What Is IEC 60870-5-104?
IEC 60870-5-104 (often shortened to IEC 104) is a telecontrol protocol used widely in electrical utilities and infrastructure SCADA, especially across Europe and much of Asia. It carries the IEC 60870-5-101 application data over standard TCP/IP networks, giving power grids and pipelines a standardized way to move telemetry and commands between control centers and remote stations.
IEC 60870-5-104 in one line: IEC 60870-5-104 is an international telecontrol standard that transports IEC 60870-5-101 application messages (ASDUs) over TCP/IP, enabling utility and infrastructure SCADA masters to exchange measurements, status, and control commands with remote RTUs and substations over routable networks.
IEC 104, IEC 101, and ASDUs
The IEC 60870-5 series defines companion standards for telecontrol. IEC 60870-5-101 specifies the application layer and message formats for serial links, while IEC 60870-5-104 keeps that same application model but replaces the serial transport with a TCP/IP profile. The data itself is carried in Application Service Data Units (ASDUs), each identified by a type (single-point status, measured value, command, etc.) and a Cause of Transmission that explains why the message was sent - spontaneous change, periodic update, interrogation response, or command confirmation.
This structure gives -104 a rich, self-describing model of telemetry and control that maps naturally onto grid and substation operations: breaker positions, analog measurements, tap-changer commands, and time-tagged events all have defined ASDU types. Time tagging with high resolution supports sequence-of-events analysis after a disturbance.
Where IEC 104 Fits and How It Integrates
IEC 104 is the workhorse telecontrol protocol for electricity transmission and distribution SCADA in many regions, and it appears in water, gas, and pipeline infrastructure that shares utility heritage. Control centers act as masters (controlling stations) that poll and command RTUs and gateways at substations and remote sites (controlled stations) over the operator's wide-area network.
Because -104 already runs over TCP/IP, integrating it into a modern SCADA or data platform is largely a matter of protocol support and network design. A gateway or SCADA driver terminates the -104 session and maps ASDUs to internal tags, which can then be historized, visualized, and forwarded. For operators consolidating multi-site data, a cloud platform can ingest values gatewayed out of an IEC 104 system so grid-adjacent oil and gas assets - pipeline cathodic protection, remote pump stations, tie-in metering - share one dashboard and historian with the rest of the estate.
How a -104 Session Starts and Stays Alive
A -104 connection has a life cycle worth knowing before you stare at a capture. The controlling station opens a TCP connection to the controlled station on port 2404, the port registered for the protocol. At that point the link is up but silent: no application data flows until the master sends a STARTDT activation frame and the outstation confirms it. Masters commonly follow that confirmation with a station interrogation so the point database starts from a known state, then let spontaneous reporting carry changes from there. You can run a general interrogation at any time afterwards to re-baseline a database you no longer trust.
Once data is flowing, both sides police the connection with timers and counters. Test frames act as keepalives on quiet links, and the send and receive sequence numbers let each side confirm the other is still consuming what it transmits. If acknowledgements stop arriving within the configured time, the sender closes the connection and the master reconnects. The standard publishes recommended defaults for these parameters, and tuning k, w and the timers is one of the few knobs that genuinely changes behavior over slow or lossy wide-area networks.
Structural Parameters Fixed by the -104 Profile
The serial -101 standard leaves several field sizes negotiable per project, which historically produced incompatible device pairings. The -104 profile removes that freedom by fixing the sizes, which is a large part of why -104 devices interoperate more smoothly than their serial ancestors:
| Field | Fixed by the -104 profile |
|---|---|
| Cause of transmission | 2 octets, including the originator address |
| Common address of ASDU | 2 octets |
| Information object address | 3 octets |
| TCP port | 2404 |
What remains site-specific is how you use those fields: which common addresses identify which stations, and how the three-octet information object address space is carved up across the point database. Sorting that out before configuration - ranges per station, ranges per data type, room to grow - is the point of an ASDU and IOA addressing plan, and it is far cheaper to do on paper than to renumber a live system later.
Commissioning a New -104 Link
Bringing up a fresh link is mostly a sequence of confirmations, each isolating a different layer:
- Confirm plain TCP reachability from master to outstation on port 2404 before touching any protocol settings.
- Verify the connection reaches the started state: STARTDT activation sent by the master and confirmed by the outstation.
- Run an interrogation and check that every expected point reports, with a plausible value and good quality.
- Force a change in the field and confirm it arrives spontaneously with the correct cause of transmission and a sensible timestamp.
- Issue a test command to a non-critical point, with the site's authorization and under the supervision of qualified personnel, and confirm the full confirmation sequence completes.
- Pull the cable or drop the route, and confirm both sides detect the failure and recover cleanly when the path returns.
The last step is the one most often skipped and the one that matters most in service, because wide-area networks fail routinely, and a link that cannot re-establish itself unattended will generate callouts for years.
Common Pitfalls on Live Links
A few failure patterns account for most -104 trouble tickets. Address mismatches come first: the master polls a common address the outstation does not answer for, or the point database maps an information object address to the wrong field signal, which produces data that is present but wrong - considerably more dangerous than data that is missing. Time problems come second: an outstation stamping events in local time while the master expects UTC quietly shifts every event in the log, and the discrepancy usually surfaces during the first serious incident investigation, which is the worst possible moment.
Sequence-number stalls are the third family: one side stops acknowledging, the flow-control window fills, and data transfer freezes until a timer expires and the connection closes. Redundant masters add a fourth: if two control centers both hold started connections to the same outstation without a coordinated redundancy scheme, commands and interrogations interleave unpredictably. Each of these is visible in a protocol capture once you can read the frame formats, which is why a capture taken at the outstation is the first diagnostic worth collecting.
Frequently Asked Questions
What is the difference between IEC 101 and IEC 104?
They share the same application layer and message model (ASDUs), but IEC 60870-5-101 runs over serial links while IEC 60870-5-104 runs the same messages over TCP/IP networks. In practice, -104 is used where an IP wide-area network is available, and -101 where legacy serial telecontrol links remain.
Where is IEC 60870-5-104 used?
It is most common in electrical transmission and distribution SCADA, particularly in Europe and Asia, and in water, gas, and pipeline infrastructure with utility heritage. It links control centers with substation and remote-station RTUs over the operator's wide-area IP network.
How does IEC 104 compare to DNP3?
Both are telecontrol/SCADA protocols with event reporting, time stamping, and interrogation, serving similar roles. IEC 60870-5-104 dominates European and Asian utilities, while DNP3 is more common in North American electric and water utilities. The choice is usually driven by region, existing installed base, and utility standards.
What TCP port does IEC 60870-5-104 use?
Port 2404, the port registered for the protocol by the standard. Firewall rules along the whole path between control center and remote station need to permit it, and a blocked 2404 somewhere in the middle is one of the most common reasons a brand-new link never leaves the idle state.
Can one IEC 104 outstation serve more than one master?
Yes. Outstations commonly accept connections from more than one controlling station, for example a main and a backup control center. How events are queued per connection and which connection is allowed to send commands depends on the device's redundancy configuration, so that behavior needs to be defined and tested deliberately rather than assumed.
Sources & Further Reading
Primary references from the standards bodies and regulators that define this topic:
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.