IEC 60870-5-104 telegram structure
APCI = Application Protocol Control Information
ASDU = Application Service Data Unit
APDU = Application Protocol Data Unit
Telegram format with variable length
This frame type is used to transmit user data between controlling and controlled station
byte\bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
|
|
|
|
---|---|---|---|---|---|---|---|---|---|---|---|---|
0 | Start byte (0x68) |
| APCI |
| APDU | |||||||
1 | Length of the APDU (max. 253) |
| ||||||||||
2 | Control field 1 |
| ||||||||||
3 | Control field 2 |
| ||||||||||
4 | Control field 3 |
| ||||||||||
5 | Control field 4 |
| ||||||||||
6 | Type identification |
| ASDU |
| ||||||||
7 | SQ | Number of objects |
| |||||||||
8 | T | P/N | Cause of transmission (COT) |
| ||||||||
9 | Originator address (ORG) |
| ||||||||||
10 | ASDU address fields |
| ||||||||||
11 | (2 octets) |
| ||||||||||
12 | Information object address fields (IOA) |
| ||||||||||
13 | (3 octets) |
| ||||||||||
14 |
|
| ||||||||||
15 | Object information |
| ||||||||||
... |
|
| ||||||||||
... |
|
| ||||||||||
... |
|
| ||||||||||
n-1 |
|
| ||||||||||
n |
|
|
Telegram format with fixed length
byte\bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
|
|
---|---|---|---|---|---|---|---|---|---|---|
0 | Start byte (0x68) |
| APCI | |||||||
1 | 4 (Length of the APDU) |
| ||||||||
2 | Control field 1 |
| ||||||||
3 | Control field 2 |
| ||||||||
4 | Control field 3 |
| ||||||||
5 | Control field 4 |
|
Control field formats
Two types of control field formats: I-Format, S-Format are used to perform numbered information transfer.
The third: U-Format control field is used to perform unnumbered link layer control functions.
I-Format
byte\bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
---|---|---|---|---|---|---|---|---|
0 | Send sequence number N(S) LSB | 0 | ||||||
1 | Send sequence number N(S) MSB | |||||||
2 | Receive sequence number N(R) LSB | 0 | ||||||
3 | Receive sequence number N(R) MSB |
S-Format
byte\bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
---|---|---|---|---|---|---|---|---|
0 | 0 | 0 | 1 | |||||
1 | 0 | |||||||
2 | Receive sequence number N(R) LSB | 0 | ||||||
3 | Receive sequence number N(R) MSB |
U-Format
byte\bit | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
---|---|---|---|---|---|---|---|---|
0 | TESTFR | STOPDT | STARTDT | 1 | 1 | |||
1 | 0 | |||||||
2 | 0 | |||||||
3 | 0 |
Simple samples and explanations
104 substation configuration: COT = 2 octets (includes originator address), ASDU address = 2 octets, IOA address = 3 octets
Sample 1
68 0E 4E 14 7C 00 65 01 0A 00 0C 00 00 00 00 05
LPDU bytes | Explanation |
---|---|
68 | Start byte |
0E | Length of the APDU = 14 |
4E | Send sequence number N(S) LSB, bit 0 = 0 => I-Format |
14 | Send sequence number N(S) MSB |
7C | Receive sequence number N(R) LSB |
00 | Receive sequence number N(R) MSB |
65 | Type identification: C_CI_NA_1 (counter interrogation command) |
01 | Number of objects = 1 |
0A | Cause of transmission = 10 (activation termination) |
00 | Originator address = 0 |
0C 00 | Common ASDU address (2 octets) = 12 dec. |
00 00 00 | Object address (3 octets) |
05 | Counter interrogation request qualifier = 5 (general counter interrogation) |
Sample 2
68 34 5A 14 7C 00 0B 07 03 00 0C 00 10 30 00 BE 09 00 11 30 00 90 09 00 0E 30 00 75 00 00 28 30 00 25 09 00 29 30 00 75 00 00 0F 30 00 0F 0A 00 2E 30 00 AE 05 00
LPDU bytes | Explanation |
---|---|
68 | Start byte |
34 | Length of the APDU = 52 |
5A | Send sequence number N(S) LSB, bit 0 = 0 => I-Format |
14 | Send sequence number N(S) MSB |
7C | Receive sequence number N(R) LSB |
00 | Receive sequence number N(R) MSB |
0B | Type identification: M_ME_NB_1(measured value, scaled value) |
07 | Number of objects = 7 |
03 | Cause of transmission = 3 (spontanous) |
00 | Originator address = 0 |
0C 00 | Common ASDU address (2 octets) = 12 dec. |
10 30 00 | Object address (3 octets) of first information object |
BE 09 00 | Scaled value + QDS (quality descriptor) of first information object |
11 30 00 | Object address (3 octets) of second information object |
90 09 00 | Scaled value + QDS (quality descriptor) of second information object |
0E 30 00 | Object address (3 octets) of third information object |
75 00 00 | Scaled value + QDS (quality descriptor) of third information object |
28 30 00 25 09 00 | Object address + Scaled value + QDS (quality descriptor) of information object four to seven |
Sample 3
68 04 01 00 7E 14
LPDU bytes | Explanation |
---|---|
68 | Start byte |
04 | Length of the APDU = 4 |
01 | bits 2..7 reserved, bit 0 = 1 and bit 1 = 0 => S-Format |
00 | reserved |
7E | Receive sequence number N(R) LSB |
14 | Receive sequence number N(R) MSB |