the connection.
APCI. Each message (APDU) starts with the start octet 68H, a length octet and four control octets. The APDU is at most 253 octets after those first two, so the ASDU can take up to 249. The control octets define three formats:
- I format: numbered information transfer. It carries an ASDU with its send sequence number N(S) and receive sequence number N(R).
- S format: only acknowledges receipt with N(R), with no data.
- U format: unnumbered control functions: STARTDT (start data transfer), STOPDT (stop it) and TESTFR (test the link), each with activation and confirmation.
ASDU. It is the same structure as the 101: type identification (1 octet), variable structure qualifier (1), cause of transmission (2, including the originator address), ASDU common address (2) and, for each object, the information object address (3) plus its value.
Most-used data types. Single point (1, and 30 with time tag), double point (3 and 31), normalized, scaled and short floating point measured values (9, 11, 13 and their time-tagged versions 34, 35, 36), integrated totals (15 and 37), single and double commands (45 and 46, and time-tagged 58 and 59), regulating step command (47), setpoint commands (48 to 50), interrogation command (100), counter interrogation (101), clock synchronization (103) and end of initialization (70). The CP56Time2a time tag takes seven octets, from milliseconds to years.
| Information | Type identification |
|---|---|
| Single point | 1; time-tagged, 30 |
| Double point | 3; time-tagged, 31 |
| Normalized measured value | 9; time-tagged, 34 |
| Scaled measured value | 11; time-tagged, 35 |
| Short floating point measured value | 13; time-tagged, 36 |
| Integrated totals | 15; time-tagged, 37 |
| Single command | 45; time-tagged, 58 |
| Double command | 46; time-tagged, 59 |
| Regulating step command | 47 |
| Setpoint commands | 48 to 50 |
| End of initialization | 70 |
| (General) interrogation command | 100 |
| Counter interrogation command | 101 |
| Clock synchronization command | 103 |
Cause of transmission. It says why the data travels: 1 periodic, 3 spontaneous, 5 requested, 6 activation, 7 activation confirmation, 10 activation termination, 20 response to general interrogation, among others. A command executed correctly shows up as 6 → 7 → 10.
Windows and timers. There are widely used default values, which each control center can change:
| Parameter | Default | Function |
|---|---|---|
| k | 12 APDUs | Maximum number of unacknowledged I frames sent |
| w | 8 APDUs | The receiver acknowledges no later than after w I frames |
| t0 | 30 s (some devices ship with 15 s) | Timeout to establish the connection |
| t1 | 15 s | Timeout for acknowledgment of a send or of a TESTFR |
| t2 | 10 s | Time limit to acknowledge with an S frame if there is no data (t2 < t1) |
| t3 | 20 s | Idle time after which TESTFR is sent |
The interoperability list recommends that w not exceed two thirds of k, and in practice t2 < t1 < t3 is maintained.
Redundancy. The standard describes redundancy groups of connections: several TCP connections between the same client and its server, of which only one is active and transfers data (started with STARTDT). The others stay established and stopped, supervised with TESTFR, and the client activates one of them with STARTDT if the active one fails.
Configuration: concepts
Configuring 104 is above all agreeing the signal list with the control center: common address, address of each object, type (with or without time tag), scale or measurement format, deadband, command class (direct or select-before-operate) and which signals go into the general interrogation. Then the link parameters are set (IP, port, k, w, t0 to t3), the allowed master addresses and the behavior of the redundancy group. Each gateway manufacturer organizes this with its own tool and its own names. When the IEDs speak IEC 61850, each signal in that list comes from a data object in the model; we explain it in mapping IEC 61850 to IEC 104 and DNP3. The select-before-operate command class is the same idea as select before operate (SBO) in IEC 61850.
Security
IEC 62351-3 applies TLS to profiles over TCP/IP, and IEC 62351-5 (2023 edition) defines security for IEC 60870-5 and its derivatives. IANA registers TCP port 19998 for the secure version of 104. In practice, also: the gateway never exposed to the Internet, filtering of master IPs on an industrial router and firewall, VPN on public links, and connection logging. How to configure and test the secure version is covered in secure IEC 104 and DNP3.
Typical problems and diagnosis
- Cyclic reconnections: t1 expired due to latency, k exceeded without acknowledgment, or a second master connected.
- Connects but no data arrives: the master did not send STARTDT, or the common address does not match (the station responds with cause 46, unknown common address of ASDU).
- Object rejected: cause 47 (unknown information object address) or 44 (unknown type identification).
- Absurd measurements: measurement type crossed between normalized, scaled and floating point.
- Events with the wrong time: unsynchronized clock, or the reception time tag instead of the IED’s.
Diagnosis uses a traffic capture (Wireshark decodes 104), the gateway log, and a master or slave simulator.
Coexistence and migration
The 104 coexists with IEC 61850 inside the substation and with DNP3 in some control centers. Migration from IEC 60870-5-101 is natural: the ASDUs are the same, but the field sizes and the link change: in 104 the cause of transmission takes 2 octets, the common address 2 and the object address 3, with no other options. Many gateways bridge the two while the control center changes over. For exchange between control centers, ICCP/TASE.2 (IEC 60870-6) is the usual choice, not the 104. The order of steps to generate the certificate chain of a TLS link is in X.509 Certificates for ICCP and IEC 104.
Testing
- Connection test: STARTDT, general interrogation, clock synchronization and TESTFR.
- Point-to-point test of every signal, from the field to the control center screen, and of every command in the reverse direction, verifying the 6, 7 and 10 sequence.
- Redundancy switchover: loss of the active connection and takeover without loss of events.
- Extended disconnection to check the event buffer and its order on recovery.
Remote configuration and integration with Tiza Group
Is the 104 link to the control center not coming up, or do the signals not match the list? Our team reviews the gateway configuration and traffic captures remotely with our remote relay configuration service, and carries out SCADA and gateway integration in medium, high and extra-high voltage substations and industry.
Related guides
- Mapping IEC 61850 to IEC 104 and DNP3 in the gateway
- Select before operate (SBO): how the command works
- Substation signal list for SCADA
- IEC 61850 toward the control center: TR 61850-90-2
- Secure IEC 104 and DNP3: TLS and IEC 62351-3 and -5
- IEC 61850, IEC 104, DNP3 and Modbus: which to use
- APDU of IEC 60870-5-104: I, S and U formats and sequence
- Port 2404 and TCP connections in IEC 60870-5-104
- Basic application functions of IEC 60870-5-104
- IEC 104 interoperability list: how to read it
- Files and fault records over IEC 60870-5-104
- IEC 104 diagnostics: counters, log and SNMP
- Invalid, substituted or blocked signal in IEC 101 and 104
- IEC 104: Testing a Link with Client and Server Simulators
- X.509 Certificates for ICCP and IEC 104: How to Generate
References
- IEC 60870-5-104:2006+AMD1:2016, Telecontrol equipment and systems – Part 5-104: Network access for IEC 60870-5-101 using standard transport profiles.
- IEC 60870-5-101:2003+AMD1:2015, Companion standard for basic telecontrol tasks.
- IEC 62351-3, security for profiles including TCP/IP.
- IEC 62351-5:2023, security for IEC 60870-5 and its derivatives.
- IANA, Service Name and Transport Protocol Port Number Registry (ports 2404 and 19998).
Frequently asked questions
Why does the IEC 60870-5-104 link drop and reconnect every few seconds?
It is almost always a timer or window that does not match the network: t1 expires because the channel has more latency than expected, the master does not send STARTDT, or two masters are connected to the same server at once. A traffic capture shows which frame goes unanswered before the connection closes.
What is the difference between type 1 and type 30 in IEC 60870-5-104?
Both carry single-point information. Type 1 (M_SP_NA_1) travels without a time tag and type 30 (M_SP_TB_1) carries the seven-octet CP56Time2a time tag. For the sequence of events, the control center normally asks for the time-tagged types.
Why does a measurement arrive correctly at the RTU but wrongly at the control center?
It is usually the agreed data type: normalized, scaled or floating point. If the station sends a scaled value and the center interprets it as normalized, the figure comes out multiplied or divided. The scale and deadband configured in the gateway also matter.