Configuring IEC 60870-5-104 on Siemens S7-1200 and S7-1500 PLCs

Configuring IEC 60870-5-104 on Siemens S7-1200 and S7-1500 PLCs

IEC 60870-5-104 and IEC 61850 dominate substation telemetry and protection communication in transmission and distribution networks. Embedding these protocols on the SIMATIC S7-1200 and S7-1500 platforms enables a single controller to serve both process automation and supervisory SCADA gateways. This technical reference consolidates protocol fundamentals, data-point mapping, Siemens library options, commissioning parameters, and verification procedures for engineers deploying these stacks in substations, hydro plants, and rail electrification projects.

Overview

IEC 60870-5-104 is the network-access variant of the IEC 60870-5 series. It runs over TCP/IP on the standardized port 2404, transporting Application Service Data Units (ASDUs) from the IEC 60870-5-101 companion standard across a 104 transport interface. IEC 61850, published by the IEC TC57 committee as the Communication Networks and Systems for Power Utility Automation standard, uses an object-oriented information model (LD / LN / DO / DA) with Manufacturing Message Specification (MMS) and optional GOOSE/Sampled Values over Ethernet. A SIMATIC controller can act as a 104 slave (controlled station), a 61850 server (substation IED), a 104 master, or a 61850 client—and S7-1500 CPUs are often configured as a bridge between IEDs and the control center.

IEC 60870-5-104 Protocol Architecture

The 104 protocol layers an Application Function Call on top of a strict supervisory session state machine. Three frame categories share one TCP socket:

• I-frames (Information): carry ASDUs and increment the send / receive sequence numbers N(S) / N(R). Identified by the lowest two bits of byte 3 being 00b.
• S-frames (Supervisory): acknowledge received I-frames without payload (N(R) only). Identified by 01b.
• U-frames (Unnumbered): session control with function codes STARTDT, STOPDT, and TESTFR. Identified by 11b.

The APDU is prefixed by a single 0x68 start byte, followed by two APDU-length octets (length field is the number of body bytes and excludes the start byte and length octets). The TCP connection is normally established by the controlling station; the controlled station supports both passive and, when configured, active roles.

Session control state machine

The session moves through three states: STOPPED, STARTED, plus an idle handling layer based on the t0..t3 timers. STANDARD parameter roles:

• t0 — Connection establishment timeout; configurable from 1 to 30 s depending on link reliability expectations.
• t1 — Acknowledgment timeout for an outstanding I-frame; typically 15 s. Expiry forces the controlling station to drop the connection.
• t2 — Maximum interval the controlled station waits before sending an S-frame when only k−1 I-frames have been received and an explicit acknowledgment is needed; typically 10 s.
• t3 — Idle test-frame interval for keepalive; typically 20 s. U-TESTFR frames are exchanged past t3 to confirm link health.

The parameter k defines the maximum number of unacknowledged I-frames before the peer must stop transmitting. Common field practice uses k = 6 or k = 12. The receive window value w is the latest N(R) acknowledged. Roll-over of sequence numbers is undefined in 104 — long sessions must be torn down before the 8-bit wrap to avoid ambiguity.

ASDU structure

Every ASDU carries an Information Object Address (IOA, 3 bytes), a Common Address (CA, 2 bytes), an Originator Address (OA, 1 byte), a Cause of Transmission (COT, 2 bytes), a Variable Structure Qualifier (VSQ, 1 byte), the Type ID (1 byte), and a number of information elements whose encoding depends on the type:

• Type ID: defines information object layout (process value structure).
• VSQ: SQ bit plus the number of objects (or number of elements when SQ=1).
• COT: 2 bytes; lower 6 bits encode T (test, spontaneous, requested, etc.); bit 8 is the positive / negative flag, bit 9 is the test flag.
• OA: 0 from master or per controlling station; some stations require this to be the originator's CA.
• CA: station address; 1–65534 valid for 104.
• IOA: 3-byte point address; range 1–16777215.
• Information elements: process value(s) plus an optional CP56 time tag (7 bytes).

IEC 61850 Protocol Architecture

IEC 61850 divides the substation information model into Logical Devices (LD) composed of Logical Nodes (LN). Each LN groups Data Objects (DO) which are aggregates of typed Data Attributes (DA). The named-physical object is the IED; communication profiles include:

• MMS (ISO 9506): client-server access for reports, control, configuration over TCP / 102.
• GOOSE: Layer-2 multicast (IEEE 802.1Q, ethertype 0x88B8) for fast horizontal peer-to-peer messaging; usable in 4 ms-class latency scenarios.
• Sampled Values (SV): Layer-2 multicast (ethertype 0x88BA) streaming of analog streams from merging units.
• Web services (later editions): HTTP/SOAP for file transfer and engineering.

Configuration uses Substation Configuration Language (SCL), an XML schema. Four file classes describe the IED and substation:

• ICD — IED Capability Description; vendor supplies, lists all LNs and DOs.
• CID — Configured IED Description; project-specific instance with one or more datasets bound.
• SCD — Substation Configuration Description; full substation including GOOSE / SV routing.
• IID — Instantiated IED Description; tooled integration output.

SIMATIC S7-1200 / S7-1500 Platform Considerations

The decision to run a 104 or 61850 stack on a SIMATIC PLC is dominated by firmware support, work memory, and CPU cycle budget. The integration approach differs from adding a third-party gateway in that it eliminates an extra device, an extra IP hop, and an extra failure domain. Always reconcile the TIA Portal version, the CPU firmware, and the optional package (HSP) version before download — mismatch is a frequent source of "no symbol" errors on integration.

CPU and memory

Consult the official SIMATIC S7-1500 system manual on Siemens Industry Online Support for firmware revision specifics; the SIMATIC S7-1200 system manual is also available on Siemens Industry Online Support.

Programming environment

The SIMATIC world uses TIA Portal as the programming environment. Typical integration version pairs (CPU firmware ↔ TIA Portal HSP) at time of writing are:

• CPU firmware V2.6 or higher for TIA Portal V15.1+ HSPs.
• CPU firmware V2.8+ for IEC 61850 ICD import via TIA Portal V16 / V17.
• CPU firmware V2.9+ for full TIA Portal V18 HSP coverage of IEC 61850.
• CPU firmware V3.0+ for TIA Portal V19 features including SCL export of datasets.

Official Siemens Library and Option Packages

Siemens provides maintained, supported IEC libraries for the SIMATIC platform. These are licensed options that require a runtime license key delivered through the TIA Portal License Manager or via the web license key delivery service.

Each option includes Function Blocks (FBs) for connection management, station control, data-point read/write, time synchronisation, and command handling. Documentation is delivered with the option package and registered in the TIA Portal help under "Optional Packages" after installation.

ASDU Data Point Types

Whether using a vendor library, the Siemens option packages, or a custom PLC implementation, the practical unit of work is the Information Object — a data point carrying a single measured or commanded process value. The ASDU Type ID determines the encoding structure and the size of the information element.

CP56 time encodes time as a 7-byte block: milliseconds (2 bytes), minutes (1 byte), hours (1 byte), day + month bit-packed in 1 byte, and year offset from 1900 in 1 byte. Receiving decoders must treat CP56 time as a binary structure rather than a numeric value and must derive the absolute year from the offset + 1900 with care for two-digit rollover conventions used by some SCADA masters (treat years >75 as 19xx; ≤ 75 as 20xx, or follow the SCADA's convention).

Configuration Parameters and Timing

The IEC 60870-5-104 standard lists a set of "system parameters" that must be agreed between controlling and controlled stations. The following table summarises the most frequently configured parameters with typical deployment ranges:

For IEC 61850, equivalent configuration lives in the SCL files: Datasets bind DOs into named groups, Report Control Blocks (BRCB / URCB) define which datasets to report, and the integrity period (IntegrityTm) plus buffering (Buffered) drive data-flow behaviour. GOOSE control blocks in the GSEControl element of the SCL dictate multicast transmission parameters and VLAN priority.

Example TIA Portal data block for a 104 IOA

// S7-1500 Data Block excerpt for IEC 60870-5-104 IOA 1001 (single-point, no time)
DATA_BLOCK "DB_IEC104_Data"
  STRUCT
    stIOA1001_Sp : STRUCT
       bVal          : BOOL;   // 0 = OFF, 1 = ON
       bQualInvalid  : BOOL;   // quality flags
       bQualitySubst : BOOL;
       bQualityTest  : BOOL;
       bBlocked      : BOOL;
       bTopical      : BOOL;
    END_STRUCT;
  END_STRUCT;
END_DATA_BLOCK

Implementation Architecture

The SIMATIC PLC implementing a 104 / 61850 stack typically follows one of three architectural patterns:

Pattern A — Direct stack on the SIMATIC CPU

The IEC stack runs as Function Blocks inside a cyclic OB (typically OB1) with a connection interrupt for the TCP socket. This is recommended for small substations using S7-1500 with the SIPLUS RIC library, the Siemens IEC 61850 Option, or maintained third-party IEC libraries. Watch OB1 cycle time and increase the OB priority appropriately to keep frame delivery jitter under t2. A typical block-cycle slice under 50 ms is acceptable for substation use; harsher cycle budgets call for time-triggered OBs.

Pattern B — CP boundary with protocol conversion

A SIMATIC CP (e.g., CP 1543-1 for S7-1500) terminates WAN protocols while the CPU handles automation. The IEC stack can still run on the CPU; the CP is reserved for firewalling, VPN, and redundant WAN failover. CP 1543-1 plus CP 1243-1 (S7-1200) both support VPN IPsec and firewall functions; pair the protocol timeouts with the VPN MTU and any Maximum Transfer Unit reduction due to encapsulation.

Pattern C — Bridging IEC 61850 ⇄ IEC 60870-5-104

The SIMATIC controller is configured as an IEC 61850 client reporting from downstream IEDs, then exposes the relevant data as an IEC 60870-5-104 server to a higher-level SCADA. Demand careful dataset design: only publish DOs that the SCADA actually requests as 104 points, because every dataset member is sent with each report. Implement a watchdog signal in the IOA point list to propagate the 61850 link health (t1 timeouts, dataset quality flags) back to the master.

Network and Topology Recommendations

Both IEC 60870-5-104 and IEC 61850 are sensitive to frame jitter and broadcast storms. Recommended deployment points:

• Place the SIMATIC CPU on a dedicated VLAN / subnet for power-utility traffic. Do not mix with generic office VLANs.
• Set the PROFINET port to a dedicated QoS class: DSCP 46 / EF for GOOSE; AF41 for 104 traffic is common.
• Enable NTP or PTP time sync. IEC 60870-5-104 supports the COT cause time synchronised, while IEC 61850 requires quality-flag q.validTimetoSync on timestamped reports.
• Lock the port speed and disable auto-negotiation per the IEC 61850-90-4 guidance on time-critical networks.
• Avoid unmanaged industrial switches in the GOOSE path. Layer-2 QoS and IGMP snooping must be configured explicitly.

Bandwidth and Load Estimation

A practical estimate of link load supports sizing of VPN tunnels, mobile radio paths, and buffering. For each ASDU the typical payload is:

For N points updated at F Hz the approximate uplink bit rate is:

bps ≈ N × F × (bytes_per_frame + 12 APDU + 20 IP) × 8

Example calculations:

• 100 SP points, 1 Hz, CP56 time: 100 × 1 × 32 × 8 = 25.6 kbps. Comfortably fits on any WAN link.
• 1 000 floating-point points (M_ME_TF_1), 10 Hz: 1 000 × 10 × 35 × 8 = 2.8 Mbps. Requires dedicated link or aggregated paths.

Always add 10 – 20 % headroom for TCP / ACKs and U-TESTFR keepalive frames, especially on long-latency links. On paths exceeding 500 ms, raise t1 above 30 s or buffer spontaneous events on the controlled station side.

Testing and Verification

The IEC 61850 community uses IEDScout and MMS Object Explorer (client tools) to drill into the data model. For 104, master simulators exercise the link layer in both directions. Common acceptance procedures for the SIMATIC integrator include:

1. Link-layer capture — capture the TCP / 2404 socket with Wireshark and verify the 0x68 start byte, length octets, and APDU direction sequence numbers.
2. Frame-by-frame decode — use a protocol analyser to verify Type ID, IOA, and quality flags.
3. General interrogation — issue C_IC_NA_1 with qualifier 20 (station interrogation, global) and confirm all configured data points are reported.
4. Clock synchronisation — broadcast C_CS_NA_1 (Type 103) and verify the PLC accepts the time within ±1 s.
5. Command flow — issue C_SC_NA_1 with Select-Before-Operate qualifier and confirm the two-step handshake per IEC 60870-5-104.
6. Stress test — drive spontaneous report rate to 50 Hz on the configured datums and confirm the k window is respected and the link does not exceed t1.

Limitations and Field Considerations

Recording constraints that should influence any integration decision:

• No offline buffer. Many compact 104 implementations drop packets on TCP disconnect. Confirm with the library documentation or test by severing the cable at intervals and counting missing spontaneous events.
• Memory ceiling on S7-1200. The data block that backs each information object occupies roughly 12–28 bytes depending on ASDU type and CP56-time inclusion. A 500-point float dataset with CP56 time consumes approximately 1.4 MB — feasible on a CPU 1215C and beyond, but borderline on a CPU 1214C.
• Single SPDU TX queue. Many small-footprint stacks use one TCP connection per station. To support multiple controlling stations you must plan for either multiple OB instances or a master-role stack.
• Time-tagging timing. CP56 time must be appended at the moment of transmission, not at the moment the sample was taken, to comply with sequence-of-events expectations.
• Lifecycle. Whether using a vendor-supported option or a custom library, prefer solutions with a documented maintenance path. Libraries without an active maintainer introduce risk on multi-year operational systems.
• TC + IP header overhead. Each APDU encapsulates inside Ethernet + IP + TCP at roughly 54 bytes of overhead, so consider the Egress bandwidth not just the payload size.

Sample Commissioning Checklist

1. Verify CPU firmware and TIA Portal version against the option package compatibility matrix on Siemens Industry Online Support.
2. Import the IEC 61850 SCD file or prepare the 104 point list. Build matching data blocks in TIA Portal.
3. Configure IP address, subnet mask, and VLAN if applicable.
4. Transfer and start the PLC program. Verify license-key status under PLC > Properties > Protection & Security.
5. From a test master, drive a General Interrogation and confirm all points return with correct COT and quality.
6. Issue a Select-Before-Operate pair from the master and confirm the PLC acknowledges both before executing.
7. Capture the TCP session with Wireshark; export the first 100 frames for the IEC acceptance log.
8. Document the parameter set (t0, t1, t2, t3, k, w, CA, OA) for the as-built substation record.
9. Set up a Watch-dog function block to alarm on k-window overruns or t1 timeouts.
10. Schedule a calendar reminder for library updates and firmware release reviews.

Comparison: Siemens Option vs. Custom or Third-Party Stack

Frequently Asked Questions