IEC 60870-5-104 APDU, APCI and ASDU

Back to Blog

The Frame Layers

IEC 104 nests its data in named layers. The outermost is the APDU (Application Protocol Data Unit) - the whole frame that crosses the TCP connection. Every APDU begins with an APCI (Application Protocol Control Information): a start byte (0x68), a length byte, and four control-field octets. The APCI is always present; it is the envelope. When the frame carries application data, an ASDU (Application Service Data Unit) follows the APCI - that is the payload with the type identifier, cause of transmission, common address, and the information objects.

So an APDU is either APCI alone or APCI plus ASDU. That distinction maps directly to the format of the control field, which is the next thing to read.

I, S, and U Formats and the Sequence Numbers

The APCI control field comes in three formats. An I-format (information) APDU carries an ASDU and both a send sequence number and a receive sequence number - it is the frame that moves real data and advances the numbered flow control. An S-format (supervisory) APDU carries no ASDU; it is a pure acknowledgement that reports the receive sequence number, used when a receiver needs to acknowledge without having data to send back. A U-format (unnumbered) APDU carries connection-control functions and no sequence numbers - this is where STARTDT and STOPDT live, along with the TESTFR keepalive.

The sequence numbers in the I and S formats are what drive the k and w flow-control window that keeps the sender and receiver in step, tuned through the k, w, t1, t2, t3 parameters. Recognizing I versus S versus U in a capture is the first move when diagnosing a stalled connection: too many I-frames with no S acknowledgement means the receive side has stopped acknowledging. The ASDU inside an I-frame is the same application unit used across the family and detailed in the IEC 60870-5-104 overview.

Reading the APCI Bytes by Hand

With a hex view and three rules you can classify any 104 frame without a dissector. After the 0x68 start byte and the length octet come the four control octets, and the lowest bits of the first control octet identify the format: if bit 0 is 0 the frame is I-format, if the two lowest bits are 01 it is S-format, and 11 means U-format. The length octet counts everything after itself - the four control octets plus any ASDU - and the standard caps the APDU at 253 octets, which in turn caps how many information objects fit in a single frame.

The sequence numbers are 15-bit counters carried across two octets each, shifted up one bit so the format bits stay out of their way, rolling over at 32768. In an I-frame the first pair of control octets carries the send sequence number and the second pair the receive sequence number; an S-frame carries only the receive number. Decoding a few frames by hand is worth doing exactly once - after that, the dissector's output stops being magic and starts being checkable.

What Lives Inside the ASDU

When an I-frame carries an ASDU, the payload has fixed anatomy of its own. It opens with the data unit identifier: a one-octet type identification saying what kind of objects follow, a one-octet variable structure qualifier giving the object count, the two-octet cause of transmission including the originator address, and the two-octet common address of the ASDU. After that come the information objects themselves, each led by its three-octet information object address and followed by the value, plus whatever quality descriptor and time tag the type defines.

The variable structure qualifier hides one packing trick worth knowing: its top bit, SQ, flags a sequence of objects at contiguous addresses. With SQ set, the ASDU carries one starting address followed by a run of values, saving the per-object address overhead - common when an outstation reports a block of adjacent measurands in one frame. A dissector shows this as many objects under a single address; it is a compression feature, not a decoding error.

Time-tagged types append a seven-octet CP56Time2a structure to each object, carrying milliseconds through year plus an invalid flag. Two of its details bite integrators regularly: the standard leaves the choice of local time versus UTC to the project, so both ends must agree explicitly, and the invalid bit is set by an outstation whose clock has lost synchronization - a tag worth surfacing rather than discarding, because it tells you the timestamp cannot be trusted even though the value itself may be fine.

Capture Checks for a Stalled Link

A handful of capture-level checks resolves most complaints that the link is up but no data moves:

1. Look for the U-format start activation and its confirmation right after the TCP handshake; a master that never sends it, or an outstation that never confirms it, leaves the link connected but mute by design.
2. Count outstanding I-frames against acknowledgements; a sender that stops after a fixed number of unacknowledged frames has filled its window and is waiting, not broken.
3. Check for periodic test-frame exchanges on quiet links; their absence explains connections that die overnight.
4. Watch for either side closing the TCP connection after a silent interval - that is a supervision timer expiring on missing acknowledgements, and the side that closed is the one whose expectation was violated.
5. Match the cause of transmission on arriving ASDUs against what actually triggered them; interrogation responses arriving marked spontaneous, or the reverse, point at outstation configuration.

The point of the layered frame design is that each check isolates one mechanism - activation, flow control, keepalive, supervision, application - so a stalled connection can be diagnosed precisely instead of rebooted hopefully.

Frequently Asked Questions