What is IEC 60870-5-104 and why is it used in power system automation?

IEC 60870-5-104 is a communication standard used for remote monitoring and control in electrical power systems. Since it is designed for telecontrol and telemetry, it is very common in substations, especially for transmission and distribution companies.

The classic IEC 60870-5-101 works over serial lines (RS-485, leased line, serial modem). IEC 104, on the other hand, carries the same communication logic over Ethernet and TCP/IP. That is, it uses an IP network. This makes it very suitable for new substation projects and wide area networks.

Let’s summarize the concepts briefly:

Telecontrol: The job of remotely commanding the grid, such as remote circuit breaker opening/closing.
Telemetry: The transmission of field measurements to the center, such as current, voltage, power, and energy.
SCADA integration: The ability of field devices (RTU, IED, meter, etc.) to communicate with the SCADA system.
RTU (Remote Terminal Unit): The field control device that collects field signals, executes commands, and communicates with the center over protocols.

Consider a substation. The RTU collects information from the circuit breakers, disconnectors, and instrument transformers in the field. It then sends this data to the SCADA Master center using IEC 104. The operator clicks on a circuit breaker on the SCADA screen, the command goes to the RTU via IEC 104, and the RTU applies this command to the relevant bay.

Reasons for choosing IEC 104:

Standard and widespread; devices from different manufacturers can work together.
Being IP-based, it can be easily used in wide area networks and infrastructures like MPLS, VPN, 4G.
It clearly shows the sequence of events with time-stamped data support.
It supports both periodic data and event-based (spontaneous) telemetry.

How does IEC 60870-5-104 differ from protocols like IEC 60870-5-101 and MODBUS?

The three most common protocols side-by-side in the field are: IEC 101, IEC 104, and Modbus.

Simple differences:

IEC 101: Works over serial port, an old but still used standard.
IEC 104: The IP-based version of the same family, using Ethernet and TCP/IP.
MODBUS (RTU/TCP): Very simple, lightweight, used in many industries, but it is not a full telecontrol standard for power system automation.

The main reasons why IEC 104 is generally chosen in a new substation project are:

It fits more easily into existing network infrastructure because it is IP-based.
Fault analysis is clearer with time-stamped event records.
It has a standard telecontrol command set and supports security mechanisms like double confirmation, select-before-operate.
Event-based telemetry reduces unnecessary network traffic and provides instant notification for important changes.

If you want to functionally compare IEC 104 with MODBUS, the following article is a good source for a detailed technical look: Comparison of Modbus and IEC 60870-5-104 communication protocols.

Typical data flow with IEC 104 in a substation: RTU, IED, and SCADA relationship

Visualize a simple scenario:

There is an RTU and a few IEDs (protection relay, energy analyzer, meter) in the substation.
The RTU collects circuit breaker and disconnector statuses from digital inputs, and current, voltage, and power information from analog inputs.
If necessary, it also receives data from IEDs via Modbus, IEC 61850, or other protocols.
It sends all this data to the SCADA Master system in the control center using the IEC 60870-5-104 protocol.
The SCADA operator gives a command to open a circuit breaker on the single-line diagram.
The command goes to the RTU via IEC 104, the RTU outputs the command to the relevant circuit breaker, and the result is returned as IEC 104 telemetry.

The roles are clear here:

SCADA: The Master side, which initiates the request, asks for data, and sends commands.
RTU / IED: The Slave side, which knows the field, produces data, and receives commands.

Typical signals sent:

Digital statuses, e.g., “Circuit Breaker 1 open/closed.”
Analog measurements, e.g., “Phase A current,” “Line power kW.”
Alarms, e.g., “Protection tripped,” “Gas relay alarm.”
Counter values, e.g., “Daily energy MWh.”

Event-based transmission with time stamps provides great convenience in the operation center. For example, when a circuit breaker opens, recording the exact hour and millisecond of the event is crucial for the sequence and responsibility of the fault.

IEC 60870-5-104 protocol structure: Quick read guide for field engineers

The standard document may look thick and daunting when you hold it. But the part required for daily work in the field is much simpler.

We can think of IEC 104 communication as a postal system:

The TCP connection is the highway between two cities.
IEC 104 frames are the postal vehicles traveling on this road.
The ASDU is the letter inside the envelope.

In the field, you are generally interested in the content of the letter. That is, “which point,” “which value,” “which time.”

IEC 60870-5-104 communication layers: TCP connection, session, and ASDU concept

The basis of communication in IEC 104 is the TCP connection. That is:

A connection is established over an IP address and port number.
Port 2404 is generally used.

When the connection is established, there are three types of frames on the IEC 104 side:

I-frame: The actual data packets, i.e., telemetry and commands.
S-frame: Acknowledgment frames for flow control.
U-frame: Control frames for purposes like opening or closing the connection.

There is no need to memorize their content. It is enough to see them as “communication rules” that regulate the conversation between the two sides.

The really important part is ASDU (Application Service Data Unit). Each ASDU carries the following information:

An address indicating which RTU or substation it came from.
An information object address specifying which field point it belongs to.
Data type, e.g., “single-bit status,” “analog measurement,” “counter.”
The actual value and, if required, the time stamp.

You will see these fields most often when looking at IEC 104 traffic in Wireshark.

Addressing logic: Common address, information object address, and their field equivalent

You can think of the IEC 104 addressing structure as two main parts:

Common Address of ASDU: Generally, the address of the RTU or substation.
Information Object Address: The address of each point within that RTU.

Example:

Common address: 3 (This could be “Substation X RTU.”)
Information object address: 101 (This could be “Circuit Breaker 1 status information.”)

Every point you define on the SCADA side corresponds to the IEC 104 address space. That is, in the SCADA tag list:

The label “TRAFO_X_KESICI_1_DURUM” is matched with common address 3, information address 101 in IEC 104.

If you make a mistake in addressing, dangerous consequences such as a command going to the wrong circuit breaker may occur. Therefore, it is very important to document the address plan correctly from day one.

Data types: Digital statuses, analog measurements, and event records

We can group IEC 104 data types into three or four main groups:

Binary (single-bit) statuses: Open/closed, present/absent, normal/fault.
- Example: Circuit breaker status, disconnector position, protection trip information.
Analog measurements: kV, kA, kW, kVar, Hz, temperature, etc.
- Example: Line current, voltage applied to the busbar, transformer oil temperature.
Counter values: Energy, energy items, meter indexes.
- Example: Daily, monthly MWh values.
Event and alarm records: Generally time-stamped digital changes.
- Example: “Circuit breaker opened 12:03:25.123,” “Earth fault detected 16:40:02.540.”

Time-stamped types save lives in fault analysis. Especially when there are consecutive openings in several stations, being able to see who opened first at the second and millisecond level makes it very easy to understand the root cause.

IEC 60870-5-104 protocol configuration steps in the field: RTU and SCADA settings

Now let’s move on to the field side of the job. Assume you are doing a real substation project. The basic steps are:

Network and IP planning.
IEC 104 configuration on the RTU side.
Master settings on the SCADA side.
Performance and test settings, commissioning.

If you prepare a small checklist for yourself at the end of each step, surprises in the field will decrease. If you are working on a Mikrodev-based project, IEC 60870-5-104 application notes can also speed up your work for IEC 104 configuration examples.

Network and IP planning: Roadmap from substation to control center

First, clarify the communication path in your mind:

Internal network of the substation (RTU, switch, IEDs).
The line going out to the regional center via the router or modem.
The chain going from there to the SCADA network in the control center.

Things to consider:

Plan a fixed IP address for each RTU.
For IEC 104, generally use port 2404, and note this port on network devices.
If necessary, separate different substations with VLANs or separate IP blocks.

A good practice in terms of cybersecurity is to separate the power system automation network from the general office network. Connecting the two networks via a firewall that only allows the necessary ports and IPs significantly limits erroneous or malicious access. Many distribution companies in Turkey have data communication specifications structured with similar principles.

Mini checklist:

Are the RTU IP, subnet, gateway plans ready?
Are the port and routing to be used for IEC 104 documented?
Which networks will be separated, is it clear?

IEC 104 configuration on the RTU side: Basic parameters and points to watch

You generally set the following parameters on the RTU:

IP address, subnet mask, gateway.
IEC 104 port number (mostly 2404).
Common address range (if the RTU uses multiple virtual addresses).
ASDU addresses and point maps.
Time synchronization (NTP, GPS, receiving time from SCADA).

The point list (tag list) is vital here. For every signal in the field:

The physical input/output on the RTU,
The IEC 104 information address,
The SCADA tag name

must be clearly documented in a single Excel or document.

Do not underestimate the time settings. If the RTU clock is wrong, the time of all event records will shift. This makes fault analysis almost useless. If possible:

Connect the RTU to a reliable NTP server.
Or receive periodic time synchronization from the SCADA Master.

Mini checklist:

Are the RTU IP and clock settings correct?
Do the common address and information addresses exactly match the tag list?
Is the time synchronization source clear?

Master configuration on the SCADA side: Point mapping and test scenarios

The main tasks you will perform on the SCADA Master side:

Line definition, i.e., the information “This RTU will communicate with this IP/port and this common address.”
Polling settings, how often you will request data.
Time synchronization settings.
Command permissions, who can send commands to which station.

Testing in the following order during commissioning makes things easier:

Communication test: Ping, is the connection established, is the IEC 104 link UP?
Digital statuses: Manually open/close a circuit breaker in the field, are the correct points changing in SCADA?
Analog measurements: Compare the value on the measuring device screen with the value on the SCADA screen.
Counter values: Are the indexes increasing logically, are the unit and scale correct?
Command tests: First try unauthorized commands, see that they are blocked. Then test closing/opening with an authorized user. Be sure to test relay interlocks and authorization mechanisms.

Mini checklist:

Is the RTU connection stable, are there frequent disconnections?
Have all critical points been tested individually?
Is the command authority matrix and logging mechanism working?

Performance settings: Notification, periodic scanning, and bandwidth management

Some of the most common mistakes in IEC 104 are:

Choosing a very short scan period for all points, unnecessarily overloading the line.
Enabling telemetry for every change that is not actually critical.
Disabling event-based transmission (spontaneous) and constantly querying everything.

A simple balance can be established:

Use event-based transmission for important alarms and status changes.
Determine a reasonable period for analogs, for example, 2 or 5 seconds.
You can read counter values at minute or 15-minute intervals.
On low-bandwidth lines, only enable the points you truly need.

Telecontrol traffic (commands) should always be prioritized. If the network is congested and commands are delayed, scan periods should be reviewed.

Mini checklist:

Are critical alarm and event points spontaneous?
Are the periodic scan periods reasonable?
Is the line capacity compatible with the number of points?

Secure telemetry with IEC 104: Cybersecurity, integrity, and continuity

An important feature of IEC 104 is that it is not an encrypted protocol on its own. That is, data is transported as plain text over the IP network. Therefore, security must be built not on the protocol, but on the network design and additional security layers.

The goal here is not to create fear. On the contrary, it is to show that secure telemetry can be achieved with a few feasible steps.

Three basic concepts:

Confidentiality: Only authorized persons access the data.
Integrity: The data is not corrupted or tampered with in transit.
Availability: The systems are operational and accessible when needed.

Basic cybersecurity measures: Network segmentation, firewall, and VPN usage

IEC 104 traffic generally goes over TCP port 2404. Instead of leaving this port “open to everyone,” it must be used only at the points where it is truly needed.

Practical measures:

Separate the power system automation network from the office network. Put a firewall in between.
Allow access only for specific IP addresses and port 2404 on the firewall.
Definitely use a VPN for remote connections. Do not open the IEC 104 port directly over the open internet.
Use strong passwords on devices such as RTUs, routers, and firewalls. Change default passwords from day one.
Keep remote access permissions to a minimum, disable them if not needed.

These steps can often be done with existing infrastructure without requiring an additional device in the field.

Data integrity and time stamp: The role of IEC 104 in fault analysis

Consider a brief fault scenario:

There is a leak on the line, and the protection relay trips.
At the same time, a voltage fluctuation occurs in another area.
Several circuit breakers open consecutively within a few seconds.

The only way to solve this chaos is to correctly see the sequence of events. That is, which event happened first and which happened next. This is where the time-stamped events of IEC 104 come to the fore.

When the RTU loses connection, well-designed systems:

Store the events in their own memory.
When the connection is restored, they send the missing records to SCADA with a “backfill” logic.

For this structure to work properly:

The clocks of the RTU, SCADA, and any GPS/NTP sources must be synchronized.
Time synchronization must work regularly.

Managing time correctly is as important as telemetry for quality reports and fault analyses. It may also be useful to look at the basic explanations for the general structure of the IEC 60870-5 standard.

Field failure resilience: Timeout, reconnection, and alarm strategies

Lines in a real grid do not always work perfectly. Especially in rural areas:

Delays increase.
The connection is sometimes lost.
Packet losses occur.

Therefore, TCP timeout and reconnection settings gain importance:

A very short timeout produces an error alarm even with small delays.
A very long timeout causes you to notice a real disconnection late.
Reconnection times must be compatible on both the RTU and SCADA sides.

The SCADA alarm strategy should also be balanced:

Put alarms like “RTU offline” in a separate and prioritized category.
Use hysteresis or delay for temporary, few-second disconnections.
Producing a separate alarm for every small delay leads the operator to alarm blindness.

IEC 104, RTU, and SCADA integration: Practical tips for project and maintenance

Let’s place what we have discussed so far into a project process. It is possible to develop a perspective that will make your work easier in new installation, rehabilitation, or maintenance projects.

Your general goal:

Correct selection of RTU and IED.
Robust IEC 104, RTU, and SCADA integration.
Well-planned testing and commissioning.
Long-term maintenance and documentation.

This approach will serve you again and again in power system automation and telecontrol projects.

Features to consider regarding IEC 104 when selecting RTU and IED

When selecting an RTU or IED, just looking at the number of inputs/outputs is not enough. Look at these points from the IEC 104 perspective:

Is there a certificate or test report for IEC 60870-5-104 compliance?
Does it support connecting to multiple control centers over the same line?
Does the point capacity cover future additions?
How is time-stamped event recording, how many records can it keep?
Is the configuration software understandable, does it allow quick intervention in the field?
Is there local manufacturer support, Turkish documentation, and fast technical support?

These features provide significant time and cost savings in the long run.

Project commissioning process: Step-by-step test plan and acceptance criteria

A simple but effective commissioning flow can be as follows:

Pre-project preparation
- The list of all points, address plan, IP plan, and security rules should be ready in writing.
Factory Acceptance Test (FAT)
- Connect the RTU and SCADA to each other in an office environment. Test IEC 104 communication, commands, and time synchronization here.
Field cable and signal test
- Check that the digital and analog inputs are actually connected to the correct field equipment.
IEC 104 communication test
- Test the connection over the actual line from the substation to the control center, observe errors and delays.
Live scenario trials
- Together with the operation center, perform opening/closing, fault, and outage tests similar to real operating scenarios.
Acceptance and documentation
- Collect all test results, document any remaining deficiencies, and finally close the work with the official acceptance form.

Common errors:

Wrong address or naming in the tag list.
Forgetting time synchronization settings.
Connection cutting out occasionally due to a firewall rule.
The command authority matrix not matching real operation needs.

Using a small checklist for these topics in every project significantly reduces recurring errors.

Monitoring, maintenance, and preparing for the future: Making the IEC 104 infrastructure long-lasting

The work does not end after installing a good IEC 104 infrastructure. To keep it long-lasting and reliable:

Regularly take configuration backups of RTU, SCADA, and network devices.
Record every change, making “who, when, what was changed” visible.
Perform protocol and firmware updates within a plan, testing them in a test environment first.
Review security rules and user permissions at least once a year.
Keep the network structure flexible for new SCADA functions, cybersecurity standards, or additional monitoring systems.

In the long run, a well-planned IEC 104 infrastructure is an investment for grid security and operational continuity. If you install and document it correctly today, you will thank yourself during future rehabilitation work.

Building a robust and secure infrastructure in the field with IEC 104

IEC 104 provides a strong foundation for telecontrol, telemetry, and SCADA integration in power system automation projects. With a correctly configured RTU and a well-designed network, receiving secure telemetry from substations becomes much more predictable.

Let’s briefly remember that IEC 104 provides you with:

An IP-based, flexible communication infrastructure,
Clear fault analysis with time-stamped event records,
Secure telecontrol with a standard command structure,
A protocol environment where different manufacturers can work together.

Top 3 applicable steps in the field:

Prepare a correct IP and address plan, and set up the RTU and SCADA tag list solidly from the start.
Implement basic security measures, do not neglect network segmentation, firewall, VPN, and time synchronization.
Create a step-by-step test plan, and document every stage from lab testing to site acceptance.

You can use this guide as a checklist when starting a new project or rehabilitation work. When you repeat the same logic for every substation, you will see that your IEC 104, RTU, and SCADA projects progress both faster and more securely. The moment you establish the balance of IEC 104, power system automation, telecontrol, protocol configuration, security, SCADA integration, RTU on the power system automation side, keeping the pulse of the grid remotely but securely becomes much easier.