Protocol guide
IEC 60870-5-104 explained
IEC 60870-5-104, usually called IEC 104, is a telecontrol protocol used to exchange measurements, status and commands between a control centre and field stations such as substations, pump stations and treatment plants over TCP/IP networks.
Where does IEC 104 come from?
IEC 104 is the network version of IEC 60870-5-101, a serial telecontrol protocol. It keeps the application layer of IEC 101 and carries it over TCP/IP, by default on TCP port 2404.
A controlling station (the master, usually a SCADA system) connects to a controlled station (the slave or outstation, usually an RTU or gateway).
How are IEC 104 messages structured?
Each frame starts with an application protocol control information (APCI) header. Three frame formats exist: I-frames carry numbered application data, S-frames acknowledge received I-frames, and U-frames start, stop and test the link.
I-frames carry an application service data unit (ASDU) with a type identification, a cause of transmission, a common address and one or more information objects, such as a single-point status, a measured value or a command.
What do the k, w and t parameters control?
The k parameter limits how many I-frames a station may send before it must receive an acknowledgement, and w sets how many it receives before it acknowledges. Timers t0 to t3 govern connection set-up, acknowledgement and test frames on an idle link.
Mismatched timers between master and slave are a common commissioning issue, which is why test tools log frames layer by layer.
How are commands made safe?
IEC 104 supports select-before-operate: the master first selects a control point, the outstation confirms, and only then is the execute command accepted, within a timeout.
On its own IEC 104 has no authentication or encryption. IEC 62351-5 adds secure authentication of critical messages, and IEC 62351-3 profiles TLS for the TCP connection.
How NeoTechX uses it
NeoCore implements IEC 60870-5-104 as slave and master, with IEC 62351-5 secure authentication and TLS, and the NeoTechX IEC 104 Test Tool acts as a master for bring-up and troubleshooting. See the NeoCore protocol matrix and how to secure legacy equipment.
Other guides: DNP3 Secure Authentication explained · IEC 62351 explained
Frequently asked questions
What port does IEC 104 use?
IEC 60870-5-104 uses TCP port 2404 by default. Many devices allow another port to be configured.
Is IEC 104 secure?
Not by itself. IEC 104 has no built-in authentication or encryption; IEC 62351-5 adds secure authentication and IEC 62351-3 profiles TLS for the TCP connection.
Field equipment sending DNP3 or Modbus in clear text?
NeoCore can secure it without replacing the device. Start with a free assessment.