DNP3 protocol

October 22, 2014

AGENDA

Agenda

InduSoft (Fabio Terezinho)

– Introduction to DNP3• Typical Architecture• DNP3 Protocol Main Concepts• Comprehensive list of Groups and Variations• Status bits• Classes

– InduSoft Web Studio DNP3 driver• DNP3 Driver Settings• DNP3 Standard Driver Sheet – Station• DNP3 Standard Driver Sheet – Services• DNP3 Standard Driver Sheet – Data Polling• DNP3 Standard Driver Sheet – Control Relay Output Block (CROB) Commands• DNP3 Standard Driver Sheet – Analog Output Block (AOB) Commands

– Demo

– Q & A

Introduction to DNP3

History: Initial development in 1993, based/inspired on the IEC 60870-5 protocol specification.

Goal: Open, standards-based Interoperability between substation computers, RTUs, IEDs (Intelligent Electronic Devices) and master stations (except inter-master station communications) for the electric utility industry.

Proposition: More robust, efficient, and interoperable than older protocols such as Modbus, at the cost of higher complexity.

Industries: Electric (primarily), water / waste water, transportation and the oil and gas.

Technical resources: including protocol specifications – DNP Users Grouphttp://www.dnp.org

Typical Architecture

DNP3

DNP3

DNP3 Protocol Main concepts

Master/Slave protocol

ISO/OSI mapping:

Application

Presentation

Session

Transport

Network

Data Link

Physical

IEC-1815DNP3 Specific

TCP / UDP

IP

Data Link

Multiple (e.g.: Ethernet)

ISO/OSI Model DNP 3

DNP3 Protocol Main concepts

- Data Objects (instead of memory addresses):- Group: General type of data with category- Variation: Representation for the data point- Index: Instance of a data object

- Group Types: Binary Input, Binary Output, Counters, Analog Input, Analog Output, Time, Class, Files, Devices, Applications, Alternate numeric.

- Group categories:- Static Objects: Current value. - Event Objects: Result of data changing. Historical objects. - Frozen Static Objects: Current frozen value, as a result of the data freeze requests. - Frozen Event Objects: Result of a frozen data changing. Historical objects.

- Variation: With flags, Without time, With absolute time, With relative time, 32-bit with flag, 16-bit with flag, etc.

- Index: Instance number of the object (starting with instance 0).

DNP3 Protocol Main concepts

- Group Numbers for each group category:

Type Group Number

Binary Input 1-9

Binary Output 10-19

Counters 20-29

Analog Input 30-39

Analog Output 40-49

Time 50-59

Class 60-69

Type Group Number

Files 70-79

Devices 80-89

Applications 90-99

Alternate numeric

100-109

Future Expansion

110-254

Reserved 0 and 255

Comprehensive list of Groups and Variations Group 0: Device Attributes (reserved) – Part 1/2

Group Variation Description0 211 Device Attributes – Identifier of support for user-specific attributes0 212 Device Attributes – Number of master-defined data set prototypes0 213 Device Attributes – Number of outstation-defined data set prototypes0 214 Device Attributes – Number of master-defined data sets0 215 Device Attributes – Number of outstation-defined data sets0 216 Device Attributes – Max number of binary outputs per request0 217 Device Attributes – Local timing accuracy0 218 Device Attributes – Duration of timing accuraccy0 219 Device Attributes – Support for analog output events0 220 Device Attributes – Max analog output index0 221 Device Attributes – Number of analog outputs0 222 Device Attributes – Support for binary output events0 223 Device Attributes – Max binary output index0 224 Device Attributes – Number of binary outputs0 225 Device Attributes – Support for frozen counter events0 226 Device Attributes – Support for frozen counters0 227 Device Attributes – Support for counter events0 228 Device Attributes – Max counter index0 229 Device Attributes – Number of counter points0 230 Device Attributes – Support for frozen analog inputs0 231 Device Attributes – Support for analog input events0 232 Device Attributes – Maximum analog input index

Comprehensive list of Groups and Variations Group 0: Device Attributes (reserved) – Part 2/2

Group Variation Description0 233 Device Attributes – Number of analog input points0 234 Device Attributes – Support for double-bit binary input events0 235 Device Attributes – Maximum double-bit binary input index0 236 Device Attributes – Number of double-bit binary input points0 237 Device Attributes – Support for binary input events0 238 Device Attributes – Max binary input index0 239 Device Attributes – Number of binary input points0 240 Device Attributes – Max transmit fragment size0 241 Device Attributes – Max receive fragment size0 242 Device Attributes – Device manufacturer’s software version0 243 Device Attributes – Device manufacturer’s hardware version0 244 Not available – Reserved for future assignm0 245 Device Attributes – User-assigned location name0 246 Device Attributes – User-assigned ID code/number0 247 Device Attributes – User-assigned device name0 248 Device Attributes – Device serial number0 249 Device Attributes – DNP subset and conformance0 250 Device Attributes – Device manufacturer’s product name and model0 251 Not available – Reserved for future assignm0 252 Device Attributes – Device manufacturer’s name0 253 Not available – Reserved for future assignm0 254 Devece Attributes – Non-specific all attributes request0 255 Device Attributes – List of attribute variations

Comprehensive list of Groups and Variations Group 1-9: Binary Input

Group Variation Description1 1 Binary Input – Packed format1 2 Binary Input – With flags2 1 Binary Input Event – Without time2 2 Binary Input Event – With absolute time2 3 Binary Input Event – With relative time3 1 Double-bit Binary Input – Packed format3 2 Double-bit Binary Input – With flags4 1 Double-bit Binary Input Event – Without time4 2 Double-bit Binary Input Event – With absolute time4 3 Double-bit Binary Input Event – With relative time

Comprehensive list of Groups and Variations Group 10-19: Binary Output

Group Variation Description10 1 Binary Output – Packed format10 2 Binary Output – Output status with flags11 1 Binary Output Event – Status without time11 2 Binary Output Event – Status with time12 1 Binary Command – Control relay output block (CROB)12 2 Binary Command – Pattern control block (PCB)12 3 Binary Command – Pattern mask13 1 Binary Output Command Event – Command status without time13 2 Binary Output Command Event – Command status with time

Comprehensive list of Groups and Variations Group 20-29: Counters – Part 1/2

Group Variation Description20 1 Counter – 32-bit with flag20 2 Counter – 16-bit with flag20 3 Counter – 32-bit with flag delta20 4 Counter – 16-bit with flag delta20 5 Counter – 32-bit without flag20 6 Counter – 16-bit without flag20 7 Counter – 32-bit without flag delta20 8 Counter – 16-bit without flag delta21 1 Frozen Counter – 32-bit with flag21 2 Frozen Counter – 16 bit with flag21 3 Frozen Counter – 32-bit with flag delta21 4 Frozen Counter – 16-bit with flag delta21 5 Frozen Counter – 32-bit with flag and time21 6 Frozen Counter – 16-bit with flag and time21 7 Frozen Counter – 32-bit with flag and time delta21 8 Frozen Counter – 16-bit with flag and time delta21 9 Frozen Counter – 32-bit without flag21 10 Frozen Counter – 16-bit without flag21 11 Frozen Counter – 32-bit without flag delta21 12 Frozen Counter – 16-bit without flag delta

Comprehensive list of Groups and Variations Group 20-29: Counters – Part 2/2

Group Variation Description22 1 Counter Event – 32-bit with flag22 2 Counter Event – 16-bit with flag22 3 Counter Event – 32-bit with flag delta22 4 Counter Event – 16-bit with flag delta22 5 Counter Event – 32-bit with flag and time22 6 Counter Event – 16-bit with flag and time22 7 Counter Event – 32-bit with flag and time delta22 8 Counter Event – 16-bit with flag and time delta23 1 Frozen Counter Event – 32-bit with flag23 2 Frozen Counter Event – 16-bit with flag23 3 Frozen Counter Event – 32-bit with flag delta23 4 Frozen Counter Event – 16-bit with flag delta23 5 Frozen Counter Event – 32-bit with flag and time23 6 Frozen Counter Event – 16-bit with flag and time23 7 Frozen Counter Event – 32-bit with flag and time delta23 8 Frozen Counter Event – 16-bit with flag and time delta

Comprehensive list of Groups and Variations Group 30-39: Analog Input – Part 1/2

Group Variation Description30 1 Analog Input – 32-bit with flag30 2 Analog Input – 16-bit with flag30 3 Analog Input – 32-bit without flag30 4 Analog Input – 16-bit without flag30 5 Analog Input – Single-prec flt-pt with flag30 6 Analog Input – Double-prec flt-pt with flag31 1 Frozen Analog Input – 32-bit with flag31 2 Frozen Analog Input – 16-bit with flag31 3 Frozen Analog Input – 32-bit with time-of-freeze31 4 Frozen Analog Input – 16-bit with time-of-freeze31 5 Frozen Analog Input – 32-bit without flag31 6 Frozen Analog Input – 16-bit without flag31 7 Frozen Analog Input – Single-prec flt-pt with flag31 8 Frozen Analog Input – Double-prec flt-pt with flag32 1 Analog Input Event – 32-bit without time32 2 Analog Input Event –16-bit without time32 3 Analog Input Event – 32-bit with time32 4 Analog Input Event – 16-bit with time32 5 Analog Input Event – Single-prec flt-pt without time32 6 Analog Input Event – Double-prec flt-pt without time32 7 Analog Input Event – Single-prec flt-pt with time32 8 Analog Input Event – Double-prec flt-pt with time

Comprehensive list of Groups and Variations Group 30-39: Analog Input – Part 2/2

Group Variation Description33 1 Frozen Analog Input Event – 32-bit without time33 2 Frozen Analog Input Event – 16-bit without time33 3 Frozen Analog Input Event – 32-bit with time33 4 Frozen Analog Input Event – 16-bit with time33 5 Frozen Analog Input Event – Single-prec flt-pt without time33 6 Frozen Analog Input Event – Double-prec flt-pt without time33 7 Frozen Analog Input Event – Single-prec flt-pt with time33 8 Frozen Analog Input Event – Double-prec flt-pt with time34 1 Analog Input Deadband – 16-bit34 2 Analog Input Deadband – 32-bit34 3 Analog Input Deadband – Single-prec flt-pt

Comprehensive list of Groups and Variations Group 40-49: Analog Output

Group Variation Description40 1 Analog Output Status – 32-bit with flag40 2 Analog Output Status – 16-bit with flag40 3 Analog Output Status – Single-prec flt-pt with flag40 4 Analog Output Status – Double-prec flt-pt with flag41 1 Analog Output – 32-bit41 2 Analog Output – 16-bit41 3 Analog Output – Single-prec flt-pt41 4 Analog Output – Double-prec flt-pt42 1 Analog Output Event – 32-bit without time42 2 Analog Output Event – 16-bit without time42 3 Analog Output Event – 32-bit with time42 4 Analog Output Event – 16-bit with time42 5 Analog Output Event – Single-prec flt-pt without time42 6 Analog Output Event – Double-prec flt-pt without time42 7 Analog Output Event – Single-prec flt-pt with time42 8 Analog Output Event – Double-prec flt-pt with time43 1 Analog Output Command Event – 32-bit without time43 2 Analog Output Command Event – 16-bit without time43 3 Analog Output Command Event – 32-bit with time43 4 Analog Output Command Event – 16-bit with time43 5 Analog Output Command Event – Single-prec flt-pt without time43 6 Analog Output Command Event – Double-prec flt-pt without time43 7 Analog Output Command Event – Single-prec flt-pt with time43 8 Analog Output Command Event – Double-prec flt-pt with time

Comprehensive list of Groups and Variations Group 50-59: Time

Group Variation Description50 1 Time and Date – Absolute time50 2 Time and Date – Absolute time and interval50 3 Time and Date – Absolute time at last recorded time51 1 Time and Date CTO – Absolute time synchronized51 2 Time and Date CTO – Absolute time unsynchronized52 1 Time Delay – Coarse52 2 Time Delay – Fine

Comprehensive list of Groups and Variations Group 60-69: Class

Group Variation Description60 1 Class Objects – Class 0 data60 2 Class Objects – Class 1 data60 3 Class Objects – Class 2 data60 4 Class Objects – Class 3 data

Comprehensive list of Groups and Variations Group 70-79: Files

Group Variation Description70 1 File-Control – File identifier (superseded)70 2 File-Control – Authentication70 3 File-Control – File command70 4 File-Control – File command status70 5 File-Control – File transport70 6 File-Control – File transport status70 7 File-Control – File descriptor70 8 File-Control – File specification string

Comprehensive list of Groups and Variations Group 80-89: Devices

Group Variation Description80 1 Internal Indications – Packed format81 1 Device Storage – Buffer fill status82 1 Device Profile – Functions and indexes83 1 Data Set – Private registration object83 2 Data Set – Private registration object descriptor85 1 Data Set Prototype – With UUID86 1 Data Set Descriptor – Data set contents86 2 Data Set Descriptor – Characteristics

Comprehensive list of Groups and Variations Group 90-99: Applications

Group Variation Description90 1 Application – Identifier91 1 Status of Requested Operation – Activate Configuration

Comprehensive list of Groups and Variations Group 100-109: Alternate Numeric

Group Variation Description100 1-3 Floating Point101 1 Binary-Coded Decimal Integer – Small101 2 Binary-Coded Decimal Integer – Medium101 3 Binary-Coded Decimal Integer – Large102 1 Unsigned Integer – 8-bit

Status BitsAcronym Name Description

OL On Line When off, indicates that the point cannot be read from the originator device.

RS Re-Start Indicates that IED is associated with the point being rebooted, so the point value is still not reliable.

CL Communication Lost Indicates failure to communicate with the IED. Therefore, the point may never have been read, or reading may be obsolete.

RF Remote Forced Indicates that the point is being forced by other device, other than IED.LF Local Forced Indicates that the point is being forced inside the IED.CF Chatter Filter Indicates that the point was filtered to remove unwanted transitions.

RO Roll-OverIndicates a shift of the counter, i.e., the passage of the maximum value to zero. This flag is no longer used by DNP3, it was kept here only for historical reasons. Its value is always zero.

OR integer with sign The value exceeds the range of representation (integer with sign) of 16 or 32 bits, or the measuring range of the A / D converter.

DC DisContinuity Indicates that the counter value should not be compared for getting changes in counting.

RE REference check Error in the conversion process from analog to digital, resulting in accuracy out of specification.

Classes

The DNP3 protocol supports the “Classes” feature. A class is a set of instances of objects. Each RTU can define objects in the classes 1, 2, or 3. To avoid sending several requests for different objects, the Master (SCADA) can send a request for all objects in a specific class (1, 2, or 3) or even for all objects from all classes (“class 0”). The assignment of each object instance with a class is configured in the RTU itself.

InduSoft Web Studio DNP3 Driver

IMPORTANT: The DNP3 driver requires the license add-on:“InduSoft Communication Package for Electrical Protocols” (IND-DRV-ELE)

DNP3 Driver Settings

Transport layer supported by the RTUs

IP Address (default) for the RTU

TCP Port (default) for the RTU

DNP3 Driver Settings

DNP Master Address

DNP3 Standard Driver Sheets - Station

<DNP RTU Address> (e.g.: 27)or

<IP>:<TCP Port>|<DNP RTU Address> (e.g.: 10.168.23.125:20000|27)

DNP3 Standard Driver Sheets – ServicesHeader: <Service>:<Group>.<Variation>[:<IndexOffset>]

<Service>: STATIC (Read static data), MONITOR (Unsolicited events), FRZ (Freeze), FRZNR (Freeze without response), FRZCLR (Freeze and clear), FRZCLRNR (Freeze and clear without response)

<Group>: Object group number (e.g.: 1 for Binary Input)

<Variation>: Object variation number (e.g.: 1 for packed format, for group 1)

<IndexOffset>: Optional offset added to the index of the object (instance number) configured in the Address column of the driver sheeet.

Address: <Index>[.<StatusBit>]

<Index>: Instance number for the object (added to the IndexOffset, if any)

<StatusBit>: Optional identifier for a status bit (e.g.: OL for On Line bit)

DNP3 Standard Driver Sheets – ServicesExamples for STATIC Service: Used to read (poll) static (current) values from objects

Header Address Remarks

STATIC:1.0 10Reads the static (current) value from the instance 10 of an Object Type 1 (Binary Input) with the default variation configured on the device (when using the STATIC service, you can specify 0 for variation, which means that the RTU will send the “default” variation type configured in the RTU itself).

STATIC:1.2 10 Reads the static (current) value from the instance 10 of an Object Type 1 (Binary Input) with flags (Variation 2 for Object Type 1).

STATIC:1.2:LF 10Reads the static (current) value of the LF (Local Forced) status bit from the instance 10 of an Object Type 1 (Binary Input) with flags (Variation 2 for Object Type 1).

STATIC:40.0 10Reads the static (current) value from the instance 10 of an Object Type 40 (Analog Output Status) with the default variation configured on the device (when using the STATIC service, you can specify 0 for variation, which means that the RTU will send the “default” variation type configured in the RTU itself).

STATIC:40.1 10 Reads the static (current) value from the instance 10 of an Object Type 40 (Analog Output Status) in 32-bits format with flags (Variation 1 for Object Type 40).

STATIC:40.1:LF 10Reads the static (current) value of the LF (Local Forced) status bit from the instance 10 of an Object Type 40 (Analog Output Status) in 32-bits format with flags (Variation 1 for Object Type 40).

DNP3 Standard Driver Sheets – ServicesExamples for MONITOR Service: Used to read (unsolicited) event values from objects

Header Address Remarks

MONITOR:2.1 10When the value of the instance 10 of an Object Type 2 (Binary Input Event) without time (Variation 1 for the Object Type 2) changes of value, the driver receives the value and updates the respective tag configured in the driver sheet.

MONITOR:2.1:LF 10When the static (current) value of the LF (Local Forced) status bit from the instance 10 of an Object Type 2 (Binary Input Event) without time (Variation 1 for the Object Type 2) changes of value, the driver receives this bit status value and updates the respective tag configured in the driver sheet.

MONITOR:42.1 10When the value of the instance 10 of an Object Type 42 (Analog Output Event) in 32-bit format without time (Variation 1 for the Object Type 42) changes of value, the driver receives the value and updates the respective tag configured in the driver sheet.

MONITOR:42.1:LF 10When the static (current) value of the LF (Local Forced) status bit from the instance 10 of an Object Type 2 (Analog Output Event) in 32-bit format without time (Variation 1 for the Object Type 42) changes of value, the driver receives this bit status value and updates the respective tag configured in the driver sheet.

DNP3 Standard Driver Sheets – ServicesExamples for FRZ Service: Used to write a command to freeze an object value

Header Address Remarks

FRZ:30.1 10

Sends a command to freeze the static (current) value from the instance 10 of an Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1 for Object Type 30). After sending the command, the driver waits for the acknowledgment of the RTU indicating that the command was successfully executed. If the successful confirmation is not received, the driver updates the “Write Status” field of the driver worksheet with the respective error code (a number different from 0). The actual frozen value is saved in the respective instance (10) of an Object Type 31 (Frozen Analog Input).

Examples for FRZNR Service: Used to write a command to freeze an object value, not expecting response (acknowledgment from the RTU)

Header Address Remarks

FRZNR:30.1 10Sends a command to freeze the static (current) value from the instance 10 of an Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1 for Object Type 30). The actual frozen value is saved in the respective instance (10) of an Object Type 31 (Frozen Analog Input).

DNP3 Standard Driver Sheets – ServicesExamples for FRZCLR Service: Used to write a command to freeze and clear an object value

Header Address Remarks

FRZ:30.1 10

Sends a command to freeze and clear the static (current) value from the instance 10 of an Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1 for Object Type 30). After sending the command, the driver waits for the acknowledgment of the RTU indicating that the command was successfully executed. If the successful confirmation is not received, the driver updates the “Write Status” field of the driver worksheet with the respective error code (a number different from 0). The actual frozen value is saved in the respective instance (10) of an Object Type 31 (Frozen Analog Input).

Examples for FRZCLRNR Service: Used to write a command to freeze and clear an object value, not expecting response (acknowledgment from the RTU)

Header Address Remarks

FRZNR:30.1 10Sends a command to freeze and clear the static (current) value from the instance 10 of an Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1 for Object Type 30). The actual frozen value is saved in the respective instance (10) of an Object Type 31 (Frozen Analog Input).

DNP3 Standard Driver Sheets – Data PollingHeader: POLL

Address: <Class Number>

<Class Number>: The DNP3 protocol supports the “Classes” feature. A class is a set of instances of objects. Each RTU can define objects in the classes 1, 2, or 3. To avoid sending several requests for different objects, the Master (SCADA) can send a request for all objects in a specific class (1, 2, or 3) or even for all objects from all classes (“class 0”). The assignment of each object instance with a class is configured in the RTU itself.

After receiving the POLL request from the Master (SCADA), the RTU must send the values for all object instances associated with the requested class (or all objects from all classes if the Address is configured with the value 0). Matching object instances in Standard Driver Worksheets configured with the Header MONITOR:<Group>.<Variation>[:<IndexOffset>] will update the tags with the values sent by the RTU.

DNP3 Standard Driver Sheets – Data PollingExamples for Data Polling all object instances associated with the Class 1

Header Address Remarks

POLL 1Sends a command to the RTU requesting the values from all objects associated (in the RTU configuration) with the Class 1. Matching values in Standard Driver Worksheets configured with the MONITOR:<Group>.<Variation>[:<IndexOffset>] will update the tags with the values sent by the RTU.

Examples for Data Polling all object instances associated with any ClassHeader Address Remarks

POLL 0

Sends a command to the RTU requesting the values from all objects associated (in the RTU configuration) with any Class (1, 2, or 3). Matching values in Standard Driver Worksheets configured with the MONITOR:<Group>.<Variation>[:<IndexOffset>] will update the tags with the values sent by the RTU.

DNP3 Standard Driver Sheets – Control Relay Output Block (CROB) commands

Header: CROB

Address: See table below

Address DescriptionAccepted Tag Values

DefaultSYNTAX Description

FUNCTION The function associated with the command

SELECT Select

N.A.OPERATE OperateDIRECTOP Direct Operate

DIRECTOPNR Direct Operate without responseINDEX Index of the object instance Integer value equal or greater than 0 N.A.

OPTYPE Type of the operation to be performed

NUL Device specific

NULPULSEON Pulse OnPULSEOFF Pulse OffLATCHON Latch OnLATCHOFF Latch Off

TRIPCODE Trip command typeNUL Nul

NULCLOSE CloseTRIP Trip

ONTIME Duration, in milliseconds, to remain ON Integer value equal or greater than 0 N.A.OFFTIME Duration, in milliseconds, to remain OFF Integer value equal or greater than 0 0

CLEAR Clear flag 0 or 1 0COUNT Number of times to execute the operation Integer value equal or greater than 1 and less than or equal to 255 1

DNP3 Standard Driver Sheets – Analog Output Block (AOB) commands

Header: AOB

Address: See table below

Address Description Accepted Tag Values DefaultSYNTAX Description

FUNCTION The function associated with the command

SELECT Select

N.A.OPERATE OperateDIRECTOP Direct Operate

DIRECTOPNR Direct Operate without responseINDEX Index of the object instance Integer value equal or greater than 0 N.A.VALUE Value written to the Analog Output Numeric value N.A.

TYPE Data type

INT 32-bit signed integer

SINTSINT 16-bit signed integer

FLOAT 32-bit IEEE-754 floating pointDOUBLE 64-bit IEEE-754 floating point

DEMO

Q & A

HOW TO CONTACT INDUSOFT

LicensingUS and Canada Toll-Free: 855-274-8381Direct dial from anywhere: 512-910-8044

SupportUS and Canada Toll-Free: 855-269-4489Direct dial from anywhere: 512-879-4107

Additional New InduSoft Numbers

Email(US) info@indusoft.com(Brazil) info@indusoft.com.br(Germany) info@indusoft.com.de

Support support@indusoft.comWeb site

(English) www.indusoft.com(Portuguese) www.indusoft.com.br(German) www.indusoft.com.de

Phone (512) 349-0334 (US) +55-11-3293-9139 (Brazil) +49 (0) 6227-732510 (Germany)

Toll-Free 877-INDUSOFT (877-463-8763) Fax (512) 349-0375

Germany

USA

Brazil

Contact InduSoft Today

THANK YOU!