ControlForge IEC 60870-5-104 Protocol Guide

James M. Belcher Founder, JMB Technical Services LLC April 2026 | ControlForge v1.0.533

1. Architecture Overview

ControlForge implements a complete IEC 60870-5-104 stack — both controlling station (client/master) and controlled station (server/slave) — callable directly from IEC 61131-3 Structured Text. No external libraries, no XML configuration files, no code generation. You create clients and servers, read and write data objects, and manage connections with plain function calls in your ST programs.

Role	Functions	Use Case
Client (Controlling Station)	`IEC104_CLIENT_CREATE` / `IEC104_CLIENT_READ_` / `IEC104_CLIENT_WRITE_`	Poll remote RTUs, protection relays, bay controllers, IEDs
Server (Controlled Station)	`IEC104_SERVER_CREATE` / `IEC104_SERVER_SET_` / `IEC104_SERVER_GET_`	Expose ControlForge data to SCADA masters, control centers, energy management systems

Both roles can run simultaneously. A single ControlForge instance can poll substation IEDs as a client while serving aggregated data to a utility control center as a server — all from the same ST program.

System Diagram

Why IEC 60870-5-104?

IEC 60870-5-104 (commonly "IEC 104") is the dominant telecontrol protocol for power system SCADA in Europe, Asia, Africa, and South America — the international counterpart to DNP3. It runs over TCP/IP and is the standard protocol for:

Transmission SCADA — communication between control centers and substations
Distribution automation — feeder monitoring, recloser control, capacitor bank switching
Generation dispatch — turbine telemetry and setpoint control from EMS
Interconnection metering — real-time power flow data between grid operators
Renewable integration — wind farm and solar plant monitoring and curtailment

Key protocol features:

Application layer (IEC 60870-5-101) over TCP/IP transport (IEC 60870-5-104)
Spontaneous transmission — controlled stations push changes without polling
Time-tagged data — CP56Time2a timestamps with millisecond resolution
Cause of transmission — every ASDU carries why it was sent (spontaneous, interrogated, periodic, etc.)
General interrogation — client can request a full snapshot of all data points
Common address (CASDU) — identifies the station/logical device (1-65534)
Information object address (IOA) — identifies each data point within a station (1-16777215)

ControlForge abstracts the protocol complexity. Your ST programs read and write typed data objects by IOA — the runtime handles APCI framing, I/S/U-format messages, sequence numbering, t1/t2/t3 timers, and connection supervision internally.

IEC 104 Data Types

IEC 104 organizes data into typed information objects. Understanding these mappings is essential for integrating with utility SCADA systems.

Data Type	ASDU Type ID	ControlForge Type	Direction	Typical Use
Single Point (SP)	M_SP_NA_1 (1) / M_SP_TB_1 (30)	BOOL	Server → Client	Breaker status, switch position, alarm flags
Double Point (DP)	M_DP_NA_1 (3) / M_DP_TB_1 (31)	INT	Server → Client	Breaker position (00=indeterminate, 01=off, 10=on, 11=indeterminate)
Measured Float (MF)	M_ME_NC_1 (13) / M_ME_TF_1 (36)	REAL	Server → Client	Voltage, current, power, frequency, temperature
Measured Scaled (MS)	M_ME_NB_1 (11) / M_ME_TE_1 (35)	INT	Server → Client	Tap position, percentage values, scaled measurements
Integrated Total (IT)	M_IT_NA_1 (15) / M_IT_TB_1 (37)	INT	Server → Client	Energy counters (kWh, MVArh), pulse accumulators
Single Command (SC)	C_SC_NA_1 (45) / C_SC_TA_1 (58)	BOOL	Client → Server	Trip/close commands, start/stop, enable/disable
Setpoint Command	C_SE_NC_1 (50) / C_SE_TC_1 (63)	REAL	Client → Server	Voltage setpoint, power setpoint, tap target

Double Point values: 0 = indeterminate/transit, 1 = OFF/open, 2 = ON/closed, 3 = indeterminate/fault. This encoding is defined by IEC 60870-5-101 and maps directly to breaker and disconnect switch positions.

IOA Addressing

Every data point in IEC 104 is identified by an Information Object Address (IOA) — a 24-bit integer (1-16777215) that is unique within a given common address (station). Unlike DNP3's zero-based type-specific indexing, IEC 104 uses a flat address space where every point has a globally unique IOA within the station.

Concept	Description	Range
Common Address (CASDU)	Station/device identifier	1-65534
IOA	Point address within the station	1-16777215

Typical IOA allocation follows utility convention:

IOA Range	Data Type	Example Use
1-999	Single Point (SP)	Breaker status, alarm contacts
1000-1999	Double Point (DP)	Breaker position, disconnect status
2000-2999	Measured Float	Voltage, current, power, frequency
3000-3999	Measured Scaled	Tap position, percentage values
4000-4999	Integrated Totals	Energy counters
5000-5999	Single Command	Breaker trip/close
6000-6999	Setpoint Command	Voltage/power setpoints

Convention only: IOA ranges are not mandated by the standard — they are engineering conventions. Each utility or system integrator defines their own IOA map. ControlForge does not enforce any mapping; you read and write any IOA with any function.

IEC 104 vs DNP3

Both protocols serve the same purpose (telecontrol SCADA) but differ in adoption and design philosophy:

Feature	IEC 60870-5-104	DNP3 (IEEE 1815)
Geography	Europe, Asia, Africa, South America	North America, Australia
Transport	TCP only (port 2404)	TCP or serial
Point addressing	Flat IOA space (1-16M)	Type-specific zero-based index
Double point	Native (2-bit status)	Binary input pairs (convention)
Time sync	Clock sync command (C_CS_NA_1)	Time sync over link layer
Standard body	IEC (Geneva)	IEEE (USA)
ControlForge support	This guide	See DNP3 guide

2. Client Functions (Controlling Station)

The IEC 104 client connects to remote controlled stations (RTUs, IEDs, bay controllers) and performs read/write operations. ControlForge handles general interrogation, spontaneous data reception, and point caching internally. Your ST code reads cached point values — every read returns the most recent value received from the controlled station.

2.1 Connection Management

IEC104_CLIENT_CREATE — Create Named Client Connection

Param	Type	Required	Description
`name`	STRING	Yes	Unique connection name
`host`	STRING	Yes	IP address or hostname of the controlled station
`port`	INT	Yes	TCP port (typically 2404)
`commonAddr`	INT	No	Common address / CASDU (default 1)

Returns: BOOL — TRUE if the client connection was created successfully.

(* Connect to a substation RTU at 10.0.0.100, default common address *)
ok := IEC104_CLIENT_CREATE('sub1', '10.0.0.100', 2404);

(* Connect with explicit common address *)
ok := IEC104_CLIENT_CREATE('sub1', '10.0.0.100', 2404, 47);

(* Multiple substations *)
ok := IEC104_CLIENT_CREATE('sub_north', '10.0.1.50', 2404, 1);
ok := IEC104_CLIENT_CREATE('sub_south', '10.0.1.51', 2404, 2);

Named connections: Every client connection has a unique string name. This name is used in all subsequent calls. Create one connection per controlled station — the typical pattern for SCADA polling.

IEC104_CLIENT_CONNECT — Establish TCP Connection

Param	Type	Description
`name`	STRING	Connection name from IEC104_CLIENT_CREATE

Returns: BOOL — TRUE if connected successfully. The runtime automatically sends a STARTDT (Start Data Transfer) activation and issues a general interrogation (C_IC_NA_1) to populate the initial point table.

ok := IEC104_CLIENT_CONNECT('sub1');

IEC104_CLIENT_DISCONNECT — Close TCP Connection

Param	Type	Description
`name`	STRING	Connection name

Returns: BOOL — TRUE if disconnected successfully. Sends a STOPDT (Stop Data Transfer) before closing the TCP connection.

ok := IEC104_CLIENT_DISCONNECT('sub1');

IEC104_CLIENT_IS_CONNECTED — Check Connection State

Param	Type	Description
`name`	STRING	Connection name

Returns: BOOL — TRUE if the TCP connection is active and data transfer is active (STARTDT confirmed).

IF NOT IEC104_CLIENT_IS_CONNECTED('sub1') THEN
    IEC104_CLIENT_CONNECT('sub1');
END_IF;

Example: Connection Lifecycle

PROGRAM POU_IEC104Init
VAR
    state : INT := 0;
    ok : BOOL;
END_VAR

CASE state OF
    0: (* Create client connection *)
        ok := IEC104_CLIENT_CREATE('sub1', '10.0.0.100', 2404, 1);
        IF ok THEN
            state := 1;
        END_IF;

    1: (* Connect — triggers STARTDT + general interrogation *)
        ok := IEC104_CLIENT_CONNECT('sub1');
        IF ok THEN
            state := 10;
        END_IF;

    10: (* Running — read/write in other programs *)
        IF NOT IEC104_CLIENT_IS_CONNECTED('sub1') THEN
            state := 1;  (* Reconnect *)
        END_IF;
END_CASE;
END_PROGRAM

2.2 Read Functions

All read functions return the most recent cached value from the controlled station. ControlForge receives spontaneous data updates and general interrogation responses automatically in the background. Reads never block.

IEC104_CLIENT_READ_SP — Read Single Point

Param	Type	Description
`name`	STRING	Connection name
`ioa`	INT	Information Object Address

Returns: BOOL — The current single point value at the specified IOA.

(* Read breaker status — IOA 1 *)
breaker_closed := IEC104_CLIENT_READ_SP('sub1', 1);

(* Read alarm contact — IOA 10 *)
overtemp_alarm := IEC104_CLIENT_READ_SP('sub1', 10);

ASDU types: The runtime accepts both M_SP_NA_1 (1) and M_SP_TB_1 (30) — with and without time tags. Time-tagged variants are preferred by the controlled station for spontaneous updates; your read call returns the value regardless of which variant was received.

IEC104_CLIENT_READ_DP — Read Double Point

Param	Type	Description
`name`	STRING	Connection name
`ioa`	INT	Information Object Address

Returns: INT — The current double point value (0-3).

Value	Meaning	IEC Interpretation
0	Indeterminate	Transit / not available
1	OFF	Open / de-energized
2	ON	Closed / energized
3	Indeterminate	Fault / inconsistent

(* Read breaker position — IOA 1000 *)
breaker_pos := IEC104_CLIENT_READ_DP('sub1', 1000);

IF breaker_pos = 2 THEN
    (* Breaker is closed *)
ELSIF breaker_pos = 1 THEN
    (* Breaker is open *)
ELSE
    (* Indeterminate — transit or fault *)
END_IF;

Double point vs single point: Use double point for equipment that has distinct open and closed feedback contacts (breakers, disconnectors). The 2-bit encoding detects mid-travel and contact disagreement — critical for protection coordination.

IEC104_CLIENT_READ_FLOAT — Read Measured Value (Floating Point)

Param	Type	Description
`name`	STRING	Connection name
`ioa`	INT	Information Object Address

Returns: REAL — The current measured value in engineering units.

(* Read substation measurements *)
bus_voltage := IEC104_CLIENT_READ_FLOAT('sub1', 2000);    (* kV *)
line_current := IEC104_CLIENT_READ_FLOAT('sub1', 2001);   (* A *)
active_power := IEC104_CLIENT_READ_FLOAT('sub1', 2002);   (* MW *)
frequency := IEC104_CLIENT_READ_FLOAT('sub1', 2003);      (* Hz *)

ASDU types: Maps to M_ME_NC_1 (13) and M_ME_TF_1 (36) — short floating point with and without time tag. These carry IEEE 754 single-precision values directly, with no scaling required.

IEC104_CLIENT_READ_SCALED — Read Measured Value (Scaled)

Param	Type	Description
`name`	STRING	Connection name
`ioa`	INT	Information Object Address

Returns: INT — The raw scaled value (-32768 to 32767).

(* Read transformer tap position — IOA 3000 *)
tap_pos := IEC104_CLIENT_READ_SCALED('sub1', 3000);

(* Read percentage value — IOA 3010 *)
load_pct := IEC104_CLIENT_READ_SCALED('sub1', 3010);

Scaling: Scaled values (M_ME_NB_1 / M_ME_TE_1) are 16-bit signed integers. The engineering unit conversion depends on the point configuration at the controlled station. A tap changer might report position 1-33 directly; a load percentage might use 0-10000 to represent 0.00-100.00%. Consult the station's IOA map for scaling factors.

IEC104_CLIENT_READ_COUNTER — Read Integrated Total

Param	Type	Description
`name`	STRING	Connection name
`ioa`	INT	Information Object Address

Returns: INT — The current counter value.

(* Read energy counters *)
kwh_import := IEC104_CLIENT_READ_COUNTER('sub1', 4000);
kwh_export := IEC104_CLIENT_READ_COUNTER('sub1', 4001);
mvarh := IEC104_CLIENT_READ_COUNTER('sub1', 4002);

Counter interrogation: The runtime can issue counter interrogation commands (C_CI_NA_1) to freeze and read counters atomically. Integrated totals use ASDU types M_IT_NA_1 (15) and M_IT_TB_1 (37).

2.3 Write Functions (Commands)

Write functions send commands from the controlling station to the controlled station. IEC 104 commands follow a select-before-operate (SBO) or direct execution model, depending on station configuration. ControlForge uses direct execution by default.

IEC104_CLIENT_WRITE_SC — Write Single Command

Param	Type	Description
`name`	STRING	Connection name
`ioa`	INT	Information Object Address of the command point
`value`	BOOL	Command value (TRUE = ON, FALSE = OFF)

Returns: BOOL — TRUE if the command was acknowledged by the controlled station.

(* Trip breaker — IOA 5000 *)
ok := IEC104_CLIENT_WRITE_SC('sub1', 5000, FALSE);

(* Close breaker — IOA 5000 *)
ok := IEC104_CLIENT_WRITE_SC('sub1', 5000, TRUE);

(* Enable capacitor bank — IOA 5010 *)
ok := IEC104_CLIENT_WRITE_SC('sub1', 5010, TRUE);

ASDU type: Sends C_SC_NA_1 (45) — single command. The controlled station validates the command and responds with an activation confirmation or negative acknowledgment. The return value reflects whether the command was accepted.

IEC104_CLIENT_WRITE_SETPOINT — Write Setpoint Command

Param	Type	Description
`name`	STRING	Connection name
`ioa`	INT	Information Object Address of the setpoint
`value`	REAL	Setpoint value in engineering units

Returns: BOOL — TRUE if the setpoint was acknowledged.

(* Set voltage reference — IOA 6000 *)
ok := IEC104_CLIENT_WRITE_SETPOINT('sub1', 6000, 110.5);

(* Set active power setpoint for wind farm curtailment — IOA 6010 *)
ok := IEC104_CLIENT_WRITE_SETPOINT('sub1', 6010, 45.0);

(* Set transformer tap target — IOA 6020 *)
ok := IEC104_CLIENT_WRITE_SETPOINT('sub1', 6020, 15.0);

ASDU type: Sends C_SE_NC_1 (50) — setpoint command, short floating point. For scaled setpoints, the runtime converts the REAL value to a scaled integer internally when communicating with stations that expect M_ME_NB_1-style values.

2.4 Lifecycle Management

IEC104_CLIENT_DELETE — Remove Client Connection

Param	Type	Description
`name`	STRING	Connection name

Returns: BOOL — TRUE if the connection was removed. Disconnects first if still connected.

ok := IEC104_CLIENT_DELETE('sub1');

IEC104_CLIENT_LIST — List All Client Connections

Returns: []STRING — Array of all active client connection names.

clients := IEC104_CLIENT_LIST();
(* Returns: ['sub_north', 'sub_south'] *)

3. Server Functions (Controlled Station)

The IEC 104 server listens for incoming connections from controlling stations (SCADA masters, control centers). ControlForge manages connection acceptance, general interrogation responses, spontaneous data transmission, and APCI-level keepalives (TESTFR) automatically. Your ST program sets data point values and reads incoming commands.

3.1 Connection Management

IEC104_SERVER_CREATE — Create Named Server

Param	Type	Required	Description
`name`	STRING	Yes	Unique server name
`port`	INT	Yes	TCP listen port (typically 2404)
`commonAddr`	INT	No	Common address / CASDU (default 1)

Returns: BOOL — TRUE if the server was created successfully.

(* Create server on default IEC 104 port *)
ok := IEC104_SERVER_CREATE('station1', 2404);

(* Create server with explicit common address *)
ok := IEC104_SERVER_CREATE('station1', 2404, 47);

(* Multiple servers for different logical devices *)
ok := IEC104_SERVER_CREATE('bay1', 2404, 1);
ok := IEC104_SERVER_CREATE('bay2', 2405, 2);

Common address: The CASDU identifies this controlled station to connecting clients. In a substation with multiple bay controllers, each bay typically has its own common address. Clients filter incoming ASDUs by common address.

IEC104_SERVER_START — Begin Listening

Param	Type	Description
`name`	STRING	Server name

Returns: BOOL — TRUE if the server began listening. Accepts incoming TCP connections and responds to STARTDT, general interrogation, and TESTFR automatically.

ok := IEC104_SERVER_START('station1');

IEC104_SERVER_STOP — Stop Listening

Param	Type	Description
`name`	STRING	Server name

Returns: BOOL — TRUE if stopped. Disconnects all connected controlling stations.

ok := IEC104_SERVER_STOP('station1');

IEC104_SERVER_IS_CONNECTED — Check If Any Client Is Connected

Param	Type	Description
`name`	STRING	Server name

Returns: BOOL — TRUE if at least one controlling station is connected and data transfer is active.

IF IEC104_SERVER_IS_CONNECTED('station1') THEN
    (* At least one SCADA master is connected *)
END_IF;

Example: Server Lifecycle

PROGRAM POU_IEC104Server
VAR
    state : INT := 0;
    ok : BOOL;
END_VAR

CASE state OF
    0: (* Create server *)
        ok := IEC104_SERVER_CREATE('station1', 2404, 1);
        IF ok THEN
            state := 1;
        END_IF;

    1: (* Start listening *)
        ok := IEC104_SERVER_START('station1');
        IF ok THEN
            state := 10;
        END_IF;

    10: (* Running — set data points in other programs *)
        ;
END_CASE;
END_PROGRAM

3.2 Set Functions (Controlled Station → Controlling Station)

Set functions update the server's data point table. When a controlling station sends a general interrogation or the server sends spontaneous data, the client receives these values. Call these from your ST program to publish field data.