DNP3 and IEC 60870-5-104 carry event-driven telecontrol data between a control center and remote sites, so design work centers on events, time stamps, and degraded links.
DNP3 and IEC 60870-5-104 are telecontrol protocols. They move monitoring and control data between a control center and remote terminal units or intelligent electronic devices, often over slow, shared, or intermittent links. DNP3 was built for electric utilities and is now common in water, transportation, and oil and gas SCADA. IEC 60870-5-104 belongs to the same telecontrol family. The design questions are about events, time, and link behavior more than raw register access.
This guide compares the two protocols, explains master and outstation behavior, event buffering, time stamps, and link degradation, and ends with a selection table. Edition status matters. DNP3 is documented by the DNP Users Group and published by the IEEE as IEEE 1815, and IEC 60870-5-104 has its own editions and amendments, so confirm the governing document and edition before writing a specification.
Where these protocols fit
Electric utilities use these protocols between a control center and substation computers, remote terminal units (RTUs), and intelligent electronic devices (IEDs). The DNP Users Group reports that DNP3 is also widely used in water and wastewater, transportation, and oil and gas. IEC 60870-5-104 carries the IEC 60870-5-101 application over standard TCP/IP transport. Inside a substation, IEC 61850 usually handles device-level data, so the two worlds meet at a gateway; see substation automation with IEC 61850.
Master, outstation, and the data model
The master station, on the control-center side, requests data from or receives data from an outstation at the remote site. DNP3 is object based. Its application layer defines data objects, variations, and point indexes, and a master can poll an outstation for whole classes of data or for specific object variations. In practice the point list is the contract: each point needs a documented index, scaling, and quality flag.
- Class 0 carries the current static value of every point. Event classes 1 to 3 carry changes, typically grouped by priority.
- IEC 60870-5-104 uses information objects with type identification and cause of transmission. Changes arrive as spontaneous messages.
Polling, report-by-exception, and unsolicited responses
The DNP Users Group lists poll-response, polled report-by-exception, unsolicited responses, and peer-to-peer among DNP3's operating modes. In a poll-only design the master asks for everything on a schedule. That wastes bandwidth and still misses changes between polls. Report-by-exception lets the outstation hold changes until the master collects them, and unsolicited responses let it announce them without a request.
Both protocols need the same discipline. The outstation needs a bounded event buffer, and the master must poll or confirm fast enough that the buffer does not overflow during an outage.
Time stamps and time synchronization
Event time stamps are only as good as the time source behind them. DNP3 and IEC 60870-5-104 both support time-stamped data and time-synchronization functions, but accuracy depends on the outstation clock, the source the master uses, and the path delay. Record the time source for each device, how drift is detected, and how the master treats an event stamped in the future or far in the past.
Test sequence of events, not only averages. Inject a known change at two outstations and confirm that the control center orders them correctly from the recorded time stamps.
Behavior on slow and intermittent links
DNP3 was designed for links of varying speed and quality. Its link layer protects short blocks of data with checksums, its transport function segments larger messages, and it can run over serial, radio, and TCP/IP connections. IEC 60870-5-104 runs over TCP/IP, so it depends on the TCP session and its timers. For a remote site, a link outage is a normal operating state, not an exceptional fault, and the design should show it. See cellular IoT connectivity for the link options that feed these sites.
Design the event path for the outage the site must survive, using the procedure below.
- Size the event buffer for the longest outage the design must survive, with the duration agreed with operations.
- Set event polling rates so a recovering link drains the backlog before events age out.
- Test link loss on a controlled basis and confirm backlog delivery, time stamps, and the stale-data indication.
How they differ from Modbus
Modbus TCP is a register protocol. The meaning of each value lives in a register map, and the master reads registers on request; see Modbus TCP deep dive. DNP3 and IEC 60870-5-104 carry typed data, event classes, and time-stamped changes in the protocol itself. A Modbus poll returns a value but does not say when it changed, unless the device adds that information by convention.
Security options
DNP3 Secure Authentication is a DNP Users Group specification, and its document library includes guidance on implementing it. IEC 62351-5 (2023) defines secure communication for IEC 60870-5 and for protocols based on or derived from it, so it is the reference for securing IEC 60870-5-104. Support and defaults vary by product, so confirm which mechanisms each outstation and master implements and enables, and treat key and certificate management as an operating procedure. Security design belongs in the OT program described in IEC 62443 standards.
Selection guide for telecontrol projects
Use the table to record the choice. Where the installed base already speaks one protocol, the default is usually to keep it and convert only at a defined gateway.
| Decision point | DNP3 | IEC 60870-5-104 | Decision note |
|---|---|---|---|
| Governing document | DNP Users Group specifications; IEEE 1815 (confirm the current edition) | IEC 60870-5-104:2006 with Amendment 1:2016 | Quote the exact edition and profile in the contract |
| Data model | Objects, variations, and classes | Typed information objects with cause of transmission | Write the point list before choosing |
| Event delivery | Polled report-by-exception and unsolicited responses | Spontaneous transmission | Test the backlog path, not only the normal path |
| Transport | Serial, RF, fiber, or TCP/IP | TCP/IP through standard transport profiles | Match the existing radio or network |
| Security options | DNP3 Secure Authentication | IEC 62351-5 profile | Confirm what each device implements |
| Conformance evidence | DNP Users Group test procedures and subset levels | Vendor interoperability documentation | Require the test record, not a datasheet claim |
Apply this to your project
- Record the edition, profile, and subset level for DNP3 or the IEC 60870-5-104 profile in the specification.
- Verify the point list, including indexes, scaling, and quality flags, against each device's documentation.
- Confirm the time source, drift check, and time stamp accuracy for every outstation.
- Test sequence of events by injecting known changes at two outstations.
- Test link loss and recovery, and record backlog delivery and the stale-data indication.
- Document which security mechanisms are enabled, who holds the keys, and how they are rotated.
Follow an ASP project guide to connect the fundamentals with implementation and acceptance.
Frequently asked questions
Is DNP3 better than Modbus TCP for remote sites?
Not in general. DNP3 adds event classes, time-stamped changes, and unsolicited responses, which suit remote sites with intermittent links. Modbus TCP is simpler and widely supported for local device access. Choose by data model, event needs, and what the control center supports, and document the register map if Modbus is used.
Does IEC 60870-5-104 replace DNP3?
No. Both are telecontrol protocols with overlapping purposes, and the choice depends on the installed base, the control center, and the utility's specification. Many systems keep one protocol on the RTU link and convert at a gateway. Any conversion must preserve time stamps and quality flags, so make that a test item.
What is report-by-exception in DNP3?
It is a mode in which the outstation reports changes rather than waiting for the master to ask for them. In polled report-by-exception the master collects buffered events on its own schedule, and unsolicited responses let the outstation announce them. Event objects can carry time stamps, so the control center can order changes even after a delay.
Is DNP3 Secure Authentication enough for an RTU?
Not by itself. It addresses authentication of messages between master and outstation, but it does not replace network segmentation, access control at the remote site, firmware control, or key management. Pair it with the measures in your OT security program, and confirm which features each device implements.
Continue the engineering work
- Substation Automation with IEC 61850: An Engineering Overview
- Modbus TCP/IP Protocol: Deep Dive
- Cellular IoT Connectivity for Industrial Assets
- SCADA System Architecture and Design Patterns
- Water and Wastewater Treatment Automation
Browse the related technical library or follow an ASP project guide to plan the implementation sequence.
Primary references and further reading
Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results.