Protocol software for power systems

Secure by design

Products About Us

How we're different

We build protocol libraries and testing tools for SCADA and grid communications.

Correctness first

Add-on security can't make fragile software safe. We build in memory-safe Rust and design for correctness from the first line, so that malformed or hostile input is rejected, not exploited.

About Rust

Test like a hacker

Our smart fuzzing has exposed flaws in protocol stacks across the industry. We design our own code to prevent that class of defects, and fuzz it anyway.

Aegis Fuzzer

Performance at any scale

Our asynchronous design handles thousands of concurrent sessions on a server, yet still fits on resource-constrained embedded Linux.

Protocol Scalability

Proven in the field

Our protocol code has run for years in deployed systems, talking to equipment from many vendors. Conformance testing keeps it that way.

DNP3 Conformance

Protocol Libraries

Written in Rust, with idiomatic bindings for C, C++, Java, and .NET.

Drop production-ready DNP3 and Modbus into your existing codebase. Evaluate the full source code, free for non-commercial use.

DNP3 Modbus
14:02:31.384 aegis> fuzz dnp3 outstation 10.0.0.12:2000014:02:31.544 seed 0x5e1f  model dnp3-2012  cases 5000014:02:31.637 TX 05 64 11 C4 01 00 0A 00 C3 D2                C1 C1 01 3C 02 06 3C 03 06 5A 9E14:02:31.730 RX 05 64 0A 44 0A 00 01 00 8B 2F14:02:31.929 #0412 g12v1 count=0xFF          ok14:02:32.128 #0413 g30v5 qual=0x17 range=0xFFFF14:02:32.221 TX 05 64 18 C4 01 00 0A 00 F1 0714:02:32.339 RX timeout 2000ms14:02:32.432 !! #0413 no response, link reset14:02:32.631 #0414 fir=0 fin=1 seq=15        ok14:02:32.724 TX 05 64 0B C4 01 00 0A 00 2E 6114:02:32.817 RX 05 64 1A 44 0A 00 01 00 9C 44                IIN 82 00  restart14:02:33.016 #0415 g50v1 len=0x0000          ok14:02:33.215 #0416 crc mismatch injected     ok14:02:33.506 !! #0417 count exceeds range14:02:33.599 TX 05 64 14 C4 01 00 0A 00 77 B314:02:33.692 RX 05 64 0A 44 0A 00 01 00 8B 2F14:02:33.891 #0418 g2v2 qual=0x28 idx=0xFFFF ok14:02:34.090 #0419 fragment 2049 bytes       ok14:02:34.144 aegis> fuzz modbus server 10.0.0.31:50214:02:34.555 TX 00 01 00 00 00 FF 01 10 00 00 7F FF14:02:34.899 RX 00 01 00 00 00 03 01 90 0314:02:35.098 #0420 exception 0x03            ok14:02:35.297 !! #0421 connection closed by peer14:02:31.384 aegis> fuzz dnp3 outstation 10.0.0.12:2000014:02:31.544 seed 0x5e1f  model dnp3-2012  cases 5000014:02:31.637 TX 05 64 11 C4 01 00 0A 00 C3 D2                C1 C1 01 3C 02 06 3C 03 06 5A 9E14:02:31.730 RX 05 64 0A 44 0A 00 01 00 8B 2F14:02:31.929 #0412 g12v1 count=0xFF          ok14:02:32.128 #0413 g30v5 qual=0x17 range=0xFFFF14:02:32.221 TX 05 64 18 C4 01 00 0A 00 F1 0714:02:32.339 RX timeout 2000ms14:02:32.432 !! #0413 no response, link reset14:02:32.631 #0414 fir=0 fin=1 seq=15        ok14:02:32.724 TX 05 64 0B C4 01 00 0A 00 2E 6114:02:32.817 RX 05 64 1A 44 0A 00 01 00 9C 44                IIN 82 00  restart14:02:33.016 #0415 g50v1 len=0x0000          ok14:02:33.215 #0416 crc mismatch injected     ok14:02:33.506 !! #0417 count exceeds range14:02:33.599 TX 05 64 14 C4 01 00 0A 00 77 B314:02:33.692 RX 05 64 0A 44 0A 00 01 00 8B 2F14:02:33.891 #0418 g2v2 qual=0x28 idx=0xFFFF ok14:02:34.090 #0419 fragment 2049 bytes       ok14:02:34.144 aegis> fuzz modbus server 10.0.0.31:50214:02:34.555 TX 00 01 00 00 00 FF 01 10 00 00 7F FF14:02:34.899 RX 00 01 00 00 00 03 01 90 0314:02:35.098 #0420 exception 0x03            ok14:02:35.297 !! #0421 connection closed by peer

Aegis Fuzzer

Aegis is a protocol-aware smart fuzzer you can point at your own devices. It models the protocol under test and generates large numbers of intelligently malformed messages, uncovering reliability and security defects before your customers or an attacker do.

Read More
READRESPONSECONFIRM

DNP3 Conformance

dnp3c is our open source DNP3 conformance project. It runs the DNP3 IED Certification Procedure against an outstation unattended, so conformance is checked in CI on every commit, just as we do for our own DNP3 library. It also runs from the command line for testing at the bench.

Read More

Expertise

We have deep experience in electric power, software engineering, and software security. We provide subject matter expertise, or contract to build portions of your product or platform.

Read More

Have any questions for us?

Reach out to inquire about our products or to scope a services engagement with our team. We can structure most projects on a T&M or fixed-price basis to meet your needs.

Latest News & Articles

We love to blog about industry trends and software engineering. Check back often for new posts, or follow us on social media.

dnp3c: Open Source DNP3 Conformance Testing

dnp3c: Open Source DNP3 Conformance Testing

We’ve released dnp3c, the DNP3 conformance test harness we’ve used internally for over a decade, as open source under the GPL. It runs the DNP Users Group’s IED Certification Procedure against an outstation, either by hand or completely unattended in CI.

Read More
The Case Against DNP3 SAv6 and AMP

The Case Against DNP3 SAv6 and AMP

DNP3’s new security protocol reinvents what TLS already provides, and it will be implemented by vendor teams that have historically struggled to safely parse basic DNP3 messages. Use TLS. It’s proven, audited, and your developers don’t need to be cryptographers.

Read More
Battalion Energy

Battalion Energy

I’m pleased to announce that I’ve joined Battalion Energy as cofounder and CTO. We’re building a cloud + edge controls platform focused on battery energy storage. There are so many things that excite me about this venture: Extremely talented founding team with a track record of building Awesome Things™. Building a modern and secure controls platform using 🦀Rust🦀 and webassembly! Disruptive business model in a rapidly expanding market. Company focus on open APIs, open ecosystems, and playing nice with others.

Read More

What Others Are Saying

Don't just take it from us. Ask around. We've been working on software and security projects in electric power for over a decade.

"Adam is consistently leading the field on design and testing of industrial protocols and the latest development tool set innovations. Tech from Step Function I/O is a smart bet."

Bryan Owen, Security Architect, OSIsoft LLC

"Adam and the experts at Step Function I/O are more than just leaders in the industrial reliability and security space, they are renowned practitioners."

Ronnie Fabela, Co-Founder, SynSaber

“At EPRI, we have built a number of protocol drivers and device simulators for DER applications that use the OpenDNP3 library. We are very impressed by the high-quality library and documentation.”

Jithendar Anandan, Smart Grid Developer, EPRI