IEC 60870-5-104

What you can build

• Confirm the field matches the picture

  After a reconnect, the operator runs a general interrogation and compares the returned station image with the last known values. Points that came back different or missing are listed for a person.

  With Data Freshness, Sensor Health

• Act on a curtailment order

  When the grid operator calls for a reduction, the operator proposes set-point commands to the RTUs you name. You approve once. Each command carries a time tag, and the receipt records station, object, and value.

  With Event Response, Export Limit

• Test a generator remotely

  The operator proposes the start command, watches the measured values and integrated totals come back as events, and files the run against the test schedule.

  With Generator Test

• Keep RTU clocks in step

  Time tags are only useful if RTU clocks agree. The operator compares event time tags with arrival time and proposes a clock synchronization to the stations that drift.

  With Integration Health

Requirements

• TCP/IP reach from the controlling station to each controlled station, directly or through the routers the standard allows for X.25, Frame Relay, ISDN, and ATM
• Each device's interoperability list (clause 9): which ASDUs, basic application functions, and network configuration it supports
• The addresses of the stations and information objects you want, as set in the RTU configuration
• For IEC 62351-5 security, devices and a controlling station that both implement the IEC TS 60870-5-7 message formats

Authentication

The standard states that security mechanisms are outside its scope; IEC 62351-3 profiles TLS 1.2 and 1.3 for the TCP connection, and IEC 62351-5 with IEC TS 60870-5-7 adds application-layer authentication and encryption per controlling station and controlled station association.

Limits

• IEC 60870-5-104 and IEC 60870-5-101 are sold by the IEC; this listing is written from the published scope, table of contents, and abstracts
• The base protocol has no authentication or encryption, so an unprotected TCP link accepts any command that reaches it
• Only the ASDUs a device lists in its interoperability clause can be used, and vendors commonly implement a subset
• Alternative ASDUs from other IEC 60870-5 companion standards, such as IEC 60870-5-102, may be carried but are not described in Part 5-104

Questions and answers

Is IEC 60870-5-104 the same as IEC 60870-5-101?

No. Part 5-101 is the companion standard for basic telecontrol tasks over serial links. Part 5-104 keeps the 101 application layer and ASDUs and carries them over TCP/IP, adding the APCI control field with I, S, and U formats, Start/Stop control, and redundant connections.

Does IEC 60870-5-104 encrypt or authenticate commands?

Not by itself. The scope note says security mechanisms are outside the standard. IEC 62351-3 profiles TLS for the TCP connection, and IEC 62351-5 with IEC TS 60870-5-7 defines message formats so a receiver can check that an APDU came from an authorized user and was not modified in transit.

What happens when the connection drops?

Clause 5.1 protects against loss and duplication of messages by numbering I format APDUs, and clause 10 defines redundant connections so a controlled station can hold more than one connection to the controlling station and switch which one carries user data.