DNP3 · Glossary

DNP3 is an open communication protocol used in telecontrol technology. The name derives from the original designation "DNP V3.00", that is, Distributed Network Protocol in version 3. DNP3 is used by field devices and higher-level control or automation systems to exchange measured values, states, counter values, events and control commands. In the power system, DNP3 primarily connects remote terminal units (RTUs), intelligent electronic devices (IEDs), protection and control devices in the substation and distribution grid automation components with SCADA systems. Outside the power supply sector, DNP3 is also used in the water and wastewater industry, in transport, and in the oil and gas industry.

The roles are typically divided between a master station and an outstation. The master station is usually located in a control centre or in a central automation system. The outstation acquires signals from the plant, processes them and makes them available to the master. These include switch positions, voltages, currents, power values, energy meters, fault signals and status information. In the opposite direction, the master sends commands, for example to open or close a switch, to acknowledge messages or to change setpoints. A single connection can address more than 65,000 devices.

Origin and standardisation

DNP3 was developed from around 1990 by the Canadian manufacturer Westronic, which later became part of GE Harris. It was based on the then still unfinished work of IEC technical committee TC 57 on the IEC 60870-5 series of standards. This is the origin of its lean three-layer architecture (Enhanced Performance Architecture). Functions that were needed above all for North American applications were added. In 1993 the specification was made public. Since then it has been owned by the DNP Users Group, an association of network operators and manufacturers that further develop the protocol, define conformance tests and maintain device profiles.

In 2010, the IEEE adopted DNP3 as standard IEEE Std 1815. The revised version IEEE 1815-2012 contains the security extension Secure Authentication in version 5. According to the DNP Users Group, a further revision process for IEEE 1815 is now under way, and there are also companion standards: IEEE 1815.1 describes the mapping between DNP3 and IEC 61850, and IEEE 1815.2 covers communication with distributed energy resources. Which version is binding in an individual case follows from the tender, the device specification and the conformance certificate.

How it works technically

DNP3 was built for distributed infrastructures with many remote installations. It is intended to work even with low bandwidth, long latencies and intermittently disrupted connections. Originally it mostly ran over serial interfaces such as RS-232 or RS-485 and over radio and leased lines. Today it is often transmitted over IP networks using TCP or UDP. The application layer is object-oriented: there are defined data objects in various variants for binary inputs and outputs, counters, analogue values, time and files. Long messages are segmented, and the individual frames are protected by checksums.

A key feature is event-oriented transmission. Instead of constantly polling every value anew, an outstation can send only the changed data. It buffers changes as time-stamped events and can even report them without being asked (unsolicited response). Static present values are usually assigned to class 0, and events to classes 1 to 3, which can be prioritised and polled differently. In addition there are time synchronisation, broadcast messages and acknowledgements at the data link and application layers. This matters for grid operation, because it is not only the current state that counts, but also the sequence and timing of state changes.

Distinction from SCADA, control systems and other protocols

DNP3 is not a SCADA system but a protocol that can be used within a SCADA or control system environment. SCADA stands for the computer-aided monitoring and control of technical processes via communication networks and operator interfaces. DNP3, by contrast, specifies how certain data are transmitted and interpreted between devices. A network operator can therefore run a SCADA system that uses DNP3 for some installations, IEC 60870-5-104 for others and manufacturer-specific interfaces for still others.

Regionally, its prevalence varies greatly. DNP3 is strongly represented above all in North America, Australia, parts of Asia and Latin America. In Germany and large parts of Europe, by contrast, the telecontrol communication of energy suppliers is predominantly implemented with IEC 60870-5-101 and -104. There, DNP3 tends to appear in internationally procured devices, in industrial and generation plants, or via protocol converters. Both protocol families share common roots but are not compatible with each other.

IEC 61850 is more strongly oriented towards automation within substations and towards a semantically modelled description of electrical equipment. DNP3 is more traditionally anchored in telecontrol communication and works with point-oriented data objects. Modbus has a simpler structure and is widely used in industry, but out of the box offers no event buffering, no time stamps and no spontaneous messages. These differences do not make any protocol fundamentally better. They show for which operating cases, existing installations and integration tasks a protocol is suited.

DNP3 is also not protection technology. Protection devices can exchange messages, measured values or commands via DNP3. The actual protection function, that is, the fast disconnection of a fault, however runs locally with its own protection algorithms and signal paths. DNP3 serves remote monitoring and remote control, not time-critical tripping in the millisecond range.

Significance in the power system

Power grids need information about their state and reliable ways to initiate switching operations. Telecontrol protocols such as DNP3 connect the physical infrastructure with the control centre. Without them, operation would depend on manual reports, local operation or heavily delayed information. In the distribution grid this need is growing, because photovoltaics, battery storage, charging infrastructure and controllable loads create more operating situations in which voltage, loading and switching states must be observed. DNP3 also plays an international role in connecting distributed generation plants, for example to a DERMS.

The temporal quality of the data is also important. When several installations report at the same time, it must remain traceable whether changes occurred simultaneously, one after another, or as a consequence of another switching operation. Time-stamped events and event classes help the control centre to distinguish current process values, stored events and prioritised messages.

Security: Secure Authentication and its limits

Classic DNP3 contains no authentication and no encryption. An attacker with access to the communication path could therefore read, alter or inject messages. As long as DNP3 ran over closed serial lines, the risk was limited. With IP connections, shared networks or remote maintenance access, it becomes a problem for cybersecurity. This does not mean, however, that every DNP3 application is equally risky. What is decisive are segmentation, access controls, protocol variant, monitoring and operating processes.

DNP3 Secure Authentication (DNP3-SA) adds a challenge-response procedure with message authentication codes to the application layer. Version 2 was part of IEEE 1815-2010; version 5 is specified in chapter 7 of IEEE 1815-2012 and is based on IEC/TS 62351-5. SAv5 protects the origin and integrity of messages, especially for critical commands, but does not encrypt the content. Confidentiality requires additional measures such as TLS in accordance with IEC 62351 or VPN tunnels. The DNP Users Group is working on a version 6 with authorisation management and zero-trust approaches.

A secure protocol variant does not, however, make an installation secure automatically. It does not replace a sound network architecture, a role and permission concept, logging or control over remote access. Risks often arise where old installations, new IP connections, service provider access and unclear responsibilities meet. Which legal obligations apply, for example to operators of critical infrastructure, depends on the country, the operator role and the installation class. No such obligations arise from the protocol itself.

Typical misunderstandings

"DNP3 is a minor matter." A protocol determines which data points are available, how events are prioritised and time stamps are handled, and which commands are permitted. An unclear data point list can cause more problems in operation than the choice of transmission medium.
"DNP3 is insecure because it is old." The basic protocol is unprotected, but the risk depends on architecture, security extensions and operational management.
"Two devices support DNP3, so they fit together." Devices support different subsets (subset levels), object variants and time stamp handling. Device profiles, conformance tests and careful engineering remain necessary.

Technical and organisational context

For existing installations, a protocol change is rarely a purely software question. Outstations, telecontrol devices and control systems are often procured for service lives of twenty years or more. A changeover can require gateways, tests, training, data point migrations and acceptance procedures. This is why protocols such as DNP3 remain in use for a long time, even if new installations partly use other standards. The costs lie less in licences and devices than in planning, operational interruptions, documentation of evidence and error prevention.

For security of supply, the availability of communication also counts. If a control centre can no longer see states or can no longer execute commands safely, it must operate the grid more cautiously, send personnel to site or rely on local automatic functions. Buffered events and acknowledgement mechanisms make communication disruptions more manageable, but do not replace an operating strategy for the failure of telecontrol technology. DNP3 is thus neither a plant nor a market instrument, but a communication language of the infrastructure in which measurement, control, responsibility and risk come together.

Sources

Overview of DNP3 Protocol — DNP Users Group; unbekannt (Seite 2026 abgerufen). Abschnitte zu Entwicklung, EPA-Architektur, Übergabe 1993 und IEEE Std 1815; Navigation „1815 Ballot Documents - 2025“, Meldung zu IEEE 1815.2
Features of DNP3 — DNP Users Group; unbekannt. Merkmalsliste und Vergleichstabelle
Zero Trust in DNP3 (White Paper) — DNP Users Group; unbekannt (ca. 2022). Abschnitte zu Secure Authentication und zu den Normen der Users Group
A Formal Analysis of DNP3 SAv5 — Cremers, Dehnel-Wild, Milner (CISPA/Oxford); 2019. Einleitung und Abschnitt zur Protokollbeschreibung
DNP3 Overview — Triangle MicroWorks; 2002-02-22. Seite 1, Geschichte und Merkmale

Related glossary entries

Edited by eCMS on 11.11.2026 19:28