iec104-cheat-sheet

KO | EN

gitlite — search

#javascript #python #ai #llm #go #android #machine-learning #rust #deep-learning #nodejs #awesome #cli #pytorch #ios

iec104-cheat-sheet

(★ 22)

Cheat Sheet for IEC 104

iec104-cheat-sheet Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Cheat Sheet for IEC 104 Protocol

## What is IEC 104?
IEC 60870-5-104 (IEC 104) is a telecontrol network protocol used in energy distribution systems for SCADA and station communication.

## IEC 104 Frame Formats
There are three different control field formats:
- **U-Format**
  - consists of an APCI only
  - is used for controlling the connection: start, stop, test frames
  - each U-Format frame is sent as an "ACT" = activation and must be responded with a "CON" confirmation 
- **S-Format**
  - consists of an APCI only
  - is only used for acknowledging I-Format frames
- **I-Format**
  - contains information (one or multiple ASDU)
  - includes Sent and Receive Sequence Numbers

## APDU
A whole IEC 104 frame is called an APDU (Application Protocol Data Unit)

An APDU consists of
  - an APCI (Application Protocol Control Information)
  - (if it is an I-Format): one or multiple ASDU (Application Service Data Unit)

**APDU = APCI + n * ASDU**

## APCI
An Apci consits of six bytes.

- Byte 1: Start Byte (0x68)
 - Byte 2: Length of APDU (max. 253)
 - Byte 3 .. 6: Control field byte 1 .. 4

### U-Format

- **Byte 1:** Bit 8: TESTFR con, Bit 7: TESTFR act, Bit 6: STOPDT con, Bit 5: STOPDT act, Bit 4: STARTDT con, Bit 3: STARTDT act, Bit 2: 1, Bit 1: 1
 - **Byte 2** Bit 8 .. Bit 1 : 0
 - **Byte 3** Bit 8 .. Bit 1 : 0
 - **Byte 4** Bit 8 .. Bit 1 : 0

Each U-Format frame can only have one function, e.g. STARTDT con = 0x0B, 0x00, 0x00, 0x00

Functions are
- **TESTFR act:** Send a test frame to check connection (heart beat)
- **TESTFR con:** Confirmation response to a test frame activation
- **STOPDT act:** Stop data transmission
- **STOPDT con:** Confirmation response of stop of data transmission
- **STARTDT act:** Start data transmission
- **STARTDT con:** Confirmation response of start data transmission

### S-Format

If there are no I-Format frames to be sent, an S-Format frame can be used to acknowledge received I-Format frames.

- **Byte 1:** Bit 8 .. Bit 2: 0, Bit 1: 1
 - **Byte 2** Bit 8 .. Bit 1 : 0
 - **Byte 3** Bit 8 .. Bit 2: RSN (LSB) Bit 1 : 0
 - **Byte 4** Bit 8 .. Bit 1 :(MSB) RSN
 
 
 ### I-Format
Each I-Format frame consists of an APCI and one or multiple ASDU.
The I-Format APCI consists of two sequence numbers: RSN and SSN.

- **Byte 1:** Bit 8 .. Bit 2: SSN (LSB), Bit 1: 0
 - **Byte 2** Bit 8 .. Bit 1 : (MSB) SSN
 - **Byte 3** Bit 8 .. Bit 2: RSN (LSB) Bit 1 : 0
 - **Byte 4** Bit 8 .. Bit 1 :(MSB) RSN

### Sequence Numbers
Each I-Format frame has a send sequence number (SSN) and a receive sequence number (RSN), which consist of 15 bits each: 0 .. 32767.

For each sent I-Format frame the SSN is incremented by one.
The RSN of the I-Format frame equals the last SSN (plus one) that was received by the communication instance sending the I-Format frame (RSN is one ahead).
A RSN acknowledges all frames before its number (RSN = 7 means 6 ... 0 are also acknwoledged.

If one communication instance does not send I-Format frames, it must use S-Format frames for acknowledgment.

Acknowledgment must be done within timeout t2.

### ASDU
An ASDU consists of a Data Unit Identifier and one or multiple Information Objects.
The structure is as follows:
1. Byte: Type Identification
2. Byte: Variable Structure Qualifier
3. Byte: Cause of Transmission
4. Byte: Originator Address
5. Byte: Common Address of ASDU
6. Byte: Common Address of ASDU
7. Byte: Information Object Address
8. Byte: Infromation Object Address
9. Byte: Infromation Object Address
10. Byte ... : Set of Information Elements (different per Type Identification)

#### Type Identification (Type ID)
The data type of the Information Object.

Some important ones:

-	1:   M_SP_NA_1, single point information
-	3:   M_DP_NA_1, double point information
-	9:   M_ME_NA_1, measured value normalized
-	11:  M_ME_NB_1, measured value scaled
-	13:  M_ME_NC_1, measured value float
-	15:  M_IT_NA_1, integrated total
-	30:  M_SP_TB_1, signle point information with time tag
-	31:  M_DP_TB_1, double point information with time tag
-	34:  M_ME_TD_1, measured value normalized with time tag
-	35:  M_ME_TE_1, measured value scaled with time tag
-	36:  M_ME_TF_1, measured value float with time tag
-	37:  M_IT_TB_1, integrated total with time tag
-	45:  C_SC_NA_1, single command
-	46:  C_DC_NA_1, double command
-	47:  C_RC_NA_1, regulating step command
-	100: C_IC_NA_1, interrogation command
-	105: C_RP_NA_1, reset process command
// tba

#### Variable Structure Qualifier
Consists of 
Bit 8: SQ bit (Sequence)
Bit 7 .. 1: Number

SQ=0: contains only one Info Element or combination of info elements of same type, each with its own Info Object Address
SQ=1: sequence of single (not continuous) Info Objects. The Info Object Address is the first object's address, the next are incremented by one.

#### Cause of Transmission
This Byte contains a test bit (Bit 8), Positive/Negative bit (Bit 7) and Cause of Transmission number as follows.

- 0:  "UNDEFINED",
-	1:  "per/cyc",
-	2:  "back",
-	3:  "spont",
-	4:  "init",
-	5:  "req",
-	6:  "act",
-	7:  "actcon",
-	8:  "deact",
-	9:  "deactcon",
-	10: "actterm",
-	11: "retrem",
-	12: "retloc",
-	13: "file",

-	20: "inrogen",
-	21: "inro1",
-	22: "inro2",
-	23: "inro3",
	// ...

-	37: "reqcogen",
-	38: "reqco1",
-	39: "reqco2",
	// ...

-	44: "unknown TypeID",
-	45: "unknown Cause Of TX",
-	46: "unknown CASDU",
-	47: "unknown IOA",

#### Common Address of ASDU (CASDU)
Two Bytes: Is used as a substation reference number.
Each station has its unique CASDU

#### Info Object Address (IOA)
Three Bytes: References the Information Object
Each Info Object has its unique IOA.

### Timeouts
- **t0** TCP SYN timeout, default 30 s
- **t1** Max response time for any frames, default 15 s
- **t2** Max time for acknowledgments, default 10 s
- **t3** Max idle time, triggers test frames, default 20 s

### TCP Port
TCP Port is 2404

iec104-cheat-sheet

iec104-cheat-sheet Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

iec104-cheat-sheet

iec104-cheat-sheet Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README