Tiza Group

Home / Tools / IEC 104 APDU decoder

IEC 60870-5-104 APDU frame decoder

Paste the hexadecimal frames from an IEC 60870-5-104 capture and see every field: the APCI with its I, S or U format and the N(S) and N(R) numbers, and the ASDU with its type, cause of transmission, common address and information objects with their IOA address.

IEC 60870-5-104APCI, APDU and I, S and U formatsIEC 60870-5-101ASDU, types and causes of transmissionIEC 60870-5-4information elements and CP56Time2a time

Example cases
IEC 60870-5-104 APDU frame decoder

Only the basic data; the rest is taken with typical values.

E1Frames
Captured frames

One row per APDU, in hexadecimal with or without spaces, commas or 0x. Direction (optional): > from master to station, < from station to master; with it the acknowledgements and the k and w windows are checked. The text never leaves the browser and is not in the copied link.

RowDirectionFrame (hex)Remove

Number of the frame in the list; you can also click a row in the "Frames" tab.

E2Link windows
frames
frames

Use a decimal point. The calculation runs in your browser and updates as you type.

Frame status

—

Frames read

—

Information objects

—

Errors and warnings

—

Frame fields

OctetsFieldValueDetail
    Octet map of the frame
    Each box is one octet in hexadecimal with its position below. The colored bar on top says which field it belongs to: APCI (start, length and control), ASDU header (type, VSQ, cause, common address), object address (IOA), or the value, quality and time of each object. Hover to see the field.

    Frames in the capture

    #DirectionSummaryStatus

      How the frame was read

      What it means for your link

        What it is for

        To read a network capture of the telecontrol link between the control centre and the substation without opening a protocol analyzer: check that the master sent STARTDT and the station confirmed it, see which type of data arrives with which cause for each object, compare the common address and object addresses with the signal list, and understand why the station rejected a command.

        It also helps to compare what the interoperability list says with what really travels: a type that is not on the list, a negative confirmation or an N(S) sequence with gaps show up at once.

        How it is decoded

        IEC 60870-5-104APCI and I, S and U formats

        The APCI

        APDU = 68H + L + C1 C2 C3 C4 [+ ASDU] · size = L + 2 ≤ 255 · ASDU = L − 4 ≤ 249
        • Start and length: the first octet is always 68H; the second, L, counts the octets that follow it. The maximum APDU length is 253 and the minimum 4 (only the four control octets).
        • I format (bit 0 of C1 = 0): N(S) = (C1 + 256·C2) ÷ 2 and N(R) = (C3 + 256·C4) ÷ 2, 15-bit numbers that wrap to 0 after 32,767. It carries an ASDU.
        • S format (C1 = 01): only N(R), the number of the next I frame it expects to receive. It carries no ASDU.
        • U format (bits 0 and 1 of C1 = 1): a single function in bits 2 to 7 of C1. STARTDT 07 (command) and 0B (confirmation), STOPDT 13 and 23, TESTFR 43 and 83. It carries no ASDU.

        IEC 60870-5-101ASDU structure and typesIEC 60870-5-104fields of 2, 2 and 3 octets

        The ASDU

        ASDU = TI (1) + VSQ (1) + COT (2) + CA (2) + objects · SQ = 0: N·(3 + E) · SQ = 1: 3 + N·E
        • TI and VSQ: the type identifies the data and its size E per object. The VSQ carries the SQ flag in bit 7 and the number N of objects or elements in bits 0 to 6.
        • Cause of transmission: bits 0 to 5 are the cause, bit 6 is P/N (negative confirmation), bit 7 is T (test); the second octet is the originator address. The common address takes two octets and the information object address (IOA) three, both with the least significant octet first.
        • SQ = 0: each object carries its own IOA. SQ = 1: a single IOA and N consecutive elements, with addresses IOA, IOA + 1, IOA + 2…
        • Length check: the decoder adds up what the VSQ and the type require and compares it with what arrived; it warns if octets are missing or left over.

        IEC 60870-5-101information elementsIEC 60870-5-4CP56Time2a and CP24Time2a

        Values, quality and time

        normalized = NVA ÷ 32,768 · scaled = SVA (signed 16-bit integer) · floating point = 32-bit IEEE 754 (little-endian)
        • Quality: IV invalid, NT not topical, SB substituted, BL blocked and, on measured values, OV overflow; on integrated totals, CA counter adjusted and CY carry.
        • CP56Time2a time (7 octets): milliseconds (0 to 59,999), minute with the IV bit, hour with the SU summer-time bit, day of the month and of the week, month and a two-digit year; the decoder assumes the 2000s. CP24Time2a carries only milliseconds and minute.
        • Commands: SCO (single), DCO (double: 1 open, 2 close) and RCO (step: 1 lower, 2 raise) carry the QU qualifier and the S/E bit (select or execute).
        • Sequence: in one direction, the N(S) of each I frame must be the previous one plus one; unacknowledged I frames must not exceed k and the other end must acknowledge before w consecutive I frames. The decoder only checks this if you mark the direction of the frames.

        The types and causes come from the interoperability lists of real devices (SIPROTEC 5, FreyrSCADA, SYS600) and from Tiza Group guides. The position of each bit inside the octets follows the structure of IEC 60870-5-101 and IEC 60870-5-104; a field that cannot be confirmed with certainty is shown as an undecoded octet. Always confirm against the edition of the standard used in your project.

        Decoder limits

        • Decodes the process, command and system types in common use (single and double point, step, bit string, measured values, integrated totals, commands, set points, interrogations, clock and test). Protection events, packed single points, parameters and file transfer are recognized by name but not decoded.
        • It works with frames already extracted as hexadecimal; it does not open capture files or reassemble a TCP stream split into segments.
        • It assumes the 104 field sizes: a 2-octet cause, a 2-octet common address and a 3-octet object address. An IEC 60870-5-101 frame is not decoded correctly.
        • It cannot tell whether the time is local or UTC, or whether the common address and object addresses are those of your project: compare them with your signal list.
        • Sequence checks need complete frames in order, with their direction marked with > or <.

        Frequently asked questions

        What is an APDU in IEC 60870-5-104?

        It is the complete message that travels over the TCP connection: a six-octet control header (the APCI, with the start octet 68H, the length and four control octets) and, in the I format, an ASDU with the data. It is at most 253 octets long after the start and length octets.

        How do I tell an I, S or U frame in the hexadecimal?

        Look at the least significant bit of the first control octet, the one after the length. If it is 0 the frame is an I frame (it carries an ASDU and the numbers N(S) and N(R)). If it is 01 it is an S frame (acknowledgement only, with N(R)). If both bits are 11 it is a U frame: 07 and 0B are STARTDT, 13 and 23 STOPDT, 43 and 83 TESTFR.

        What does the cause of transmission of a frame mean?

        It says why the message is sent: 3 is a spontaneous change, 20 is the answer to a general interrogation, 6 and 7 are the activation of a command and its confirmation. With the P/N bit set to 1 the confirmation is negative, and causes 44 to 47 mean the station does not recognize the type, the cause, the common address or the object address.

        We integrate and test your telecontrol link

        We integrate the substation with the control centre over IEC 60870-5-104, DNP3 and IEC 61850: signal list, types and causes, commands, time and point-to-point tests against the SCADA, on site or remotely.

        See SCADA integration and gatewaysSee control, protection and communications

        Related guides

        IEC 60870-5-104 APDU: I, S and U Formats and SequenceHow an IEC 60870-5-104 APDU is built over TCP, what the I, S and U formats do, and how frames are numbered to detect losses.IEC 60870-5-104: How It Works and How to Test ItIEC 60870-5-104 in substations: APCI and ASDU, I, S and U frames, data types, cause of transmission, k, w, t0 to t3, redundancy, security and testing.Cause of Transmission in IEC 101 and 104: MeaningThe cause of transmission (COT) in IEC 60870-5-101 and 104 explains why each message was sent: spontaneous, cyclic, interrogated or command. Value list.IEC 101 and 104 Information Types: The TI ListThe information types (TI) of IEC 60870-5-101 and 104: single and double points, measurands, counters, commands and system functions.CP56Time2a Time Tag in IEC 101 and 104What the CP56Time2a time tag of IEC 60870-5-101 and 104 contains, which types carry it and what its invalid-time and summer-time bits mean.Invalid, Substituted and Blocked Signals in IEC 101/104What the IEC 60870-5-101 and 104 quality flags mean (invalid, not topical, substituted, blocked, overflow) and what the operator sees on the SCADA.DNP3 or IEC 104 Link Keeps Dropping: Causes and FixesWhy a DNP3 or IEC 60870-5-104 link to the control center drops: timers, idle sessions closed, two masters, event bursts or an unstable channel.

        Other tools

        COMTRADE records: viewer and generatorOpen .cfg/.dat or .cff fault records in your browser, read RMS and digital channels, and generate COMTRADE records for your test set.IEC 61850 SCL viewerOpen .scd, .cid or .icd files in your browser: IEDs, GOOSE and SV addresses, datasets, subscribers and checks. The file is not uploaded.IEC 61850 network: GOOSE/SV addresses and process busValidate multicast MAC, APPID, VLAN and priority of GOOSE and sampled values, and calculate bandwidth, worst-case latency and PRP, HSR or RSTP redundancy of the process bus.Interlocking table and CILO equationsInterlocking matrix per device, IEC 61850 EnaOpn and EnaCls equations, GOOSE signals between bays and FAT/SAT test cases per configuration.Technical glossarySubstation, protection and communications terms, explained in one or two sentences.ANSI / IEEE C37.2 device numbersDevice function numbers 1 to 94, common suffixes and their IEC 61850 logical node, with search.
        All tools (24)

        Solar energy

        PV system sizingPV I-V curveCable voltage drop

        Protection

        ANSI / IEEE C37.2 device numbersPhasor diagramRelay coordinationCurrent transformer: burden and saturationVector group compensation (87T)Frequency df/dt ramp

        Analysis and communications

        COMTRADE records: viewer and generatorIEC 61850 SCL viewerIEC 61850 network: GOOSE/SV addresses and process busInterlocking table and CILO equationsTechnical glossary

        Equipment testing and diagnostics

        Commissioning checklistInsulation diagnosis: dissolved gases (DGA) and temperature correction

        Electrical studies

        Short circuit and per-unit systemArc flashGrounding resistance

        Industry and power quality

        Motor startingHarmonic distortion THD and TDDCapacitor bankBattery sizing

        WhatsApp