What is an RTU (Remote Terminal Unit)?
An RTU (Remote Terminal Unit) is a rugged, microprocessor-controlled device at a remote site that reads signals from field equipment such as sensors and actuators, sends them as measurements and status reports to a central SCADA system, and executes that system’s control commands locally. RTUs are the outposts of industrial automation in distributed infrastructure: pumping stations, substations, pipelines, wind and solar farms and railways. They are also called remote telemetry units or telecontrol units, and in the Dutch water sector they are often described as outstations reporting to the master station (hoofdpost).
🧠 What does an RTU do?
An RTU acts as the intermediate station between the physical process and the control centre. Where a PLC is primarily about fast control, an RTU is about reliable telemetry over long distances. Its core tasks are:
- Reading signals - digital inputs for states (breaker open/closed, pump running, door open) and analogue inputs for measurements such as pressure, level and flow, usually via 4-20 mA or 0–10 V
- Remote control - relay outputs that start a pump, open a valve or trip a circuit breaker on command from the control centre
- Recording events - every change of state is time-stamped so the sequence of events can be reconstructed afterwards
- Buffering - if the link drops, the RTU stores events and delivers them once the connection is restored
- Local logic - simple automation such as switching a pump on level, even while the link to the centre is down
- Data concentration - collecting data from downstream IEDs, meters and PLCs and bundling it towards SCADA
In the Purdue Model an RTU sits at level 1, alongside the PLC: it is a controller directly connected to the process.
🔧 What are the components of an RTU?
An RTU is modular. Most manufacturers supply a base module with processor and communications, extended with I/O cards as needed.
| Component | Function | Typical implementation |
|---|---|---|
| CPU module | Handles I/O, protocols, logic and time-stamping | Embedded processor with its own firmware |
| Digital inputs | Status indications and counters | Volt-free contacts, pulse counters |
| Analogue inputs | Measured values | 4-20 mA, 0–10 V, or via transducers |
| Outputs | Operating equipment | Relay outputs; analogue outputs are less common |
| Communications | Link to the centre and to field devices | RS-485, RS-232, Ethernet, fibre, radio or cellular |
| Power supply | Continuity during mains failure | Station battery, own battery and charger, or solar panel |
Because RTUs are unmanned, they are designed for a wide temperature range, high EMC immunity and low power consumption. The device itself usually sits in an outdoor cabinet or kiosk, so weather resistance comes mainly from that enclosure. For substations, the environmental requirements in part 3 of IEC 61850 apply.
📡 How does an RTU communicate with SCADA?
The communication model is the main difference from an ordinary controller. Links to remote sites are often slow, expensive or intermittent, so an RTU sends as little data as possible while making sure that no event is lost.
- Polling - the centre periodically requests all values. Simple, but inefficient across hundreds of sites.
- Report by exception - the RTU reports only changes: a digital input that toggles or an analogue value that moves by more than a configured threshold (deadband).
- Unsolicited reporting - when an alarm occurs, the RTU reports on its own without waiting for the next poll.
- Integrity poll - periodically, or after a link is restored, the centre requests the complete picture so that no stale data lingers.
That is why, for RTUs, low latency matters less than the correct, complete and time-stamped arrival of every event. The common protocols are:
| Protocol | Transport | Typical use |
|---|---|---|
| Modbus (Modbus RTU / Modbus TCP) | Serial or TCP port 502 | Water, simple telemetry; no time-stamps or event buffering |
| DNP3 (IEEE 1815) | Serial or TCP/UDP port 20000 | Electricity and water, especially in North America; event classes 1–3 and time-stamps |
| IEC 60870-5-101 | Serial | European power grids, older telecontrol links |
| IEC 60870-5-104 | TCP port 2404 | The standard for telecontrol in European power grids |
| IEC 61850 | Ethernet inside the substation | Integration with IEDs within the station |
The physical carrier can be leased lines, fibre, microwave links, private radio networks or cellular networks such as 4G or LTE-M. In the Netherlands, grid operators use, among other things, Utility Connect’s 450 MHz network for controlling substations: a mission-critical network that keeps working during a power outage.
🔄 What is the difference between an RTU, a PLC and an IED?
The distinction used to be sharp: an RTU could run little logic, a PLC could run a lot. Modern RTUs, however, often support programming according to IEC 61131-3, and many PLCs speak DNP3 or IEC 104. The difference now lies in design choices.
| Feature | RTU | PLC | IED |
|---|---|---|---|
| Main task | Telemetry and remote control | Fast local control | Protection and metering of electrical equipment |
| Location | Distributed, unmanned, often outdoors | Factory, machine, control cabinet | Inside the substation, next to the switchgear |
| Communications | Designed for slow and intermittent WAN links | Mainly local fieldbuses and Industrial Ethernet | IEC 61850, GOOSE, DNP3 |
| Time-stamps and buffering | Core function | Usually limited | Extensive, for fault analysis |
| Power | Battery or solar, low consumption | Mains power in the cabinet | Station battery |
| Logic | Simple up to IEC 61131-3 | Extensive, scan time in milliseconds | Protection functions and interlocks |
In practice there is a hybrid category: a PLC with a telemetry module deployed as an RTU, or an RTU that also performs some local control.
🏭 Where are RTUs used?
- Water boards and drinking water - sewage pumping stations, polder pumping stations, weirs, reservoirs and booster stations monitored from a central master station (see Water Sector OT Security)
- Power grids - medium- and high-voltage substations where the grid operator reads breaker positions, voltages and currents and switches remotely
- Wind and solar farms - a farm’s grid connection substation communicates with the grid operator through an RTU
- Oil and gas - pressure monitoring and leak detection along pipelines and at compressor stations
- Rail and infrastructure - points, signals, tunnels and movable bridges
🔐 How do you secure an RTU?
RTUs are an attractive target: whoever controls the RTU controls the process. Classic telecontrol protocols have no authentication, so an RTU executes any valid command it receives.
| Incident | Year | Role of the RTU |
|---|---|---|
| Industroyer (Ukraine) | 2016 | Malware sent valid commands over IEC 101, IEC 104 and IEC 61850 to open circuit breakers |
| Industroyer2 (Ukraine) | 2022 | New variant using IEC 104 only, aimed at high-voltage substations; the attack was thwarted |
| Attack on the Polish energy system | 2025 | Manipulated firmware was loaded onto RTUs through a default account, leaving them stuck in a reboot loop; signed updates were available but not enabled |
The Polish incident is instructive for the Netherlands: no sophisticated exploit was needed, just a VPN without MFA, reused passwords and default settings. Since 15 August 2026 the Dutch Cybersecurity Act (Cyberbeveiligingswet) applies to grid operators, drinking water companies and water boards, and it requires appropriate measures for exactly this kind of system.
🛠️ How do you approach RTU security step by step?
- Take inventory - record per site which RTU, firmware version, I/O configuration, modem and SIM card is installed; an asset inventory often uncovers forgotten 4G routers.
- Remove default accounts - change factory passwords and disable or restrict unused services such as the web interface, FTP and SSH.
- Enable firmware verification - use signed firmware where the RTU supports it, and check that the feature is actually switched on.
- Segment the connection - place RTUs in their own zone according to IEC 62443, with a private APN or VPN for cellular links and network segmentation between the telemetry network and the office.
- Secure the protocol - use DNP3 Secure Authentication (part of IEEE 1815-2012) or IEC 104 with TLS according to IEC 62351, and when replacing hardware choose a component certified against IEC 62443-4-2.
- Limit remote access - let vendors log in only for a limited time through a jump server with MFA (see Remote Access).
- Monitor and back up - use network monitoring that understands IEC 104 and DNP3, and keep backups of all RTU configurations so you can recover quickly after sabotage.
❓ Frequently asked questions
What does the abbreviation RTU stand for?
RTU stands for Remote Terminal Unit, sometimes also called a remote telemetry unit or telecontrol unit. An RTU is the field device at a remote site that sends measurements and status information to SCADA and executes control commands.
What is the difference between an RTU and Modbus RTU?
An RTU is a device, whereas Modbus RTU is a serial transmission mode of the Modbus protocol in which messages are sent in binary form. An RTU may use Modbus RTU, but also DNP3 or IEC 60870-5-104, and Modbus RTU is just as often used between PLCs and variable frequency drives.
Which protocol does an RTU usually use in Europe?
In Dutch and other European power grids, IEC 60870-5-104 is the common standard for communication between the RTU and the control centre. In the water sector, Modbus, DNP3 and vendor-specific telemetry protocols are also used.
How does an RTU get power at a remote site?
An RTU in a substation usually runs on the station battery so that it keeps reporting during a mains failure. At sites without a grid connection, such as measuring points along a pipeline, an RTU uses a battery with a solar panel, which is feasible thanks to its low power consumption.
Can a PLC be used as an RTU?
A PLC can be used as an RTU when it supports a telemetry protocol such as DNP3 or IEC 104 and can buffer time-stamped events. A dedicated RTU remains better suited to very large numbers of distributed sites with slow links and limited power.
Does an RTU fall under the Dutch Cybersecurity Act?
The Dutch Cybersecurity Act (Cyberbeveiligingswet) applies to organisations, not to devices, such as grid operators, drinking water companies and water boards. Those organisations must, however, include their RTUs in their duty of care, with measures such as access control, segmentation and incident reporting.
📌 In summary
An RTU is the rugged outpost of a SCADA system: it reads field signals at remote sites, sends them reliably and time-stamped to the control centre, and executes control commands locally. Because every RTU directly affects a physical process, default passwords, unsecured protocols and open remote access are unacceptable; segmentation, signed firmware and secured protocols belong in every installation.