# Free IEC 104 Simulator: Client and Server

> What an IEC 60870-5-104 simulator does, when you need a server (RTU) simulator versus a client (master) simulator, and how to test a SCADA master or a real RTU step by step with a free IEC 104 tester.

Kaynak: https://ranaliz.com/en/blog/iec-104-simulator-free · Yazar: Ahmet Korkmaz · Güncelleme: 2026-10-19


**An IEC 104 simulator stands in for one side of an IEC 60870-5-104 link so you can test the other side without the real equipment. A server (RTU) simulator pretends to be the outstation and answers a real SCADA master. A client (master) simulator pretends to be the SCADA and queries a real RTU.** Most commissioning projects need both. This guide explains the protocol in brief, then shows how to use each simulator step by step.

## IEC 104 in one table

IEC 104 carries telecontrol messages between a master and an outstation over TCP, by default on port 2404.

| Term | Meaning |
|---|---|
| **Master / client** | The side that asks for data: SCADA, gateway |
| **Outstation / server** | The side that provides data: RTU, substation or plant controller |
| **Common Address (CA)** | Station address of the ASDU; must match on both sides |
| **IOA** | Address of each point (3 bytes in IEC 104) |
| **Type ID** | What the point is: single point, double point, measurement, command |
| **COT** | Cause of transmission: periodic, spontaneous, interrogated, command confirmation |
| **GI** | General interrogation: “send me everything” (C_IC_NA_1) |

## How a session runs

1. The master connects to the outstation on **TCP 2404**.
2. The master sends **STARTDT act**; the outstation replies **STARTDT con** and data transfer begins.
3. The master sends a **general interrogation** (C_IC_NA_1, type 100). The outstation replies with a confirmation (COT 7), every point (COT 20), then a termination (COT 10).
4. From then on, changes arrive **spontaneously** (COT 3).
5. When idle, both sides exchange **TESTFR** frames to keep the link alive.

## Server simulator or client simulator?

| You want to prove… | Use | It replaces |
|---|---|---|
| The SCADA / gateway decodes points correctly | **Server (RTU) simulator** | The RTU |
| The RTU sends the right points and accepts commands | **Client (master) simulator** | The SCADA |

The server simulator matters most early in a project. The SCADA or grid operator side can validate the agreed point list while the site is still under construction. Most mapping mistakes show up in the lab, before anyone drives to site.

## Step by step: test a master with an RTU simulator

1. **Prepare the point list.** CA, plus the IOA and type ID for every point. This is the document agreed between the RTU vendor and the SCADA side.
2. **Start the simulator.** In server mode, define the CA and points and listen on port 2404.
3. **Point the master at it.** Change the master’s target IP to the machine running the simulator. Port 2404 must be open in the firewall.
4. **Check the GI response.** Every point should appear in the master with the right name and value.
5. **Change a value.** Change a measurement or status in the simulator and confirm the master receives the spontaneous update.
6. **Send a command.** Issue a command from the master and confirm it reaches the right IOA in the simulator.

## Step by step: test a real RTU with a client simulator

1. Connect to the RTU’s IP on port 2404. If the RTU only accepts configured master IPs, have your laptop’s IP added.
2. Send a GI and compare the returned points with the point list.
3. Check type IDs. A float expected where a scaled value arrives will be off by powers of ten.
4. Try commands on a disconnected or test object first.

The full protocol-level procedure (STARTDT, timers, COT values, failure table) is in [how to test an IEC 104 connection](https://ranaliz.com/en/blog/how-to-test-iec-104-connection).

## Common types to put in your point list

| Type ID | Short name | Typical use |
|---|---|---|
| 1 | M_SP_NA_1 | Single point: alarm, status bit |
| 3 | M_DP_NA_1 | Double point: breaker open/closed |
| 13 | M_ME_NC_1 | Measured value, float: power, voltage, current |
| 30 / 31 / 36 | …_TB_1 / …_TF_1 | Time-tagged status and measurements |
| 45 | C_SC_NA_1 | Single command |
| 46 | C_DC_NA_1 | Double command: breaker open/close |
| 50 | C_SE_NC_1 | Set point, float: power limit |

## Free IEC 104 simulator options

| Option | Type | Notes |
|---|---|---|
| **Ranaliz iOT Tester** | Desktop app, client + server | Free, MIT source, Windows and macOS. Also Modbus and MQTT |
| **FreyrSCADA simulators** | Desktop apps, separate client and server | Commercial; evaluation versions available |
| **lib60870 examples** | C library with sample programs | Good for developers; needs compiling |
| **Python simulators (c104 and others)** | Scripts | Flexible, but you write the point list in code |

Check each project’s current license before using it commercially.

## Ranaliz iOT Tester: IEC 104 client and server in one app

[Ranaliz iOT Tester](https://ranaliz.com/en/product/iot-tester) is a free desktop app that runs both IEC 104 modes:

- **Client:** connect to an RTU, run a general interrogation, watch live point updates and write commands.
- **Server:** an RTU simulator with points you configure, plus start and monitor controls.

Point types include M_SP, M_DP, M_ME, C_SC, C_DC, C_SE and others. The same app also has a Modbus tester (TCP/UDP/RTU) and an MQTT client. That makes it easy to test both sides of a Modbus-to-IEC-104 gateway from one laptop. Ready builds exist for Windows 10/11 and Apple Silicon macOS, and the source is on GitHub under the MIT license.

## FAQ

### Is there a free IEC 104 simulator?

Yes. Ranaliz iOT Tester is free and includes both a client and a server (RTU) simulator. Library examples such as lib60870 are free too but need building. Most commercial simulators are free only as time-limited evaluations.

### What port does IEC 104 use?

TCP 2404 by default. Some installations change it, so check the outstation configuration.

### Can I test a SCADA master without the real RTU?

Yes. Run an RTU simulator with the agreed point list and connect the master to it. Mapping and command errors usually show up there first.

### What is the difference between IEC 101 and IEC 104?

IEC 101 runs over serial links. IEC 104 carries the same application layer over TCP/IP, normally with a 2-byte Common Address and a 3-byte IOA.

## Sources

- IEC 60870-5-104 — Network access for IEC 60870-5-101 using standard transport profiles
- IEC 60870-5-101 — Companion standard for basic telecontrol tasks