IEC 60870-5-104 monitoring

Scope and context

In a digitised substation (station automation in accordance with IEC 61850), an Ethernet network forms the backbone of communication between protection systems, RTUs and the control system. If a switch or port fails, or redundancy is lost in a ring topology, the control room may lose visibility of part of the substation without this being reflected in the technical parameters themselves (voltage, currents, circuit breaker positions). The status of the network infrastructure must therefore be transmitted to the control room via the same route as standard SCADA signals — via IEC 60870-5-104.

Equipment used

METEL LAN-RING — industrial managed switches for ring and mesh topologies (G series)

• Modular DIN switches for the energy sector and industry, operating range −40 °C to +75 °C.
• Redundant ring (mesh) topology with link recovery within 30 ms (LAN-RING, RSTP/LACP).
• Ports: SFP/SFP+ up to 10 Gbps, RJ45 with PoE/PoE++ for cameras and terminals.
• Switch diagnostics and status via encrypted SNMPv3 (GET/TRAP) — a key interface for IPLOG PLCs; Modbus TCP/RTU is also supported without the need for encryption.
• Selected models: 1000 A surge protection (8/20 µs waveform) on Ethernet ports.
• Alarm inputs with balanced loops, NO/NC relay outputs, event management (64 events).
• Separation by purpose: SNMPv3 GET/TRAP serves as a data link to IPLOG → IEC 104 for the control room, whilst SSH CLI and SIMULand.v4 (with support for 802.1X, TACACS+, syslog) ensure independent IT/OT management and diagnostics outside the control room’s supervision.

METEL IPLOG — PLC / RTU / protocol converter

• IPLOG is a Linux-based PLC programmable in accordance with IEC 61131-3 using the METEL IEC IDE application.
• In this project, it communicates with the LAN-RING switch exclusively via SNMPv3 — using the GET method (cyclical OID polling) and by receiving TRAP notifications:
  • Towards the host system, it offers EN/IEC 60870-5-104 as an integration protocol for third-party SCADA/visualisation systems.
  • Local access and management security: SSH, OpenVPN, SNMPv3, 802.1X.
  • In practice, it functions as a typical ‘protocol converter’ as described in the general RTU model: it collects data from subordinate devices (in this case: switch diagnostics via SNMPv3 GET/TRAP) and converts it into ASDU messages of protocol 104 for the dispatcher.

Solution architecture

Principle of operation

1. The LAN-RING G switch continuously monitors its own status (link status, power supply, temperature and, where applicable, SFP optical power) and makes this information available via SNMP OIDs (the switch’s MIB); in the event of critical status changes, it simultaneously generates asynchronous SNMP-TRAP messages.
2. IPLOG acts as an SNMPv3 manager: it regularly retrieves selected OIDs using the SNMP-GET method (periodic polling) whilst simultaneously listening for SNMP-TRAP notifications, which enable it to respond immediately to an event without waiting for the next polling cycle. SNMPv3 authentication and encryption (SHA-512/AES256) ensure that communication between the switch and the IPLOG PLC is protected even within the OT network itself.
3. The IPLOG’s internal logic (IEC 61131-3 programme) maps selected SNMP values and received traps to Information Objects (IOA) of the IEC 104 protocol.
4. As a slave (controlled station) of the 104 protocol, IPLOG sends these data points to the SCADA control system (master/control station) via TCP/IP on port 2404.
5. In parallel and independently of this, standard network management of the switch can take place via SSH CLI (configuration, diagnostics) and SIMULand.v4 (graphical bulk configuration, topology, firmware) — this branch runs directly between the switch and the IT/OT workstation and does not involve the control centre. 

What is typically transmitted from the LAN-RING switch to IEC 104

Role of the programme in IPLOG (IEC 61131-3)

The specific logic running in IPLOG typically handles the configuration of SNMPv3 access to the switch (SHA-512 authentication, AES256 encryption, assignment of a dedicated account) and the definition of the list of monitored OIDs.

• • Periodic SNMP GET polling of selected OIDs (port status, redundancy, power supply, temperature) at a set interval.
  • Receipt and processing of SNMP TRAP messages — immediate response to an asynchronous event without waiting for the next polling cycle.
  • Detection of status changes (threshold detectors `R_TRIG`/`F_TRIG`) so that only actual changes (spontaneous transmission) are sent to the IEC 104, rather than a continuous stream of data.
  • Aggregation logic (e.g. logical sum of the states of multiple ports into a single ‘Station LAN OK/Fault’ signal) using standard blocks (`OR`, timing/debounce blocks to prevent oscillation during short line outages or the loss of a single SNMP GET cycle).
  • Mapping of the resulting variables to IEC 104 points exposed to the control centre.

Benefits of the solution

• Unified view of faults — a network infrastructure fault appears on the control room screen in the same way as a technology fault, without the need for separate NMS monitoring on the control room screen.
• Redundancy — the status of the ring (LAN-RING) is visible; the dispatcher can tell whether the substation is operating in degraded (unbacked-up) mode without the need for a service technician’s intervention.
• Low transmission capacityrequirements — thanks to the mappingof only critical, aggregated points (and spontaneous transmission upon change), the volume of data on the IEC-104 link remains minimal.
• A single supplier for both the switch and the gateway — LAN-RING and IPLOG are from the same manufacturer (METEL), which simplifies integration at the SNMP MIB level and subsequent support.
• Rapid response to alarms — the combination of SNMP-GET (regular checks) and SNMP-TRAP (immediate notification) ensures that a critical event reaches the control centre without having to wait for the next polling cycle, whilst regular SNMP-GET queries verify that the switch and the connection are still functioning correctly (it is possible to distinguish between ‘it’s quiet because everything is OK’ and ‘it’s quiet because the switch is down’).
• Security and division of responsibilities (IT/OT vs. control room)