Professional Documents
Culture Documents
Technical Manual
For
ADVC Controller Range
Document Status
As Implemented
Subject to Change
Scope
Describes the DNP3 Protocol Implementation on
ADVC controller range
80 Schneider Road
Eagle Farm 4009
Queensland
Australia.
Tel +61 7 3635 7500
Fax +61 7 3635 7560
LIMITATIONS
This document is copyright and is provided solely for the use of the recipient. It is not to be copied
in any way, nor its contents divulged to any third party, nor to be used as the basis of a tender or
specification without the express written permission of Schneider Electric (Australia) Pty Limited.
This document discloses confidential intellectual property that belongs to Schneider Electric
(Australia) Pty Limited. This document does not invest any rights to Schneider Electric (Australia)
Pty Limited intellectual property in the recipient. Moreover the recipient is required not to disclose
any of the intellectual property contained in this document to any other party unless authorised in
writing by Schneider Electric (Australia) Pty Limited.
ADC01-DOC-146 R14 i
DNP3 Protocol Technical Manual
Revision Control
Contents
1. Introduction..............................................................................................................................1
2. Overview..................................................................................................................................1
2.1. Status Points.................................................................................................................1
2.2. Controls........................................................................................................................1
2.3. Operator interfaces.......................................................................................................2
2.4. Password Protection.....................................................................................................2
3. Applicability ............................................................................................................................3
3.1. Control Cubicle Software ............................................................................................3
3.2. GMT Offset..................................................................................................................3
3.3. DNP3 Protocol .............................................................................................................3
3.4. Terminology.................................................................................................................3
4. Protocol Configuration.............................................................................................................4
4.1. Communications ..........................................................................................................4
4.2. Transmission Services Configuration ..........................................................................7
4.3. Unsolicited Response Configuration .........................................................................11
4.4. Diagnostics.................................................................................................................16
4.5. Data Configuration.....................................................................................................19
4.6. DNP3 over IP.............................................................................................................24
Appendix A Protocol Timings ...........................................................................................................27
Appendix B DNP3 Device Profile.....................................................................................................28
DNP3 Device Profile .............................................................................................................29
Appendix C DNP3 Implementation Table.........................................................................................31
Controller DNP3 Implementation Table................................................................................31
DNP3 Function Codes ...........................................................................................................34
DNP3 Qualifiers.....................................................................................................................34
DNP3 Internal Indication Bits ...............................................................................................35
DNP3 Object Status Flags .....................................................................................................35
1. Introduction
This document describes the DNP3 implementation for ADVC Controller Range. It describes the
DNP3 implementation within the controller and its panel interface.
For more information about DNP3 input/output point map, point descriptions and attributes per
point refer to the WSOS5 DNP IO configuration tool and its documentation.
2. Overview
The controller combines the functions of protection relay and switchgear controller into a single
intelligent electronic device (IED).
The controller provides a user friendly operator interface on a LCD control panel that allows
configuration and control of the switchgear.
In addition the controller generates time tagged “events” which are displayed on the operator
control panel. These events show the history of the switchgear operation for the benefit of the
operator and for post fault analysis.
Examples would be:
Operator Actions such as trip or close
• Protection Pick up
• Protection Trips
• Fault Current Levels
• Auto-reclose actions
These events are optimised to give the operator the most useful information.
Electricity supply utilities frequently link the controller into their SCADA systems as a Remote
Terminal Unit (RTU).
To make this simple the controller provides:
• Mounting room for a radio or modem in the control cubicle.
• Power supply for the radio or modem in the control cubicle.
• Embedded protocol handler for the required SCADA protocol in the controller firmware.
The DNP3 protocol allows digital and analog data to be sent from the controller to the SCADA
system with time tags attached.
2.1. Status Points
This implementation provides a set of status information about the switchgear that can be used by a
SCADA system to generate displays and events for operational purposes. This data is called the
“Status Points”.
For example:
• Open or Close Status
• Lockout Status
• Fault Flags
• Line Currents and Voltages
Time tags are optional. If enabled, these status points are returned with time tags. For firmware
version A42-01.xx and later time stamps have a one millisecond (1ms) resolution.
2.2. Controls
A list of the controls supported by the controller is detailed in the IO configuration tool.
All controls have a corresponding binary status point. The master station must use these status
points to verify that the control action has been successful. Sometimes a control will be rejected
because of an underlying controller condition preventing the action. These conditions are detailed
in the DNP IO configuration tool’s ADVC-PTCL-331.html point list.
ADC01-DOC-146 R14 1
DNP3 Protocol Technical Manual
The DNP3 protocol handler can trigger two events to be recorded in the controller event log -
“DNP3 Trip Req” and “DNP3 Close Req”. This event log reporting indicates only that the protocol
handler has requested a trip or a close from the controller. It does not necessarily mean that the
action has been taken. As detailed above, the request may be over-ridden by operational conditions.
The DNP3 protocol handler is designated as a remote user. Refer to the equipment manual for more
information.
Note:
Some controls affect the currently active protection group. The change is put into effect
immediately and is permanent for that group. In other words, it is the equivalent to selecting
that protection group on the operator control panel, changing the setting and then putting the
change into service.
All binary/analog output points have a matching binary/analog input status point. It is
recommended that the master station use the control’s corresponding binary/analog input
status to verify the success of an action.
2.3.1. setVUE
The setVUE style OI is used on A44, and is the only interface available for A41, A42 and A43.
2.3.2. flexVUE
The flexVUE style OI is used on A44 only.
DNP3 MENU
MAIN MENU
DNP COMMS
ENGINEERING MENU DNP COMM STATS ↕
TELEMETRY MENU DNP TRANS SERVICES
CONFIGURE COMMS DNP IP NETWORKING
DNP3 MENU DNP UNSOLICITED
DNP DIAGNOSTICS
3. Applicability
3.1. Control Cubicle Software
This manual applies to ADVC controllers with A41-03.xx and later software versions.
To determine the version of the firmware on the controller refer to the ADVC Controller Range
Operations Manual.
3.4. Terminology
The terminology used in this document is that Earth Fault or Ground Fault is described as Earth /
Ground Fault and Sensitive Earth Fault (SEF) or Sensitive Ground Fault (SGF) is described as
SEF/SGF.
Also note that the phase terminology is ABC and refers always to the phase set by the Terminal
Designation or “Phasing” option, never to the physical bushing or terminal on the switchgear.
4. Protocol Configuration
When the DNP3 protocol handler is made available in the controller, a submenu is added to the
Communication menu. The DNP3 submenu pages fall into the following categories
• Communications
• Transmission Services Configuration
• Unsolicited Response Configuration
• Diagnostics
• Data Configuration
• IP Networking (Version A44-11.00 or later only)
All protocol configuration settings can be viewed, modified and stored on a personal computer with
the WSOS utility.
4.1. Communications
Setting Description
Port Selection Port Selection
Note 1 The communication port that the protocol handler is assigned to use.
Note 4 Range: Port NONE, RS232-PORT-A, RS232-PORT-B, RS232-PORT-C,
Note 5
RS232-PORT-D, RS-485, V23, 10BaseT
Factory default is Port NONE
INACTIVE Protocol Handler Status
RUNNING Indication of the current status of the DNP3 protocol handler.
INACTIVE means that the protocol handler is either configured as Port
NONE or the protocol handler has been assigned to a port that has already
been assigned exclusive use by another application in the controller or the
protocol IO map is invalid.
RUNNING means that the protocol handler has a valid IO map, has
successfully attached itself to a port and is running normally.
Display only status.
Range: INACTIVE/RUNNING
Protocol Map DNP3 Input/Output Map
Note 4 Displays the name of the currently loaded DNP Input/Output map.
Different IO maps can be created using WSOS and loaded into the controller.
If the loaded map is corrupt then an “Invalid Map” message is shown.
Reload the required map if this is seen.
Display only status.
Factory default is DNP3 Standard ACR2
Tx Count Transmission Message Count
Note 2,3 The number of DNP3 datalink messages transmitted from this controller into
the DNP3 communication link.
Range: 0 to 32767
Rx Count Receive Message Count
Note 2,3 The number of DNP3 datalink messages received by this controller from the
DNP3 communication link.
Range: 0 to 32767
Rx Length Err Receive Message Length Error Count
Note 2,3 The number of message packets received with a length error
Range: 0 to 32767
Rx CRC Err Receive Message CRC Error Count
Note 2,3 The number of DNP3 datalink messages received by this controller from the
DNP3 communication link with a CRC error
Range: 0 to 32767
Notes
1. The controller does not have all of its communications ports available at any one time. A
port selection feature in WSOS determines the ports available for the protocol handler to
use. Refer to the WSOS help file or the equipment operation manual for more information.
Unavailable ports are not displayed in this setting field.
2. Communication statistic counters are display status fields only.
3. All communication statistics counters are zeroed when:
• the controller is reset
• a DNP3 cold or warm restart message is received
• a configuration parameter is changed that triggers a protocol handler warm restart
• the ‘Reset All’ button is selected in WSOS.
• The OI select key is pressed twice (not password protected)
4. Changing this setting will cause the DNP3 handler task to perform a warm restart. This will
mean a re-initialisation of all communication settings such as FCB, sequence numbers,
restart internal indication etc. A temporary loss of communications with the master station
may occur. Also, any queued events will be deleted.
5. Selecting the port to 10BaseT is supported in Version A44-11.00 or later.
Setting Description
DL Cf Rqd Data Link Confirm Required
On some communications links it is required to have extra communications
integrity to ensure that all data link frames are successfully received by the
master station.
If NEVER, the protocol handler will not request acknowledgment messages
from the master station for data link frame transmissions. It assumes all data
link frames are received by the master station and relies solely on application
layer message integrity checking.
If SOMETIMES, the protocol handler requests a data link acknowledge
response from the master station only on multi-frame DNP3 messages.
If ALWAYS, the protocol handler will expect a data link acknowledgment
message from the master station to all data link frame transmissions.
Range: NEVER, SOMETIMES, ALWAYS.
Factory default is SOMETIMES
DL Cf TO Data Link Confirm Timeout
When the controller DNP3 data link layer transmits a frame that requires an
acknowledge response from the master station, it starts a timer.
If an acknowledge frame is not received from the master station with-in the
data link confirm time out period, DL Cf TO, then the frame is resent.
If the communications link has failed then the controller will continue
retransmissions until DL Max Retries failures occur after which it informs the
application layer of the failure.
Range: 50 to 65535 ms.
Factory default is 4000 ms
DL Max Retries Data Link Maximum Retries
Maximum number of times a frame is re-sent before communication failure
is identified.
Range: 0 – 255.
Factory default is 2
Apl Cf TO Application Layer Confirm Timeout
When the controller transmits some DNP3 messages, such as application
layer messages that contain change of state data, a DNP3 application layer
confirm message is expected from the master station. When the last byte of
one these messages is transmitted by the controller a timer is started.
If an application layer confirm message is not received from the master
station with-in the time out period then the message is deemed failed. Refer
to section 4.3.3 for more information regarding failed application layer
message handling.
If the application layer message is too large for a single data link frame then
the protocol handler segments the application message into multiple data
link frames. The application confirm timeout period must therefore allow for
multiple data link frames.
If DL Cf Rqd is set to either SOMETIMES or ALWAYS, then setting the
confirm timeout Apl Cf TO using the following formulae is recommended:
If Apl Frag Size >= 249,
Apl Cf TO >= ((DL Max Retries + 1) x DL Cf TO x Apl Frag Size / 249)
If Apl Frag Size < 249,
Apl Cf TO >= ((DL Max Retries + 1) x DL Cf TO)
WSOS will offer this value to the user if entering a value outside these
formulae.
If DL Cf Rqd is set to NEVER then the minimum Apl Cf TO is 0ms.
Range: 0 or (Apl Cf TOCalculated) to 3600000 ms.
Setting Description
Factory default is 108000 ms
Select/Op Select/Operate Timeout
Maximum time permitted, in milliseconds, between receiving a select
command message and an operate command message from the master station
for the control action to be deemed valid.
Range: 50 to 65535 ms.
Factory default is 10,000 ms
Apl Frag Size Application Layer Maximum Fragment Size
Note 1 Defines the maximum size of the application layer fragment that can be sent
Note 2 at any one time. Multiple application fragments will be created if the
controller data to be transmitted exceeds this size.
For high noise environments, reducing the size of the transmitted data link
frame can result in improved communication reliability. This can be done by
setting the Apl Frag Size value to less than 249. It is recommended that if the
value is set this low then DL Cf Rqd should be set to either SOMETIMES or
ALWAYS. However, it should be noted that this increased reliability will
result in increased turn around time for large controller data transmission.
For more information refer to the DNP3 User Group Technical Bulletin
9804-002 “DNP Confirmation and Retry Guidelines” Section 4.2.
If DNP VTO communications is to be used then it is recommended that this
value be set to 2048.
Range: 50 to 2048 bytes.
Factory default is 2048 bytes
DNP Address DNP3 Station Address
Note 2 The station address of the controller on the communication link.
This setting is not configurable via WSOS if ‘DNP3 radio’ or ‘DNP3
Modem’ communications are used.
Range: 0 to 65519
Factory default is 5
Time Dly Rq Time Synchronisation Request Delay
Note 2 The DNP3 protocol allows for the master station to send time
synchronisation messages independently or at the request of the controller or
both.
Time Dly Rq is the amount of time, in minutes, after the last master station
time synchronisation message that the controller will wait before setting the
‘Time Synchronisation Required’ internal indication bit (IIN1-4). This bit is
sent to the master station in every controller DNP3 message.
If this setting is set to 0 then the internal indication bit is never set and the
master station solely determines time synchronisation operation.
Range: 0 – 65535 minutes
Factory default is 0 minutes
Tx Delay Transmit Delay
Additional time, in milliseconds, between receiving a request and sending a
response.
This setting is used when the master station requires time to disable the
transmitter. If collision avoidance delay is being used by the controller then
this setting should be set to a value slightly greater than the master station’s
post-transmission period.
Range: 0 to 65535 ms
Factory default 0 ms
Operate Seq Chk ON: the controller requires DNP3 Select-Before-Operate (SBO) requests to be
Setting Description
contiguously sequenced, i.e. if the select sequence number is N in the Application
Layer sequence, then the operate Application Layer message request sequence
number must be N+1 (within the application layer sequence number range).
Either way - the operate Application Layer request message must be received
within the “Select/Operate Timeout” period to activate the selected control.
Range: ON/OFF
Factory default is ON
Applicable to version V43 only from A43-03.00 onwards.
Keep-Alive Keep-Alive Time
Note 2 The controllers issues periodical Request Link Status messages to verify the
Note 3 integrity of the connection to the master.
Range: 1 to 172800s
Factory default is 20s
Applicable to version V44 from A44-11.00 onwards.
Notes
1. The maximum number of DNP application sequence numbers permitted per report attempt
is limited to 16. It is therefore possible that if Apl Frag Size is set low and the number of
available events is large then not all available event data will be reported in a single
message sequence. If Unsolicited responses are not enabled then the master station must
monitor event availability in controller using the class data available internal indicators and
perform multiple poll attempts to read all data.
2. Changing this setting will cause the DNP3 handler task to perform a warm restart. This will
mean a re-initialisation of all communication settings such as FCB, sequence numbers,
restart internal indication etc. A temporary loss of communications with the master station
may occur. Also, any queued events will be deleted.
3. The Keep Alive time setting is only available for 10BaseT port and TCP mode selected.
Alternatively, if a master station polls the controller frequently and the controller’s unsolicited
responses are not enabled then it is recommended that the controller not be configured to use data
link retries and the data link confirmation mode be set to SOMETIMES. It is the master station’s
responsibility to gather data. If the master station detects a communication failure then it can
choose to either move on and poll the next device on a multi-drop communication link or perform a
poll retry on the failed device. A controller retry at this stage increases the probability of collisions.
For more information refer to the DNP3 User Group Technical Bulletin 9804-002 “DNP
Confirmation and Retry Guidelines.”
Events can be reported in three data classes. Typically the following priorities are applied:
• Class 1 - high priority event class
• Class 2 - medium priority event class, and
• Class 3 - low priority event class
The event class of DNP3 binary and analog points can be configured using a tool embedded in
WSOS.
Note
The fourth DNP3 data class, Class 0, is not an event class. It is used in the reporting of current
(static) value of data and not change of state events. Setting a point to class 0 via the WSOS
Configurable DNP3 tool will prevent the protocol handler from reporting change of state events for
that point to the master station. The point will remain accessible via static data polls.
The following controller display pages allow configuration of Unsolicited Response behaviour.
DNP UNSOLICITED
Unsolicited OFF
Master Addr 3 ↕
Unsol Retries 255
Unsol Delay 109s
Send Class READY
C1 Max Count 1
C1 Delay 1s
C2 Max Count 3
C2 Delay 5s
C3 Max Count 5
C3 Delay 10s
Setting Description
Unsolicited Enable/Disable Unsolicited Responses
Note 1 If OFF, change of state events are buffered but only sent as responses to
event polls from the master. Any Enable or Disable Unsolicited
Messages commands received by the controller will result in the
controller responding with its ‘Function Code Not Implemented’ internal
indication bit set.
If ON or FORCED, change of state events are buffered and are
transmitted when:-
• A class count is exceeded, or
• A class notification delay timer expires, or
• As a response to a master station event poll.
When a class count is exceeded, or class notification delay timer expires,
then the number and type of events transmitted is determined by Send
Class.
If the master station issues a Disable Unsolicited Messages command to
the controller after the controller has sent its initial unsolicited ‘Null’
message then the mode of the controller will be overridden regardless of
ON or FORCED setting.
Note:
1. If ON, the unsolicited reporting ability in the controller is enabled.
The controller will inform the master station of this ability via an
initial unsolicited ‘Null’ message and will only transmit unsolicited
response change of state events after it receives an ‘Enable
Unsolicited Messages’ command from the master station.
ON will mean that the controller DNP3 implementation is compliant
with the DNP3-1999+ specification.
2. If FORCED, the controller will transmit unsolicited response change
of state events immediately without waiting for the ‘Enable
Unsolicited Messages’ command from the master station.
FORCED will cause the controller DNP3 implementation to be non-
compliant with the DNP3-1999+ specification and is not recommended.
This setting has been provided for compatibility with legacy master
station implementations that are in conflict with the specification.
Range: OFF, ON, FORCED.
Factory default is OFF
Setting Description
Master Addr DNP3 Master Station Address
Note 1 This is the DNP3 address to which the unsolicited responses are sent.
Range: 0 to 65519
Factory default is 3.
Unsol Retries Unsolicited Response Maximum Number of Retries
Note 1 Maximum number of attempts to re-transmit an unsolicited response
without getting a confirmation from the master.
Refer to section 4.3.3 below for more information.
This limitation does not apply to an initial unsolicited ‘Null’ message.
(A DNP3-2000 requirement.)
A value of 0 means that only a single transmission is made and no re-
transmits are attempted.
A value of 255 means unlimited retries ie maximum limit is disabled.
Range: 0 to 255
Factory default is 255
Unsol Delay Unsolicited Response Retry Delay
Note 1 If the controller has not received a confirmation from the master station
to an unsolicited response within Apl Cf TO period then this setting
determines when the next unsolicited response will be sent.
The Apl Cf TO timer and Unsol Dly timers are started at the same time ie
started immediately after the transmission of the last byte of a controller
message that expects a response from the master.
If Unsol Dly is greater than Apl Cf TO then it will wait until Unsol Dly
seconds after transmission of last message before sending a retry.
Unsol Dly should never be set to less than Apl Cf TO.
Range: 1 to 86400 seconds
Factory default is 109s
Send Class Unsolicited Response Class Reporting
Used to control which classes are transmitted in the unsolicited response
message when a class count is exceeded or a class notification delay
timer expires.
If READY then only the events of that class are reported.
If ALL then all available events, irrespective of class, will be included in
the unsolicited message.
If PRIORITY then any events available of equal or higher priority are
sent. For example, if Class 2 events are ready to be sent and Class 1
events are available but not ready then both classes will automatically be
sent. Any available Class 3 events will not be included.
Note that if set to READY or PRIORITY then the reported unsolicited
message may have internal indicator bits (IINs) set to indicate data
available in other classes. Some master stations, upon seeing these bits
set will immediately send a poll for the unreported data. In this case
ALL is recommended for greater communication efficiency.
Range: READY, ALL, PRIORITY
Factory default is READY
Setting Description
Unsol Selects the Unsolicited Response retry type that is transmitted when an
(REGENERATED / unsolicited response is ‘Unconfirmed’ by the master station and a
IDENTICAL) retransmission is required by the out-station.
Note 1
The octets of a REGENERATED unsolicited response retry - may
contain some or all of the data from the previous unsolicited response,
and may also include updated data, new data and changed IIN octets.
The sequence number in the application control octet is incremented
from the previously transmitted unsolicited response.
Note
1. Changing this setting will cause the protocol handler to perform a warm restart. This will mean
a re-initialisation of all communication settings such as FCB, sequence numbers, restart internal
indication etc. A temporary loss of communications with the master station may occur. Also,
any queued events prior to setting change will be lost.
If the application layer receives an confirm response within the application layer confirmation time
out period (Apl Cf TO), then the tagged events are removed from the buffer.
If a confirm message is not received within the application layer confirm time out period (Apl Cf
TO) then all tagged events are untagged and are retained in the event buffer and the protocol
handler behaves as follows:
• If unsolicited response messages are not enabled then the events are retransmitted when next
requested by the master station.
• If unsolicited response messages are enabled then the protocol handler waits for the retry delay
timer (Unsol Dly) to expire before attempting to send another unsolicited response. Selection of
Regenerated or Identical unsolicited retries is an operator setting, refer 4.3.2 Unsolicited
Response Settings – Unsol REGENRATED/IDENTICAL.
If the maximum unsolicited response retry limit is enabled and after Unsol Retries, the protocol
handler will cease attempting to send unsolicited responses until either:-
• A successful application layer message, of any function code, addressed to it is received
from the master station,
• a new event is queued in the buffer, or
• the default (non configurable) ‘Offline’ time-out expires.
If the 250 binary event buffer, or the 200 analog event buffer, is full then the oldest queued event
will be over-written by a new event. Both event buffers reside in volatile RAM.
4.4. Diagnostics
4.4.1. Overview
Diagnostic pages are to enable the user to have visibility of the protocol handler’s internal statuses,
timer values and event buffer status for communications commissioning purposes.: -
setVUE DNP Diagnostics page 1
Setting Description
C1-> Class Indicator
C2-> Indicator of the class that applies to the rest of the data on the row.
C3->
Unsolicited Unsolicited Response Reporting Status
Response Status Shows whether transmission of unsolicited data for the class has been
by Class enabled or disabled
ENABLED if:
• Unsolicited is ON in protocol handler AND the protocol handler
has received an Enable Unsolicited Responses command
(Function code 0x14) from the master station, OR
• Unsolicited is FORCED AND the protocol handler has NOT
received a Disable Unsolicited Responses command (Function
code 0x15) from the master station
DISABLED if
• Unsolicited is OFF in protocol handler, OR
• Unsolicited is ON in protocol handler AND the protocol handler has
never received an Enable Unsolicited Responses command (Function
code 0x14) from the master station, OR
• Unsolicited is ON or FORCED in protocol handler AND the
protocol handler has received a Disable Unsolicited Responses
command (Function code 0x15) from the master station
Display only status.
Range: ENABLED, DISABLED
Buffered events Class Event count
by Class The number of binary and analog events currently buffered for the class.
Count is valid irrespective of whether the protocol handler is in solicited
response or unsolicited response mode.
Display only status.
Range: 0 to 450 events
Unsolicited Unsolicited Response Class Notification Timer
Response Timer The current value of notification delay timer for the class.
by Class Display only status.
Range: 0 to Unsolicted Delay seconds
DL Timer Datalink Confirm Timer
The time in milliseconds since last datalink message was transmitted.
Display only status.
Range: 0 to DL Cf TO seconds
DL retry count Datalink Retry Count
Number of times a datalink message has been sent. This count includes
the initial message.
Display only status.
Range: 0 to DL Max Retries
Apl Cf Timer Application Confirm Timer
The time in milliseconds since start of transmission of current
application layer message.
Display only status.
Range: 0 to Apl Cf TO seconds
Select Timer Select / Operate Timer
The time in milliseconds since receipt of select command.
Display only status.
Range: 0 to Select/Op seconds
Uns Retry Tmr Unsolicited Response Retry Timer
The time in seconds since last unsolicited response message was
transmitted.
Display only status.
Range: 0 to Retry Dly seconds
Uns Retry Cnt Unsolicited Response Retry Count
Number of times an unsolicited response retry has been sent.
Display only status.
Range: 0 to Unsol Retries
Note
The accuracy of displayed timer values are subject to panel refresh time.
Setting Description
Binary Time Binary Time Tag Usage
Determines whether or not a time tag is included with DNP3 binary
change of state events transmitted to a master station by the controller.
Range: ON, OFF
Factory default is ON.
Analog Time Analog Time Tag Usage
Determines whether or not a time tag is included with DNP3 analog
change of state events transmitted to a master station by the controller.
Range: ON, OFF
Factory default is OFF
Setting Description
Analog Flag Analog Flag Reporting
Determines whether or not a byte containing the analog’s status data is
included with its value in a controller response to a static data scan.
If ON, the controller will always send a flag of either 0x01 (point
online) or 0x21 (point online and overrange). It is recommended that
this setting should only be set ON if the use of the analog flag bits is a
master station requirement.
Range: ON, OFF
Factory default is OFF
Binary Outputs Binary Output Status Reporting
Note 1 The protocol handler response to an integrity poll or a class 0 poll
includes binary inputs, counters and analog inputs. This setting
determines whether or not binary output status data is also included.
(Unmapped data types are excluded.)
If ON, the controller will always include binary output (object 10
variation 02) status data in the response.
Range: ON, OFF
Factory default is OFF
Analog Evts Select the Analog event reporting mode for Analog class 1, 2 or 3 input
Note 1 change events.
Note
1. Changing this setting will cause the protocol handler to perform a warm restart. This will mean
a re-initialisation of all communication settings such as FCB, sequence numbers, restart internal
indication etc. A temporary loss of communications with the master station may occur. Also,
any queued events prior to setting change will be lost.
The rest of the default data objects used by the controller are:
• Binary input status (Object 1 variation 01),
• Binary counter status (Object 20 variation 05),
• Frozen counter status (Object 21 variation 09),
• Binary output status (Object 10 variation 02), and
• List of attribute variations (Object 0 variation 255) – Version A44-11.00 or later only
These object types are not configurable.
Note:
If the master station requests data with an explicit object variation then the controller will respond
with that variation. If an analog value is greater than 32767 then the controller will respond to a
request for a 16 bit analog input object with value 32767 and over-range bit set.
For more information refer to the WSOS5 DNP3 Configuration Tool manual WSOS01-DOC-
102.pdf
For a listing of all controller’s IO that can be mapped refer to the ADVC-PTCL-331.html points list
available in the help menu of the tool that is accessible via WSOS5.
For a listing of the controller’s default IO map refer to the “DNP3 Standard ACR” map available
with the tool. A legacy “DNP3 Legacy 27-17 ACR” IO map is also available with the tool and can
be loaded into the controller to make its DNP3 IO behave like a PTCC V27-17 or newer.
Note:
The DNP3 Standard ACR map reflects points that are available with default settings in the
controller. If a feature is made available via configuration then the user is required to manually add
any related points to the IO list as required.
The volatile analogue input deadbands are configurable from the DNP3 master station on a per
point basis using DNP3 analog input deadband object writes. If it is desired that the changes be
maintained after a controller or protocol handler restart then it is the master station’s responsibility
for re-sending any updated deadband values. The master station can detect the restart condition via
the DNP internal indicator restart status bit.
Deadband values are not reported in integrity or event polling. They are only available via reads
and writes of DNP3 analogue input deadband objects.
All deadbands supported by the protocol handler are fixed value format - ie the deadband value
represents an analogue input’s absolute value difference between the last reported value and the
threshold value that the current value must exceed in order to generate an analogue change of state
event.
For more information on DNP3 analogue input deadband objects and behaviour refer to the DNP3
User Group Technical Bulletin 9809-001 “Analogue Input Reporting Deadband”.
Layout if Transport Protocol is TCP Protocol and Unsolicited is OFF (Listening End Point).
Layout if Transport Protocol is TCP Protocol and Unsolicited is ON (Dual End Point).
Setting Description
IP Networking Mode
UNSOLICITED TCP UDP
On/Forced Dual End Point Datagram End Point
Off Listening End
Note:
1. Changing this setting will cause the DNP3 handler task to perform a warm restart. This will
mean a re-initialisation of all communication settings such as FCB, sequence numbers,
restart internal indication etc. A temporary loss of communications with the master station
may occur. Also, any queued events will be deleted.
flexVUE DNP Network Stats pages displayed with an invalid connection attempt
DNP NETWORK STATS
Last Invalid 10.1
Invalid Pckts 77 ↕
Setting Description
Last Invalid IP Last Invalid IP address
Note 1 Only visible when Check Master IP is ON
This field displays the IP address of the last unauthorized machine that
tries to connect to the controller DNP3 TCP port.
The user can press SELECT on this page to make a menu appear.
Another press of "SELECT" will reset the page and set this field to
"NONE", while "Menu" key pressed will cancel the whole operation.
Display only status.
Range : NONE or an invalid IP address
Invalid Packet Invalid Packet Count
Count Only visible when Check Master IP is ON
This field displays the number of connection tries of the last
unauthorized machine. If a new invalid connection is attempted from a
different machine, the Last Invalid IP is updated and the count is reset to
1.
The user can press SELECT on this page to make a menu appear.
Another press of "SELECT" will reset the page and set this field to
"NONE", while "Menu" key pressed will cancel the whole operation.
Display only status.
Range : 0 to 4294967296
Note
1. This field on the flexVUE scrolls to display the full text.
Initialisation Time
After power up, the protocol handler will not respond to master station requests whilst it waits for
the controller database to be initialised and for high priority boot up tasks to be completed.
Turnaround Time
The turnaround time for the protocol, from the end of receiving a message until the start of the pre-
transmission time, is typically < 30 milliseconds with a range of 4 to 100 milliseconds.
The DNP3 device profile defines the mapping of all data points used, in the standard format
recommended by the DNP3 users group.
This device profile is also available as an XML file generated by WSOS with ADVC Controller
running Version A44-11.00 or later. To get this file, open the DNP3 Point Configuration Window
and click on Create in the XML Profile box. It is then possible to save the file.
The following device profile summarizes the capability of the DNP3 functionality available on the
controller. In order to access to the complete device profile, it is necessary to use WSOS.
Conforms to DNP3 level 2 subset definition requirements with many additional level 3 features built
in. Refer to the shaded areas of Appendix C DNP3 Implementation Table, for additional level 3
features built in.
Maximum Data Link Frame Size (octets): Maximum Application Fragment Size (octets):
Transmitted: 292 Transmitted: Configurable (50 to 2048)
Received: 292 Received: 249
Maximum Data Link Retries: Maximum Application Layer Retries:
Configurable 0..255 None
Requires Data Link Layer Confirmation:
Configurable, 3 settings Never, Always, Sometimes (on multi frame fragments only)
Sometimes (only when reporting event data or when sending multifragment responses)
Note
1. All shaded areas are the additional level 3 or above function, objects, variations and/or qualifiers
supported by controller.
2. Bold italics response function codes represent controller default objects. These are the object
variations that the controller will issue as in its response to an event (class 1, 2, 3) poll, an integrity
Request Response
Function Description Function Description Function Description
Code Code Code
1 Read 9 Freeze and Clear 129 Response
2 Write 10 Freeze and Clear, No Ack 130 Unsolicited
3 Select 13 Cold Restart (Note 1) Response
Note
1. When a cold or warm restart command is received by the controller it will restart the DNP3 protocol
handler only. The controller itself does not restart.
It is recommended by the DNP3 User Group that master stations do not ask for a data link
acknowledgement nor an application confirm on restart commands (refer to “Cold/Warm Restart
Sequence”, Technical Bulletin 9701-003)
The controller reports a time object of 500 milliseconds for both restart types. The master station
should not initiate any message sequences for this period. However, if the controller has unsolicited
messages configured ON then it will automatically establish communications on restart. This may be
within the 500 milliseconds period.
DNP3 Qualifiers
Qualifier Use in a Request Use in a Response
(Hex)
00, 01 A range of static points, or a single point with a point Static Objects
number.
Object headers use either 8 bit (Q=00) or 16 bit
(Q=01) start and stop range indices.
Response
Controller Control Response Description
Status Value
0 Control request accepted
1 Control request denied. Select/Operate timed out. The time out setting is configurable.
2 Control request denied. Operate without select message OR operate/select application sequence
number mis-match.
3 Control request denied. Formatting error
4 Control request denied. Control operation not supported
Examples:
• Trip control sent to a point that supports only Pulse or Latch operations. The supported
operations are indicated on a per point basis in the IO configuration tool.
• The binary output (or analog output) point number is out of range.
• The analog output value is out of range.
5 Control request denied. Already Active
6 Control request denied. Hardware Error.
7 Not Implemented.
8 Control request denied. Control rejected by controller because too many operations have been
requested.
9 Control request denied. Control rejected by controller because of an underlying condition preventing
the action. This includes local mode.
127 Control request denied. Control rejected by controller because of some other undefined reason.
All binary output points have a matching binary input status point. The master station must always
use the corresponding binary status for the control to verify the success of the action.
Notes:
1) The following data types are not used by the controller:-
• File transfer objects
• Analog input floating point and analog output floating point objects
• Variable arrays objects
• 8 bit unsigned integer objects
• Virtual terminal objects
2) The “Reset User Process”(1) function code should not be used. If the “Reset User Process”(1)
function code is used in the Control byte, then the response function code will be “Link Not
Used”(15).