DNP3 Protocol
Supported device types and versions
Communication line configuration
Communication station configuration
I/O tag configuration
Tell commands
Literature
Changes and modifications
Document revisions
Supported device types and versions
Protokol DNP3 is a telemetric protocol designed for communication of a master station (usually SCADA) with outstations (usually PLC, RTU, or other IED - Intelligent Electronic Devices). It was developed while IEC only worked on IEC60870-5 standards (IEC 870-5-101 and IEC 870-5-104).
DNP3 defines multiple object Groups (e.g. Binary Input, Analog Input, Counter) and multiple Variations for each object group (e.g. for Analog Input there are variations 32-bit with flag, 16-bit with flag, 32-bit without flag, 16-bit without flag, Single-precision floating point with flag ..). Each object is defined by a Group and Index (a non-negative number with the size of 1, 2, or 4 bytes).
At the same time, the DNP3 protocol classifies objects into 4 classes (Class 0 - static objects; Class 1..3 - dynamic objects with change registration). Similar to IEC 870-5-101 and IEC 870-5-104, DNP3 supports requesting all values of a particular class (Poll request), in addition to the explicit reading of a particular group of objects with a specified variation (or possibly using variation 0 - automatic variation). When reading, it is possible to request the data of the whole group or to specify an index or the entire range of objects.
The following application functions are supported for the objects:
Read (1) - reading objects.
Write (2) - Single-phase write of objects (with numeric code confirming successful write or talking about write error).
Select (3) + Operate (4) - a two-phase write of objects that virtually excludes the possibility of error due to undetected interference on the line. Each operation returns a group, index, and write value in addition to the return code.
Direct Operate (5) - single-phase write of objects (except the numeric code, the operation returns a group, index, and write value).
Direct Operate Non Return (6) - single-phase write of an object without confirmation (least secure).
Enable Unsolicited Responses (20) - activation of sending spontaneous changes by subordinate stations.
The protocol also supports sending spontaneous changes by outstations - using the application function Unsolicited Response (130).
Data is sent as Data Link Layer packets, also called transport segments. One or more transport segments form an Application Layer fragment. The fragment can be sent as confirmed (Data Link Layer function code 3 - CONFIRMED_USER_DATA) or unconfirmed (Data Link Layer function code 4 - UNCONFIRMED_USER_DATA). The transport segments within one fragment are always confirmed - with the exception of the last one (Data Link Layer function code 0 - ACK).
Table 1: D2000 implementation supports the following groups and their variations:
Group | Variations | Supported operations | Note |
|---|---|---|---|
Binary Input (1) | Packed format (1) | Reading (Read) | Binary inputs |
Binary Input Event (2) | Without time (1) | Analysis* | Reporting of binary inputs' changes |
Double-bit Binary Input (3) | Packed format (1) | Reading (Read) | Double-bit binary inputs |
Double-bit Binary Input Event (4) | Without time (1) | Analysis* | Reporting of double-bit binary inputs' changes |
Binary Output (10) | Packed format (1) | Reading (Read) | Binary outputs |
Binary Output Event (11) | Status w/o time (1) | Reading (Read) | Reporting of binary outputs' changes |
Binary Command (12) | Control relay output block (CROB) (1) | - | Not supported yet |
Binary Output Command Event (13) | Command status without time (1) | Analysis* | Reporting of changes (results of third party commands) |
Counter (20) | 32-bit with flag (1) | Reading (Read) | Counters |
Frozen Counter (21) | 32-bit with flag (1) | Reading (Read) | Counters- values captured when the object was frozen |
Counter Event (22) | 32-bit with flag (1) | Analysis* | Reporting of counters' changes |
Frozen Counter Event (23) | 32-bit with flag (1) | Analysis* | Reporting of counters' changes when the object was frozen |
Analog Input (30) | 32-bit with flag (1) | Reading (Read) | Analog inputs |
Frozen Analog Input (31) | 32-bit with flag (1) | Reading (Read) | Analog inputs - values captured when the object was frozen |
Analog Input Event (32) | 32-bit w/o time (1) | Analysis* | Reporting of analog inputs' changes |
Frozen Analog Input Event (33) | 32-bit w/o time (1) | Analysis* | Reporting of analog inputs' changes when the object was frozen |
Analog Input Reporting Deadband (34) | 16-bit (1) | Reading (Read) | Deadbands of analog inputs |
Analog Output Status (40) | 32-bit with flag (1) | Reading (Read) | Reading of analog outputs |
Analog Output (41) | 32-bit (1) | Writing (Select+Operate, | Writing of analog outputs |
Analog Output Event (42) | 32-bit w/o time (1) | Analysis* | Reporting of analog outputs' changes |
Analog Output Command Event (43) | 32-bit w/o time (1) | Analysis* | Reporting of analog outputs' changes |
Time and Date (50) | Absolute time (1) | Reading (Read) | Current time |
Time and Date CTO (51) | Absolute time, synchronized (1) | Analysis* | Common timestamp ** |
Class Objects (60) | Class 0 data (1) | Poll | Requesting values for all objects of the respective class |
Binary-Coded Decimal Integer (101) | Small (1) | Reading (Read) | Reading of 1,2 and 4-byte signed BCD numbers |
Unsigned Integer (102) | 8-bit (1) | Reading (Read) | Reading of 8-bit unsigned numbers |
Octet String (110) | Variations 0-255 correspond to octet strings of 0-255 bytes in length | Reading (Read) | Reading + writing of octet strings |
Octet String Event (111) | Variations 0-255 correspond to octet strings of 0-255 bytes in length | Analysis* | Reporting of octet strings' changes |
Virtual Terminal Output Block (112) | Variations 0-255 correspond to strings of 0-255 bytes in length | Writing (Write) | Writing to a virtual terminal |
Virtual Terminal Event Data (113) | Variations 0-255 correspond to trings of 0-255 bytes in length | Reading (Read) | Reading from a a virtual terminal |
* Note: Operation Analysis means that D2000 KOM can analyze the message and assign values to the appropriate I/O tag. For example, for a Binary Input Event (2) group, values are assigned to the I/O tags from the Binary Input (1) group.
** Note: The outstation can send object values from the Time and Date CTO (51) group, defining the Common Time of Occurrence (CTO) for subsequent events. Afterward, values with relative time are sent - Binary Input Event (2) and Double-bit Binary Input Event (4), using With relative time (3) variations.
Note: D2000 KOM supports sending a message with the writing type outside the range allowed by the standard - e.g. for the Analog Output (41) group, a write operation with Write (2) function can be configured.
The D2000 implementation also supports time synchronization (according to the parameters configured on the station) and browsing. Secure authentication is not supported.
Communication line configuration
Category of communication line:
TCP / IP-UDP: The IP address and UDP port of the outstation are configured on the line (the default port for the DNP3 protocol is 20000). The UDP port on the side of the D2000 KOM process is dynamically assigned. If it needs to be fixed, use the SerialOverUDP Device Redundant line.
TCP/IP-TCP: The IP address and TCP port of the outstation are configured on the line (the default port for the DNP3 protocol is 20000). The parameter Line number is not used, set it to 0.
Note: if a TCP/IP-TCP line has all stations set to StOFF, TCP connection will be closed. Thus it is possible to control TCP communication from the event using a tell command STSTAT.
Communication line protocol parameters
Configuration line dialog box - tab Protocol parameters.
They influence some of the optional protocol parameters. The following line parameters can be set:
Keyword | Full name | Description | Unit | Default value |
|---|---|---|---|---|
MA | Master Address | Address of KOM process. The address must be a 16-bit number from interval 0-65 519 (other addresses have special meanings). | - | 1 |
SS | Serialized Stations | Serialization of communication with individual stations on the line. Serialization means that individual stations are queried sequentially (which corresponds to the situation of the stations on the serial line) to avoid conflict when multiple stations try to send a response at the same time. If a D2000 KOM process actually communicates with a single device that contains multiple virtual stations, or a device that is forwarding messages to other stations (in a way that prevents a conflict), or the channel is duplex (TCP, UDP), it is possible to disable serialization. Thus D2000 KOM process will send queries to all stations on the line and then wait for answers. Turning off serialization can speed up communication, but this will cause packet collisions and packet losses on lines with multiple stations where collisions are possible (such as RS-485). | - | YES |
BG | Browse All Groups | The parameter determines whether, in addition to Poll requests for individual classes (Class 0-3), requests for the explicit reading of all supported object Groups should also be sent. The reason for the explicit reading of Groups is that some objects may not be assigned to any of the classes, so Poll requests will not find them. | - | YES |
DTQ | Debug Timeout Queue | The parameter activates advanced debug information about messages in the time queue. | - | NO |
Communication station configuration
Communication protocol DNP3.
Station address: a 16-bit number from range 0-65 519 (other addresses have special meanings).
Communication station protocol parameters
The following station parameters can be set:
Keyword | Full name | Description | Unit | Default value |
|---|---|---|---|---|
PI1, PI2, PI3, PI4 | Poll Interval n (-1=OFF) | Interval for sending Poll requests. It is possible to configure 4 different intervals and for each interval to specify the class to which Poll is sent (Class 0-3). |