IEC 60870-5-104 Server communication protocol

Supported device types and versions  
Communication line configuration
Communication station configuration
I/O tag configuration
TELL commands
Literature
Document revisions

Supported device types and versions

This protocol implements a server-side of IEC-104 communication (known also as IEC 870-5-104 or IEC-104).

Communication supports reading and writing data by means of the IEC 60870-5-104 communication protocol operating on the basis of TCP network communication. D2000 system works in the IEC 60870-5-104 server mode (slave). It is able to communicate with multiple (N) clients (masters). Implementation is according to the IEC 60870-5-104 standard as follows:

• Originator ASDU address is 1 byte, it is defined as a line number.
• ASDU address is 2 bytes, it is defined as station address. For each station on a line, a different ASDU address must be defined.
• Cause of transmission is 2 bytes (it also contains Originator ASDU address)
• Information object address IS 3 bytes, it is defined as an I/O tag address.
• The following ASDU types in the direction of monitoring are implemented (from the D2000 system to the control station and also vice-versa in balanced mode):

Table 1

Note: For setting individual bits of the quality byte (SIQ for ASDU 1,2,30; DIQ for ASDU 3,4,31; QDS for ASDU 5..14,20,32..36), the flags A (0.bit), B (1.bit) .. H (7.bit) are used.

For example:

• for ASDU 4: A=DPI bit 0, B=DPI bit 1, C=0, D=0, E=BL bit, F=SB bit, G=NT bit, H=IV bit.
• for ASDU 16: A..E Sequence number bits 0..4, F=CY bit, G=CA bit, H=IV bit

The exception is the bits, which are set directly by a value (e.g. for ASDU 1, the 0.bit is not set by the A flag but by the value of output I/O tag).
If the Invalid attribute is set for a new value, the highest bit (IV) will be set in the status byte for all ASDUs (except for ASDU 21, which does not have a status byte).

* - Status is taken as low 2 bytes, Status change detection is taken as highest 2 bytes of a 32-bit integer.

The following ASDU types in the direction of control are implemented (from the control station to D2000, also the opposite direction in balanced mode):

Table 2

Bits of "status" byte (SCO fro ASDU 45,58; DCO for ASDU 46,59; RCO for ASDU 47,60; QOS for ASDU 48..50,61..63) causes setting the A (0.bit), B (1.bit) .. H (7.bit) flags with an exception for the bits which are directly set by the value of a variable (SCO bit 0, DCO and RCS bits 0-1). After receiving a response (positive/negative), the A .. H flags are set according to the bits of the "status" byte.

When writing values, the value of 6 [Activation] is expected as CauseOfTransmission. The response of the controlled station depends on the setting of the CMDC parameter. Originator ASDU address will be used the same as is in the received command.

Establishing a connection:

• D2000 KOM process is waiting on a TCP port and, after establishing a connection, is waiting for receiving the StartDT Act U-frame from the client. Then it sends StartDT Con as a response (it is possible to send TestFrame before StartDT Act).
• If the EOI parameter is set, the D2000 KOM process will send ASDU 70 [End of initialization], the initial OA address (configured as a line number) is used as Originator ASDU address.
• If the Synchronisation period parameter (the Time parameters tab) for some of the stations is different from 0, ASDU 103 [Clock synchronisation command] with CauseOfTransmission= 6 [Activation] will be sent in the configured period. The initial OA address (configured as a line number) resp. Originator ASDU of the last received ASDU 100 or 101 will be used as Originator ASDU address.
• D2000 KOM process sends new values acquired from the D2000 Server process for variables with ASDU 1..14, 20, 21, 30 .. 36 to a client, which sent ASDU 100 [Interrogation Command] and new values for variables with ASDU 15,16,37 to a client, which sent ASDU 101 [Counter Interrogation Command]
• D2000 KOM process accepts time synchronisation using ASDU 103 [Clock synchronisation command] with CauseOfTransmission=6 [Activation] or 3 [Spontaneous]. If CauseOfTransmission= 6, its response dependd on setting of the CMDC parameter. If CauseOfTransmission= 3, it does not respond.
• D2000 KOM process responds to received commands (ASDU 45..51, 58..64) with CauseOfTransmission= 6 [Activation] dependd on setting of the CMDC parameter.

Originator ASDU address (OA): initial OA is set as TCP line number in the configuration. The address will be used for the optional sending of the ASDU 70 [End of initialization] at the beginning of a connection and always for sending new values.
After receiving ASDU 100 or 101, the current values of all output I/O tags are sent (which don't have an Invalid attribute set) with the same OA as contained in ASDU 100 or 101.
As responses to received commands (ASDU 45..51, 58..64), the confirmations using the same ASDUs as received command are sent.

The D2000 system also supports a balanced mode. In this mode, the task of controlled and control stations is symmetrical. In this mode, the D2000 system sends commands and ASDUs 100/101. The balanced mode may be used only if it is supported by the partner station. An advantage is that the D2000 system can send ASDU 100 [Interrogation Command] a 101 [Counter Interrogation Command] and receives the current values of input I/O tags (configured as ASDU 1-40) after the connection was disconnected and re-established. It is suitable to configure single-shot commands as ASDUs 45 - 64; they are not repeated after re-establishing the connection.

Writing of an output I/O tag:

• When writing IEC 104 values (ASDUs 1-40), the rules of server protocols apply.
• When writing IEC 104 commands (ASDUs 45-64) in the balanced mode, ASDU is considered to be confirmed (the Transient flag is cleared) in dependence on the CMDC parameter. If the connection to a client is lost when writing, the writing success depends on the PW parameter.

Communication line configuration

• Communication line category: TCP/IP-TCP
• TCP Parameters
  • Required to define the server parameters
  • Host: string containing at most 80 characters – the name of the network interface in form of INET (name or numerical address a.b.c.d, e.g. 192.168.0.1) used for receiving clients by the D2000 KOM process. If the name is ALL or *, the D2000 KOM process will listen on all network interfaces of the computer, where is running.
  • Port: TCP port number (0..65535), where the D2000 KOM process is listening.
  • Line number: will be used as Originator ASDU address (1 byte, 0-255).

Note: Starting from D2000 version 7.02.004 the flags A to P of the value of the communication line are used for informing about connected active clients. An active client is a client who after establishing the connection sent U-frame StartDT Act, i.e. asked for sending the data. The first connected active client will cause a change of flag A to TRUE, the second flag B, etc up to flag P and continuing again with the first flag A. If the client sends the StopDT Act U-frame  (requesting the server to stop sending data) or disconnects, the value of its flag will be changed to FALSE.

Communication station configuration

• Communication protocol: IEC870-TCP Server.
• The station address is a number within the range 0...65535, it defines the ASDU address. It can be specified as a decimal number or as a hexadecimal number with a hash at the beginning (e.g. #0A).

Note 2: The protocol supports sending long time stamps (CP56Time2a tag) in local time or UTC time with defined offset (see the Use monotonic UTC time+ parameter).

The Browse button opens a browsing dialog for the station address. If the communication is functional, a dialog with the ASDU addresses received so far is displayed. The Refresh button can be used to clear the list of received ASDU addresses.

Station protocol parameters

The following parameters can be defined as station protocol parameters:

Table 3

A string containing the protocol parameters is being defined as follows:

Keyword=value;Keyword=value; ...

Example:

WTn=10000;WT3=25000;OCIC=0;

If a keyword with an invalid value in the initialization string is found, a corresponding default value according to the Table 3 will be used. Defined parameters, except for OIC, OCIC and FST are valid for the entire line - i.e. it is enough to define them for one station on the line.

I/O tag configuration

Possible I/O tag types: Ai, Ao, Ci, Co, Di, Dout, Qi

• I/O tag address is mapped to the Information object address, i.e. it has 3 bytes and must within the range of 0..16777215. It can be specified as a decimal number or as a hexadecimal number with a hash at the beginning (e.g. #0A).
  The I/O tag with an address starting with %IGNORE will be ignored.
  
• Input tags must be of particular types (Ai, Ci, Di, Qi) for received ASDU, see Table 1.
• For a particular type of output tag (Ao, Dout, Co), it is necessary to set an ASDU type, that has to be used, see Table 2 and also Table 1 in the balanced mode.
• Archive for providing old values: if the client requires archive values using ASDU 250, the server sends:
  1. the values of the historical value specified by this input entry field,
  2. if the input entry field is not filled, then the values of the historical value that archives the I/O tag,
  3. if the specified historical value does not exist, then the values of the I/O tag that archives the control object of the specified I/O tag,
  4. if the control object does not exist (or the archive is not available), the server returns an error.
  Specification of a historical value allows configuring e.g. sending 10-minutes averages instead of sending all changes of given I/O tag.
• If the Destination Column is configured, then the values received from the address configured at the I/O tag and above are stored in the corresponding items (e.g. objects with addresses 10, 11, 12 ... according to the number of rows of the destination structure).

Browse

For the I/O tags, it is possible to discover the list of objects, as long as the KOM process is running and communication with a station is established.
Clicking the Browse button opens the IEC870-TCPSRV Item Browser window and displays a list of objects that have been read so far. The object list is created dynamically as a result of received messages.

The list of objects is dynamic, i.e. when a new value arrives in the KOM process, it is updated. Filtering in individual columns is also supported, asterisks can be used in the mask (e.g. *Short*).

Double-clicking on a particular line will cause the Address parameter to be inserted into the configuration of the I/O tag from which the IEC870-TCPSRV Item Browser window was opened.

The Refresh button clears the list of values in both the CNF and the KOM process.

The Value column contains the received value.

Tell commands

Literature

Document revisions

• Ver. 1.0 – February 5th, 2004
• Ver. 1.1 – December 1st, 2004: extension - support of balanced mode
• Ver. 1.2 – June 15th, 2020: browsing support
• Ver. 1.3 – November 16th, 2023 (support for the Destination Column)