DNP3 vs IEC 60870-5-104 : Full Protocol Comparison for SCADA Engineers

Two protocols dominate remote communication in power utility SCADA systems worldwide: DNP3 (IEEE 1815) and IEC 60870-5-104. Both connect control centers to RTUs, IEDs, and substation gateways — but they take fundamentally different approaches to data modeling, timing, and security. Choosing the wrong one, or misunderstanding how each works, creates integration headaches that can persist for years in a live system.

This guide cuts through the marketing language and gives you a practical, technical comparison so you can make an informed decision — and know how to test either protocol properly before your system goes live.

---

Table of Contents

1. Origins and Regional Adoption
2. Protocol Architecture
3. Data Objects and Point Types
4. Event Timestamping and Timing
5. Transport Layer and Connectivity
6. Security Features
7. Side-by-Side Comparison Table
8. When to Use DNP3 vs IEC 104
9. How to Test Both Protocols
10. FAQ

---

1. Origins and Regional Adoption

DNP3

DNP3 (Distributed Network Protocol 3) was developed in the early 1990s by GE Harris Canada, later standardized by the DNP Users Group and eventually published as IEEE 1815. It was designed specifically for electric utility communication in North America, addressing the limitations of older protocols like Modbus and CDC Type II in handling unsolicited messaging and timestamped events.

Today, DNP3 is the dominant telecontrol protocol in North America, Australia, and parts of Latin America. It is deeply embedded in electric utilities, water utilities, and oil & gas SCADA systems across these regions.

IEC 60870-5-104

IEC 60870-5-104 (commonly called IEC 104) is the TCP/IP adaptation of IEC 60870-5-101, an older serial protocol developed by the International Electrotechnical Commission. IEC 101 was widely deployed in European substations in the 1990s, and IEC 104 extended it to work over TCP/IP networks, published in 2000.

IEC 104 dominates in Europe, the Middle East, Asia, and South America. In many countries it is mandatory for grid interconnection. Where IEC 60870-5-101 already exists on serial links, IEC 104 provides a direct network upgrade path with near-identical data modeling.

---

2. Protocol Architecture

DNP3 Architecture

DNP3 is a layered protocol with three primary layers:

• Data Link Layer — handles framing, CRC error checking, and addressing. Each message carries a source and destination address (0–65519).
• Transport Layer — reassembles fragmented messages. This is a thin pseudo-transport layer unique to DNP3; it is not TCP.
• Application Layer — the main working layer. Defines function codes (Read, Write, Direct Operate, Select-Before-Operate, etc.) and data objects.

Communication follows a master-outstation model. The master (SCADA or control center) polls the outstation (RTU, IED, gateway). Outstations can also send unsolicited responses — pushing event data to the master without being polled. This is one of DNP3’s key advantages for bandwidth-limited or event-driven applications.

IEC 60870-5-104 Architecture

IEC 104 is built on top of TCP/IP. Its application layer is called ASDU (Application Service Data Unit), inherited from IEC 101. The transport control layer is called APCI (Application Protocol Control Information), which manages connection establishment, sequencing, and supervisory frames (S-frames, I-frames, U-frames).

IEC 104 uses a client-server model. The controlling station (SCADA/control center) acts as the client. The controlled station (RTU, IED) acts as the server, listening on port 2404 by default. The protocol supports both spontaneous (unsolicited) transmission and polled data acquisition using General Interrogation (GI).

One architectural difference worth noting: IEC 104 connections are persistent TCP sessions, while DNP3 over TCP can operate over both persistent and non-persistent connections depending on implementation.

---

3. Data Objects and Point Types

This is where the two protocols diverge most significantly in practice.

DNP3 Data Objects

DNP3 organizes data using object groups and variations. The group defines the data type; the variation defines the specific encoding. Some important groups:

• Group 1 / 2 — Binary Input (static / change event)
• Group 10 / 11 — Binary Output (static / change event)
• Group 20 / 22 — Counter (static / change event)
• Group 30 / 32 — Analog Input (static / change event)
• Group 40 / 42 — Analog Output Status (static / change event)
• Group 12 — Control Relay Output Block (CROB) — used to control binary outputs
• Group 50 — Time and Date

DNP3 supports three event classes (Class 1, 2, 3) plus Class 0 (static/current values). Each data point is assigned to a class, and the master polls each class independently. This class-based scheme gives fine-grained control over how frequently different types of events are reported.

IEC 60870-5-104 Data Objects

IEC 104 uses ASDU Type IDs (TIs) to classify information. Each ASDU carries a type identifier, cause of transmission, originator address, common address, and one or more information objects. Key type IDs:

• M_SP_NA_1 (TI 1) — Single-point information (no timestamp)
• M_SP_TB_1 (TI 30) — Single-point information with 56-bit timestamp
• M_DP_NA_1 (TI 3) — Double-point information
• M_ME_NC_1 (TI 13) — Short floating-point measured value
• M_ST_NA_1 (TI 5) — Step position information
• C_SC_NA_1 (TI 45) — Single command
• C_DC_NA_1 (TI 46) — Double command
• C_IC_NA_1 (TI 100) — Interrogation command (General Interrogation)

IEC 104 has a strong concept of Cause of Transmission (CoT), which qualifies why a data update is being sent — spontaneous, interrogated, activation confirmation, activation termination, etc. This is richer than DNP3’s event class model and more explicit in distinguishing the reason for each message.

Key Difference in Data Modeling

DNP3’s group/variation scheme is more flexible and allows selective polling of specific data types. IEC 104’s ASDU model is more explicit in encoding the context of each transmission. Neither is strictly superior — DNP3 tends to be easier to implement for selective data retrieval, while IEC 104’s CoT scheme makes event auditing more transparent.

---

4. Event Timestamping and Timing

Both protocols support millisecond-resolution timestamps, but differ in implementation:

DNP3 Timestamping

DNP3 supports 48-bit absolute timestamps on event objects. Time is synchronized between master and outstation using function code FC 24 (Write Time). DNP3 also supports relative timestamps (time from last report) and unsynchronized events (flagged as time-uncertain). In practice, time synchronization over DNP3 is often a source of bugs — the standard allows multiple implementation choices, and interoperability between different vendors’ time sync behavior can be inconsistent.

IEC 104 Timestamping

IEC 104 uses CP56Time2a, a 56-bit (7-byte) timestamp format that encodes milliseconds, minutes, hours, day of week, day of month, month, and year. Every timestamped ASDU type (TI 30, 31, 32, etc.) carries this full timestamp. Time synchronization is performed via C_CS_NA_1 (TI 103) — Clock Synchronization Command. The 56-bit format is unambiguous and carries the full calendar date, making long-term event log reconstruction easier.

IEC 104’s timestamping approach is generally considered more robust for historical event analysis, because every event carries a complete self-contained timestamp. DNP3 events can carry relative timestamps that require reconstruction from a base time reference.

---

5. Transport Layer and Connectivity

DNP3 Transport Options

DNP3 was originally designed for serial communication (RS-232, RS-485) and retains that heritage in its data link layer. Over time it was extended to:

• DNP3 over TCP/IP (most common in modern deployments)
• DNP3 over UDP/IP
• DNP3 over serial (still widely used in legacy RTUs)

When running over TCP, DNP3 can operate on any port (no standard default), though 20000 is common. The protocol handles its own framing and CRC even over TCP, which adds some overhead but provides error detection at the application level — a holdover from the serial era.

IEC 104 Transport

IEC 104 is designed exclusively for TCP/IP networks. It uses port 2404 by default (IANA assigned). The APCI layer handles sequencing, acknowledgment, and flow control at the application level using a sliding window mechanism (parameter W for acknowledgment window, K for maximum unacknowledged I-frames).

IEC 104’s TCP-native design means it integrates more cleanly with modern IP network infrastructure, firewalls, and VPNs. DNP3 over TCP carries legacy serial framing that is sometimes problematic for network equipment that does deep packet inspection.

---

6. Security Features

DNP3 Secure Authentication (SA)

DNP3 Secure Authentication (SAv5, defined in IEEE 1815-2012) adds challenge-response authentication using HMAC (Hash-based Message Authentication Code). It operates at the application layer and is designed to authenticate critical control messages without requiring changes to the underlying communication infrastructure. SAv5 supports:

• Challenge-response authentication for sensitive functions
• Pre-shared keys and asymmetric key management
• Update key change procedures
• Broadcast authentication

DNP3 SAv5 adoption has been slow in practice. Many deployed systems still use no authentication at all, though regulatory pressure (particularly NERC CIP in North America) is pushing adoption.

IEC 104 Security

IEC 60870-5-104 itself has no built-in authentication or encryption. Security is typically implemented at the network level using:

• VPN tunnels (IPsec, OpenVPN) between control center and substations
• IEC 62351 — the IEC standard for securing IEC 60870 and IEC 61850 communications, which adds TLS and authentication at the transport level
• Network segmentation and firewall rules

IEC 62351-5 specifically addresses security for IEC 60870-5 series protocols. Adoption of IEC 62351 is growing, particularly in European utility projects, but like DNP3 SA, legacy deployments often rely entirely on network-level security.

Practical conclusion: Neither protocol has widely deployed application-layer security in real-world systems. Both rely heavily on network perimeter security. Where application-layer security is required, DNP3 SAv5 has a more mature built-in mechanism than IEC 104’s native capabilities (which require IEC 62351 as an overlay).

---

7. Side-by-Side Comparison Table

Feature	DNP3 (IEEE 1815)	IEC 60870-5-104
Standard body	IEEE / DNP Users Group	IEC TC 57
Primary regions	North America, Australia, Latin America	Europe, Middle East, Asia, South America
Transport	Serial, TCP/IP, UDP/IP	TCP/IP only
Default TCP port	20000 (unofficial)	2404 (IANA assigned)
Data model	Object groups + variations	ASDU Type IDs + Cause of Transmission
Event classes	Class 1, 2, 3 (+ Class 0 static)	Not applicable (event filtering by CoT)
Timestamp format	48-bit absolute / relative	56-bit CP56Time2a (full calendar)
Unsolicited responses	Yes (configurable, class-based)	Yes (spontaneous, CoT=3)
General interrogation	Integrity poll (Class 0)	General Interrogation (TI 100)
Command types	CROB, Direct Operate, SBO	Single/Double/Step/Regulating commands
Built-in security	DNP3 SAv5 (HMAC-based)	None native (requires IEC 62351)
File transfer	Yes (Group 70)	Limited (not standardized)
Legacy serial support	Yes (IEC 60870-5-101 equivalent)	Via IEC 60870-5-101
Typical use case	North American utility SCADA, water, oil & gas	European/international grid, substation SCADA

---

8. When to Use DNP3 vs IEC 104

Choose DNP3 when:

• Your project is in North America, Australia, or a region where DNP3 is mandated by the utility or regulatory body.
• You need serial communication (RS-232/485) over legacy infrastructure alongside TCP/IP.
• You require fine-grained event class polling — the ability to independently poll high-priority (Class 1) events more frequently than lower-priority data.
• You are integrating with legacy RTUs that already speak DNP3.
• You need built-in file transfer capability (Group 70) without a separate file protocol.

Choose IEC 60870-5-104 when:

• Your project is in Europe, the Middle East, Asia, or any region where IEC standards dominate.
• You already have IEC 60870-5-101 serial links that you want to migrate to TCP/IP with minimal data model changes.
• You need rich Cause of Transmission information to distinguish between spontaneous events, interrogation responses, activation confirmations, and retransmissions.
• You require full calendar timestamping (CP56Time2a) on every event for comprehensive historical analysis.
• Your system must interoperate with IEC 61850 substations via a gateway that supports both standards.

When you need both:

Many real-world SCADA systems handle both protocols simultaneously — especially in countries with mixed legacy infrastructure, or in projects involving cross-border grid interconnections. A control center may speak IEC 104 to European substations and DNP3 to older RTUs in the same network. In these environments, having a tool that can simulate and test both protocols from a single interface is essential.

---

9. How to Test Both Protocols

Whether you’re commissioning a new RTU, integrating a gateway, or troubleshooting a live SCADA link, you need a reliable way to simulate master and outstation roles for both DNP3 and IEC 104. This is where a dedicated protocol test tool becomes indispensable.

What to look for in a test tool

• Support for both master (client) and outstation (server) roles for each protocol
• Ability to configure all protocol parameters (addresses, timeouts, class polling intervals, event generation)
• Real-time protocol decode and message logging
• Simulation of multiple simultaneous devices
• Support for both serial and TCP/IP transport
• The ability to generate unsolicited responses and spontaneous events for realistic testing

Axon Test 5

Axon Test 5 is one of the few tools that covers DNP3, IEC 60870-5-101, IEC 60870-5-104, IEC 60870-5-103, OPC, and Modbus in a single application — both master and slave roles. It was developed by Axon Group (Colombia) and is widely used by utility engineers and SCADA integrators for FAT (Factory Acceptance Testing) and SAT (Site Acceptance Testing).

For engineers who need to test both DNP3 and IEC 104 behavior in the same project, Axon Test 5 removes the need to switch between separate tools. You can configure a DNP3 master talking to an IEC 104 outstation simulation, or vice versa, to validate a gateway’s protocol conversion logic — a scenario that is extremely common in real grid projects.

A free trial version is available. See the full Axon Test 5 guide for configuration details, download instructions, and protocol-specific setup walkthroughs.

---

10. Frequently Asked Questions

Can DNP3 and IEC 104 communicate with each other directly?

No. They are separate protocols with different data models and message structures. A protocol gateway or converter is required to bridge between them. Many substation gateways — including devices like the Axon Exchange — support both protocols natively and perform the mapping between data objects.

Which protocol is faster?

In terms of raw throughput over TCP, neither is significantly faster than the other for typical SCADA workloads. IEC 104’s sliding window mechanism (parameter K) can allow more in-flight messages before requiring acknowledgment, which can improve throughput on high-latency WAN links. DNP3’s event class polling system is efficient for bandwidth-constrained links because it separates high-priority events from low-priority data.

Is DNP3 being replaced by IEC 104 globally?

Not in the near term. In North America, DNP3 is deeply entrenched and supported by regulatory frameworks like NERC CIP. In regions where both protocols are deployed, migration from DNP3 to IEC 104 is uncommon — existing deployments tend to run indefinitely. What is changing is the gradual adoption of IEC 61850 for new substation automation projects, which can coexist with both DNP3 and IEC 104 via gateways at the control center interface.

Does IEC 104 support time synchronization?

Yes. Time synchronization in IEC 104 is performed using the Clock Synchronization Command (C_CS_NA_1, TI 103). The controlled station responds with an activation confirmation and adjusts its internal clock. For higher precision, external time sources (GPS, PTP/IEEE 1588) are typically used at the substation level, with the time quality flag in CP56Time2a indicating whether the timestamp is reliable.

What is the difference between IEC 60870-5-101 and IEC 60870-5-104?

IEC 60870-5-101 is the serial (RS-232/485) version of the protocol. IEC 60870-5-104 is the TCP/IP adaptation of IEC 101. The application layer (ASDUs, type IDs, data objects) is nearly identical between the two — the difference is entirely in the physical and transport layers. This is why migrating from a serial IEC 101 deployment to a TCP/IP IEC 104 deployment is relatively straightforward compared to switching protocol families entirely.

How do I know which protocol an existing RTU supports?

Check the RTU’s datasheet or firmware configuration interface. Most modern RTUs support both DNP3 and IEC 104, and many also support Modbus. Protocol selection is typically a configuration parameter. If the documentation is unavailable, a protocol analyzer or simulator tool connected to the RTU can usually identify the protocol by examining the frame structure of outgoing messages.

---

Related articles on docrack.me:

• Axon Test 5 — Complete Guide for Telecontrol Protocol Simulation and FAT/SAT Testing
• Axon Builder 3 — SCADA/HMI for the Electric Sector
• Axon Exchange — Multi-Protocol Substation Gateway Guide