InduSoft Web Studio and DNP3

DNP3 protocol
October 22, 2014

Agenda
InduSoft (Fabio Terezinho)
– Introduction to DNP3
• Typical Architecture
• DNP3 Protocol Main Concepts
• Comprehensive list of Groups and Variations
• Status bits
• Classes
– InduSoft Web Studio DNP3 driver
• DNP3 Driver Settings
• DNP3 Standard Driver Sheet – Station
• DNP3 Standard Driver Sheet – Services
• DNP3 Standard Driver Sheet – Data Polling
• DNP3 Standard Driver Sheet – Control Relay Output Block (CROB) Commands
• DNP3 Standard Driver Sheet – Analog Output Block (AOB) Commands
– Demo
– Q & A

Introduction to DNP3
History: Initial development in 1993, based/inspired on the IEC 60870-5 protocol
specification.
Goal: Open, standards-based Interoperability between substation computers, RTUs, IEDs
(Intelligent Electronic Devices) and master stations (except inter-master station
communications) for the electric utility industry.
Proposition: More robust, efficient, and interoperable than older protocols such as Modbus,
at the cost of higher complexity.
Industries: Electric (primarily), water / waste water, transportation and the oil and gas.
Technical resources: including protocol specifications – DNP Users Group
http://www.dnp.org

Typical Architecture
DNP3
DNP3

DNP3 Protocol Main concepts
Master/Slave protocol
ISO/OSI mapping:
ISO/OSI Model DNP 3
Application
Presentation
Session
Transport
Network
Data Link
Physical
IEC-1815
DNP3 Specific
TCP / UDP
IP
Data Link
Multiple (e.g.: Ethernet)

- Data Objects (instead of memory addresses):
- Group: General type of data with category
- Variation: Representation for the data point
- Index: Instance of a data object
- Group Types: Binary Input, Binary Output, Counters, Analog Input, Analog Output, Time,
Class, Files, Devices, Applications, Alternate numeric.
- Group categories:
- Static Objects: Current value.
- Event Objects: Result of data changing. Historical objects.
- Frozen Static Objects: Current frozen value, as a result of the data freeze requests.
- Frozen Event Objects: Result of a frozen data changing. Historical objects.
- Variation: With flags, Without time, With absolute time, With relative time, 32-bit with
flag, 16-bit with flag, etc.
- Index: Instance number of the object (starting with instance 0).

- Group Numbers for each group category:
Type Group Number
Binary Input 1-9
Binary Output 10-19
Counters 20-29
Analog Input 30-39
Analog Output 40-49
Time 50-59
Class 60-69
Type Group Number
Files 70-79
Devices 80-89
Applications 90-99
Alternate
100-109
numeric
Future
Expansion
110-254
Reserved 0 and 255

Comprehensive list of Groups and Variations
Group 0: Device Attributes (reserved) – Part 1/2
Group Variation Description
0 211 Device Attributes – Identifier of support for user-specific attributes
0 212 Device Attributes – Number of master-defined data set prototypes
0 213 Device Attributes – Number of outstation-defined data set prototypes
0 214 Device Attributes – Number of master-defined data sets
0 215 Device Attributes – Number of outstation-defined data sets
0 216 Device Attributes – Max number of binary outputs per request
0 217 Device Attributes – Local timing accuracy
0 218 Device Attributes – Duration of timing accuraccy
0 219 Device Attributes – Support for analog output events
0 220 Device Attributes – Max analog output index
0 221 Device Attributes – Number of analog outputs
0 222 Device Attributes – Support for binary output events
0 223 Device Attributes – Max binary output index
0 224 Device Attributes – Number of binary outputs
0 225 Device Attributes – Support for frozen counter events
0 226 Device Attributes – Support for frozen counters
0 227 Device Attributes – Support for counter events
0 228 Device Attributes – Max counter index
0 229 Device Attributes – Number of counter points
0 230 Device Attributes – Support for frozen analog inputs
0 231 Device Attributes – Support for analog input events
0 232 Device Attributes – Maximum analog input index

Group 0: Device Attributes (reserved) – Part 2/2
0 233 Device Attributes – Number of analog input points
0 234 Device Attributes – Support for double-bit binary input events
0 235 Device Attributes – Maximum double-bit binary input index
0 236 Device Attributes – Number of double-bit binary input points
0 237 Device Attributes – Support for binary input events
0 238 Device Attributes – Max binary input index
0 239 Device Attributes – Number of binary input points
0 240 Device Attributes – Max transmit fragment size
0 241 Device Attributes – Max receive fragment size
0 242 Device Attributes – Device manufacturer’s software version
0 243 Device Attributes – Device manufacturer’s hardware version
0 244 Not available – Reserved for future assignm
0 245 Device Attributes – User-assigned location name
0 246 Device Attributes – User-assigned ID code/number
0 247 Device Attributes – User-assigned device name
0 248 Device Attributes – Device serial number
0 249 Device Attributes – DNP subset and conformance
0 250 Device Attributes – Device manufacturer’s product name and model
0 252 Device Attributes – Device manufacturer’s name
0 254 Devece Attributes – Non-specific all attributes request
0 255 Device Attributes – List of attribute variations

Group 1-9: Binary Input
1 1 Binary Input – Packed format
1 2 Binary Input – With flags
2 1 Binary Input Event – Without time
2 2 Binary Input Event – With absolute time
2 3 Binary Input Event – With relative time
3 1 Double-bit Binary Input – Packed format
3 2 Double-bit Binary Input – With flags
4 1 Double-bit Binary Input Event – Without time
4 2 Double-bit Binary Input Event – With absolute time
4 3 Double-bit Binary Input Event – With relative time

Group 10-19: Binary Output
10 1 Binary Output – Packed format
10 2 Binary Output – Output status with flags
11 1 Binary Output Event – Status without time
11 2 Binary Output Event – Status with time
12 1 Binary Command – Control relay output block (CROB)
12 2 Binary Command – Pattern control block (PCB)
12 3 Binary Command – Pattern mask
13 1 Binary Output Command Event – Command status without time
13 2 Binary Output Command Event – Command status with time

Group 20-29: Counters – Part 1/2
20 1 Counter – 32-bit with flag
20 2 Counter – 16-bit with flag
20 3 Counter – 32-bit with flag delta
20 4 Counter – 16-bit with flag delta
20 5 Counter – 32-bit without flag
20 6 Counter – 16-bit without flag
20 7 Counter – 32-bit without flag delta
20 8 Counter – 16-bit without flag delta
21 1 Frozen Counter – 32-bit with flag
21 2 Frozen Counter – 16 bit with flag
21 3 Frozen Counter – 32-bit with flag delta
21 4 Frozen Counter – 16-bit with flag delta
21 5 Frozen Counter – 32-bit with flag and time
21 6 Frozen Counter – 16-bit with flag and time
21 7 Frozen Counter – 32-bit with flag and time delta
21 8 Frozen Counter – 16-bit with flag and time delta
21 9 Frozen Counter – 32-bit without flag
21 10 Frozen Counter – 16-bit without flag
21 11 Frozen Counter – 32-bit without flag delta
21 12 Frozen Counter – 16-bit without flag delta

Group 20-29: Counters – Part 2/2
22 1 Counter Event – 32-bit with flag
22 2 Counter Event – 16-bit with flag
22 3 Counter Event – 32-bit with flag delta
22 4 Counter Event – 16-bit with flag delta
22 5 Counter Event – 32-bit with flag and time
22 6 Counter Event – 16-bit with flag and time
22 7 Counter Event – 32-bit with flag and time delta
22 8 Counter Event – 16-bit with flag and time delta
23 1 Frozen Counter Event – 32-bit with flag
23 2 Frozen Counter Event – 16-bit with flag
23 3 Frozen Counter Event – 32-bit with flag delta
23 4 Frozen Counter Event – 16-bit with flag delta
23 5 Frozen Counter Event – 32-bit with flag and time
23 6 Frozen Counter Event – 16-bit with flag and time
23 7 Frozen Counter Event – 32-bit with flag and time delta
23 8 Frozen Counter Event – 16-bit with flag and time delta

Group 30-39: Analog Input – Part 1/2
30 1 Analog Input – 32-bit with flag
30 2 Analog Input – 16-bit with flag
30 3 Analog Input – 32-bit without flag
30 4 Analog Input – 16-bit without flag
30 5 Analog Input – Single-prec flt-pt with flag
30 6 Analog Input – Double-prec flt-pt with flag
31 1 Frozen Analog Input – 32-bit with flag
31 2 Frozen Analog Input – 16-bit with flag
31 3 Frozen Analog Input – 32-bit with time-of-freeze
31 4 Frozen Analog Input – 16-bit with time-of-freeze
31 5 Frozen Analog Input – 32-bit without flag
31 6 Frozen Analog Input – 16-bit without flag
31 7 Frozen Analog Input – Single-prec flt-pt with flag
31 8 Frozen Analog Input – Double-prec flt-pt with flag
32 1 Analog Input Event – 32-bit without time
32 2 Analog Input Event –16-bit without time
32 3 Analog Input Event – 32-bit with time
32 4 Analog Input Event – 16-bit with time
32 5 Analog Input Event – Single-prec flt-pt without time
32 6 Analog Input Event – Double-prec flt-pt without time
32 7 Analog Input Event – Single-prec flt-pt with time
32 8 Analog Input Event – Double-prec flt-pt with time

Group 30-39: Analog Input – Part 2/2
33 1 Frozen Analog Input Event – 32-bit without time
33 2 Frozen Analog Input Event – 16-bit without time
33 3 Frozen Analog Input Event – 32-bit with time
33 4 Frozen Analog Input Event – 16-bit with time
33 5 Frozen Analog Input Event – Single-prec flt-pt without time
33 6 Frozen Analog Input Event – Double-prec flt-pt without time
33 7 Frozen Analog Input Event – Single-prec flt-pt with time
33 8 Frozen Analog Input Event – Double-prec flt-pt with time
34 1 Analog Input Deadband – 16-bit
34 2 Analog Input Deadband – 32-bit
34 3 Analog Input Deadband – Single-prec flt-pt

Group 40-49: Analog Output
40 1 Analog Output Status – 32-bit with flag
40 2 Analog Output Status – 16-bit with flag
40 3 Analog Output Status – Single-prec flt-pt with flag
40 4 Analog Output Status – Double-prec flt-pt with flag
41 1 Analog Output – 32-bit
41 2 Analog Output – 16-bit
41 3 Analog Output – Single-prec flt-pt
41 4 Analog Output – Double-prec flt-pt
42 1 Analog Output Event – 32-bit without time
42 2 Analog Output Event – 16-bit without time
42 3 Analog Output Event – 32-bit with time
42 4 Analog Output Event – 16-bit with time
42 5 Analog Output Event – Single-prec flt-pt without time
42 6 Analog Output Event – Double-prec flt-pt without time
42 7 Analog Output Event – Single-prec flt-pt with time
42 8 Analog Output Event – Double-prec flt-pt with time
43 1 Analog Output Command Event – 32-bit without time
43 2 Analog Output Command Event – 16-bit without time
43 3 Analog Output Command Event – 32-bit with time
43 4 Analog Output Command Event – 16-bit with time
43 5 Analog Output Command Event – Single-prec flt-pt without time
43 6 Analog Output Command Event – Double-prec flt-pt without time
43 7 Analog Output Command Event – Single-prec flt-pt with time
43 8 Analog Output Command Event – Double-prec flt-pt with time

Group 50-59: Time
50 1 Time and Date – Absolute time
50 2 Time and Date – Absolute time and interval
50 3 Time and Date – Absolute time at last recorded time
51 1 Time and Date CTO – Absolute time synchronized
51 2 Time and Date CTO – Absolute time unsynchronized
52 1 Time Delay – Coarse
52 2 Time Delay – Fine

Group 60-69: Class
60 1 Class Objects – Class 0 data

Group 70-79: Files
70 1 File-Control – File identifier (superseded)
70 2 File-Control – Authentication
70 3 File-Control – File command
70 4 File-Control – File command status
70 5 File-Control – File transport
70 6 File-Control – File transport status
70 7 File-Control – File descriptor
70 8 File-Control – File specification string

Group 80-89: Devices
80 1 Internal Indications – Packed format
81 1 Device Storage – Buffer fill status
82 1 Device Profile – Functions and indexes
83 1 Data Set – Private registration object
83 2 Data Set – Private registration object descriptor
85 1 Data Set Prototype – With UUID
86 1 Data Set Descriptor – Data set contents
86 2 Data Set Descriptor – Characteristics

Group 90-99: Applications
90 1 Application – Identifier
91 1 Status of Requested Operation – Activate Configuration

Group 100-109: Alternate Numeric
100 1-3 Floating Point
101 1 Binary-Coded Decimal Integer – Small
101 2 Binary-Coded Decimal Integer – Medium
101 3 Binary-Coded Decimal Integer – Large
102 1 Unsigned Integer – 8-bit

Status Bits
Acronym Name Description
OL On Line
When off, indicates that the point cannot be read from the originator
device.
RS Re-Start
Indicates that IED is associated with the point being rebooted, so the point
value is still not reliable.
CL Communication Lost
Indicates failure to communicate with the IED. Therefore, the point may
never have been read, or reading may be obsolete.
RF Remote Forced Indicates that the point is being forced by other device, other than IED.
LF Local Forced Indicates that the point is being forced inside the IED.
CF Chatter Filter Indicates that the point was filtered to remove unwanted transitions.
RO Roll-Over
Indicates a shift of the counter, i.e., the passage of the maximum value to
zero. This flag is no longer used by DNP3, it was kept here only for
historical reasons. Its value is always zero.
OR integer with sign
The value exceeds the range of representation (integer with sign) of 16 or
32 bits, or the measuring range of the A / D converter.
DC DisContinuity
Indicates that the counter value should not be compared for getting
changes in counting.
RE REference check
Error in the conversion process from analog to digital, resulting in accuracy
out of specification.

Classes
The DNP3 protocol supports the “Classes” feature. A class
is a set of instances of objects. Each RTU can define
objects in the classes 1, 2, or 3. To avoid sending several
requests for different objects, the Master (SCADA) can
send a request for all objects in a specific class (1, 2, or 3)
or even for all objects from all classes (“class 0”). The
assignment of each object instance with a class is
configured in the RTU itself.

InduSoft Web Studio DNP3 Driver
IMPORTANT: The DNP3 driver requires the license add-on:
“InduSoft Communication Package for Electrical Protocols” (IND-DRV-ELE)

DNP3 Driver Settings
Transport layer supported by
the RTUs
IP Address (default) for the
RTU
TCP Port (default) for the
RTU

DNP3 Driver Settings
DNP Master Address

DNP3 Standard Driver Sheets - Station
<DNP RTU Address> (e.g.: 27)
or
<IP>:<TCP Port>|<DNP RTU Address> (e.g.: 10.168.23.125:20000|27)

DNP3 Standard Driver Sheets – Services
Header: <Service>:<Group>.<Variation>[:<IndexOffset>]
<Service>: STATIC (Read static data), MONITOR (Unsolicited events), FRZ (Freeze),
FRZNR (Freeze without response), FRZCLR (Freeze and clear), FRZCLRNR (Freeze
and clear without response)
<Group>: Object group number (e.g.: 1 for Binary Input)
<Variation>: Object variation number (e.g.: 1 for packed format, for group 1)
<IndexOffset>: Optional offset added to the index of the object (instance number)
configured in the Address column of the driver sheeet.
Address: <Index>[.<StatusBit>]
<Index>: Instance number for the object (added to the IndexOffset, if any)
<StatusBit>: Optional identifier for a status bit (e.g.: OL for On Line bit)

Examples for STATIC Service: Used to read (poll) static (current) values from objects
Header Address Remarks
STATIC:1.0 10
Reads the static (current) value from the instance 10 of an Object Type 1 (Binary
Input) with the default variation configured on the device (when using the STATIC
service, you can specify 0 for variation, which means that the RTU will send the
“default” variation type configured in the RTU itself).
STATIC:1.2 10
Reads the static (current) value from the instance 10 of an Object Type 1 (Binary
Input) with flags (Variation 2 for Object Type 1).
STATIC:1.2:LF 10
Reads the static (current) value of the LF (Local Forced) status bit from the
instance 10 of an Object Type 1 (Binary Input) with flags (Variation 2 for Object
Type 1).
STATIC:40.0 10
Reads the static (current) value from the instance 10 of an Object Type 40
(Analog Output Status) with the default variation configured on the device (when
using the STATIC service, you can specify 0 for variation, which means that the
RTU will send the “default” variation type configured in the RTU itself).
STATIC:40.1 10
Reads the static (current) value from the instance 10 of an Object Type 40
(Analog Output Status) in 32-bits format with flags (Variation 1 for Object Type
40).
STATIC:40.1:LF 10
Reads the static (current) value of the LF (Local Forced) status bit from the
instance 10 of an Object Type 40 (Analog Output Status) in 32-bits format with
flags (Variation 1 for Object Type 40).

Examples for MONITOR Service: Used to read (unsolicited) event values from objects
MONITOR:2.1 10
When the value of the instance 10 of an Object Type 2 (Binary Input Event)
without time (Variation 1 for the Object Type 2) changes of value, the driver
receives the value and updates the respective tag configured in the driver sheet.
MONITOR:2.1:LF 10
When the static (current) value of the LF (Local Forced) status bit from the
instance 10 of an Object Type 2 (Binary Input Event) without time (Variation 1
for the Object Type 2) changes of value, the driver receives this bit status value
and updates the respective tag configured in the driver sheet.
MONITOR:42.1 10
When the value of the instance 10 of an Object Type 42 (Analog Output Event) in
32-bit format without time (Variation 1 for the Object Type 42) changes of value,
the driver receives the value and updates the respective tag configured in the
driver sheet.
MONITOR:42.1:LF 10
When the static (current) value of the LF (Local Forced) status bit from the
instance 10 of an Object Type 2 (Analog Output Event) in 32-bit format without
time (Variation 1 for the Object Type 42) changes of value, the driver receives
this bit status value and updates the respective tag configured in the driver
sheet.

Examples for FRZ Service: Used to write a command to freeze an object value
FRZ:30.1 10
Sends a command to freeze the static (current) value from the instance 10 of an
Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1 for Object
Type 30). After sending the command, the driver waits for the acknowledgment
of the RTU indicating that the command was successfully executed. If the
successful confirmation is not received, the driver updates the “Write Status”
field of the driver worksheet with the respective error code (a number different
from 0). The actual frozen value is saved in the respective instance (10) of an
Object Type 31 (Frozen Analog Input).
Examples for FRZNR Service: Used to write a command to freeze an object value, not
expecting response (acknowledgment from the RTU)
FRZNR:30.1 10
Sends a command to freeze the static (current) value from the instance 10 of an
Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1 for Object
Type 30). The actual frozen value is saved in the respective instance (10) of an
Object Type 31 (Frozen Analog Input).

Examples for FRZCLR Service: Used to write a command to freeze and clear an object value
FRZ:30.1 10
Sends a command to freeze and clear the static (current) value from the instance
10 of an Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1
for Object Type 30). After sending the command, the driver waits for the
acknowledgment of the RTU indicating that the command was successfully
executed. If the successful confirmation is not received, the driver updates the
“Write Status” field of the driver worksheet with the respective error code (a
number different from 0). The actual frozen value is saved in the respective
instance (10) of an Object Type 31 (Frozen Analog Input).
Examples for FRZCLRNR Service: Used to write a command to freeze and clear an object
value, not expecting response (acknowledgment from the RTU)
FRZNR:30.1 10
Sends a command to freeze and clear the static (current) value from the instance
10 of an Object Type 30 (Analog Input) in 32-bits format with flags (Variation 1
for Object Type 30). The actual frozen value is saved in the respective instance
(10) of an Object Type 31 (Frozen Analog Input).

DNP3 Standard Driver Sheets – Data Polling
Header: POLL
Address: <Class Number>
<Class Number>: The DNP3 protocol supports the “Classes” feature. A class is a set
of instances of objects. Each RTU can define objects in the classes 1, 2, or 3. To
avoid sending several requests for different objects, the Master (SCADA) can send
a request for all objects in a specific class (1, 2, or 3) or even for all objects from all
classes (“class 0”). The assignment of each object instance with a class is
configured in the RTU itself.
After receiving the POLL request from the Master (SCADA), the RTU must send the
values for all object instances associated with the requested class (or all objects
from all classes if the Address is configured with the value 0). Matching object
instances in Standard Driver Worksheets configured with the Header
MONITOR:<Group>.<Variation>[:<IndexOffset>] will update the tags with the
values sent by the RTU.

DNP3 Standard Driver Sheets – Data Polling
Examples for Data Polling all object instances associated with the Class 1
POLL 1
Sends a command to the RTU requesting the values from all objects associated
(in the RTU configuration) with the Class 1. Matching values in Standard Driver
Worksheets configured with the MONITOR:<Group>.<Variation>[:<IndexOffset>]
will update the tags with the values sent by the RTU.
Examples for Data Polling all object instances associated with any Class
POLL 0
Sends a command to the RTU requesting the values from all objects associated
(in the RTU configuration) with any Class (1, 2, or 3). Matching values in Standard
Driver Worksheets configured with the
MONITOR:<Group>.<Variation>[:<IndexOffset>] will update the tags with the
values sent by the RTU.

DNP3 Standard Driver Sheets – Control Relay
Output Block (CROB) commands
Header: CROB
Address: See table below
Address Description
Accepted Tag Values
Default
SYNTAX Description
FUNCTION The function associated with the command
SELECT Select
N.A.
OPERATE Operate
DIRECTOP Direct Operate
DIRECTOPNR Direct Operate without response
INDEX Index of the object instance Integer value equal or greater than 0 N.A.
OPTYPE Type of the operation to be performed
NUL Device specific
NUL
PULSEON Pulse On
PULSEOFF Pulse Off
LATCHON Latch On
LATCHOFF Latch Off
TRIPCODE Trip command type
NUL Nul
CLOSE Close NUL
TRIP Trip
ONTIME Duration, in milliseconds, to remain ON Integer value equal or greater than 0 N.A.
OFFTIME Duration, in milliseconds, to remain OFF Integer value equal or greater than 0 0
CLEAR Clear flag 0 or 1 0
COUNT Number of times to execute the operation Integer value equal or greater than 1 and less than or equal to 255 1

DNP3 Standard Driver Sheets – Analog Output
Block (AOB) commands
Header: AOB
Address: See table below
Address Description
Accepted Tag Values
Default
SYNTAX Description
FUNCTION The function associated with the command
SELECT Select
N.A.
OPERATE Operate
DIRECTOP Direct Operate
DIRECTOPNR Direct Operate without response
INDEX Index of the object instance Integer value equal or greater than 0 N.A.
VALUE Value written to the Analog Output Numeric value N.A.
TYPE Data type
INT 32-bit signed integer
SINT
SINT 16-bit signed integer
FLOAT 32-bit IEEE-754 floating point
DOUBLE 64-bit IEEE-754 floating point

Additional New InduSoft Numbers
Licensing
US and Canada Toll-Free: 855-274-8381
Direct dial from anywhere: 512-910-8044
Support
US and Canada Toll-Free: 855-269-4489
Direct dial from anywhere: 512-879-4107

Email
(US) info@indusoft.com
(Brazil) info@indusoft.com.br
(Germany) info@indusoft.com.de
Support support@indusoft.com
Web site
(English) www.indusoft.com
(Portuguese) www.indusoft.com.br
(German) www.indusoft.com.de
Phone (512) 349-0334 (US)
+55-11-3293-9139 (Brazil)
+49 (0) 6227-732510 (Germany)
Toll-Free 877-INDUSOFT (877-463-8763)
Fax (512) 349-0375
USA
Germany
Brazil
Contact InduSoft Today

InduSoft Web Studio and DNP3

More Related Content

What's hot (20)

Viewers also liked (13)

Similar to InduSoft Web Studio and DNP3 (20)

More from AVEVA (20)

Recently uploaded (20)

InduSoft Web Studio and DNP3