Adc01-Doc-146 Advc Protocol Manual Dnp3 r15 Web

DNP3 Protocol
Technical Manual for the

ADVC Controller Range
Scope of this document

Describes the DNP3 Protocol Implementation
on ADVC controller range.
Limitations
This document is copyright and is provided

solely for the use of the recipient. It is not to
be copied in any way, nor its contents divulged
to any third party, nor to be used as the basis
of a tender or specification without the express
written permission of Schneider Electric
(Australia) Pty Limited.
This document discloses confidential intellectual
property that belongs to Schneider Electric
(Australia) Pty Limited. This document does
not invest any rights to Schneider Electric
(Australia) Pty Limited intellectual property in
the recipient. Moreover, the recipient is required
not to disclose any of the intellectual property
contained in this document to any other party
unless authorised in writing by Schneider
Electric (Australia) Pty Limited.
Disclaimer
The advisory procedures and information

contained within this document have been
compiled as a guide to the safe and
effective operation of products supplied by
Schneider Electric.
It has been prepared in conjunction with
references from sub-assembly suppliers and the
collective experience of the manufacturer.
In-service conditions for use of the products
may vary between customers and end-users.
Consequently, this document is offered as a
guide only. It should be used in conjunction
with the customers own safety procedures,
maintenance program, engineering judgment
and training qualifications.
No responsibility, either direct or consequential,
for injury or equipment failure can be accepted
by the manufacturer resulting from the use of
this document.
2 | Schneider Electric
Copyright
2012 by
Schneider Electric (Australia) Pty Limited
All Rights Reserved.
No part of the contents of this document may
be reproduced or transmitted in any form or
by any means without the written permission
of the manufacturer.
Document part number

ADC01-DOC-146
Revision
R15
List of figures
Revision history:
R00
Draft. Created from N00-324 R48
R01 Several changes including better wording, layout
21/02/04
Figure 1: WSOS DNP3 Configuration tool
24
01/03/04
of Unsol and Database pages
R02 Updated to reflect some implementation issues,
24/05/04
added VTO
Information, removed alarming as DNP3 feature
R03 General update of descriptions, added
18/06/04
Configurable IO section.
R04 Added the AI Deadband section
11/07/04
R05 Minor corrections. Added Tx Delay
17/10/04
R06 Minor corrections as per document review
25/11/04
R07 Amend Unsolicited Response Retry Delay
20/02/06
OCP field.
Add applicability note regarding GMT Offset.
Add note regarding V42 1ms time
stamp resolution.
R08 RFC12769 enhancements:- for V43 release
29/05/09
A43-03.00
4.3.2 Unsolicited Response Settings
(REGENERATED/IDENTICAL)
4.2.2 Transmission Services Settings
(Operate Seq Chk)
4.5.1 Database Settings (Analog Evts)
R09 RFC14221 ADVC:String Amendments
02/06/09
R10
22/06/09
Add setting table notes for:4.3.2 Unsolicited Response Settings

(REGENERATED/IDENTICAL)
4.5.1 Database Settings (Analog Evts)
R11
Updated company name, address and

phone numbers.
08/07/09
R12
RFC11922 added for V44 release A44-11.00
18/08/09
4.6 DNP3 over IP
R13
Removed older controller references
10/09/09
R14
Updated references and implementation table

according to latest DNP3 specs.
05/10/09
R15
Unsolicited max retries update
09/02/10
DNP3 Protocol Technical Manual for the ADVC Controller Range (ADC01-DOC-146) | 3
Contents
1. Introduction
2. Overview
2.1.
Status Points
2.2. Controls
2.3.
Operator interfaces
2.4.
Password Protection
3. Applicability
3.1.
Control Cubicle Software
3.2.
GMT Offset
3.3.
DNP3 Protocol
3.4. Terminology
4.
Protocol Configuration
4.1. Communications
4.2.
Transmission Services
Configuration
10
4.3.
Unsolicited Response
Configuration
14
4.4. Diagnostics
19
4.5.
Data Configuration
21
4.6.
DNP3 over IP
26
Appendix A Protocol Timings
29
Appendix B DNP3 Device Profile
29
29
DNP3 Device Profile
Appendix C DNP3 Implementation Table
31
Controller DNP3
Implementation Table
31
DNP3 Function Codes
34
DNP3 Qualifiers
35
DNP3 Internal Indication Bits
35
DNP3 Object Status Flags
35
DNP3 Control Operation
36
DNP3 Technical Bulletins
36
1. Introduction
This document describes the DNP3 implementation for the ADVC Controller Range. It describes the
DNP3 implementation within the controller and its panel interface.
For more information about DNP3 input/output point map, point descriptions and attributes per
point refer to the WSOS5 DNP IO configuration tool and its documentation.
2 Overview
The controller combines the functions of protection relay and switchgear controller into a single
intelligent electronic device (IED). The controller provides a user friendly operator interface on a
LCD control panel that allows configuration and control of the switchgear. In addition the controller
generates time tagged events which are displayed on the operator control panel. These
events show the history of the switchgear operation for the benefit of the operator and for post
fault analysis.
Examples would be:
Operator Actions such as trip or close
Protection Pick up
Protection Trips
Fault Current Levels
Auto-reclose actions.
These events are optimised to give the operator the most useful information. Electricity supply
utilities frequently link the controller into their SCADA systems as a Remote Terminal Unit (RTU).
To make this simple the controller provides:
Mounting room for a radio or modem in the control cubicle
Power supply for the radio or modem in the control cubicle
Embedded protocol handler for the required SCADA protocol in the controller firmware.
The DNP3 protocol allows digital and analog data to be sent from the controller to the SCADA
system with time tags attached.
2.1 Status Points

This implementation provides a set of status information about the switchgear that can be used by
a SCADA system to generate displays and events for operational purposes. This data is called the
Status Points.
For example:
Open or Close Status
Lockout Status
Fault Flags
Line Currents and Voltages.
Time tags are optional. If enabled, these status points are returned with time tags. For firmware
version A42-01.xx and later time stamps have a one millisecond (1ms) resolution.
2.2 Controls
A list of the controls supported by the controller is detailed in the IO configuration tool.
All controls have a corresponding binary status point. The master station must use these status
points to verify that the control action has been successful. Sometimes a control will be rejected
because of an underlying controller condition preventing the action. These conditions are detailed
in the DNP IO configuration tools ADVC-PTCL-331.html point list.
The DNP3 protocol handler can trigger two events to be recorded in the controller event log DNP3 Trip Req and DNP3 Close Req. This event log reporting indicates only that the
protocol handler has requested a trip or a close from the controller. It does not necessarily
mean that the action has been taken. As detailed above, the request may be overridden by
operational conditions.
The DNP3 protocol handler is designated as a remote user. Refer to the equipment manual for
more information.
Note: Some controls affect the currently active protection group. The change is put into effect
immediately and is permanent for that group. In other words, it is the equivalent to selecting that
protection group on the operator control panel, changing the setting and then putting the change
into service.
All binary/analog output points have a matching binary/analog input status point. It is recommended
that the master station use the controls corresponding binary/analog input status to verify the
success of an action.
2.3 Operator interfaces

The DNP3 protocol can be fully configured via WSOS or the Operator Interface.
The two styles of OI, setVUE and flexVUE provide access to the DNP3 configuration menus. For
more information on how to use the different operator interfaces refer to the Operation Manual.
2.3.1 setVUE
The setVUE style OI is used on A44, and is the only interface available for A41, A42 and A43.
------- DNP COMMUNICATIONS 1

------- C
RS232-PORT-C
RUNNING
DNP3 Standard ACR2
2.3.2 flexVUE
The flexVUE style OI is used on A44 only.
MAIN MENU
ENGINEERING MENU
TELEMETRY MENU
CONFIGURE COMMS
DNP3 MENU
DNP3 MENU
DNP
DNP
DNP
DNP
DNP
DNP
COMMS
COMM STATS
TRANS SERVICES
IP NETWORKING
UNSOLICITED
DIAGNOSTICS
2.4 Password Protection

All DNP3 panel fields require password entry unless described as Display only or otherwise stated.
For more information on operator control panel usage refer to the equipment manual.
3. Applicability
3.1 Control Cubicle Software
This manual applies to ADVC controllers with A41-03.xx and later software versions.
To determine the version of the firmware on the controller refer to the ADVC Controller Range
Operations Manual.
3.2 GMT Offset

For firmware version A42-01.xx and later a non-zero GMT Offset setting affects the DNP SCADA
communications link time values, both sent and received. (refer to the ADVC Operations Manual for
further details).
3.3 DNP3 Protocol

The protocol version implemented is described in the following documents:
DNP3 Specifications (DNP3 User Group):
Volume 1 - Introduction,
Volume 2 - Application Layer Part 1,
Volume 3 - Transport Function,
Volume 4 - Data Link Layer,
Volume 5 - Layer Independent,
Volume 6 - Part 1 - Object Library Basics,
Volume 6 - Part 2 - Objects,
Volume 6 - Part 3 - Parsing Codes,
Volume 7 - IP Networking,
Volume 8 - Interoperability,
Volume 8 - Appendix 1 - Device Profile,
Version
Version
Version
Version
Version
Version
Version
Version
Version
Version
Version
Version
Version
2.02
2.11
2.11
2.10
2.01
2.01
2.03
2.02
2.04
1.04
2.20
2.05
2.06
Technical Committee Bulletins:

These documents are obtainable from the DNP3 users group, which can
be contacted via the web site http://www.dnp.org
3.4 Terminology
The terminology used in this document is that Earth Fault or Ground Fault is described as
Earth/Ground Fault and Sensitive Earth Fault (SEF) or Sensitive Ground Fault (SGF) is described
as SEF/SGF.
Also note that the phase terminology is ABC and refers always to the phase set by the Terminal
Designation or Phasing option, never to the physical bushing or terminal on the switchgear.
4. Protocol Configuration
When the DNP3 protocol handler is made available in the controller, a submenu is added to the
Communication menu. The DNP3 submenu pages fall into the following categories
Communications
Transmission Services Configuration
Unsolicited Response Configuration
Diagnostics
Data Configuration
IP Networking (Version A44-11.00 or later only).
All protocol configuration settings can be viewed, modified and stored on a personal computer with
the WSOS utility.
4.1 Communications
setVUE DNP communication pages
-------- DNP COMMUNICATIONS 1

RS232-PORT-C
RUNNING
DNP3 Standard ACR
flexVUE DNP communication pages
-------C
DNP COMMS
Port RS232-C
RUNNING
DNP3 Standard ACR 2
---- DNP COMMUNICATION STATISITICS

Tx Count 0
Rx Count 0
Rx Length Err 0
Rx CRC Err 0
---
DNP COMMS STATS

Tx
Rx
Rx
Rx
Count 0
Count 0
CRC Err 0
Length Err 0
Setting
Description
Port Selection
Port Selection
Note 1
Note 4
Note 5
The communication port that the protocol handler is assigned to use.

Range: Port NONE, RS232-PORT-A, RS232-PORT-B, RS232-PORT-C,
RS232-PORT-D, RS-485, V23, 10BaseT
Factory default is Port NONE
INACTIVE
Protocol Handler Status
RUNNING
Indication of the current status of the DNP3 protocol handler.

INACTIVE means that the protocol handler is either configured as Port
NONE or the protocol handler has been assigned to a port that has
already been assigned exclusive use by another application in the
controller or the protocol IO map is invalid.
RUNNING means that the protocol handler has a valid IO map, has
successfully attached itself to a port and is running normally.
Display only status.
Range: INACTIVE/RUNNING
Protocol Map
DNP3 Input/Output Map
Note 4
Displays the name of the currently loaded DNP Input/Output map.

Different IO maps can be created using WSOS and loaded into the
controller. If the loaded map is corrupt then an Invalid Map message is
shown. Reload the required map if this is seen.
Factory default is DNP3 Standard ACR2
Tx Count
Transmission Message Count
Note 2,3
The number of DNP3 data link messages transmitted from this

controller into the DNP3 communication link.
Range: 0 to 32767
4.1 Communications (cont.)

Setting
Description
Rx Count
Receive Message Count
Note 2,3
The number of DNP3 data link messages received by this controller

from the DNP3 communication link.
Range: 0 to 32767
Rx Length Err
Receive Message Length Error Count
Note 2,3
The number of message packets received with a length error

Range: 0 to 32767
Rx CRC Err
Receive Message CRC Error Count
Note 2,3
The number of DNP3 data link messages received by this controller

from the DNP3 communication link with a CRC error
Range: 0 to 32767
Notes
1. The controller does not have all of its communications ports available at any one time. A port
selection feature in WSOS determines the ports available for the protocol handler to use. Refer
to the WSOS help file or the equipment operation manual for more information. Unavailable
ports are not displayed in this setting field.
2. Communication statistic counters are display status fields only.
3. All communication statistics counters are zeroed when:
the controller is reset
a DNP3 cold or warm restart message is received
a configuration parameter is changed that triggers a protocol handler warm restart
the Reset All button is selected in WSOS.
The OI select key is pressed twice (not password protected)
4. Changing this setting will cause the DNP3 handler task to perform a warm restart. This will
mean a re-initialisation of all communication settings such as FCB, sequence numbers,
restart internal indication etc. A temporary loss of communications with the master station
may occur. Also, any queued events will be deleted.
5. Selecting the port to 10BaseT is supported in Version A44-11.00 or later.
4.2 Transmission Services Configuration

4.2.1 Overview
The DNP3 protocol has a number of data link and application layer settings that form transmission
service functions. The controller permits configuration of a number of these:
Data link layer confirmation
Data link time out
Application layer confirmation time out
Control select/operate time out period
Time Synchronisation request operation.
4.2.2 Transmission Services Settings

These pages allow the SCADA engineer to determine how the data link and application layer of the
DNP3 protocol handler transmits DNP3 data packets.
setVUE DNP Transmission Services pages
flexVUE DNP Transmission Services pages
---- DNP Transmission Services 1 ----C

DL Cf Rqd SOMETIMES DL Cf TO 4000ms
DL Max Retries 2
Apl Cf TO 108000ms
Select/Op 10000ms
Apl Frag Size 2048
---- DNP Transmission Services 2 ----C

DNP Address 5
Time Dly Rq 0min
Tx Delay 0ms
Operate Seq Chk ON
Keep-alive 20s
DNP TRANS SERVICES

DL Cf Rqd SOMETIMES
DL Cf TO 4000ms
DL Max Retries 2
Apl Cf TO 108000ms
Select/Op 10000ms
Apl Frag Size 2048
DNP Address 5
Time Dly Rq 0min
Tx Delay 0ms
Operate Seq Chk ON
Keep-alive 20s
Setting
Description
DL Cf Rqd
Data Link Confirm Required
On some communications links it is required to have extra

communications integrity to ensure that all data link frames are
successfully received by the master station.
If NEVER, the protocol handler will not request acknowledgment
messages from the master station for data link frame transmissions.
It assumes all data link frames are received by the master station and
relies solely on application layer message integrity checking.
If SOMETIMES, the protocol handler requests a data link acknowledge
response from the master station only on multi-frame DNP3 messages.
If ALWAYS, the protocol handler will expect a data link acknowledgment
message from the master station to all data link frame transmissions.
Range: NEVER, SOMETIMES, ALWAYS.
Factory default is SOMETIMES
DL Cf TO
Data Link Confirm Timeout

When the controller DNP3 data link layer transmits a frame that requires
an acknowledge response from the master station, it starts a timer.
If an acknowledge frame is not received from the master station with-in
the data link confirm time out period, DL Cf TO, then the frame is resent.
If the communications link has failed then the controller will continue retransmissions until DL Max Retries failures occur after which it informs
the application layer of the failure.
Range: 50 to 65535 ms.
Factory default is 4000 ms
4.2.2 Transmission Services Settings (cont.)

Setting
Description
DL Max Retries
Data Link Maximum Retries

Maximum number of times a frame is resent before communication
failure is identified.
Range: 0 255.
Factory default is 2
Apl Cf TO
Application Layer Confirm Timeout

When the controller transmits some DNP3 messages, such as
application layer messages that contain change of state data, a DNP3
application layer confirm message is expected from the master station.
When the last byte of one these messages is transmitted by the
controller a timer is started.
If an application layer confirm message is not received from the master
station within the time out period, then the message is deemed failed.
Refer to section 4.3.3 for more information regarding failed application
layer message handling.
If the application layer message is too large for a single data link frame,
then the protocol handler segments the application message into
multiple data link frames. The application confirm timeout period must
therefore allow for multiple data link frames.
If DL Cf Rqd is set to either SOMETIMES or ALWAYS, then setting
the confirm timeout Apl Cf TO using the following formulae is
recommended:
If Apl Frag Size >= 249,
Apl Cf TO >= ((DL Max Retries + 1) x DL Cf TO x Apl Frag Size / 249)
If Apl Frag Size < 249,
Apl Cf TO >= ((DL Max Retries + 1) x DL Cf TO)
WSOS will offer this value to the user if entering a value outside
these formulae.
If DL Cf Rqd is set to NEVER then the minimum Apl Cf TO is 0ms.
Range: 0 or (Apl Cf TO Calculated ) to 3600000 ms.
Factory default is 108000 ms
Select/Op
Select/Operate Timeout
Maximum time permitted, in milliseconds, between receiving a select
command message and an operate command message from the
master station for the control action to be deemed valid.
Range: 50 to 65535 ms.
Factory default is 10,000 ms

Setting
Description
Apl Frag Size
Application Layer Maximum Fragment Size
Note 1
Note 2
Defines the maximum size of the application layer fragment that can be
sent at any one time. Multiple application fragments will be created if the
controller data to be transmitted exceeds this size.
For high noise environments, reducing the size of the transmitted
data link frame can result in improved communication reliability. This
can be done by setting the Apl Frag Size value to less than 249. It is
recommended that if the value is set this low then DL Cf Rqd should be
set to either SOMETIMES or ALWAYS. However, it should be noted that
this increased reliability will result in increased turn around time for large
controller data transmission.
For more information refer to the DNP3 User Group Technical Bulletin
9804-002 DNP Confirmation and Retry Guidelines Section 4.2.
If DNP VTO communications is to be used then it is recommended that
this value be set to 2048.
Range: 50 to 2048 bytes.
Factory default is 2048 bytes
DNP Address
DNP3 Station Address
Note 2
The station address of the controller on the communication link.

This setting is not configurable via WSOS if DNP3 radio or DNP3
Modem communications are used.
Range: 0 to 65519
Time Dly Rq
Time Synchronisation Request Delay
Note 2
The DNP3 protocol allows for the master station to send time
synchronisation messages independently or at the request of the
controller or both.
Time Dly Rq is the amount of time, in minutes, after the last master
station time synchronisation message that the controller will wait before
setting the Time Synchronisation Required internal indication bit
(IIN1-4). This bit is sent to the master station in every controller
DNP3 message.
If this setting is set to 0 then the internal indication bit is never set and
the master station solely determines time synchronisation operation.
Range: 0 65535 minutes
Factory default is 0 minutes
Tx Delay
Transmit Delay
Additional time, in milliseconds, between receiving a request and
sending a response.
This setting is used when the master station requires time to disable the
transmitter. If collision avoidance delay is being used by the controller
then this setting should be set to a value slightly greater than the master
stations post-transmission period.
Range: 0 to 65535 ms
Factory default 0 ms

Setting
Description
Operate Seq Chk
ON: the controller requires DNP3 Select-Before-Operate (SBO)

requests to be contiguously sequenced, i.e. if the select sequence
number is N in the Application Layer sequence, then the operate
Application Layer message request sequence number must be N+1
(within the application layer sequence number range).
A setting of OFF allows the controller to accept out of sequence
Operate requests.
Either way - the operate Application Layer request message must be
received within the Select/Operate Timeout period to activate the
selected control.
Range: ON/OFF
Factory default is ON
Applicable to version V43 only from A43-03.00 onwards.
Keep-Alive
Keep-Alive Time
Note 2
The controllers issues periodical Request Link Status messages to

verify the integrity of the connection to the master.
Note 3
Range: 1 to 172800s
Factory default is 20s
Applicable to version V44 from A44-11.00 onwards.
Notes
1. The maximum number of DNP application sequence numbers permitted per report attempt
is limited to 16. It is therefore possible that if Apl Frag Size is set low and the number of
available events is large then not all available event data will be reported in a single message
sequence. If Unsolicited responses are not enabled then the master station must monitor
event availability in controller using the class data available internal indicators and perform
multiple poll attempts to read all data.
mean a re-initialisation of all communication settings such as FCB, sequence numbers, restart
internal indication etc. A temporary loss of communications with the master station may
occur. Also, any queued events will be deleted.
3. The Keep Alive time setting is only available for 10BaseT port and TCP mode selected.
4.2.3 Use of Application and Data Link Confirmation/Retries

The use of application and data link confirmations and retries depends upon the nature of data
transfer on the communications link (ie whether controller unsolicited responses are used or the
master frequently polls for data).
When the controller is configured to transmit unsolicited response messages, it is recommended
that only the controller be configured to use of data link confirmations and retries. It is the
controllers responsibility to ensure that data is successfully transmitted to the master station so
it will attempt to retry sending a message if it detects a failure. If the master station also performs
integrity polls on the same communications link, then it should do so infrequently to limit
collision problems.
Alternatively, if a master station polls the controller frequently and the controllers unsolicited
responses are not enabled then it is recommended that the controller not be configured to use data
link retries and the data link confirmation mode be set to SOMETIMES. It is the master stations
responsibility to gather data. If the master station detects a communication failure then it can
choose to either move on and poll the next device on a multi-drop communication link or perform a
poll retry on the failed device. A controller retry at this stage increases the probability of collisions.
For more information refer to the DNP3 User Group Technical Bulletin 9804-002 DNP Confirmation
and Retry Guidelines.
4.3 Unsolicited Response Configuration

4.3.1 Overview
The protocol handlers DNP3 event processing informs the master station that a change in a binary
input has occurred, or an analog input has exceeded its deadband range.
The transmission of event data can be performed using two methods:
Master initiated polling for event data.
Controller initiated transmissions called Unsolicited Responses.
Events can be reported in three data classes. Typically the following priorities are applied:
Class 1 - high priority event class
Class 2 - medium priority event class
Class 3 - low priority event class
The event class of DNP3 binary and analog points can be configured using a tool embedded
in WSOS.
Note: The fourth DNP3 data class, Class 0, is not an event class. It is used in the reporting of
current (static) value of data and not change of state events. Setting a point to class 0 via the WSOS
Configurable DNP3 tool will prevent the protocol handler from reporting change of state events for
that point to the master station. The point will remain accessible via static data polls.
The following controller display pages allow configuration of Unsolicited Response behaviour.
4.3.2 Unsolicited Response Settings
setVUE DNP Unsolicited pages
flexVUE DNP Unsolicited pages
--------- DNP Unsolicited 1 --------C

Unsolicited OFF
Master Addr 3
Unsol Retries 255 Unsol Delay 109s
Send Class READY
Unsol REGENERATED
--------- DNP Unsolicited 2 --------C

C1 Max Count 1
C1 Delay 1s
C2 Max Count 3
C2 Delay 5s
C3 Max Count 5
C3 Delay 10s
DNP UNSOLICITED
Unsolicited OFF
Master Addr 3
Unsol Retries 255
Unsol Delay 109s
Send Class READY
C1 Max Count 1
C1 Delay 1s
C2 Max Count 3
C2 Delay 5s
C3 Max Count 5
C3 Delay 10s
Setting
Description
Unsolicited
Enable/Disable Unsolicited Responses
Note 1
If OFF, change of state events are buffered but only sent as responses
to event polls from the master. Any Enable or Disable Unsolicited
Messages commands received by the controller will result in the
controller responding with its Function Code Not Implemented internal
indication bit set.
If ON or FORCED, change of state events are buffered and are
transmitted when:
a class count is exceeded
a class notification delay timer expires
as a response to a master station event poll.
When a class count is exceeded, or class notification delay timer
expires, then the number and type of events transmitted is determined
by Send Class.
If the master station issues a Disable Unsolicited Messages command
to the controller after the controller has sent its initial unsolicited Null
message, then the mode of the controller will be overridden regardless
of ON or FORCED setting.
Note:
1. If ON, the unsolicited reporting ability in the controller is enabled.
The controller will inform the master station of this ability via an
unsolicited Null message and will only transmit unsolicited
response initial change of state events after it receives an Enable
Unsolicited Messages command from the master station.
ON will mean that the controller DNP3 implementation is compliant with
the DNP3-1999+ specification.
2. If FORCED, the controller will transmit unsolicited response change
of state events immediately without waiting for the Enable
Unsolicited Messages command from the master station.
FORCED will cause the controller DNP3 implementation to be noncompliant with the DNP3-1999+ specification and is not recommended.
This setting has been provided for compatibility with legacy master
station implementations that are in conflict with the specification.
Range: OFF, ON, FORCED.
Factory default is OFF.
4.3.2 Unsolicited Response Settings (cont.)

Setting
Description
Master Addr
DNP3 Master Station Address
Note 1
This is the DNP3 address to which the unsolicited responses are sent.
If the controller is set up to communicate with WSOS using VTO
communications then it is recommended that this setting should not be
set to the WSOS DNP3 master address.
Range: 0 to 65519
Factory default is 3.
Unsol Retries
Unsolicited Response Maximum Number of Retries
Note 1
Maximum number of attempts to re-transmit an unsolicited response

without getting a confirmation from the master.
Refer to section 4.3.3 below for more information.
This limitation does not apply to an initial unsolicited Null message
(a DNP3-2000 requirement.).
A value of 0 means that only a single transmission is made and no retransmits are attempted.
A value of 255 means unlimited retries (i.e. maximum limit is disabled.
When the maximum number of retries is reached without getting a
confirmation from the master, the Unsol Dly timer is restarted with a
value of 86400s).
Range: 0 to 255
Unsol Delay
Unsolicited Response Retry Delay
Note 1
If the controller has not received a confirmation from the master station
to an unsolicited response within Apl Cf TO period then this setting
determines when the next unsolicited response will be sent.
The Apl Cf TO timer and Unsol Dly timers are started at the same time
(i.e. started immediately after the transmission of the last byte of a
controller message that expects a response from the master).
If Unsol Dly is greater than Apl Cf TO then it will wait until Unsol Dly
seconds after transmission of last message before sending a retry.
Unsol Dly should never be set to less than Apl Cf TO.
Range: 1 to 86400 seconds
Factory default is 109s

Setting
Description
Send Class
Unsolicited Response Class Reporting

Used to control which classes are transmitted in the unsolicited
response message when a class count is exceeded or a class
notification delay timer expires.
If READY then only the events of that class are reported.
If ALL then all available events, irrespective of class, will be included in
the unsolicited message.
If PRIORITY then any events available of equal or higher priority are
sent. For example, if Class 2 events are ready to be sent and Class 1
events are available but not ready, then both classes will automatically
be sent. Any available Class 3 events will not be included.
Note that if set to READY or PRIORITY, then the reported unsolicited
message may have internal indicator bits (IINs) set to indicate data
available in other classes. Some master stations, upon seeing these bits
set will immediately send a poll for the unreported data. In this case ALL
is recommended for greater communication efficiency.
Range: READY, ALL, PRIORITY
Factory default is READY
Unsol
( REGENERATED/
Selects the Unsolicited Response retry type that is transmitted when

an unsolicited response is Unconfirmed by the master station and a
re-transmission is required by the out-station.
Note 1
The octets of a REGENERATED unsolicited response retry may contain

some or all of the data from the previous unsolicited response, and
may also include updated data, new data and changed IIN octets. The
sequence number in the application control octet is incremented from
the previously transmitted unsolicited response.
IDENTICAL)
An IDENTICAL unsolicited response retry is a repeat, octet-for-octet, of

the previously transmitted unsolicited response. The sequence number
appearing in the application control octet of an identical retry and the
previous unsolicited messages are the same.
Range: Unsol REGENERATED/IDENTICAL
Factory default is REGENERATED
Applicable to version V43 only for Release A43-03.00 onwards.
Refer DNP3Spec-V2-Part1-ApplicationLayer-20071215.pdf Section 6.0
C1 ->
C2 ->
C3 ->
Class Indicator
Indicator of the class that applies to the rest of the data on the row.
Setting
Description
Max Count
Unsolicited Response Class Notification Max Count
Note 1
The total number of binary and analog events of this class that must
occur before an unsolicited response message is triggered.
Range: 1 to 450 events
Class 1 factory default is 1 event.
Class 2 factory default is 3 events
Class 3 factory default is 5 events
Delay
Unsolicited Response Class Notification Delay
Note 1
The maximum time an event of this class will be held before an

unsolicited response message is triggered.
Range: 1 to 86400 seconds
Class 1 factory default is 1second.
Class 2 factory default is 5 seconds
Class 3 factory default is 10 seconds
Notes
1. Changing this setting will cause the protocol handler to perform a warm restart. This will mean
a re-initialisation of all communication settings such as FCB, sequence numbers, restart
internal indication etc. A temporary loss of communications with the master station may occur.
Also, any queued events prior to setting change will be lost.
4.3.3 Event Buffering

Multiple DNP3 change of state events can be transmitted in the same message. When events are
transmitted, the software tags them as sent and retains them in the event buffer. All messages
containing events require an application layer confirm response from the master station.
If the application layer receives a confirm response within the application layer confirmation time out
period (Apl Cf TO), then the tagged events are removed from the buffer.
If a confirm message is not received within the application layer confirm time out period (Apl Cf TO)
then all tagged events are untagged and are retained in the event buffer and the protocol handler
behaves as follows:
If unsolicited response messages are not enabled then the events are re-transmitted when next
requested by the master station.
If unsolicited response messages are enabled, then the protocol handler waits for the retry delay
timer (Unsol Dly) to expire before attempting to send another unsolicited response. Selection
of Regenerated or Identical unsolicited retries is an operator setting, refer 4.3.2 Unsolicited
Response Settings Unsol REGENRATED/IDENTICAL.
If the maximum unsolicited response retry limit is enabled and after Unsol Retries, the protocol
handler will cease attempting to send unsolicited responses until either:
a successful application layer message of any function code addressed to it is received from
the master station
a new event is queued in the buffer
the default (non configurable) Offline time-out expires.
If the 250 binary event buffer, or the 200 analog event buffer is full, then the oldest queued event will
be over-written by a new event. Both event buffers reside in volatile RAM.
4.4 Diagnostics
4.4.1 Overview
Diagnostic pages are to enable the user to have visibility of the protocol handlers internal statuses,
timer values and event buffer status for communications commissioning purposes.
setVUE DNP Diagnostics page 1
flexVUE DNP Diagnostics pages
----- DNP Diagnostics 1 -------C

C1 -> ENABLED, Events 0,
Timer 0s
Timer 0s
Timer 0s
setVUE DNP Diagnostics page 2
----- DNP Diagnositics 2 -------C

DL Timer 0s
DL Retry Count 0
Apl Cf Timer 0s
Select Timer 0s
Uns Retry Tmr 0s
Uns Retry Cnt 0
DNP DIAGNOSTICS
C1 -> DISABLED
C1 -> Events 0
C1 -> Timer 0s
C2 -> DISABLED
C2 -> Events 0
C2 -> Timer 0s
C3 -> DISABLED
C3 -> Events 0
C3 -> Timer 0s
DL Timer 0s
DL Retry Count 0
Apl Cf Timer 0s
Select Timer 0s
Uns Retry Tmr 0s
Uns Retry Cnt 0
Setting
Description
C1->
C2->
C3->
Class Indicator
Status by Class
Unsolicited Response Reporting Status
Indicator of the class that applies to the rest of the data on the row.
Shows whether transmission of unsolicited data for the class has been
enabled or disabled.
ENABLED if:
Unsolicited is ON in protocol handler AND the protocol handler has
received an Enable Unsolicited Responses command (Function code
0x14) from the master station.
Unsolicited is FORCED AND the protocol handler has NOT received a
Disable Unsolicited Responses command (Function code 0x15) from
the master station.
DISABLED if:
Unsolicited is OFF in protocol handler.
Unsolicited is ON in protocol handler AND the protocol handler has
never received an Enable Unsolicited Responses command (Function
code 0x14) from the master station.
Unsolicited is ON or FORCED in protocol handler AND the protocol
handler has received a Disable Unsolicited Responses command
(Function code 0x15) from the master station.
Range: ENABLED, DISABLED.
4.4.1 Overview (cont.)

Setting
Description
Buffered events by
Class
Class Event count

The number of binary and analog events currently buffered for the class.
Count is valid irrespective of whether the protocol handler is in solicited
response or unsolicited response mode.
Range: 0 to 450 events
Timer
by Class
Unsolicited Response Class Notification Timer

The current value of notification delay timer for the class.
Range: 0 to Unsolicted Delay seconds
DL Timer
Datalink Confirm Timer

The time in milliseconds since last data link message was transmitted.
Range: 0 to DL Cf TO seconds
DL retry count
Data link Retry Count

Number of times a data link message has been sent. This count
includes the initial message.
Range: 0 to DL Max Retries
Apl Cf Timer
Application Confirm Timer

The time in milliseconds since start of transmission of current
application layer message.
Range: 0 to Apl Cf TO seconds
Select Timer
Select / Operate Timer

The time in milliseconds since receipt of select command.
Range: 0 to Select/Op seconds
Uns Retry Tmr
Unsolicited Response Retry Timer

The time in seconds since last unsolicited response message
was transmitted.
Range: 0 to Retry Dly seconds
Uns Retry Cnt
Unsolicited Response Retry Count

Number of times an unsolicited response retry has been sent.
Range: 0 to Unsol Retries
Note: The accuracy of displayed timer values are subject to panel refresh time.
4.5 Data Configuration

4.5.1 Database Settings
These pages allow the SCADA engineer to determine the type of data object reported in a
class event or integrity poll.
flexVUE Database Configuration pages
setVUE Database Configuration page
----Binary
Analog
Binary
DNP Database Configuration 1 ---C

Time ON
Analog Time OFF
Size 16bit
Analog Flag OFF
Output OFF
Analog Evts:BUF ALL
Setting
Description
Binary Time
Binary Time Tag Usage
DNP DATABASE CONFIG

Binary
Analog
Analog
Analog
Binary
Time ON
Time ON
Size 16bit
Flag OFF
Output OFF
Determines whether or not a time tag is included with DNP3 binary

change of state events transmitted to a master station by the controller.
Range: ON, OFF
Factory default is ON.
Analog Time
Analog Time Tag Usage

Determines whether or not a time tag is included with DNP3 analog
change of state events transmitted to a master station by the controller.
Range: ON, OFF
Factory default is OFF
Analog Size
Default Analog Data Object Size

Determines the size of the controller DNP3 default analog objects.
This size is transmitted by the controller for all static and event data
responses where the master does not explicitly ask for data size.
Range: 16, 32 bits (signed)
Factory default is 16 bit
Analog Flag
Analog Flag Reporting

Determines whether or not a byte containing the analogs status data is
included with its value in a controller response to a static data scan.
If ON, the controller will always send a flag of either 0x01 (point online)
or 0x21 (point online and overrange). It is recommended that this setting
should only be set ON if the use of the analog flag bits is a master
station requirement.
Range: ON, OFF
4.5.1 Database Settings (cont.)

Setting
Description
Binary Outputs
Binary Output Status Reporting
Note 1
The protocol handler response to an integrity poll or a class 0 poll

includes binary inputs, counters and analog inputs. This setting
determines whether or not binary output status data is also included.
(Unmapped data types are excluded.)
If ON, the controller will always include binary output (object 10 variation
02) status data in the response.
Range: ON, OFF
Analog Evts
Note 1
Select the Analog event reporting mode for Analog class 1, 2 or 3 input
change events.
Class 1,2 or 3 Analog input change events can be reported in BUF ALL
mode (Buffer-All, every evented change is reported).
Or in PRESENT-value mode, one event per point (when a change is
detected, the report of the change contains the present-value at the
time the event is reported - not when the change was detected).
Range: BUF ALL/PRESENT.
Factory default is BUF ALL
Applicable to version V43 only from A43-03.00 onwards.
Notes
1. Changing this setting will cause the protocol handler to perform a warm restart. This will mean
a re-initialisation of all communication settings such as FCB, sequence numbers, restart
Also, any queued events prior to setting change will be lost.
4.5.2 Default Database Data Objects

When master stations perform a static data (class 0), change of state event (class 1,2,3) or integrity
data (class 1,2,3,0) poll then the reported data object variation is typically not specified. The request
simply asks for any data for a specific DNP3 class type and it is left to the controllers protocol
handler to determine which DNP3 object variation is to be transmitted. The controller determined
object variations are referred to in this manual as the Default object variation. Some default data
object variations can be configured. The table below lists the selectable variations and identifies the
relevant configuration setting required.
Controller Configuration Settings

DNP3 Data Object
Binary
Time Tag
Analog
Size
Analog
Flag
32 Bit Analog Input with flag

(Object 30 Variation 1)
32
ON
16 Bit Analog Input with flag

16
ON
32 Bit Analog Input without flag

32
OFF
16 Bit Analog Input without flag

16
OFF
Binary Input Change without time

OFF
Binary Input Change with time

ON
Analog
Time Tag
32 Bit Analog Change Event without time

OFF
32
16 Bit Analog Change Event without time

OFF
16
32 Bit Analog Change Event with time

ON
32
16 Bit Analog Change Event with time

ON
16
16 Bit Analog Input Deadband

16
32 Bit Analog Input Deadband

32
The rest of the default data objects used by the controller are:
Binary input status (Object 1 variation 01)
Binary counter status (Object 20 variation 05)
Frozen counter status (Object 21 variation 09)
Binary output status (Object 10 variation 02)
List of attribute variations (Object 0 variation 255) Version A44-11.00 or later only.
These object types are not configurable.
Note: If the master station requests data with an explicit object variation then the controller
will respond with that variation. If an analog value is greater than 32767 then the controller will
respond to a request for a 16 bit analog input object with value 32767 and over-range bit set.
4.5.3 Database IO Points Map

The controller has a default database of DNP3 IO points called DNP3 Standard ACR map.
If the user wishes to change the selection of points and/or attributes of a point there is a
configuration tool available.
Figure 1 - WSOS DNP3 ConfigurationTool
Examples of configuration that can be performed per DNP3 datatype are:

Binary Inputs point selection, class allocation and invert logic
Analog Inputs point selection, class allocation, scaling and deadband
Counters point selection
Binary Outputs point selection, control type (Pulse, Latch, Trip/Close) and invert logic
Analog Outputs point selection.
For more information refer to the WSOS5 DNP3 Configuration Tool manual WSOS01-DOC-102.pdf
For a listing of all controllers IO that can be mapped refer to the ADVC-PTCL-331.html points list
available in the help menu of the tool that is accessible via WSOS5.
For a listing of the controllers default IO map refer to the DNP3 Standard ACR map available
with the tool. A legacy DNP3 Legacy 27-17 ACR IO map is also available with the tool and can be
loaded into the controller to make its DNP3 IO behave like a PTCC V27-17 or newer.
Note: The DNP3 Standard ACR map reflects points that are available with default settings in the
controller. If a feature is made available via configuration then the user is required to manually add
any related points to the IO list as required.
4.5.4 Analogue Deadband Configuration

All of the protocol handlers analogue inputs have a deadband value stored in non-volatile
memory. The user, via the WSOS DNP Tool, can configure these values on a per point basis. Upon
controller start up, protocol handler restart, or a new IO map being loaded, the protocol handler
copies all deadband settings to volatile memory overriding any previous settings. The protocol
handler uses the volatile values in its deadband reporting logic.
The volatile analogue input deadbands are configurable from the DNP3 master station on a per
point basis using DNP3 analog input deadband object writes. If it is desired that the changes be
maintained after a controller or protocol handler restart then it is the master stations responsibility
for re-sending any updated deadband values. The master station can detect the restart condition
via the DNP internal indicator restart status bit.
Deadband values are not reported in integrity or event polling. They are only available via reads
and writes of DNP3 analogue input deadband objects.
All deadbands supported by the protocol handler are fixed value format - ie the deadband value
represents an analogue inputs absolute value difference between the last reported value and the
threshold value that the current value must exceed in order to generate an analogue change of
state event.
For more information on DNP3 analogue input deadband objects and behaviour refer to the DNP3
User Group Technical Bulletin 9809-001 Analogue Input Reporting Deadband.
4.6 DNP3 over IP

These pages allow the SCADA engineer to configure DNP3 to operate on
top of an IP network; this is only possible using version A44-11.00 or later.
To make these pages visible select port as 10BaseT.
setVUE DNP IP Networking 1
----------- DNP IP NETWORKING 1

--------C
Protocol TCP
setVUE DNP IP Networking 2

Layout if Transport Protocol is
TCP Protocol and Unsolicited is OFF (Listening End Point).
--------- DNP IP NETWORKING 2 ----------C

Check Master IP ON
IP 10.176. 18.156
Slave Port 20010
Broadcast UDP 65533
Layout if Transport Protocol is

TCP Protocol and Unsolicited is ON (Dual End Point).
--------- DNP IP NETWORKING 2 -----------C

Check Master IP OFF IP 10.176. 18.156
Slave Port 20000
Master Port 20000
Broadcast UDP 65533
Layout if Transport Protocol is UDP Protocol (Datagram End Point).

Check Master IP OFF IP 10.176. 18.156
Slave Port 20000
Master Port 20000
Port in REQ
OFF
flexVUE DNP Network Configuration pages
DNP NETWORK CONFIG

Protocol TCP
Check Master IP ON
IP 10.176. 18.156
Slave Port 20000
BroadUDP Port 65533
Master Port 20000
Port in REQ OFF
4.6 DNP3 over IP (cont.)

Setting
Description
IP Protocol Mode
IP Protocol Mode
Note 1
The protocol used to proceed DNP3 requests.

TCP : Transmission Control Protocol
UDP : User Datagram Protocol
Depending on the DNP3 Unsolicited settings and the selected Transport
Protocol, the following end point mode options will be in service:
IP Networking Mode
UNSOLICITED TCP
UDP
On/Forced
Dual End Point
Datagram End Point
Off
Listening End
Range: TCP, UDP

Factory Default is TCP
Check Master IP
Check Master IP Address
Note 1
This setting is used to improve the security of the DNP3 protocol.

ON: Only the IP address specified by the Master IP address parameter
is authorised to connect to the controller.
OFF: Any IP address can connect to the controller.
Range: ON, OFF
Factory Default is OFF
Master IP
Master IP address
Note 1
The station IP address. This is both used for authorising, if Check

Master IP is ON, and for when unsolicited is turned on.
Range: Any valid IP address
Factory Default is 127.0.0.1
Slave Port
TCP Slave Port
Note 1
The TCP port used by the controller to listen to DNP3 requests.

Range: 1 to 65534
Factory Default is 20000
Master Port
Master TCP Port Number
Note 1
This is the TCP port where the controller will send all the responses.
This port shall be used by the master to listen and receive the incoming
requests from the controller.
Range: 1 to 65534
4.6 DNP3 over IP (cont.)

Setting
Description
Port in REQ
Port In Request
Note 1
The port number of the incoming message will be used as the

destination port number instead of the master port setting value.
Only visible If the Transport Protocol is UDP
Range: ON, OFF
Factory Default is OFF
Broadcast UDP
Broadcast UDP Port Number
Note 1
This is the UDP Port where the controller listens to broadcast requests.
Range: 1 to 65534
Notes:
mean a re-initialisation of all communication settings such as FCB, sequence numbers, restart
Also, any queued events will be deleted.
setVUE DNP IP
Networking page three displayed with an invalid connection attempt

Last Invalid IP
10.196.88.156
Invalid Packet Count 77
flexVUE DNP Network Stats pages

displayed with an invalid connection attempt
DNP NETWORK STATS

Last Invalid 10.1
Invalid Pckts 77
Setting
Description
Last Invalid IP
Last Invalid IP address
Note 1
Only visible when Check Master IP is ON
This field displays the IP address of the last unauthorised machine that tries
to connect to the controller DNP3 TCP port.
The user can press SELECT on this page to make a menu appear. Another
press of SELECT will reset the page and set this field to NONE, while
Menu key pressed will cancel the whole operation.
Range: NONE or an invalid IP address
Invalid Packet
Count
Invalid Packet Count

Only visible when Check Master IP is ON
This field displays the number of connection tries of the last unauthorised
machine. If a new invalid connection is attempted from a different machine,
the Last Invalid IP is updated and the count is reset to 1.
The user can press SELECT on this page to make a menu appear. Another
press of SELECT will reset the page and set this field to NONE, while
Menu key pressed will cancel the whole operation.
Range: 0 to 4294967296
1. This field on the flexVUE scrolls to display the full text.
Appendix A Protocol Timings

Initialisation Time
After power up, the protocol handler will not respond to master station requests whilst it waits for
the controller database to be initialised and for high priority boot up tasks to be completed.
Turnaround Time
The turnaround time for the protocol, from the end of receiving a message until the start of the
pre-transmission time, is typically < 30 milliseconds with a range of 4 to 100 milliseconds.
Appendix B DNP3 Device Profile

The controller implementation complies with the DNP3 Subset Definitions document. Additional
implementation information is given in this section.
The DNP3 device profile defines the mapping of all data points used, in the standard format
recommended by the DNP3 users group.
This device profile is also available as an XML file generated by WSOS with ADVC Controller running
Version A44-11.00 or later. To get this file, open the DNP3 Point Configuration Window and click on
Create in the XML Profile box. It is then possible to save the file.
The following device profile summarises the capability of the DNP3 functionality available on the
controller. In order to access to the complete device profile, it is necessary to use WSOS.
DNP3 Device Profile

DNP3 Device Profile
Vendor Name:
Device Name:
Schneider Electric (Australia) Pty Limited,

Brisbane, Australia
ADVC Controller Range
Highest DNP3 Level Supported:
Device Function: Slave
For Requests: 2
For Responses: 2
Conforms to DNP3 level 2 subset definition requirements with many additional level 3 features
built in. Refer to the shaded areas of Appendix C DNP3 Implementation Table, for additional level
3 features built in.
Also, the following functions are included:
Function codes 7, 8, 9, 10 for Binary Counters (Object 20 Variation 6)
Function code 14 - Warm Restart
Function code 20 - Enable Unsolicited Messages
Function code 21 - Disable Unsolicited Messages
Function code 22 - Assign Data Classes.
Maximum Data Link Frame Size (octets):
Transmitted: 292
Received: 292
Maximum Application Fragment

Size (octets):
Transmitted: Configurable (50 to 2048)
Received: 249
Maximum Data Link Retries:
Maximum Application Layer Retries:
Configurable 0.255
None
Requires Data Link Layer Confirmation:

Configurable, 3 settings Never, Always, Sometimes (on multi frame fragments only)
Requires Application Layer Confirmation:
Sometimes (only when reporting event data or when sending multifragment responses)
DNP3 Device Profile (cont.)

DNP3 Device Profile
Timeouts while waiting for:
Data Link Confirm: Configurable
Application Confirm: Configurable
Need Time Delay: Configurable (on power up, an additional
device start up delay applies. Refer to appendix A).
Select Operate Delay: Configurable
Unsolicited Response Notification: Configurable
Unsolicited Response Retry Delay: Configurable
Timeouts not supported:
Complete Appl. Fragment: None
Complete Appl. Response: None
Executes Control Operations:
WRITE Binary Outputs:
Never
SELECT/OPERATE: Always
DIRECT OPERATE:
Always
DIRECT OPERATE - NO ACK:
Always
Max number of controls that can operate
simultaneously: 1
Pattern control operations are not supported
Count > 1:
Never
Pulse On:
Always
Pulse Off:
Always (Legacy support)
Latch On:
Always
Latch Off:
Always
Trip/Close: Sometimes
WRITE Analog Outputs:
Never
SELECT/OPERATE: Always
DIRECT OPERATE:
Always
DIRECT OPERATE - NO ACK:
Always
Max number of outputs that can operate
simultaneously: 1
Raise/Lower:
Never
Queue:
Never
Clear Queue:
Never
Pulse On and Pulse Off times are ignored
Maximum Select/Operate Delay Time:

Configurable 1 .. 65535 ms
Reports Binary Input Change Events when no
specific variation requested:
Configurable with / without time
Reports time tagged Binary Input

Change Events when no specific variation
requested:
Binary Input Change with Time
Sends Unsolicited Responses:

Enable/Disable Unsolicited supported
Static Data in Unsolicited Responses:

Never
Supports Collision Avoidance:

Configurable
Collision Avoidance Detection Method:
Default Counter Object:

Default Object: 20
Default Variation: 05
Counter Roll Over at:

65535
Sends Multi-Fragment Responses: Yes
If RS232 DCD
If V23 BUSY/DCD
If RS485 Not Applicable
Appendix C DNP3 Implementation Table

Controller DNP3 Implementation Table
OBJECT
REQUEST
RESPONSE
(slave must parse)
(master must parse)
Obj
Var
Description
Func Codes
(dec)
Qual Codes
(hex)
Func
Codes
Qual Codes
(hex)
242
Device Manufacturers Software Version
00
129
00, 17
243
Device Manufacturers Hardware Version
00
129
00, 17
246
User assigned ID code/number
00
129
00, 17
248
Device Serial Number
00
129
00, 17
250
Device Manufacturers Product Name and Model
00
129
00, 17
252
Device Manufacturers Name
00
129
00, 17
254
Non-specific all attributes request
00, 06
255
List attributes request
00, 06
129
00, 5B
Binary Input - All Variations
00, 01 06
N/A
N/A
00, 01, 06,

07, 08,
17, 28
129
00, 01
00, 01, 06,

07, 08,
17, 28
129
22
07, 08, 17, 28

1
Binary Input
Binary Input With Status
1, 22
1, 22
17, 28
Note 4
00, 01
17, 28
Note 4
Binary Input Change - Default
06, 07, 08
N/A
N/A
Binary Input Change without Time
06, 07, 08
129, 130
17, 28
Binary Input Change with Time
06, 07, 08
129, 130
17, 28
Binary Input Change with Relative Time
06, 07, 08
129, 130
17, 28
10
Binary Output - All Variations
00, 01 06
N/A
N/A
00, 01, 06,

07, 08,
17, 28
129
00, 01
00, 01, 07, 08
129
Echo of request
N/A
N/A
00, 01, 06,

07, 08,
17, 28
129
00, 01
00, 01, 06,

07, 08,
17, 28
129
00, 01, 06,

07, 08,
17, 28
129
07, 08, 17, 28

10
12
Binary Output Status
Control Relay Output Block
3, 4, 5, 6
17, 28
Note 4
17, 28
20
Binary counter Default
1, 7, 8, 9, 10
00, 01 06
07, 08, 17, 28
20
20
20
32 Bit Binary Counter with flag
16 Bit Binary Counter with flag
32 Bit Binary Counter without flag
1, 7, 8, 9, 10
1, 7, 8, 9, 10
1, 7, 8, 9, 10
17, 28
Note 4
00, 01
17, 28
Note 4
00, 01
17, 28
Note 4
Controller DNP3 Implementation Table (cont.)
OBJECT
REQUEST
RESPONSE
(slave must parse)
(master must parse)
Obj
Var
Description
Func Codes
(dec)
Qual Codes
(hex)
Func
Codes
Qual Codes
(hex)
20
16 Bit Binary Counter without flag
1, 7, 8, 9, 10
00, 01, 06,

07, 08,
17, 28
129
00, 01
00, 01 06
N/A
N/A
00, 01, 06,

07, 08,
17, 28
129
00, 01
00, 01, 06.

07, 08,
17, 28
129
00, 01, 06.

07, 08,
17, 28
129
00, 01, 06.

07, 08,
17, 28
129
00, 01 06
N/A
N/A
00, 01, 06,

07, 08,
17, 28
129
00, 01
00, 01, 06,

07, 08,
17, 28
129
00, 01, 06,

07, 08,
17, 28
129
00, 01, 06,

07, 08,
17, 28
129
21
Frozen Counter Default
17, 28
Note 4
07, 08, 17, 28

21
21
21
21
30
10
32 Bit Frozen Counter with flag
16 Bit Frozen Counter with flag
32 Bit Frozen Counter without flag
16 Bit Frozen Counter without flag
Analog Input - Default
22
17, 28
Note 4
00, 01
17, 28
Note 4
00, 01
17, 28
Note 4
00, 01
17, 28
Note 4
07, 08, 17, 28

30
30
30
30
32 Bit Analog Input
16 Bit Analog Input
32 Bit Analog Input without Flag
16 Bit Analog Input without Flag
1, 22
1, 22
1, 22
1, 22
17, 28
Note 4
00, 01
17, 28
Note 4
00, 01
17, 28
Note 4
00, 01
17, 28
Note 4
32
Analog Change Event - Default
06, 07, 08
N/A
N/A
32
32 Bit Analog Change Event without Time
06, 07, 08
129, 130
17, 28
32
16 Bit Analog Change Event without Time
06, 07, 08
129, 130
17, 28
32
32 Bit Analog Change Event with Time
06, 07, 08
129, 130
17, 28
32
16 Bit Analog Change Event with Time
06, 07, 08
129, 130
17, 28
34
Analog Input Reporting Dead band Default
00, 01, 06,

07, 08,
17, 28
N/A
N/A
Note 6
OBJECT
REQUEST
RESPONSE
(slave must parse)
(master must parse)
Obj
Var
Description
Func Codes
(dec)
Qual Codes
(hex)
Func
Codes
Qual Codes
(hex)
34
16 bit Analog Input Dead band reporting
00, 01, 06,

07, 08,
17, 28
129, 130
17, 28
00, 01,
07, 08,
17, 28
00, 01, 06,

07, 08,
17, 28
129, 130
17, 28
00, 01,
07, 08,
17, 28
00, 01 06
N/A
N/A
00, 01, 06,

07, 08,
17, 28
129
00, 01
17, 28
00, 01, 06,

07, 08,
17, 28
129
Note 6
34
32 bit Analog Input Dead band reporting

Note 6
40
Analog Output Status - Default
07, 08, 17, 28

40
40
32 Bit Analog Output Status
16 Bit Analog Output Status
Note 4
00, 01
17, 28
Note 4
41
32 Bit Analog Output Block
3, 4, 5, 6
00, 01, 07,

08, 17, 28
129
Echo of request
41
16 Bit Analog Output Block
3, 4, 5, 6
00, 01, 07,

08,
129
Echo of request
00, 01, 06
07, 08,
17, 28,
129
00, 01
17, 28
00, 01, 06
08, 17, 28
129
17, 28
50
50
Time and Date
Time and Date
Note 4
Note 4
07
(quantity = 1)
2
00, 01
17, 28
00, 01, 06
08, 17, 28,
07
(quantity = 1)
51
Time and Date CTO Absolute time,

synchronised
129, 130
07, (quantity 1)
51
Time and Date CTO Absolute time,

unsynchronised
129, 130
07, (quantity 1)
52
Time Delay Fine
N/A
N/A
129
07, (quantity 1)
52
Time Delay Fine
N/A
N/A
129
07, (quantity 1)
60
Class 0, 1, 2, and 3 Data
1, 20, 21
06
OBJECT
REQUEST
RESPONSE
(slave must parse)
(master must parse)
Obj
Var
Description
Func Codes
(dec)
Qual Codes
(hex)
Func
Codes
Qual Codes
(hex)
60
Class 0 Data
06
N/A
N/A
06, 07, 08
N/A
N/A
20, 21
06
06, 07, 08
N/A
N/A
20, 21
06
06, 07, 08
N/A
N/A
20, 21
06
00, 01, 07,

08, 17, 28
N/A
N/A
Virtual Terminal Event Data
06, 07, 08
129
17, 28
Internal Indications
00 index = 7
N/A
N/A
N/A
N/A
N/A
20, 21
60
60
60
112
Class 1 Data
Class 2 Data
Class 3 Data
Virtual Terminal Output Block

Note 5
113
80
No Object
13
14 23
Notes:
1. All shaded areas are the additional level 3 or above function, objects, variations and/or qualifiers supported by controller.
2. Bold italics response function codes represent controller default objects. These are the object variations that the controller will issue as in its response to an event
(class 1, 2, 3) poll, an integrity (class 1, 2, 3, 0) poll, in a response to a variation 0 read request, or in an unsolicited response message. Where more than one data
object variation is highlighted then default object can be configured. Selection of default objects is explained in section 4.5.2.
3. All Request and Response options marked N/A are Not Applicable.
4. For static (non-change-event) objects, qualifiers 17 or 28 are only responded when a request is sent with qualifiers 17 or 28, respectively. Otherwise, static object
requests sent with qualifiers 00, 01, 06, 07, or 08, will be responded with qualifiers 00 or 01. (For change-event objects, qualifiers 17 or 28 are always responded.)
5. A write with an analog input deadband value of zero will be rejected. The response will have the setting in qualifier, range or data not
valid or out of range internal indicator bit (IIN2-2) set.
6. A write with an analog input deadband value of zero will be rejected. The response will have the setting in qualifier, range or data not valid or out of range internal
indicator bit (IIN2-2) set.
DNP3 Function Codes

Request
Response
Function
Code
Description
Function
Code
Description
Function
Code
Description
Read
Freeze and Clear
129
Response
Write
10
Freeze and Clear, No Ack
130
Select
13
Cold Restart (Note 1)
Unsolicited
Response
Operate
14
Warm Restart (Note 1)
Direct Operate
20
Enable Unsolicited Msgs
Direct Operate, No Ack
21
Disable Unsolicited Msgs
Immediate Freeze
22
Assign Class
Immediate Freeze, No Ack
23
Delay Measurement
Note: When a cold or warm restart command is received by the controller it will restart the DNP3 protocol handler
only. The controller itself does not restart.
It is recommended by the DNP3 User Group that master stations do not ask for a data link acknowledgement nor
an application confirm on restart commands (refer to Cold/Warm Restart Sequence, Technical Bulletin 9701-003)
The controller reports a time object of 500 milliseconds for both restart types. The master station should not initiate
any message sequences for this period. However, if the controller has unsolicited messages configured ON then it
will automatically establish communications on restart. This may be within the 500 milliseconds period.
DNP3 Qualifiers
Qualifier (Hex)
00, 01
Use in a Request
A range of static points, or a single point with a
point number.
Use in a Response
Static Objects
Object headers use either 8 bit (Q=00) or 16 bit

(Q=01) start and stop range indices.
06
Not valid
All points.
Object headers and data sizes are determined by
controller configured settings.
07, 08
A limited quantity of events or a single point with

no number (eg Time and Date).
A single point with no number

(eg Time and Date)
Object headers have either 8 bit quantity fields

(Q=07) or 16 bit quantity fields (Q=08).
17, 28
Controls (usually one or more unrelated points)

Object headers have either 8 bit quantity field
with 8 bit indices (Q=17) or 16 bit quantity field
with 16 bit indices (Q=28)
Event objects
(usually one or more unrelated points)
5B
DNP3 Internal Indication Bits

The following DNP3 response internal indication bits are not supported.
IIN1-6 Device trouble. For system health status refer to the Abnormal Operator Conditions
binary input point.
IIN2-4 Request already executing.
IIN2-5 Corrupt Configuration.
DNP3 Object Status Flags

Binary Inputs.
Only the online and status bits are supported. This means that, depending upon the points status,
the reported flag will always be either 0x01 or 0x81 since the controller always regards
its points as online.
Binary Outputs
Only the on-line and status bits are supported. The online/offline condition of a point is determined
by underlying conditions defined in the individual IO point definition. Refer to the IO configuration
tool for more details.
Analog Inputs
Only the online and over-range bits are supported. Since the controller always regards its points as
online, the flag will always be reported as either 0x01 or 0x21.
DNP3 Control Operation

The success or failure of control operation is returned in the control response message.
The controller support for control success is shown below.
Response
Status Value
Controller Control Response Description
Control request accepted
Control request denied. Select/Operate timed out. The time out setting is configurable.
Control request denied. Operate without select message OR operate/select application

sequence number mismatch.
Control request denied. Formatting error
Control request denied. Control operation not supported

Examples:
Trip control sent to a point that supports only Pulse or Latch operations. The supported
operations are indicated on a per point basis in the IO configuration tool.
The binary output (or analog output) point number is out of range.
The analog output value is out of range.
Control request denied. Already Active
Control request denied. Hardware Error.
Not Implemented.
Control request denied. Control rejected by controller because too many operations have
been requested.
Control request denied. Control rejected by controller because of an underlying condition

preventing the action. This includes local mode.
127
Control request denied. Control rejected by controller because of some other undefined reason.
All binary output points have a matching binary input status point. The master station must always
use the corresponding binary status for the control to verify the success of the action.
DNP3 Technical Bulletins

Technical Bulletin
Description
TB2008-001
Notification of Subset Level

Requirements: Device Attribute
(Object Group 0) XML Profile
Manual Version
Comment
Note:
1. The following data types are not used by the controller:
File transfer objects
Analog input floating point and analog output floating point objects
Variable arrays objects
8 bit unsigned integer objects
Virtual terminal objects.
2. The Reset User Process(1) function code should not be used. If the Reset User Process(1)
function code is used in the Control byte, then the response function code will be Link Not
Used(15).
Notes
Notes
Notes
Make the most of your energy SM
2012 Schneider Electric. All Rights Reserved.
As standards, specifications and designs change from time to time, always ask for confirmation
of the information given in this publication.
This document has been printed using FSC Mix Certified paper. ISO 14001 environmental
management system in use at mill.
Information given in this publication was accurate at the time of printing.
CLIPCOM 24208
Schneider Electric (Australia) Pty Ltd

Head Office
Australia Wide
78 Waterloo Road
Tel: 1300 369 233
Macquarie Park
Fax: 1300 369 288
NSW 2113
www.schneider-electric.com.au
au.help@schneider-electric.com

Adc01-Doc-146 Advc Protocol Manual Dnp3 r15 Web

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Adc01-Doc-146 Advc Protocol Manual Dnp3 r15 Web

Hochgeladen von

Copyright:

Verfügbare Formate

DNP3 Protocol

Technical Manual for the

Scope of this document

This document is copyright and is provided

The advisory procedures and information

Document part number

Draft. Created from N00-324 R48

R01 Several changes including better wording, layout

Figure 1: WSOS DNP3 Configuration tool

of Unsol and Database pages

R02 Updated to reflect some implementation issues,

R03 General update of descriptions, added

R04 Added the AI Deadband section

R05 Minor corrections. Added Tx Delay

R06 Minor corrections as per document review

R07 Amend Unsolicited Response Retry Delay

R08 RFC12769 enhancements:- for V43 release

R09 RFC14221 ADVC:String Amendments

Add setting table notes for:4.3.2 Unsolicited Response Settings

Updated company name, address and

RFC11922 added for V44 release A44-11.00

4.6 DNP3 over IP

Removed older controller references

Updated references and implementation table

Unsolicited max retries update

Control Cubicle Software

Appendix A Protocol Timings

Appendix B DNP3 Device Profile

DNP3 Device Profile

Appendix C DNP3 Implementation Table

DNP3 Function Codes

DNP3 Internal Indication Bits

DNP3 Object Status Flags

DNP3 Control Operation

DNP3 Technical Bulletins

2.1 Status Points

2.3 Operator interfaces

------- DNP COMMUNICATIONS 1

2.4 Password Protection

3.2 GMT Offset

3.3 DNP3 Protocol

Technical Committee Bulletins:

-------- DNP COMMUNICATIONS 1

flexVUE DNP communication pages

---- DNP COMMUNICATION STATISITICS

DNP COMMS STATS

The communication port that the protocol handler is assigned to use.

Protocol Handler Status

Indication of the current status of the DNP3 protocol handler.

DNP3 Input/Output Map

Displays the name of the currently loaded DNP Input/Output map.

Transmission Message Count

The number of DNP3 data link messages transmitted from this

4.1 Communications (cont.)

Receive Message Count

The number of DNP3 data link messages received by this controller

Receive Message Length Error Count

The number of message packets received with a length error

Receive Message CRC Error Count

The number of DNP3 data link messages received by this controller

4.2 Transmission Services Configuration

4.2.2 Transmission Services Settings

flexVUE DNP Transmission Services pages

---- DNP Transmission Services 1 ----C