IEC 60870-5-104 telegram structure

APCI = Application Protocol Control Information

ASDU = Application Service Data Unit

APDU = Application Protocol Data Unit

Telegram format with variable length

This frame type is used to transmit user data between controlling and controlled station

byte\bit

7

6

5

4

3

2

1

0

 

 

 

 

0

Start byte (0x68)

 

APCI

 

APDU

1

Length of the APDU (max. 253)

 

2

Control field 1

 

3

Control field 2

 

4

Control field 3

 

5

Control field 4

 

6

Type identification

 

ASDU

 

7

SQ

Number of objects

 

8

T

P/N

Cause of transmission (COT)

 

9

Originator address (ORG)

 

10

ASDU address fields

 

11

(2 octets)

 

12

Information object address fields (IOA)

 

13

(3 octets)

 

14

 

 

15

Object information

 

...

 

 

...

 

 

...

 

 

n-1

 

 

n

 

 

 

Telegram format with fixed length

byte\bit

7

6

5

4

3

2

1

0

 

 

0

Start byte (0x68)

 

APCI

1

4 (Length of the APDU)

 

2

Control field 1

 

3

Control field 2

 

4

Control field 3

 

5

Control field 4

 

 

Control field formats

Two types of control field formats: I-Format, S-Format are used to perform numbered information transfer.

The third: U-Format control field is used to perform unnumbered link layer control functions.

I-Format

byte\bit

7

6

5

4

3

2

1

0

0

Send sequence number N(S) LSB

0

1

Send sequence number N(S) MSB

2

Receive sequence number N(R) LSB

0

3

Receive sequence number N(R) MSB

S-Format

byte\bit

7

6

5

4

3

2

1

0

0

0

0

1

1

0

2

Receive sequence number N(R) LSB

0

3

Receive sequence number N(R) MSB

U-Format

byte\bit

7

6

5

4

3

2

1

0

0

TESTFR

STOPDT

STARTDT

1

1

1

0

2

0

3

0

Simple samples and explanations

104 substation configuration: COT = 2 octets (includes originator address), ASDU address = 2 octets, IOA address = 3 octets

Sample 1

68 0E 4E 14 7C 00 65 01 0A 00 0C 00 00 00 00 05

LPDU bytes

Explanation

68

Start byte

0E

Length of the APDU = 14

4E

Send sequence number N(S) LSB, bit 0 = 0 => I-Format

14

Send sequence number N(S) MSB

7C

Receive sequence number N(R) LSB

00

Receive sequence number N(R) MSB

65

Type identification: C_CI_NA_1 (counter interrogation command)

01

Number of objects = 1

0A

Cause of transmission = 10 (activation termination)

00

Originator address = 0

0C 00

Common ASDU address (2 octets) = 12 dec.

00 00 00

Object address (3 octets)

05

Counter interrogation request qualifier = 5 (general counter interrogation)

Sample 2

68 34 5A 14 7C 00 0B 07 03 00 0C 00 10 30 00 BE 09 00 11 30 00 90 09 00 0E 30 00 75 00 00 28 30 00 25 09 00 29 30 00 75 00 00 0F 30 00 0F 0A 00 2E 30 00 AE 05 00

LPDU bytes

Explanation

68

Start byte

34

Length of the APDU = 52

5A

Send sequence number N(S) LSB, bit 0 = 0 => I-Format

14

Send sequence number N(S) MSB

7C

Receive sequence number N(R) LSB

00

Receive sequence number N(R) MSB

0B

Type identification: M_ME_NB_1(measured value, scaled value)

07

Number of objects = 7

03

Cause of transmission = 3 (spontanous)

00

Originator address = 0

0C 00

Common ASDU address (2 octets) = 12 dec.

10 30 00

Object address (3 octets) of first information object

BE 09 00

Scaled value + QDS (quality descriptor) of first information object

11 30 00

Object address (3 octets) of second information object

90 09 00

Scaled value + QDS (quality descriptor) of second information object

0E 30 00

Object address (3 octets) of third information object

75 00 00

Scaled value + QDS (quality descriptor) of third information object

28 30 00 25 09 00
29 30 00 75 00 00
0F 30 00 0F 0A 00
2E 30 00 AE 05 00

Object address + Scaled value + QDS (quality descriptor) of information object four to seven

Sample 3

68 04 01 00 7E 14

LPDU bytes

Explanation

68

Start byte

04

Length of the APDU = 4

01

bits 2..7 reserved, bit 0 = 1 and bit 1 = 0 => S-Format

00

reserved

7E

Receive sequence number N(R) LSB

14

Receive sequence number N(R) MSB