August 11, 2026 · How-To

DNP3 Select-Before-Operate (SBO): Safe Control Outputs

By Dzulfikar Ats Tsauri, founder of Voltrus / JoyoDigitama. He builds the protocol tools covered in these posts. Updated October 28, 2026.

DNP3 carries commands that trip breakers, start pumps, and drive analog setpoints across hundreds of remote sites over noisy links. A single corrupted, duplicated, or misrouted command message could energize the wrong feeder or overflow the wrong tank. Select-Before-Operate (SBO) is DNP3's structural defense against that: a two-step handshake that makes a critical control much harder to fire by accident.

This guide explains how SBO works, when to use it instead of Direct Operate, and how the select timeout protects against stale commands. For where controls fit in the wider DNP3 model, see class polling.

The Two-Step Handshake

1. Select. The master sends a Select message naming the control point and the intended value (e.g. Binary Output 3 → LATCH_ON). The outstation acknowledges the Select but performs no action. The point is now "armed" for a short window.
2. Operate. The master sends an Operate message for the same point with the same value, within the select timeout. The outstation verifies the match and only then executes the control.

Direct Operate: the One-Shot Alternative

DNP3 also defines Direct Operate, where select and operate happen in a single message. It is faster and simpler but offers none of SBO's guards. Use Direct Operate only for non-critical points where an erroneous command has no safety consequence: an indicator lamp, a logging enable. Anything that moves a breaker, a valve, or a drive gets SBO.

The Select Timeout

Each armed Select has a configurable select timeout (commonly a few seconds). If the matching Operate does not arrive within the window, the outstation cancels the Select and any subsequent Operate is rejected. This is the anti-replay mechanism: a delayed Operate cannot act on a stale, forgotten Select.

Binary vs Analog Controls

SBO applies to both control object types:

• Binary Output (BO): trip/close, latch on/off, pulse. The Operate carries the output code (LATCH_ON, LATCH_OFF, PULSE, etc.).
• Analog Output (AO): setpoint values. The Operate carries the same analog value as the Select.

Confirmation and Status

After an Operate executes, the resulting point-state change generates an event in the normal class event stream (see class polling). The master therefore sees confirmation of the control through the same mechanism it sees every other change: the point value moves, an event is queued, and the next class poll returns it.

Testing Controls Safely

Never exercise SBO against a live device until you have run it against a simulator. The pattern to validate: Select returns success, an Operate with a mismatched value is rejected, an Operate after the select timeout is rejected, and a correct Operate within the window changes the point. MacTools DNP3 Explorer issues Direct Operate and SBO on macOS, with a method switch in its control dialog, and pairs with the built-in outstation simulator so you can prove all four cases safely before pointing controls at real equipment.

Further Reading

• DNP3 Class 0, 1, 2, 3 Explained
• DNP3 vs Modbus for SCADA