IEC 104

Pull

Synopsis

Director reads one IEC 60870-5-104 controlled station: a substation's RTU, a protection relay, or the controller of a wind or solar plant, of battery storage, or of a gas network. Director connects to it as a controlling station, the way a control centre's front end does: over TCP (port 2404), or over TLS with a client certificate where the station secures its connections (IEC 62351-3). It starts the data transfer and interrogates the station; from then on the station sends its changes of itself, and Director writes what it sends as ECS records. Nothing is installed on the station.

It never commands anything. The device sends the start of the data transfer, the station interrogation and, only when counter_interrogation_interval is set, a counter interrogation that reads the integrated totals and neither freezes nor resets them. It has no command, set point, clock synchronization, or reset process to send, and the connection refuses to send anything but those two interrogations (see What It Sends).

warning

The device needs a connection of its own at the station. A station takes a limited number of connections, each set up in its own configuration, and keeps the events it has not delivered for each of them. Set up a connection for Director's address in the station's configuration. On the control centre's connection the device would take the events the control centre is waiting for, and a station with no connection set up for Director's address closes the connection as it is made.

One device, one station, one common address. Monitoring twelve stations takes twelve devices, and a gateway that fronts several stations is read by a device for each. The device dials the station and binds no port, so any number of IEC 104 devices, on one Director or several, can name port 2404, and none of them blocks a listener. One Director owns each device: two would write every information object twice, and a station has few connections to spare.

What to write is declared by datasets. An information object carries an address and a value: that address 3001 is the voltage of a busbar is in the operator's signal list, not on the wire. So a point dataset is your own, a table of the points whose latest values it writes on an interval, each an information object address, a type, and a name, with a scale where the signal list has one. An event dataset writes every information object the station sends, as it came, with its cause of transmission, its quality, and its time tag: the station's sequence of events.

The device runs on Director only; no agent runs it.

note

The IEC 104 device needs Director 2.4.1 or later.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: iec104
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string|string[]>
    port: <numeric>
    common_address: <numeric>
    originator_address: <numeric>
    cot_size: <numeric>
    common_address_size: <numeric>
    ioa_size: <numeric>
    k: <numeric>
    w: <numeric>
    t0: <numeric>
    t1: <numeric>
    t2: <numeric>
    t3: <numeric>
    interrogation_interval: <numeric>
    counter_interrogation_interval: <numeric>
    timezone: <string>
    timestamp_source: <string>
    max_reconnect_interval: <numeric>
    tls:
      status: <boolean>
      server_name: <string>
      ca_name: <string>
      cert_name: <string>
      key_name: <string>
      passphrase: <string>
      insecure_skip_verify: <boolean>
      min_tls_version: <string>
      max_tls_version: <string>
  definitions: <definition[]>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
`id`	Y	-	Unique numeric identifier
`name`	Y	-	Device name
`description`	N	-	Optional description
`type`	Y	-	Must be `iec104`
`tags`	N	-	Optional tags
`pipelines`	N	-	Optional pre-processor pipelines
`status`	N	`true`	Enable/disable the device

Connection

Field	Required	Default	Description
`address`	Y	-	The station's host name or IP address, or up to 8 addresses: the connections of one redundancy group, in the order they are tried (see Redundancy Group). Several addresses are a list, or one text separated by commas. An address may carry a port of its own (`host:2405`, `[2001:db8::70]:2405`). A wildcard address is refused.
`port`	N	`2404`	From `1` to `65535`, for every address that names none. A station that takes its TLS connections on a port of their own, commonly `19998`, is given it here or in its address.
`common_address`	N	`1`	The station's common address of ASDU, which the device interrogates and whose points it reads: from `1` to `65534`, or `1` to `254` with a `common_address_size` of `1`. `0` is not used, and the global address, which names every station at once, is refused.
`originator_address`	N	`0`	From `0` to `255`. The originator address the device names itself with in what it sends, for a station that tells its controlling stations apart by it. Needs a `cot_size` of `2`.
`timezone`	N	`UTC`	The zone of the station's clock, which its time tags are read in: `UTC`, an IANA name (`Europe/Istanbul`), or an offset (`+03:00`). `Local` is refused: Director's own zone is not the station's.
`timestamp_source`	N	`data`	What an event's record is dated by: `data`, the object's time tag, within limits, or `collection`, the time it arrived (see Time).
`max_reconnect_interval`	N	`30`	The longest wait between two tries to connect, in seconds, from `1` to `300`. The wait starts at one second and doubles while the tries fail.
`tls`	N	off	How the connection is secured. See TLS.

Protocol

The sizes, the windows, and the timers are the standard's by default. They are the station's to say: its interoperability list names them, and the two ends of a connection have to agree. A station of an IEC 60870-5-101 heritage behind a gateway may use shorter addresses, which is what the three sizes are for.

Field	Required	Default	Description
`cot_size`	N	`2`	Octets of the cause of transmission, `1` or `2`; the second is the originator address
`common_address_size`	N	`2`	Octets of the common address, `1` or `2`
`ioa_size`	N	`3`	Octets of the information object address, `1`, `2`, or `3`
`k`	N	`12`	The I frames one end sends at most before one is acknowledged, from `1` to `32767`
`w`	N	`8`	The I frames the device receives at most before it acknowledges, from `1` to `32767` and not above `k`. More than two thirds of `k` is warned of, as the standard advises against it.
`t0`	N	`30`	Seconds a connection may take to be made, its TLS handshake included, from `1` to `255`
`t1`	N	`15`	Seconds the station has to acknowledge an I frame or to confirm a start, a stop, or a test, from `1` to `255`
`t2`	N	`10`	Seconds the device may hold an acknowledgement back, from `1` to `255` and less than `t1`
`t3`	N	`20`	Seconds the connection may be idle before the device tests it, from `1` to `172800`
`interrogation_interval`	N	`900`	Seconds between two station interrogations beside the one every connection starts with, from `1` to `86400`. `0` interrogates at the start of a connection alone.
`counter_interrogation_interval`	N	`0`	Seconds between two counter interrogations, the start of a connection included, from `1` to `86400`. `0`, the default, never asks: at some stations a counter interrogation freezes the counters, which is the station operator's call.

A device that fails these checks does not start, and its state is Configuration error; the message names the field. Every bound is checked when the configuration is read, before anything is dialed. A whole number is a number or its digits, or ${NAME}, an environment variable of Director's that holds one. A field counted in seconds (t0 to t3, the two interrogation intervals, max_reconnect_interval, and a point dataset's interval) also takes a duration of whole seconds (15s, 2m). No other field does: port: 40m is refused, not read as port 2400.

TLS

TLS is on when tls.status is true. The station's certificate is then verified, against tls.ca_name or the system's authorities, for the name in tls.server_name or the host the device dialed, unless tls.insecure_skip_verify is on.

Field	Required	Default	Description
`status`	N	`false`	Secures the connection
`server_name`	N	the address	The name the station's certificate is verified for
`ca_name`	N	the system's authorities	The authority of the station's certificate: PEM inline, or a file under the Director's root
`cert_name`, `key_name`	N	-	The device's certificate and its key, sent when the station asks for one. Both or neither.
`passphrase`	N	-	For an encrypted key
`insecure_skip_verify`	N	`false`	Does not verify the station's certificate, which the device warns of
`min_tls_version`, `max_tls_version`	N	`tls1.2`, none	`tls1.0`, `tls1.1`, `tls1.2`, or `tls1.3`

What the block names is read when the device starts, so a CA or a certificate rotated where it is kept restarts the device. A TLS 1.2 station that renegotiates its session to renew its keys, as IEC 62351-3 has it, is answered; the device starts no renegotiation itself and checks no revocation.

Connection

Starting

The device dials the station and, with tls.status on, makes the TLS handshake, both within t0. It sends STARTDT act at once; the station has t1 to confirm. From the confirmation on, the data transfer is started, the device is Connected, and it interrogates the station.

The connection then runs the standard's procedures: every I frame carries its sequence numbers, the device acknowledges once w frames wait or t2 after the oldest came, the station has t1 to acknowledge what the device sends, and a connection idle for t3 is tested with TESTFR act. A frame out of sequence, an acknowledgement of frames that were not sent, octets that are no frame, or a frame left unacknowledged past t1 ends the connection. A far end that sends STARTDT act or STOPDT act is a controlling station, not a controlled one: the connection ends with a Configuration error that says so.

What It Sends

Three kinds of frames leave the device: U frames (STARTDT act, STOPDT act, TESTFR act, and TESTFR con), S frames, and I frames that carry one of two ASDUs:

ASDU	When	What it changes at the station
`C_IC_NA_1` (100), activation, qualifier `20`	At the start of every connection, and every `interrogation_interval`	Nothing: the station answers with its points
`C_CI_NA_1` (101), activation, qualifier `5`	The same, only with a `counter_interrogation_interval`	Nothing: the freeze bits are zero, which reads the totals the station has and freezes and resets none

It never sends a command (single, double, or regulating step, a set point, a bitstring), a clock synchronization (C_CS_NA_1), a reset process (C_RP_NA_1), a read (C_RD_NA_1), a test command, or a parameter. This is not a setting: the connection refuses to send any ASDU but those two.

Interrogation

The station is interrogated when a connection's data transfer starts, and every interrogation_interval after. A station that says it has started (an end of initialization, M_EI_NA_1) is interrogated again at once.

A station that does not confirm an interrogation within t1 is said once, as a warning. What it sends of itself is written all the same.
A station that refuses the interrogation (a negative confirmation, or an answer that it does not know the type, the cause, the common address, or the object address) makes the device's state Configuration error, which says which and what to check. A later interrogation that is answered makes it Connected again. A refused counter interrogation is only said.
When an interrogation ends, the points of the device's datasets it did not answer are named in the log, once for as long as they are the same: an address or a type that is not the station's shows there.

Acknowledgement

An I frame is acknowledged only after its records were written. What the station takes for delivered was written, and a device that falls behind slows the station down through TCP and the window rather than dropping what it sends.

note

Events are delivered at least once. An ASDU an event record of which could not be written is never acknowledged: the device acknowledges the frames before it, closes the connection, and connects again, so that the station, which deletes only what was acknowledged, sends it again. A point record that could not be written is lost alone: the point's value is held, and the next record writes it.

Redundancy Group

address may name several addresses: the connections of one redundancy group, in the order they are tried. The device holds one connection. It connects to the first address; when a connection cannot be made, or ends, it tries the next at once, and after the last the first again. It does not go back to the first address of itself while the one it is connected to serves.

What the device held of the station's points belongs to the connection: a new connection starts with none and is given them by the interrogation it starts with, so no record holds a value older than its connection. The device's state and its log say which address it is at (192.0.2.71:2404 (address 2 of 2)), and server.address on every record names the address it came through.

Reconnecting

A connection that cannot be made, or that ends, is made again for as long as the device runs. After every address has failed in a row, the device waits one second, then twice the last wait, up to max_reconnect_interval. A connection that stood, its data transfer started and lasting t1, starts the wait at one second again. So a station that takes a connection and closes it at once, as one does that has no connection set up for Director, is tried no faster than one that takes none.

A stop acknowledges what came, sends STOPDT act, takes what the station still sends for up to two seconds, and closes the connection. Any change to the device or to its datasets restarts it this way, and the restarted device never writes beside its predecessor.

Datasets

The device's definitions are its datasets. In the console they are the datasets and profiles assigned to the device in its Data collection; see Datasets and Profiles. In a configuration file each dataset is a definition named by its type:

Dataset	Definition	Definition ID	Kind	One record per
`point`	`iec104_point_collector`	`35150`	metric	interval of the dataset's table
`event`	`iec104_event_collector`	`70`	log	information object the station sends

Any number of datasets of either type.
Nothing assigned is allowed. The device then only tests the connection, and never starts the data transfer: a station that is asked for nothing sends nothing, and keeps its events for its next reader. Every minute it connects, sends TESTFR act, and closes the connection when the station confirms. It is Connected when one of its addresses answers.
A dataset that cannot be read is left out, with a warning in the device's log that names it and says why: a table with no name, a point with no type, or an address declared twice. The rest of the device runs. With every dataset left out, the device stops with Configuration error.

Points

An iec104_point_collector dataset is a table of the points of the operator's signal list. It keeps the latest value the station sent of each of its points on the connection, from the answers to an interrogation and from what the station sends of itself. It writes one record when the connection's first interrogation has ended, then one every interval. A station whose interrogation never ends is written on the interval all the same. Nothing is written while the device is not connected, and a record none of whose points has a value is not written.

Field	Required	Default	Description
`table`	Y	-	The name the dataset's values sit under in a record: letters, digits, and underscores, at most 64, not starting with a digit. `table`, `common_address`, and `quality` are reserved.
`interval`	N	`60`	Seconds between two records, `1` or more
`labels`	N	-	An object of names and values written on every record as ECS `labels`. At most 32; a name is letters, digits, underscores, and hyphens, and a value at most 256 characters.
`pipeline_name`	N	the device's	The pre-processing pipeline the dataset's records enter

A dataset's inputs are its points, at most 4096, each a row of the signal list:

Field	Required	Default	Description
`name`	N	`ioa_<address>`	The field the value is written to: letters, digits, and underscores, at most 64, not starting with a digit, once in the table
`address`	Y	-	The information object address: `0` to `16777215`, `0` to `65535` with an `ioa_size` of `2`, or `0` to `255` with `1`. Once in the table.
`type`	Y	-	What the object is (see Types)
`scale`	N	`1`	A number the value is multiplied by. For a measured value or an integrated total only.
`offset`	N	`0`	A number added to the product. For a measured value or an integrated total only.

A measured value or an integrated total whose row names a scale other than 1, or an offset, is written as value × scale + offset, rounded to fifteen significant digits, so that 900 tenths are 90 and not 90.00000000000001. On any other type, a scale other than 1 or an offset is refused.

Types

A point's type is what the information object is, whatever time tag it comes with:

Type	Also read as	The standard's types	Written as
`single`	`single_point`, `sp`	`M_SP_NA_1` (1), `M_SP_TA_1` (2), `M_SP_TB_1` (30)	`true` or `false`
`double`	`double_point`, `dp`	`M_DP_NA_1` (3), `M_DP_TA_1` (4), `M_DP_TB_1` (31)	`intermediate`, `off`, `on`, or `indeterminate`
`step`	`step_position`, `st`	`M_ST_NA_1` (5), `M_ST_TA_1` (6), `M_ST_TB_1` (32)	A whole number, `-64` to `63`
`bitstring`	`bitstring32`, `bo`	`M_BO_NA_1` (7), `M_BO_TA_1` (8), `M_BO_TB_1` (33)	A whole number, `0` to `4294967295`
`normalized`	`normalised`, `measured_normalized`, `nva`	`M_ME_NA_1` (9), `M_ME_TA_1` (10), `M_ME_ND_1` (21), `M_ME_TD_1` (34)	A number, `-1` to just under `1`
`scaled`	`measured_scaled`, `sva`	`M_ME_NB_1` (11), `M_ME_TB_1` (12), `M_ME_TE_1` (35)	A whole number, `-32768` to `32767`
`float`	`short_float`, `measured_float`	`M_ME_NC_1` (13), `M_ME_TC_1` (14), `M_ME_TF_1` (36)	A number
`counter`	`integrated_total`, `integrated_totals`, `it`	`M_IT_NA_1` (15), `M_IT_TA_1` (16), `M_IT_TB_1` (37)	A whole number

A type is read in any case, with hyphens or spaces for underscores, and may be the standard's name or number of any type of the kind (M_ME_NC_1, 13), as an engineering tool exports it. A type that is no point's, such as a command or an end of initialization, is refused.

A value that comes as another kind than its row declares is not written, and what was held of the point is dropped. An ASDU of another common address than the device reads, or one marked as a test, is no point's. Both are said in the log, once while they are the same.

Events

An iec104_event_collector dataset writes every information object the station sends, a record each, as it came. It takes labels and pipeline_name, and nothing else: it has no interval and no inputs.

It writes what a point dataset does not ask for as well: the points no table declares, the station's confirmations and terminations of the device's interrogations, its end of initialization, and the ASDUs of other common addresses and those marked as tests.

A type the device does not decode is written raw, never guessed. The device decodes the types 1 to 16, 21, and 30 to 37, the end of initialization (70), and the two interrogations as the station mirrors them (100, 101). Any other type is written as one record of the ASDU as it came, its information in hexadecimal, named as the standard names it (TYPE_<n> otherwise); nothing in it is taken for an address or a value. The log says so when the first of a type comes, and then every half an hour with how many came since.

Records

Every record is one ECS 8.11 document with the following fields:

Field	Value
`@timestamp`	When the point record was written; for an event, see Time
`ecs.version`	`8.11.0`
`event.module`	`iec104`
`observer.name`	The device's name in the console
`observer.hostname`	The Director's host name
`observer.vendor`, `observer.product`	`VirtualMetric`, `IEC 60870-5-104`
`server.address`, `server.port`	The address the connection was made to, and its port
`server.ip`	The address, when it is an IP address
`network.protocol`, `network.transport`	`iec104`, `tcp`
`labels.<name>`	The dataset's labels, when it has any

Point Records

event.dataset is iec104.point, event.kind metric, event.category host, and event.type info.

Field	Value
`iec104.point.table`	The dataset's table
`iec104.point.common_address`	The station's common address
`iec104.point.<table>.<name>`	The latest value of each point that has one, as Types writes it
`iec104.point.quality.<name>`	The quality flags set on a point's value, and a value left out (see Quality)

{
  "@timestamp": "2026-10-14T12:00:00Z",
  "ecs": { "version": "8.11.0" },
  "event": { "module": "iec104", "dataset": "iec104.point", "kind": "metric", "category": ["host"], "type": ["info"] },
  "observer": { "vendor": "VirtualMetric", "product": "IEC 60870-5-104", "name": "substation-north-rtu", "hostname": "director01" },
  "server": { "address": "192.0.2.70", "ip": "192.0.2.70", "port": 2404 },
  "network": { "protocol": "iec104", "transport": "tcp" },
  "labels": { "substation": "north" },
  "iec104": {
    "point": {
      "table": "feeder_1",
      "common_address": 1,
      "feeder_1": { "breaker_q0": "on", "earthing_switch": false, "tap_position": 3, "voltage_l1": 20.5, "current_l1": 37.5 },
      "quality": { "voltage_l1": ["not_topical"], "oil_temperature": ["invalid"] }
    }
  }
}

The oil temperature, which the station marks invalid, is under quality and not among the values. The values sit under the table's name, so two tables can name a field alike with different types without one mapping conflicting with the other.

Event Records

event.dataset is iec104.event, event.kind event, event.category network, event.type info, event.action the cause of transmission, and event.created always when the object arrived. message summarizes the object, such as M_DP_TB_1 spontaneous 1/1001: off.

Field	Value
`iec104.event.type`, `iec104.event.type_id`	The ASDU's type, by the standard's name and its number
`iec104.event.cause`, `iec104.event.cause_id`	The cause of transmission (`spontaneous`, `interrogated_by_station`, `periodic`, `background`, `activation_confirmation`, and so on; `cause_<n>` for one the standard does not define)
`iec104.event.negative`, `iec104.event.test`	The P/N and T bits, where set
`iec104.event.common_address`, `iec104.event.originator`	The common address, and the originator address with a `cot_size` of `2`
`iec104.event.address`, `iec104.event.kind`	The information object address, and what the object is
`iec104.event.value`	Always a number, so the field keeps one type: a single point `0` or `1`, a double point `0` to `3`, a normalized value its fraction. Absent for a short floating point number that is no number.
`iec104.event.state`	A point's state in words; why a station started; or `not_a_number`, `infinite`, or `negative_infinite`
`iec104.event.transient`	A step position in a transient state
`iec104.event.bits`	A bitstring, in hexadecimal
`iec104.event.raw`	A normalized value's sixteen bits
`iec104.event.counter_sequence`	The sequence number of an integrated total's reading
`iec104.event.parameters_changed`	An end of initialization after a change of the station's parameters
`iec104.event.quality`	The quality flags that are set
`iec104.event.time`, `iec104.event.time_in_hour`, `iec104.event.time_invalid`, `iec104.event.time_substituted`, `iec104.event.summer_time`	The time tag (see Time)
`iec104.event.count`, `iec104.event.sequence`, `iec104.event.data`	For a type the device does not decode: the objects the ASDU says it has, its SQ bit, and its information in hexadecimal

{
  "@timestamp": "2026-10-14T11:59:58.75Z",
  "ecs": { "version": "8.11.0" },
  "event": {
    "module": "iec104", "dataset": "iec104.event", "kind": "event", "category": ["network"], "type": ["info"],
    "action": "spontaneous", "created": "2026-10-14T12:00:01Z"
  },
  "observer": { "vendor": "VirtualMetric", "product": "IEC 60870-5-104", "name": "substation-north-rtu", "hostname": "director01" },
  "server": { "address": "192.0.2.70", "ip": "192.0.2.70", "port": 2404 },
  "network": { "protocol": "iec104", "transport": "tcp" },
  "labels": { "substation": "north" },
  "message": "M_DP_TB_1 spontaneous 1/1001: off",
  "iec104": {
    "event": {
      "type": "M_DP_TB_1", "type_id": 31,
      "cause": "spontaneous", "cause_id": 3,
      "common_address": 1, "originator": 0,
      "address": 1001, "kind": "double",
      "value": 1, "state": "off",
      "time": "2026-10-14T11:59:58.75Z"
    }
  }
}

Quality

Flag	The standard's	Of
`invalid`	IV	Every type but the normalized value without quality (21)
`not_topical`	NT	Points, step positions, bitstrings, and measured values
`substituted`	SB	The same
`blocked`	BL	The same
`overflow`	OV	Step positions, bitstrings, and measured values
`carry`	CY	Integrated totals
`adjusted`	CA	Integrated totals

A value the station marks invalid is not written as a value. On a point record it is named under iec104.point.quality, and said once in the log for as long as it lasts: an invalid value never reads as a good one. The other flags are listed with the value kept. A short floating point number that is no number (not a number, an infinity) is left out and said the same way.

Time

A seven-octet time tag (CP56Time2a) names an instant on the station's clock, read in the device's timezone. Its summer time bit tells apart the two passes of the hour a zone repeats in autumn.

With timestamp_source: data, an event record is dated by its object's tag when the tag is a time, is not marked invalid, and is no more than five minutes ahead of Director's clock nor more than 366 days behind it, so an event a station held back for hours is dated when it happened. Otherwise the record is dated when the object arrived: a tag marked invalid, a clock that runs ahead (which is said once, with by how much), a clock that was never set, or an object with no tag. The tag is in the record either way, in iec104.event.time.

A three-octet time tag (CP24Time2a) names a minute and the milliseconds past it, and no hour. It is written as far as it goes, in iec104.event.time_in_hour (MM:SS.mmm), and dates nothing: completing it with the hour of arrival would be a guess.

A point record is dated when it is written.

Device State

The connection state follows the station. A failure is logged once for as long as it lasts, and again after half an hour, with what to check.

Connected when the station confirmed the start of the data transfer (receives from 192.0.2.70:2404 (common address 1), with , over TLS where it is), and after a failure, once the new connection has stood t1. A device with no dataset is Connected when an address of the station answered a test frame.
Connection error while the connection cannot be made or was lost: the address does not answer within t0, nothing listens there, the station closed the connection, did not answer within t1, sent a frame out of sequence or what is no frame, or the TLS handshake failed for another reason than a certificate. A station that closes the connection as it is made usually has no connection set up for Director's address; before the data transfer starts, a station that secures its connections closes one that is not secured, too. No answer within t1, or a frame out of sequence, usually means k, w, and the timers are not the station's.
Certificate error while the station's certificate does not verify (no CA of the device's signed it, it is of another name, it has expired or is not valid yet, which is said with its dates), or the station does not take the device's.
Configuration error for a configuration that is refused or every dataset left out, a station that refuses the interrogation, a station nothing of which can be read with the device's sizes (which then names them), or a far end that is another controlling station.
Error while the device closes its connection over an event record it could not write, so its ASDU was not acknowledged. It connects again after the wait of Reconnecting, and closes again until the record can be written; the station keeps its events meanwhile. Why the record could not be written is in the line before: Director's queue, or the dataset's pre-processing pipeline. A pipeline that fails on one record holds the station's events back until it is fixed.

note

The IEC 104 device is not simulated. A point dataset's records are the values of your own signal list, a shape a generated sample cannot stand in for.

Not Supported

Anything in control direction but the two interrogations: commands, set points, clock synchronization, reset process, read, test commands, parameters, and file transfer. By design.
Group interrogations (the qualifiers 21 to 36) and counter requests of one group. The device asks for the whole station.
Several common addresses on one connection. A gateway that fronts several stations is read by a device for each, each on a connection of its own. An event dataset writes the ASDUs of the other common addresses it sees.
The standard's redundancy with standby connections, several connections held open and tested, of which one is started. The device holds one connection and moves to the next address when it is lost (see Redundancy Group).
The events of protection equipment (17 to 20, 38 to 40) and the other types the device does not decode: an event dataset writes them as they came.
IEC 62351-5, authentication in the application layer. TLS (IEC 62351-3) secures the connection.
IEC 60870-5-101 over a serial line. A 101 station is read through a gateway that speaks 104.

Verification

The device's IEC 104 stack is its own. Its decoders were fuzz-tested, and the device was tested against a controlled station written for the tests over loopback TCP, real TLS handshakes with a client certificate included. No utility's RTU, relay, gateway, or third-party simulator was read. A station's own habits, such as what it does with frames that were not acknowledged when a connection is made again, or which types it sends, are handled as the standard describes them, not as any product was seen to behave. No measurement was made of how many information objects a second the device writes.

Examples

Substation RTU

Reading a substation's RTU at common address 1: a feeder's points every 60 seconds, a busbar's every 10, and every information object the RTU sends...

- id: 535100001
  name: substation-north-rtu
  description: RTU of the north substation
  type: iec104
  status: true
  properties:
    address: "192.0.2.70"
    common_address: 1
    interrogation_interval: 900
  definitions:
    - name: iec104_point_collector
      status: true
      properties:
        table: feeder_1
        interval: 60
        labels:
          substation: north
          voltage_level: 20kV
      inputs:
        - name: breaker_q0
          properties: { address: 1001, type: double }
        - name: earthing_switch
          properties: { address: 1002, type: single }
        - name: tap_position
          properties: { address: 2001, type: step }
        - name: voltage_l1
          properties: { address: 3001, type: float }
        - name: current_l1
          properties: { address: 3002, type: normalized, scale: 150 }
        - name: oil_temperature
          properties: { address: 3003, type: scaled, scale: 0.1, offset: -40 }
        - name: active_energy
          properties: { address: 4001, type: counter, scale: 0.001 }
    - name: iec104_point_collector
      status: true
      properties:
        table: busbar
        interval: 10
      inputs:
        - name: voltage
          properties: { address: 3101, type: M_ME_NC_1 }
        - name: frequency
          properties: { address: 3102, type: M_ME_TF_1 }
    - name: iec104_event_collector
      status: true
      properties:
        labels:
          substation: north

Redundancy Group over TLS

Reading a wind park's plant controller at the two gateways of its redundancy group, over TLS with a client certificate, and asking for its integrated totals every 15 minutes...

- id: 535100002
  name: wind-park-controller
  description: Plant controller of the wind park, at its two gateways
  type: iec104
  status: true
  properties:
    address:
      - iec104-a.windpark.example.com
      - iec104-b.windpark.example.com:19999
    port: 19998
    common_address: 47
    originator_address: 12
    interrogation_interval: 300
    counter_interrogation_interval: 900
    timezone: Europe/Istanbul
    tls:
      status: true
      ca_name: grid-operator-ca.pem
      cert_name: director-iec104.pem
      key_name: director-iec104.key
      min_tls_version: tls1.2
  definitions:
    - name: iec104_point_collector
      status: true
      properties:
        table: plant
        interval: 15
      inputs:
        - name: active_power
          properties: { address: 100, type: float }
        - name: reactive_power
          properties: { address: 101, type: float }
        - name: grid_breaker
          properties: { address: 200, type: double }
        - name: exported_energy
          properties: { address: 300, type: counter }
    - name: iec104_event_collector
      status: true

Station Behind a Gateway

Reading a gas pressure regulating station of an IEC 101 heritage behind a gateway: no originator address, a common address of one octet, and information object addresses of two. Its clock is not trusted, so events are dated when they arrive...

- id: 535100003
  name: gas-station-rtu
  description: RTU of a gas pressure regulating station
  type: iec104
  status: true
  properties:
    address: "192.0.2.72, 192.0.2.73"
    common_address: 3
    cot_size: 1
    common_address_size: 1
    ioa_size: 2
    timezone: "+01:00"
    timestamp_source: collection
  definitions:
    - name: iec104_point_collector
      status: true
      properties:
        table: regulator
      inputs:
        - name: inlet_pressure
          properties: { address: 101, type: scaled, scale: 0.01 }
        - name: outlet_pressure
          properties: { address: 102, type: scaled, scale: 0.01 }
        - name: door_contact
          properties: { address: 201, type: single }
    - name: iec104_event_collector
      status: true

Synopsis​

Schema​

Configuration​

Device​

Connection​

Protocol​

TLS​

Connection​

Starting​

What It Sends​

Interrogation​

Acknowledgement​

Redundancy Group​

Reconnecting​

Datasets​

Points​

Types​

Events​

Records​

Point Records​

Event Records​

Quality​

Time​

Device State​

Not Supported​

Verification​

Examples​

Substation RTU​

Redundancy Group over TLS​

Station Behind a Gateway​

Synopsis

Schema

Configuration

Device

Connection

Protocol

TLS

Connection

Starting

What It Sends

Interrogation

Acknowledgement

Redundancy Group

Reconnecting

Datasets

Points

Types

Events

Records

Point Records

Event Records

Quality

Time

Device State

Not Supported

Verification

Examples

Substation RTU

Redundancy Group over TLS

Station Behind a Gateway