WinCC IEC 60870-5-104 Slave: Configuring Data Transmission to External Systems

Overview and Architecture

IEC 60870-5-104 (IEC 104) is the TCP/IP adaptation of IEC 60870-5-101, operating over port 2404 with a default APDU size of 253 bytes. In a WinCC-as-slave (controlled station / server) topology, WinCC acts as the IEC 104 server: it accepts inbound connections from an external master (control center, EMS, DMS, or another SCADA) and spontaneously transmits process data using Application Service Data Units (ASDUs) in Cause of Transmission (CoT) 03h (spontaneous) or 14h (interrogation response).

The native WinCC runtime does not include an IEC 104 server channel out of the box. You require the SIMATIC WinCC/TeleControl option package, which provides both master (client) and slave (server) driver modes. Licensing is split into two SKUs:

Prerequisites

• WinCC V7.4 SP1 or later (V7.5 SP2 recommended for IEC 104 stability fixes)
• WinCC/TeleControl option installed and licensed (engineering + runtime)
• Windows Server 2016/2019 or Windows 10 LTSC host; TCP port 2404 open in Windows Firewall
• Existing WinCC project with populated internal/external tags from SIMATIC PLCs
• External IEC 104 master IP address and Common Address of ASDU (CA) agreed with the third-party system
• Step 7 or TIA Portal project available if SIPLUS RTU functions (FB90/FC90) are involved in the PLC-side chain

Step-by-Step Configuration

1. Install WinCC/TeleControl Option

1. Run the WinCC setup media, select WinCC/TeleControl under optional components.
2. Apply the engineering license via Automation License Manager (ALM) before opening the project.
3. Confirm installation: in WinCC Configuration Studio, Tag Management tree should show a new channel group "SINAUT Spectrum" or "TeleControl" depending on version.

2. Create the IEC 104 Slave Channel

1. In WinCC Configuration Studio → Tag Management, right-click the channel tree → Add New Driver Connection.
2. Select driver: "IEC 60870-5-104 Server" (listed as TC IEC 60870-5-104 Slave in V7.4).
3. Set the connection properties:

   Parameter	Typical Value	Notes
   Local IP Address	0.0.0.0 or specific NIC IP	Bind to all interfaces or a specific Ethernet adapter
   TCP Port	2404	IANA-assigned IEC 104 port; change only if agreed with master
   Common Address of ASDU (CA)	1–65534	Must match master's configured CA; 2-octet mode is default
   k (max unacknowledged I-frames)	12	IEC 104 flow control window; increase to 32 for high-throughput
   w (ack threshold)	8	Send S-frame after w received I-frames; typically k×0.67
   t1 timeout (ms)	15000	Unacknowledged I/U-frame timeout; triggers connection reset
   t2 timeout (ms)	10000	Max delay before sending S-frame acknowledgment
   t3 timeout (ms)	20000	Test frame (TESTFR) keepalive interval

3. Define TeleControl Process Tags (IOA Mapping)

WinCC/TeleControl uses its own internal tag namespace under the IEC 104 connection. Each tag maps to an Information Object Address (IOA). You must create TeleControl tags and bind them to existing WinCC process tags.

1. Under the IEC 104 Slave connection, create a new tag group (e.g., "Monitored Data").
2. Add individual tags. Set parameters per tag:

   Field	Example	Description
   IOA (Information Object Address)	100	3-octet address; agreed with master system
   ASDU Type ID	M_ME_NC_1 (13)	Short float; use M_SP_NA_1 (1) for single-point, M_DP_NA_1 (3) for double-point
   Cause of Transmission	03h Spontaneous	Transmit on value change; 01h = periodic, 06h = activation
   Deadband (for analog)	0.5	Suppress transmission below this delta to reduce traffic

3. Each TeleControl tag at this stage is independent of your WinCC process tags — it has no value source yet.

4. Bridge WinCC Process Tags → TeleControl Tags

This is the critical coupling step. WinCC/TeleControl tags do not auto-subscribe to existing WinCC internal or external tags. You must copy values via one of these methods:

Recommended approach — WinCC Global C-Script:

// Global Script: CopyTagsToTeleControl
// Cycle: 1000 ms
#include "apdefap.h"

void CopyTagsToTeleControl(char* lpszPictureName, char* lpszObjectName, char* lpszPropertyName)
{
    double dVal;
    BOOL bRet;

    // Read source process tag
    dVal = GetTagDouble("PLC1_Tank1_Level");  // existing WinCC tag

    // Write to TeleControl slave tag (IOA 100)
    bRet = SetTagDouble("TC_IEC104_SlaveConn\\MonitoredData\\IOA_100_Level", dVal);

    if (!bRet) {
        // Log error to WinCC alarm system
        printf("[TeleControl] Tag write failed for IOA 100\n");
    }

    // Single-point status example (IOA 200)
    BOOL bStatus = GetTagBit("PLC2_Pump1_Running");
    SetTagBit("TC_IEC104_SlaveConn\\MonitoredData\\IOA_200_PumpStatus", bStatus);
}

5. Configure General Interrogation (GI) Response

The external master will issue a C_IC_NA_1 (Type ID 100, COT 06h) General Interrogation command on connect. WinCC/TeleControl handles this automatically — it sends all mapped TeleControl tags with COT 14h (interrogation response) then COT 0Ah (activation termination). Verify the GI Group Assignment on each tag if selective interrogation groups (Group 1–16) are required by the master.

6. Activate Runtime and Verify

1. Start WinCC Runtime. The IEC 104 server listener starts automatically on TCP 2404.
2. Verify with netstat -an | findstr 2404 — should show LISTENING.
3. From the master side (or using a test tool such as FreyrSCADA IEC 104 Client Simulator or Triangle MicroWorks ACS), initiate a TCP connection to WinCC host IP, port 2404.
4. Observe STARTDT ACT / STARTDT CON handshake (U-frame exchange).
5. Issue a General Interrogation — WinCC should respond with all configured IOAs.
6. Modify a source process tag in WinCC; confirm the master receives a spontaneous ASDU (COT 03h) within the script cycle period.

Common Error Codes and Diagnostics

SIPLUS RTU / PLC-as-Master Alternative

If your PLC (S7-300/400/1500) needs to act as the IEC 104 master and WinCC acts purely as a data concentrator slave, use the SIPLUS S7-300 CP 343-1 or the S7-1500 CP 1543-1 with STEP 7 FB90/FC90 SIPLUS TeleControl library blocks. In this topology:

• PLC CP module establishes TCP connection to WinCC TeleControl server on port 2404
• FB90 (SEND_IEC104) in the PLC OB sends data objects to WinCC IOA addresses
• WinCC TeleControl slave receives and maps received ASDU values to WinCC tags
• WinCC then forwards to the external third-party master via a second IEC 104 server connection or OPC

See SIPLUS TeleControl FB90/FC90 Programming Guide (Entry 49216783) for block parameters and DB structure.

Reference Documentation

• WinCC/TeleControl V7 System Manual (Entry 109748460)
• WinCC TeleControl IEC 60870-5-104 Configuration Guide (Entry 23129884)
• SIPLUS TeleControl FB90/FC90 Function Block Manual (Entry 49216783)
• IEC 60870-5-104 Standard: Telecontrol equipment — Part 104 (IEC Webstore)
• WinCC V7.5 SP2 Release Notes and Known Issues (Entry 109763201)

Frequently Asked Questions