DNP3 Protocol
Protokol DNP3 is a telemetric protocol designed for communication of a master station (usually SCADA) with outstations (usually PLC, RTU, or other IED - Intelligent Electronic Devices). It was developed while IEC only worked on IEC60870-5 standards (IEC 870-5-101 and IEC 870-5-104).
DNP3 defines multiple object Groups (e.g. Binary Input, Analog Input, Counter) and multiple Variations for each object group (e.g. for Analog Input there are variations 32-bit with flag, 16-bit with flag, 32-bit without flag, 16-bit without flag, Single-precision floating point with flag ..). Each object is defined by a Group and Index (a non-negative number with the size of 1, 2, or 4 bytes).
At the same time, the DNP3 protocol classifies objects into 4 classes (Class 0 - static objects; Class 1..3 - dynamic objects with change registration). Similar to IEC 870-5-101 and IEC 870-5-104, DNP3 supports requesting all values of a particular class (Poll request), in addition to the explicit reading of a particular group of objects with a specified variation (or possibly using variation 0 - automatic variation). When reading, it is possible to request the data of the whole group or to specify an index or the entire range of objects.
The following application functions are supported for the objects:
Read (1) - reading objects.
Write (2) - Single-phase write of objects (with numeric code confirming successful write or talking about write error).
Select (3) + Operate (4) - a two-phase write of objects that virtually excludes the possibility of error due to undetected interference on the line. Each operation returns a group, index, and write value in addition to the return code.
Direct Operate (5) - single-phase write of objects (except the numeric code, the operation returns a group, index, and write value).
Direct Operate Non Return (6) - single-phase write of an object without confirmation (least secure).
Enable Unsolicited Responses (20) - activation of sending spontaneous changes by subordinate stations.
The protocol also supports sending spontaneous changes by outstations - using the application function Unsolicited Response (130).
Data is sent as Data Link Layer packets, also called transport segments. One or more transport segments form an Application Layer fragment. The fragment can be sent as confirmed (Data Link Layer function code 3 - CONFIRMED_USER_DATA) or unconfirmed (Data Link Layer function code 4 - UNCONFIRMED_USER_DATA). The transport segments within one fragment are always confirmed - with the exception of the last one (Data Link Layer function code 0 - ACK).
Group | Variations | Supported operations | Note |
|---|---|---|---|
Binary Input (1) | Packed format (1) | Reading (Read) | Binary inputs |
Binary Input Event (2) | Without time (1) | Analysis* | Reporting of binary inputs' changes |
Double-bit Binary Input (3) | Packed format (1) | Reading (Read) | Double-bit binary inputs |
Double-bit Binary Input Event (4) | Without time (1) | Analysis* | Reporting of double-bit binary inputs' changes |
Binary Output (10) | Packed format (1) | Reading (Read) | Binary outputs |
Binary Output Event (11) | Status w/o time (1) | Reading (Read) | Reporting of binary outputs' changes |
Binary Command (12) | Control relay output block (CROB) (1) | - | Not supported yet |
Binary Output Command Event (13) | Command status without time (1) | Analysis* | Reporting of changes (results of third party commands) |
Counter (20) | 32-bit with flag (1) | Reading (Read) | Counters |
Frozen Counter (21) | 32-bit with flag (1) | Reading (Read) | Counters- values captured when the object was frozen |
Counter Event (22) | 32-bit with flag (1) | Analysis* | Reporting of counters' changes |