SCADA Telemetry Communications: DNP3, IEC 60870-5-104, Modbus and Radio, Cellular and Satellite Links
On this page
Plant-floor SCADA talks to PLCs over a local Ethernet network. Telemetry SCADA is different: it supervises sites spread over kilometres or hundreds of kilometres, such as water and wastewater networks, pipelines, electricity substations, wind farms and oil and gas wells. Links are slower, less reliable, sometimes paid per megabyte, and exposed to the outside world. The protocols and design choices reflect that.
This guide covers the telemetry side. For plant networks (VLANs, rings, firewalls, zones), see Industrial Network Design for OT Engineers. For network shapes (star, ring, mesh), see SCADA Network Topologies.
What telemetry protocols must handle
- Slow or expensive links: send changes, not full data sets, every scan.
- Link outages: remote stations buffer events and send them when the link returns.
- Event order: changes are time-stamped at the remote station so the sequence of events is known.
- Safe remote control: commands need confirmation mechanisms such as select-before-operate. See SCADA Control and Command Functions.
- Integrity: the master periodically requests all current values to make sure its database is complete.
The main telemetry protocols
| Protocol | Where it is used | Transport | Key features |
|---|---|---|---|
| DNP3 (IEEE 1815) | Electric and water utilities, especially in North America, Australia and parts of Asia | Serial or TCP/UDP (port 20000 by default) | Event classes, time-stamped events, unsolicited reporting, select-before-operate, Secure Authentication |
| IEC 60870-5-101 | Power utilities (serial links), mainly Europe and international | Serial | Spontaneous transmission, general interrogation, time tags, select/execute commands |
| IEC 60870-5-104 | The TCP/IP version of 101 | TCP (port 2404 by default) | Same application functions as 101 over IP networks |
| Modbus RTU / TCP | Water, small utilities, oil and gas, many RTUs and radios | Serial or TCP (port 502) | Simple, universal; no events, timestamps or quality, so the master must poll |
| IEC 61850 | Inside electrical substations (protection relays, bay controllers) | Ethernet (MMS, GOOSE, Sampled Values) | Object models of substation equipment; a gateway usually converts to DNP3 or IEC 104 for the control centre |
| MQTT / Sparkplug B | Newer IIoT-style telemetry, especially over cellular | TCP/TLS | Publish/subscribe, report by exception, state awareness. See MQTT and Sparkplug B |
DNP3 in more detail
- Data types: binary inputs, analog inputs, counters, binary outputs and analog outputs, each with a point index.
- Static data and events: the outstation keeps current (“static”) values and a buffer of events (changes with timestamps).
- Event classes: events are assigned to Class 1, 2 or 3 (often used for priority), and Class 0 means all static data. The master performs frequent event polls and occasional integrity polls (Class 0 plus all events).
- Unsolicited responses: outstations can send events without being polled, which suits report-by-exception over radio or cellular.
- Time synchronisation: the master can set outstation clocks; for accuracy, use GPS or network time at the outstation where possible.
- Security: DNP3 Secure Authentication authenticates critical messages such as commands; combine it with TLS or VPNs for confidentiality where supported.
IEC 60870-5-101/104 in more detail
- Information objects with types such as single-point, double-point, measured values and integrated totals, many with time tags.
- Cause of transmission tells the master why data was sent: spontaneous (change), periodic, or in response to a general interrogation.
- General interrogation retrieves all current values after start-up or reconnection.
- Commands support select-and-execute sequences.
- Security: the IEC 62351 series defines security measures for these protocols, including TLS for IEC 104; check what your master and outstations support.
Communication media for remote sites
| Medium | Strengths | Limitations | Typical use |
|---|---|---|---|
| Fibre (owned or leased) | High bandwidth, immune to electrical interference, low latency | Cost of installation; routes along pipelines and power lines | Substations, pipeline stations, large sites |
| Licensed radio (UHF/VHF, point-to-multipoint) | Owned by the operator, no per-message cost, long range | Low bandwidth, needs licensing and path planning | Water networks, oil and gas fields, irrigation |
| Unlicensed / spread spectrum radio | No licence, higher data rates | Shorter range, interference from other users | Plant-wide and local telemetry |
| Cellular (LTE, LTE-M, NB-IoT, 5G) | Wide coverage, IP-based, easy to deploy | Depends on a carrier; coverage gaps; data costs; network sunsets | Pump stations, meters, distributed assets |
| Satellite | Available almost anywhere | Cost; geostationary links add around half a second of round-trip delay (low-earth-orbit services reduce this) | Remote wells, offshore and desert sites |
| Leased lines / private networks | Predictable service | Cost; many legacy services are being withdrawn | Older utility networks |
Plan for technology sunsets. Many carriers have switched off 2G and 3G networks, which stranded older telemetry modems. Check the carrier’s roadmap before choosing a cellular technology, and record modem types in the asset register.
Designing a reliable telemetry network
- Match the protocol to the link. On low-bandwidth radio, use report by exception (DNP3 events, IEC 104 spontaneous data) instead of polling large Modbus blocks.
- Estimate traffic. Count points and expected change rates per station, then check the link capacity with margin for integrity polls and bursts after outages.
- Buffer at the outstation. Size event buffers for the longest expected outage.
- Add path redundancy for critical sites: for example fibre or radio as primary with cellular as backup, and monitor which path is in use.
- Monitor link health: communication failure alarms per station, retry counters, signal strength and latency trends.
- Synchronise time at outstations (GPS, NTP or protocol time sync) so event timestamps are usable. See Time Synchronisation in OT.
- Document station addresses, point lists, protocol settings and link details, and back up RTU configurations. See OT Backup and Restore Runbook.
Securing telemetry links
- No public IP addresses on RTUs or PLCs. Use private APNs for cellular, VPNs (IPsec or similar) and firewalls at both ends.
- Authenticate commands with DNP3 Secure Authentication or IEC 62351 mechanisms where supported, and restrict which master stations may send commands.
- Harden remote access to outstations: no default passwords, logging, and remote engineering access through a controlled path.
- Physical security matters at unmanned sites: cabinets, tamper switches, and alarms on door opening.
See ISA/IEC 62443 for the zone-and-conduit approach, and Certificates and PKI for OT when TLS is used.
Troubleshooting telemetry communications
| Symptom | Likely cause | First check |
|---|---|---|
| One station offline | Power, modem or radio failure, antenna damage, SIM or data plan problem | Station power and modem status, signal strength, carrier portal |
| Stations drop out at certain times | Radio interference, weather effects on paths, cellular congestion | Link statistics over time; spectrum or path survey |
| Data arrives late | Polling cycle too long, link overloaded, satellite latency | Poll schedule, event reporting settings, traffic volume |
| Events in the wrong order | Outstation clocks not synchronised; server timestamps used | Time sync configuration and timestamp source |
| Gaps after an outage | Event buffer overflow at the outstation | Buffer size versus outage duration |
| Commands time out | Select-before-operate timeout too short for the link latency | Command timeouts relative to round-trip time |
| DNP3 station not responding after replacement | Wrong outstation or master address, link settings mismatch | DNP3 addresses, baud rate, IP and port configuration |
For general data-quality problems, see Bad Tag Quality and Communication Failures.
Frequently asked questions
What is the difference between DNP3 and Modbus?
Modbus is a simple request/response protocol with no timestamps, events or quality information, so the master must poll for everything. DNP3 was designed for telemetry: outstations buffer time-stamped events, report by exception, support unsolicited messages and secure authentication, and support select-before-operate commands.
Which is better for utilities, DNP3 or IEC 60870-5-104?
Both provide similar telemetry functions. The choice is usually regional and set by utility standards: DNP3 is common in North America and some other regions, IEC 60870-5-101/104 in Europe and many international utilities. Choose what your control centre and equipment suppliers support.
Is cellular reliable enough for SCADA?
For many monitoring and supervisory applications, yes, provided the design includes outstation buffering, communication alarms, secure private connectivity and, for critical sites, a backup path. Fast control and protection should never depend on a cellular link.
Key takeaways
- Telemetry SCADA needs protocols that handle slow links, outages, event order and safe commands.
- DNP3 and IEC 60870-5-101/104 provide events, time tags, interrogation and secure command options; Modbus is simple but needs polling.
- Choose media by distance, bandwidth, cost and lifetime, and plan for cellular technology sunsets.
- Buffer at outstations, monitor links, synchronise clocks and secure every connection.
Related tutorials
Before you apply this in a plant: this article is for education. Always check the current edition of the relevant standards, the manufacturer's documentation for your exact product and version, and your site's procedures. Safety-related work needs qualified personnel. See our editorial policy.