DNP3 protocol and IEC 60870-5-104 are the two dominant SCADA protocols between master stations, RTUs, and IEDs in electric utility and infrastructure automation.
Both were designed for the same job — reliable data acquisition and control over long-distance or unreliable links — but took different engineering paths.
This guide explains how each protocol works, compares their architecture and data models, and shows when to choose one over the other.
DNP3 protocol dominates North American electric utility SCADA deployments. IEC 60870-5-104 dominates European and international markets.
Both emerged from the IEC 60870-5 document series and solve the same problem: reliable process data transfer between a control centre and field devices over a network not designed for real-time traffic.
DNP3 Protocol and IEC 60870-5-104: Common Origin, Different Evolution
Both DNP3 and IEC 60870-5-104 trace their origins to IEC 60870-5. That series defined a three-layer architecture — physical, data link, and application — without a full OSI stack.
DNP3 was developed in 1993 by GE-Harris Canada from the partially completed IEC 60870-5 draft specifications, because IEC standardisation was too slow for the commercial need.
IEC 60870-5-104 was standardised later as the TCP/IP transport variant of the serial IEC 60870-5-101 protocol.
The DNP Users Group later shortened the name to "DNP3" specifically to remove the version-number implication — signalling that the protocol would not keep incrementing to DNP4 or DNP5. There has never been a DNP 3.1, DNP 4.0, or any successor version name.
The protocol does happen to use a three-layer model (data link, pseudo-transport, application), but this is coincidental with the name. The three layers are what makes DNP3 efficient for RTU communication — no session or presentation layer overhead from the OSI model.
DNP3 Protocol Architecture and Working Principle
A typical DNP3 protocol session has a master station and one or more outstations (RTUs or IEDs). The master sends requests; outstations respond.
All data points are organised into data objects grouped by object groups — binary inputs, analogue inputs, counters, binary outputs, analogue outputs, and time.
DNP3 uses three data priority classes plus Class 0 for static data.
The master polls each class at a different rate: Class 1 for alarms, Class 2 for process data, Class 3 for trends.
This is one of DNP3 protocol's strongest advantages on bandwidth-limited WAN links.
Class 1: Highest priority change events. Protection relay trips, critical alarms. Master polls frequently (every 1 to 5 seconds).
Class 2: Medium priority change events. Process alarms, status changes, setpoint confirmations. Master polls every 10 to 30 seconds.
Class 3: Lowest priority change events. Analogue trending, counters, lower-priority status. Master polls every 30 to 60 seconds or on demand.
DNP3 supports unsolicited responses — the outstation sends data without being polled when a Class 1 or Class 2 change event occurs. This reduces polling traffic and improves alarm latency significantly.
The DNP3 pseudo-transport layer segments messages larger than one data link frame. This enables the DNP3 protocol to transfer device configuration and firmware as well as real-time data.
See the SCADA communication protocol guide and the Modbus RTU vs TCP guide for context.
Unsolicited responses remove the need for the master to poll every outstation for changes, but they also mean the master must be ready to receive events at any time from any outstation.
On a network with hundreds of outstations, enabling unsolicited responses without tuning the hold-off timers and maximum event count per message can flood the master with simultaneous event reports during a grid disturbance. Set the hold-off timer (the delay before an unsolicited report is sent) to stagger reports across outstations, and limit the maximum number of events per unsolicited response to prevent large bursts.
SA v5 adds a challenge-response authentication mechanism at the application layer. The master and outstation share a pre-configured update key. Any control command (OPERATE, SELECT, or DIRECT OPERATE) requires the outstation to challenge the master with a random number, and the master must respond with an HMAC-SHA-256 hash of the challenge data and the shared key before the command is accepted.
SA v5 is now required by many North American utility SCADA specifications and is supported by most modern DNP3 protocol stacks. It does not change the DNP3 data model or polling structure — it adds an authentication handshake on top of the existing protocol.
IEC 60870-5-104: How It Works
IEC 60870-5-104 is the TCP/IP variant of the IEC 60870-5-101 serial protocol. It carries the same ASDU data model as 101, transporting it over TCP port 2404 rather than a serial link.
All IEC 104 data is exchanged through ASDUs. Each ASDU has a type identification code (TI) defining the data type and a cause of transmission (COT) defining why it was sent.
Information objects inside the ASDU carry the actual data values with timestamps and quality flags.
4-byte header — controls the connection state and frame numbering.
Three frame formats: I-frame (information), S-frame (supervisory), U-frame (unnumbered control).
ASDU (Application Service Data Unit):
Type ID — what kind of data (e.g., 1 = single-point status, 30 = single-point with timestamp, 36 = measured analogue with float)
Cause of Transmission (COT) — why it was sent (1 = periodic, 3 = spontaneous, 6 = activation, 7 = activation confirmation)
Common Address — identifies the RTU/IED
Information Objects — actual data values + timestamps + quality flags
Window size: Maximum 12 unacknowledged I-frames (configurable: parameter W). Sender must pause if receiver has not acknowledged W frames.
IEC 104 uses a spontaneous transmission model: the outstation sends change events as they occur, without being polled. This is equivalent to DNP3 unsolicited responses but is the IEC 104 default.
The connection uses a persistent TCP connection. The APCI S-frame and U-frame control keep-alive and I-frame acknowledgement.
Unlike the DNP3 protocol, IEC 104 has no data priority class system — all events are sent in order of occurrence. See the DCS communication protocols guide.
T1 is the timeout for acknowledgement of an I-frame (default 15 seconds). T2 is the maximum delay before sending an S-frame acknowledgement (default 10 seconds). T3 is the keep-alive test frame interval (default 20 seconds). W is the maximum number of received I-frames before an S-frame must be sent (default 8).
On a high-latency satellite or WAN link with 500 ms round-trip time, the default T1 of 15 seconds may cause unnecessary connection resets if a burst of traffic delays acknowledgements. Increase T1 to 3 to 5 times the maximum expected round-trip time. On a low-latency LAN, the defaults are conservative — reduce T2 to 1 to 3 seconds to improve event delivery responsiveness.
DNP3 Protocol vs IEC 60870-5-104: Full Comparison
| Parameter | DNP3 Protocol | IEC 60870-5-104 |
|---|---|---|
| Standard body | IEEE Std 1815. Maintained by the DNP Users Group. | IEC TC 57. Part of the IEC 60870-5 series. |
| Geographic dominance | North America, Asia-Pacific, Latin America | Europe, Middle East, Africa, international markets |
| Transport | TCP/IP (port 20000) or serial (RS-232, RS-485) | TCP/IP only (port 2404). Serial variant is IEC 60870-5-101. |
| Data model | Object groups and variations (e.g., Group 1 = binary inputs, Group 30 = analogue inputs). Data class assigned per point. | ASDU with Type ID and Cause of Transmission. No data priority classes — events sent in order of occurrence. |
| Data priority | Class 1, 2, 3 system. Master polls each class at different rates. Class 1 for critical events, Class 3 for trend data. | No priority class system. All spontaneous events sent in chronological order to the master. |
| Event delivery | Polled mode (master asks) or unsolicited response (outstation sends without being asked — optional, configurable). | Spontaneous transmission by default — the outstation sends events as they occur. No polling required for event data. |
| Maximum frame size | 250 bytes per data link frame. Pseudo-transport layer reassembles multiple frames into one application message (up to 2,048 bytes). | 253 bytes per ASDU (no native message segmentation). Large data sets require multiple separate ASDUs. |
| Timestamps | DNP3 timestamps are 48-bit millisecond-resolution UTC. Outstation can record time-tagged events even when not communicating with master. | IEC 104 uses CP56Time2a — 7-byte millisecond-resolution timestamp (year, month, day, hour, minute, second, millisecond). |
| Security | DNP3 Secure Authentication v5 (SA v5) per IEEE 1815-2012. HMAC-SHA-256 challenge-response authentication for control commands. | IEC TS 62351-5 defines security extensions for IEC 104. Less widely deployed than DNP3 SA v5 in practice. |
| Multi-point networks | Up to 65,519 outstation addresses per master. Natively supports multi-drop networks (one master, many outstations on one link). | Designed primarily for point-to-point (one master, one outstation per TCP connection). Multi-master configurations require careful design. |
| Best for | North American utilities, bandwidth-constrained WAN links, networks requiring data priority classes, NERC CIP environments needing SA v5 authentication. | International utility SCADA, European grid operators, systems where spontaneous event delivery is preferred over polling, and IEC 61850 substation automation integration. |
DNP3 Protocol Poll Cycle and Bandwidth Estimator
Watch: SCADA Communication Protocols — Modbus, DNP3 and IEC 60870
DNP3 Protocol vs IEC 60870-5-104 Questions
External References
- DNP3 Protocol Overview for SCADA Systems | Real Time Automation (2024)
- DNP3 vs IEC 60870-5: Protocol Comparison for SCADA | Industrial Monitor Direct (2026)
What We Learn Today
- DNP3 protocol and IEC 60870-5-104 share the same three-layer architecture from IEC 60870-5 but differ in data model, event delivery, and geographic deployment. DNP3 dominates North America with its data class priority system. IEC 104 dominates Europe with its spontaneous event delivery model over TCP port 2404.
- The key DNP3 advantage is differential polling: Class 1 events (protection alarms) are retrieved every few seconds; Class 3 trend data is retrieved much less frequently. This makes DNP3 more efficient than IEC 104 on bandwidth-limited WAN and satellite links where all traffic competes on the same channel.
- Converting between DNP3 and IEC 60870-5-104 requires a protocol gateway — the two protocols have incompatible data object models. Any SCADA project integrating both North American and European systems must plan for gateway hardware in the architecture.