DNP3 is an open telecontrol protocol between a master station (the SCADA) and its outstations (RTUs, gateways, relays and reclosers), standardized as IEEE 1815. It organizes data into groups and variations, separates current values from time-stamped events, prioritizes events in three classes and lets the outstation send changes without waiting to be polled. It runs over serial links and over TCP/IP.
What DNP3 is and its standard
DNP3 (Distributed Network Protocol) is an open SCADA protocol: it carries statuses, measurements, counters and files from remote outstations to the master, and commands and setpoints in the opposite direction. It is maintained by the DNP Users Group, which took over its ownership and development in 1993, and it was adopted as IEEE Std 1815 in 2010. The IEEE 1815-2012 edition replaced the 2010 one; IEEE now marks it as inactive-reserved while the P1815 revision project moves forward, so it is worth checking which edition each specification calls for.
Its architecture is the three-layer EPA (Enhanced Performance Architecture), based on the work of IEC technical committee 57, the same family from which IEC 60870-5 came.
Where it is used and why
It is common at distribution utilities, in water systems and in many reclosers, capacitor bank controllers and feeder relays. Within the substation communications architecture, a gateway or RTU can be a DNP3 master toward the IEDs and a DNP3 outstation toward the SCADA. In the field it travels over radio or cellular inside a VPN. Its comparison with IEC 104, IEC 61850 and Modbus is in IEC 61850, IEC 104, DNP3 and Modbus: which to use.
It is chosen for its efficiency on slow or costly channels: report by exception, time-stamped events stored while the link is down, and implementation levels that allow simple devices and complex masters.
How it works
Data link layer. Each frame starts with two sync octets, length, control, and destination and source addresses, and carries two CRC octets for every 16 data octets. The maximum payload is 250 octets, 292 counting header and CRC. There are 65,520 individual addresses; some are reserved for broadcast messages. Link-layer confirmation is optional and is almost always left off.
Transport layer. A single octet per frame allows long messages to be split and reassembled: each frame carries up to 249 octets of application data.
Application layer. Messages are split into fragments whose size depends on the receiver’s buffer; the normal range is 2048 to 4096 octets.
Data: groups and variations. Each point has an index that starts at zero. Its type and format are identified by a group and a variation. For example, static analog inputs are group 30 (six variations: 16- or 32-bit integer, with or without quality flag, and floating point) and their events are group 32 (eight variations, with or without time). There are equivalent groups for binary inputs, counters, control outputs and analog outputs.
Static data and events. The static value is the current one. An event is a change: a binary that changes state or an analog that exceeds its deadband, with or without a time stamp. Events are assigned to classes 1, 2 and 3; static data forms class 0. The master polls frequently for events and, once in a while, does an integrity poll: classes 1, 2, 3 and 0 in the same message, first the pending events and then all current values.
Unsolicited responses. The outstation can send its events without waiting to be asked. The master enables and disables them with function codes 20 and 21, and must confirm each response.
Controls. With select-before-operate (SBO, function codes 3 and 4), with a maximum time between the two, or with direct operate (code 5) and direct operate no acknowledgment (code 6).
| Function code | Use |
|---|---|
| 3 | Select (SBO) |
| 4 | Operate after select (SBO) |
| 5 | Direct operate |
| 6 | Direct operate, no acknowledgment |
| 20 | Enable unsolicited responses |
| 21 | Disable unsolicited responses |
Time. The master can write the time to the outstation, with one method for serial links that measures the channel delay and another for LAN networks.
Serial and TCP/IP. Over TCP/IP the link frames travel inside TCP or UDP. IANA registers port 20000 for DNP3.
Configuration: concepts
The agreed items are the DNP3 address of the master and of each outstation, the point map (indexes by type), the default variation of each point and of its events, the class of each event, the deadbands, whether unsolicited responses are used and their confirmation times and retries, the control model and time synchronization. All of that is captured in the DNP3 device profile (Device Profile Document), a DNP Users Group format that describes what the device supports. Each manufacturer configures it with its own tool and its own names. How to read the device profile when integrating a DNP3 device is covered in DNP3: How to Read the Device Profile.
Security
Secure Authentication version 5 (SAv5), defined in clause 7 of IEEE 1815-2012, uses challenge and response with a message authentication code (HMAC-SHA or AES-GMAC variants); the outstation treats all control commands and output writes as critical operations that are always authenticated. The next version, developed with working group 15 of IEC committee 57, is published as the DNP3-SL security layer (formerly SAv6): it authenticates all messages, supports encryption, uses X.509 certificates and can coexist with SAv5. It is an implementation of IEC 62351-5. In addition: VPN, firewalls and allowed-address control. How it is configured and tested is covered in secure IEC 104 and DNP3.
Typical problems and diagnosis
- No response: source or destination addresses swapped, or TCP opened on the wrong port.
- Lost events: event buffer full during a long outage, or points with no class assigned.
- Measurements that do not update: deadband too wide.
- Control rejected: time between select and operate expired, or the master uses direct operate and the outstation accepts only SBO.
- Internal indication (IIN) flags: the outstation restart bit (IIN1.7), time needed (IIN1.4) and event buffer overflow (IIN2.3) call for a reaction from the master: clear the restart flag, write the time and do an integrity poll.
Diagnosis is done with captures (Wireshark decodes DNP3), master logs and master and outstation simulators.
Coexistence and migration
DNP3 coexists with IEC 60870-5-104 in gateways that serve different control centers, with Modbus toward meters and auxiliary equipment, and with IEC 61850 inside the substation. Migrating between DNP3 and 104 is not direct: the data model, the classes and the addressing change, so the signal list is redone and tested again. Translation from IEC 61850 is explained in mapping IEC 61850 to IEC 104 and DNP3, and redundancy of the gateway and its links in redundant gateway and links to the control center. Which attacks Modbus, DNP3 and IEC 104 allow by design, and which control mitigates them, is covered in Common Attacks on Modbus, DNP3 and IEC 104 and Fixes.
Testing
The DNP Users Group publishes conformance test procedures for IEDs. In the field: integrity poll, a test of each event and its class, unsolicited responses with link cut and recovery, SBO and direct controls, time synchronization and point-to-point testing with the SCADA.
DNP3 remote configuration and integration with Tiza Group
A recloser or an RTU on DNP3 that does not report the way it should? Our team reviews profiles, point maps and captures remotely, worldwide, with our remote configuration service and does SCADA and gateway integration in medium, high and extra high voltage substations and industry. How DNP3 organises its points and event classes, and when it uses unsolicited reports, is in DNP3: Points, Event Classes and Unsolicited Reports.
Related guides
- IEC 61850 to IEC 104 and DNP3 mapping in the gateway
- Redundant gateway and dual link to the control center
- IEC 61850, IEC 104, DNP3 and Modbus: which to use
- Secure IEC 104 and DNP3: TLS and IEC 62351-3 and -5
- Common Attacks on Modbus, DNP3 and IEC 104 and Fixes
- DNP3: How to Read the Device Profile
- DNP3: Points, Event Classes and Unsolicited Reports
References
- IEEE Std 1815-2012, IEEE Standard for Electric Power Systems Communications – Distributed Network Protocol (DNP3).
- DNP Users Group, A DNP3 Protocol Primer, revision A (2005).
- DNP Users Group, DNP3 Device Profile Guide and IED Test Procedures.
- IEC 62351-5:2023, security for IEC 60870-5 and derivatives (includes DNP3).
Frequently asked questions
What is an integrity poll in DNP3?
It is the reading of classes 1, 2, 3 and 0 in a single request: first the accumulated events and then all current values. The master does it at startup, when communication is restored, or when the outstation reports that it restarted, to leave its database complete and consistent.
Why does SCADA not receive the unsolicited events from a recloser over DNP3?
Check that the master has enabled unsolicited responses (function code 20), that the points are assigned to an event class, that the master's DNP3 address matches the one the outstation expects, and that the master confirms each response. If the confirmation does not arrive, the outstation retries and may stop sending.
Is DNP3 suitable for protection trips between substations?
No. DNP3 is for monitoring and control. Trips between line ends go over teleprotection or high-speed messages such as IEC 61850 GOOSE, with transfer times and security defined for protection.