Downloads

ABB RP570: Select-Before-Operate waits for the select to be confirmed before sending Execute.

Select-Before-Operate is no longer offered where the protocol lacks it: IEC 60870-5-103, and IEC 60870-5-104 bitstrings.

Select-Before-Operate: Adjustable delay before Execute, and a new Cancel selection command.

IEC 60870-5-101: Control menu in Address Tracking.

Import, export and playback: Faster, more reliable capture imports and playback, including compressed PCAP/PCAPNG files and captures without an Ethernet header, with playback that follows the recorded timing. Improved CSV handling, preserved signal links and multiline recording comments, and Excel imports that read stored formula results and flag missing values. Cancelled imports recover cleanly; failed saves and exports preserve the previous file.

Reliability and performance: Smoother, faster capture, grids and charts with lower memory use during long sessions, with a choice of how much history to keep and a memory safety valve. Safer recording, start/stop and shutdown, and clearer recovery from serial-monitor and network-adapter failures. Charts handle invalid readings more safely, and recording errors are reported instead of silently stopping.

IEC 60870-5-104: Secure Authentication keeps 2013 compatibility as the default, with strict mode as a saved opt-in, and user roles follow the IEC TS 62351-5 permission table. Session-key renewal adapts to supported peer formats, and monitoring learns session keys from observed key changes, so authentication codes are verified without SerialMon taking part.

IEC 60870-5-102: Expanded message decoding, time tags read in the IEC 60870-5-102 layout, correct signed counter readings, signature handling and clearer reporting of malformed requests. Control Center and IED mode follow the class 1 and class 2 polling procedure, and clock synchronization uses the REE/SIMEL layout. Address Tracking keeps points apart by station and record, with a tree grouped by metering address.

IEC 60870-5-103: Corrected measured values and quality flags, with expanded device identification, disturbance-record decoding and generic data shown in full. Multi-drop lines are checked per station, and the Control Center keeps commands queued while a relay is busy. IED mode answers the generic read and write services and handles larger generic-data replies more reliably. Address Tracking adds a tree grouped by function and information number.

Control Center and IED operation: More reliable interrogation, command confirmations, select-before-operate, clock synchronization and recovery from communication failures. Common device variations are tolerated with clear diagnostics, and saved commissioning options cover equipment that deviates further; invalid or unauthorized commands remain refused. IEC 60870-5-104 explains failed sessions and refused requests, and adds local, UTC and UTC+1 time references and clearer timeout handling.

ABB SPA-bus and SPA/TCP: More reliable polling, retries and file transfer, decoded events and alarms, broadcast writes and clearer refusal messages. Replies are paired with their requests more reliably, and IED mode serves event and alarm reads as a relay does. Written values update only after acknowledgement. TCP connections show individual request and error counters, with improved stability during extended monitoring.

GNSS: Expanded receiver and AIS message decoding, with u-blox message names and the manufacturer behind proprietary sentences, and checks for malformed sentences, invalid coordinates and incomplete messages that can be switched on and off as for the other protocols. Short position messages are handled correctly.

Time and time synchronization: More reliable network time synchronization with wider server compatibility, including an NTP version choice for legacy servers and a notice when Windows refuses a clock change. Expanded clock-telegram decoding, including Hopf 6021 and Trimble TSIP and TAIP, with timestamp checks. RFC 868 Control Center and IED mode work over UDP, and IED replies also over serial connections.

Packet views: Hover over Raw and Parsed packet column headings for explanations of their contents, including protocol-specific fields.

Statistics, Oscilloscope and Graphic analysis: Statistics keeps your zoom during a live capture with a Follow button and draws all series on one capture timeline, and chart tooltips show the nearest data point. The Oscilloscope gains a time range slider with presets and a choice of received or protocol time, and Graphic analysis explains its options in tooltips.

Connections and capture: UDP modes, named profiles, hostnames and IPv6 support, plus clearer TCP client and network monitor diagnostics. Serial handshake settings are applied, and a new tool identifies ABB SPA-bus, ABB RP570 or IEC 60870-5 FT1.2 traffic on a serial line. Improved packet reassembly, capture-loss reporting and handling of PRP/HSR network redundancy, with more robust capture of fragmented or malformed traffic.

Installation: SerialMon now needs an x64 processor with x86-64-v2 support (SSE4.2 and POPCNT), or Windows 11 on ARM64 with x64 emulation. Windows 10 version 1607 is still the minimum, and the runtime is still included.

Bug reports: More useful crash details and exact build information help troubleshooting. Reports can be saved and retried reliably, including during fatal errors, with limits and filtering on collected diagnostic data.

IEC 60870-5-104: TLS and Secure Authentication with certificate tools, key management, user permissions and protection against replayed commands. TLS follows IEC 62351-3:2023 with separate Control Center and IED certificates, and an opt-in legacy TLS stack and commissioning options serve older RTUs. TLS connections and RSA-based monitor decryption require a purchased license.

Anomaly detection and security monitoring: A dedicated Anomalies window with severity, filters, muting and retention limits, plus passive authentication and TLS checks. More accurate checks reduce false alarms, delayed findings survive connection resets and packet rows highlight the most severe finding. IEC 60870-5-104 also checks transport timers, and a Commissioning (FAT/SAT) profile keeps routine tests from being reported as attacks. Anomaly detection remains a beta feature.

IEC 60870-5-101 and IEC 60870-5-104: File-directory browsing and downloads, IED-side file serving, counter interrogation, parameters and regulating-step commands. File transfers handle large files and interrupted exchanges more reliably, with clearer failure reporting, and each downloaded file is stored under its station. IEC 60870-5-101 adds balanced point-to-point links in monitoring, Control Center and IED mode.

IEC 60870-5-104: With an SvK license, IED mode can be set to Svenska kraftnät's TR02-04-04E guidelines in one step, including the UTC+1 time reference they require, after a list of the settings that change.

ABB RP570: Routed telegrams, automatic integrity scans after startup or restart, long telegrams and improved IED responses, plus corrected decoding of negative readings. Analog limit zones, RTU status and pulse counters from older RTUs are read and sent correctly, and new anomaly rules cover the polling dialogue, sequence numbers and lost events. Commands from Address Tracking go to the command object linked by the RTU560 import.

Address Tracking: Accepted markers, favorites and snapshots with change highlighting, a filter bar with value-activity and Hide analogs filters, Back and Forward navigation and quality tooltips, plus improved command menus, signal links, Events and Alarms handling. View > Sort by orders every view by address, signal list, last received, quality, number of changes, value or arrival, in either direction. Large signal lists are more responsive, tree filters and exports are more reliable, and editing signal properties preserves incoming live readings.

Address Tracking: A Grid view shows every tracked address as a tile coloured by its quality, using the IEC 60870-5-101, IEC 60870-5-102, IEC 60870-5-103 and IEC 60870-5-104 quality flags and the ABB RP570 alarm and warning zones. Tiles pulse when a value changes and can be sorted, zoomed and filtered.

Events and Alarms: An event panel beside the newest rows shows new events and alarms one at a time in large text, with quality and signal-list warnings, and can be detached to a second screen. Menu-bar quick toggles, Locate from a row to its Address Tracking entry, packet, alarm or event, and tinting of the selected address's other events were also added.

Main window: A timeline shows Raw or Parsed packets traffic second by second, with a miniature in the status bar of Events, Alarms and Address Tracking. Closing with an unsaved capture asks to save it. Quick toggles, linked selection between Raw and Parsed packets, opt-in global hotkeys and release and beta update channels were also added.

IEC 60870-5-103: IED General Interrogation response now scoped to the requested slave address only — previously all configured addresses were returned regardless of which slave was interrogated

IEC 60870-5-101: IED now discards frames with invalid checksum instead of processing them

IEC 60870-5-101: IED now echoes the correct QOI byte in GI actcon/actterm/deactcon responses

IEC 60870-5-101: IED counter interrogation deactivation (COT=8) now receives a deactcon instead of being rejected

IEC 60870-5-101: maximum variable-frame payload length corrected from 253 to 255 bytes

IEC 60870-5-102: IED counter interrogation data now sent with COT=37 instead of COT=20

IEC 60870-5-102: IED actterm for CI command types 120–123 now correctly applies to all integrated-total families

IEC 60870-5-102: Control Center now recognizes actterm for command ASDU types 104–123

Communication interfaces: TCP server now disposes IEC 104 session context on client disconnect, preventing resource leaks

Address Tracking: deleting a slave now fires correct removal events for each child address

IEC 60870-5-101: IED dirty-address tracking is now per-connection so multiple simultaneous sessions no longer interfere

IEC 60870-5-104: STOPDT handshake is now initiated and awaited before closing connection, preventing loss of in-flight data

IEC 60870-5-104: IED dirty-address tracking is now per-connection; GI/CI status fields show live values

IEC 60870-5-104: IED logs CP56Time2a timestamps from timed command variants to the comment stream

IEC 60870-5-104: settings now warn when w exceeds ⅔ of k, as recommended by the standard

ABB RP570: IED dirty-address tracking is now per-connection

Address Tracking: snapshot — take a point-in-time snapshot of all tracked addresses and compare live data against it, with color-coded highlighting for changed rows and phantom entries for removed addresses

Address Tracking: timestamp sanity check — timestamp column cells are highlighted when the protocol timestamp differs from the received time by more than a configurable threshold

Events: timestamp sanity check with configurable threshold highlighting

Alarms: timestamp sanity check with configurable threshold highlighting

If Quality (Flags) changes will also send to Events

Events can be set as suppressed from Events window

Alarms can be set as suppressed from Alarms window

New setting to disable Events when Quality/Timestamp changes

PCAP import/export could leak file handles and produced unnecessary memory spikes for gzip files

Packet-builder queue could accept null or empty commands silently

IEC 60870-5-101: Control Center was not using the configured link address when sending requests

IEC 60870-5-101: Responses were accepted regardless of link address — incoming frames are now filtered by the configured link address

IEC 60870-5-101: IED mode did not properly execute many control commands — single, double, regulating-step, bitstring, and setpoint commands now behave correctly and return the expected confirmations

IEC 60870-5-101: Link handling mixed up two reply codes during polling — communication state and "no data" responses are now interpreted correctly, improving poll stability

IEC 60870-5-101: Protection-event ASDUs M_EP_TD_1, M_EP_TE_1, M_EP_TF_1 showed incorrect timestamps — CP56 time is now formatted correctly

IEC 60870-5-101: CP56 time parsing could throw for invalid date components — invalid dates now return a safe fallback instead of crashing

IEC 60870-5-101: FT1.2 payload limit of 253 bytes was not enforced — oversized frames are now rejected in CC, IED, and the command builder

IEC 60870-5-101: Link address width was handled inconsistently across the code — now normalized everywhere

IEC 60870-5-102: IED mode only sent an ACK instead of actual counter data — IED now builds and returns real IEC102 data ASDUs from tracking objects

IEC 60870-5-102: Sunday was encoded as 0 in CP56 day-of-week — corrected to 7 per protocol specification

IEC 60870-5-102: COT negative and test flags were not retained during packet parsing

IEC 60870-5-102: Parser could go out of range for ASDU types above the table limit

IEC 60870-5-103: Multi-object ASDUs with SQ=0 (sequential) were not parsed correctly — INF now increments for sequential objects and per-object FUN/INF pairs are read for SQ=1 (individually addressed)

IEC 60870-5-103: IEC103 tracking and tracer-creation used inconsistent address representations — now uses a unified packed FUN/INF address throughout

IEC 60870-5-103: IED mode only sent ACK instead of real data — IED now builds and returns actual IEC103 variable-frame ASDUs from tracking objects

IEC 60870-5-103: Frames were not checksum-validated before dispatch in IED mode

IEC 60870-5-103: Sunday was encoded as 0 in time-sync commands — corrected to 7

IEC 60870-5-104: 15-bit sequence number wrap was not handled correctly — sequence numbers now wrap at 0x7FFF as required

IEC 60870-5-104: TESTFR state was lost after a TESTFR exchange — previous state is now saved and restored correctly

IEC 60870-5-104: STARTDT used t1 timeout instead of t0

IEC 60870-5-104: W-window check used simple linear comparison, which failed across 15-bit wrap boundaries — now uses modulo-safe arithmetic

IEC 60870-5-104: U-format frames (TESTFR, STARTDT, STOPDT) were incorrectly modified by FixSeqNo

IEC 60870-5-104: Fragmented TCP frames were re-read from the wrong source buffer during reassembly

IEC 60870-5-104: Execute-without-select was silently ignored for most command types — now returns a proper negative actcon

IEC 60870-5-104: Invalid DCO (double command) and RCO (regulating step) values 0 and 3 were accepted — now rejected with negative confirmation

IEC 60870-5-104: GI and CI requests used hardcoded originator address 0 instead of the configured value

IEC 60870-5-104: Command builder used hardcoded originator address 0

IEC 60870-5-104: S-format APCI was constructed incorrectly in the packet builder

IEC 60870-5-104: Graph 1 help boxes used the Graph 3 color scheme

IEC 60870-5-104: Signed BCR (binary counter reading) values were displayed as unsigned

ABB RP570: IED mode decoded frames with its own offset logic instead of using the shared parser — IED now uses the canonical RP570 decode path

ABB RP570: CC response detection read from the wrong byte index (RTU byte instead of FCODE byte)

ABB RP570: GOM tracking objects were created with the wrong type (SPM instead of GOM)

ABB RP570: SPM/GOM IED emulation sent no reply when the target address was not found — now returns NXR

ABB RP570: Tracking and text analysis could crash on truncated payloads for AVM, DVM, PCM, DVL, PCT, SPM, GOM, ERMD, ERMI, ERMC, CBXC, EXC, IHC — bounds checks added throughout

ABB RP570: Command builder silently truncated object numbers above the 11-bit limit — now throws an explicit error

ABB RP570: IDM split menu visibility was based on fragile name-string parsing — now uses type-based check

ABB SPA-bus: SPA reply sending was broken by the shared framework — IED and CC replies are now correctly transmitted

ABB SPA-bus: Request-state tracking used a fixed 1000-entry array — replaced with a dictionary to handle any slave identifier safely

ABB SPA-bus: Non-numeric or out-of-range slave identifiers could cause an exception during tracking

ABB SPA-bus: Request state was not cleared when re-opening a session — stale entries from a previous session no longer affect the next one

IEC 60870-5-102: Incoming frames were not checksum-validated in IED mode

IEC 60870-5-103: Type 1 and Type 2 event values now include Relative Event Time (RET) and Fault Number (FAN) where present

IEC 60870-5-103: IEC103 custom columns now have correct labels matching the displayed data (Address, Flow, FC, ASDU, COT, FUN, INF)

IEC 60870-5-104: Value text added for clock sync (C_CS_NA_1), delay acquisition (C_CD_NA_1), and parameter ASDUs

ABB RP570: Command-response matching for CBR is now object-aware; EXR/NXR fallback uses oldest pending command by time

ABB RP570: ERMA, ERMD, ERMI text output now includes sequence number and time-quality information

IEC 60870-5-101: IED mode now responds to counter interrogation (C_CI_NA_1), read (C_RD_NA_1), clock synchronization (C_CS_NA_1), test (C_TS_NA_1), and delay acquisition (C_CD_NA_1) commands

IEC 60870-5-101: CC now logs when the slave reports link service not functioning (FC=14) or not implemented (FC=15)

IEC 60870-5-102: Counter interrogation now covers the full IEC102 CI command family (types 104–123) instead of only type 104

IEC 60870-5-102: Single-point read workflow added: CC and IED now support C_SP_NA_2 and C_SP_NB_2

IEC 60870-5-102: Data Flow Control (DFC) is now respected — CC pauses sending when the slave signals busy

IEC 60870-5-102: CP56 timestamps are now extracted and shown for time-tagged IEC102 packets (M_SP_TA_2, M_TI_TA_2)

IEC 60870-5-102: Command builder now selects the correct CI variant and single-point command type based on the tracking object

IEC 60870-5-103: CC now prioritizes Class 1 polling when the slave signals ACD (has Class 1 data available)

IEC 60870-5-103: CC and IED now filter frames by the configured IEC103 link address (broadcast 0xFF is always accepted)

IEC 60870-5-103: Reserved control bit (bit 7) violations in received frames are now rejected

IEC 60870-5-103: Negative confirmation (COT=21) is now logged when the slave rejects a command

IEC 60870-5-104: New configurable settings: Originator Address, Allow Clock Sync, Require Select-Before-Operate (SBO)

IEC 60870-5-104: Preference panel now warns when t2 ≥ t1 or w > k

IEC 60870-5-104: APDU length is now validated (minimum 4, maximum 253 bytes)

IEC 60870-5-104: Clock synchronization (C_CS_NA_1) is now gated by the Allow Clock Sync setting — disabled by default

IEC 60870-5-104: Delay acquisition correction (C_CD_NA_1) is now applied when processing subsequent clock sync commands

IEC 60870-5-104: Select-before-operate redesigned with 30-second SBO timeout and per-address tracking

IEC 60870-5-104: Parameter ASDUs (110–112) and file-transfer types (120–127) now return explicit "unsupported type" negative confirmations

IEC 60870-5-104: Originator address validation: non-zero configured OA rejects mismatching incoming ASDUs

IEC 60870-5-104: GI retry logic: CC retries general interrogation up to 3 times on timeout before proceeding to counter interrogation

IEC 60870-5-104: Row coloring: slave-to-master frames are shown in white, master-to-slave in light gray

IEC 60870-5-104: Control format decoding: I/S/U format is now clearly shown in packet details (e.g., NS=x NR=y, STARTDT.act, TESTFR.con)

IEC 60870-5-104: Protection-event ASDU types (17–19, 38–40) and control types C_TS_NA_1 / C_CD_NA_1 added to the packet table

ABB RP570: IED now rejects frames with invalid checksums before processing

ABB RP570: CC now validates checksums for both fixed and variable frames before updating state

ABB RP570: IED now has explicit response behavior for FTAB and TDC commands

ABB RP570: IED now validates TSI payload length: short payloads receive NXR, valid payloads receive EXR

ABB RP570: SCI rearm now triggers after a configurable inactivity timeout (5 minutes)

ABB RP570: PMRV tracking now decodes individual block/value pairs instead of only a summary event

ABB RP570: Truncated packets now show explicit [TRUNCATED] markers in text analysis instead of risking index overruns

ABB SPA-bus: Incoming SPA frame checksums are now validated; frames with incorrect checksums are flagged; XX checksum bypass is supported

Auto-reconnect now works again

Proper IEC 60870-5-104 implementation for master and slave

Full support for ABB RP570 protocol, including ERMI

Performance improvements

IEC 60870-5-101 support for both master and slave, in addition to monitoring

IEC 60870-5-102 support for both master and slave, in addition to monitoring

Full IEC 60870-5-103 support for monitoring, master and slave

New automatic visual indication of events with time gap, to simplify finding new events

New event popup to indicate new events with clear message

Proper warnings if IEC 60870-5-10x messages are wrong or invalid

Mark tested signals as Accepted for easy FAT/SAT testing

Quick sending of Single/Double commands to client from tracking window (context menu)

Change visible columns (right mousebutton on header)

Playback function was broken, now working again

Improved performance for loading SerialMon MON-files

Updated components

New window for import of RTU560 Excel file, where columns can be selected manually (with preview)

Updated components

Cleanup of deprecated components

IPv4-scanner: Updated manufacturer MAC-database

Changes highlighted in grids