IEC 60870-5-104 Protocol

Monitor, master (CC) and slave (IED) support, secured with IEC 62351-5 Secure Authentication and IEC 62351-3 TLS.

IEC 60870-5-104 is the TCP/IP-based companion standard for telecontrol equipment and systems. It enables communication over standard network infrastructure between substations and control centers.

Protocol Overview

IEC 60870-5-104 uses the application layer of IEC 60870-5-101 over TCP/IP:

ISO/OSI Layer IEC 104 Layer
7. Application layer ASDU (same as IEC 101)
6. Presentation layer APCI (Application Protocol Control Information)
5. Session layer
4. Transport layer TCP (Port 2404)
3. Network layer IP
2. Data link layer Ethernet
1. Physical layer

APCI Frame Types

Type Name Description
I-Frame Information Contains ASDU with user data
S-Frame Supervisory Acknowledgement, flow control
U-Frame Unnumbered STARTDT, STOPDT, TESTFR commands

SerialMon Support

SerialMon decodes, simulates and tests IEC 60870-5-104 in all three roles.

Operating Modes

Mode Description
Monitor Passive network capture of IEC 104 traffic (port mirroring or PCAP files)
Master/CC Simulate a control center connecting to RTUs/IEDs
Slave/IED Simulate an RTU or IED accepting connections from control centers

Supported Features

  • All APCI frame types (I, S, U)
  • STARTDT/STOPDT/TESTFR handling
  • Sequence number management
  • General Interrogation (GI)
  • Time synchronization
  • Single and double commands
  • Measurement values (normalized, scaled, floating point)
  • Protocol validation with warnings for invalid messages
  • Signal acceptance marking for FAT/SAT testing
  • Quick command sending from tracking window
  • Multiple simultaneous connections
  • Time-tagged commands with a command age check, counter interrogation with freeze and reset, parameter loading and file transfer
  • Time reference in local time, UTC, or UTC+1 without daylight saving (Svenska kraftnät)
  • Secure Authentication (IEC 62351-5:2013, IEC TS 60870-5-7) as master, slave and passive monitor, with user roles (IEC 62351-8) - purchased license
  • TLS (IEC 62351-3) on port 19998 as master and slave, a legacy TLS stack for older RTUs, and certificate generation and inspection - purchased license
  • Passive TLS monitoring, and decryption of static-RSA sessions with the server key
  • Anomaly and security event detection
  • Commissioning options for RTUs and SCADA systems that deviate from the standard

Connection Settings

Parameter Default Description
TCP Port 2404 Standard IEC 104 port
Secure port 19998 IEC 104 over IEC 62351-3 TLS
k (max unconfirmed I-frames) 12 Unacknowledged I-frames before the sender stops
w (latest ack threshold) 8 Received I-frames before an acknowledgement is sent
t0 (connection timeout) 30s Connection establishment
t1 (send or test timeout) 15s Acknowledgement of a sent I-frame or test frame
t2 (ack timeout) 10s Acknowledgement when no data is sent (t2 < t1)
t3 (test timeout) 20s Idle time before a test frame (TESTFR)

Use Cases

  • SCADA Commissioning - Verify RTU/IED communication before go-live
  • Troubleshooting - Debug network communication issues
  • FAT/SAT Testing - Comprehensive acceptance testing with signal verification
  • Integration Testing - Test SCADA integration with simulated devices

Related Protocols