Protocol Analyzer — MMS, GOOSE, SV and IEC 60870-5-104, byte by byte

When a channel "occasionally drops a point", this is the tool that tells you which side did it.

A message-level diagnostic tool for substations, telecontrol networks and industrial sites. It turns "the protocol is invisible" into "every byte is readable": link frame, APDU, ASDU and information object are expanded layer by layer, next to a timing diagram and an anomaly list, for commissioning, acceptance, fault reproduction and misoperation analysis.

What it is used for

Before energisation: GOOSE and SV commissioning, including interlocking logic verification. During operation: locating the root cause of a 104 channel that occasionally interrupts, avalanches or loses points. During maintenance: chasing missing events and failed disturbance recalls on a 103 protection information substation.

Equipment vendors also use it before shipment, as a self-check on protocol behaviour, and as a teaching aid — a decoded conversation is a far better explanation than a clause reference.

• Via 61850: MMS read/write, reporting, settings and file services; GOOSE subscribe/publish with stNum/sqNum tracking; SV; SNTP/PTP time sync
• Via 104: complete ASDU decoding, with k/w window and t1/t2/t3 state made visible
• Anomalies graded by severity: frame interval timeout, sequence jump, stNum/sqNum anomaly, declared length versus actual bytes, negative acknowledgement, duplicate message, ASDU type inconsistent with the link role

On "whose fault is it"

The tool does not pronounce a verdict. It produces the timing and the anomaly entries — response timeouts, discontinuous sequence numbers, quality-bit anomalies, model mismatches — and marks the suspect end so both parties argue from the same evidence. Definitive attribution still comes from comparing captures taken on both sides over the same interval, and the export makes that comparison straightforward.

Frequently asked