What Is an IEC 60870-5 IOA (Information Object Address)?

Back to Blog

Two Addresses Locate a Point

IEC 60870-5 addressing works at two levels. The common address of the ASDU (CASDU) identifies the station or a logical grouping within it - think of it as the address of the outstation. The information object address (IOA) identifies a specific point inside that station: a particular status, measurement, or command. Together they are unique: CASDU plus IOA points at exactly one information object, the same way a street plus a house number points at one building.

The IOA is a numeric field, and crucially it does not by itself say what type of point it is - the same IOA value could in principle appear against different ASDU types. In practice, good engineering avoids that confusion by assigning IOA ranges to categories, so anyone reading the point list can tell a status from a measurement from a command by its address band alone.

Structuring an IOA Plan

A readable IOA plan is a deliberate design, not an accident. The common approach is to carve the IOA number space into ranges by point type and function - one band for single-point status, another for measured values, another for commands - and to keep spare room in each band for future points. This makes the map self-documenting: an address in the measurement band is obviously a measurement, and adding a point later does not force a renumber.

The IOA plan is set alongside the ASDU type assignment and the common address, a task covered end to end in planning the ASDU and IOA addressing. Because addressing is part of the shared application layer, the same IOA scheme applies whether the link is serial 101 or networked 104. A clean scheme also makes troubleshooting far easier, because you can read the point's role straight from its address.

How Big the IOA Space Is

In IEC 60870-5-101 the IOA length is a fixed system parameter - one, two, or three octets - chosen per system and configured identically at both ends. IEC 60870-5-104 fixes it at three octets, giving an address space that runs to 16,777,215. Because the protocol fields are positional, a length mismatch between master and outstation does not produce a tidy error message; it produces garbled parsing of everything after the address. That is why the chosen sizes are recorded in the interoperability profile and checked before anyone connects, not discovered afterward.

IOA 0 is reserved for ASDUs where an object address has no meaning - station-level exchanges such as a general interrogation command address the station as a whole and carry IOA 0 - so no real point should ever be assigned address zero. The common address of the ASDU has its own configurable sizes and a broadcast value as well. Keep both address plans in one document, because a point is only unique as the CASDU plus IOA pair, and half a plan is not a plan.

Structured vs Flat Address Plans

The standard permits treating the IOA's octets as structured sub-fields - for example low octet as the point within a device, middle octet as the device or bay, high octet as the area. The appeal is that a structured address decodes by eye straight off a protocol capture in hex, and the map documents itself. The cost is wasted space: most sub-ranges never fill, and one crowded bay can exhaust its octet while whole regions of the address space sit empty.

The flat alternative assigns decimal bands from a single number line, which spends the space efficiently but leans entirely on the point list for meaning. Many working systems land on a hybrid: decimal type-bands repeated inside per-area blocks. Any of the three works; what fails is mixing them. Pick one rule for the whole system, write it into the signal list, and hold every future addition to it - the worst address plan in practice is three good plans applied by three different engineers.

A Worked Symbolic Example

Consider a scheme of the form IOA = A x 100000 + T x 10000 + n, where A is the area or bay group, T is the type band - say 1 for single-point status, 2 for double-point status, 3 for measured values, 4 for counters, 5 for commands - and n is the sequence number within the band. A measured value numbered 37 in area 2 becomes 230037, and anyone reading a log resolves it by eye: area 2, type 3, point 37. The scheme stays comfortably inside the three-octet space while leaving generous spare in every band.

Two refinements repay their cost. First, keep each command's IOA related to its feedback point by a fixed offset, so pairing a control with its status is mechanical rather than a lookup. Second, leave the top of every n range unassigned as declared spare, and record it as spare - future points then extend bands instead of colonizing whatever gap looks empty, which is how tidy plans decay into archaeology.

Proving the Map After Commissioning

A general interrogation is the natural audit tool: it returns every monitored point in one sweep, and reconciling the returned CASDU and IOA pairs one-for-one against the signal list finds both failure modes at once. A point on the list that never arrives is unconfigured or dead; a point that arrives but is not on the list is undocumented. Both are defects, and both are far cheaper to fix while the commissioning crew is still on site than months later during an incident investigation.

Commands deserve a stricter standard: verify each individually, with the process in a safe state and qualified personnel supervising, because the consequence of an addressing error in the control direction is operating the wrong equipment. And where the master side is a gateway feeding a wider system, there is a third map to reconcile - the gateway's own tag mapping - since a perfectly correct outstation address map can still be mislabeled upstream. That end-to-end check is part of connecting IEC 60870 outstations to cloud SCADA.

Frequently Asked Questions