Purpose and architecture
IEC 60870-5-104 carries power-system telemetry and control over TCP/IP, commonly between an RTU or substation gateway and a SCADA/EMS centre. It shares many application services and data types with serial IEC 101, but applies a specific network profile and field sizes.
The controlling station commonly opens the TCP connection; the controlled station commonly listens on port 2404. Multiple station relationships depend on implementation. Accepting a TCP connection does not itself grant permission to execute every command.
APDU and connection control
An APDU has a six-byte APCI: start byte 0x68, length and four control bytes. I-format APDUs carry an ASDU and send/receive sequence numbers. S-format acknowledges received I-frames. U-format carries STARTDT, STOPDT and TESTFR control exchanges. Sequence numbers are 15-bit.
t0 concerns connection establishment; t1 limits acknowledgement waiting, t2 delays acknowledgements and t3 triggers an idle-link test. k limits outstanding I-frames; w is a receive acknowledgement threshold. They are not all timeouts, nor does k specify the number of clients. Common settings include t1 15 s, t2 10 s, t3 20 s, k 12 and w 8, subject to agreement and constraints. A frame acknowledgement does not prove a technological command has executed.
ASDU and data
The ASDU includes Type ID, VSQ, a two-byte Cause of Transmission including originator address, a two-byte Common Address and information objects with three-byte IOAs. VSQ describes object count and sequential addressing.
Examples include M_SP_NA_1 single-point status, M_DP_NA_1 double-point status, M_ME_NA/NB/NC_1 measured values and M_IT_NA_1 counters. Time-tagged variants carry event time. Commands include C_SC_NA_1, C_DC_NA_1 and C_SE_NA/NB/NC_1. C_IC_NA_1 requests general interrogation, C_CI_NA_1 counter interrogation and C_CS_NA_1 clock synchronisation.
Events, quality and time
Data may be spontaneous, periodic, background or requested. Cause 3 denotes spontaneous transmission, 6 activation, 7 activation confirmation, 10 activation termination and 20 station interrogation response. Cause 37 is a general counter interrogation response; 38–41 concern counter groups.
Quality depends on object type: IV invalid, NT not topical, SB substituted and BL blocked are common; measured values can include OV. These are not universal write-permission bits. Counters have their own descriptor. CP56Time2a provides a seven-byte date/time with millisecond resolution, not a guarantee of clock accuracy. Event time, receipt time, time zone and synchronisation must be distinguished.
Commands and redundancy
Select-before-operate separates selection and execution; direct execute is also possible where supported. Confirmations, interlocks and operational modes must be checked. Clock synchronisation can use the protocol or separate supported NTP/PTP/GNSS arrangements.
Redundancy may involve multiple servers, routes and connections, with coordinated active transfer in a redundancy group. Buffering and failover behaviour depend on the implementation. A general interrogation after recovery can restore current state, but cannot recreate lost events.
Security and commissioning
Base IEC 104 has no cryptographic channel protection. IEC 62351-3 addresses protected TCP/IP profiles, part 5 IEC 60870-5-derived security, and part 7 monitoring objects. Match supported editions and profiles; segmentation, access rules, controlled remote access and command logging remain important.
Agree IOAs, types, scales, deadbands, timers, windows and clock behaviour. Test STARTDT, interrogation, spontaneous data, commands, quality flags and failover. IEC 61850 often supplies substation data to a gateway while IEC 104 links it to dispatch; this is a common architecture, not a universal restriction on either standard.
