The short answer
DNP3
DNP3, standardized as IEEE 1815, is the protocol utilities use between a SCADA master and remote outstations. Unlike Modbus, it lets the outstation report changes as time-stamped events, on its own initiative, so a master over a slow radio or cellular link learns what happened and when without polling every point every cycle. It defines the data types, the event classes, the polling model, and, in its secure authentication extension, how the two ends prove who they are.
Key points
- The master polls; the outstation answers, and can also send unsolicited events when something changes.
- Class 0 is a snapshot of everything; classes 1, 2, and 3 are events queued by priority since the last poll.
- Events carry the outstation timestamp, so a sequence of events survives a slow link and arrives in order.
- DNP3 runs over serial links and over TCP, and the same point map works on both.
- Secure Authentication adds cryptographic proof of identity; without it the protocol trusts whoever is on the wire.
Why it exists
A distribution utility has hundreds of remote sites on radio links that carry a few kilobits per second. Polling every point at every site every few seconds is impossible on that bandwidth, and a protocol that can only answer questions cannot tell the master that a breaker tripped between polls, or when. DNP3 was written for that problem: let the outstation keep a queue of what changed, with timestamps, and hand it over efficiently when the master asks or when the change is urgent enough to send unasked.
Water and wastewater SCADA inherited it from the electric utilities for the same reasons. A lift station on a licensed radio channel, reporting pump starts and high level alarms to a master at the plant, is the case the protocol was made for.
Master and outstation
The master is the SCADA host or a data concentrator. The outstation is the RTU or the PLC at the remote site. The master initiates: it polls for data, sends controls, and sets time. The outstation responds, and may also initiate an unsolicited response when configured to. Each outstation has an address, each master has an address, and a message carries both, which lets one channel serve many outstations and lets an outstation refuse a master it does not know.
Static data and events
- Static data, class 0
- The current value of every point: binary inputs, analog inputs, counters, binary and analog outputs. An integrity poll requests class 0 and gets the whole picture. It is expensive on a slow link and it is done at startup and at a long interval.
- Event data, classes 1, 2, and 3
- When a point changes by more than its configured deadband, or a binary point changes state, the outstation queues an event with the value and its timestamp. Each point is assigned a class, so that a high level alarm can be class 1 and a slowly drifting temperature class 3. The master polls the classes at different rates, and gets only what changed.
- Unsolicited responses
- For events that cannot wait for the next poll, the outstation sends them without being asked. The master acknowledges. Which classes are unsolicited, and how long the outstation waits to group events before sending, is configured per outstation.
Controls
Outputs are operated with a select-before-operate sequence: the master selects the point, the outstation confirms, the master operates, the outstation acts and confirms. Two round trips, and a misdelivered or corrupted operate cannot move the wrong point. Direct operate skips the select for points where the extra safety is not needed. Pulse controls, with on and off durations, are part of the protocol, which is why a remote breaker or a pump start can be commanded without the master managing the timing.
Transport
DNP3 was written for serial links and it still runs over RS-232 and RS-485 to radios and modems. It also runs over TCP and UDP on Ethernet and cellular, on port 20000 by convention, with the same messages inside. A migration from radio to cellular is often a transport change and nothing else at the application level. The link layer has its own addressing and error checking, which is part of why it works on noisy channels that would corrupt Modbus frames.
Interoperability and the device profile
Two DNP3 devices can both be compliant and still not talk, because the protocol allows many optional features. Each device publishes a device profile that says which it supports: which data types, which variations, whether it does unsolicited, what time synchronization method it uses. Comparing the outstation profile against the master profile before purchase is the difference between an afternoon of configuration and a month of finger pointing. The subset levels, one through four, are a shorthand for what a device supports.
Security
Base DNP3 has no authentication. Anyone who can reach the channel can send a control. DNP3 Secure Authentication, version five in the current standard, adds a challenge and response with shared keys or certificates so the outstation can prove a control came from its master. It is supported by most current RTUs and masters and it is rarely turned on. On a cellular link that terminates on a public network, it should be, along with the VPN the cellular pages describe.
Frequently asked questions
- What is the difference between DNP3 and Modbus?
- Modbus is a question and answer protocol with no timestamps and no events; the master learns only what it polls, when it polls. DNP3 lets the outstation queue time-stamped events and send them unasked, which is what a slow, shared, or intermittent link needs. Modbus is simpler; DNP3 is built for telemetry.
- What is an integrity poll?
- A request for class 0, the current value of every point, plus the queued events of the other classes. It gives the master a complete, consistent picture. It is done at startup, after a communication outage, and at a long interval, because it is expensive on a slow link.
- Why do my events arrive with the wrong times?
- The outstation clock is wrong. Events carry the outstation timestamp. The master has to set the time on the outstation regularly using the protocol time synchronization, and the outstation has to keep it between syncs.
- Does DNP3 run over Ethernet?
- Yes, over TCP or UDP, on port 20000 by convention, with the same application messages as the serial version. Radio, cellular, fiber, and leased lines all carry it.
Related topics
- Modbus RTUSerial Modbus over RS-485: function codes, register addressing, the off-by-one that catches everyone, and the physical layer details that decide whether a bus is stable.
- Serial CommunicationsRS-232, RS-422, and RS-485 in practice: which is which, cable and distance, termination, biasing, the common reference wire everyone leaves off, and the settings that have to match at both ends.
- Protocol GatewaysProtocol converters between a controller and devices that do not speak its language: what a gateway does, the common pairings in water and wastewater, the mapping table that is the whole configuration, the failure modes a gateway adds, and when to use a native interface instead.
- Remote Site Stops CommunicatingOne radio site silent while its neighbors answer: site power, the radio, antenna and coax after a storm, a reset configuration, the controller behind it, or a changed path. What the master diagnostics say before anyone drives, and the order of checks on site.
- Water and Wastewater Utility Threat LandscapeWhat has actually happened at water utilities, what those incidents had in common, and the small number of controls that would have prevented most of them.
- Modbus TCPModbus over Ethernet: what the MBAP header changes, why the CRC disappears, how the unit identifier works, and what does not get easier just because it is on Ethernet.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.