For a brownfield substation retrofit, the typical spec is a transparent gateway that converts IEC 60870-5-101 (serial, FT1.2 frames) on RS-232 or RS-485 to IEC 60870-5-104 (TCP/IP, port 2404 default) carrying the same ASDU payload to the control centre, with no rewrite of point lists at the outstation [S1][S8].
Scope covers transmission and distribution substations, wind and solar farms, battery storage sites, and large industrial loads where a fleet of IEC 101 outstations still reports on serial links but the new SCADA master only accepts IEC 104 over an IP WAN [S1][S2]. Conversion can be done by a standalone hardware gateway, a software proxy on a substation RTU, or a virtual appliance on a protection relay, and the right pick is set by link count, latency budget, and whether the box must also bridge Modbus at the same time [S4].
Why the conversion is needed and where the encoding breaks
IEC 60870-5-101 was published as IEC 60870-5-101:2003+AMD1:2015, consolidated edition 2.1, and runs on serial links using FT1.2 frames: fixed frames start 0x10 and variable frames start 0x68 L L 0x68, both ending 0x16, with a single 0xE5 character as positive acknowledgement [S1].
IEC 60870-5-104 was published as IEC 60870-5-104:2006+AMD1:2016, consolidated edition 2.1, including the August 2023 corrigendum, and carries the same Application Service Data Units over TCP using an APCI that starts 0x68 followed by one length octet and four control octets [S1]. The current IEC 104 publication is dated 2006 with amendment 1 in 2016, so any "new revision" claims should be checked against the IEC webstore before you pin them into a spec.
Three places in the encoding diverge and force configuration work at the gateway: link layer, address field widths, and the time-tagged ASDU types accepted by the outstation [S1]. A mismatch on any of these stops the two ends understanding each other even when the same point list is loaded, so the interoperability list from the outstation vendor is the first document to read.
Selection criteria that actually decide the gateway
For most substation retrofits the decision reduces to four checks: link count, master-side protocol set, latency budget, and diagnostic access. The first three are scored against the table below; the fourth is binary, you either get raw frame capture or you do not. [S1]
Gateways in the IEC 101/104 class cluster into three patterns: a 1-port serial-to-IP box for one outstation per device, a multi-port substation server that aggregates dozens of IEC 101 lines into a single IEC 104 uplink, and a software module that runs inside a protection relay or RTU [S4][S8]. The Moxa MGate 5114 family ships with conversion between Modbus RTU, Modbus TCP, IEC 60870-5-101, and IEC 60870-5-104 in a single box, with a web wizard and PCAP export for Wireshark, which is a typical reference for the 1-port segment [S4]. For high-density feeders, transparent gateways such as the iGW-S2-SFP handle the conversion purely by configuring the communication parameters, so no ASDU mapping is written [S8].
On the master side, most new control centres are IEC 104 plus IEC 61850, while older master stations still terminate IEC 101 over a serial tie line. A gateway that only converts IEC 101 to IEC 104 will not talk to an IEC 61850-only master, so for greenfield builds with IEC 61850 inside the station the gateway sits between the IEC 101 outstation cluster and the IEC 104 link to the control centre, while IEC 61850 is handled by the station bus [S1][S2].
Comparison: 1-port box vs multi-port server vs integrated module
The comparison lines the three options up against the criteria that matter in a procurement spec. Values are taken from published product references in the research, not invented percentages. [S1]
1-port standalone box (MGate 5114 class): one RS-232/RS-485 to one TCP/IP, plus Modbus RTU/TCP side; web-based configuration in five steps; built-in traffic monitoring with PCAP export; typical use is a single outstation per device or a pilot on one feeder [S4].
Multi-port transparent server (iGW-S2-SFP class): converts IEC 60870-5-101 to IEC 60870-5-104 without ASDU mapping work, configured by communication parameters only, and intended for dense outstation clusters on a multidrop serial line [S8].
Integrated module on an RTU or protection relay: lowest incremental hardware cost, but the gateway function is tied to the relay firmware release cycle, and diagnostic capture is limited to what the relay logs.
On latency, IEC 101 unbalanced mode on a multidrop line is bound by the poll cycle, with FT1.2 allowing one outstanding frame per master, while IEC 104 supports up to k numbered I-frames outstanding with timers t0 to t3 governing acknowledgement, so a single-event latency improves when the same outstation is reachable over IP rather than at the end of a 32-station poll [S1]. On interoperability, IEC 104 fixes the cause of transmission to 2 octets, the common address to 2 octets, and the object address to 3 octets, so a gateway must not let a vendor option rewrite those widths and still claim IEC 104 conformance [S1].
Configuration work that catches teams out
The interoperability list is the first failure point. The list records balanced or unbalanced transmission for IEC 101, the octet counts of the link address, cause of transmission, common address, and object address, which time-tagged types the device sends and accepts, and which commands it accepts with a time tag and whether it uses select-before-operate [S1]. A mismatch on any of those stops the gateway from registering the outstation, regardless of the cable and the IP route.
Time-tagged ASDUs are the second failure point. IEC 101 accepts both CP24Time2a (3 octets) and CP56Time2a (7 octets) monitoring and command types, while IEC 104 uses CP56Time2a only, with monitoring types 30 to 40 and command types 58 to 64 [S1]. A gateway that maps the wrong direction silently drops or rewrites timestamps, which is invisible at the SCADA HMI but ruins post-fault sequence-of-events analysis.
Security and transport timers are the third. IEC 104 sets STARTDT and STOPDT to bring the TCP session up and down, and runs t0 to t3 to detect a dead peer, with port 2404 as the default [S1][S2]. On cellular and MPLS links the t0 and t1 values from the default profiles often fire spuriously, so a gateway that lets the operator override those timers is more useful in brownfield builds than one that hides them.
Siemens WinCC integration with a SIPLUS RIC plus TIM 3V IE is the typical dispatching pattern, and the configuration walkthrough published in September 2026 walks through the gateway parameters end to end [S5]. For SCADA masters that are still IEC 101 only, a gateway in the reverse direction, IEC 104 to IEC 101, is also a recognised pattern and is treated as the same hardware with a different mode.
Real deployments and what to copy from them
For transmission and distribution companies, a substation typically has one RTU that collects circuit breaker and disconnector statuses from digital inputs and current, voltage, and power from analog inputs, optionally pulls IED data over Modbus or IEC 61850, and then forwards the whole set to the SCADA master over IEC 104 [S2]. The operator action is a remote open or close command that goes SCADA master to RTU over IEC 104 and is applied to the bay, with select-before-operate and double confirmation used as the standard command-set guard [S2].
For distributed energy resources, a wind or solar plant often keeps the IEC 101 RTU from the original build and uses a gateway to convert to IEC 104 over a private cellular APN, on the assumption that the original point list, including CP24Time2a time tags, is preserved through the conversion [S1][S2]. The standard caveat is that the IEC 104 side will only carry CP56Time2a, so any time-tagged CP24Time2a-only types at the outstation must be remapped before commissioning, not after.
For a transition project, a standalone gateway beats a computing platform for cost and development time when the scope is "establish communication between two systems", because no additional programming is needed and the box already acts as a diagnostic tool with raw-data capture and PCAP export for Wireshark [S4]. When the scope grows to include protocol translation beyond IEC 101/104 plus Modbus, or to include IEC 61850 MMS at the station bus, the calculus shifts and a substation server or a protection-relay-resident gateway becomes the lower-risk option.
Limitations, failure modes, and what the gateway will not fix
A transparent gateway does not validate point list semantics, so a wrong common address of 1 octet on the IEC 101 side and 2 octets on the IEC 104 side will route telegrams to the wrong logical device at the master, with no error logged at the gateway beyond a malformed frame count [S1][S8].
Cellular and satellite links drop TCP sessions on a schedule, and IEC 104 timers t0 to t3 are unforgiving by default, so a gateway deployed on a public 4G path without VPN is a known failure pattern that operators see as random loss of telemetry, while a private APN with persistent TCP keepalives set to half the t0 value tends to hold the session [S1][S2].
Vendor-proprietary options that rewrite the IEC 104 cause of transmission, common address, or object address octet counts are not interoperable with a standard IEC 104 station, even if the same vendor's own master accepts them, and the gateway should refuse that configuration or flag it explicitly [S1]. When this kind of vendor lock-in is discovered late, the standard remediation is to repoint the affected outstations to a standard IEC 104 profile and to use a gateway that exposes, not hides, the address widths.
For the broader standards picture, IEC 60870 part 5 is the family of standards for telecontrol in electrical engineering and power system automation, and IEC 60870-5-101 and IEC 60870-5-104 sit inside that family alongside IEC 60870-5-103 for protection equipment and IEC 60870-5-102 for metering [S6]. Related reference material on process instrumentation and control protocols is collected at the protocol gateway and fieldbus gateway encyclopedia entries, with adjacent coverage of pressure transmitter and flow meter field devices that sit behind the RTU on the same substation network. For sites that pair telecontrol upgrades with actuator work, the industrial valve and pressure sensor pages give the field-side hardware context.
Track two signals over the next quarter: the IEC 60870-5-104 amendment trail beyond the August 2023 corrigendum already inside edition 2.1 [S1], and the share of new substation builds that ship with native IEC 104 on the master link versus a gateway in front of an IEC 101 outstation fleet, which is the trend that decides whether 1-port boxes stay the dominant form factor or are absorbed into multi-port substation servers. A directly related buy-side reference is the Safety Light Curtain Cascade Wiring for Multi-Zone Protection guide, which uses a similar gateway-style spec layout for safety devices and is useful for engineers standardising their spec templates across disciplines.