IEC 60870-5-104 (IEC104) is a telecontrol protocol widely used in electrical utility SCADA systems to communicate with RTUs and substation gateways over TCP/IP. EnvisionSCADA acts as an IEC104 master (controlling station) and connects to remote stations on TCP port 2404. Each IEC104 device represents one remote station connection. Variables map individual information objects from that station into the project variable space.
Configure the device first, then add variables to it. Variables are accessed at runtime as DeviceName.VariableName, for example RTU1.Feeder1_Current.
After the connection is established, EnvisionSCADA sends a general interrogation so the remote station reports the current state of all points. From then on the remote station sends changes spontaneously. Time-tagged values keep the timestamp assigned by the remote station, so events are stored in the historian with the original process time.
Variables reference points by their Object Type and Information Object Address (IOA). The Object Type determines the data encoding in monitor direction and the command encoding in control direction.
Device Settings
Each IEC104 device represents one remote station connection. Configure the connection endpoint, the IEC 60870-5-104 protocol parameters, and the diagnostics options.
Create a new device with the Add button in the toolbar. The Add device dialog contains all device settings organized in the sections General, Connection, IEC104 Settings, and Diagnostics, with default values already filled in. Enter at least the Name and IP Address and press Create.
The device row shows Enable, Name, IP Address, Port, Common Address, Originator Address, Template, and Description directly and these values can be edited in place. Press the Settings icon on a device row to open the Edit device dialog, which contains the same sections and all settings of the device. Press Save to apply the changes.
| Setting | Description | Example | Units / Format |
|---|---|---|---|
| Enable | Enables or disables this IEC104 device. | true | Boolean |
| Simulation | Runs the device in simulation mode. The device does not open its real connection; its variables stay available and become read and write in memory like Local variables, with a Good status and a Channel State of Simulation, so the project can be tested without hardware. Written values are held in memory only and reset when the application restarts. | false | Boolean |
| Name | Unique name for this IEC104 device. Used as the device name prefix in runtime variable references. | RTU1 | Text |
| IP Address | IP address of the remote station. | 192.168.1.30 | IP Address |
| Port | TCP port used for the IEC104 connection. | 2404 | Integer |
| Common Address | Common address of ASDU (station address) of the remote station. Must match the remote station configuration. Data received with a different common address is discarded. | 1 | Integer (1 to 65534) |
| Originator Address | Originator address sent in commands and interrogations from this master. Use 0 when the remote station does not require a specific originator. | 0 | Integer (0 to 255) |
| Template | Optional device template name. When set, this device uses a shared variable list from the named template device. | Iec104Template | Text |
| Description | Free text description for documentation purposes. | Substation feeder RTU | Text |
No rows match the filter.
Device Advanced Settings
The following settings are available in the IEC104 Settings and Diagnostics sections of the Add device and Edit device dialogs. The k, w, t0, t1, t2, and t3 values are the standard IEC 60870-5-104 protocol parameters. The defaults match the values recommended by the standard and work with most remote stations.
| Setting | Description | Default | Units / Format |
|---|---|---|---|
| k (Max Unacknowledged) | Maximum number of transmitted frames that may remain unacknowledged by the remote station before transmission stops. | 12 | Frames |
| w (Acknowledge Window) | Number of received frames after which an acknowledgement is sent at the latest. Keep w at two thirds of k or lower. | 8 | Frames |
| t0 (Connect Timeout) | Timeout for establishing the TCP connection. | 30 | Seconds |
| t1 (Send Timeout) | Timeout for the remote station to acknowledge a transmitted frame or test frame. The connection is closed and re-established when it expires. | 15 | Seconds |
| t2 (Acknowledge Timeout) | Maximum time before received frames are acknowledged. Must be lower than t1. | 10 | Seconds |
| t3 (Test Frame Interval) | Idle time after which a test frame keepalive is sent to verify the connection. | 20 | Seconds |
| GI Interval (s) | Interval for periodic general interrogations. 0 sends a general interrogation only when the connection is established. | 0 | Seconds |
| Clock Synchronization | Sends a clock synchronization command to the remote station after each connection establishment. | false | Boolean |
| Verbose | Logging verbosity level. 0 is silent, higher values produce more diagnostic output including frame-level logging. | 0 | Integer |
| Command Select Timeout | How long a command point stays armed here after the remote station confirms an operator selection. Set this below the select timeout configured in the remote station, so the selection is released here before the station drops it on its own. Used by command points whose Command Mode is Select before operate (operator). | 20 | Seconds (1 to 600) |
No rows match the filter.
Variable Settings
Variables are added per device. Each variable maps one information object of the remote station to a named variable in the EnvisionSCADA namespace.
Create a new variable with the Add button in the toolbar. The Add variable dialog organizes all variable settings in the tabs General, Scaling, Historian, and Gateway, with default values already filled in. Enter at least the Name and Information Object Address (IOA) on the General tab and press Create. When the variable is created on a template device, it is also created on all instance devices that use the template. On a template device, start the Name with the {Device} replacer, so that each instance device gets its own variable. The Name must resolve to a different variable on each device; this is checked for every instance device before anything is saved, when a variable is created and when it is renamed.
The variable row shows Enable, Name, Asset, Object Type, Information Object Address, and Description directly and these values can be edited in place. Press the Settings icon on a variable row to open the Edit variable dialog, which contains the same tabs and all settings of the variable. Press Save to apply the changes. Changes made on a template device are also applied to the matching variable on all instance devices, while each instance keeps its own Modbus Address value. The Gateway tab settings Modbus Address, OPC UA, Writeable, MQTT Publisher, Kafka Device, Kafka Remap Device, and Kafka Remap Variable are also available as table columns, which are shown with Columns as described in the Configuration Tables article.
| Setting | Description | Example | Units / Format |
|---|---|---|---|
| Enable | Enables or disables this variable. | true | Boolean |
| Name | Full variable name. The {Device}. replacer prefix is optional: {Device} resolves to the device name when the device loads, so the variable follows a device rename automatically, while a literal name is used exactly as written and keeps working across device renames. The resolved name must be unique across the whole project. | {Device}.Feeder1_Current | Text |
| Asset | Asset tag used to group and filter this variable. | Substation1 | Text |
| Object Type | IEC104 type of this information object. Monitor types receive data from the remote station. Command types send commands to the remote station. | Measured short float (M_ME_NC) | Enum |
| Information Object Address (IOA) | Information object address of the point in the remote station. | 1001 | Integer (1 to 16777215) |
| Description | Free text description for documentation purposes. | Feeder 1 current measurement | Text |
| Pulse | Sends single and double commands with the short-pulse qualifier instead of persistent output. | false | Boolean |
| Command Mode | How the command is issued. Direct execute sends the command in one step. Select before operate arms the point with a selection first and executes it only after the remote station confirms that selection. Select before operate (operator) is the same exchange split across two operator actions, so the point stays reserved at the remote station while the operator decides. Applies to command object types. | Select before operate | Enum |
| User Groups | Comma-separated list of user groups that have access to this variable at runtime. | Operators,Supervisors | Text |
| Signature Required | Requires an electronic signature for each write to this variable from a page object, the Live Manager, the Runtime API or MCP while Part 11 compliance mode is enabled and Write variables marked Signature Required is selected under Signature Required Actions on the Parameters page. The write rights of the user and the value range are checked first, so a refused write does not open the Electronic Signature dialog. A variable created while Part 11 compliance mode is enabled starts with Signature Required selected. Writes by alarm, event and schedule actions, Python scripts and the gateways run without a signature. See the Electronic Signatures article. | true | Boolean |
| Recipe Targets | Recipe type name (target) this variable belongs to. Supports the {Device} placeholder, which resolves to the owning device name so one naming rule can spread a set of variables across several devices. | Line1 | Text |
| Recipe Parameter Name | Explicit name of the parameter this variable represents inside a recipe. Variables that fill the same role across different targets share the same Recipe Parameter Name, which is how values are matched on Apply and Snapshot. A variable takes part in recipes only when both Recipe Targets and Recipe Parameter Name are set. | Setpoint | Text |
| Trend Groups | Comma-separated list of trend group names this variable belongs to. A variable can be in several groups. The groups are the filter the Trend Analyst offers when picking variables. The names accept the {Device}, {DeviceName} and {VariableName} placeholders, so one UDT definition gives every instance its own group. | Pumps,{Device} | Text |
| Units | Engineering unit label displayed alongside the value. | A | Text |
| Format | Display format of the value on screens and in the Trend Analyst: the value of a Label or Input (unless the object uses its own Floating Point and Decimals), the value text of a Knob and a Slider, the Trend tooltip, a Data Grid Variable column, the right-click menu, Quick Trend, the current value in the Recipe Manager, variable tokens in alarm and event messages, and the Trend Analyst tooltip, summary and pen Format. An Input shows the plain value while it is being edited. 0 shows no decimals, 0.00 always shows two decimals, 0.0## shows one to three decimals and #,##0.00 adds a thousands separator, with up to 15 decimals. Values are rounded half away from zero for display only; alarms and expressions keep the full value, and so does the historian unless Round to Format is on. ReadVariable in the runtime API and MCP returns the Format beside the full value. Leave empty to show the value as received. | 0.00 | Text |
| Min Raw | Minimum raw value from the remote station, used for scaling. | 0 | Number |
| Max Raw | Maximum raw value from the remote station, used for scaling. | 32767 | Number |
| Min Scaled | Minimum engineering value corresponding to Min Raw. | 0 | Number |
| Max Scaled | Maximum engineering value corresponding to Max Raw. | 1000 | Number |
| Converter | Name of a Converter defined in the Converters configuration to apply a custom read/write expression. | RawToPressure | Text |
| Historian | Enables logging of this variable's values to the historian database. | true | Boolean |
| Round to Format | Stores the historian samples of this variable rounded to the decimals of its Format, as a plain number: with Format 0.00 the value 34.30487 is stored as 34.3. The deadband compares the rounded values, so with Deadband 0 a sample is written only when the rounded value changes. On a variable without scaling the Raw value is stored empty, since it equals the value. The live value, alarms, expressions and all interfaces keep the full value. Applies to new samples only; samples already stored keep their values. Requires a Format. | false | Boolean |
| Deadband | Minimum change in value required before a new historian record is written. | 0.5 | Number |
| Minimum Time (s) | Minimum time in seconds between historian records for this variable. | 0 | Seconds |
| Sample Group | Name of the Sample Group that controls the historian sampling rate for this variable. | Text | |
| History Source | Where the trends read the history of this variable: Project default (the History Source with Project default enabled on the History Sources page, or the EnvisionSCADA Historian when no source has it), EnvisionSCADA Historian (the samples recorded while Historian is on) or a History Source of the History Sources page (a query on a Database Connection or the fetch() function of a Python Module script). In the table, an empty History Source is Project default and Historian is the EnvisionSCADA Historian. Live values always come from the variable itself. Test reads the last 24 hours with the settings in the dialog. See the History Sources article. | Project default | Enum |
| History Reference | What the History Source reads for this variable: the reference passed to fetch(), or @Variable of the History Query. When empty, the History Reference of the source is used, by default the full name of the variable; the field shows it in italics. {Name} is replaced by the full name of the variable. Browse lists the references that a Script source offers. | CDT158 | Text |
| History Parameters | Shown for a Script source: optional key=value pairs separated by ;, added to the History Parameters of the source. A key set here replaces the same key of the source. The field shows the History Parameters of the source in italics. | scale=0.1 | Text |
| Modbus Address | Optional address on the built-in Modbus TCP and Modbus RTU servers where this variable is exposed. The servers are enabled in the Gateways section of the Parameters page. Each instance device keeps its own value. | %MW0 | See Modbus TCP Addressing |
| OPC UA | Exposes this variable as an OPC UA node. When Historize is also ticked, the Historian data of the variable is readable through OPC UA Historical Access. | true | Boolean |
| Writeable | Allows external systems to write this variable through the gateways: the OPC UA Server, the Modbus TCP and Modbus RTU servers, the MQTT publisher when Subscribe is enabled on the publisher, and Kafka when Consumer is enabled on the Kafka device. Writes from pages, actions, scripts and the API are independent of this setting. Command object types require Writeable, and Writeable is accepted on command object types only. | false | Boolean |
| MQTT Publisher | Name of the MQTT publisher that publishes this variable, typed or chosen with the ... button. A variable is published by one publisher, and the name must match a publisher on the MQTT Publishers page. Leave empty to keep the variable unpublished. Writes from the broker need Subscribe on the publisher and Writeable on the variable. See the MQTT Publishers article. | CloudIoT | Text |
| Kafka Device | Name of the Kafka device this variable is linked to, typed or chosen with the ... button. Every value change of a linked variable is produced to the Producer Topic of the Kafka device while the device is enabled. Writes from the Consumer Topic need Consumer on the Kafka device and Writeable on the variable. Leave empty to keep the variable unlinked. See the Kafka Devices article. | KafkaBroker1 | Text |
| Kafka Remap Device | Device name used for this variable in Kafka messages instead of the name of the device that owns the variable. Inbound messages from the Consumer Topic are matched on this name as well. Leave empty to use the device name. | Substation1 | Text |
| Kafka Remap Variable | Variable name used for this variable in Kafka messages instead of its own name. Inbound messages from the Consumer Topic are matched on this name as well. Leave empty to use the variable name without the device name, for example Feeder1_Current for RTU1.Feeder1_Current on device RTU1. | Feeder1_I | Text |
No rows match the filter.
Operator Select Before Operate
Command Mode Select before operate (operator) splits a command into two operator actions, configured on a button or another clickable object with the Select Command and Execute Command actions. Select Command arms the point: EnvisionSCADA sends the selection and waits for the remote station to confirm it. The point is then reserved at the remote station and nothing has moved in the field yet. Execute Command then executes it. The variable takes the new value only after the remote station confirms that execution.
The reservation is held by the remote station, not by EnvisionSCADA, and it is released again when the operator executes it, when the operator cancels it, when Command Select Timeout runs out, or when the connection to the remote station drops. In the last three cases a deactivation is sent where the link still allows it, so the point is not left armed in the field.
A selection belongs to the operator who made it. Another user sees that the point is selected and by whom, and cannot execute or cancel that selection. A third action, Cancel Selection, releases the point again without executing it.
| Variable | Description | Example | Units / Format |
|---|---|---|---|
| <Variable>.Selected | True while the point is armed at the remote station. Bind a lamp or a button state to it. | True | Boolean |
| <Variable>.SelectedBy | User name of the operator holding the selection. Empty when the point is not armed. | Operator1 | Text |
| <Variable>.SelectRemaining | Seconds left before the selection is released. Bind a countdown to it. 0 when the point is not armed. | 14 | Seconds |
No rows match the filter.
These three variables exist for every point configured for an operator selection, from the moment the device starts, so a faceplate resolves them before the first selection is made. They are read only.
Automated writes are unaffected. A Python script, a schedule, an alarm action or a gateway write to the same point performs the selection and the execution in one step, because there is no operator to pause for. The two-stage actions are available on pages only, for the same reason: they wait for a person. The wire exchange is identical; only the pause differs.
Build the controls once as a group symbol master with the point name as a replacer, then create one instance per command point, rather than wiring the buttons per page. The armed state must always come from these variables. A local variable set by a button and cleared by a script only looks the same: it reports an arm that the remote station never made and keeps counting down after the connection is gone.
Supported Object Types
The following object types are available for variable mapping. Monitor types receive values from the remote station, both in plain form and in the time-tagged form (CP56Time2a). Command types send commands to the remote station.
For monitor points the time-tagged variants are matched automatically. A variable configured as Single point (M_SP) receives both M_SP_NA_1 and M_SP_TB_1 messages for its Information Object Address.
| Object Type | Direction | Type IDs | Value |
|---|---|---|---|
| Single point (M_SP) | Monitor | 1 / 30 | 0 or 1 |
| Double point (M_DP) | Monitor | 3 / 31 | 0 to 3 (1 = off, 2 = on, 0 and 3 = indeterminate) |
| Step position (M_ST) | Monitor | 5 / 32 | -64 to +63 |
| Bitstring 32 bit (M_BO) | Monitor | 7 / 33 | Unsigned 32 bit value |
| Measured normalized (M_ME_NA) | Monitor | 9 / 34 / 21 | -1.0 to +1.0 |
| Measured scaled (M_ME_NB) | Monitor | 11 / 35 | -32768 to +32767 |
| Measured short float (M_ME_NC) | Monitor | 13 / 36 | IEEE 754 single precision |
| Integrated total (M_IT) | Monitor | 15 / 37 | Signed 32 bit counter |
| Single command (C_SC) | Command | 45 | 0 = off, 1 = on |
| Double command (C_DC) | Command | 46 | 0 = off, 1 = on |
| Regulating step command (C_RC) | Command | 47 | 1 = step lower, 2 = step higher |
| Setpoint normalized (C_SE_NA) | Command | 48 | -1.0 to +1.0 |
| Setpoint scaled (C_SE_NB) | Command | 49 | -32768 to +32767 |
| Setpoint short float (C_SE_NC) | Command | 50 | IEEE 754 single precision |
No rows match the filter.
Variable Arrays
A variable can expand into an array by setting the Array size field to a value between 2 and 512. The variable itself is the first element and its Name must end in the first index, for example Temps[0]. The remaining elements are created automatically as Temps[1], Temps[2] and so on. Each element advances the Information Object Address (IOA) by one, so the elements map onto consecutive points in the remote station.
The element rows are managed by the first element: they follow its settings, appear locked in the variable list, and are edited by editing the first element. Changing the Array size adds or removes elements at the end. Renaming the first element or changing its address renames and re-addresses all elements. Setting Array size back to 0 while elements exist removes the elements.
To turn the elements into ordinary independent variables, use the Ungroup array action on the first element's row in the variable list, or the Configuration API (POST /API/Config/VariableArrays/Ungroup). All rows are kept and only the grouping is removed. This is one-way. The element count badge next to the first element's name folds and unfolds the element rows in the list.
Notes
EnvisionSCADA operates as an IEC104 master only. The Common Address must match the common address of ASDU configured in the remote station exactly.
Monitor points and command points are separate variables. When a remote station uses one information object address for the status of a point and another for its command, create one monitor variable and one command variable.
Commands are sent with cause of transmission activation and are reported only once the remote station confirms them. Command Mode decides how: a direct execute in one step, or a selection that is executed after the station confirms it. One command exchange runs at a time per device, so a selection and its execution always belong to the same write.
A command the station refuses, or leaves unconfirmed within the device timeout t1, ends the write: the variable keeps its previous value and is marked with a fault status, and the System Log entry names the stage that ended the write. This is what makes the displayed value trustworthy, because a value only appears on the variable once the station has accepted the command. For the two select modes the selection is additionally released again with cause of transmission deactivation, so the point is not left armed at the remote station.
Values received with the Invalid (IV) or Not Topical (NT) quality flag keep their value but are marked with a fault status so the bad quality is visible at runtime.
The Pulse setting applies to Single command (C_SC) and Double command (C_DC) object types. It sends the command with the short-pulse qualifier so the remote station generates a pulse output.
The Momentary On action also sends a pulse command for single and double commands. The Toggle action inverts the last commanded value.
Enable Clock Synchronization when the remote station requires a time synchronization from the controlling station. Time-tagged messages from the remote station are always accepted regardless of this setting.
Enable Verbose only during commissioning or diagnostics. Verbose level 1 and higher logs every transmitted and received frame and increases log volume significantly.