Talking to substations over distance
A grid control centre may oversee hundreds of substations spread across a region. It needs to read their measurements, see their status and send commands — reliably, over whatever link is available. IEC 60870-5 is the European family of telecontrol protocols built for exactly that conversation, and in modern networks its member IEC 60870-5-104 is everywhere.
-101 and -104 — the same data, two transports
The clever part of the family is the split between what is sent and how. IEC 60870-5-101 defines the application data — measured values, single and double points, commands — as typed information objects carried in ASDUs, each with an address and a cause of transmission. That data definition is transport-independent. 60870-5-101 carries it over serial links; 60870-5-104 wraps the identical application layer in TCP/IP, so the same SCADA logic runs over routed wide-area networks. Inside substations, 60870-5-103 interfaces to protection relays, and IEC 60870-6 (ICCP/TASE.2) handles centre-to-centre exchange.
DNP3, the cousin — and the security gap
60870-5 is not alone. DNP3 (IEEE 1815) shares a common origin and does the same job; 60870-5 dominates in Europe, DNP3 in North America, and many devices speak both. The family’s weakness is age: 60870-5-104 was specified without security, so authentication and encryption are added by the IEC 62351 series — now mandatory thinking given how exposed a routed telecontrol link is. This is the same control-system security discipline as IEC 62443.
Where it sits versus IEC 61850
It is easy to confuse 60870-5 with IEC 61850, but they solve different problems. 61850 is the fast, model-rich communication inside a substation; 60870-5-104 is the wide-area link reporting that substation upward to the control centre. A modern station typically runs 61850 internally and 60870-5-104 to the centre, with OPC UA (IEC 62541) bridging to enterprise and analytics systems.