104 SCADA Protocol Utility

IEC 60870-5-104 APDU Decoder

Decode IEC 60870-5-104 APDU hexadecimal frames into APCI format, send and receive sequence numbers, U-format commands and common ASDU fields including Type ID, Variable Structure Qualifier, Cause of Transmission, originator address, Common Address and Information Object Address.

✓ I-format ✓ S-format ✓ U-format ✓ ASDU ✓ Type ID ✓ COT

104

IEC 104 APDU Decode

● Ready

IEC 60870-5-104 APDU Hex Bytes Enter one complete APDU beginning with 68. Hex bytes may use spaces, commas, colons, hyphens, 0x prefixes or continuous hexadecimal data.

APDU length rule: byte 0 must be 0x68. Byte 1 gives the number of bytes following the length byte, so the complete APDU size must equal Length + 2. The four APCI control bytes always follow the length field.

IEC 60870-5-104 Decode Result Decoded

Decoded APDU —

APCI Format —

APDU Length —

Control Bytes —

Send Sequence N(S) —

Receive Sequence N(R) —

U Function —

ASDU Length —

Type ID —

VSQ —

Cause of Transmission —

Originator Address —

Common Address —

Object Count —

Sequence Flag —

First IOA —

Total Input Bytes —

ASDU Bytes

—

Information Object Data After First IOA

—

Byte-Level Decode Breakdown

—

What Is IEC 60870-5-104?

IEC 60870-5-104, commonly called IEC 104, is a telecontrol protocol used in SCADA, electrical power, utility and industrial communication systems. It carries IEC 60870-5 application information over TCP/IP while using an Application Protocol Control Information header to manage sequence numbers and connection-control functions.

An IEC 104 Application Protocol Data Unit, or APDU, consists of the APCI and, for I-format messages, normally an ASDU containing the application data.

IEC 104 APDU Structure

APDU:

68
Length
Control Byte 1
Control Byte 2
Control Byte 3
Control Byte 4

Optional ASDU...

The fixed APCI therefore occupies six bytes when the start and length bytes are included.

IEC 104 Start Byte 0x68

A normal IEC 60870-5-104 APDU begins with hexadecimal 0x68. The next byte specifies the APDU length after the length field.

68 04 07 00 00 00

68 = Start
04 = Four bytes follow

Total APDU bytes:
4 + 2
= 6

I, S and U Frame Formats

Format	Control Recognition	Main Purpose
I-format	Control byte 1 bit 0 = 0	Transfers ASDU data and sequence acknowledgements
S-format	Lowest two bits = 01	Supervisory acknowledgement without ASDU
U-format	Lowest two bits = 11	STARTDT, STOPDT and TESTFR control

IEC 104 I-Format Sequence Numbers

An I-format control field carries both a transmit sequence number N(S) and receive acknowledgement sequence number N(R). Each occupies 15 significant bits and is encoded after a one-bit left shift.

Control bytes:

02 00 0A 00

Send raw:
0x0002

N(S):
0x0002 >> 1
= 1


Receive raw:
0x000A

N(R):
0x000A >> 1
= 5

IEC 104 S-Format

An S-format APDU acknowledges received I-format messages without transmitting an ASDU. Its receive sequence number is encoded in control bytes three and four.

68 04 01 00 0A 00

Control:
01 00 0A 00

N(R):
0x000A >> 1
= 5

IEC 104 U-Format Commands

Control Byte	Function
0x07	STARTDT act
0x0B	STARTDT con
0x13	STOPDT act
0x23	STOPDT con
0x43	TESTFR act
0x83	TESTFR con

U-format messages do not contain normal send and receive sequence numbers. Their control bits instead carry the unnumbered connection-management command.

IEC 104 ASDU Header

For a typical IEC 104 I-frame, the ASDU starts immediately after the four APCI control bytes. The commonly used IEC 104 ASDU header contains six bytes before the first Information Object Address.

ASDU:

Byte 0      Type ID
Byte 1      VSQ
Byte 2      Cause of Transmission
Byte 3      Originator Address
Bytes 4–5  Common Address, little-endian

Then:
Information Objects...

Variable Structure Qualifier — VSQ

The Variable Structure Qualifier contains the number of information objects and a sequence flag.

VSQ bit 7:
SQ sequence flag

VSQ bits 0–6:
Number of information objects

When SQ is clear, information objects normally carry their own Information Object Addresses. When SQ is set, the first address establishes the starting point and subsequent information objects can follow sequential addresses according to the ASDU structure.

Cause of Transmission

The first Cause of Transmission byte contains a six-bit cause code plus the Positive/Negative and Test indicators. The second byte is the originator address.

Cause byte:

Bits 0–5:
Cause code

Bit 6:
P/N

Bit 7:
Test

Common IEC 104 Cause Codes

Cause	Meaning
1	Periodic / cyclic
2	Background scan
3	Spontaneous
4	Initialized
5	Request
6	Activation
7	Activation Confirmation
8	Deactivation
9	Deactivation Confirmation
10	Activation Termination
20	Interrogated by station interrogation
44	Unknown Type Identification
45	Unknown Cause of Transmission
46	Unknown Common Address
47	Unknown Information Object Address

Common IEC 60870 Type IDs

Type ID	Mnemonic	Description
1	M_SP_NA_1	Single-point information
3	M_DP_NA_1	Double-point information
5	M_ST_NA_1	Step position information
9	M_ME_NA_1	Normalized measured value
11	M_ME_NB_1	Scaled measured value
13	M_ME_NC_1	Short floating-point measured value
30	M_SP_TB_1	Single-point with CP56Time2a
31	M_DP_TB_1	Double-point with CP56Time2a
36	M_ME_TF_1	Short float with CP56Time2a
45	C_SC_NA_1	Single command
46	C_DC_NA_1	Double command
48	C_SE_NA_1	Set-point normalized command
49	C_SE_NB_1	Set-point scaled command
50	C_SE_NC_1	Set-point short floating-point command
100	C_IC_NA_1	Interrogation command
101	C_CI_NA_1	Counter interrogation command
103	C_CS_NA_1	Clock synchronization command

Common Address of ASDU

The Common Address identifies the station or logical data source associated with the ASDU. In the standard IEC 104 profile it occupies two bytes and is transmitted low byte first.

Common Address bytes:

34 12

Decoded:
0x1234
= 4660

Information Object Address

Information Object Addresses, often abbreviated IOA, identify individual points or information objects within the station. The common IEC 104 format uses a three-byte address transmitted least-significant byte first.

IOA bytes:

01 00 00

IOA =
0x000001
= 1

This decoder extracts the first IOA when enough bytes are present. The bytes following it are preserved as object data because their field width and meaning depend on the ASDU Type ID.

APCI vs ASDU

The APCI and ASDU serve different purposes. APCI controls framing, connection state and sequence acknowledgement. The ASDU contains the telecontrol application information.

APDU
│
├── APCI
│   ├── 68
│   ├── Length
│   └── Control field
│
└── ASDU
    ├── Type ID
    ├── VSQ
    ├── Cause
    ├── Common Address
    └── Information Objects

IEC 60870-5-104 APDU Decoder FAQs

What byte begins an IEC 104 APDU?

IEC 60870-5-104 APDUs use hexadecimal 0x68 as the start byte.

What does the IEC 104 length byte count?

It specifies the number of APDU bytes following the length field. Therefore the complete frame size is the length value plus two bytes.

How do I recognize an IEC 104 I-format frame?

The least-significant bit of the first control byte is zero.

What does an S-format frame do?

It provides supervisory acknowledgement using N(R) without carrying a normal ASDU.

What are IEC 104 U-format frames used for?

They carry connection-control functions including STARTDT, STOPDT and TESTFR.

How is N(S) calculated?

The first two I-format control bytes form a little-endian 16-bit value that is shifted right by one bit.

How is N(R) calculated?

Control bytes three and four form a little-endian value and are shifted right by one bit.

What does VSQ contain?

VSQ contains the number of information objects in bits 0–6 and the SQ sequence flag in bit 7.

How large is the IEC 104 Common Address?

In the normal IEC 104 profile it occupies two bytes.

How large is the Information Object Address?

IEC 104 normally uses a three-byte Information Object Address.

Can this decoder identify every object value automatically?

No. Object data structure depends on the Type ID. This tool decodes the common APCI and ASDU structure and preserves remaining bytes instead of guessing an incorrect value format.

Decode IEC 104 I, S and U Frames

Inspect IEC 60870-5-104 APDU length, control fields, sequence numbers, connection commands and common ASDU header values directly from hexadecimal SCADA traffic.