9) El mundo DNP3.0 2004-2005

TO: RE: All DNP3 User Group Members DNP3 Documentation Library DATE: March 25, 2004 Thank you for your membership in the DNP3 Users Group and for your support of the DNP3 protocol! This file includes all DNP3-related documents available as of March 25, 2004 and will be updated on an as-needed basis. The purpose of this file is to provide a single source document in a universal format for the convenience of all DNP3 User Group Members. Therefore, this file has been created in Adobe Portable Document Format (.pdf). If you do not have access to Adobe Acrobat, you may download a free Acrobat Reader directly from the Adobe website (www.Adobe.com). The bookmarks in this document will enable quick navigation through all of the existing DNP3 documentation. Simple character string searches are also allowed (i.e., Object 10) using the standard Windows key sequence (Ctrl-F). Please let us know if you have any comments or questions regarding this document. Sincerely, The DNP3 Executive Committee A DNP3 Protocol Primer Introduction This is a primer for people who want a quick understanding of DNP3 without having to comb through the tedious details of a complex specification. The writing style is meant to be informal and personal1. So let us start with what it is. Protocols define the rules by which devices talk with each other, and DNP3 is a protocol for transmission of data from point A to point B using serial and IP communications. It has been used primarily by utilities such as the electric and water companies, but it functions well for other areas. A typical electric company may have a common operations center that monitors all of the equipment at each of its substations. In the operations center, a powerful computer stores all of the incoming data and displays the system for the human operators. Substations have many devices that need monitoring (Are circuit breakers opened or closed?), current sensors (How many amperes are flowing?) and voltage transducers (What is the line potential?). That only scratches the surface; a utility is interested in monitoring many parameters, too numerous to discuss here. The operations personnel often need to switch sections of the power grid into or out of service. Computers are situated in substations to collect the data for transmission to the master station in the operations center. The substation computers are also called upon to energize or de-energize the breakers and voltage regulators. DNP3 uses the term outstation to denote remote computers as are found in the field. The term master is used for the computers in the control centers. DNP3 provides the rules for remotely located computers and master station computers to communicate data and control commands. DNP3 is a non-proprietary protocol that is available to anyone by visiting the web site www.dnp.org. Only a nominal fee is charged for documentation, but otherwise it is available worldwide with no restrictions. This means a utility can purchase master station and outstation computing equipment from any manufacturer and be assured that they will reliably talk to each other. Vendors compete based upon their computing equipment’s features, costs and quality factors instead of who has the best protocol. Utilities are not bound to one manufacturer after the initial sale. What do the computers talk about? Outstation computers gather data for transmission to the master • • • • Binary input data that is useful to monitor two-state devices. For example a circuit breaker is closed or tripped; a pipeline pressure alarm shows normal or excessive. Analog input data that conveys voltages, currents, power, reservoir water levels and temperatures. Count input data that reports energy in kilowatt hours or fluid volume. Files that contain configuration data. The master station issues control commands that take the form of • • Close or trip a circuit breaker, start or stop a motor, and open or close a valve. Analog output values to set a regulated pressure or a desired voltage level. Other things the computers talk to each other about are synchronizing the time and date, sending historical or logged data, waveform data, and on and on. Why DNP3? DNP3 was designed to optimize the transmission of data acquisition information and control commands from one computer to another. It is not a general purpose protocol like those found on the Internet for transmitting email, hypertext documents, SQL queries, multimedia and huge files. It is intended for SCADA (Supervisory Control and Data Acquisition) applications. Master and Outstation Databases Figure 1 shows the master-outstation relationship and gives a simplistic view of the databases and software processes involved. The master is on the left side of figure 1, and the outstation is on the right side. 1 Readers should not assume this document contains formal rules, which are only provided by the DNP3 Specification volumes. DNP3 Primer, Revision A, 20 March 2005 Page 1 Copyright, DNP Users Group, 2000, 2005 Binary Input 8 7 6 5 4 3 2 1 0 Master Control Output Analog Input Counter Input 4 3 3 2 2 1 1 0 0 6 5 4 3 2 1 0 Analog Output 4 3 2 1 0 Binary Input 8 7 6 5 4 3 2 1 0 Outstation Control Output Analog Input Counter Input 4 3 3 2 2 1 1 0 0 6 5 4 3 2 1 0 Analog Output 4 3 2 1 0 DNP3 User's Code DNP3 User's Code DNP3 Software DNP3 Software Physical Media User Requests User Responses Figure 1 A series of square blocks at the top of the outstation depict data stored in its database and output devices. The various data types are conceptually organized as arrays. An array of binary input values represents states of physical or logical boolean devices. Values in the analog input array represent input quantities that the outstation measured or computed. An array of counters represents count values, such as kilowatt hours, that are ever increasing (until they reach a maximum and then roll over to zero and start counting again.) Control outputs are organized into an array representing physical or logical on-off, raise-lower and trip-close points. Lastly, the array of analog outputs represents physical or logical analog quantities such as those used for setpoints. The elements of the arrays are labeled 0 through N - 1 where N is the number of blocks shown for the respective data type. In DNP3 terminology, the element numbers are called the point indexes. Indexes are zero-based in DNP3, that is, the lowest element is always identified as zero. Notice that the DNP3 master also has a similar database for the input data types (binary, analog and counter.) The master uses values in its database for the specific purposes of displaying system states, closed-loop control, alarm notification, billing, and much, much more. An objective of the master is to keep its database updated. It accomplishes this by sending requests to the outstation asking it to return the values in the outstation’s database. This is termed polling. The outstation responds to the master’s request by transmitting the contents of its database. Arrows are drawn at the bottom of Figure 1 showing the direction of the requests (toward the outstation) and the direction of the responses (toward the master). Later we will discuss systems whereby the outstations transmit responses without being asked. Layering The master and the outstation shown in Figure 1 each have two software layers. The top layer is the DNP3 user layer. In the master, it is the software that interacts with the database and initiates the requests for the outstation’s data. In the outstation, it DNP3 Primer, Revision A, 20 March 2005 Page 2 Copyright, DNP Users Group, 2000, 2005 is the software that fetches the requested data from the outstation’s database for responding to master requests. It is interesting to note, that if no physical separation of the master and outstation existed, eliminating the DNP3 might be possible by connecting these two upper layers together. However, since physical, or possibly logical separation of the master and outstation exists, DNP3 software is placed at a lower level. The DNP3 user’s code uses the DNP3 software for transmission of requests or responses to the matching DNP3 user’s code at the other end. More will be said about data types and software layers later, but first we want to examine a few typical system architectures where DNP3 is used. DNP3 Master DNP3 Outstation One-on-One DNP3 Master DNP3 Outstation DNP3 Outstation DNP3 Outstation Multi-drop DNP3 Master DNP3 Outstation Master DNP3 Outstation Hierarchical DNP3 Master DNP3 Outstation XYZ Master XYZ Outstation XYZ Outstation Data Concentrator XYZ Master XYZ Outstation DNP3 Master DNP3 Outstation DNP3 Outstation Data Concentrator Figure 2 System Architecture Figure 2 shows common system architectures in use today. At the top is a simple one-on-one system having one master station and one outstation. The physical connection between the two is typically a dedicated or dial-up telephone line. The second type of system is known as a multi-drop design. One master station communicates with multiple outstation devices. Conversations are typically between the master and one outstation at a time. The master requests data from the first outstation, then moves onto the next outstation for its data, and continually interrogates each outstation in a round robin order. The communication media is a multi-dropped telephone line, fiber optic cable, or radio. Each outstation can hear messages from the master and is only permitted to respond to messages addressed to itself. Outstations may or may not be able to hear each other. In some multi-drop forms, communications are peer-to-peer. A station may operate as a master for gathering information or sending commands to the outstation in another station. And then, it may change roles to become an outstation to another station. DNP3 Primer, Revision A, 20 March 2005 Page 3 Copyright, DNP Users Group, 2000, 2005 The middle row in Figure 2 shows a hierarchical type system where the device in the middle is an outstation to the master at the left and is a master with respect to the outstation on the right. The middle device is often termed a sub-master. Both lines at the bottom of Figure 2 show data concentrator applications and protocol converters. A device may gather data from multiple outstations on the right side of the figure and store this data in its database where it is retrievable by a master station on the left side of the figure. This design is often seen in substations where the data concentrator collects information from local intelligent devices for transmission to the master station. TCP/IP Many vendors offer products that operate using TCP/IP to transport DNP3 messages in lieu of the media discussed above. Link layer frames, which we have not talked about yet, are embedded into TCP/IP packets. This approach has enabled DNP3 to take advantage of Internet technology and permitted economical data collection and control between widely separated devices. More On Layering Communication circuits between the devices are often imperfect. They are susceptible to noise and signal distortion. DNP3 software is layered to provide reliable data transmission and to effect an organized approach to the transmission of data and commands. Figure 3 shows the layering that was not shown in Figure 1. Binary Input 8 7 6 5 4 3 2 1 0 Master Binary Input 8 7 6 5 4 3 2 1 0 Outstation Control Output Analog Counter 4 3 2 1 0 3 2 1 0 6 5 4 3 2 1 0 Analog Output 4 3 2 1 0 Analog Counter 4 3 2 1 0 3 2 1 0 DNP3 User's Code DNP3 Application Layer Pseudo Transport Layer DNP3 Link Layer DNP3 User's Code DNP3 Application Layer Pseudo Transport Layer DNP3 Link Layer Physical Media User Requests User Responses Figure 3 Link Layer Responsibility The link layer has the responsibility of making the physical link reliable. It does this by providing error detection and duplicate frame detection. The link layer sends and receives packets, which in DNP3 terminology, are called frames. Sometimes transmission of more than one frame is necessary to transport all of the information from one device to another. DNP3 Primer, Revision A, 20 March 2005 Page 4 Copyright, DNP Users Group, 2000, 2005 A DNP3 frame consists of a header and data section. The header specifies the frame size, contains data link control information and identifies the DNP3 source and destination device addresses. The data section is commonly called the payload and contains data passed down from the layers above. DNP3 Frame Header Data Section Header Sync Length Link Control Destination Address Source Address CRC Every frame begins with two sync bytes that help the receiver determine where the frame begins. The length specifies the number of octets in the remainder of the frame, not including CRC check octets. The link control octet is used for the sending and receiving link layers to coordinate their activities. Addressing The destination address specifies which DNP3 device should process the data, and the source address identifies which DNP3 device sent the message. Having both destination and source addresses satisfies at least one requirement for peer-to-peer communications because the receiver knows where to direct its responses. 65520 individual addresses are available. Every DNP3 device must have a unique address within the collection of devices sending and receiving messages to and from each other. Three destination addresses are reserved by DNP3 to denote an all-call message; that is, the frame should be processed by all receiving DNP3 devices. One address is a universal address, the details of which are not given here, and twelve addresses are reserved for special needs in the future. CRC Checks The data payload in the link frame contains a pair of CRC octets for every 16 data octets. This provides a high degree of assurance that communication errors can be detected. The maximum number of octets in the data payload is 250, not including CRC octets. (The maximum length link layer frame is 292 octets if all the CRC and header octets are counted.) Link Layer Confirmation One often hears the term “link layer confirmation” when DNP3 is discussed. A feature of DNP3's link layer is the ability for the transmitter of the frame to request the receiver to confirm that the frame arrived. Using this feature is optional, and it is often not employed because there are other methods for confirming receipt of data. It provides an extra degree of assurance of reliable communications. If a confirmation is not received, the link layer may retry the transmission. Some disadvantages to using link layer confirmation are the extra time required for confirmation messages and waiting for multiple timeouts when retries are configured. Transport Layer The transport layer has the responsibility of breaking long application layer messages into smaller packets sized for the link layer to transmit, and, when receiving, to reassemble frames into longer application layer messages. In DNP3 the transport layer is incorporated into the application layer. The transport layer requires only a single octet overhead to do its job. Therefore, since the link layer can handle only 250 data octets, and one of those is used for the transport function, each link layer frame can hold as many as 249 application layer octets. Application Layer Fragments Application layer messages are broken into fragments. Maximum fragment size is determined by the size of the receiving device’s buffer. The normal range is 2048 to 4096 bytes. A message that is larger than a one fragment requires multiple fragments. Fragmenting messages is the responsibility of the application layer. Note that an application layer fragment of size 2048 must be broken into 9 frames by the transport layer, and a fragment size of 4096 needs 17 frames. Interestingly, it has been learned by experience that communications are sometimes more successful for systems operating in high noise environments if the fragment size is significantly reduced. DNP3 Primer, Revision A, 20 March 2005 Page 5 Copyright, DNP Users Group, 2000, 2005 Static and Event Data The application layer works together with the transport and link layers to enable reliable communications. It provides standardized functions and data formatting with which the user layer above can interact. Before functions, data groups and variations can be discussed, the terms static, events and classes need to be covered. In DNP3, the term static is used with data and refers to the present value. Thus static binary input data refers to the present on or off state of a bi-state device. Static analog input data contains the value of an analog at the instant it is transmitted. One possibility DNP3 allows is requesting some or all of the static data in an outstation device. DNP3 events are associated with something significant happening. Examples are state changes, values exceeding some threshold, snapshots of varying data, transient data and newly available information. An event occurs when a binary input changes from an on to an off state or when an analog value changes by more than its configured deadband limit. DNP3 provides the ability to report events with and without time stamps so that if desired, the master will have the information to generate a time sequence report. The master’s user layer can direct DNP3 to request events. Usually, a master is updated more rapidly if it spends most of its time polling for events from the outstation and only occasionally asks for static data as an integrity measure. The reason updates are faster is because the number of events generated between outstation interrogations is small and, therefore, less data must be returned to the master. DNP3 goes a step further by classifying events into three classes. When DNP3 was conceived, class 1 events were considered as having higher priority than class 2 events, and class 2 were higher than class 3 events. While that scheme can be still be configured, some DNP3 users have developed other strategies more favorable to their operation for assigning events into the classes. The user layer can request the application layer to poll for class 1, 2 or 3 events or any combination of them. Variations DNP3 has provisions for representing data in different formats. Examination of analog data formats is helpful to understand the flexibility of DNP3. Static, present value, analog data can be represented by variation numbers as follows: 1. 2. 3. 4. 5. 6. A 32-bit integer value with flag A 16-bit integer value with flag A 32-bit integer value A 16-bit integer value A 32-bit floating point value with flag A 64-bit floating point value with flag The flag referred to is a single octet with bit fields indicating whether the source is on-line, the data source restarted, communications are lost with a downstream source, the data is forced and the value is over range. Not all DNP3 devices can transmit or interpret all six variations. Later, DNP3 levels are discussed, but for now, suffice it to say that DNP3 devices must be able to transmit the simplest variations so that any receiver can interpret the contents. Event analog data can be represented by these variations: 1. 2. 3. 4. 5. 6. 7. 8. A 32-bit integer value with flag A 16-bit integer value with flag A 32-bit integer value with flag and event time A 16-bit integer value with flag and event time A 32-bit floating point value with flag A 64-bit floating point value with flag A 32-bit floating point value with flag and event time A 64-bit floating point value with flag and event time The flag has the same bit fields as for the static variations. Groups It appears by looking at the above variations that variation 1 and 2 analog events cannot be differentiated from variation 1 and 2 static analog values. DNP3 solves this predicament by assigning group numbers. Static analog values are assigned as group 30, and event analog values are assigned as group 32. Static analog values, group 30, can be formatted in one of 6 variations, and event analog values, group 32, can be formatted in one of 8 variations. DNP3 Primer, Revision A, 20 March 2005 Page 6 Copyright, DNP Users Group, 2000, 2005 When a DNP3 outstation transmits a message containing response data, the message identifies the group number and variation of every value within the message. Group and variation numbers are also assigned for counters, binary inputs, controls and analog outputs. In fact, all valid data types and formats in DNP3 are identified by group and variation numbers. Defining the allowable groups and variations helps DNP3 assure interoperability between devices. DNP3's basic documentation contains a library of valid groups and their variations. Objects When data from an index is transmitted across the wire, the sender must suitably encode the information to enable a receiving device to parse and properly interpret this data. The bits and bytes for each index appearing in the message are called an object. That is, objects in the message are the encoded representation of the data from a point, or other structure, and the object format depends upon which group and variation number are chosen. Reading Data The master’s user layer formulates its request for data from the outstation by telling the application layer what function to perform, such as reading, and by specifying the data types it wants from the outstation. The request can specify how many objects it wants or it can specify specific objects or a range of objects from index number X through index number Y. The application layer then passes the request down through the transport layer to the link layer that, in turn, sends the message to the outstation. The link layer at the outstation checks the frames for errors and passes them up to the transport layer where the complete message is assembled in the outstation’s application layer. The application layer then tells its user layer which groups and variations were requested. Responses work similarly, in that, the outstation’s user layer fetches the desired data and presents it to the application layer that, in turn, uses the group and variation numbers to format user layer data into objects. Data is then passed downward, across the communication channel and upward to the master’s application layer. Here the data objects are then presented to the master’s user layer. Other Functions Reading data was briefly described in the above two paragraphs, but DNP3 software is designed to handle other functions. For one, the master can set the time in the outstation. The master can transmit freeze accumulator requests, and it can transmit requests for control operations and setting of analog output values using select-before-operate or direct-operate sequences. Unsolicited Responses One area that has not been covered yet is transmission of unsolicited messages. This is a mode of operating where the outstation spontaneously transmits a response without having received a specific request for the data. Not all outstations have this capability. This mode is useful when the system has many outstations and the master requires notification as soon as possible after a change occurs. Rather than waiting for a master station polling cycle to get around to it, the outstation simply transmits the change. Before configuring a system for unsolicited messages, a few basics need to be considered. First, spontaneous transmissions should generally occur infrequently, otherwise, too much contention can occur, and controlling media access via master station polling would be better. The second basic issue is that the outstation should have some way of knowing whether it can transmit without stepping on another outstation’s message. DNP3 leaves specification of algorithms to the system implementer. Implementation Levels One last area of discussion involves implementation levels. The DNP3 organization recognizes that supporting every feature of DNP3 is not necessary for every device. Some devices are limited in memory and speed and do not need specific features, while other devices must have the more advanced features to accomplish their task. DNP3 organizes complexity into three levels. At the lowest level, level 1, only very basic functions must be provided and all others are optional. Level 2 handles more functions, groups and variations, and level 3 is even more sophisticated. Within each level only certain combinations of request formats and response formats are required. This was done to limit software code in masters and outstations while still assuring interoperability. Summary It should be apparent by now that DNP3 is a protocol that fits well into the data acquisition world. It transports data as generic values, it has a rich set of functions, and it was designed to work in a wide area communications network. The standardized approach of groups and variations, and link, transport and application layers, plus public availability makes DNP3 a protocol to be regarded. DNP3 Primer, Revision A, 20 March 2005 Page 7 Copyright, DNP Users Group, 2000, 2005 Author: Ken Curtis from Woodland Engineering wrote this paper to help the many people who are just getting into or considering DNP3 for their operation. Ken is a consulting engineer. Valuable editing assistance was provided by Mike Thesing of Advanced Control Systems. Ken can be reached at [email protected]. DNP Users Group: Mail Address: DNP Users Group PO Box 43075, DVPO Calgary, AB T2J 7A7 Canada 403-271-1319 [email protected] www.dnp.org Fax: Email: Website: DNP3 Primer, Revision A, 20 March 2005 Page 8 Copyright, DNP Users Group, 2000, 2005 DOCUMENT REVISION HISTORY Name of Document: DNP V3.00 Data Link Layer Protocol Description Network File Name: P009-0PD.DL Original Author: Malcolm Smith/Jim McFadyen Date and Version of Preliminary Release: September 1991 Version 0.00 Associated Software Release(s): DNP V3.00 Revisions Since Preliminary Release Date Version By Whom: N. Male Pages Affected: All Reason for Changes: Renamed and relocated from O:\DOCUMENT\OTHER\DOC0361.wp to N:\APPL\P009 0FS.DL Reformatted to WINC standards. Corrected errors Minor corrections Reversed MSB and LSB in Figure 2-15 and accompanying text, as per J. McFadyen. Changed to meet IEC conventions Re-added time-sync functionality to Data Link and fixed a problem with data frame duplication. Added time-sync accuracy to TIME OF DAY messages Adopted fully-balanced transmission procedures in order to become more IEC compliant. Removed timesynchronization functions. Removed Transport Functions section. Reformatted to WI standards. Added marketing comments Removed IEC conformance section from Chapter 2 and created new Chapter 2. Renamed old chapter 2 to Chapter 3. Changed 'polling' to 'polled' in last paragraph Channel failover section changed 'was intended to communicate' to 'communicates' Sept. 30/91 0.00A Nov. 11/91 Nov. 18/91 Jul. 24/92 Aug. 17/92 Oct. 22/92 Oct. 27/92 Nov. 8/92 0.00B 0.00C 0.00D 0.01A 0.01B 0.01C 0.01D J.McFadyen J. McFadyen MCH MS MS MS MS 2-11 All All Nov. 24/92 Jan. 22/93 July. 20/93 0.02 0.02 0.02 LA MS MS All vi,1-1,2-2 i,ii 1-1 2-1 Date Version By Whom: Pages Affected: 2-2 Reason for Changes: Paragraph 1 removed 'Chapter 2' of line 2 to clarify sentence. Removed paragraph 2 as it is confusing. Paragraph 3, changed 'spontaneous' to 'unsolicited' and removed 'sub-master station' references to make it easier to follow. Paragraph, changed wording to suggest 'compatible' schemes. Paragraph 3, explained better. USER DATA section explained that there are 16 octets per block except the last block (previously it was unclear) FCB, removed 'properly' from last paragraph as it is meaningless. FCV changed 'frame count bit valid bit' to 'frame count valid bit' Simplified greatly Simplified greatly Defined CRC algorithm Corrected error in diagram Corrected spelling error Removed misplaced graphic from page and corrected error Removed 'or will not' from line 4 as it is misleading Removed all references to "configurable" parameters as this is implementation specific. End of 3-2, removed last sentence as it is implementation specific. Added 'DNP Data Link to Physical Layer Implementation Issues document' as a section of the Physical Layer section in order to explain some of the physical layer issues and usage of the physical layer in the DNP data link layer. Removed some unneeded and incorrect definitions Checked for Grammar, Spelling, Structure and Formatting Revisions as per C. Heune. Converted to MSWord 6.0. 2-3 2-5 2-7 2-9,2-10 2-11,2-12 2-14 2-15 2-20 2-21 2-23 3-1,3-2 4-4 G-1,G-2 Aug.30/93 0.02 J.Bhat AV S. Tessari All All All Sept. 01/93 0.02 May 30/97 0.02 DNP Users Group DNP PRODUCT DOCUMENTATION DNP V3.00 DATA LINK LAYER Document Version: 0.02 Internal File: P009-0PD.DL Associated Software Release: DNP V3.00 NOTICE OF RIGHTS - DNP USERS GROUP The contents of this manual are the property of the DNP Users Group. Revisions or additions to the definition and functionality of the Distributed Network Protocol cannot be made without express written agreement from the DNP Users Group or its duly authorized party. In addition, no part of this document may be altered or revised or added to in any form or by any means, except as permitted by written agreement with the DNP Users Group or a Party duly authorized by the DNP Users Group. As a Party, duly authorized by the DNP Users Group, Harris Corporation has made every reasonable attempt to ensure the completeness and accuracy of this document, however, the information contained in this manual is subject to change without notice, and does not represent a commitment on the part of Harris Corporation or the DNP Users Group. An update program for DNP documents is provided upon request by Harris Corporation on behalf of the DNP Users Group. TRADEMARK NOTICES Brand and product names mentioned in this document are trademarks or registered trademarks of their respective companies. TABLE OF CONTENTS ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION WHO SHOULD USE THIS SPECIFICATION HELP AND ADDITIONAL DOCUMENTATION HOW THIS SPECIFICATION IS ORGANIZED CONVENTIONS USED IN THIS SPECIFICATION 1. OVERVIEW 2. IEC CONFORMANCE 2.1 CHANNEL FAILOVER 2.2 FRAME FORMAT AND PROCEDURES 2.3 LENGTH, CONTROL AND ADDRESS FIELDS 3. DNP DATA LINK DESCRIPTION 3.1 PURPOSE OF THE DATA LINK LAYER 3.2 FT3 FRAME FORMAT 3.3 DATA LINK HEADER FRAME FIELDS 3.4 USER DATA 3.5 CRC FIELDS 3.6 DATA LINK FUNCTION CODES 3.7 TRANSMISSION PROCEDURES 4. DATA LINK SERVICES AND RESPONSIBILITIES 4.1 DATA LINK FUNCTIONS 4.2 INTERFACE DESCRIPTION 5. PHYSICAL LAYER INTERFACE 5.1 PHYSICAL LAYER DESCRIPTION 6. PHYSICAL LAYER CHARACTERISTICS 6.1 LINE CONFIGURATIONS 6.2 MODES OF TRANSMISSION 6.3 LOCAL LOOP DNP V3.00 Data Link Layer (Version 0.02) v v v v vi vi 1-1 2-1 2-1 2-1 2-2 3-1 3-1 3-1 3-2 3-6 3-6 3-7 3-10 4-1 4-1 4-2 5-1 5-1 6-1 6-1 6-1 6-2 i 7. PHYSICAL LAYER PROCEDURES 7.1 GENERAL CONSIDERATIONS 7.2 HALF-DUPLEX PROCEDURES 7.3 FULL-DUPLEX PROCEDURES LIST OF ABBREVIATIONS AND ACRONYMS 7-1 7-1 7-1 7-2 ii DNP Users Group 02) iii .00 Data Link Layer (Version 0.TABLE OF FIGURES FIGURE 3-1 FT3 FRAME FORMAT 3-2 FIGURE 3-2 CONTROL OCTET BIT DEFINITIONS 3-3 FIGURE 3-3 TABLE OF PRIMARY AND SECONDARY FUNCTION CODES 3-5 FIGURE 3-4 DESTINATION ADDRESS FORMAT 3-5 FIGURE 3-5 SOURCE ADDRESS FORMAT 3-5 FIGURE 3-6 CRC ORDERING 3-7 FIGURE 3-7 RESET OF SECONDARY LINK 3-10 FIGURE 3-8 RESET OF USER PROCESS 3-11 FIGURE 3-9 SEND FROM STATION A/CONFIRM FROM STATION B 3-11 FIGURE 3-10 SEND FROM STATION B/CONFIRM FROM STATION A 3-11 FIGURE 3-11 SEND MULTIPLE FRAMES FROM STATION A/CONFIRM FROM STATION B 3-12 FIGURE 3-12 FRAME COUNT BIT OPERATION 3-12 FIGURE 3-13 FRAME COUNT BIT OPERATION 3-13 FIGURE 3-14 SEND-NO-REPLY EXPECTED FROM STATION A 3-13 FIGURE 3-15 SEND FROM STATION B/NACK FROM STATION A 3-14 FIGURE 3-16 REQUEST/RESPOND FRAME AND DFC BIT USAGE 3-15 DNP V3. iv DNP Users Group . 02) v . 57 for data transmission in telecontrol systems • DNP V3.APP) • DNP V3. IEC 3-layer EPA and IEC TC-57 standards is helpful. DNP V3. This includes programmers implementing and designing DNP data link layer software/hardware and quality assurance personnel testing and verifying implementations of the DNP data link layer.00 Data Object Library (P009-0BL) • DNP V3. • IEC 870-5-1 and IEC 870-5-2 standards (or drafts). transmission procedures and Link Protocol Data Unit. Familiarity with the ISO-OSI 7layer model.00 Data Link Layer (Version 0.TF). Application programmers may find this specification useful in determining how to interface with and make use of the DNP data link layer.ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION This document specifies the Distributed Network Protocol (DNP) Data Link layer services.00 Transport Functions (P009-0PD. Technical Committee No. WHO SHOULD USE THIS SPECIFICATION This specification is intended for communication engineers and programmers interested in knowing the function and message format of the DNP data link layer. HELP AND ADDITIONAL DOCUMENTATION The following documentation may be helpful.00 Application Layer (P009-0PD. DATA LINK SERVICES AND RESPONSIBILITIES Describes the services that the data link provides to higher layers. 2. vi DNP Users Group . PHYSICAL LAYER INTERFACE Describes the service interface provided by the physical layer to the data link. can also be described using the word INDication.HOW THIS SPECIFICATION IS ORGANIZED 1. For example. 6. PHYSICAL LAYER PROCEDURES Describes how the DNP data link uses the physical layer. PHYSICAL LAYER CHARACTERISTICS Describes the physical layer used with the DNP data link. function codes and procedures. the octet is a term used to refer to an eight bit data object and is synonymous with the term byte. LIST OF ABBREVIATIONS AND ACRONYMS CONVENTIONS USED IN THIS SPECIFICATION In this document. IEC CONFORMANCE Details the differences between DNP and the IEC TC-57 standards. 3. The low order bit of an octet is referred to as bit 0 and the high order bit as bit 7. DNP DATA LINK DESCRIPTION Describes the DNP data link frame format. OVERVIEW A general overview of the data link layer. 5. 4. data link indications commonly referred to as IND. Irregular capitalization is used in referencing technical terms which have an associated verb or noun. 7. however. DNP V3. master stations. Link Protocol Data Unit (LPDU). IEDs or submaster stations not designated as master stations. submaster stations. outstations and IEDs are both originators (primary stations) and receivers (secondary stations).1.TF). The DNP V3. outstations and intelligent electronic devices (IEDs) can use this data link to pass messages between primary (originating) stations and secondary (receiving) stations. However. Master stations. Technical Committee No.02) 1-1 .00 Data Link layer. the DNP Version 3 Data Link is intended to be used with a pseudo-transport layer which implements as a minimum message assembly and disassembly.00 Transport Functions (P009-0PD.00 Data Link layer. that these transport functions are not a part of the data link but are needed to support advanced RTU functions.00 Data Link Layer (Version 0.00 Data Link layer supports polled and quiescent telecontrol systems and is designed to operate with connection and connection-less orientated. data link and application layers only. In this protocol. DNP V3. The ISO OSI based model supported by this protocol specifies physical. to support advanced RTU functions and messages larger than the maximum frame length as defined by the IEC document 870-5-1. OVERVIEW This document defines the Distributed Network Protocol (DNP) V3. RS-485 and fibre transceivers. 57 for data transmission in telecontrol systems were used as a basis for developing the DNP V3. This is termed the Enhanced Performance Architecture (EPA). This pseudo-transport layer is described in the document. as well as data link layer services and transmission procedures. asynchronous or synchronous bit-serial physical layers such as RS-232C. It is stressed. The IEC 870-5-1 and IEC 870-5-2 standards set out by the International Electrotechnical Commission (IEC). submaster stations. Fully-balanced transmission procedures were adopted to support spontaneous transmissions from outstations. . 2 FRAME FORMAT AND PROCEDURES The data link layer uses a standard variable length frame format as defined in the IEC 870-5-1 Transmission Frame Formats document. In the OSI model. R3 and R4 are followed. the layer above the data link is responsible for providing channel failover based on communications failure at the Data Link. it is the responsibility of each device to implement a compatible collision avoidance scheme. 2. In a half-duplex environment. That is. Fully-balanced means that each station can act as a primary station (sending) and a secondary station (receiving) at the same time. The basic frame format is used and transmission rules R1. Thus. although the exact time values suggested are not used but are configurable in each implementation. R2.1 CHANNEL FAILOVER The DNP link layer communicates with only one physical layer (or channel). The FT3 frame format class is well suited for data transmission between stations that require medium information transfer rates and low residual error probability. In both half-duplex and full-duplex configurations. This configuration requires a full-duplex channel to operate properly. an entire data link layer transaction between the master station and outstation will have to be completed at both stations before any further transactions can be started from either station. Fully-balanced transmission procedures as specified by IEC 870-5-2 were adopted to handle unsolicited transmissions from stations not designated as masters in a half-duplex or full-duplex system. In DNP.02) 2-1 .2. 870-5-1. Rules R5 and R6 are followed in principle. the same procedures will be used except that a station cannot be both a primary and secondary station at the same time. IEC CONFORMANCE This chapter describes the difference between the DNP protocol and the IEC TC-57 (8705) telecontrol data link layer protocol specification. The frame definitions outlined in IEC 870-5-2 are followed with the note that the Address field is 2 octets in length and specifies the destination station address and the Link User Data field is used as a 2 octet source station address. the Session layer is responsible for maintaining channel connections. DNP V3. This layer could be a Network/Transport Layer or the Application Layer. 2. item 13. for channel failover is met at the Application Layer.00 Data Link Layer (Version 0. the IEC requirement. 2. (Refer to Section 3 for more information on these fields). The first field is the A (Address) field where it is used to represent the destination station address and the second is in the Link User Data field where it is used to represent the source station address.1.2.2 Table III are supported.2. The CONTROL field used is the IEC CONTROL field used for balanced transmission as defined in IEC 870-5-2 clause 6. All the function codes specified in IEC 870-5-3 clause 6. (Refer to Section 3 for more information on this field).1. 2-2 DNP Users Group . The ADDRESS field is a 16-bit (2 octet) field.4. The DNP data link frame header has two IEC ADDRESS fields.3 LENGTH. CONTROL AND ADDRESS FIELDS The DNP data link uses the same LENGTH field as defined in IEC 870-5-1 clause 6. 1 octet control. the data link (given the station destination address) will connect to the right physical circuit without control supplied from higher layers. An FT3 frame is defined as a fixed length header block followed by optional data blocks. DNP DATA LINK DESCRIPTION The Data Link Layer is the second layer in the Open System Interconnection (OSI) model. In this way.e. The DNP Version 3 implementation of the IEC data link handles both connection-less and connection oriented systems (that is. In this implementation the fixed length user data field is defined as a source address.00. This means that user data supplied by higher layers (LSDU) must be converted into one frame (or LPDU as described in Section 2) and sent to the physical layer for transmission. physical networks that require dialing or logging in before data can be transmitted to the destination device) but has no need to provide connection services.2 FT3 FRAME FORMAT This section describes the LPDU format. 1 octet length. Conversely. 3. Secondly. Each block has a 16-bit CRC appended to it. However. The IEC specifies that the header fields consist of 2 start octets. individual LPDUs received by the data link layer must be assembled into one LSDU and passed to higher layers. The actual physical network is transparent to the application using the data link because the data link layer is responsible for connecting and disconnecting from any physical network without higher level interaction (i.1 PURPOSE OF THE DATA LINK LAYER The main purpose of the DNP data link layer is twofold. performs and controls transmission service functions required by the higher layers. the data link layer must provide transfer of information or Link Service Data Unit (LSDU) across the physical link as described by the ISO-OSI standard. 3. The OSI reference model enforces either a connection-less or a connection oriented system. First. application layer). The data link layer accepts. the data link provides indications of other events such as link status. the EPA model implies neither a connection-less system nor a connection oriented system.02) 3-1 .3.00 Data Link Layer (Version 0. a destination address and an optional fixed length user data field. The layer provides for frame synchronization and link control. DNP V3. the physical medium is totally transparent to the link layer service user. in DNP V3. That is. 2 octet source address. The minimum value for LENGTH is 5 indicating only the header is present and the maximum value is 255.•<•••••••••••••••••••••••••••• Block 0 ••••••••••••••••••••••••>•<. The CRC fields are not included in the count. Each block following the header has 16 octets of User defined data except the last block of a frame which contains 1 to 16 octets of User defined data as needed. Frame control octet. 2 octet destination address.Block 1 ->• ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • START • START • LENGTH • CONTROL • DESTINATION • SOURCE • CRC • USER • CRC • . The first octet is the LSB and the second octet is the MSB.3. 3.3 DATA LINK HEADER FRAME FIELDS This section describes block 0 (or header) of a data link frame. 1 octet count of USER DATA in the header and body. The first octet is the LSB and the second octet is the MSB. DESTINATION and SOURCE field sizes are included in this count. 3-2 DNP Users Group .. DESTINATION and SOURCE fields in the header. The CONTROL. Station B is not a master station. 2 octet Cyclic Redundancy Check. Figure 3-1 FT3 Frame Format 3.1 Start The Start field is 2 octets in length. The primary station is the originator of the message. Figure 3-2 defines the fields of the control octet.2 Length The length field is 1 octet in length and specifies the count of user octets in the frame.3. Station A is defined as the designated master station.3 Control The control field contains the direction of the frame.Block n ->| ------------| USER | CRC | | DATA | | ------------------------->| START LENGTH CONTROL DESTINATION SOURCE CRC USER DATA 2 starting octets of the header (0x0564)..3. 3. The secondary station is the destination station. This count includes the CONTROL. The first octet is a 05 hexadecimal and the second octet is a 64 hexadecimal. The minimum value for this field is 5 and the maximum value is 255. 3. • 0x05 • 0x64 • • • • • • DATA • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• •<••••••••••••••••••• Fixed Length Header •••••••••••••••••••••>•<•••••••••••• Body 10 octets |<. the source of the message. type of frame and flow control information. ••••••••••••••••••••••••••••••••••••••••••••••••• • • 1 • FCB • FCV • • • • • Primary to Secondary • DIR • PRM ••••••••••••• FUNCTION CODE • • • 0 • RES • DFC • • • • • Secondary to Primary ••••••••••••••••••••••••••••••••••••••••••••••••• Bit 7 6 5 4 3 2 1 0 DIR Physical transmission direction 1 = station A to station B 0 = station B to station A PRM Primary Message 1 = frame from primary (initiating station) 0 = frame from secondary (responding station) FCB FCV Frame count bit Frame count bit valid 1 = Frame count bit is valid 0 = ignore frame count bit Data flow control bit Reserved = 0 Defines the frame type. DIR = 1 indicates a frame from A to B DIR = 0 indicates a frame from B to A PRM The primary message bit indicates the direction of the frame in relation to the initiating station.00 Data Link Layer (Version 0. FCB The frame count bit is used for suppressing losses and duplication of frames to the same secondary station. Initially before communications with a secondary station or after communication failure. PRM =1 indicates a frame from the initiating station PRM =0 indicates a frame from the responding station. the primary station (in both the master station and outstation) must reset the data link for each secondary station data link it wishes to communicate with. This bit toggles for each successful SEND-CONFIRM service that is initiated by the same primary station and directed to the same secondary station. 3-3 DNP V3. This can be done once at data link start-up for all secondary stations or as needed. Station A is the master. how the data link will handle the frame DFC RES FUNCTION CODE Figure 3-2 Control Octet Bit Definitions DIR The direction bit indicates the physical direction of the frame with relation to the designated master station.02) . • • 8 • • Not Used • .• • 13 • • Not Used • .• • 7 • • Not Used • . after data link start-up or transaction failure. At this point the primary station can continue with the sending of user data. DFC FUNCTION CODE Function Code Field Values of the Control Octet Sent from the Primary Station (PRM = 1) ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Function • Frame Type • Service Function • FCV • • Code • • • Bit • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • 0 • SEND .• • 9 • REQUEST . The primary station must interrogate the secondary station using REQUESTRESPOND Request Link Status until the DFC is returned with a value of 0.• • 14 • • Not Used • . Figure 316 illustrates the DFC bit usage.• • 11 • • Not Used • .• • • • • • • • • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• 3-4 DNP Users Group . FCV The frame count valid bit enables the functioning of the FCB bit.CONFIRM expected • Reset of user process • 0 • • 2 • SEND . FCV =0 indicates the state of the FCB bit is ignored FCV =1 indicates to a secondary station that the state of the FCB bit must be checked against the state of the FCB bit of the last frame sent with the FCV bit set. The secondary station returns this bit set to a 1 if further SEND of user data to this secondary station will cause data link buffers to over flow. The following tables define the implemented codes and associated FCV states.Each secondary station.CONFIRM expected • User Data • 1 • • 4 • SEND . The data flow control bit is used to prevent the overflowing of buffers in a secondary station. must not accept any primary SEND-CONFIRM messages with FCV set until a RESET command has been received and a CONFIRM message sent.• • 15 • • Not Used • .CONFIRM expected • RESET of remote link • 0 • • 1 • SEND .CONFIRM expected • TEST function for link • 1 • • 3 • SEND .• • 6 • • Not used • .RESPOND expected • REQUEST LINK STATUS • 0 • • 10 • • Not Used • .• • 12 • • Not Used • .NO REPLY expected • Unconfirmed User Data • 0 • • 5 • • Not Used • . The definition of the values placed in this field are different between primary and secondary stations. The function code identifies the type of frame. Note that this field is not included as USER DATA but must be passed as a return value to the higher layers by the data link service primitives.02) 3-5 . The address 0xffff is defined as an all stations address.positive acknowledgement • • 1 • CONFIRM • NACK . All stations will accept frames with the destination address set to this value.5 Source Address The source address field is 2 octets in size and specifies the address of the station that the frame originated from.3.Function Code Field Values of the Control Octet Sent from the Secondary Station (PRM = 0) ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Function • Frame Type • Service Function • • Code • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • 0 • CONFIRM • ACK . The first octet of the address is the low order octet and the second octet is the high order.00 Data Link Layer (Version 0.4 Destination Address The Destination address field is 2 octets in size and specifies the address of the station that the frame is directed to.3. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • LOW ORDER OCTET (LSB) • HIGH ORDER OCTET (MSB) • • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 3-5 Source Address Format DNP V3.Message not accepted. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • LOW ORDER OCTET (LSB) • HIGH ORDER OCTET (MSB) • • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 3-4 Destination Address Format 3. Link busy • • 2 • • Not Used • • 3 • • Not Used • • 4 • • Not Used • • 5 • • Not Used • • 6 • • Not Used • • 7 • • Not Used • • 8 • • Not Used • • 9 • • Not Used • • 10 • • Not Used • • 11 • RESPOND • Status of Link (DFC = 0 or DFC = 1) • • 12 • • Not Used • • 13 • • Not Used • • 14 • • Link service not functioning • • 15 • • Link service not used or implemented • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 3-3 Table of Primary and Secondary Function Codes 3. The first octet of the address is the low order octet and the second octet is the high order. 4 USER DATA The blocks following the header may contain from 1 to 16 octets of user data. If more than 16 user data octets follow the header (block 0). The CRC algorithm requires that when T is divided by P at the receiver the remainder is 0. Together M and F' are appended together so that T' = 216M + F' and T' will be transmitted (additionally we define T = 216M + F). (4)Invert R bit-wise to get R'. The last block will contain the leftover. The transmission and reception procedure is described below: To transmit a block: (1)Take the user data block M with k data bits. (3)Divide this number (module-2) by P (17-bits) to get R (16-bits). In the following discussion. If we assume that T=216M + R then. each block must contain 16 octets of data except for the last block. This can be proven to provide a remainder of 0 as follows. (2)Multiply M by 216 to obtain 216M. The 2 octet CRC check is generated from the following polynomial and then inverted before being placed in the block for transmission: X16 + X13 + X12 + X11 + X10 + X8 + X6 + X5 + X2 + 1 The CRC algorithm used will now be described. 1) (Q is the quotient). CONTROL. If we substitute equation 1 then T/P = Q + (R + R)/P = Q since R added to itself modulo-2 results in zero. The START.3. The data link service primitives provide a place to put the source address. the remainder (R) of 216M/P is used as F in the block so that 216M/P = Q + R/P (Equation. A 16-bit CRC check word (F) is bit-wise inverted (F') and appended to M. 3-6 DNP Users Group . 128 for all user data blocks but the last block where k is 8 to 128). DESTINATION and SOURCE fields are all included when calculating the CRC for the header. T/P = (216M + R)/P. In addition. modulo-2 arithmetic (addition and division) is assumed. Each data block has a CRC appended to it. A message block (M) of k-bits is to be transmitted (along with other blocks) (k is 64 for the header. LENGTH. The data link layer passes all of the user data and the source address from the header to the higher layers when a SEND user data frame is received. The CRC check sequence is a pattern (P) of 17 bits as defined above in polynomial form. 3. If the remainder is not 0 then the block is in error.5 CRC FIELDS A two octet cyclic redundancy check is appended to each block in a frame. (5)Append R' to 216M and transmit as a block (T'). 00 Data Link Layer (Version 0.1 Reset This function code is used to synchronize a primary and secondary station for further SEND-CONFIRM transactions. The diagram below shows the ordering of the 16-bit CRC check word with respect to any blocks (user data or header).6.1. the secondary station will begin accepting Primary messages from that Primary station with the FCV bit set. The RESET command also synchronizes the FCB bit between primary and secondary stations. retries + 1) Send RESET frame with FCV=0. The primary station must send this function code when it wishes to first communicate with the secondary station or after a communications failure has been recognized by the primary station. Using the FT3 frame format class and CRC. This is because a successful transaction only guarantees that the primary station transmitter and the secondary station receiver are communicating.1 Primary Transaction Do number of configurable tries: (i.To receive a block: (1)Receive a block (T') (k+16 bits). When a secondary station has re-started or when a communications failure has been recognized by the secondary. The RESET command only enables communications in one direction. The primary station after completing the RESET transaction will set the FCB bit to 1 in the next message (with FCV valid) to that secondary station. •••••••••••••••••••••••••••••••••••••••••••••••••••••• • • LSB • MSB • •••••••••••••••••••••••••••••••••••••••••••••••••••••• • Block Octets • CRC • • • • Figure 3-6 CRC Ordering 3. from the primary to the secondary station. DIR=x Wait the pre-determined time-out period for an ACK frame from the secondary station.6 DATA LINK FUNCTION CODES 3.6. 3. (3)Divide T (module-2) by P (17-bits) to get the remainder. In this state. the secondary station will be considered un-reset. Upon reception and reply to a RESET command. FCB=x. PRM=1. (4)If the remainder is not 0 then there is an error in the block else the block is good. DNP V3.e.02) 3-7 . (2)Invert R'(16-bits) in T'(k+16 bits) to get T (k+16 bits). The secondary station after completing the RESET transaction will expect the FCB bit in the next message (with FCV valid) to be 1 from that primary station. the secondary station will not accept messages from the primary station until it has received and replied to a RESET command from that primary station. the frame has a Hamming distance of 6. if a RESET command with FCV=0.e. then the current transaction (if any) can be aborted (possibly with negative INDication sent to data link user). DIR=x. The data link user can use this indication to reset its internal state.6. 3.1. set FCB status to 1 (i.6. PRM=0.6. DIR=x). Upon reception by a secondary station. FCB=x. 3.6.4 User Data 3-8 DNP Users Group . A positive INDication can be returned to the data link user. Upon reception by a secondary station.2 Secondary Transaction After start-up or after transaction failure do: Wait for reception of RESET command with FCV=0. the secondary station should be considered off-line and a negative INDication should be sent to the data link user. If frame is not received then go to top of loop and re-try End do loop If ACK was received then the transaction is considered successful and the secondary station can be considered on-line. A positive INDication can be sent to the data link user. an ACK confirm frame is sent in reply otherwise a NACK confirm frame is sent in reply. PRM=1. respond with an ACK confirm frame (DFC=x. If the FCBs do not match.3 Test The TEST command is used to test the state of the secondary data link. PRM=0.If ACK frame is received. DIR=x). Respond with an ACK confirm frame (DFC=x. it checks the value of the FCB bit in the primary message and compares it against the FCB status (expected FCB) for that primary station. an INDication should be sent to the data link user. Otherwise. The secondary station also sets the DFC bit accordingly in the response. If accepted by the data link user. next frame sent to secondary with FCV valid should have FCB=1) and exit loop. The FCB status (expected value of FCB in next received frame with FCV valid) should be set to 1. 3. FCB=x. then the secondary station should send the last secondary confirm frame. 3. an ACK confirm frame should be sent in reply and the expected FCB status should be toggled.2 Reset of User Process This function code is used to reset the data link user process. During normal operation. A positive INDication can be sent to the data link user. The FCB status (expected value of FCB in next received frame with FCV valid) should be set to 1. PRM=1 and DIR=x is received. In such case. Otherwise. 5.6.6. PRM=1. next frame sent to secondary with FCV valid should have opposite FCB) and exit loop. toggle FCB status (i.e.5 Unconfirmed User Data This function is used to send user data to the secondary station without needing confirmation. retries + 1) Send User Data frame with FCV=1.1 Primary Transaction DNP V3. A positive INDication can be returned to the data link user. DIR=x and FCB set to FCB status (expected FCB state) do the following: If the data link user is ready to accept user data then respond with an ACK confirm frame (DFC=x. The frame sent contains the user data from the primary data link user that is to be passed to the data link user of the secondary station.2 Secondary Transaction Upon reception of a User Data frame with FCV=1. the secondary station must have been RESET according to the rules above (see RESET). If frame is NACK then wait a pre-determined amount of time until secondary link is NOT busy or use REQUEST LINK STATUS (below) and go to top of loop to retry. 3. If ACK was received then the transaction is considered successful and the secondary station can be considered on-line. The transmission procedures are described below: 3. If correct ACK frame is received. The frame sent contains the user data from the primary data link user that is to be passed to the data link user of the secondary station. Wait the pre-determined time-out period for a ACK or NACK frame from the secondary station. Before communications can begin. 3. DIR=x and FCB set to FCB status for the secondary station (next expected FCB status). DIR=x) else respond with a NACK frame (same bit settings as ACK) and exit this loop.02) 3-9 .4. If correct frame is not received then go to top of loop and re-try.e.6.1 Primary Transaction Do number of configurable tries: (i. Otherwise.4. a negative INDication should be sent to the data link user and the secondary station can be considered off-line or on-line depending on the data link user's interpretation of the failure.The User Data function is used to send confirmed data to a secondary station.6. the bandwidth of the system can be more fully utilized if the user data is low priority. In this way. PRM=1.00 Data Link Layer (Version 0. The transmission procedures are described below: 3. PRM=0. 6 Request Link Status This command is used to request the status of the secondary data link. 3. 3. The secondary station receives the message and responds with an ACK confirm frame. a primary station sends a SEND-CONFIRM RESET frame to a secondary station.7.6. Reset (REQ) ••••••••••• • • • SEND • • FCB=0 • ••••••••••••••••••••••> ••••••••••••••• Expected FCB=x • CONFIRM • <•••••••••••••••••••••••••••• (IND) Reset Expected FCB=1 (IND) Positive Next FCB=1 Figure 3-7 Reset of Secondary Link 3. A secondary station will respond to this request with a LINK STATUS confirm frame with the DFC bit set to 1 if the data link is busy or the data link user cannot accept any more user data and 0 indicating that the data link is not busy and the data link user can accept more user data.Send Unconfirmed User Data frame with PRM=1.2 Reset of User Process In Figure 3-8. FCB=x. DIR=x.7.1 Reset of Secondary Link In Figure 3-7.6. 3-10 DNP Users Group . FCV=0. 3. Announce positive INDication to data link user. The secondary station receives the message and responds with an ACK confirm frame. 3.2 Secondary Transaction Receive Unconfirmed User Data frame as above and send positive INDications with the data to the data link user. The transmission procedures are similar to TEST except that the primary station will typically only use this command when a NACK frame is received during a User Data transaction.7 TRANSMISSION PROCEDURES This section illustrates the usage of the defined frame types. a primary station sends a SEND-CONFIRM Reset User Process frame to a secondary station.5. The secondary expects FCB to be 0 since this is the second frame received after the link was reset. •••••••••••• • • • SEND •(REQ) Expected FCB=0 • FCB=0 • •••••••••••••••<•••••••••••••••••••••••• • CONFIRM • • • ••••••••••••••••••••••••••> (IND) Positive (IND) User Data Figure 3-10 SEND From Station B/CONFIRM From Station A DNP V3.7. A CONFIRM frame is sent in response. STATION A (REQ) STATION B Expected FCB=1 ••••••••••••• • • • SEND • • FCB=1 • ••••••••••••••••••••••••> ••••••••••••••• • CONFIRM • • • <•••••••••••••••••••••••••••• (IND) Positive (IND) Data Figure 3-9 SEND From Station A/CONFIRM From Station B In Figure 3-10.Reset User (REQ) (IND) Positive ••••••••••• • • • SEND • • • ••••••••••••••••••••••> ••••••••••••••• • CONFIRM • <•••••••••••••••••••••••••••• (IND) Reset User Figure 3-8 Reset of User Process 3. a non-master station acting as a primary station sends a SEND-CONFIRM frame to a designated master station acting as a secondary station. This is the first frame with FCV valid after the secondary link was reset (above) so FCB = 1 in the SEND frame. The secondary station expects FCB to be 1 since this is the first frame (with FCV valid) after the link was reset (above) and sends a CONFIRM frame.02) 3-11 . Since this is the second frame after the secondary link has been reset the FCB = 0 in the SEND frame. the designated master station acting as a primary station sends a SENDCONFIRM frame to a non-master station acting as a secondary station. The non-master station upon receiving the CONFIRM INDicates success to the non-master station data link user.3 Send/Confirm User Data In Figure 3-9.00 Data Link Layer (Version 0. The master station upon receiving the CONFIRM assumes the message was correctly received and INDicates success to the master station data link user. This example illustrates what happens when the CONFIRM from the secondary station is lost. a designated master station sends 3 consecutive frames to the same nonmaster station. unexpected FCB but another confirm is sent Figure 3-12 Frame Count Bit Operation In Figure 3-13.In Figure 3-11. 3-12 DNP Users Group . the designated master acting as primary sends a one frame message to the secondary non-master. (REQ 1) ••••••••••• • SEND • • FCB=1 • ••••••••••••••••••••••> ••••••••••••• • CONFIRM • • • (IND) Positive <••••••••••••••••••••••••• (REQ 2) ••••••••••• • SEND • • FCB=0 • ••••••••••••••••••••••••> ••••••••••••• • CONFIRM • • • (IND) Positive <••••••••••••••••••••••••• (REQ 3) ••••••••••• • SEND • • FCB=1 • ••••••••••••••••••••••••> ••••••••••••• • CONFIRM • • • (IND) Positive <••••••••••••••••••••••••• Expected FCB=1 (IND) User Data Expected FCB=0 (IND) User Data Expected FCB=1 (IND) User Data Figure 3-11 SEND Multiple Frames From Station A/CONFIRM From Station B In Figure 3-12. This example illustrates what happens when the SEND frame from the primary station is lost. the designated master acting as primary sends a two frame message to the secondary non-master. ••••••••••• • • • SEND • • FCB=1 • t DAB ••• ••••••••••••••••••••••> ••••••••••••• • t DBA • CONFIRM • • • • • garbled ••••••••••••••••••••••••••• • or not received retry delay > t DAB + t DBA + t CONFIRM duration • ••• ••••••••••• • • (same data)• SEND • • FCB=1 • ••••••••••••••••••••••> ••••••••••••• • • • CONFIRM • • • <••••••••••••••••••••••••• (IND) Positive (REQ) Expected FCB=1 (IND) User Data + t SEND message processing time at station B Expected FCB = 0 send data is ignored. a non-master primary station sends a frame to the master secondary.00 Data Link Layer (Version 0.••••••••••• • • • SEND • Expected FCB = 0 • FCB=0 • ••••••••••••••••••••••> ••••••••••••• • CONFIRM • tBA • • (IND) Positive•••••••••••<••••••••••••••••••••••••• (IND) User Data • SEND • • FCB=1 • tAB •••••••••••••> (lost or garbled) (REQ) retry delay > tBA + tAB + CONFIRM time + CONFIRM processing time at Station B ••••••••••• • SEND • • FCB=1 • Expected FCB=1 ••••••••••••••••••••••> ••••••••••••• • CONFIRM • • • (IND) Positive ••••••••• <••••••••••••••••••••••••• (IND) User Data Figure 3-13 Frame Count Bit Operation NOTE: Both a master station and non-master station acting as primary stations can re-try SEND frames.7. (REQ) ••••••••••••• • SEND • • NO REPLY • • • ••••••••••••••••••••••••> (IND) Positive with user data ••• • delay before next frame = t SEND message processing at station B • ••• ••••••••••••• (REQ 2) • SEND • • NO REPLY • • • ••••••••••••••••••••••••> (IND) Positive with user data ••• • delay • ••• ••••••••••••• (REQ 3) • SEND • • NO REPLY • • • ••••••••••••••••••••••••> (IND) Positive with user data Figure 3-14 SEND-NO-REPLY Expected From Station A 3. upon reception of a valid frame INDicates data availability to the data link user.4 Send/No Reply Expected In Figure 3-14. Upon reception of the first CONFIRM.02) 3-13 . 3. the primary station INDicates success to the data link user. The secondary station.5 Send/NACK In Figure 3-15. the master or non-master primary station sends 3 frames to the secondary master or non-master. the primary INDicates success to the data link user. The DNP V3. Upon successfully transmitting the SEND frame.7. the CONFIRM message contains the DFC bit set. 3-14 DNP Users Group . The secondary will RESPOND to the REQUEST frame with the current state of the DFC. If the secondary is ready to receive more data.6 Request/Respond In Figure 3-16. upon reception of the CONFIRM. The secondary master decides that it cannot accept any frames at this time and sends a NACK frame back. ••••••••••• • SEND • • FCB=1 • •••••••••••••<••••••••••••••••••••••• • CONFIRM • • • (IND) Positive ••••••••••••••••••••••••> ••••••••••• • SEND • • FCB=0 • ••••••••••••••••••••••••••••••••••••• • NACK • ••••••••••••••••••••••••> (IND) Negative Expected FCB=1 (REQ 1) (IND) Positive (REQ 2) (IND) Negative Figure 3-15 SEND From Station B/NACK From Station A 3.primary sends a second frame to the secondary. after receiving this NACK. the transmission of SEND frames will continue. stop SENDing data frames to the secondary station but will instead periodically REQUEST the status of the secondary by sending a REQUEST-RESPOND frame.7. the DFC returned will be 0 otherwise the DFC returned will be 1. The primary. When the primary station recognizes DFC = 0 in the RESPOND frame. will fail the transaction and send a negative INDication to the data link user. The primary station will. a primary station SENDs consecutive frames to a secondary station. When the secondary station cannot receive any more frames. ••••••••••••• • • • SEND • • FCB=0 • ••••••••••••••••••••••••> ••••••••••••• • CONFIRM • • DFC=0 • •••••••••••••<••••••••••••••••••••••••• • SEND • • • • FCB=1 • ••••••••••••••••••••••••> ••••••••••••• • CONFIRM • • DFC=1 • •••••••••••••<••••••••••••••••••••••••• • REQUEST • • RESPOND • • • ••••••••••••••••••••••••> ••••••••••••• • CONFIRM • • DFC=1 • •••••••••••••<••••••••••••••••••••••••• • REQUEST • • RESPOND • • • ••••••••••••••••••••••••> ••••••••••••• • CONFIRM • • DFC=0 • ••••••••••••••••••••••••••••••••••••••• • SEND • • • • FCB=0 • ••••••••••••••••••••••••> ••••••••••••• • CONFIRM • • DFC=0 • <••••••••••••••••••••••••• (IND) User Data (IND) User Data but buffers full now (IND) (IND) User Data Figure 3-16 REQUEST/RESPOND Frame and DFC Bit Usage DNP V3.(REQ 1) (IND) Positive Receipt of CONFIRM frame with DFC = 0 is the condition for transmission of the next SEND user data frame. (IND) Positive (REQ 3) Receipt of CONFIRM frame with DFC = 0 is the condition for transmission of the next SEND user data frame.02) 3-15 .00 Data Link Layer (Version 0. . 00 Data Link Layer (Version 0.1 DATA LINK FUNCTIONS This section describes the services offered by the data link and its functions. Priority delivery can be EXPEDITED or NORMAL to indicate a high or low priority request. The data link is responsible for performing the following functions: • Performing message retries • Synchronizing and handling of the FCB bit in the control word • Setting and clearing the DFC bit based on buffer availability • Automatically establishing a connection based on the destination parameter in a dial up environment when a directed service is requested by the user • Disconnection in a dial-up environment • Packing user data into the defined frame format and transmitting the data to the physical layer • Unpacking the frames that are received from the physical layer into user data • Controlling all aspects of the physical layer • Performing collision avoidance/detection procedures to ensure the reliable transfer of data across the physical link • Responding to all valid frames (function codes) received from the physical layer. The data link is responsible for providing the following services: • Exchange of SDUs between peer DNP data links • Error notification to data link user • Sequencing of SDUs • Prioritized SDU delivery • Quality SDU delivery. SDUs will only be exchanged between peer DNP data links. The communication requirements of the network layer and the pseudo-transport layer are satisfied by the data link layer service primitives.02) . DATA LINK SERVICES AND RESPONSIBILITIES 4.4. 4-1 DNP V3. 2 INTERFACE DESCRIPTION The data link service primitives are illustrated in pseudo code to illustrate the requirements and behavior in a real implementation and are not intended as an exact interface definition. Error notification will be given to the data link user when a response to a request has not been received. TIME_SERVICE. confirm = request_data_link_service( SERVICE. 4. send_count. time_of_transmission ) Input: SERVICE Service to perform TIME_SERVICE Guaranteed time service to perform source Source address to use in sent message destination Destination address to use in sent message send_data_buffer Data to send in message send_count Number of octets in message retry_flag Instructs data link layer to retry unacknowledged frames or not time_of_transmission Time that first bit of first octet of message is to be sent Output: time_of_transmission Time that first bit of first octet of message was sent 4-2 DNP Users Group . retry_flag. send_data_buffer.Quality delivery can be SEND-NO-REPLY or SEND-CONFIRM to indicate whether or not message acknowledgment is required. source. destination. Data link request (REQ) services can be used at any time after the data link has been initialized and configured by the system. 00 Data Link Layer (Version 0. Expedited send a message specified in parameters using SENDNO-REPLY expected frames.02) . current unrequested transaction or waiting for physical layer availability Send a message specified in parameters using SEND-CONFIRM frames. destination_address. forces the data link to send a NACK frame instead of a CONFIRM frame in the next secondary transaction).e. indications = request_data_link_indications( source_address. Send message at time specified in time_of_transmission. Send message at any time with priority specified. (reception of a NACK frame from the secondary station) Service code is not implemented Requested service cannot proceed at this time because the data link is busy either with a previous requested transaction. In a half-duplex system. Fails if the data link is busy Send a message specified in parameters using SEND-NO. this may mean cancelling the current secondary transaction (as above). May necessitate cancelling the current secondary transaction if a half-duplex system is used (i. time_of_reception) Output: source_address destination_address received_data_buffer received_data_count time_of_reception Source address of received message Destination address of received address Received message Number of octets in message Time at which first bit of first octet of message was received 4-3 DNP V3. This service should have the highest priority. Return link status.Confirm = 0 1 2 3 4 Requested service was successful Requested service has failed Requested SEND data service was terminated by the current primary station. Service = 0 1 2 3 4 Time_service 0 1 Data link indications (IND) can be requested at any time by the service user but should be checked as often as possible in order to obtain received data. Return successful if the data link is not busy. received_data_count. This action only takes place if the primary station is using SEND-CONFIRM frames. received_data_buffer.REPLY frames. Fails if the data link is busy Expedited send a message specified in parameters using SENDCONFIRM frames. If the data link is configured as an outstation then the time_of_reception will still be returned but the service user has to be aware of the possibility of inaccurate times received before the outstation has been time-synchronized. Data link has detected a transaction failure. If the data link is configured as a master station then the time that the first bit of the first octet of the message was received has been placed in time_of_reception. 4-4 DNP Users Group . The source address of the received message has been placed in source_address.Indications = 0 1 2 No indications to report Data link has received a valid message that has been placed in received_data_buffer and the number of octets received has been placed in received_data_count. The CCITT V. The Receive service must be able to accept data from the DCE and therefore provide the correct signaling to the DCE in order to receive data and not noise. data_count. confirm = request ( SERVICE. The interface describes the necessary services that ANY physical layer must provide in order to accommodate the DNP V3. 5.02) 5-1 .24 standard describes the DTE (Data Terminal Equipment) which is used for communication with a DCE (Data Communication Equipment) and is usually a frequency-switched modem (FSK). The physical link service primitives are illustrated in pseudo code to illustrate the requirements and behavior in a real implementation and are not intended as an exact interface definition. data_buffer.00 Data Link Layer (Version 0. Disconnect. time_of_transmission) DNP V3. the service must indicate whether or not the medium is busy. The Send service converts data octets into bit-serial data for transmission between the DTE and DCE.5. PHYSICAL LAYER INTERFACE This section describes the DNP Version 3 Data Link to physical layer interface. As a minimum. The physical layer must provide 5 basic services: Send. 1 start bit. The Status service must be able to return the state of the physical medium. Connect. modem_string.1 PHYSICAL LAYER DESCRIPTION The physical layer that is recommended for the data link is a bit-serial oriented asynchronous physical layer supporting 8 bit data. This type of circuit connection to a PSN (Public Switching Network) or to private leased lines can be used. and Status.24 standard DCE definition. The Connect and Disconnect services provide connection and disconnection from the PSN (if applicable). the appropriate modem must be used and must conform (minimally) to the V.00 Data Link. In each case. no parity and RS232C voltage levels and control signals. Receive. 1 stop bit. Physical layer requests can be sent at any time after the physical layer has been started and configured with all relevant parameters. It must provide the proper signal control in order to communicate with the given DCE. DCE has connected to PSN (incoming call). time_of_reception) Output: received_data_buffer Received message received_data_count Number of octets in message time_of_reception Time at which first bit of first octet of message was received Indications = 0 1 2 3 4 No indications to report. current unrequested transaction or waiting for DCE availability Send a message specified in data_buffer of size specified in data_count Initialize DCE using string specified in modem_string Connect to PSN using string specified in modem_string Disconnect from PSN Request physical link status. received_data_count. DCE has disconnected from PSN (hang up). Physical layer has received a message that has been placed in received_data_buffer and the number of octets received has been placed in received_data_count.Input: data_buffer Data to send data_count Number of octets to send modem_string Command string for DCE Output: time_of_transmission Time that first bit of first octet of message was transmitted Confirm = 0 1 2 3 Requested service was successful Requested service has failed Service code is not implemented Requested service cannot proceed at this time because the physical link is busy either with a previous requested transaction. Physical layer has detected problems with the link or DCE that makes communication inadvisable or impossible until some later time. Re-initialization of the DCE may be required. returns 0 if busy and 1 if not busy Service = 0 1 2 3 4 Physical layer indications (IND) can be requested at any time by the service user but should be checked as often as possible in order to obtain received data. 5-2 DNP Users Group . indications = indicate(received_data_buffer. all devices act as slave data links and collision avoidance should be turned on as no one device has a higher priority and all can transmit spontaneously.2 MODES OF TRANSMISSION The physical layer supported by DNP must transmit/receive data in serial mode. These are direct and serial bus topologies. priority has to be assigned amongst the masters. Generally. However.02) 6-1 . synchronous or isochronous allowing for higher throughput with a DNP V3. This node transmits to multiple-nodes and receives from multiple nodes. The direct topology has two physical nodes with each physical node connected directly to the other. This is often the SCADA master. In a multiple-master configuration. In this configuration. PHYSICAL LAYER CHARACTERISTICS 6.6.1 LINE CONFIGURATIONS Regardless of the physical layer used. In peer-to-peer communications.00 Data Link Layer (Version 0. 6. All other nodes in the bus receive from the master node and transmit to the master node. there are two physical topologies used to construct a SCADA communications network. a two node radio or modem network or a dial-up connection through a PSN (Public Switched Network). there is one node which is deemed to be in control of the physical network. The DNP data link supports multiple-master. The transmission can be asynchronous. This is often referred to as a multi-drop configuration and is commonly made up of many Bell 202 modems with their outputs/input tied together. multiple-slave and peer-to-peer communications. the master devices are higher priority than the slave devices. the data unit transferred will be 8 bits in length. The serial bus topology has more than two physical nodes with each node connected to the same channel or communication line as every other node in the serial bus network. This is often referred to as point-to-point and can be a direct physical cable from point-to-point. e. NOT at the modem) can be accomplished using a two-wire or four-wire circuit (i.e. The DNP data link can use half-duplex procedures with a 2-wire circuit and full-duplex or half-duplex procedures with a 4-wire circuit. however will be handled quite differently. The actual mechanism used has no affect on the operation of the data link. The DNP data link can support both full-duplex and half-duplex procedures at the local loop. Both cases. 6-2 DNP Users Group .synchronous modem.3 LOCAL LOOP The termination of the data communications circuit at the communication node (i. TX/RX pair or independent TX and RX pairs). 6. In addition. When this DNP V3. If this circuit is four-wire then full-duplex procedures will be used and there will be no chance of message collisions on the circuit.7. detect the presence of data on the physical communication circuit and use control line signaling for control of the physical circuit. the master station (or highest priority device) needs to be able to take control of the communication circuit and block other stations from transmitting. the indication appears when the master or slave is transmitting on the circuit. the data link must be able to control when the transmission of data takes place. A direct connect to a dialup PSN is typically 2-wire but the circuit from the station to the modem is a 4-wire fullduplex circuit and should be used in a full-duplex fashion. all physical layers should be able to return a data carrier detection indication (DCD) which indicates if there is traffic on the circuit. Regardless of the physical layer used. However. the designated master station messages can collide with any other stations message and the slave station messages can collide with each other at any time. 7. In a four wire circuit. In a direct connection type topology. In a two-wire circuit. if the circuit is two-wire then half-duplex procedures will be used. a collision can occur if both stations attempt to transmit data at the same time. The dial-up modem must use CTS to hold off the transmitter after RTS is asserted.00 Data Link Layer (Version 0. In a multi-drop topology. In this case there is a chance of collision in a two-wire or four wire circuit. there are several ways to avoid or recover from a collision on the communication circuit. In a two-wire system. PHYSICAL LAYER PROCEDURES 7. To accomplish this.02) 7-1 . the master station messages cannot collide with the slave station messages but the slave station messages can collide with each other.2 HALF-DUPLEX PROCEDURES When half duplex procedures are used in a two-wire system. In this case. the designated master station can act as a primary station to many secondary stations. the primary station (initiating station) can only communicate with one station.1 GENERAL CONSIDERATIONS The purpose of the data link to physical layer interface is to allow the data link to send or receive a message to or from another data link. 7. which station is allowed to transmit on the circuit. each station can be configured in the same way and the average time wasted is about (Max . However. Before sending. 7. the indication is checked again and if the circuit is still idle then the transmission can take place. The DNP data link protocol does not assign priority to either the master or slave message but it is generally accepted in SCADA that the master should have control of the communication circuit and therefore should transmit the message (if one is to be sent).2. When the indication disappears. The insertion of the time delay after the loss of data carrier allows the master to take control of the circuit (if needed at that time) and shuts out the other station (because the carrier indication is caused by the masters transmission). a station is transmitting on the circuit. The question now is. if the high priority slave stations have nothing to transmit. could possibly cause a collision so the slave station must wait some time after detecting the loss of a data carrier before attempting to send. no other station should attempt to transmit on the circuit. If the circuit is busy then the station must wait again until the indication disappears and perform the procedure again. if allowed to transmit at this point.3 FULL-DUPLEX PROCEDURES When full-duplex procedures are used in a four-wire direct connection circuit. a collision is still possible if two stations decide to wait for the same amount of time.2 Multi-Point In a multi-drop configuration. One possibility is to configure each slave station to wait a steadily increasing amount of time (no duplicate times and all greater than Master_Min time) hence assigning priorities to the stations. In the point-to-point configuration. the circuit is free for someone to use. During this time. The smaller the Max value the greater the chance of this happening.1 Point-to-Point In a point-to-point configuration this time delay only needs to be as long as the time needed for the master to detect the loss of data carrier and begin the transmission of the message (plus any propagation delays in the system) (Master_min time). In the multi-drop configuration.indication is present. this time delay needs to be different for each slave station. This Max is a function of the number of slave stations in the system. Any slave station. 7. either the master or slave station could transmit.2. In this way. stations which are important in the system can be given higher priority and collisions will rarely happen (only if device timing is bad or the system is poorly configured). However. either the master or any of many slave stations could transmit.Master_Min) / 2. there is no chance of collision because there exists two independent channels for both the reception 7-2 DNP Users Group . Another scheme is to configure each slave station to wait a random time between Master_Min and Max. then there is a lot of time (and hence bandwidth) wasted. In this way. The DNP data link will assert the RTS (Request To Send) line before transmitting each frame and wait for the CTS line to go high before transmitting the data.1 Point-to-Point In a point-to-point. 7. the master station can transmit messages at any time without collision but may not receive the data link confirmation immediately because another station (acting as a primary station) may have taken control of the master's receive circuit before the secondary station or a collision occurred.2 Multi-Point In a full-duplex. full-duplex system both master and slave can transmit at the same time without collision so there is no need for collision detection/avoidance or access mechanisms in this case. It does not necessarily mean that data is being transmitted on the circuit. 7-3 DNP V3.3. multi-drop system. any traffic in the receive or transmit direction can be detected because they are both on the same circuit but in a four-wire system the transmitted and received messages travel on different circuits. The CTS (Clear To Send) line indicates to the data link when it is safe to transmit. The slave station's messages will collide at random because there is no way for the station to know if another station has control of the master's receive circuit. the data link will assume that a connection has been lost and attempt to re-dial if needed.02) . The master still has control of the circuit because there is only one station to talk to.and transmission of messages.3. However. The dial-up circuit is a point-topoint circuit. The data carrier (DCD) indicates that the modem is electrically connected to another modem across the PSN. the meaning of the data carrier signal is quite different than with a direct circuit. 7. 7. One simple solution is to allow slave messages to collide. the master can still send out high priority messages but there may be a collision which will cause a secondary station to time-out.3. If the DCD line goes low. This signal must be an input to the slave stations which indicates a request to take control of the master's receive circuit. When full-duplex procedures are used in a four-wire multi-drop system the problem of collision avoidance increases in complexity. In a two-wire system.3 Dial-Up Modem A dial-up modem uses a four-wire full-duplex circuit that typically requires several control signals (other than DCD) in order to operate. hence no need to block out other stations. In this way. The reason for this lies in the fact that a physical communication circuit that has two independent channels usually can only detect traffic in the receive direction. both the master and slave stations can transmit data at any time when needed. The solution is to make use of a control circuit (RTS in the case of RS-232) to signal the slave stations when another slave station has taken control of the master's receive circuit. The RTS line will then be de-asserted.00 Data Link Layer (Version 0. In this case. 7-4 DNP Users Group . 00 Data Link Layer (Version 0.LIST OF ABBREVIATIONS AND ACRONYMS CRC DFC DIR DNP EPA FCB FCV IEC IED ISO LPDU LSDU octet OSI PRM cyclic redundancy check data flow control direction of physical transmission Distributed Network Protocol enhanced protocol architecture frame control bit frame count valid International Electrotechnical Commission intelligent electronic device International Organization for Standardization link protocol data unit link service data unit 8-bit data object (byte) Open System Interconnection primary DNP V3.02) 1 . Huene Converted to MSWord 6.DOCUMENT REVISION HISTORY Name of Document: DNP V3:00 Transport Functions Network File Name: P009-0PD. 1992 Version 0.00 Revisions Since Preliminary Release Date Nov. 20/93 Sep 01/93 May 30/97 Version 0. 08/92 Aug.00A 0.01 0.0 .01 0.00A Associated Software Release(s): DNP V3. Smith J. Tessari Pages Affected All All All All Reason for Changes Created Revised after review Corrections as per C.01 By Whom M.TF Original Author: Malcolm Smith Date and Version of Preliminary Release: November 8. Bhat AV S. . DNP Users Group DNP PRODUCT DOCUMENTATION DNP V3.00 TRANSPORT FUNCTIONS Document Version: 0.TF Associated Software Release: DNP V3.00 .01 Internal File: P009-0PD. except as permitted by written agreement with the DNP Users Group or a Party duly authorized by the DNP Users Group. .NOTICE OF RIGHTS . An update program for DNP documents is provided upon request by Harris Corporation on behalf of the DNP Users Group. Harris Corporation has made every reasonable attempt to ensure the completeness and accuracy of this document. however. the information contained in this manual is subject to change without notice. duly authorized by the DNP Users Group. and does not represent a commitment on the part of Harris Corporation or the DNP Users Group. Revisions or additions to the definition and functionality of the Distributed Network Protocol cannot be made without express written agreement from the DNP Users Group or its duly authorized party. no part of this document may be altered or revised or added to in any form or by any means. As a Party. TRADEMARK NOTICES Brand and product names mentioned in this document are trademarks or registered trademarks of their respective companies.DNP USERS GROUP The contents of this manual are the property of the DNP Users Group. In addition. 1 TRANSPORT FUNCTIONS 3. TRANSPORT SERVICES AND RESPONSIBILITIES 3.00 Transport Functions (Version 0. OVERVIEW 2.01) i .2 INTERFACE DESCRIPTION LIST OF ABBREVIATIONS AND ACRONYMS iii iii iii iii iv iv 1-1 2-1 2-1 2-2 2-3 2-4 3-1 3-1 3-2 DNP V3.TABLE OF CONTENTS ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION WHO SHOULD USE THIS SPECIFICATION HELP AND ADDITIONAL DOCUMENTATION HOW THIS SPECIFICATION IS ORGANIZED CONVENTIONS USED IN THIS SPECIFICATION 1.3 FRAME ASSEMBLING 2.2 TRANSPORT HEADER FIELD DEFINITIONS 2.4 TRANSMISSION OF MESSAGES 3. TRANSPORT FUNCTIONS 2.1 TRANSPORT HEADER 2. TABLE OF FIGURES FIGURE 2-1 FIGURE 2-2 FIGURE 2-3 FIGURE 2-4 FIGURE 2-5 TRANSPORT LAYER MESSAGE LAYOUT TH BIT DEFINITIONS ASSEMBLING OF DATA FROM THREE DATA FRAMES TRANSMISSION OF A SINGLE FRAME MESSAGE FRAGMENTING OF A MULTI-FRAME APPLICATION MESSAGE 2-2 2-2 2-3 2-4 2-4 ii DNP Users Group . transmission procedures and Transport Protocol Data Unit.DL). DNP V3. WHO SHOULD USE THIS SPECIFICATION This specification is intended for communication engineers and programmers interested in knowing the function and message format of the DNP V3.APP) • DNP V3. 57 for data transmission in telecontrol systems • DNP V3. This includes programmers implementing and designing DNP V3.00 Transport Functions.00 Data Object Library (P009-0BL) • DNP V3.00 Transport Functions. Familiarity with the ISO-OSI 7-layer model.00 Application Layer (P009-0PD. • IEC 870-5-1 and IEC 870-5-2 standards (or drafts).00 Transport Functions (Version 0. Application programmers may find this specification useful in determining how to interface with and make use of the DNP V3.ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION This document specifies the Distributed Network Protocol (DNP) V3.01) iii . IEC 3-layer EPA and IEC TC-57 standards is helpful.00 Data Link Layer (P009-0PD.00 Transport Functions. HELP AND ADDITIONAL DOCUMENTATION The following documentation may be helpful. Technical Committee No.00 Transport Functions.00 Transport Functions software/hardware and quality assurance personnel testing and verifying implementations of the DNP V3. can also be described using the word INDication. The low order bit of an octet is referred to as bit 0 and the high order bit as bit 7. the octet is a term used to refer to an eight bit-data object and is synonymous with the term byte. TRANSPORT SERVICES AND RESPONSIBILITIES Services provided by an interface to the transport functions. LIST OF ABBREVIATIONS AND ACRONYMS CONVENTIONS USED IN THIS SPECIFICATION In this document. 2. data link indications commonly referred to as IND.HOW THIS SPECIFICATION IS ORGANIZED 1. iv DNP Users Group . 3. Irregular capitalization is used in referencing technical terms which have an associated verb or noun. TRANSPORT FUNCTIONS A detailed description of the packet formats and transmission procedures. For example. OVERVIEW A general overview of the transport functions. However. This is termed the Enhanced Protocol Architecture (EPA). DNP V3.01) 1-1 . However. because the IEC data link (DNP V3. submaster stations and outstations are both originators (primary stations) and receivers (secondary stations). This pseudo-transport layer is actually a super-data link transport protocol which is normally found as part of some OSI data links.00 Transport Functions (Version 0.1. submaster stations and outstations or intelligent electronic devices (IEDs) can use these transport functions to pass messages between primary (originating) stations and secondary (receiving) stations. master stations. as well as transport services and transmission procedures. Transport Protocol Data Unit (TPDU). In this protocol. to support advanced RTU functions and messages larger than the maximum frame length as defined by the IEC (International Electrotechnical Committee) document 870-5-1.00 Data Link is intended to be used with this pseudo-transport layer which implements message assembly and disassembly. OVERVIEW This document defines the Distributed Network Protocol (DNP) V3. Master stations.00 Data Link Layer) does not support these functions in the data link. The ISO (International Organization for Standardization) OSI (Open System Interconnection) model supported by this protocol specifies physical. data link and application layers only. the DNP V3.00 Transport Functions. it is necessary to move them out of the data link in order to maintain compliance. . All pseudo-transport layer messages have a TH. last frame and give every frame a six-bit sequence number. The secondary station checks the TH octet on reception of each LSDU for the correct sequence and builds a TSDU message for higher layers. It also works in the reverse fashion. and assemble multiple (more than one) TPDUs into one TSDU. the transport functions break the message into LSDUs. LSDUs are user data fragments which are small enough to fit into the defined FT3 frame format.00 Transport Functions (Version 0. The TH contains information that can identify the first frame.1 TRANSPORT HEADER After the data link receives a complete frame. The pseudo-transport layer function is specific only for those messages that are larger than one Link Protocol Data Unit (LPDU) between primary and secondary stations. This functionality allows the pseudo-transport layer to disassemble one Transport Service Data Unit (TSDU) into multiple (more than one) Transport Protocol Data Units (TPDUs). When a primary station transmits a message to a secondary station. DNP V3. This process works as follows: The pseudo-transport layer takes one TSDU (user data) and breaks it into several sequenced TPDUs (each with Transport Protocol Control Information (TPCI)). Each TPDU is sent to the data link layer as Link Service Data Unit (LSDU) for transmission. These functions add a Transport layer Header (TH) octet at the beginning of the user data fragments that contain the information for the secondary station to reconstruct the complete message. This information is required to reconstruct a message and also to guard against higher layers from receiving misdirected or incomplete messages. or frames. The TH field is stripped out before the frame is combined with other frames belonging to the same message. the data is presented to the transport functions in a format illustrated below.2. This pseudo-transport layer acts as the DNP data link user in a protocol stack consisting of only the DNP Data Link and DNP Application Layer. Figure 2-1 shows the structure of a TPDU. TRANSPORT FUNCTIONS This section describes the Transport layer functions which act as a pseudo-transport layer to the DNP data link layer. The pseudo-transport layer receives multiple TPDUs from the data link layer and assembles them into one TSDU. 2.01) 2-1 . 1 Final frame of a sequence. The TH is added to the head of the fragment and the maximum number of octets to be framed becomes 250 octets. When a secondary station receives a frame with the FIR bit set. Maximum data link data count Data link header data count Transport header Application user data + 255 -5 -1 = 249 octets octets octet octets 2. If a frame is received without the FIR bit set and no message sequence is currently in progress. both the FIR and FIN bits are set. all previously received unterminated frame sequences are discarded. then the frame is ignored. One octet in length. FIR = 1 First frame of a sequence.2 TRANSPORT HEADER FIELD DEFINITIONS ----------------------------------------------| | | | | | | | | | FIN | FIR | | | SEQUENCE | | | | | | | | | | | | ----------------------------------------------7 6 5 4 3 2 1 0 BIT Figure 2-2 TH Bit Definitions FIN The final bit indicates that this frame of user data is the last frame of a sequence which compromises a complete user message.----------------| | | | TH | USER DATA | | | | ----------------- Figure 2-1 Transport Layer Message Layout TH Transport control octet. the message is broken into fragments small enough to fit in a single DNP V3. 0 Not the first frame of a sequence. If a complete user message is only one frame in length.00 Data Link frame. The first frame of a sequence may have any sequence from 0 to 63. FIR 2-2 DNP Users Group . The first bit indicates that the frame is the first in a sequence of frame(s) which comprise a complete message. USER DATA 1 to 249 octets in length. When an application requests the transmission of a long message. The maximum size of a fragment is 249 octets of user data. FIN = 0 More frames follow. 3 FRAME ASSEMBLING Figure 2-3 illustrates the assembling of a three-frame message.-----------> ------------| USER DATA 0 | -------------------------| SOURCE = n | --------------------------| FIR = 0 | | FIN = 0 | | SEQUENCE = 4| | USER DATA 1 | -------------. USER DATA FRAMES TRANSPORT DATA BUFFER -------------| SOURCE = n | --------------------------| FIR = 1 | | FIN = 0 | | SEQUENCE = 3| Note sequence starts with the value in the frame that has the FIR bit = 1 | USER DATA 0 | -------------.-----------> ------------| USER DATA 2 | FIN indicated this is the last frame of message ------------| USER DATA 1 | ------------| USER DATA 0 | complete message passed to application ------------.-----------> Figure 2-3 Assembling of Data From Three Data Frames DNP V3. All user messages start off with a sequence specified in the first frame which has the FIR bit set (each message may start with any sequence number between 0 and 63). It guards against missing or duplicated frames.01) 2-3 .SEQUENCE The sequence number of the frame is used to check that each frame is being received in sequence.-----------> ------------| USER DATA 1 | ------------| USER DATA 0 | -------------------------| SOURCE = n |-----------------------------------> -------------SOURCE ADDRESS passed to application -------------| FIR = 0 | | FIN = 1 | FIN indicates last frame | SEQUENCE = 5| | USER DATA 2 | -------------.00 Transport Functions (Version 0.e. The last frame is identified by having the FIN bit set in the TH field. i. any sequence number is valid when the FIR bit is set. 2. The sequence number does not have to increment across message boundaries. After sequence number 63 the next sequence number will be 0. The first frame of the message identified by having the FIR bit set in the TH field. The sequence number increments for each frame sent to or received from the same address belonging to the same message and resets at the beginning of a new message. 2.-------------CONFIRM --------> -------------| DESTINATION | parameter to data link --------------------------| FIR = 0 | | FIN = 1 | | SEQUENCE = 4 | | USER DATA 2 | send last 100 octets (249 + 249 + 100 = 598) SEND <------.4 TRANSMISSION OF MESSAGES Figure 2-4 illustrates the transmission of a single frame message using the SEND CONFIRM frame service.-------------CONFIRM --------> --------------------> SUCCESS to application layer Figure 2-5 Fragmenting of a Multi-Frame Application Message 2-4 DNP Users Group .-------------CONFIRM -------> --------------------> SUCCESS to application layer Figure 2-4 Transmission of a Single Frame Message -------------DESTINATION | parameter from application --------------------------USER DATA | | 598 octets | -------------- | | | | -------------| DESTINATION | parameter to data link --------------------------| FIR = 1 | | FIN = 0 | 1 TH octet | SEQUENCE = 2 | | USER DATA 0 | send 249 octets (1 to 249 is the valid range for this count) SEND <------. Figure 2-5 illustrates the transmission of a multi-frame message using the SEND . FRAMES SENT FROM DATA LINK CONFIRM FRAMES RECEIVED COMPLETE MESSAGE FROM APPLICATION | --------------DESTINATION | parameter from application ----------------------------USER DATA | | 30 octets | --------------- | | | -------------| DESTINATION | parameter to data link --------------------------| FIR = 1 | | FIN = 1 | 1 TH octet | SEQUENCE = 1 | | USER DATA 0 | send 30 user octets plus 1 TH = 31 octets SEND <----.-------------CONFIRM --------> -------------| DESTINATION | parameter to data link --------------------------| FIR = 0 | | FIN = 0 | | SEQUENCE = 3 | | USER DATA 1 | send 249 octets SEND <------.CONFIRM frame service. Error notification is given to the transport user when a response to a request has not been received.1 TRANSPORT FUNCTIONS This section describes the services offered by the pseudo-transport layer and its function. The pseudo-transport layer is responsible for performing the following functions: • Packing user data into multiple frames (more than one) of the defined DNP V3. The pseudo-transport layer is responsible for providing the following services: • Exchange of SDUs between peer DNP V3. TRANSPORT SERVICES AND RESPONSIBILITIES 3.01) 3-1 . SDUs will only be exchanged between peer DNP V3.00 pseudo-transport layers. Priority delivery can be set to EXPEDITED or NORMAL to indicate a high or low priority request. DNP V3.3.00 Data Link frame format and using the services of the DNP V3. The communication requirements of the network layer and the application layer are satisfied by the pseudo-transport layer service primitives.00 Data Link for transmitting the data • Unpacking multiple frames that are received from the data link into user data • Controlling all aspects of the data link excluding data link configuration. Quality delivery can be set to SEND-NO-REPLY or SEND-CONFIRM to indicate whether or not message acknowledgment is required.00 pseudo-transport layers • Error notification to transport user • Sequencing of SDUs • Prioritized SDU delivery • Quality SDU delivery.00 Transport Functions (Version 0. Source address to use in sent message. source.2 INTERFACE DESCRIPTION The pseudo-transport layer service primitives are illustrated in pseudo code to illustrate the requirements and behavior in a real implementation and are not intended as an exact interface definition. TIME_SERVICE. Input: SERVICE TIME_SERVICE source destination send_data_buffer send_count retry_flag time_of_transmission Output: time_of_transmission Time that first bit of first octet of message was sent confirm = 0 1 2 3 4 Requested service is successful. time_of_transmission) Service to perform. Number of octets in message. Requested SEND data service is terminated by the current primary station. (reception of a NACK frame from the secondary station).3. Time that first bit of first octet of message is to be sent. retry_flag. send_count. Data to send in message. Requested service cannot proceed at this time because the data link is busy either with a previous requested transaction. Instructs data link layer to retry unacknowledged frames or not. Guaranteed time service to perform. Transport request (REQ) services can be used at any time after the transport functions have been initialized and configured by the system. destination. send_data_buffer. Destination address to use in sent message. 3-2 DNP Users Group . Service code is not implemented. current unrequested transaction or waiting for physical layer availability. Requested service has failed. confirm = request_transport_service( SERVICE. Return successful if the data link is not busy.REPLY frames. Fails if the data link is busy. Destination address of received address. Fails if the data link is busy. This service should have the highest priority.(i. Number of octets in message. Send message at any time with priority specified. this may mean canceling the current secondary transaction. Send message at time specified in time_of_transmission. Data link indications (IND) can be requested at any time by the service user but should be checked as often as possible in order to obtain received data. Return link status. Expedited send a message specified in parameters using SENDNO-REPLY expected frames. DNP V3.e. This action only takes place if the primary station is using SEND-CONFIRM frames.01) 3-3 . Send a message specified in parameters using SEND-NO. destination_address. Time at which first bit of first octet of message was received. Expedited send a message specified in parameters using SENDCONFIRM frames.00 Transport Functions (Version 0. indications = request_data_link_indications( source_address. (as above). May necessitate canceling the current secondary transaction if a half-duplex system is used. forces the data link to send a NACK frame instead of a CONFIRM frame in the next secondary transaction). Received message.service = 0 1 2 3 4 time_service =0 1 Send a message specified in parameters using SEND-CONFIRM frames. time_of_reception) Output: source_address destination_address received_data_buffer received_data_count time_of_reception Source address of received message. In a half-duplex system. received_data_buffer. received_data_count. Indications = 0 1 2 No indications to report. The source address of the received message has been placed in source_address. If the data link is configured as an outstation then the time_of_reception will still be returned but the service user has to be aware of the possibility of inaccurate times received before the outstation has been time-synchronized. Data link has received a valid message that has been placed in received_data_buffer and the number of octets received has been placed in received_data_count. 3-4 DNP Users Group . Pseudo-transport layer has detected a transaction failure. If the data link is configured as a master station then the time that the first bit of the first octet of the message was received has been placed in time_of_reception. 01) 1 .00 Transport Functions (Version 0.LIST OF ABBREVIATIONS AND ACRONYMS CRC DNP EPA IEC ISO octet OSI RTU cyclic redundancy check Distributed Network Protocol enhanced protocol architecture International Electrotechnical Commission International Organization for Standardization 8-bit data object (byte) Open System Interconnection remote terminal unit DNP V3. 01A 0. 8/92 0.02D 0.03 MS LA P.8/92 Nov. Changed name of document.03 0. changed terminology to match IEC definitions.02A J. Reformatted. Bhat J. McFadyen J.01/93 0. 30/91 0. Re-edited and reformatted.DOCUMENT REVISION HISTORY Name of Document: DNP V3. McFadyen NFM MCH M.APP Original Author: Malcolm Smith/Jim McFadyen Date and Version of Preliminary Release: August 7. Re-added TIME-SYNC and made some technical corrections. Reformatted to WI standards. McFadyen. Smith Section 3 All 3-11 ALL Oct. Format check.Smith Nov. 30/92 Jul. 13/92 Apr.03 0.01B 0.20/93 Aug. Re-defined Application Control (AC) octet to handle sequencing of fragments and added diagrams to illustrate this. Bhat AV Sections 3. 18/91 Jan. Morton J. McFadyen J.25/92 July 7/93 Jul. McFadyen.00C 0.00 Revisions Since Preliminary Release Date Version By Whom: NFM Pages Affected: All Reason for Changes: Document renamed and relocated from O:\Document\Other\DOC0362. 1991 Version 0. Re-edited and reformatted.00B 0.00A Nov.03 0. Re-design of qualifier.Smith Timesync Section 3 Oct. footers. added support of multi-fragment objects. Bhat J.00 Associated Software Release(s): DNP V3. Reformatted. Removed all references to TIMESYNCHRONIZATION in the Application Layer as this is a Data Link function.00 Application Layer Protocol Description Network File Name: P009-0PD. added chapters.02C M.03 0. 4 All All All All All All .wp to P009-0FS. 27/92 0.01C 0.21/93 Aug. 11/91 Nov.30/93 Sept. 24/92 Sep. glossary.03 0.APP Reformatted to WI standards Corrections Minor corrections Addition of Application Control fields Minor fixes per J. Reversed MSB and LSB in Figure 3-7 as per J. 22/92 0. Removed Section 9.02B M. Sept. clarification of function code usage. Tessari Pages Affected: All Reason for Changes: Converted to MS Word 6.0 .Date May 28/97 Version 0.03 By Whom: S. 03 Internal File: P009-0PD.DNP Users Group DNP PRODUCT DOCUMENTATION DNP V3.00 .APP Associated Software Release: DNP V3.00 APPLICATION LAYER Document Version: 0. An update program for DNP documents is provided upon request by Harris Corporation on behalf of the DNP Users Group. Harris Corporation has made every reasonable attempt to ensure the completeness and accuracy of this document. . and does not represent a commitment on the part of Harris Corporation or the DNP Users Group. the information contained in this manual is subject to change without notice. In addition. As a Party.DNP USERS GROUP The contents of this manual are the property of the DNP Users Group. duly authorized by the DNP Users Group. except as permitted by written agreement with the DNP Users Group or a Party duly authorized by the DNP Users Group. TRADEMARK NOTICES Brand and product names mentioned in this document are trademarks or registered trademarks of their respective companies. no part of this document may be altered or revised or added to in any form or by any means. Revisions or additions to the definition and functionality of the Distributed Network Protocol cannot be made without express written agreement from the DNP Users Group or its duly authorized party. however.NOTICE OF RIGHTS . 9 IMMEDIATE FREEZE .7 DIRECT OPERATE .2 COMMUNICATION FLOW CONTROL 3.1 CONFIRM (FUNCTION CODE 0) 4-1 4.2 READ (FUNCTION CODE 1) 4-2 4.TABLE OF CONTENTS ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION WHO SHOULD USE THIS SPECIFICATION HELP AND ADDITIONAL DOCUMENTATION HOW THIS SPECIFICATION IS ORGANIZED CONVENTIONS USED IN THIS SPECIFICATION 1.3 MASTER REQUEST & UNSOLICITED RESPONSE COLLISIONS 3.6 INTERNAL INDICATIONS 3. DETAILED FUNCTION CODE DESCRIPTIONS 4-1 4.1 APPLICATION REQUEST FORMAT 2.2 APPLICATION RESPONSE FORMAT 3.6 DIRECT OPERATE (FUNCTION CODE 5) 4-19 4.5 FUNCTION CODES 3.10 FREEZE AND CLEAR (FUNCTION CODE 9) 4-20 4.7 OBJECT HEADER ix ix ix ix x x 1-1 1-2 2-1 2-2 2-2 3-1 3-1 3-3 3-8 3-11 3-12 3-14 3-16 4.NO ACKNOWLEDGEMENT (FUNCTION CODE 10)4-21 DNP V3. MESSAGE FORMATS 2.3 WRITE (FUNCTION CODE 2) 4-14 4.NO ACKNOWLEDGEMENT (FUNCTION CODE 8)4-20 4.5 OPERATE (FUNCTION CODE 4) 4-18 4.NO ACKNOWLEDGEMENT (FUNCTION CODE 6) 4-19 4. DEFINITION OF DNP MESSAGE FIELDS 3. OVERVIEW 1.8 IMMEDIATE FREEZE (FUNCTION CODE 7) 4-20 4.03) v .1 APPLICATION HEADERS 3.00 Application Layer (Version 0.1 DESCRIPTION AND IEC RELATIONSHIP 2.4 ERROR RECOVERY 3.4 SELECT (FUNCTION CODE 3) 4-16 4.11 FREEZE AND CLEAR . 18 START APPLICATION (FUNCTION CODE 17) 4-25 4.1 FILE IDENTIFIER OBJECTS PERFORMING WRITE FUNCTIONS 8.2 FILE IDENTIFIER OBJECT PERFORMING READ FUNCTIONS LIST OF ABBREVIATIONS AND ACRONYMS 5-1 6-1 7-1 8-1 8-1 8-5 vi DNP Users Group .21 ENABLE SPONTANEOUS MESSAGES (FUNCTION CODE 20) 4-26 4.4.12 FREEZE WITH TIME (FUNCTION CODE 11) 4-21 4.17 INITIALIZE APPLICATION (FUNCTION CODE 16) 4-24 4. CLASSES 6. TIME SYNCHRONIZATION 7.15 WARM RESTART (FUNCTION CODE 14) 4-23 4.22 DISABLE SPONTANEOUS MESSAGES (FUNCTION CODE 21) 4-27 4. BINARY INPUT WITH TIME EVENTS 8.19 STOP APPLICATION (FUNCTION CODE 18) 4-25 4.23 ASSIGN CLASSES (FUNCTION CODE 22) 4-27 4.20 SAVE CONFIGURATION (FUNCTION CODE 19) 4-26 4.13 FREEZE WITH TIME . FILE TRANSFER 8.16 INITIALIZE DATA (FUNCTION CODE 15) 4-23 4.24 DELAY MEASUREMENT (FUNCTION CODE 23) 4-28 5.14 COLD RESTART (FUNCTION CODE 13) 4-22 4.NO ACKNOWLEDGEMENT (FUNCTION CODE 12)4-22 4. 03) vii . PROCESS_AFTER_CONFIRM MODE 3-11 FIGURE 3-12 OBJECT HEADER 3-16 FIGURE 3-13 OBJECT FIELD 3-17 FIGURE 3-14 QUALIFIER FIELD 3-18 FIGURE 3-15 MESSAGES WITHOUT DATA OBJECTS 3-23 FIGURE 3-16 MESSAGES WITH DATA OBJECTS 3-26 FIGURE 4-1 CONFIRMATION MESSAGE 4-1 FIGURE 4-2 SINGLE OBJECT REQUEST 4-3 FIGURE 4-3 MULTIPLE OBJECTS OR RANGES 4-3 FIGURE 4-4 SINGLE OBJECT RANGE WRITE 4-15 FIGURE 4-5 MULTIPLE OBJECT OR MULTIPLE RANGES 4-15 FIGURE 4-6 MASTER SELECTION OF TWO CONTROL OR ANALOG OUTPUTS 4-17 FIGURE 4-7 OUTSTATION RESPONSE 4-17 FIGURE 4-8 MASTER SELECTION OF A PATTERN OUTPUT 4-17 FIGURE 4-9 OUTSTATION RESPONSE TO THE PATTERN SELECT MESSAGE 4-18 DNP V3. IMMEDIATE_PROCESS MODE 3-10 FIGURE 3-11 SIMULTANEOUS TRANSMISSIONS.TABLE OF FIGURES FIGURE 1-1 CONTEXT OF EPA 1-2 FIGURE 2-1 MESSAGE SEQUENCE 2-1 FIGURE 2-2 APPLICATION REQUEST FORMAT 2-2 FIGURE 2-3 APPLICATION RESPONSE FORMAT 2-3 FIGURE 3-1 REQUEST HEADER 3-1 FIGURE 3-2 RESPONSE HEADER 3-1 FIGURE 3-3 APPLICATION CONTROL FIELD 3-2 FIGURE 3-4 TYPICAL MESSAGE TRANSACTION FLOW 3-4 FIGURE 3-5 MULTI-FRAGMENT RESPONSE & RTU CONFIRMATION TIMEOUT 3-5 FIGURE 3-6 MESSAGE TRANSACTIONS WITH RESPONSE TIMEOUTS 3-6 FIGURE 3-7 MESSAGE FLOW WHEN RESPONSE DELAYED ON A NETWORK 3-7 FIGURE 3-8 RESENDING UNSOLICITED RESPONSES DUE TO NETWORK DELAYS 3-7 FIGURE 3-9 SIMULTANEOUS TRANSMISSIONS.00 Application Layer (Version 0. IMMEDIATE_PROCESS MODE 3-9 FIGURE 3-10 SIMULTANEOUS TRANSMISSIONS. FIGURE 4-10 MASTER SELECTION OF TWO OUTPUTS OR SETPOINTS 4-18 FIGURE 4-11 OUTSTATION RESPONSE 4-18 FIGURE 4-12 MASTER SELECTION OF TWO OUTPUTS OR SETPOINTS 4-19 FIGURE 4-13 OUTSTATION RESPONSE 4-19 FIGURE 4-14 MASTER SELECTION OF TWO OUTPUTS OR SETPOINTS 4-19 FIGURE 4-15 MASTER IMMEDIATE FREEZE CONTROL MESSAGE 4-20 FIGURE 4-16 OUTSTATION RESPONSE TO IMMEDIATE FREEZE 4-20 FIGURE 4-17 MASTER IMMEDIATE FREEZE NO-ACK CONTROL MESSAGE 4-20 FIGURE 4-18 MASTER FREEZE AND CLEAR CONTROL MESSAGE 4-21 FIGURE 4-19 OUTSTATION RESPONSE TO FREEZE AND CLEAR REQUEST 4-21 FIGURE 4-20 MASTER FREEZE AND CLEAR NO-ACK CONTROL MESSAGE 4-21 FIGURE 4-21 MASTER FREEZE WITH TIME MESSAGE 4-22 FIGURE 4-22 OUTSTATION RESPONSE TO FREEZE WITH TIME 4-22 FIGURE 4-23 MASTER FREEZE WITH TIME NO-ACK MESSAGE 4-22 FIGURE 4-24 MASTER COLD RESTART CONTROL MESSAGE 4-23 FIGURE 4-25 OUTSTATION RESPONSE TO COLD RESTART REQUEST 4-23 FIGURE 4-26 MASTER WARM RESTART CONTROL MESSAGE 4-23 FIGURE 4-27 OUTSTATION RESPONSE TO WARM RESTART REQUEST 4-23 FIGURE 4-28 MASTER INITIALIZE DATA CONTROL MESSAGE 4-24 FIGURE 4-29 OUTSTATION RESPONSE TO INITIALIZE DATA REQUEST 4-24 FIGURE 4-30 MASTER INITIALIZE APPLICATION CONTROL MESSAGE 4-24 FIGURE 4-31 OUTSTATION RESPONSE AFTER INITIALIZING APPLICATION(S) 4-24 FIGURE 4-32 MASTER START APPLICATION CONTROL MESSAGE 4-25 FIGURE 4-33 OUTSTATION RESPONSE AFTER STARTING APPLICATION(S) 4-25 FIGURE 4-34 MASTER STOP APPLICATION CONTROL MESSAGE 4-25 FIGURE 4-35 OUTSTATION RESPONSE AFTER STOPPING APPLICATION(S) 4-26 FIGURE 4-36 MASTER SAVE CONFIGURATION CONTROL MESSAGE 4-26 FIGURE 4-37 OUTSTATION RESPONSE AFTER SAVING CONFIGURATION(S) 4-26 FIGURE 4-38 MASTER REQUEST TO ENABLE SPONTANEOUS MESSAGES 4-27 FIGURE 4-39 OUTSTATION RESPONSE 4-27 FIGURE 4-40 MASTER REQUEST TO DISABLE SPONTANEOUS MESSAGES 4-27 FIGURE 4-41 OUTSTATION RESPONSE TO DISABLE SPONTANEOUS MESSAGE 4-27 FIGURE 4-42 MASTER REQUEST TO ASSIGN CLASSES TO DATA 4-28 FIGURE 4-43 OUTSTATION RESPONSE TO ASSIGN CLASSES 4-28 FIGURE 4-44 MASTER REQUEST TO INITIATE DELAY MEASUREMENT 4-28 FIGURE 4-45 OUTSTATION REPONSE TO DELAY MEASUREMENT REQUEST 4-29 FIGURE 8-1 PASSING A FILE IDENTIFIER OBJECT VIA DATA CONCENTRATORS 8-4 viii DNP Users Group . DNP V3.ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION This document specifies the Distributed Network Protocol (DNP) application layer services and message format. HELP AND ADDITIONAL DOCUMENTATION The following documentation may be helpful.03) ix . WHO SHOULD USE THIS SPECIFICATION This specification is for people who need to know the structure and meaning of the fields that make up the application layer message. This includes programmers implementing and designing an application and Quality Assurance personnel testing and verifying implementations of the application layer.00 Application Layer (Version 0. application data flow control and any specific information pertaining to DNP application layer services.00 Data Object Library (P009-0BL). This document specifies the Application Protocol Data Unit (APDU). • DNP V3. The low order bit of an octet is numbered as bit zero (0) and the high order is bit seven (7). FILE TRANSFER A description of file transfer. 4. x DNP Users Group . LIST OF ABBREVIATIONS AND ACRONYMS CONVENTIONS USED IN THIS SPECIFICATION The term octet used in this document refers to an eight-bit data object and is synonymous with the term byte. 2. 3. OVERVIEW A general overview of the application layer. TIME SYNCHRONIZATION A description of time synchronizing. BINARY INPUT WITH TIME EVENTS A description of binary input with time events. MESSAGE FORMATS A definition of the request and response formats. DEFINITION OF THE DNP MESSAGE FIELDS A detailed explanation of the message field. DETAILED FUNCTION CODE DESCRIPTION A description of the function codes. 7. CLASSES A description of the classes. Data octets illustrated in this document are received and transmitted from left to right. 5. 6.HOW THIS SPECIFICATION IS ORGANIZED 1. 8. OVERVIEW This document defines the Harris Distributed Network Protocol (DNP) application layer APDU format and services. DNP V3. The DNP is suitable for use in highly secure. The User Layer makes use of the Application Layer to send/receive complete SCADA/DA messages to/from a master station or outstation. Figure 1-1 on the following page shows the EPA structure and how it fits into the entire communication system. This is termed the Enhanced Performance Architecture (EPA). the User Layer interfaces to the Application Layer in one place only implying that the user has no need to know of the other elements of the communication system except the Application Layer interface. moderate speed and moderate throughput applications. The protocol is highly flexible and open-ended without any target hardware specific constructs. This document defines the third layer of this EPA or the Application Layer.00: Data Link Layer (P009-0PD. As shown.03) 1-1 .DL). Primary focus has been on the current and future needs of these areas. data link and application layers only. The International Electrotechnical Commission (IEC) specifies a simplified model consisting of the physical. has developed the DNP for application in both SCADA and distributed automation (DA) systems.00 Application Layer (Version 0. The data link layer is defined in: Distributed Network Protocol Version 3.1. Harris Canada Inc. The ISO OSI (International Standards Organization Open System Interconnection) model specifies seven layers. each APDU that is part of the larger multi-APDU is referred to as a fragment and there is a restriction that each fragment contains complete data objects only and that the function code portion of the APCI (Application Protocol Control Information) is identical in each fragment of the same message or multi-APDU. the Application User Data is converted into multiple ASDUs. In DNP. That is. Each ASDU is then prefixed by APCI (Application Protocol Control Information) which is then packaged as an APDU.1 DESCRIPTION AND IEC RELATIONSHIP The DNP Application Layer APDU is based in principle on the IEC 870-5-3 and 870-5-4 draft documents as prepared by TC-57 WG 03. In DNP. the Application Layer PDU (Protocol data Unit) fits the IEC description of an APDU. In reverse.User Layer Application Layer Data Link Layer Physical Layer Communication Medium Figure 1-1 Context of EPA 1. 1-2 DNP Users Group . The user sends Application User Data to the Application Layer where it is converted to ASDU (Application Service Data Unit). there will be no fragmentation of information objects between APDUs and the same operation must be requested of each object in the message. Structurally. the Application Layer receives multiple APDU (one at a time) where it removes the APCI to obtain the ASDU and assembles the ASDUs into Application User Data. This is to ensure that each fragment on its own can be processed and also implies that each ASDU contains only complete data objects. the master station sends an Application Layer Request to the outstation which returns an Application Layer Response. Master Send Request Accept response --------------------> <-------------------<----------------Outstation Accept request and process Optional confirmation Send Response Optional confirmation ---------------------------------> Important change detected Accept response <----------------- Send Unsolicited Response Optional confirmation ---------------------------------> Figure 2-1 Message Sequence As shown above.00 Application Layer (Version 0. In DNP. The outstation can decide to spontaneously transmit data using an Application Layer Unsolicited Response message. waiting for a confirmation). see Section 3. A master station may accept unsolicited responses while the request transaction is in progress. a request/response transaction with a particular outstation must be completed before another requests can be sent to that outstation. The terms APDU and fragment are interchangeable. only designated master stations can send Application Layer request messages and only Outstations can send Application Layer Response messages. Figure 2-1 below shows the sequence of Application Layer messages between one master and one Outstation. it may conditionally accept one request command from the master. (For detailed information. Unsolicited responses can be sent before or after the request/response transaction but not during. each response or request can consist of 1 or more individual fragments.3 Master Request and Unsolicited Response Collisions).03) 2-1 . For an outstation.e. MESSAGE FORMATS This section defines the formats of the application layer messages (APDU). Each fragment however should be digestible (parsable) and therefore executable (because DNP V3. a request/response transaction must be completed before any other requests are accepted or unsolicited responses are sent. In addition.2. For a master. If an outstation is presently in the middle of an unsolicited transaction (i. In this specification the master station is defined as the station sending a request message and the Outstation is the slave device. Remote Terminal Unit (RTU) or Intelligent End Device (IED) to which the requested messages is destined. The request header is present in all application layer request APDUs..2 APPLICATION RESPONSE FORMAT The response from an Outstation to an application layer request APDU or the unsolicited response from an outstation have the format illustrated in Figure 2-3. Each ASDU consists of one or more Data Unit Identifiers (DUI) or object headers and optional associated Information Objects (IO) or data fields. The APCI is often called a response header in an application response message. The request header contains information on how to assemble a multi-fragment message and on the purpose of the message. The response header contains the same information as the request header plus an additional field containing internal indications of the outstation. the ASDU is optional and is used when the message meaning is not conveyed completely in the request header.. The object header can specify 0 or more en that returned by the receiving station or that follow the header in the message.the function code is part of every fragment). This is to ensure that devices can process a request and build and more importantly send a response before the next request is received. • DUI • IO . the ASDU is not present.. 2.. The APDU is made up of an APCI block which contains message control information and an ASDU which contains information to be processed by the receiving station. The response ASDU has 2-2 DNP Users Group .•••••••••••••••••••••••• • Request Header • Object Header • data • • Object Header • data • • • • • • • • ••••••••••••••••••••••••••••••••••••••••••. multi-fragment messages may require multi-fragment responses which may require more message storage than the device has available. IO • DUI • IO • •••••••••••••••••••••••••••••••••••••••••• . It is advised that devices with limited message storage capabilities should only be sent single fragment message requests when the expected response (from all fragments sent) is larger than one fragment. Otherwise. In DNP.. The format is identical in form to the request. Data object(s) of the type specified in the object header.•••••••••••••••••••••••• • APCI • ASDU • Figure 2-2 Application Request Format Request Header Object Header Data The request header identifies the purpose of the message and consists of APCI (Application Protocol Control Information). The APCI is often called a request header in an application request message. The response header is always part of the application response. If the request header implies all the needed information required to carry out the request. This header identifies the data objects that follow.1 APPLICATION REQUEST FORMAT The application request message format (APDU) is illustrated in Figure 2-2... 2.. 00 Application Layer (Version 0..03) 2-3 .. Data object(s) of the type specified in the object header... • DUI • IO . DNP V3. •••••••••••••••••••••••• • APCI • ASDU • Figure 2-3 Application Response Format Response Header Object Header Data The response header identifies the purpose of the message and consists of APCI (Application Protocol Control Information).•••••••••••••••••••••••• • Response Header• Object Header • data • • Object Header • data • • • • • • • • ••••••••••••••••••••••••••••••••••••••••••...the same format of the request message with one notable exception (explained in Section 3). This header identifies the data objects that follow. IO • DUI • IO • •••••••••••••••••••••••••••••••••••••••••• .. 2-4 DNP Users Group . DEFINITION OF DNP MESSAGE FIELDS This section describes the request and response headers (APCIs) which control the sequence and flow of application messages between a master station and an Outstation.3. ••••••••••••••••••••••••••••••••••••••• • Application Control • Function Code • • AC • FC • ••••••••••••••••••••••••••••••••••••••• Figure 3-1 Request Header 3. The headers are used to assemble multi-fragment (multi-APDU) messages into Application User Data. and the ASDU which include DUI or data object headers. Each field is one octet in length and is illustrated below. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Application Control • Function Code • Internal Indications • • AC • FC • IIN • • • • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 3-2 Response Header 3.03) 3-1 .00 Application Layer (Version 0. It provides information needed to construct multi-fragment application messages.2 Response Header The response header has three fields as illustrated below. The object headers are used to identify uniquely the information object(s) that optionally follow the header.1 Request Header The request header or APCI has two fields.1.1. 3.1 APPLICATION HEADERS 3. DNP V3.3 Application Control The application control field has a size of one octet.1. CON If set to one (1) in a received message. NOTE: 3-2 DNP Users Group . For unsolicited responses. this bit indicates the message fragment is the final fragment of a complete application message. The recommended size of the fragment buffer is 2048 bytes in order to maintain compatibility with current DNP devices. with each fragment small enough to fit into the application's message buffer. indicates the sending application is expecting a confirmation from the receiving application of the reception of the fragment. 7 6 5 4 3 2 1 0 bit •••••••••••••••••••••••••••••••••••••••••••••••••• • FIR • FIN • CON • SEQUENCE • • • • • • •••••••••••••••••••••••••••••••••••••••••••••••••• Figure 3-3 Application Control Field FIR FIN If set to one (1). which is sent automatically to the master. Fragment numbers 0 to 15 are reserved for master station requests and all Outstation responses (NOT Unsolicited Responses). Each fragment has an application header and appropriate object headers so that each fragment can be processed as individual messages which can then be discarded making room for the next fragment. usually containing event data. each consecutive fragment from an Outstation must have an increasing sequence number (the number overflows from 31 to 16). An application function code zero (0) is used in the confirmation message. It is recommended that any changed data that is reported from an Outstation be sent with a confirmation requested in the response. this bit indicates the message fragment is the first fragment of a complete application message. If set to one (1). Fragment numbers 16 to 31 are reserved for unsolicited responses from Outstations. NOTE: An Unsolicited Response is a message generated by an Outstation. each consecutive fragment received from or transmitted to the same Outstation must have an increasing sequence number (the number overflows from 15 to 0).Application messages may be packaged into fragments. SEQUENCE Indicates the fragment number. For requests to an Outstation and the Outstation responses (not unsolicited responses). The master does not need to poll the Outstation for this data. These specify how long an application must wait for a response or CONFIRMation response before re-transmitting or aborting the transaction. 5) An Outstation must completely process a request and respond to it before beginning to process a second request. • The first fragment of a multi-fragment response to a single fragment request has the same sequence number as the request. the sequence number of the first fragment of the request retry equals the sequence number of the last fragment of the request which has just failed. Master station and Outstation application response time-outs. It cannot simultaneously process multiple requests. the sequence number is incremented. Sequence Number field.03) 3-3 . timers and parameters controlling message flow are: 1) 2) 3) 4) CON bit field. the sequence number is NOT incremented. DNP V3.3. The following rules dictate how sequence numbers work: • The sequence number rolls over from 15 to 0 or from 31 to 16. FIR and FIN bit fields. This number is used to assemble multi-fragment messages and identify which responses match particular requests. • A single fragment response to a single fragment request has the same sequence number as the request. For successive fragment of the multi-fragment response. The application may or may not support re-transmission of transactions at the application layer. The Sequence Number for all requests from the master station to the Outstation is in the range 0 to 15 inclusive. Applications may or may not support application level retries. The sequence number for all Unsolicited Responses from the Outstation is in the range 16 to 31 inclusive. Retry counters specify how many times a request is repeated if a response fails. A CONFIRMation response is an application acknowledgments of the previous request or response message. Each successive request fragment from the DNP master station has an incremented sequence number. The fields.00 Application Layer (Version 0. • The CONFIRMation response to a request or response has the same sequence number as the request or response. The exception is for retries on requests.2 COMMUNICATION FLOW CONTROL The flow of requests and responses between the master and the Outstation is controlled by fields in the response and request headers as well as application timers and parameters. For multi fragment request retries. Setting/clearing this bit enables/disables message CONFIRMation responses. Master station and Outstation application retry count. • The first fragment of a multi-fragment response to a multi-fragment request has the same sequence number as the last fragment of the multi-fragment request. For single fragment request retries. or how often responses are re-transmitted if a CONFIRMation response is not received. • (SEQ=7) • (SEQ=24) • (CON=0) • • • (SEQ=7) • • M M M -------------------------------------------------------------------Outstation L L • Response • Unsol. • If two messages are received with the same sequence number. retransmit the response (re-processing the message is unnecessary). ignore the second response. • • • Response • CONFIRM • CONFIRM • expected. it usually means that the response to the message was not received by the other station. • • Response • CONFIRM • expected.The use of this sequence number scheme ensures the Outstation and master station can cope with all occurrences of messages being lost or delayed on a communication network. it starts a CONFIRMation response timer. The following figures illustrate some cases of message transactions and how the Sequence Numbers prevent problems. the request will be re-transmitted with the same sequence number. If this timer had expired before the CONFIRMation was received. The master sends a request. SEQ is the Sequence Number and CON is the Confirmation Requested bit in the message. In the examples. When the Outstation transmits the response. Case One illustrates typical message transactions. the Outstation would have re-transmitted the response. • If two CONFIRMation responses are received with the same sequence number. Later on. • to master • Response • (CON=1) • (CON=1) • (SEQ=7) • (SEQ=24) • • CASE 2 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. The following rules are obeyed by both the Outstation and master station: • If the system uses application level retries. Time progresses from left to right in the diagrams. when a response is not received before time-out. • (SEQ=2) • (CON=0) • • (SEQ=2) • M M -------------------------------------------------------------------Outstation L L • CONFIRM • Response • (SEQ=2) • to master • • request • • (CON=1) • • (SEQ=2) Figure 3-4 Typical Message Transaction Flow 3-4 DNP Users Group . the Outstation responds and the master CONFIRMs the response. the Outstation sends an Unsolicited Response to the master station. Case Two shows a similar situation to Case One except the master request requires a CONFIRMation response as well as a normal response. CASE 1 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. The vertical arrows represent the flow of messages between the Outstation and the master station. In this case. The Outstation assumes that the response was successful. Note that the next request from the master station used sequence number equals 4. • • Response Response • CONFIRM • expected. The master repeats the request after a response time-out occurs. When the Outstation resends the response.g. and when its CONFIRMation time-out expires it re-transmits the response. CASE 3 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. Case Six illustrates the case where the master request is not received by the Outstation. RTU • (CON=1) • (SEQ=3) time-out.03) 3-5 . • (SEQ=2) • (SEQ=24) • • (CON=0) • • • • (SEQ=2) • • • M M M M -------------------------------------------------------------------Outstation L L • Response • Response • Frag. Case Five is identical to Case Four. data loss due to communication loss is often not critical. not • (SEQ=3) • (CON=0) received. • • • Request. the master does CONFIRM the first Outstation response. DNP V3. the CON bit is set in the Outstation responses. In this case. Resend • (SEQ=3) • response.NOTE: In Figure 3-4 and some of the following figures. The master will not re-process the second response. the response from the Outstation is not received by the master station. when the response does not contain event data). the master will repeat the CONFIRMation. The sequence number in successive fragments is incremented. • • • Figure 3-5 Multi-Fragment Response & RTU Confirmation Time-out From the Outstation side. This CONFIRMation is not received by the Outstation.00 Application Layer (Version 0. The CON bit may be clear in some transaction (e. Case Three illustrates a multi-fragment response from the Outstation. The Outstation waits for a CONFIRMation. 2 • (CON=1) • (CON=1) • (SEQ=2) • (SEQ=3) • • CASE 4 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. • Response • CONFIRM • CONFIRM • (SEQ=4) • expected. • • (SEQ=3) • M M -------------------------------------------------------------------Outstation L L • Response CONFIRM not • Response • (CON=1) received. In Case Five unlike Case Four. 1 • Frag. In Case Four. • (CON=0) • • (SEQ=5 ) • (SEQ=5) • M M M -------------------------------------------------------------------Outstation L Request not • Response received. • (CON=1) • (SEQ=5) • • Figure 3-6 Message Transactions With Response Time-outs Case Seven is similar to Case Four. The original response that the master did not receive is delayed in the communication network. the Outstation response to the master request is not received. The master re-sends the request. In this case. • (SEQ=5) • (CON=0) Request. Case Seven also illustrates another possible condition. In Case Seven however. The Outstation receives and discards this second CONFIRMation. • (SEQ=10) • (SEQ=10) • (CON=0) • • • (SEQ=10) • • M M M -------------------------------------------------------------------Outstation L L • Response CONFIRM not • Response • (CON=1) received. the first CONFIRMation from the Outstation is delayed in the communication network. • • • CASE 6 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. In Case Four the Outstation timed out waiting for the CONFIRMation and repeated the response. • • • Response • CONFIRM • CONFIRM • expected. Time-out on • Request. the Outstation replies and the master finishes the transaction sequence with a CONFIRMation. The master station assumes that the first CONFIRMation was not received by the Outstation. In both cases. When this CONFIRMation eventually arrives at the master station. Case Eight is similar to Case Seven. • • Response response. 3-6 DNP Users Group . Resend • (SEQ=10) • response. it is ignored. Resend • expected. the master times out first and repeats the request. RTU • (CON=1) • (SEQ=10) time-out. It therefore re-transmits the CONFIRMation. • Response • CONFIRM • expected. The original response from the Outstation then arrives at the master station. The Outstation automatically stops waiting for the CONFIRMation and repeats its previous response.CASE 5 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. CONFIRM and • (CON=0) resends request.00 Application Layer (Version 0. • (CON=1) ignores it. Master receives • No response in network. CONFIRM delayed • Request. Time-out on • Unsol. It does not process it the second time. • (SEQ=30) • (SEQ=30) • • Figure 3-8 Resending Unsolicited Responses Due to Network Delays DNP V3. This illustrates a situation where network delays. • (SEQ=30) delayed unsol. cause time-outs to occur. CONFIRM • Response. Master • expected. • Response • CONFIRM • CONFIRM • expected. • (SEQ=8) • (SEQ=8) • (CON=0) request. • (CON=0) • • • (SEQ=8) • (SEQ=8) • • M M M M -------------------------------------------------------------------Outstation L L • Response • Response RTU ignores • (CON=1) • (CON=1) second • (SEQ=8) • (SEQ=8) CONFIRM • • • • CASE 8 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. • (CON=1) CONFIRM. the Unsolicited Response is re-transmitted by the Outstation when a timeout on the CONFIRMation occurs. • M M -------------------------------------------------------------------Outstation L L • Unsol. • response. CASE 9 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master Unsol. but does respond to it in the same way as the first time. • (SEQ=30) Not received. The master eventually receives it twice. • No response first delayed • expected. • • Resend CONFIRM. response • Master • delayed in • CONFIRM receives the • CONFIRM network. The Outstation discards the second CONFIRMation. • (SEQ=5 ) • (SEQ=12) M M -------------------------------------------------------------------Outstation L L • CONFIRM • CONFIRM • (SEQ=12) • (SEQ=12) • • • • • • Figure 3-7 Message Flow When Response Delayed on a Network In Case Nine. RTU discards • response.CASE 7 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. second • (CON=1) Resend. and not message losses. • • • Response not received. Resend • expected. Response • Request.03) 3-7 . Time-out. Binary input data. The Outstation will generally process a request immediately. This mode of operation is referred to PROCESS_AFTER_CONFIRM mode. counter event data etc.e.3 MASTER REQUEST & UNSOLICITED RESPONSE COLLISIONS When Unsolicited Responses are generated by an Outstation there exists the possibility that the master station sends a request at the same time that the Outstation sends an Unsolicited Response. The Outstation may receive the request when it expects to receive a CONFIRMation of its Unsolicited Response. The master station will always process an Unsolicited Response immediately. In Case Ten. 3-8 DNP Users Group . 3.3.g. It will wait for the CONFIRMation before processing the request. All requests except READ requests for system data (e. The processing of the above and similar situation depends on the type of request issued by the master station.) are processed in this way. This would not confuse the Outstation. ever if it arrives when the master station is expecting a response to a previously issued request. the master immediately responds to the Unsolicited Response. request is not a READ request). even if it is waiting for CONFIRMation of a previous Unsolicited Response. if CON bit is set). The reason for the different functionality is to prevent the loss or duplication of data events. Note that the two CONFIRMation responses could be sent from the master in the opposite order to the order shown in Case Ten. The Outstation immediately processes and responds to the master station request.e.3. Case Eleven illustrates a basic message flow where the Unsolicited Response does not require a CONFIRMation.1 IMMEDIATE_PROCESS Mode Figures 3-9 and 3-10 illustrate the normal functionality when a master station request and an Outstation Unsolicited Response are transmitted simultaneously and the Outstation is in the IMMEDIATE_PROCESS mode (i. The Outstation will NOT process a master station READ request if it is waiting for CONFIRMation of a previous Unsolicited Response. This mode of operation is referred to as IMMEDIATE_PROCESS mode. A CONFIRMation of the Unsolicited Response is issued immediately if requested by the Outstation (i. The master receives the Unsolicited Response when it expects to receive a response to its request. 03) 3-9 . • (SEQ=2) • (CON=1) • • (SEQ=2) • M M -------------------------------------------------------------------Outstation L L L • Unsol. • (SEQ=7) • (SEQ=24) • (CON=0) • • • (SEQ=7) • • M M M -------------------------------------------------------------------Outstation L L • Unsol. • Response • Response • to master • (CON=1) • request • (SEQ=24) • (CON=1) • • (SEQ=7) CASE11 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. Store and • • Response process the • CONFIRM • expected. the Outstation re-transmits the Unsolicited Response. The Outstation responds to the master request. • CONFIRM • Response • response • (SEQ=2) • to master • (CON=0) • • request • (SEQ=22) • • (CON=1) • • • (SEQ=2) Figure 3-9 Simultaneous Transmissions.CASE 10 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. but would reply to it again. Note that it is possible that the first Unsolicited Response later arrives at the master station (it was delayed in the network). The master then CONFIRMs the Unsolicited Response. IMMEDIATE_PROCESS Mode In Case Twelve. unsol.00 Application Layer (Version 0. • • • Response • CONFIRM • CONFIRM • expected. response. then after the CONFIRMation time-out for the Unsolicited Response. DNP V3. The Outstation would discard the reply. the Unsolicited Response is CONFIRMed in between CONFIRMations to two fragments of a multi-fragment response to the master request. Case Thirteen illustrates the situation where the Unsolicited Response is not received by the master station. The master would not re-process the response. • response • (CON=1) CONFIRM to unsol.3. • response • (CON=1) • (SEQ=3) response. This is due to the possibility that the READ request requests data objects which are already in the unCONFIRMed Unsolicited Response. 2 • (CON=1) • (CON=1) • (CON=1) • (SEQ=18) • (SEQ=2) • (SEQ=3) • • • CASE 13 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. the Outstation will not process the READ request until it receives the CONFIRMation to the Unsolicited Response. • Response RTU time-out for • Unsol. 3-10 DNP Users Group .CASE 12 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. The Outstation will not process the READ request until the CONFIRMation is received. unsol. • • • • Figure 3-10 Simultaneous Transmissions. IMMEDIATE_PROCESS Mode 3. there is a risk of data being lost or duplicated. The Outstation must re-transmit the Unsolicited Response until it is CONFIRMed or its configured re-transmission limit is reached. Case Fifteen is similar to Case Fourteen except the Unsolicited Response is not CONFIRMed. • (SEQ=2) • (SEQ=18) • (SEQ=3) • (CON=0) • • • • (SEQ=2) • • • M M M M -------------------------------------------------------------------Outstation L L L • Unsol. If the Outstation was to respond to the READ request immediately. • Response • Response • Response • Frag. • • • • Response • CONFIRM • CONFIRM • CONFIRM • expected. If this limit is ever reached. 1 • Frag.2 PROCESS_AFTER_CONFIRM Mode When a READ request for system data is received by the Outstation and a previous Unsolicited Response has not yet been CONFIRMed. the Outstation will internally re-buffer the data in the Unsolicited Response. • (CON=0) • • response • (SEQ=3) • • (SEQ=28) M M M -------------------------------------------------------------------Outstation L L L • Unsol. Resend • (CON=1) • (SEQ=28) • request. • (SEQ=3) • unsol. response. respond to any outstanding master station requests then try to send the Unsolicited Response again. Master does • • • Response not receive • CONFIRM • CONFIRM to • expected. Case Fourteen illustrates the situation where the READ request is received while the Outstation is waiting for a CONFIRMation. RTU time-out for • Unsol.CASE 14 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. the master application layer should indicate the value of the Internal Indications in all Outstation responses. DNP V3. In particular. The user layer is responsible for initiating any kind of error recovery procedure. • Response • response CONFIRM to unsol. • response • (CON=1) • (CON=1) response. • (SEQ=2) • (CON=0) • response • • (SEQ=2) • (SEQ=18) • M M M -------------------------------------------------------------------Outstation L RTU waits RTU now L • Unsol.00 Application Layer (Version 0. reception and error checking. In addition. response. PROCESS_AFTER_CONFIRM Mode 3. response. request. When and if a transaction failure is reported by the data link layer. • to unsol.4 ERROR RECOVERY The DNP application layer relies on the data link layer for all message transmission. the application layer should fail the application layer transaction and report the error to the user. for confirm processes • Response • Response Do not process master • (CON=1) • (CON=1) request.03) 3-11 . • unsol. unsol. • (SEQ=2) • (SEQ=18) • • • CASE 15 Time ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••→ Master • Request. • (SEQ=3) • (CON=0) • response • • (SEQ=3) • (SEQ=28) • M M M -------------------------------------------------------------------Outstation L L L • Unsol. • • • Response • CONFIRM • CONFIRM • expected. Resend • (CON=1) • (SEQ=3) • (SEQ=28) unsol. The application layer is NOT responsible for recovering from communication problems. Master does • • • Response not receive • CONFIRM to • CONFIRM • expected. the user layer should make use of the IIN or Internal Indications that are returned in any Outstation response. • (SEQ=28) • • • • Figure 3-11 Simultaneous Transmissions. There are two groups of function codes. respond with the status of the operation. one for requests and the other for responses. setpoints. respond with objects requested that are available. DNP Users Group 3-12 . No response to this message is required. Store specified objects in Outstation. respond with the status of the control points selected. Copy the specified objects to a freeze buffer. CODE FUNCTION DESCRIPTION Transfer Function Codes 0 Confirm Message fragment confirmation used in both requests and responses. The Operate function code is required to activate these outputs. do not respond with a message. 8 Immediate Freeze -No Acknowledgment Transfer Function Codes 9 Freeze and Clear Copy the specified objects to a freeze buffer.3. analog outputs) . then clear the objects.No Acknowledgment Freeze Function Codes 7 Immediate Freeze Copy the specified objects to a freeze buffer and respond with status of the operation.5 FUNCTION CODES The function code identifies the purpose of the message. 4 Operate 5 Direct Operate 6 Direct Operate . respond with the status of the control points. Request specified objects from Outstation. The size of this field is one octet. Set or produce the output actions on the points previously selected with the Select function. respond with status of the operation 1 Read 2 Write Control Function Codes 3 Select Select or arm output points but do not set or produce any output action (controls. Select and set or operate the specified outputs but do not send a response to the request. Select and set or operate the specified outputs. respond with the status of the control points. 14 Warm Restart 15 Initialize Data to Defaults Initialize Application Start Application Stop Application 16 17 18 Configuration Function Codes 19 Save Configuration Save the specified configuration to nonvolatile memory. respond with status of the operation. respond with a time object indicating time till Outstation availability. Initialize the specified data to power up initial values. do not respond with a message. respond with a time object indicating time till Outstation availability.CODE 10 FUNCTION Freeze and Clear -No Acknowledgment Freeze with Time DESCRIPTION Copy the specified objects to a freeze buffer. respond with status of the operation. respond with a time object indicating time till Outstation availability. Perform the desired partial reset sequence.00 Application Layer (Version 0. Enable spontaneous reporting of the specified data object(s). Start running the specified application(s). Copy the specified objects to a freeze buffer at the specified time and intervals. 11 12 Freeze with Time -No Acknowledgment Application Control Function Codes 13 Cold Restart Perform the desired reset sequence. Ready the specified application(s) to run. Stop the specified application(s). Copy the specified objects to a freeze buffer at the specified time and intervals. respond with the status of the operation. respond with status of the operation Assigned specified data object(s) to a particular class 20 Enable Unsolicited Messages Disable Unsolicited Messages Assign Class 21 22 Time Synchronization Function Codes 23 Delay Measurement Allows the application to calculate the path delay (or propagation delay) for a particular Outstation. The value calculated from this function code should be used to adjust the time of day when setting the Outstation time. respond with status of the operation. then clear the objects.03) 3-13 . respond with status of the operation Disable spontaneous reporting of the specified data object(s). DNP V3. respond with status of the operation. do not respond with a message. Class 1 data available Set when data that has been configured as Class 1 data is ready to be sent to the master Master station should request this class data from the Outstation when this bit is set in a response Class 2 data available DNP Users Group .120 121 .128 FUNCTION DESCRIPTION Reserved for future use Reserved for testing only Response Function Codes 0 Confirm Message fragment confirmation used in both requests and responses. Response to a request message Unsolicited response that was not prompted by a request. No response to this message is required. 129 130 Response Unsolicited Message Table 3-1 Function Codes 3.6 INTERNAL INDICATIONS The Internal Indications (IIN) field is a two-octet field that follows the function code in all responses. Bit 0 Bit 1 Bit 2 3-14 All stations message received Set when a request is received with the destination address of the all stations address (ffff hexadecimal).CODE Reserved 24 . the IIN is always returned with the appropriate bits set. Cleared after next response (even if response to global request is required) Used to let the master station know that a Broadcasted message was received by this station. When a request cannot be processed due to formatting errors or the requested data is not available. •••••••••••••••••••••••••••••• • First Octet Second Octet • • | • •••••••••••••••••••••••••••••• First Octet ••••••••••••••••••••••••••••••••••••••••••••••••• • 7 • 6 • 5 • 4 • 3 • 2 • 1 • 0 • Bit number • • • • • • • • • ••••••••••••••••••••••••••••••••••••••••••••••••• A one (1) in the bit position indicates the described state. The master synchronizes the time by writing the Time and Date object to the Outstation. This should only be used when the state can not be described by a combination of one or more of the other IIN bits. Bit 5 - Bit 6 - Bit 7: - Second Octet ••••••••••••••••••••••••••••••••••••••••••••••••• • 7 • 6 • 5 • 4 • 3 • 2 • 1 • 0 • Bit number • • • • • • • • • ••••••••••••••••••••••••••••••••••••••••••••••••• Bit 0 Bit 1 - Function code not implemented Requested object(s) unknown. The Outstation does not have the specified objects or there are no objects assigned to the requested class.Bit 3 Bit 4 - Set when data that has been configured as Class 2 data is ready to be sent to the master Master station should request this class data from the Outstation when this bit is set in a response Class 3 data available Set when data that has been configured as Class 3 data is ready to be sent to the master Master station should request this class data from the Outstation when this bit is set in a response Time-synchronization required from the master. The device profile for a given device states the conditions that effect this bit. That is.00 Application Layer (Version 0. the Outstation's control outputs are accessible through the DNP protocol.03) 3-15 . Clear when the Outstation is in the Remote state. Set when some or all of the Outstation's digital output points are in the Local state. DNP V3. Cleared when the time is set by the master. This bit is also cleared when the master explicitly writes a 0 into this bit of the Internal Indication object of the Outstation. the Outstation's control outputs are NOT accessible through the DNP protocol. Device restart Set when the user application at the Outstation restarts. This indication should be used for debugging purposes and usually indicates a mismatch in device profiles or configuration problems. That is. Cleared when the master explicitly Writes a 0 into this bit of the Internal Indications object in the Outstation. Device trouble Set when an abnormal condition exists at the Outstation. Qualifier 3-16 DNP Users Group . Specifies the meaning of the range field as described in section 3.7 OBJECT HEADER The object header of a message specifies the data objects (or IOs) that are either contained in the message or are to be used to respond to this message. The appropriate error recovery procedures should be initiated by the user. The object field uniquely identifies the type or class of object which gives the structure (and hence size) of the data object. •••••••••••••••••••••••••••••• • Object • Qualifier • Range • • • • • •••••••••••••••••••••••••••••• Figure 3-12 Object Header Object Specifies the object group and variation of the objects that follow the header as described in section 3. The format of the object header is identical for a request and a response but the interpretation of the header is dependent on whether it is a request or a response and which function code accompanies the header. COS/SOE buffers have overflowed. making it impossible to communicate this condition to a master station. This indication should be used for debugging purposes and usually indicates configuration problems. OBJECT. The qualifier specifies how the range field is to be interpreted.Bit 2 - Parameters in the qualifier. Note that sometimes a corrupt configuration will disable an Outstation. or other application buffers have overflowed. range or data fields are not valid or out of range. This is a two-octet field. Set to indicate that the current configuration in the Outstation is corrupt and that the master application layer should inform the user of this exception. QUALIFIER. Request understood but requested operation is already executing. The master may download another configuration to the Outstation. For example. This is a one-octet field. currently always returned as zero (0). Reserved for use by agreement. Reserved for use by agreement. Bit 3 - Bit 4 Bit 5 - Bit 6 Bit 7 - 3. This is a catch-all for application request formatting errors. Event buffer(s). The master should attempt to recover as much data as possible and indicate to the user that their may be lost data. currently always returned as zero (0). The specific variation has to be specified. this indicates all object variations belonging to the same group (i. variation 0 cannot be used to specify the objects. The size of this field ranges from zero (0) octets to eight octets. See Section 5: CLASSES for more detail. 16bit analog inputs or 32-bit analog inputs). Objects may be assigned to one of four classes. The object field is two octets in length. the returned object header may indicate a 32 bit count field in the counter objects it returns. The master must however be able to interpret the object headers and have some knowledge of the structure of each variation. By requesting data with the variation set to 0.g.e.03) 3-17 . With the same request message directed to another station. The currently defined object structures are described in DNP-V3. The range field may not be present if the qualifier specifies that there is no range field.1 Object Field The Object field specifies an object group and the variation of the object within the group. Given that the Outstation supports only 16 bit counters. Consider the example where the request message specifies counter objects in the first octet and the variation is 0. When the Object field specifies a data class instead of a specific object type. analog inputs) and the second octet specifies the variation of the data type (e. it is not necessary for the master to know what variations the Outstation supports. In the response direction however. In the request direction.Range Indicates the quantity of objects. if the object variation is specified as 0. The combined object group plus variation specifies uniquely the object to which the message refers. it will respond with an object header with the variation field set to indicate that the counter objects are 16 bit counters. The first octet specifies the general type of data (e. first octet second octet ••••••••••••••••••••••••••••••••••••••••• • • 0 or Object variation• • Object Group •••••••••••••••••••••••• • • Object variation • ••••••••••••••••••••••••••••••••••••••••• Application request direction Application response direction Figure 3-13 Object Field DNP V3. NOTE: 3. all or any analog inputs types).00 Application Layer (Version 0.00 Data Object Library (P009-0BL).7. starting and ending index or identifiers for the objects in question as described in section 3. This field uniquely identifies the objects in question.g. the object field refers indirectly to all the data objects assigned to that class of data and not to any specific object type. 2 Qualifier Field The qualifier field specifies the meaning of the range field. The Range Field consists of indices (to specify a range of objects) or object identifier lists (see qualifier code 11). These bits indicate the size. The Range Field follows the Qualifier Field. 0= 1= 2= 3= 4= 3-18 objects are packed with no index prefixing them objects are prefixed with a 1 octet index objects are prefixed with a 2 octet index objects are prefixed with a 4 octet index objects are prefixed with a 1 octet object size DNP Users Group . The structure and use of the Range Field is dependent on the value in the Index Size field and the Qualifier Code field. Each of the Start Range and Stop Range sub-fields is termed as index. 0= 1= 2= 3= 4= 5= 6= 7= not valid with qualifier code 11 1 octet identifier size 2 octet identifier size 4 octet identifier size reserved reserved reserved reserved • In a Response or Request Object Header that is part of a message containing data objects. Index Size (3-bits) • In a Request Object Header when Qualifier Code equals 11 The Index Size bits are valid only when the qualifier code is 11. in octets. Together they define a range of objects in the data following the Object Header. of each entry in the Range Field. The 3 bit Index Size field specifies the size of the indices or object size prefixing each object. it often consists of a Start Range value and an Stop Range value. When the Range Field is used to index data.7.3. 7 6 5 4 3 2 1 0 bit •••••••••••••••••••••••••••••••••••••••••••••••••• • R • Index Size • 4 bit Qualifier Code • • • • • •••••••••••••••••••••••••••••••••••••••••••••••••• Figure 3-14 Qualifier Field R Reserved bit always set to 0 The Range Field is used to index data or as an identifier. A message with data can also use Index size of 0 to indicate no more indexing. This qualifier can be used in messages with object headers only because it cannot DNP V3.e. For Qualifier Codes specifying Start ad Stop Indices in the Range. the length of the range field is 0 (i. For Qualifier Codes 0. The Qualifier Code can be used both in the request and response messages as it can uniquely identify data objects whether they do or do not exist in the message. • Start and Stop Sub-Fields in the Range Field The Range field following the Qualifier field often contains sub-fields (Start Range and Stop Range) that designate a range of integer values starting numerically from Start Range (including the number Start Range) to Stop Range (including the number Stop Range).00 Application Layer (Version 0. 5 or 6 in a message with data objects to indicate that each data object (with indices specified by the Range Field) has an object size prefix (with this size determines by the Index size). Index Size values of 1. 2 and 3 cannot be used.03) 3-19 . 4 and 5. Some Qualifier Code definitions are: 0= 1= 2= 3= 4= 5= 8 bit start and stop indices in the Range Field 16 bit start and stop indices in the Range Field 32 bit start and stop indices in the Range Field 8 bit absolute address identifiers in the Range 16 bit absolute address identifiers in the Range 32 bit absolute address identifiers in the Range • All objects of the given object type When the Qualifier Field equals 6. no range field) because all the data objects of the specified type are being referred to. 1 and 2. The Index Size field should be 0 in a data-less message to indicate no further indexing. Start Range and Stop Range are interpreted as virtual memory addresses. Start Range and Stop Range are interpreted as indices of data For Qualifier Codes 3. The Index Size field can be 4.5= 6= 7= objects are prefixed with a 2 octet object size objects are prefixed with a 4 octet object size reserved Qualifier Code (4-bits) The Qualifier Code is used to specify the meaning of the Range field. This identifier has a free-format and will not be interpreted in any way by the application layer at this time. The Range Field that follows designates the number of objects referenced. In a message with or without data objects. 8 and 9 can be used in the request and response messages. the Qualifier Code defines a variable length array of octets (string) that contains the object identifier. 2 or 3 then the Range Field specifies the number of indices and objects following the Range Field. Some Qualifier Code definitions are: 7= 8= 9= 8 bit single field quantity 16 bit single field quantity 32 bit single field quantity • Free-format Qualifier (Qualifier Code 11) This Qualifier Code is used to specify objects when other Qualifier Codes are inadequate or do not provide enough identifying information. The Index Size field should be set to the size of the indices that either pre-fix each data object (for messages with data objects) or that form a sequential list of identifiers. If the Index Size is 1. 8 and 9 are used to indicate that the Range Field consists of a single count indicating the number of data objects in question. Qualifier Code 6 = no range field (implies all the specified objects) • Single field quantity Qualifier Codes 7. If the Index Size field equals zero. Qualifier 11 is used only when the Range Field (index) cannot uniquely specify the data objects in question. the Range Field specifies the number of objects referenced starting numerically from 0 (including 0) to the value in the Range Field minus 1. The order of identifiers (and optional data objects) is arbitrary but should not consist of duplicate indices. Qualifier Codes 7. In this case. The Index Size field should not indicate an object size identifier as this would not uniquely specify the data objects in question and should be set to 0 if no identifiers or indices are following. The Index size should be set to 0 when this Qualifier code is used.uniquely identify data objects if they are present in the message. the value in the Range Field specifies the number of data objects to be referred to. 3-20 DNP Users Group . Points are I1 to I2 inclusive reserved reserved reserved reserved reserved LSB MSB LSB MSB ••••••••••••••••••••••••••••••••••••••••• • 16 bit Start • 16 bit Stop • • • • • • • • • • • • I1 • I2 • • • • ••••••••••••••••••••••••••••••••••••••••• Q-code 1 and 4.7. 8. The bytes described appear after the qualifier octet of the object header and before the next object header or end of message.00 Application Layer (Version 0. and 6 should be used to specify the size of the object size field in octets. In the following. The size of the identifier (in octets) is determined by the object size field which prefixes each identifier.The Range Field is always a 1 octet value (Count) which specifies the number of object identifiers.03) 3-21 . 9 and 11. The following figure defines all the valid qualifier/range/index combinations for a request or response which do NOT contain any IO or data objects and simply specifies the objects in question. • Reserved Qualifier Codes The following Qualifier Code values are reserved and should not be used: 10 = 12 = 13 = 14 = 15 = 3.5. Request for known points specified with a Range of indices. The size of the object size field is determined by the Index size. Index sizes 4.3 Range The meaning of the Range Field is specified by the Qualifier Field. I-size MUST be 0 Definition of Range Field. Following the Range Field are Count object size field/object identifier pairs. The values in these fields are inclusive. The range field is a single field specifying a quantity for qualifier codes 7. the term 'Q-code' refers to the 4 bit Qualifier Code field and 'I-size' refers to the Index Size field. The Range field is not present for qualifier code 6. For Qualifier Codes 0 to 5 the Range field has 2 sub-fields specifying a start and stop index or address. I-size MUST be 0 Points are I1 to I2 inclusive DNP V3. Use Q-code 0-5 for describing points related in sequence: ••••••••••••••••••••• • Start • Stop • • 8 bit • 8 bit • • • • • I1 • I2 • ••••••••••••••••••••• Q-code 0 and 3. . I2 .. I-size MUST be 0 Points are I1 to I2 inclusive Use Q-code 6 for describing ALL points of the given data type: (There is no range field or indices with this qualifier Use Q-code 7-9 for describing a number of unrelated points: ••••••••••• •Quantity • • 8 bit • • • • Q • • • ••••••••••• Q-code 7. I-size MUST be 2 • • Points are I1. Q-code 8..I2 .. I-size MUST be 1 Points are I1.. I-size MUST be 0 Points are 0 .LSB MSB LSB MSB ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • 32 bit Start • 32 bit Stop • • • • • • • • • • • • • • • • • • • • I1 • I2 • • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Q-code 2 and 5.... I-size MUST be 2 Points are I1... IQ inclusive LSB MSB ••••••••••••••••••••••••••••••••••••••• •••••••••••••••••••• • 16 bit Quantity • Index • • Index • • • • LSB • • • MSB•. IQ inclusive ••••••••••••••••••••••••••••••••• •Quantity • Index • • 8 bit • • • • I1 • • Q • • • • LSB • • • MSB • ••••••••••••••••••••••••••••••••• LSB MSB ••••••••••••••••••••• • 16 bit Quantity • • Q • • • • ••••••••••••••••••••• .... • • • • Q • I1 • •••••••••••••••••••••••••••• ••••••••• • Index • • LSB • • • • IQ • ••••••••• Q-code 8.... I-size MUST be 3 Points are I1.. I2 .... Q-1 inclusive •••••••••••••••••••• •Quantity • Index • • • Index • • 8 bit • • • • I1 • • Q • • • • LSB • •••••••••••••••••••• •••••••••• • • • • • • ...• LSB • MSB• • • • • • • • • Q • I1 • • IQ • ••••••••••••••••••••••••••••••••• •••••••••••••• Q-code 8. I-size MUST be 0 Points are 0 to Q-1 inclusive LSB MSB •••••••••••••••••••••••••••• • 16 bit Quantity • Index• • | • LSB •...I2 ... I2 . IQ inclusive ..• LSB • • • MSB• • • • • • • • • • • • • • Q • I1 • • IQ • ••••••••••••••••••••••••••••••••••••••• •••••••••••••••••••• Q-code 8.. I-size MUST be 3 Points are I1.... IQ inclusive 3-22 DNP Users Group .. I-size MUST be 1 Points are I1... IQ inclusive •••••••••••••••••••••••••• •Quantity • Index • • 8 bit • • • • I1 • • Q • • • • LSB • MSB • •••••••••••••••••••••••••• ••••••••••••••• • Index • Q-code 7...• IQ • • • • LSB • MSB • ••••••••••••••• •••••••••••••••••••• • Index • • • • IQ • • • • LSB • • • MSB • •••••••••••••••••••• Q-code 7.I2 .. IQ inclusive LSB MSB ••••••••••••••••••••••••••••••••• •••••••••••••• • 16 bit Quantity • Index • • Index • • • • LSB • MSB•.... • IQ • • • • LSB • •••••••••• Q-code 7. Index size MUST be 1 Octets Oi1 . • ON • • Q • Size N • • • • • •••••••••••••••••••••••••••••••••••• •••••• Q-code 11..LSB MSB ••••••••••••••••••••••••••••••••••••••••• • 32 bit Quantity • • • | • • • • IQ • • ••••••••••••••••••••••••••••••••••••••••• Q-code 9. I-size MUST be 2 Octets 1 to N are the object identifier As for the previous case.. there could be many identifiers each one following the other.. I2 . The type of identifier is implied by the object type: •••••••••••••••••••••••••••••• •••••• •••••••••••••• •••••• • 8-bit • 8-bit • • • • • • 8-bit • • • • • • • O11 • O12• . I2 .. IQ Use qualifier 11 when describing points that need to be uniquely identified by an object identifier such as a File Object Identifier or Configuration Header.. • ON • • Q • Size N • • • • • •••••••••••••••••••••••••••••••••••••••••••••••• •••••• Q-code 11. OiN form the object identifier for Object i where 0<=i<Q (quantity) •••••••••••••••••••••••••••••••••••• •••••• • 16-bit • 16-bit • • • • • • LSB | MSB • LSB | MSB • O1 • O2 • .03) 3-23 ..... IQ LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••• • 32 bit Quantity • Index • • Index • • | | | • LSB | MSB •. I2 . I-size MUST be 3 Points are I1..• LSB | | | MSB • • Q • I1 • • IQ • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••• Q-code 9. I-size MUST be 3 Octets 1 to N are the object identifier As for the previous case...• LSB | MSB • • Q • I1 • • IQ • •••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••• Q-code 9.• OQN• • Q •Size N1• • • • • •Size NQ• • • • •••••••••••••••••••••••••••••• •••••• •••••••••••••• •••••• Q-code 11.... IQ-1 LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••••• •••••••••• • 32 bit Quantity • Index • • Index • • | | | • LSB •.• • OQ1•... •••••••••••••••••••••••••••••••••••••••••••••••• •••••• • 32-bit • 32-bit • • • • • • LSB | | | MSB • LSB | | | MSB • O1 • O2 • ..• LSB • • Q • I1 • • IQ • •••••••••••••••••••••••••••••••••••••••••••••••••• •••••••••• Q-code 9. I-size MUST be 1 Points are I1.. I-size MUST be 0 Points are 0 . Figure 3-15 Messages Without Data Objects DNP V3.00 Application Layer (Version 0..... I-size MUST be 2 Points are I1. IQ LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••• • 32 bit Quantity • Index • • Index • • | | | • LSB | | | MSB •.... there could be many identifiers each one following the other.. • O1N•. I2 inclusive ••••••••••••••••••••••••••••••••••••• • Start • Stop • Object •DO-I1 • • 8 bit • 8 bit • Size • with • • • • 8-bit • size •... Use Q-code 0-5 for describing points related in sequence: •••••••••••••••••••••••••••••••••••••••• • Start • Stop • DO • DO • DO • • 8 bit • 8 bit • • • • • • • I1 • I1+1 • I1+2 •.. I2 inclusive Note: 8 and 32-bit object sizes can also be used by using I-size 4 and 6 LSB MSB LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • •••••••••••••••••••••••• • • • • • • • • • 32 bit Start • 32 bit Stop • Object • DO-I1• • Object •DO-I2 • • | | | • | | | • Size • with • • Size • with • • • • 32-bit • size • • 32-bit • size • • I1 • I2 • S1 • S1 •... I2 inclusive Note: 8 and 16-bit object sizes can also be used by using I-size 4 and 5 Important Note !!! Do NOT use Q-code 6 for describing a message which contains data objects as the exact number of points are not known and therefore the contents of the message cannot be determined.....16-bit • size • • I1 • I2 • S1 • S1 •.• S2 • S2 • • • • LSB | | | MSB • • • LSB | | | MSB • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• •••••••••••••••••••••••• Q-code 2 and 5. 3-24 DNP Users Group ... I-size MUST be 0 • | • | • • • • Points/Objects are I1 .. I-size MUST be 0 Points/Objects are I1 .. I-size MUST be 5 Points/Objects are I1 .. The bytes described appear after the qualifier octet of the object header and before the next object header or end of message.• S2 • S2 • • • • LSB | MSB • • • LSB | MSB • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• •••••••••••••••••••• Q-code 1 and 4.. Request/response with known points specified with a Range of indices..The following figure defines all the valid qualifier/range/index combinations for a request or response which contain IO or data objects and specifies that the objects in question either follow the qualifier/range fields (for qualifier without pre-fixing indices) or follow each individual identifying index. • I1 • I2 • • • • •••••••••••••••••••••••••••••••••••••••• •••••••• • DO • • • • I2 • • • •••••••• Q-code 0 and 3.... • I1 • I2 • S1 • S1 • ••••••••••••••••••••••••••••••••••••• •••••••••••••••• • Object •DO-I2• Q-code 0 and 3.. I2 inclusive • 8-bit • size• • S2 • S2 • •••••••••••••••• Note: 16 and 32-bit object sizes can also be used by using I-size 5 and 6 LSB MSB LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• •••••••••••••••••••• • 16 bit Start • 16 bit Stop • Object •DO-I1 • • Object •DO-I2 • • | • | • Size • with • • Size • with • • • • 16-bit • size • •.• I2 • • I1 • I2 • • • • • • • • • • •••••••••••••••••••••••••••••••••••••••••••••••• ••••••• LSB MSB LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••• • 32 bit Start • 32 bit Stop • DO • • DO • • | | | • | | | • • • • • • • I1 •. I-size MUST be 4 • Size • with• Points/Objects are I1 . I-size MUST be 6 Points/Objects are I1 .. I2 inclusive LSB MSB LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••• ••••••• • 16 bit Start • 16 bit Stop • DO • • DO • Q-code 1 and 4. I-size MUST be 0 Points/Objects are I1 ... I2 inclusive • • • I1 •..• I2 • • I1 • I2 • • • • • • • • • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••• Q-code 2 and 5. . IQ DNP V3. IQ inclusive •••••••••••••••••••••••••• ••••••••••••••••• •Quantity • Index • DO • • Index • DO • • 8 bit • • • • • • • • I1 • I1 • ..... I-size MUST be 0 • • Points/Objects are 0 ..00 Application Layer (Version 0.Use Q-code 7-9 for describing a number of unrelated points: ••••••••••••••••• •Quantity • DO • • 8 bit • • • • I0 •. • | • I0 • •••••••••••••••••••••••••• •••••••• • DO • • • •I(Q-1)• •••••••• Q-code 7. I-size MUST be Points/Objects are I1. IQ •••••••••••••••••••••••••••••••••••••• •••••••••••••••••••••••••• •Quantity • Index • DO • • Index • DO • 3 • • • • • • • • 8 bit • • • • • • • • I1 • I1 • ..... • Q • • • • • ••••••••••••••••• ••••••••••• • DO • Q-code 7. I-size MUST be 2 Points/Objects are I1.• IQ • I1 • • • • • • • • • Q • • • • • • • • LSB | | | MSB • • • LSB | | | MSB • • •••••••••••••••••••••••••••••••••••••• •••••••••••••••••••••••••• LSB MSB •••••••••••••••••••••••••• • 16 bit Quantity • DO • • Q • •. I2 .. I-size MUST be Points are I1... I2 . I2 ..I2 .• LSB | MSB• • inclusive • | • • I1 • • • IQ • • Q • I1 • • • IQ • • •••••••••••••••••••••••••••••••••••••• ••••••••••••••••••• Q-code 8.• LSB | | | MSB• • ... IQ inclusive LSB MSB ••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••• • 32 bit Quantity • Index • DO • • Index • DO • 1 • | | | • LSB • •.03) 3-25 ...I2 inclusive •••••• • DO • • • • IQ • •••••• Q-code 9... I2 .. Q-1 inclusive LSB MSB ••••••••••••••••••••••••••••••••••• • 16 bit Quantity • Index • DO • • | • LSB • • • • • I1 • • Q • I1 • • ••••••••••••••••••••••••••••••••••• ••••••••••••••• • Index • DO • • LSB • • • •IQ • • IQ • • ••••••••••••••• Q-code 8. IQ inclusive LSB MSB •••••••••••••••••••••••••••••••••••••• ••••••••••••••••••• • 16 bit Quantity • Index • DO • • Index • DO • • | • LSB | MSB• •. I2 .• IQ • IQ • • Q • • • • • • • • LSB • • • LSB • • •••••••••••••••••••••••••• ••••••••••••••••• •••••••••••••••••••••••••••••••• ••••••••••••••••••••• •Quantity • Index • DO • • Index • DO • • 8 bit • • • • • • inclusive • • I1 • I1 •.. I-size MUST be 1 Points/Objects are I1. • IQ • I1 • •••••••••••••••••••••••••••••••••••••••••••••• Q-code 8.. IQ LSB MSB •••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••••••••• • 16 bit Quantity • Index • DO • • Index • DO • 3 • | • LSB | | | MSB• •.. I-size MUST be 1 Points/Objects are I1.. Q-1 inclusive • I(Q-1) • • • • • ••••••••••• Q-code 7.. IQ • • • I1 • • • IQ • • Q • I1 • • • IQ • • •••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••••••••• LSB MSB •••••••••••••••••••••••••••••••••••••••••••••• • 32 bit Quantity • DO • • | | | • •.. I-size MUST be 0 Points are I1.... I-size MUST be 2 Points/Objects are I1.I2 . I-size MUST be 0 Points/Objects are 0 ..... I-size MUST be Points/Objects are I1.• IQ • IQ • • Q • • • • • • • • LSB | MSB • • • LSB | MSB • • •••••••••••••••••••••••••••••••• ••••••••••••••••••••• Q-code 7.. IQ inclusive Q-code 8.• LSB • • • Q • I1 • I1 • • I2 • I2 • Q-code 9.... .••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••• LSB MSB ••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••• • 32 bit Quantity • Index • DO • • Index • 2 • | | | • LSB | MSB • •.. IQ • Q • I1 • • I2 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••• Q-code 9. there could be many identifiers each one following the other. Figure 3-16 Messages With Data Objects 3-26 DNP Users Group . I-size Points are I1.• OQN• • • Q •Size N1• • • • • ID1 • •Size NQ• • • • IDQ• •••••••••••••••••••••••••••••• •••••••••••• •••••••••••••• ••••••••••• Q-code 11. The size of the object is contained in the Object Identifier so the Application Layer must be able to interpret some fields of the Object Identifier in order to process a message. • ON • • • Q • Size N • • • • • ID1 • • • • • • • • • •••••••••••••••••••••••••••••••••••••••••••••••• •••••••••••• Q-code 11. Index size MUST be 1 Octets Oi1 . •••••••••••••••••••••••••••••••••••••••••••••••• •••••••••••• • 32-bit • 32-bit • • • • • DO • • LSB | | | MSB • LSB | | | MSB • O1 • O2 • . • O1N• •.. The type of identifier is implied by the object type: •••••••••••••••••••••••••••••• •••••••••••• •••••••••••••• ••••••••••• • 8-bit • 8-bit • • • • • DO • • 8-bit • • • • DO • • • • O11 • O11• .... IQ LSB MSB •••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••• • 32 bit Quantity • Index • • Index • MUST be 3 • | | | • LSB | | | MSB •. OiN form the object identifier for Object i where 0<=i<Q (quantity) which is followed by the object identified. • ON • • • Q • Size N • • • • • ID1 • •••••••••••••••••••••••••••••••••••• •••••••••••• Q-code 11. I2 .. I2 Use qualifier 11 when describing points that need to be uniquely identified by an object identifier such as a File Object Identifier or Configuration Header. I-size MUST be 3 Octets 1 to N are the object identifier As for the previous case.• LSB | MSB • • Q • I1 • I1 • • I2 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••• Q-code 9..• • OQ1•..... I-size MUST be Points are I1.. there could be many identifiers each one following the other..... •••••••••••••••••••••••••••••••••••• •••••••••••• • 16-bit • 16-bit • • • • • DO • • LSB | MSB • LSB | MSB • O1 • O2 • .• LSB | | | MSB • .... I-size MUST be 2 Octets 1 to N are the object identifier As for the previous case.. Note the CON bit in the confirmation message may be set to 0 or 1. CON = 0 indicates no application confirmation expected for request. CON = ? • Code = 0 • • • • ••••••••••••••••••••••••••••••••••••••••••• Figure 4-1 Confirmation Message •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Request Header • Read request that will result in • • FIR = 1. any station that sends a message fragment with the CON bit set must wait until the CONFIRMation message arrives before continuing with message fragment transmission or another transaction. 4. The requests and responses are assumed to consist of one fragment each.00 Application Layer (Version 0.03) 4-1 . any station receiving a message fragment with the CON bit set MUST respond with a CONFIRMation message BEFORE sending any other application layer message. • a multiple fragment response • • CON = 0 • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Read request. However. function code and internal indication have been omitted from most of the examples but are always present in reality. DNP V3. This allows the option of having the confirmation message confirmed. DETAILED FUNCTION CODE DESCRIPTIONS This section describes the application layer function codes with examples. FIN = 1.1 CONFIRM (FUNCTION CODE 0) The confirm function is used to confirm the reception of a message fragment when the application control field (AC) in the received fragment has the CON bit set. The confirmation response for a single fragment message is illustrated in Figure 4-1. The application headers containing the application control. ••••••••••••••••••••••••••••••••••••••••••• • Application Control • Function • • FIR = 1.4. An example of a multiple fragment message is illustrated in the description of function code 0. FIN = 1. In addition. 2 READ (FUNCTION CODE 1) The read function is the basic code used for requesting data objects from a Outstation. qualifier and range field are coded in such a way that their size can be calculated allowing requests for multiple objects or ranges to be sent in a single message. CON = 0 • Code = 0 • • • • ••••••••••••••••••••••••••••••••••••••••••• • Confirmation of the last fragment of the response 4. The object. ••••••••••••••••••••••••••••••••••••••••••• • Request Header • Function • • FIR = 1. CON = 0 • Code = 0 • • • • ••••••••••••••••••••••••••••••••••••••••••• • Confirmation sent by the requesting station •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Response Header • ASDU of second fragment • • FIR = 0. FIN = 1. CON = 1 indicates the Outstation is expecting an application confirmation of the reception of this fragment. FIN = 0 • of response • • CON = 1 • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • The second fragment of the response ••••••••••••••••••••••••••••••••••••••••• • Request Header • Function • • FIR = 1.•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Response Header • ASDU of first fragment of the response • • FIR = 1. 4-2 DNP Users Group . FIN = 1 • • • CON = 1 • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • The last fragment of the response ••••••••••••••••••••••••••••••••••••••••••• • Request Header • Function • • FIR = 1. FIN = 1. FIN = 0 • • • CON = 1 • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • First fragment of response. CON = 0 • Code = 0 • • • • ••••••••••••••••••••••••••••••••••••••••• • Confirmation of the second fragment ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Response Header • ASDU of last fragment of the response • • FIR = 0. FIN = 1. 4-3 DNP V3. This qualifier code also indicates the range field is not present. This method is useful for requesting event data because the requesting station does not know in advance which points have generated events.00 Application Layer (Version 0. • The Outstation may respond with any or all objects of the defined group. The range field specifies 3 objects starting at index 7 to index 9 inclusive. • The qualifier code specifies all the defined objects of the group defined at the Outstation. octet 1 2 3 4 5 6 7 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • • AC • FC = 1 • g = n v = x • 0000 | 0000 • Start Stop • • • • | • 0 0 • 7 | 9 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Read object group n variation x. • The index size has no meaning and is set to 0.1 Read Requests The following examples illustrate some legal qualifier and range combinations for the read function code. The qualifier code specifies a range field with a 1 octet start and stop sub-field. octet 1 2 3 4 5 •••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • • AC • FC = 1 • g = n v = 0 • 0000 0110 • • • • | • 0 6 • •••••••••••••••••••••••••••••••••••••••••••••••• • Read object group n. The read request for a single range of objects is illustrated in Figure 4-2. The index size has no meaning and is set to 0.The number of multiple requests allowed in a single message is defined in the device profile of each device DNP is implemented on. Figure 4-3 illustrates the request for 2 object types or possibly 2 ranges of the same object type. •••••••••••••••••••••••••••••••••••••••••••••••••• • Request Header • Object • Qualifier • Range • • AC • FC = 1 • • • • • • • • • • •••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-2 Single Object Request • first Read request • second Read request • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Request Header • Object • Qualifier • Range • Object • Qualifier • Range • • AC | FC = 1 • • • • • • • • • • • • • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-3 Multiple Objects or Ranges 4.03) .2. octet 1 2 3 4 5 6 7 8 9 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • object gv • Qualifier • Range • • • AC • FC = 1 • g = n v = x • 0000 0001 • Start • Stop • • • • | • 0 1 • 700 • 702 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • Read object group n. The index size has no meaning and is set to 0. The Index Size field has no meaning and is set to 0. • The range field specifies a starting virtual address of 7 and a virtual ending address of 9. The qualifier code specifies a range field with a 4 octet start and stop sub-field. The range field specifies 3 objects starting at index 700 to index 702 inclusive. The qualifier code specifies a range field with a 2 octet start and stop sub-field. variation x. This method is useful for requesting specific data that is known to be valid at the time of the request.• The Outstation may respond within the range specified. The range field specifies 3 objects starting at index 70000 to index 70002 inclusive. This method is useful for requesting specific bytes from the memory of some remote application. The Outstation may respond within the range specified. NOTE: Virtual addressing is normally used only for diagnostic or manufacturing tests as intimate knowledge of the Outstation is needed to interpret the response. This method is useful for requesting specific data that is known to be valid at the time of the request. DNP Users Group 4-4 . variation x. • The Outstation may respond within the range specified. This method is useful for requesting specific data that is known to be valid at the time of the request. variation x. The Outstation may respond within the range specified. octet 1 2 3 4 5 6 7 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • • AC • FC = 1 • g = n v = x • 0000 0011 • Start • Stop • • • • | • 0 3 • 7 • 9 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Read object group n. • The Index Size field has no meaning and is set to 0. octet 1 2 3 4 5 6 7 8 9 10 11 12 13 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • • • • • Object gv • Qualifier • | | | Range | | | • • AC • FC = 1 • g = n v = x • 0000 0010 • Start • Stop • • • • | • 0 2 • 70000 • 70002 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • Read object group n. In this case n and x would specify a generic octet object • The qualifier code specifies a range field with a 1 octet start and stop sub-field. • The Outstation may respond within the range specified. The range field specifies 3 objects. variation x. The index size has no meaning and is set to 0. The qualifier code specifies a 1 octet quantity. NOTE: Virtual addressing is normally used only for diagnostic or manufacturing tests as intimate knowledge of the Outstation is needed to interpret the response. In this case n and x would specify a generic octet object. • The index size has no meaning and is set to 0. • The range field specifies a starting virtual address of 700 and a virtual ending address of 702. octet 1 2 3 4 5 6 7 8 9 10 11 12 13 ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • | | | Range | | | • • AC • FC = 1 • g = n v = x • 0000 0101 • Start • Stop • • • • | • 0 5 • 70000 • 70002 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Read object group n. octet 1 2 3 4 5 6 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • • AC • FC = 1 • g = n v = p • 0000 0111 • Quantity • • • • | • 0 7 • 3 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Read object group n variation p. • The range field specifies a starting virtual address of 70000 and a virtual ending address of 70002.00 Application Layer (Version 0. 4-5 DNP V3. This method is useful for requesting specific bytes from the memory of some remote application. • The Outstation may respond within the range specified. In this case n and x would specify a generic octet object. variation x.octet 1 2 3 4 5 6 7 8 9 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • | Range | • • AC • FC = 1 • g = n v = x • 0000 0100 • Start • Stop • • • • | • 0 4 • 700 • 702 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Read object group n. NOTE: Virtual addressing is normally used only for diagnostic or manufacturing tests as intimate knowledge of the Outstation is needed to interpret the response. • The Index Size field has no meaning and is set to 0.03) . • The qualifier code specifies a range field with a 4 octet start and stop sub-field. This method is useful for requesting specific bytes from the memory of some remote application. • The qualifier code specifies a range field with a 2 octet start and stop sub-field. octet 1 2 3 4 5 6 7 8 9 ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • • AC • FC = 1 • g = n v = p • 0000 1001 • Quantity • • • • | • 0 9 • | 70000 | • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • Read object group n variation p. This method is useful for requesting a limited amount of data of a particular variation (e. some critical status points may be requested for analysis or reporting purposes. analog change events) as the receiving station may not be able to handle the entire data base of the Outstation. For example. 4-6 DNP Users Group . The qualifier code specifies a 2 octet quantity. The qualifier code specifies a 4 octet quantity. The index size has no meaning and is set to 0. variation x. The range field specifies that the list contains 3 entries. The index size specifies each entry in the list is a 1 octet index. analog) of the Outstation. binary input with time objects) as the receiving station may not be able to handle the entire data base (i. The range field specifies 400 objects. octet 1 2 3 4 5 6 7 ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • • AC • FC = 1 • g = n v = p • 0000 1000 • Quantity • • • • | • 0 8 • 400 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • Read object group n variation p. The range field specifies 70000 objects. The qualifier code specifies a list of objects in the index field.e.g. analog) of the Outstation. octet 1 2 3 4 5 6 7 8 9 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • Indices • • AC • FC = 1 • g = n v = x • 0001 0111 • Quantity • 11 • 22 • 108 • • • • • 1 7 • 3 • • • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • Read object group n. This method is useful for requesting a limited amount of data of a particular variation as the receiving station may not be able to handle the entire data base (i.e. The index size has no meaning and is set to 0.g.• This method is useful for requesting a limited amount of data of a particular variation (e. This method is useful for requesting some specific points from the remote device. variation x. The qualifier code specifies a list of objects in the index field. The range field specifies the list contains 3 entries. some critical status points may be requested for analysis or reporting purposes. The range field is always the same size as an entry in the index list. NOTE: octet 1 2 3 4 5 6 7 .. For example. variation x. DNP V3. This format would normally be used when the indices have values between 0 and 255. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • Identifier • • AC • FC = 1 • g = n v = v • 0001 1011 • Quantity • • • • • | • 1 11 • 1 • Size | Object Identifier • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Size octets • • Read object group n variation v (in this case the group and variation identify the object identifier). The index size specifies each entry in the list is a 2 octet index. The range field specifies the list contains 3 entries. octet 1 2 3 4 5 6 7 8 9 10 11 12 13 ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • Indices • • AC • FC = 1 • g = n v = x • 0010 0111 • Quantity • 311 • 422 • 108 • • • • | • 2 7 • 3 • | • | • | • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • Read object group n. The index size specifies each entry in the list is a 4 octet index.NOTE: The range field is always the same size as an entry in the index list.03) 4-7 .. NOTE: octet 1 2 3 4 5 6 7 8 9 18 19 20 21 ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • Indices • • AC • FC = 1 • g = n v = x • 0011 0111 • Quantity • • • • • • • | • 3 7 • 3 • 70000 • 76000 • 90000 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • • Read object group n.. The qualifier code specifies a list of objects in the index field. The range field is always the same size as an entry in the index list.. This method is useful for requesting some specific points from the remote device.00 Application Layer (Version 0. For example. some critical status points may be requested for analysis or reporting purposes. This format would normally be used when some or all of the indices have values greater than what will fit in 1 octet. This method is useful for requesting some specific points from the remote device. • The range field specifies the list contains 1 entry......2 Read Responses This section defines some of the legal forms of an object header prefixing the objects in a response to a read request.2. • The qualifier code specifies a range field with 2 octet start and stop sub-fields. This method is however the only way in which to request a data object that is larger than one fragment in size. 4.. • The range field specifies 3 objects starting at index 7 to index 9 inclusive follow this header • The index size has no meaning and is set to 0 as the start and stop field identify the index of each object... octet 1 2 3 4 5 ••••••••••••••••••••••••••••••••••••••••••••••••••• • Object gv • Qualifier • Range • • group = n • 0000 0000 • Start • Stop • • variation = v • 0 0 • 7 • 9 • ••••••••••••••••••••••••••••••••••••••••••••••••••• . variation v. • The index size has no meaning and is set to 0 as the start and stop field identify the index of each object. variation v. • Objects following this header are group n. 4-8 DNP Users Group .. The size field is also an 8-bit quantity specifying that the object identifier is 'size' octets in length.... • Object gv • Qualifier • Range • • group = n • 0000 0001 • Start • Stop • • variation = v • 0 1 • 300 • 302 • •••••••••••••••••••••••••••••••••••••••••••••••••••••. • Objects following this header are group n.. variation v. • Object gv • Qualifier • Range • • group = n • 0000 0010 • Start • Stop • • variation = v • 0 2 • 70000 • 70002 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••. • The qualifier code specifies a range field with 4 octet start and stop sub-fields.. • This method is useful for reading configurations from a remote device (if the File Object Identifier is used). • The qualifier code specifies a range field with a 1 octet start and stop sub-fields.. .. • Objects following this header are group n.. • The range field specifies 3 objects starting at index 300 to index 302 inclusive follow this header. octet 1 2 3 4 5 6 7 •••••••••••••••••••••••••••••••••••••••••••••••••••••.. The index size specifies that the quantity field and Size field are 8-bit in length.• The qualifier code specifies a list of object identifiers in the identifier field and the range field is an 8 bit quantity. octet 1 2 3 4 5 6 7 8 9 10 11 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••.. . • The index size has no meaning and is set to 0 as the start and stop field identify the index of each object. • Objects following this header are group n.. • The index size has no meaning and is set to 0 as the start and stop field identify the index of each object. • The index size has no meaning and is set to 0 as the start and stop field identify the index of each object. • The qualifier code specifies a range field with a 1 octet start and stop sub-fields.. • The qualifier code specifies a range field with 4 octet start and stop sub-fields. variation v.. variation v.. • Object gv • Qualifier • Range • • group = n • 0000 0101 • Start • Stop • • variation = v • 0 5 • 70000 • 70002 • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••. • The range field specifies the contents of virtual addresses 7 to 9 inclusive following this header.. • The qualifier code specifies a range field with 2 octet start and stop sub-fields..03) 4-9 . • Object gv • Qualifier • Range • • group = n • 0000 0100 • Start • Stop • • variation = v • 0 4 • 300 • 302 • •••••••••••••••••••••••••••••••••••••••••••••••••••••... • The range field specifies the contents of virtual addresses 300 to 302 inclusive following this header. variation v.. • The index size has no meaning and is set to 0 as the start and stop field identify the index of each object. octet 1 2 3 4 5 ••••••••••••••••••••••••••••••••••••••••••••••••••• ... • The range field specifies the contents of virtual addresses 70000 to 70002 inclusive following this header. DNP V3. • Objects following this header are group n.. • Objects following this header are group n.. octet 1 2 3 4 5 6 7 8 9 10 11 •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••..• The range field specifies 3 objects starting at index 70000 to index 70002 inclusive follow this header. octet 1 2 3 4 5 6 7 •••••••••••••••••••••••••••••••••••••••••••••••••••••.00 Application Layer (Version 0..... • Object gv • Qualifier • Range • • group = n • 0000 0011 • Start • Stop • • variation = v • 0 3 • 7 • 9 • ••••••••••••••••••••••••••••••••••••••••••••••••••• .. .... The range field specifies 3 objects. The qualifier code specifies a range field with a 1 octet quantity..... The range field specifies 3 objects... • • • • Objects following this header are group n. variation v. The index size specifies the objects are prefixed with 4 octet index identifiers. octet 1 2 3 4 ••••••••••••••••••••••••••••••••••••••••. The range field specifies 3 objects. The index size specifies the objects are prefixed with 1 octet index identifiers. variation v. The index size specifies the objects are packed with no indices prefixing them... The qualifier code specifies a range field with a 1 octet quantity. • Object gv • Qualifier • Range • • group = n • 0010 0111 • 3 • • variation = v • 2 7 • • ••••••••••••••••••••••••••••••••••••••••. variation v..... This implies the first object in the message has an index of 0 and the last object in this example will have an index of 2. The range field specifies 3 objects. octet 1 2 3 4 ••••••••••••••••••••••••••••••••••••••••. • • • • Objects following this header are group n. • Object gv • Qualifier • Range • • group = n • 0001 0111 • 3 • • variation = v • 1 7 • • ••••••••••••••••••••••••••••••••••••••••.. • Object gv • Qualifier • Range • • group = n • 0000 0111 • 3 • • variation = v • 0 7 • • ••••••••••••••••••••••••••••••••••••••••. • Object gv • Qualifier • Range • • group = n • 0011 0111 • 3 • • variation = v • 3 7 • • ••••••••••••••••••••••••••••••••••••••••.... The qualifier code specifies a range field with a 1 octet quantity.... The qualifier code specifies a range field with a 1 octet quantity.. 4-10 DNP Users Group . The index size specifies the objects are prefixed with 2 octet index identifiers. octet 1 2 3 4 ••••••••••••••••••••••••••••••••••••••••. • • • • Objects following this header are group n. variation v. • • • • Objects following this header are group n.octet 1 2 3 4 ••••••••••••••••••••••••••••••••••••••••. This implies the first object in the message has an index of 0 and the last object in this example will have an index of 2. • Object gv • Qualifier • Range • • group = n • 0000 1000 • 3 • • variation = v • 0 8 • • ••••••••••••••••••••••••••••••••••••••••.. variation v. octet 1 2 3 4 5 ••••••••••••••••••••••••••••••••••••••••. • Objects following this header are group n..... variation v.. • Note that since the object indices are not specified (and the response and request do not have to match). • Object gv • Qualifier • Range • • group = n • 0010 1000 • 300 • • variation = v • 2 8 • • ••••••••••••••••••••••••••••••••••••••••.. octet 1 2 3 4 5 ••••••••••••••••••••••••••••••••••••••••.. • The range field specifies 300 objects. • Object gv • Qualifier • Range • • group = n • 0100 0111 • Quantity • • variation = v • 4 7 • 1 • •••••••••••••••••••••••••••••••••••••••••••••••. The index size specifies the objects are prefixed with 1 octet object sizes.. • • • • • Objects following this header are group n..03) 4-11 ..... • The qualifier code specifies a range field with a 2 octet quantity. The index size specifies the objects are packed with no indices prefixing them. • • • • Objects following this header are group n.. variation v.. The index size specifies the objects are prefixed with a 1 octet index identifier.octet 1 2 3 4 •••••••••••••••••••••••••••••••••••••••••••••••. • Object gv • Qualifier • Range • • group = n • 0001 1000 • 3 • • variation = v • 1 8 • • ••••••••••••••••••••••••••••••••••••••••.. The qualifier code specifies a range field with a 2 octet quantity.. The qualifier code specifies the range field is an 8 bit quantity. Note that since the object indices are not specified (and the response and request do not have to match)... DNP V3. variation v. The qualifier code specifies a range field with a 2 octet quantity. The range field specifies 3 objects.. The range field specifies the number of the objects in the data field. the data object itself must contain some unique identification (such as a time-stamp). the data object itself must contain some unique identification (such as a time-stamp). octet 1 2 3 4 5 ••••••••••••••••••••••••••••••••••••••••.00 Application Layer (Version 0. • • • • Objects following this header are group n. The range field specifies 3 objects.... .. This implies the first object in the message has an index of 0 and the last object in this example will have an index of 2. Note that since the object indices are not specified (and the response and request do not have to match)......• The index size specifies the objects are prefixed with a 2 octet index identifier. octet 1 2 3 4 5 •••••••••••••••••••••••••••••••••••••••••••••••. variation v.. octet 1 2 3 4 5 6 7 ••••••••••••••••••••••••••••••••••••••••.. The qualifier code specifies a range field with a 2 octet quantity. • Object gv • Qualifier • Range • • group = n • 0000 1001 • 3 • • variation = v • 0 9 • • ••••••••••••••••••••••••••••••••••••••••. The index size specifies the objects are prefixed with a 4 octet index identifier. • The range field specifies 3 objects... variation v. • • • • • Objects following this header are group n. octet 1 2 3 4 5 6 7 ••••••••••••••••••••••••••••••••••••••••.. octet 1 2 3 4 5 ••••••••••••••••••••••••••••••••••••••••. The index size specifies the objects are prefixed with 2 octet object sizes... 4-12 DNP Users Group . variation v.... • Object gv • Qualifier • Range • • group = n • 0101 1000 • Quantity • • variation = v • 5 8 • • •••••••••••••••••••••••••••••••••••••••••••••••. • Objects following this header are group n. The range field specifies 3 objects.... • Object gv • Qualifier • Range • • group = n • 0011 1000 • 300 • • variation = v • 3 8 • • ••••••••••••••••••••••••••••••••••••••••. The qualifier code specifies the range field is a 16 bit quantity. The qualifier code specifies a range field with a 4 octet quantity. • The qualifier code specifies a range field with a 4 octet quantity.. The index size specifies the objects are packed with no indices prefixing them.. variation v.. • • • • Objects following this header are group n. • Object gv • Qualifier • Range • • group = n • 0001 1001 • 3 • • variation = v • 1 9 • • ••••••••••••••••••••••••••••••••••••••••. The range field specifies the number of objects in the data field. The range field specifies 300 objects. the data object itself must contain some unique identification (such as a time-stamp).. • • • • Objects following this header are group n. The range field specifies the number of the objects in the data field. The index size specifies the objects are prefixed with 2 octet index identifiers... The index size specifies the objects are prefixed with 4 octet index identifiers. The index size specifies the objects are prefixed with 1 octet object sizes.... octet 1 2 3 4 5 6 7 ••••••••••••••••••••••••••••••••••••••••.. variation v. • Object gv • Qualifier • Range • • group = n • 0010 1001 • 3 • • variation = v • 2 9 • • ••••••••••••••••••••••••••••••••••••••••...... Note that since the object indices are not specified (and the response and request do not have to match). • Object gv • Qualifier • Range • • group = n • 0100 1001 • Quantity • • variation = v • 4 9 • • •••••••••••••••••••••••••••••••••••••••••••••••.. • • • • • Objects following this header are group n..00 Application Layer (Version 0.. DNP V3. The qualifier code specifies a range field with a 4 octet quantity. the data object itself must contain some unique identification (such as a time-stamp). • • • • Objects following this header are group n. variation v.. The range field specifies 3 objects. octet 1 2 3 4 5 6 7 ••••••••••••••••••••••••••••••••••••••••.03) 4-13 .. • Object gv • Qualifier • Range • • group = n • 0010 1001 • 3 • • variation = v • 3 9 • • ••••••••••••••••••••••••••••••••••••••••. The qualifier code specifies a range field with a 4 octet quantity. variation v. octet 1 2 3 4 5 6 7 •••••••••••••••••••••••••••••••••••••••••••••••. The qualifier code specifies the range field is a 32 bit quantity.. • • • • Objects following this header are group n.. The range field specifies 3 objects.• The index size specifies the objects are prefixed with a 1 octet index identifier. The size field is also an 8-bit quantity specifying that the object identifier plus data following the identifier is 'size' octets in length.. • The range field specifies the list contains 1 entry. Figure 4-5 illustrates the writing of multiple objects or ranges.. The response from the Outstation is always a function code followed by the IIN. CON=? FIR=0 FIN=1 octet 1 2 3 4 5 6 7 . • Note that each fragment is digestible by the requesting station because each object identifier specifies a unique portion of the object. Figure 4-4 illustrates the general format of a message writing single object type or range.. 4-14 DNP Users Group . Typical uses of the Write function are to download configuration or files to an Outstation and to set the time in the Outstation. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Object gv • Qualifier • Range • Identifier • Data • • g = n v = v • 0001 1011 • Quantity • • for • • | • 1 11 • 1 • Size • Object Identifier for piece 1• piece 1 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Size octets Fragment #2: FC=129. • This method is useful for reading configurations from a remote device (if the File Identifier Object is used). CON=? FIR=1 FIN=0 octet 1 2 3 4 5 6 7 . ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Object gv • Qualifier • Range • Identifier • Data • • g = n v = v • 0001 1011 • Quantity • • for • • | • 1 11 • 1 • Size • Object Identifier for piece 3• piece 3 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Size octets • Read object group n variation v (in this case the group and variation identify the object identifier)... 4. This method is however the only way in which to request a data object that is larger than one fragment in size.....3 WRITE (FUNCTION CODE 2) The write function code is used for moving objects from a master station to an Outstation. • The qualifier code specifies a list of object identifiers in the identifier field and the range field is an 8 bit quantity. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Object gv • Qualifier • Range • Identifier • Data • • g = n v = v • 0001 1011 • Quantity • • for • • | • 1 11 • 1 • Size • Object Identifier for piece 2• piece 2 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Size octets Fragment #3: FC=129. Figure 4-6 is an example of the writing of a configuration to an Outstation.The read response can also consist of a multi-fragment message with each object identifier specifying different portions (pages) of the entire object: Fragment #1: FC=129... CON=? FIR=0 FIN=0 octet 1 2 3 4 5 6 7 .. The object header is defined the same as in a read request. The index size specifies that the quantity field and Size field are 8-bit in length. ..3.... •••••••••••••••••....••••••••••••••••••••••••••••••••• . • • • Object Header • • Object Header • • AC • FC = 2 • • Object(s) • • Objects(s) • • • • • • •••••••••••••••••••••••••••••••••..1 Write Requests The Write request transfers a multi-fragment object to a remote device. The size field is also an 8-bit quantity specifying that the object identifier plus data is 'size' octets in length • The range field specifies the list contains 1 entry..... • This method is useful for downloading configurations to a remote device (if the File Object Identifier is used) as the contents of the Data filed is not interpreted by the DNP V3............ The Write Request is typically used for writing objects such as the Internal Indication Object......03) 4-15 .. Each fragment contains identifying information for each portion of the entire object...... ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • AC • • Object gv • Qualifier • Range • Identifier • Data • • FIN=1• FC = 2 • g = n v = v • 0001 1011 • Quantity • • for • • FIR=0• • | • 1 11 • 1 • Size • Object Identifier for piece 3• piece 3 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Size octets • Write object group n variation v (in this case the group and variation identify the object identifier).. • • • Object Header • • AC • FC = 2 • • Object(s) and prefixing indices or identifiers • • • • ••••••••••••••••••••••••••••••••• . • The Data field contains the data (of size specified in the identifier) belonging to the identified object.. Figure 4-4 Single Object Range Write •••••••••••••••••••••••••••••••••......••••••••••••••••• ..00 Application Layer (Version 0. File Identifier Objects and the Time and Date Object.... Figure 4-5 Multiple Object or Multiple Ranges 4..... ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • AC • • Object gv • Qualifier • Range • Identifier • Data • • FIN=0• FC = 2 • g = n v = v • 0001 1011 • Quantity • • for • • FIR=1• • | • 1 11 • 1 • Size • Object Identifier for piece 1• piece 1 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Size octets octet 1 2 3 4 5 6 7 ..... octet 1 2 3 4 5 6 7 ...... ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • AC • • Object gv • Qualifier • Range • Identifier • Data • • FIN=0• FC = 2 • g = n v = v • 0001 1011 • Quantity • • for • • FIR=0• • | • 1 11 • 1 • Size • Object Identifier for piece 2• piece 2 • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Size octets octet 1 2 3 4 5 6 7 .... • The qualifier code specifies a list of object identifiers in the identifier field and the range field is an 8 bit quantity.... 4. Figure 4-6 illustrates a select message (fixed size control blocks) sent from a master station to an Outstation. There are two forms to the control messages.. The operate message control objects must match the control objects in the preceding select message before the activation takes place. The select message causes the Outstation to starts a timer. The Write request below sets the time of day in the Outstation. 4-16 DNP Users Group . analog outputs or pattern control blocks. The status bytes state the success or failure of the Select request. These may be control relay outputs.2 Write Responses The response to a Write request can only consist of the IIN (Internal Indications) that indicates the success of the Write operation and so there is no ASDU portion of a Write response. The response always uses the Response function code. This method is however the only way in which to send a data object that is larger than one fragment in size.3. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • AC • • Object gv • Qualifier • Range • Time Object • • FIN=1• FC = 2 • g = n v = v • 0000 0000 • Quantity • • • FIR=1• • | • 0 00 • 1 • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • The qualifier specifies a 1 octet quantity. 4. octet 1 2 3 4 5 6 7 . The first form is for control blocks with a fixed size and the second form is for a control block of variable size. the quantity field specifies 1 object and the Object field identifies the object as a Time and Date Object.. The variable sized control block is for pattern outputs. The operate message must be received correctly before the timer expires in order for the activation to take place. An additional operate message must be sent to the Outstation to actually activate the request. The Outstation responds to a select message by arming the specified points (specified by the index preceding the control blocks) and returning the request in the response as illustrated in Figure 4-7 (fixed size control blocks). This function does not output or activate the new state or value but makes them ready (arms them) and reports their status.application layer. The response is identical to the request except that it includes the IIN and modified status bytes (part of the control block objects).4 SELECT (FUNCTION CODE 3) The select function code is used to select one or more control points at an Outstation... • The second qualifier code specifies a range field with a 1 octet start and stop sub-field. 4.. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier •Quantity• pattern • • AC • FC = 3 • group = a • 0000 0111 • • control • • • • variation = b • 0 7 • 1 • block •. specified is a Pattern Control Block which describes all the parameters that are common to the control points specified in the Pattern Mask Objects. Object c.1 Pattern Control Figure 4-8 illustrates a master station select message for a pattern and Figure 4-9 an Outstation response. variation v. (continued) •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Object gv • Qualifier • Range •pattern •pattern •pattern •pattern • • group = c •0000 0000 • Start | Stop • mask • mask • mask • mask • • variation = d • 0 0 • 5 8 •object 5•object 6•object 7•object 8• ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-8 Master Selection of a Pattern Output • The first object. which describe whether or not the point should be activated. • The first qualifier code specifies a 8-bit range (quantity) field which specifies one (1) Pattern Control Block. DNP V3. Object a. Variation d.••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • • control • • control • • AC • FC = 3 • group = n • 0001 0111 • Quantity • index • block • index • block • • • • variation = v • 1 7 • 2 • • object 1• • object 2• ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-6 Master Selection of Two Control or Analog Outputs • Object following this header is group n (must be a control block object relating to outputs or setpoints). • The index size specifies 1 octet indices prefixing each control block. Variation b.. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Object gv • Qualifier • Range • • control • • control • • AC • FC • IIN • group = n • 0001 0111 • Quantity • index • block • index • block • • • • • variation = v • 1 7 • • • object 1• • object 2• ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-7 Outstation Response The Outstation response control objects must match the control objects (byte for byte) in the request or the operate message will not be sent.03) 4-17 .4. Following this object are a number of Pattern Mask objects. This range specifies the Pattern Mask Objects which are to be considered for the pattern control. • The qualifier code specifies a range field with a 1 octet quantity of control blocks.00 Application Layer (Version 0. (continued) •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • Object gv • Qualifier • Range •pattern •pattern •pattern •pattern • • group = c •0000 0000 • Start | Stop • mask • mask • mask • mask • • variation = d • 0 0 • 5 8 •object 5•object 6•object 7•object 8• ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-9 Outstation Response to the Pattern Select Message • Notice that the format of the response is identical to the request message (except the application response header). In the case of a 4-18 DNP Users Group . variation v. 4. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Object gv • Qualifier • Range • control • control • • AC • FC • IIN • group = n • 0000 0111 • Quantity • block 1 • block 2 • • • • • variation = v • 0 7 • 2 • • • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-11 Outstation Response • Object following this header is group n (must be a control block object relating to outputs or setpoints). A matching message using the select function code must previously have been received. variation v. The objects returned will be used by the master to verify the success of the select operation.• The above message constitutes one pattern control request. • The qualifier code specifies a range field with a 1 octet quantity of control blocks. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • control • control • • AC • FC = 4 • group = n • 0000 0111 • Quantity • block 1 • block 2 • • • • variation = v • 0 7 • 2 • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-10 Master Selection of Two Outputs or Setpoints • Object following this header is group n (must be a control block object relating to outputs or setpoints). one of which is built into each of the control block objects.5 OPERATE (FUNCTION CODE 4) The operate function code is used to activate one or more control or analog outputs at an Outstation... The format of this message is the same as a select message except the function code is 4. • The qualifier code specifies a range field with a 1 octet quantity of control blocks. • Indication of the success or failure of the operations is returned in the Output Status bytes. and the arm timer must still be active before the activation will take place. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier •Quantity• pattern • • AC • FC=128 • group = a • 0000 0111 • • control • • • • variation = b • 0 7 • 1 • block •. Multiple requests (Pattern Control Block followed by multiple Pattern Mask Objects) can be sent in one message as long as the total size of the requests can fit into one application layer fragment. 03) 4-19 . variation v.6 DIRECT OPERATE (FUNCTION CODE 5) The direct operate function code is used to activate one or more outputs or setpoints at an Outstation. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Object gv • Qualifier • Range • control • control • • AC • FC • IIN • group = n • 0000 0111 • Quantity • block 1 • block 2 • • • • • variation = v • 0 7 • 2 • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-13 Outstation Response • Object following this header is group n (must be a control block object relating to outputs or setpoints).7 DIRECT OPERATE .NO ACKNOWLEDGEMENT (FUNCTION CODE 6) The direct operate No Acknowledgement function code is used to activate one or more outputs or setpoints at a Outstation. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • control • control • • AC • FC = 6 • group = n • 0000 0111 • Quantity • block 1 • block 2 • • • • variation = v • 0 7 • 2 • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-14 Master Selection of Two Outputs or Setpoints • Object following this header is group n (must be a control block object relating to outputs or setpoints). • The qualifier code specifies a range field with a 1 octet quantity of control blocks. DNP V3.Pattern Mask object. the status is part of the Pattern Control Block object preceding the mask. A preceding select message is not required. The format of this message is the same as a select or operate message except the function code is 5.00 Application Layer (Version 0. variation v. 4. The format of this message is the same as a select or operate message except the function code is 6 and the Outstation does not respond with a message to the master station. 4. A preceding select message is not required. • The qualifier code specifies a range field with a 1 octet quantity of control blocks. variation v. • The qualifier code specifies a range field with a 1 octet quantity of control blocks. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • control • control • • AC • FC = 5 • group = n • 0000 0111 • Quantity • block 1 • block 2 • • • • variation = v • 0 7 • 2 • • • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-12 Master Selection of Two Outputs or Setpoints • Object following this header is group n (must be a control block object relating to outputs or setpoints). this function code is used to perform a global freeze on all Outstations belonging to the master. The objects which were frozen can be requested (in another request) by asking for frozen objects. only counter objects are frozen. however..9 IMMEDIATE FREEZE . the Outstation should copy the current values of the specified data objects to their appropriate freeze buffers. Typically.• • • • • • • • ••••••••••••••••••••••••••••••• ••••••••••••••••• Figure 4-17 Master Immediate Freeze No-Ack Control Message 4..10 FREEZE AND CLEAR (FUNCTION CODE 9) This function code is used to copy the specified data to a freeze buffer like the freeze immediate function code but then the Outstation clears ( to 0 ) the specified data objects. 4-20 DNP Users Group ... the SEND-NO REPLY services of the Data Link Layer may have to be used in certain environments.NO ACKNOWLEDGEMENT (FUNCTION CODE 8) This function code works identically to the previous function code (Immediate Freeze) except that no Outstation response is needed.4. 4. Typically. •••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-16 Outstation Response to Immediate Freeze The Outstation response can indicate (in the IIN) that the objects in the request are not known. In this case. ••••••••••••••••••••••••••••••• ••••••••••••••••• • • • Object Header • • Object Header • • AC • FC = 7 • •. Upon reception of the message. ••••••••••••••••••••••••••••••• ••••••••••••••••• • • • Object Header • • Object Header • • AC • FC = 8 • •.8 IMMEDIATE FREEZE (FUNCTION CODE 7) This function code is used to copy the specified data objects to a freeze buffer.• • • • • • • • ••••••••••••••••••••••••••••••• ••••••••••••••••• Figure 4-15 Master Immediate Freeze Control Message The request can contain multiple object headers which specify many objects to freeze. TIME non zero zero zero INTERVAL zero zero non zero DESCRIPTION Freeze once at specified time. Start freezing at the specified time and repeat at each interval increment thereafter non zero non zero DNP V3.. this function code is used to perform a global freeze and clear on all Outstations belonging to the master. The value of these fields determines the behaviour of the Outstation freezing.• • • • • • • • ••••••••••••••••••••••••••••••• ••••••••••••••••• Figure 4-20 Master Freeze and Clear No-Ack Control Message 4. the object has two components: a time field (absolute) and an interval time field.00 Application Layer (Version 0... Freeze Immediately. ••••••••••••••••••••••••••••••• ••••••••••••••••• • • • Object Header • • Object Header • • AC • FC = 9 • •.Typically.NO ACKNOWLEDGEMENT (FUNCTION CODE 10) This function code works identically to the previous function code (Freeze and Clear) except that no Outstation response is needed. As shown.• • • • • • • • ••••••••••••••••••••••••••••••• ••••••••••••••••• Figure 4-18 Master Freeze and Clear Control Message •••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-19 Outstation Response to Freeze and Clear Request 4. Subsequent freezes will occur at each interval increment. Freezing is synchronized to the beginning of the current hour.. ••••••••••••••••••••••••••••••• ••••••••••••••••• • • • Object Header • • Object Header • • AC • FC= 10 • •.03) 4-21 . The first freeze will occur at the smallest multiple greater than or equal to the current time.12 FREEZE WITH TIME (FUNCTION CODE 11) This function code initiates the periodic freezing of the specified data objects. this function code is used to freeze counters or accumulators and then reset them to 0. The Time and Date with Interval object sent preceding the objects to freeze is described in the table below. Typically.11 FREEZE AND CLEAR . Typically. the SEND-NO REPLY services of the Data Link Layer may have to be used in certain environments. this function code is used to perform a global freeze with time on all Outstations belonging to the master. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object Header • Time Object • Object Header(s) • • AC • FC = 12 • for time object • Time and Date • Interval • for data objects • • • • • • • to freeze • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-23 Master Freeze With Time No-Ack Message 4.NO ACKNOWLEDGEMENT (FUNCTION CODE 12) This function code works identically to the previous function code (Freeze With Time) except that no Outstation response is needed. 4.13 FREEZE WITH TIME . as if it has been newly powered up.•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object Header • Time Object • Object Header(s) • • AC • FC = 11 • for time object • Time and Date • Interval • for data objects • • • • • • • to freeze • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-21 Master Freeze With Time Message •••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-22 Outstation Response to Freeze With Time The time object must contain the time and interval. Example: A time object specifies the time of day as 2:32 pm and an interval of 10 minutes. ••••••••••••••• • • • • AC • FC = 13• • • • ••••••••••••••• 4-22 DNP Users Group . The first freeze will occur at 2:32 pm and subsequent freezes every 10 minutes starting from 2:42 pm. In this case.14 COLD RESTART (FUNCTION CODE 13)The cold restart function code makes the Outstation perform a complete restart of the user application . These objects are defined in the DNP Data Object Library (P009-0BL). The interval allows the Outstation to perform a restart sequence and enable DNP communications again.03) 4-23 .16 INITIALIZE DATA (FUNCTION CODE 15) DNP V3.00 Application Layer (Version 0. but it is not necessary to run through the entire reset sequence (only certain applications need be restarted). The DNP application may reset itself without resetting other subsystems or processes. The Time Delay Object is actually a Time Delay Fine or Time Delay Course object.15 WARM RESTART (FUNCTION CODE 14) This code restart function code specifies that the Outstation perform a restart. The master should not attempt to communicate with the Outstation until the interval has elapsed.Figure 4-24 Master Cold Restart Control Message •••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Object • Time Delay • • AC • FC • IIN • Header • Object • • • • • for time • • •••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-25 Outstation Response to Cold Restart Request The Outstation. 4. After the response is sent (and transaction was successful) the Outstation should perform the restart procedure. upon receiving the Cold Restart request will response with a Time Delay Object (Time Delay Fine or Time Delay Course) which specifies a time interval until the Outstation will be ready for further communications. 4. Typically this function makes an Outstation application initialize its configuration and clear events stored in its local buffers. •••••••••••••••• • • • • AC • FC = 14 • • • • •••••••••••••••• Figure 4-26 Master Warm Restart Control Message ••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Object • Time Delay • • AC • FC • IIN • Header • Object • • • • • for time • • ••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-27 Outstation Response to Warm Restart Request The Outstation response is identical to the response to the Cold Restart function code and should be interpreted in the same way. The Time Delay Fine object is defined in the DNP Data Object Library (P009-0BL). this function could be used to clear counters. For example.This function code specifies that configurable data is to be set to the initial or default settings. upon receiving the request. •••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-31 Outstation Response After Initializing Application(s) The Outstation...17 INITIALIZE APPLICATION (FUNCTION CODE 16) This function code initializes the specified applications at the Outstation in preparation for execution. octet 1 2 3 4 5 6 7. 4-24 DNP Users Group . should initialize the specified application(s) and then respond with either the success or failure of the transaction. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • Application •Application • • AC • FC = 16 • Group = n • 0001 1011 • Quantity • Identifier •Object • • • • Variation = v • 1 11 • 1 • Size •Identifier • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-30 Master Initialize Application Control Message • The object group and variation must specify an application identifier object. • The application identifier size field indicates the size of the Application Object Identifier that follows. 4. Note that the initial settings are NOT contained in the request. • The qualifier indicates the range field is an 8 bit quantity specifying the number of object identifiers that follow. ••••••••••••••••••••••••••••••••••• • • • Object Header • • AC • FC = 15 • for data objects • • • • to initialize • ••••••••••••••••••••••••••••••••••• Figure 4-28 Master Initialize Data Control Message •••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-29 Outstation Response to Initialize Data Request The response only indicates the success or failure of the requested operation. . • The application identifier size field indicates the size of the Application Object Identifier that follows. DNP V3. octet 1 2 3 4 5 6 7.. ••••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Object • Time Delay • • AC • FC • IIN • Header • Object • • • • • for time • • ••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-33 Outstation Response After Starting Application(s) The Outstation. 4. • The qualifier indicates the range field is an 8 bit quantity specifying the number of object identifiers that follow. • The application identifier size field indicates the size of the Application Object Identifier that follows.19 STOP APPLICATION (FUNCTION CODE 18) This function code informs the Outstation to stop the execution of the specified application. should start the specified application(s) and then respond with either the success or failure of the transaction.03) 4-25 . • The qualifier indicates the range field is an 8 bit quantity specifying the number of object identifiers that follow..18 START APPLICATION (FUNCTION CODE 17) This function code is used to start the specified application(s) at the Outstation.. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • Application •Application • • AC • FC = 18 • Group = n • 0001 1011 • Quantity • Identifier •Object • • • • Variation = v • 1 11 • 1 • Size •Identifier • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-34 Master Stop Application Control Message • The object group and variation must specify an application identifier object.4.00 Application Layer (Version 0. •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • Application •Application • • AC • FC = 17 • Group = n • 0001 1011 • Quantity • Identifier •Object • • • • Variation = v • 1 11 • 1 • Size •Identifier • •••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-32 Master Start Application Control Message • The object group and variation must specify an application identifier object. upon receiving the request. octet 1 2 3 4 5 6 7. upon receiving the request.•••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-35 Outstation Response After Stopping Application(s) The Outstation. 4-26 DNP Users Group . upon receiving the request. should stop the specified application(s) and then respond with either the success or failure of the transaction..21 ENABLE SPONTANEOUS MESSAGES (FUNCTION CODE 20) This function code informs the Outstation to enable spontaneous reporting of the objects specified in the object header. • The configuration identifier size field indicates the size of the configuration Object Identifier that follows. octet 1 2 3 4 5 6 7.20 SAVE CONFIGURATION (FUNCTION CODE 19) This function initiates the saving of the specified configuration(s) to nonvolatile storage at the Outstation station.. should save the specified configuration(s) and then respond with either the success or failure of the transaction and a time object (Time Delay Fine or Time Delay Course) which indicates the time at which the Outstation will be available again for communication. 4. • The qualifier indicates the range field is an 8 bit quantity specifying the number of object identifiers that follow. ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• • • • Object gv • Qualifier • Range • File •File • • AC • FC = 19 • Group = n • 0001 1011 • Quantity • Identifier •Identifier • • • • Variation = v • 1 11 • 1 • Object Size •Object • ••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-36 Master Save Configuration Control Message • The object group and variation must specify a configuration or file identifier object. The master should not attempt to communicate with the Outstation until the time specified. ••••••••••••••••••••••••••••••••••••••••••••••••• • • • • Object • Time • • AC • FC • IIN • Header • Object • • • • • • • ••••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-37 Outstation Response After Saving Configuration(s) The Outstation. 4. This means that any objects which are configured for the specified class will be enabled for spontaneous messages.03) . •••••••••••••••••••••••••••••••• • • • Object Header • • AC • FC = 21 • • • • • • •••••••••••••••••••••••••••••••• Figure 4-40 Master Request to Disable Spontaneous Messages •••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-41 Outstation Response to Disable Spontaneous Message The Outstation will disable spontaneous messages for all object (types or points) specified in the object header.23 ASSIGN CLASSES (FUNCTION CODE 22) This function is used to assign data objects to classes.•••••••••••••••••••••••••••••••••• • • • Object Header(s) • • AC • FC= 20 • • • • • • •••••••••••••••••••••••••••••••••• Figure 4-38 Master Request to Enable Spontaneous Messages •••••••••••••••••••••••• • • • • • AC • FC • IIN • • • • • •••••••••••••••••••••••• Figure 4-39 Outstation Response The Outstation will enable spontaneous messages for all object (types or points) specified in the object header. The master could also send an object header specifying class data.22 DISABLE SPONTANEOUS MESSAGES (FUNCTION CODE 21) This function code informs the Outstation to disable spontaneous reporting of the objects specified in the object header.00 Application Layer (Version 0. The master could also send an object header specifying class data. 4. 4. This means that any objects which are configured for the specified class will be disabled for spontaneous messages. 4-27 DNP V3. • Static data objects are assigned to Class 0 and cannot be assigned to other classes.••••••••••••••••• • • • Class Object • Data Object • • Data Object • • AC • FC = 22 • Header • Header 1 • • Header n • • • • • • • • •••••••••••••••••••••••••••••••••••••••••••••••. ••••••••••••••••• • • • • • AC • FC • IIN • • • • • ••••••••••••••••• Figure 4-43 Outstation Response to Assign Classes The Outstation response indicates the success or response of the operation (success or failure determined by the state of the IIN bits). 4-28 DNP Users Group . variation and range of the objects to be assigned to the class specified in the class object header preceding the data object header..24 DELAY MEASUREMENT (FUNCTION CODE 23) This function is used to calculate the communication delay for a particular Outstation. however. • Multiple sets of Class Object headers followed by one or more Data Object headers can be sent in one message.•••••••••••••••••••••••••••••••••••••••••••••••. •••••••••••••••• • • • • AC • FC = 23 • • • • •••••••••••••••• Figure 4-44 Master Request to Initiate Delay Measurement • Only one time object can be sent in any one separate request. • The data object header(s) identifies the group. Time Synchronization for a detailed description of the process). Event data objects are assigned to classes 1. Each set must not span multiple fragments. 4..••••••••••••••••• Figure 4-42 Master Request to Assign Classes to Data • The class object header must specify the class object group and a variation between 1 and 3 indicating the class assignment to all the data object (specified by the headers) that follow. It is generally used in the time synchronization process for the Outstations (see section 6. 2 and/or 3 and cannot be assigned to Class 0. 00 Application Layer (Version 0. DNP V3.••••••••••••••••••••••••••••••••••••••••••••••• • • • • Time Delay • Time Delay • • AC • FC • IIN • Fine Header • Fine object • • • • • • • ••••••••••••••••••••••••••••••••••••••••••••••• Figure 4-45 Outstation Reponse to Delay Measurement Request The Outstation responds with the Time Delay Fine object.03) 4-29 . This object states the number of milliseconds elapsed between the Outstation receiving the first bit of the first byte of the request and the time of transmission of the first bit of the first byte of the response. 4-30 DNP Users Group . Class data is used by a master station to request pre-assigned data objects on a demand or availability basis from an Outstation. 2 and 3 are reserved for event data objects (objects created as the result of data changes in the Outstation or some other stimulant). There are four Classes of data. It is not required that an Outstation have data assigned to Classes 1. Class 0 is reserved for static data objects (static data reflects the current value of data in the Outstation). a class data object header can be used only in a request (with no associate data object) to indicate to the Outstation which data objects to return. The Outstation will return (in the response) object headers for the ACTUAL data objects and NOT the class object header. DNP V3. The ability to assign data to Classes and the degree of configurability is described in the Outstation's device profile.5. 2 or 3. Each event object can be assigned to Class 1. Therefore.00 Application Layer (Version 0.03) 5-1 . 2 or 3. Classes 1. Objects may be grouped in Classes by priority (the priority is determined by the user) and the data classes polled at varying rates. CLASSES Objects may be assigned to a class. 5-2 DNP Users Group . The master now transmits the first bit of the first byte of a Write request at time MasterSend. 3. To synchronize Master station and Outstation time. The Outstation transmits the first bit of the first byte of the response to the Delay Measurement request at time RtuSendTime.RtuReceiveTime 4. The master station can now calculate the one way propagation delay as Delay = MasterSendTime . DNP V3. The master records the time of transmission of the first bit of the first byte of the request (MasterSendTime). The Master station receives the first bit of the first byte of the Outstation's response at time MasterReceiveTime. The Write request contains the Time and Date object.6.00 Application Layer (Version 0. 5. The Master station sends a Delay Measurement request to the Outstation. where RtuTurnAround = RtuSendTime .03) 6-1 . 1. TIME SYNCHRONIZATION Time synchronization is handled by the application layer BUT has to make use of special services of the data link layer. The Outstation receives the first bit of the first byte of the Delay Measurement request at time RtuReceiveTime (this is a local time in the Outstation). This is the time that the Master station wants the Outstation to be set to.RtuTurnAround ---------------------------------------------------2 6. the following procedure is used. 2. The application must initiate the time synchronization sequence by sending the appropriate request or response.MasterReceiveTime . with the time in this object equal to RtuTurnAround. with the time in the object representing a time equal to (MasterSend + Delay). The response contains the Time Delay object (Time Delay Fine or Time Delay Course). 7. The Outstation receives the first bit of the first byte of the Write request at time RtuReceive. 8.RtuReceive NewRtuTime = (time in the Time and Date object) + Adjustment 9. NOTE: The Time Synchronization scheme assumes that the Outstation to master propagation delay and the master to Outstation propagation delay are equal. the master station may send a global request (using the reserved destination address of FFFF hexadecimal) to simultaneously synchronize all Outstations. The Master and Outstation time are now synchronized. The Outstation will process the Write request. The following algorithm is used: Adjustment = CurrentRtuTime . If desired. 6-2 DNP Users Group . setting the Outstation clock to time NewRtuTime. only if all path delays are equal. BINARY INPUT WITH TIME EVENTS An Outstation will often transmit Binary Input with Time or Binary Input with Relative Time objects when digital input points changes state. 3) Outstation Time NOT Synchronized. The relative times start at 0 (for the oldest object) and range upwards relative to the Time and Date object.00 Application Layer (Version 0. 2) Outstation Time Synchronized.7. several event object to send.03) 7-1 . DNP V3. Binary input event objects are transmitted in different formats depending on different conditions. 1) Outstation Time Synchronized. The data is transmitted in the Binary Input with Time object format. The Unsynchronized Common Time and Date object is transmitted followed by one or more Binary Input with Relative Time objects. The time in the Time and Date Common Time of Occurrence object is the time of the oldest object. The Time and Date Common Time of Occurrence object is transmitted followed by several Binary Input with Relative Time objects. The time in the Time and Date Common Time of Occurrence object is the time of the oldest object. The relative times start at 0 (for the oldest object) and range upwards relative to the Date and Time object. one event object to send. one or more event object to send. 7-2 DNP Users Group . 03) 8-1 . A data concentrator is located between a master station and an Outstation .it does not directly route messages between a master station and an Outstation. The response always uses the RESPONSE function code. The object may or may not contain data (no data for DELETE or ERASE). an outstation can send an unsolicited message containing a FIO. The interpretation of the File_Name field is dependent on the Data Concentrator through which the object is being routed. The File Identifier Object is always passed to an Outstation in a request using the WRITE function code.8. FILE TRANSFER The File Identifier Object (FIO) may be used to transfer data files between Outstations and master stations. to the Outstation.00 Application Layer (Version 0. This field describes how the object is to be routed from the master station. DNP V3. Note that the request message is using the WRITE function code. The Outstation may be another Data Concentrator. The action to be done (reading. writing or otherwise) is specified by the File_Function field within the object. The File_Function field in the object will be WRITE. INSERT. However. through any number of intermediate Data Concentrators. This is commonly used to write configurations from a master to an Outstation or read configurations from an Outstation to a master. The File Identifier Object contains routing information in its File_Name field.1 FILE IDENTIFIER OBJECTS PERFORMING WRITE FUNCTIONS This section describes how a File Identifier Object is passed from a master station through a Data Concentrator to an Outstation. The functionality of the File Identifier Object allows configuration information to be routed to Outstations via intermediate Data Concentrators. 8. Note that a Data Concentrator is not just a communication node . DELETE or ERASE.it is effectively an Outstation to the master station and a master station to the Outstation. APPEND. where xx (2 ASCII characters) contains the Master Application number to which this File Identifier Object must be routed. Outstation Application sends the File Identifier Object to the Master 3) Application. 5) If a CONFIRMation Response is required. Master Application now waits for the response containing the File 6) Identifier Object. • File_Name field contains an ASCII character string. the first 9 character of which are "/DNPDCAxx". It is an Outstation with respect to the master station. For the request. When this object is received. • File_Function field in the object is set to WRITE. • Master Application . This information routes the object from the Outstation Application to the Master Application within the Data Concentrator. a negative acknowledgement is sent to the Outstation Application. The transaction is complete. INSERT. DELETE or ERASE. 7) Upon receipt of a response File Identifier Object or negative acknowledgement (from the Master Application).This is the software application in the Data Concentrator that communicates to the Outstation. the Master Application waits for this response. which will send it on to the Outstation. the Master Application sends it to the Outstation Application. If the above conditions are met. 8-2 DNP Users Group . If the Master Application does not receive the object. Master Application sends a request (WRITE function code) containing the 4) File Identifier Object to the appropriate Outstation. The Harris implementation uses a string.This is the software application in the Data Concentrator that communicates to the master station.The following Nomenclature is used: • Outstation Application . the following sequence occurs: Outstation Application sends a CONFIRMation response to the master 1) station (if the CON bit in the Request Header is set). It is a master with respect to the Outstation. The object in the response contains the status of the command specified in the File_Function field. APPEND. the Outstation Application sends a response to the master. modifying other File Identifier Object fields if necessary. Outstation Application removes the first 9 characters (for HARRIS 2) implementation) from the FILE_NAME field. The master station send the request (WRITE function code) with the File Identifier Object to the Outstation Application. the following conditions must be satisfied. • DNP WRITE Function Code is used in the request. The length and contents of the string is dependant on the Data Concentrator. DNP V3. It contains the File Identifier Object. it will modify and set the following fields in the response File Identifier Object: START_RECORD = END_RECORD = 0 FILE_SIZE = 0 FILE_FUNCTION = RESPONSE PERMISSION = 0 Master Application was unable to pass the File Identifier STATUS = 2 Object to the Master Application. Figure 8-1 is a simplistic example illustrating how the File Identifier Object is passed through the system from a master station to an Outstation via two data concentrators. The File_Name field is designed so that File Identifier Objects containing configurations can be downloaded to an Outstation via any number of intermediate data concentrators. If the Outstation Application receives a response from the Master Application. If the Outstation Application receives a negative acknowledgement from the Master Application.03) 8-3 .00 Application Layer (Version 0. 4 Operation unsuccessful because the device addressed by FILE_ID is offline.The response to the request uses the RESPONSE Function Code. with no data records. The Outstation Application does not need to change this response. which contains the status of the operation requested in the File_Function field. 4 Operation unsuccessful because a negative acknowledgement received from the Master Application. this response contains a File Identifier Object. • • ↓ FILE_NAME = /DNPDCA03/DNPDCA10/config1 •••••••••••••••••••••••••••••••••• • Outstation application removes• • 1st 9 chars of FILE_NAME • •--------------------------------• • sends object to internal • First Data Concentrator • device number 03 • Outstation Application •--------------------------------• has Address DST=1 • Master applic. addresses • • the object to DST=22 • •••••••••••••••••••••••••••••••••• • • ↓ FILE_NAME = /DNPDCA10/config1 •••••••••••••••••••••••••••••••••• • Outstation application removes• • 1st 9 chars of FILE_NAME • •--------------------------------• • sends object to internal • Second Data Concentrator • device number 10 • Outstation Application •--------------------------------• has Address DST=22 • Master applic. The second DC receives the WRITE request. The Master Application in the first DC WRITEs the File Identifier Object to the second DC. The Master Application configuration specifies device number 10 has DNP destination address 8. configuration • • maps device 10 to DST=8 • • Master applic. It then routes the object to the Master Application specified as device number 3. The Master Application in the second DC WRITEs the File Identifier Object to the Outstation. It then routes the object to the Master Application specified as device number 10. addresses • • the object to DST=8 • •••••••••••••••••••••••••••••••••• • • ↓ FILE_NAME = /config1 •••••••••••••••••••• • • • End Device • • Address 8 • • • •••••••••••••••••••• Figure 8-1 Passing a File Identifier Object Via Data Concentrators In Figure 8-1: 1) 2) 3) 4) 5) 6) The master station WRITEs the File Identifier Object to the first data concentrator (DC). The Master Application configuration specifies device number 3 has DNP destination address 22. The Outstation Application in the second DC removes the first nine characters of the File_Name. The File_Name field specifies that the object is to be sent to device number 3 in the first DC. The Outstation Application in the first DC removes the first nine characters of the File_Name. configuration • • maps device 03 to DST=22 • • Master applic. DNP Users Group 8-4 . The File_Name field specifies that the object is to be sent to device number 10 in the second DC. • AN Outstation Application will not receive while it waits for a response from a down stream device. where xx (2 ASCII characters) contains the Master Application number of the destination for this File Identifier Object. It responds with a RESPONSE containing the modified File Identifier Object. The Master Application in the first DC transfers the response File Identifier Object to the Outstation Application. The Outstation Application in the first DC sends a RESPONSE containing the File Identifier Object to the DNP master station. The Master Application in the second DC transfers the response File Identifier Object to the Outstation Application. 8-5 DNP V3. 8. which in turn has a larger response timeout than the Outstation Application in the second DC.7) 8) 9) 10) 11) The Outstation receives the WRITE request. If the above conditions are met. The master station can read the File Identifier Object when the following conditions are met: • The DNP WRITE Function Code is used in the request. The File_Function field is set to READ.03) . NOTES: • This functionality requires the DNP master station to have a larger response timeout than the Outstation Application in the first DC. 1) The Outstation Application sends a CONFIRMation response to the DNP master station (if required). • The File_Function field in the File Identifier Object received in the request is set to READ. It is transmitted to the Master Application in the second DC. the following sequence occurs. It is "locked out" to master requests. The Outstation Application sends a RESPONSE containing the File Identifier Object to the first DC. The length and contents of the string is dependant on the DC. • The DNP master station must have detailed configuration and routing information in order to construct the File_Name field. • The File_Name field contains an ASCII character string. This object contains the status of the operation.00 Application Layer (Version 0. the first 9 character of which are "/DNPDCAxx".2 FILE IDENTIFIER OBJECT PERFORMING READ FUNCTIONS This section describes how a File Identifier Object is used to perform read functions. The HARRIS implementation uses a string. This information routes the object through the DC to the Master Application which will send it on from the DC to the Outstation. Note that the object is passed to applications via a request using the WRITE function code. The Outstation Application sends a READ command with the File Identifier Object to the Master Application. If a CONFIRMation Response is required. a negative acknowledgement is sent to the Outstation Application. The Outstation Application will modify and set the following fields in the response File Identifier Object. The transaction is complete. 4 Operation unsuccessful because the device addressed by FILE_ID is offline. 4 Operation unsuccessful because a negative acknowledgement received from the Master Application. the Outstation Application sends a response to the master. Upon receipt of an response File Identifier Object or negative acknowledgement. START_RECORD = END_RECORD = 0 FILE_SIZE = 0 FILE_FUNCTION = RESPONSE PERMISSION = 0 Outstation Application was unable to pass the File STATUS = 2 Identifier Object to the Master Application. modifying the File Identifier Object as required. 8-6 DNP Users Group . the Master Application sends the response to the Outstation Application. In the cases where the Outstation Application cannot pass the request to the Master Application or a negative acknowledgement is received from the Master Application. The Master Application now waits for the response containing the requested File Identifier Object. If the Master Application does not receive the object. Some error conditions can occur in the above sequence. the Master Application waits for this response. When this object is received. The Master Application sends a READ command with the File Identifier Object to the appropriate Outstation.2) 3) 5) 6) 7) 8) The Outstation Application removes the first 9 characters from the File_Name field( for HARRIS implementation). the Outstation Application returns the File Identifier Object received as part of the request to the master station. 00 Application Layer (Version 0.03) 1 .LIST OF ABBREVIATIONS AND ACRONYMS AC APCI APDU ASDU COS DA DC DNP DUI EPA IEC IIN IO ISO OSI PDU RTU SCADA SEQ application control application protocol control information application protocol data unit application service data unit change of state distribution automation data concentrator distributed network protocol data unit identifiers enhanced protocol architecture International Electrotechnical Commission internal indications information objects International Standards Organization Open System Interconnection protocol data unit remote terminal unit supervisory control and data acquisition sequence number DNP V3. 20/93 Sep. Tessari Pages Affected All All All All All All All All All Reason for Changes Created using P020-0BL Revised after review and editorials. Update and reformat.00A 0.02 0.02 0.02 By Whom MS MS LA MS JB JB JB MCH S. 01/93 July.00A Associated Software Release(s): DNP V3. 01/93 Sep. Re-structure.01 0.02 0.02 0. 08/92 Nov.DOCUMENT REVISION HISTORY Name of Document: DNP V3:00 Data Object Library Network File Name: P009-OBL Original Author: Malcolm Smith/Michael Copps Date and Version of Preliminary Release: October 8. 23/92 Jun.02 0. addition of objects. Update and addition of new objects. 01/93 Aug. 1992 Version 0.0 . 27/93 Jul. Converted to MSWord 6.00B 0. Update and edit as per the review. 09/92 Nov.00 Revisions Since Preliminary Release Date Oct. 08/97 Version 0. Reformatted to WI standards. Check and revise format. . DNP Users Group DNP PRODUCT DOCUMENTATION DNP V3.00 DATA OBJECT LIBRARY Document Version: 0.02 Internal File: P009-OBL Associated Software Release: DNP V3.00 . TRADEMARK NOTICES Brand and product names mentioned in this document are trademarks or registered trademarks of their respective companies.DNP USERS GROUP The contents of this manual are the property of the DNP Users Group. the information contained in this manual is subject to change without notice. In addition. no part of this document may be altered or revised or added to in any form or by any means. duly authorized by the DNP Users Group. except as permitted by written agreement with the DNP Users Group or a Party duly authorized by the DNP Users Group. As a Party. however. Harris Corporation has made every reasonable attempt to ensure the completeness and accuracy of this document. .NOTICE OF RIGHTS . and does not represent a commitment on the part of Harris Corporation or the DNP Users Group. Revisions or additions to the definition and functionality of the Distributed Network Protocol cannot be made without express written agreement from the DNP Users Group or its duly authorized party. An update program for DNP documents is provided upon request by Harris Corporation on behalf of the DNP Users Group. 1 BINARY OUTPUT 5.2 16-BIT BINARY COUNTER 6. BINARY INPUT OBJECT DEFINITIONS 4.3 BINARY INPUT CHANGE WITHOUT TIME 4.00 Data Object Library (Version 0.5 BINARY INPUT CHANGE WITH RELATIVE TIME 5.4 BINARY INPUT CHANGE WITH TIME 4.02) vi vi vi vi vii vii 1-1 2-1 2-1 3-1 3-1 3-4 4-1 4-1 4-3 4-4 4-6 4-8 5-1 5-1 5-2 5-3 5-7 5-8 6-1 6-1 6-3 6-5 i .3 CONTROL RELAY OUTPUT BLOCK 5.1 LIBRARY STRUCTURE 3.3 32-BIT DELTA COUNTER DNP V3.2 BINARY OUTPUT STATUS 5.1 SINGLE-BIT BINARY INPUT 4.1 GENERAL 3.4 PATTERN CONTROL BLOCK 5.1 32-BIT BINARY COUNTER 6.2 POINT NUMBERING 4. DECLARATION RULES FOR INFORMATION ELEMENTS 2. COUNTER OBJECT DEFINITIONS 6.TABLE OF CONTENTS ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION WHO SHOULD USE THIS SPECIFICATION HELP AND ADDITIONAL DOCUMENTATION HOW THIS SPECIFICATION IS ORGANIZED CONVENTIONS USED IN THIS SPECIFICATION 1.2 BINARY INPUT WITH STATUS 4. BINARY OUTPUT OBJECT DEFINITIONS 5.5 PATTERN MASK 6. GENERAL RULES 3. OVERVIEW 2. 10 16-BIT FROZEN COUNTER 6.7 32-BIT FROZEN ANALOG INPUT WITH TIME OF FREEZE 7.11 32-BIT ANALOG CHANGE EVENT WITHOUT TIME ii 6-6 6-7 6-8 6-9 6-10 6-11 6-12 6-13 6-14 6-15 6-17 6-19 6-21 6-23 6-24 6-25 6-26 6-27 6-28 6-29 6-30 6-31 6-33 6-35 6-37 6-39 6-40 6-41 6-42 6-43 6-45 6-47 6-49 7-1 7-1 7-3 7-5 7-6 7-7 7-8 7-9 7-11 7-13 7-14 7-15 DNP Users Group .4 16-BIT ANALOG INPUT WITHOUT FLAG 7.34 16-BIT FROZEN COUNTER EVENT WITH TIME 6.5 32-BIT FROZEN ANALOG INPUT 7.8 16-BIT DELTA COUNTER WITHOUT FLAG 6.19 32-BIT FROZEN DELTA COUNTER WITHOUT FLAG 6.2 16-BIT ANALOG INPUT 7.5 32-BIT COUNTER WITHOUT FLAG 6.25 32-BIT COUNTER CHANGE EVENT WITH TIME 6.8 16-BIT FROZEN ANALOG INPUT WITH TIME OF FREEZE 7.35 32-BIT FROZEN DELTA COUNTER EVENT WITH TIME 6.32 16-BIT FROZEN DELTA COUNTER WITHOUT TIME 6.6.28 16-BIT DELTA COUNTER CHANGE EVENT WITH TIME 6.23 32-BIT DELTA COUNTER CHANGE EVENT WITHOUT TIME 6.27 32-BIT DELTA COUNTER CHANGE EVENT WITH TIME 6.21 32-BIT COUNTER CHANGE EVENT WITHOUT TIME 6.18 16-BIT FROZEN COUNTER WITHOUT FLAG 6.11 32-BIT FROZEN DELTA COUNTER 6.6 16-BIT FROZEN ANALOG INPUT 7.1 32-BIT ANALOG INPUT 7.12 16-BIT FROZEN DELTA COUNTER 6.24 16-BIT DELTA COUNTER CHANGE EVENT WITHOUT TIME 6.26 16-BIT COUNTER CHANGE EVENT WITH TIME 6.30 16-BIT FROZEN COUNTER EVENT WITHOUT TIME 6.9 32-BIT FROZEN ANALOG INPUT WITHOUT FLAG 7.10 16-BIT FROZEN ANALOG INPUT WITHOUT FLAG 7.15 32-BIT FROZEN DELTA COUNTER WITH TIME OF FREEZE 6.22 16-BIT COUNTER CHANGE EVENT WITHOUT TIME 6.36 16-BIT FROZEN DELTA COUNTER EVENT WITH TIME 7.29 32-BIT COUNTER CHANGE EVENT WITHOUT TIME 6. ANALOG INPUT OBJECT DEFINITIONS 7.3 32-BIT ANALOG INPUT WITHOUT FLAG 7.31 32-BIT FROZEN DELTA COUNTER EVENT WITHOUT TIME 6.7 32-BIT DELTA COUNTER WITHOUT FLAG 6.14 16-BIT FROZEN COUNTER WITH TIME OF FREEZE 6.6 16-BIT COUNTER WITHOUT FLAG 6.33 32-BIT FROZEN COUNTER EVENT WITH TIME 6.16 16-BIT FROZEN DELTA COUNTER WITH TIME OF FREEZE 6.9 32-BIT FROZEN COUNTER 6.13 32-BIT FROZEN COUNTER WITH TIME OF FREEZE 6.20 16-BIT FROZEN DELTA COUNTER WITHOUT FLAG 6.17 32-BIT FROZEN COUNTER WITHOUT FLAG 6.4 16-BIT DELTA COUNTER 6. 1 INTERNAL INDICATIONS 12.3 EXTENDED FLOATING POINT DNP V3.14 16-BIT ANALOG CHANGE EVENT WITH TIME 7.4 CLASS 3 DATA 11. TIME OBJECT DEFINITIONS 9.02) 7-17 7-19 7-21 7-23 7-25 7-27 7-29 8-1 8-1 8-3 8-4 8-5 9-1 9-1 9-2 9-4 9-5 9-6 9-7 10-1 10-1 10-2 10-3 10-4 11-1 11-1 12-1 12-1 12-2 12-4 12-7 12-8 13-1 13-1 14-1 14-1 14-4 14-6 iii . ANALOG OUTPUT OBJECT DEFINITIONS 8.2 16-BIT ANALOG OUTPUT STATUS 8.00 Data Object Library (Version 0.18 16-BIT FROZEN ANALOG EVENT WITH TIME 8.3 CLASS 2 DATA 10. DEVICE OBJECT DEFINITIONS 12.4 16-BIT ANALOG OUTPUT BLOCK 9.2 TIME AND DATE WITH INTERVAL 9.17 32-BIT FROZEN ANALOG EVENT WITH TIME 7.5 TIME DELAY COARSE 9.3 32-BIT ANALOG OUTPUT BLOCK 8.2 STORAGE OBJECT 12. APPLICATION OBJECT DEFINITIONS 13. FILE OBJECT DEFINITIONS 11.1 APPLICATION IDENTIFIER 14.1 FILE IDENTIFIER 12.13 32-BIT ANALOG CHANGE EVENT WITH TIME 7.1 SHORT FLOATING POINT 14.2 CLASS 1 DATA 10.2 LONG FLOATING POINT 14.4 UN-SYNCHRONIZED TIME AND DATE CTO 9.12 16-BIT CHANGE EVENT WITHOUT TIME 7. ALTERNATE NUMERIC OBJECT DEFINITIONS 14.16 16-BIT FROZEN ANALOG EVENT WITHOUT TIME 7.1 32-BIT ANALOG OUTPUT STATUS 8.1 TIME AND DATE 9.6 TIME DELAY FINE 10.3 TIME AND DATE CTO 9.3 DEVICE PROFILE 12.15 32-BIT FROZEN ANALOG EVENT WITHOUT TIME 7.1 CLASS 0 DATA 10.4 PRIVATE REGISTRATION OBJECT 12. CLASS OBJECT DEFINITIONS 10.7.5 PRIVATE REGISTRATION OBJECT DESCRIPTOR 13. 14.4 SMALL-PACKED BINARY CODED DECIMAL 14.6 LARGE-PACKED BINARY CODED DECIMAL LIST OF ABBREVIATIONS AND ACRONYMS 14-8 14-9 14-10 iv DNP Users Group .5 MEDIUM-PACKED BINARY CODED DECIMAL 14. 00 Data Object Library (Version 0.02) v .LIST OF TABLES TABLE 2-1 DATA TYPES TABLE 2-2 BIT POSITIONS 2-1 2-2 DNP V3. In the case of compound objects.TF) vi DNP Users Group . HELP AND ADDITIONAL DOCUMENTATION The following documentation may be helpful. implementers or engineers interested in the structure of application information objects used in the DNP Application Layer. the semantics of each component is described.00 Application Layer (P009-0PD. • DNP V3. • DNP V3.DL). The object syntax is specified as well as the semantics of each object.00 Data Link Layer (P009-0PD.ABOUT THIS DOCUMENT PURPOSE OF THIS SPECIFICATION This document defines coding specifications of Distributed Network Protocol (DNP) information elements or data objects used in the DNP Application Layer.00 Transport Functions (P009-0PD.APP) • DNP V3. WHO SHOULD USE THIS SPECIFICATION All programmers. Bit positions are numbered from 0 through n. DNP V3. 4. 3. ANALOG INPUT OBJECT DEFINITIONS 8. OVERVIEW 2. DEVICE OBJECT DEFINITIONS 13. DECLARATION RULES FOR INFORMATION ELEMENTS Covers the rules for construction and interpretation of the data objects. CLASS OBJECT DEFINITIONS 11. APPLICATION OBJECT DEFINITIONS 14. COUNTER OBJECT DEFINITIONS 7.02) vii . ALTERNATE NUMERIC OBJECT DEFINITIONS LIST OF ABBREVIATIONS AND ACRONYMS CONVENTIONS USED IN THIS SPECIFICATION This document deviates from the IEC conventions for bit position numbering. FILE OBJECT DEFINITIONS 12. BINARY OUTPUT OBJECT DEFINITIONS 6. TIME OBJECT DEFINITIONS 10. The rest of the sections provide detailed definitions of each type of object. 1.HOW THIS SPECIFICATION IS ORGANIZED This document is organized into 13 sections as outlined below. GENERAL RULES Describes the rules governing each of the currently defined objects. ANALOG OUTPUT OBJECT DEFINITIONS 9. with 0 to the top right and n to the bottom left.00 Data Object Library (Version 0. BINARY INPUT OBJECT DEFINITIONS 5. viii DNP Users Group . 00 Data Object Library (Version 0. are processed and stored as information objects and these can be packaged for transmission as application data units. These formats are described within this document. This document will be revised and new information elements or objects will be added as necessary. called information elements (IEC 870-5-3: General Structure of Application Data).1. DNP V3. and as authorized by the DNP User's Group. OVERVIEW The intelligent devices which use the DNP Application Layer protocol are capable of monitoring. controlling and/or producing a large number of different pieces of data both at the hardware and software levels. All devices provide stored information elements as information objects in the same format.02) 1-1 . These pieces of data. 1-2 DNP Users Group . OCTETSTRING Symbol UI I UF F R BS OS Meaning Positive whole number Positive or negative whole number Positive fixed point number Positive or negative fixed point number Positive or negative floating-point number Assembly of independent bits Assembly of octets 1 Table 2-1 Data Types 1 BOOLEAN is a BITSTRING of size 1. 2. as supported by the IEC 870-5-4. Data Type 1. REAL 6. These rules have been derived from the IEC TC57 870 series of standards or drafts.2. INTEGER 3. DECLARATION RULES FOR INFORMATION ELEMENTS 2.1 Data Types All data can be described in its most elemental form as a data type. as the basis of its descriptions.1 GENERAL This section describes the basic rules for the declaration of information elements. Device profile documents are used to indicate the exact origin and meaning of the data object for each telecontrol device.00 Data Object Library (Version 0.1. FIXED POINT 5. These rules provide an unambiguous means of describing and representing data irrespective of its origin. Table 2-1 lists the available data types and their meaning.02) 2-1 . UNSIGNED FIXED POINT 4. BITSTRING 7. DNP information elements use constructs. Data types are recognized as standard constructs used in most language compilers. DNP V3. UNSIGNED INTEGER 2. the bit allocations and the functional purpose of the individual data fields... within curly brackets.4 Element Value If applicable. and is a cardinal number that specifies the length of the data field in bits or octets as appropriate.2. The first declared data field begins with bit position 0. . . In general this is declared by the range of admitted values and by a term that identifies the used code. ASCII (ASCII). the sizes. . A following list declares the data types. a selected range and a selected code of values of the declared data field is denoted within angle brackets: <v1. The order of bits is shown in Table 2-2. . 8j-3 7 6 5 4 3 2 1 0 Data Size i 4 12 .1. Data size i.1. 8j-1 6 14 .5 Compound Elements Compound data fields are information elements composed of different data fields with successive bit allocations. . 2.1.3 Bit Position In defining information objects. 8j-4 3 11 . An example is: BS12 specifies a BITSTRING of 12 bits. is noted after the data type symbol notation. 8j-5 2 10 . which are a combination of information elements. . below.pn] . the other fields use successive bit allocations: 2-2 DNP Users Group . the position of individual bits can be significant. where p1 and pn denote the first and the last bits of the field. Terms that identify codes are: binary code (BIN). Compound data fields are declared by listing individual data fields separated by commas or listed in a column. 8j-6 1 9 . . The default code declaration is binary if no term is used. 8j-7 0 8 . 8j-8 Table 2-2 Bit Positions 2. . .2 Data Size Each information element is composed of a data type and a size. 8j-2 5 13 . etc.vn code>.1. 2. binary coded decimal (BCD). j 7 15 . BITS OCTETS 1 2 . The bit position of a specified field of data size i is denoted in square brackets [p1. 00 Data Object Library (Version 0. data field 2.i2] = function 2 etc...} DNP V3. Sequences of data fields are declared as compound data fields.i-1] data field 2 = data type 2 size i2[i1.02) 2-3 .i1+i2-1] = function 2 etc.} or = function 1 {data field 1 size i1[1..6 Sequence Elements Sequence data fields are information elements composed of different data fields..} 2..'Information Element = CPi {data field 1. .1.. data field 2.i1] data field 2 size i2[1..} or = function 1 {data field 1 = data type 1 size i1[0.. however each field begins bit allocation 0: 'Information Element = SQi {data field 1.. 2-4 DNP Users Group . DNP V3.00 Data Object Library (Version 0. These rules apply to all the current objects (except where noted) and all future objects. Frozen Static Objects: The objects which reflect the current frozen value of the field point or software point. These are as follows: 3. The objects 1 . 3. P009-0PD. The variation of this object gives a different representation of the same data point. Data is frozen as a result of the data freeze requests. All the classes of a different data type should also be organized in the same range of object numbers.1. as outlined below: • • • • Static Objects: The objects which reflect the current value of the field point or software point. (Refer to the DNP V3. the following groupings have been created for all traditional SCADA/DA data types and several non-traditional data types.1 Binary Input The binary input grouping contains all objects that represent binary (status or Boolean) input information.) Frozen Event Objects: The objects which are generated as a result of frozen data changing or some other stimulant.00 Application Layer.3.02) 3-1 . These are historical objects reflecting the value of data at some time in the past.9 are reserved for these objects. So far. such as the size of the object or whether or not the object has flag information. These are historical objects reflecting the value of changed data at some time in the past. Event Objects: The objects which are generated as a result of data changing or some other stimulant. GENERAL RULES This section will describe the general rules that apply to the DNP data objects.APP. Each category should be represented with a different object.1 LIBRARY STRUCTURE The DNP application layer has an 8-bit object and an 8-bit variation field used to denote the data object. The 8-bit object denotes a general type of data such as static binary data. There are generally four different categories of data within each data type. 3. The objects 10 .2 Binary Output The binary output grouping contains all objects that represent binary output or relay control information.7 Class The class grouping contains all objects that represent data classes or data priority. The objects 80 .6 Time The time grouping contains all objects that represent time in absolute or relative form in any resolution.9 Devices The devices grouping contains all objects that represent device (rather than point) information.79 are reserved for these objects.4 Analog Input The analog input grouping contains all objects that represent analog input information.89 are reserved for these objects.3.49 are reserved for these objects. The objects 20 . 3.39 are reserved for these objects.1. The objects 60 .8 Files The files grouping contains all objects that represent files or a file system. 3.3 Counters The counter grouping contains all objects that represent counters. 3. The objects 30 .5 Analog Output The analog output grouping contains all objects that represent analog output information. The objects 90 . The objects 50 .1. The objects 70 .99 are reserved for these objects.59 are reserved for these objects. 3.1. 3.1.1. 3.10 Applications The applications grouping contains all objects that represent software applications or operating system processes. The objects 40 .19 are reserved for these objects.69 are reserved for these objects. 3-2 DNP Users Group . 3.1.29 are reserved for these objects.1.1.1. The objects 110 . DNP V3. 3.3.00 Data Object Library (Version 0. Applications which use these object numbers may not be compatible with future versions of DNP.12 Future Expansion The future expansion grouping is reserved for future or custom expansion of the DNP protocol.02) 3-3 .13 Reserved The objects 0 and 255 are permanently reserved and should not be used to denote any DNP object.1.254 are reserved for these objects.109 are reserved for these objects.1. The objects 100 .1. 3.11 Alternate Numeric The alternate numeric grouping contains all objects that represent alternate or custom numeric representations. var 3. analog input. object x. 6. 7. point i in obj 20 var 1. When reported as an event. range 5 reports the same information. point i in obj 1 var 1 and 2 is the same point as point i in obj 2 var 1. (a) (b) Point i in the static object is the same physical point as point i in the event object. 4. For example: For binary inputs. analog output and counter groupings the following rules apply. RULE 2: Point i of object x can be reported in one of many variations (i. RULE 3: Point i within different objects of the same grouping are not necessarily unique. • Obj 20. Point i in the frozen object is the same physical point as point i in the frozen event object. 6. var 4. 2. and 4 is the same point as point i in obj 22 var 1. Rule 1: Point i of object x. only in 16-bit format. • Obj 20. 6. There is no direct correlation between frozen and non-frozen objects. only in 16-bit format. within each of the binary input. 4. 5. When responding to a request for Class data or variation 0 of object x. variation z. For counters. range 5 reports the same information. however an application should report only ONE event object in any one variation for each event. it can be a 16-bit or 32bit counter). and 8 (frozen and frozen static correlation). 5. 2 and 3 (static and event correlation). however. The exact variation to return is an application specific decision. 7. where y and z are variations of object x. 2. range 5 returns the running value of counter 5 in 32-bit format. 3.2 POINT NUMBERING The following rules apply to the interpretation of the object point number (DNP Application Layer range field) in conjunction with objects and variations. there should be only one variation of the object returned. point i in obj 21 var 1. and 8 is the same point as point i in obj 23 var 1. range 5 returns the number of counts accumulated in counter 5 since the last time it was reported.3. binary output. NOTE: Point i in obj 20 and point i in obj 21 are NOT necessarily the same point. and 8 (static and event correlation). point i can be returned in either one of the variations for that object. In addition. 2. DNP Users Group 3-4 . var 2. var 1. For example: A device has 16 running counters (object 20) numbered 0 to 15. 7. 5. 3. again in 32-bit format. 3. 3. Point 5 can be asked for in four different ways: • Obj 20. 4.e. variation y represents the same physical point as point i. 2. • Obj 20. DNP V3.Rule 4: Object groupings which can by definition or due to device limitation have only one point per object or where the point number is not needed should use the range number 0 or quantity equals to 1. when using a message format that requires a point number.02) 3-5 .00 Data Object Library (Version 0. 3-6 DNP Users Group . 4.4.Variation: 01 Type: Static Description: The single-bit binary input object is used to represent the state of a digital input point (hardware or software). BINARY INPUT OBJECT DEFINITIONS This section defines the binary input data objects using the rules established in section 2.1 BIN> Narrative: This single-bit binary input representation is used to transmit binary input states in a packed format.02) 4-1 .0] State = BS1 [0] <0..00 Data Object Library (Version 0. Transmission of the data object is always performed in complete octets with unoccupied bit positions set to zero. DECLARATION RULES FOR INFORMATION ELEMENTS. The following example illustrates the packing of n of these data objects.1 SINGLE-BIT BINARY INPUT Data Object 01 . Object Coding: 0 BS1 [0. 7 15 6 14 5 13 4 12 3 11 2 10 1 9 0 8 0 0 0 n n-1 n-2 n-3 n-4 DNP V3. (i. bits which are part of the binary input with status variation. 4-2 DNP Users Group . etc. restart. are not part of this variation.NOTE: This variation contains no point status information. The use of the single-bit binary input variation implies that the point is on-line and all other status bits are clear. communication lost. bits are cleared). on-line.e. restart. For example. etc. 1.7] On-line Restart Communication lost Remote forced data Local forced data Chatter filter Reserved State = = = = = = = = BS1 [0] <0. 1 BIN> DNP V3. and also indicates the status of the point as follows: The on-line bit indicates that the binary input point has been read successfully. This device may be the device reporting this data object. forced> BS1 [4] <0. restart> BS1 [2] <0. 1. The communication lost bit indicates that the device reporting this data object has lost communication with the originator of the data object. The state bit indicates the current state of the binary input point. normal. 1. If this field is set to off-line. on-line> BS1 [1] <0. The remote forced data bit indicates that the state of the binary input has been forced to its current state at a device other than the end device. The chatter filter bit indicates that the binary input point has been filtered in order to remove unneeded transitions in the state of the point. 1. forced> BS1 [5] <0. normal. normal. Object Coding: 7 6 5 4 3 2 1 0 BS8 [0..4. off-line.02) 4-3 . the state of the digital point may not be correct. normal.Variation: 02 Type: Static Description: The binary input with status object is used to represent the state of a digital input point (hardware or software). The local forced data bit indicates that the state of the binary input has been forced to its current state at the end device. 1. filter on> BS1 [6] <0> BS1 [7] <0.00 Data Object Library (Version 0. 1. normal.2 BINARY INPUT WITH STATUS Data Object 01 . lost> BS1 [3] <0. The restart bit indicates that the field device that originated the data object is currently restarting. 4-4 DNP Users Group .3 BINARY INPUT CHANGE WITHOUT TIME Data Object 02 . The state bit indicates the current changed state of the binary input point. the state of the digital point may not be correct. The chatter filter bit indicates that the binary input point has been filtered in order to remove unneeded transitions in the state of the point.Variation: 01 Type: Event Description: The binary input change without time object is used to represent the changed state of a digital input point (hardware or software) and also indicates the status of the point as follows: The on-line bit indicates that the binary input point has been read successfully. The communication lost bit indicates that the device reporting this data object has lost communication with the originator of the data object. The restart bit indicates that the field device that originated the data object has been re-started. The local forced data bit indicates that the state of the binary input has been forced to its current state at the device reporting this data object. If this field is set to off-line. This device may be the device reporting this data object.4. The remote forced data bit indicates that the state of the binary input has been forced to its current state at the originating device. 1.1 BIN> Narrative: This object is only reported when the current value is different than the last recorded or measured value. 1. normal. 1. forced> BS1 [5] <0. normal. forced> BS1 [4] <0. If the chatter filter is on. on-line> BS1 [1] <0. 1.7] On-line Restart Communication lost Remote forced data Local forced data Chatter filter Reserved State = = = = = = = = BS1 [0] <0. 1. 1. normal. normal. normal.Object Coding: 7 6 5 4 3 2 1 0 BS8 [0. lost> BS1 [3] <0.02) 4-5 . DNP V3. filter on> BS1 [6] <0> BS1 [7] <0. this object may only be reported when the new state has remained constant for a certain period of time. off-line.00 Data Object Library (Version 0. restart> BS1 [2] <0.. The remote forced data bit indicates that the state of the binary input has been forced to its current state at the originating device. the state of the digital point may not be correct. The accuracy of this time will depend on the accuracy of the individual device. The restart bit indicates that the field device that originated the data object has been re-started. The chatter filter bit indicates that the binary input point has been filtered in order to remove unneeded transitions in the state of the point.Variation: 02 Type: Event Description: The binary input change with time object is used to represent the changed state of a digital input point (hardware or software) and the time at which the state changed. It also indicates the status of the point as follows: The on-line bit indicates that the binary input point has been read successfully. The state bit indicates the current changed state of the binary input point. This device may be the device reporting this data object.4. The communication lost bit indicates that the device reporting this data object has lost communication with the originator of the data object.4 BINARY INPUT CHANGE WITH TIME Data Object 02 . The local forced data bit indicates that the state of the binary input has been forced to its current state at the device reporting this data object. 4-6 DNP Users Group . If this field is set to off-line. The Time of Occurrence indicates the absolute time at which the telecontrol device detected the change of state. lost> BS1 [3] <0. zero minutes. 1. 1. DNP V3. normal. forced> BS1 [5] <0.02) 4-7 . forced> BS1 [4] <0. normal..47] <248 -1 ms> BS8 [0. 1. 1970. January 1st. 1. off-line.1 BIN> Narrative: Time of occurrence is recorded as milliseconds since midnight. normal.. restart> BS1 [2] <0. normal. 1.00 Data Object Library (Version 0. and milliseconds. 1.Object Coding: FLAG 7 6 5 4 3 2 1 0 TIME OF OCCURRENCE 7 15 23 31 39 47 6 14 22 30 38 46 5 13 21 29 37 45 4 12 20 28 36 44 3 11 19 27 35 43 2 10 18 26 34 42 1 9 17 25 33 41 0 8 16 24 32 40 SQ2 {FLAG = Time of Occurrence = } FLAG On-line Restart Communication lost Remote forced data Local forced data Chatter filter Reserved State } ={ = = = = = = = = BS8 [0..7] BS1 [0] <0. filter on> BS1 [6] <0> BS1 [7] <0.7] UI48 [0. seconds. on-line> BS1 [1] <0. normal. at zero hours. The accuracy of this time will depend on the accuracy of the individual device. The MSEC field indicates the relative time at which the telecontrol device detected the change of state. This device may be the device reporting this data object. 4-8 DNP Users Group .4. If this field is set to off-line. The local forced data bit indicates that the state of the binary input has been forced to its current state at the device reporting this data object. The state bit indicates the current changed state of the binary input point.5 BINARY INPUT CHANGE WITH RELATIVE TIME Data Object 02 . the state of the digital point may not be correct. The remote forced data bit indicates that the state of the binary input has been forced to its current state at the originating device. The restart bit indicates that the field device that originated the data object has been re-started. It also indicates the status of the point as follows: The on-line bit indicates that the binary input point has been read successfully. The communication lost bit indicates that the device reporting this data object has lost communication with the originator of the data object.Variation: 03 Type: Event Description: The binary input change with relative time object is used to represent the changed state of a digital input point (hardware or software). The chatter filter bit indicates that the binary input point has been filtered in order to remove unneeded transitions in the state of the point. and the relative time at which the state changed. forced> BS1 [4] <0. 1.02) 4-9 .7] UI16 [0. DNP V3. 1. The relative time in each binary input object is added to the CTO absolute time to give the absolute time at which the binary input change was detected by the device. on-line> BS1 [1] <0.Object Coding: FLAG 7 6 5 4 3 2 1 0 MSEC 7 15 6 14 5 13 4 12 3 11 2 10 1 9 0 8 SQ2 {FLAG MSEC } FLAG On-line Restart Communication lost Remote forced data Local forced data Chatter filter Reserved State } = = ={ = = = = = = = = BS8 [0. 1..7] BS1 [0] <0. 1..15] <0. 1. lost> BS1 [3] <0.1 BIN> Narrative: This object MUST be preceded by an absolute time object (common time object or CTO) or an unsynchronized CTO in the DNP Application Layer message. restart> BS1 [2] <0. normal. The CTO is used as an absolute time base for all following binary input change with relative time objects. normal. normal. normal. forced> BS1 [5] <0. off-line.216-1> BS8 [0. filter on> BS1 [6] <0> BS1 [7] <0. normal. 1...00 Data Object Library (Version 0. 4-10 DNP Users Group . The following example illustrates the packing of n of these data objects: 7 15 6 14 5 13 4 12 3 11 2 10 1 9 0 8 0 0 0 n n-1 n-2 n-3 n-4 DNP V3.5. Object Coding: 0 BS1 [0. The state bit indicates the desired logic state of the digital output point.1 BINARY OUTPUT Data Object 10 . DECLARATION RULES FOR INFORMATION ELEMENTS.0] State = BS1 [0] <0. with unoccupied bit positions set to zero.1 BIN> Narrative: Transmission of the data object is always pre-formed in complete octets..Variation: 01 Type: Static Description: The binary output object is used to control a digital output point (hardware or software). BINARY OUTPUT OBJECT DEFINITIONS This section defines the binary output data objects using the rules established in section 2.02) 5-1 . 5.00 Data Object Library (Version 0. A binary output command to this point should work correctly.5.7] On-line Restart Communication lost Remote forced data Local forced data Reserved Reserved State = = = = = = = = BS1 [0] <0. normal.Variation: 02 Type: Static Description: The binary output status object is used to indicate the current state of a controlled digital point and the status of that point as follows: The on-line bit indicates that the device controlling the binary output point is operating correctly. The state bit indicates the current state of the binary output point. forced> BS1 [4] <0. on-line> BS1 [1] <0. a binary output command to this point would be unsuccessful. 1. normal.1 BIN> 5-2 DNP Users Group .2 BINARY OUTPUT STATUS Data Object 10 .. The restart bit indicates that the field device that originated the data object has been re-started. The communication lost bit indicates that the digital output point could not be controlled because communications have been lost with the controlled device. The remote forced data bit indicates that the digital output point has been controlled at the originating device and the current state is in the state bit. 1. restart> BS1 [2] <0. normal. This device may be the device reporting this data object. The local forced data bit indicates that the digital output point has been controlled at this device and the current state is in the state bit. If this field is set to off-line. normal. 1. 1. 1. off-line. forced> BS1 [5] <0> BS1 [6] <0> BS1 [7] <0. Object Coding: 7 6 5 4 3 2 1 0 BS8 [0. lost> BS1 [3] <0. 00 Data Object Library (Version 0.5. These parameters define the type and duration of the digital output. The off-time field specifies the amount of time the digital output is to be turned off (may not apply to all control types). The on-time field specifies the amount of time the digital output is to be turned on (may not apply to all control types). The applicability of this code will depend on the type of hardware used in the end device.02) 5-3 . DNP V3. The count field indicates the number of times that the control operation should be performed in succession.Variation: 01 Type: Static Description: The control relay output Block information object contains digital output control parameters.3 CONTROL RELAY OUTPUT BLOCK Data Object 12 . The control code field indicates the control function to perform. as this is an illegal operation for the system.. Trip> Narrative: Trip/Close: This field determines which control relay to activate in a system where a trip and close relay pair is used to energize and de-energize the field points.. This field does not support having both the trip and close attributes simultaneously. normal.. The NUL value in this field can be used to activate the field point select relay only without activating the trip or close relays. 5-4 DNP Users Group . this field should always be NUL to indicate a normal digital control operation where the exact control point is inherently known.232-1.. Close. 1.7] <00. ms> UI32 [0. clear> BS2 [6. NUL.232-1.3] <0. 10.127> [0...7] UI8 [0...... In a system without trip/close relays. requeued> BS1 [5] <0.31] <0.7] <0.255> UI32 [0. ms> UI7 [0.0] <0..1> BS4 [0. In a system without field point select relays. 1. the NUL value would not perform any control operation.31] <0.15> BS1 [4] <0.Object Coding: Control Code 7 6 5 4 3 2 1 0 Count 7 6 5 4 3 2 1 0 On Time 31 Off Time 31 Status 7 6 5 4 3 2 1 0 0 0 SQ4 {Control code Count On-time Off-time Status Reserved } Control code Code Queue Clear Trip/Close } ={ = = = = = = = = = = BS8 [0... 01. normal.6] <0. This latches the point(s) off. In the former. Place operation at the back of the control queue when complete.Count: The Count field determines how many times the control is executed. and the queue is cleared of all controls including the presently running control if the clear attribute is set. each control is performed until completion before the next control is accepted for that point. If the control block for that operation had the queue attribute set. When the count reaches 0. the control operation is re-queued (to the back of the queue) for that point. Latch Off . The meaning of the code field and the operation to perform is determined by the following: 0: 1: 2: 3: 4: 5 . Pulse On . then turned on for the specified on-time and left in the on state. do not execute the control.This latches the point(s) on.02) 5-5 . Cancel currently running operation and remove queued operations on affected points immediately before activating this new operation (if not NUL).00 Data Object Library (Version 0. When the control function is executed and completed. Latch On . any control command should be queued for the particular point in question. In the latter. If the count is 0. The control block can be used with devices which support control queuing on a point per point basis or devices which have other control mechanisms.The point(s) is turned off for the specified off-time. the control is complete. Undefined. If the control code is NUL then no control operation is queued.The point(s) is turned on for the specified on-time. Pulse Off . it is removed from the queue. Code: Queue: Clear: If the control operation has the clear attribute set. DNP V3. all control operations are removed from the queue including the presently running control and this control operation is performed. No operation specified.15: Queue: Clear: NUL operation. turned off for the specified off-time and left in the off state. Only the R attribute is processed. The meaning of this field is determined as follows: 0: 1: Request accepted. The arm timer was started when the select operation for the same point was received. No previous matching select message (i. 5-6 DNP Users Group . Request not accepted as the operate message was received after the arm timer timed out. or direct operate). 2: 3: 4: 5: 6: 7 . Request not accepted. Request not accepted because of control hardware problems. The success or failure of the requested control operation is returned in the status field. Control operation not supported for this point. as the control queue is full or the point is already active. or queued. initiated.127:Undefined. Request not accepted as there were formatting errors in the control request (either select.e. an operate message was sent to activate a control point that was not previously armed with the select message. operate.The reserved bit of the control point after the operation can be determined if the control output is on. and parameters are identical to the control relay output block except that the queuing attributes are not valid.Variation: 02 Type: Static Description: The pattern control block (PCB) object contains digital output control parameters for pattern type controls. The meaning of all fields. The PCB object defines all the parameters for the subsequent pattern mask objects which follow this object in the message.02) 5-7 .4 PATTERN CONTROL BLOCK Data Object 12 . Object Coding: Control Code 7 6 5 4 Count 7 6 5 4 3 2 1 0 3 2 1 0 On Time 31 Off Time 31 Status 7 6 5 4 3 2 1 0 0 0 DNP V3. All these controls must be performed in parallel.00 Data Object Library (Version 0. These parameters define the type and duration of the digital output for each of the affected points. This is.e. These parameters contained in the PCB influence all the pattern mask object(s) that immediately follow the PCB object. the pattern control is not meant to be re-queued. the same operation on different points). The combination of this object and the pattern mask objects that follow will specify a number (0 or more) of control operations to perform (i. attributes. until the next PCB in the message.5. This object is used in conjunction with the PCB object to specify both the control points to operate and the parameters that determine the control operation.5.0] Mask = BS1 [0] <0. The following example illustrates the packing of n of these data objects. then the parameters specified in the preceding PCB are applied to a specified point for each pattern mask object and a control operation is generated for the point.5 PATTERN MASK Data Object 12 .. inactive. active> Narrative: This single-bit pattern mask is typically sent in groups. If the mask bit is set to active. Object Coding: M BS1 [0. 1. Transmission of the data object is always performed in complete octets with unoccupied bit positions set to zero. 7 15 6 14 5 13 4 12 3 11 2 10 1 9 0 8 0 0 0 n n-1 n-2 n-3 n-4 5-8 DNP Users Group .Variation: 03 Type: Static Description: The pattern mask object is used to select from a range of possible control points that have to be executed in parallel. This value increments indefinitely until a counter clear operation is performed in which case the value is reset to 0.. with the following inclusion: • When set. This bit is cleared when the counter value (plus the roll-over state) is reported. This can be accumulated pulses or transitions from a hardware or software point.02) 6-1 .Variation: 01 Type: Static Description: The 32-bit binary counter represents an accumulated value. DNP V3. DECLARATION RULES FOR INFORMATION ELEMENTS. The counter value has been reset to 0 upon the rollover and counting has resumed as normal. The flag field has the same meaning as in previous objects. COUNTER OBJECT DEFINITIONS This section defines the counter data objects using the rules established in section 2. 6.00 Data Object Library (Version 0.1 32-BIT BINARY COUNTER Data Object 20 . the roll-over bit indicates that the accumulated value has exceeded the last reported recordable value (232-1). The value field shows the current value of the counter at the time of reporting or last reported value from the originating device.6. normal. normal. normal. normal. restart> BS1 [2] <0. 1. 1.. forced> BS1 [4] <0. 1. 1. roll-over> BS1 [6] <0> BS1 [7] <0> 6-2 DNP Users Group . lost> BS1 [3] <0. roll-over> BS1 [5] <0.. 1. 1. normal.31] <0. off-line. forced> BS1 [4] <0.. 1. on-line> BS1 [1] <0.7] UI32 [0.232-1> BS1 [0] <0. normal.Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 31 0 SQ2 {FLAG Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. 2 16-BIT BINARY COUNTER Data Object 20 . This value increments indefinitely until a counter clear operation is performed in which case the value is reset to 0. DNP V3.00 Data Object Library (Version 0. The counter value has been reset to 0 upon roll-over. and counting has resumed as normal.02) 6-3 . the roll-over bit indicates that the accumulated value has exceeded the maximum possible recordable value (216-1). The value field shows the current value of the counter at the time of reporting or last reported value from the originating device. with the following inclusion: • When set.Variation: 02 Type: Static Description: The 16-bit binary counter represents an accumulated value. The flag field has the same meaning as in previous objects.6. This bit is cleared when the counter value (plus the roll-over state) is reported. This can be accumulated pulses or transitions from a hardware or software point. normal. 1. 1. normal. roll-over> BS1 [6] <0> BS1 [7] <0> 6-4 DNP Users Group . restart> BS1 [2] <0.. 1.7] UI16 [0. lost> BS1 [3] <0. on-line> BS1 [1] <0.. 1. normal. normal. 1. roll-over> BS1 [5] <0.15] <0.. 1. normal. normal. off-line. forced> BS1 [4] <0. 1.Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 15 0 SQ2 {FLAG Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. forced> BS1 [4] <0.216-1> BS1 [0] <0. 1. normal. normal. normal. forced> BS1 [4] <0. and counting has resumed as normal. This can be accumulated pulses or transitions from a hardware or software point. roll-over> BS1 [6] <0> BS1 [7] <0> DNP V3. on-line> BS1 [1] <0. normal..02) 6-5 .7] UI32 [0.6. 1.. 1. Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 31 0 SQ2 {FLAG Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. The counter value has been reset to 0 upon roll-over. The flag field has the same meaning as in previous objects. roll-over> BS1 [5] <0. off-line.Variation: 03 Type: Static Description: The 32-bit delta counter represents a value that has accumulated since the last value was reported.. 1. The value field shows the current value of the counter at the time of reporting or last reported value from the originating device. This bit is cleared when the counter value (plus the roll-over state) is reported.00 Data Object Library (Version 0. 1. normal. forced> BS1 [4] <0. lost> BS1 [3] <0.3 32-BIT DELTA COUNTER Data Object 20 . with the following inclusion: • When set. This value increments until it is reported at which point it is reset to 0. 1. the roll-over bit indicates that the accumulated value has exceeded the maximum possible recordable value (232-1). restart> BS1 [2] <0.232-1> BS1 [0] <0. 1. normal.31] <0. normal. normal. lost> BS1 [3] <0. roll-over> BS1 [6] <0> BS1 [7] <0> 6-6 DNP Users Group . normal. This can be accumulated pulses or transitions from a hardware or software point. 1. restart> BS1 [2] <0. The counter value has been reset to 0 upon the roll-over and counting has resumed as normal. roll-over> BS1 [5] <0. with the following inclusion: • When set. 1. forced> BS1 [4] <0.6. 1. 1. normal. the roll-over bit indicates that the accumulated value has exceeded the maximum possible recordable value (216-1). forced> BS1 [4] <0. Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 15 0 SQ2 {FLAG Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. This value increments until it is reported at which point it is reset to 0.7] UI16 [0. 1. normal..216-1> BS1 [0] <0. The value field shows the current value of the counter at the time of reporting or last reported value from the originating device. This bit is cleared when the counter value (plus the roll-over state) is reported. off-line.. normal. The flag field has the same meaning as in previous objects. 1. on-line> BS1 [1] <0..4 16-BIT DELTA COUNTER Data Object 20 .Variation: 04 Type: Static Description: The 16-bit delta counter represents a value that has accumulated since the last value was reported. 1.15] <0. this variation implies that flag = 1).5 32-BIT COUNTER WITHOUT FLAG Data Object 20 .31] <0. This value increments indefinitely until a counter clear operation is performed in which case the value is reset to 0. Object Coding: Value 31 0 SQ2 {Value = } UI32 [0. DNP V3.e. This can be accumulated pulses or transitions from a hardware or software point.02) 6-7 ..232-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i.00 Data Object Library (Version 0..6. The value field shows the current value of the counter at the time of reporting or last reported value from the originating device.Variation: 05 Type: Static Description: The 32-bit binary counter represents an accumulated value. 6-8 DNP Users Group .Variation: 06 Type: Static Description: The 16-bit binary counter represents an accumulated value.6. This can be accumulated pulses or transitions from a hardware or software point.6 16-BIT COUNTER WITHOUT FLAG Data Object 20 .. this variation implies that flag = 1). Object Coding: Value 15 0 SQ2 {Value = } UI16 [0.e..15] <0.216-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i. The value field shows the current value of the counter at the time of reporting or last reported value from the originating device. This value increments indefinitely until a counter clear operation is performed in which case the value is reset to 0. 02) 6-9 . Object Coding: Value 31 0 SQ2 {Value = } UI32 [0.00 Data Object Library (Version 0.7 32-BIT DELTA COUNTER WITHOUT FLAG Data Object 20 .e.. The value field shows the current value of the counter at the time of reporting or last reported value from the originating device.6.31] <0. This value increments until it is reported at which point it is reset to 0. DNP V3.Variation: 07 Type: Static Description: The 32-bit delta counter represents a value that has accumulated since the last value was reported.. This can be accumulated pulses or transitions from a hardware or software point. this variation implies that flag = 1).232-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i. . 6-10 DNP Users Group .216-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i. this variation implies that flag = 1). This can be accumulated pulses or transitions from a hardware or software point. The value field shows the current value of the counter at the time of reporting or last reported value from the originating device.8 16-BIT DELTA COUNTER WITHOUT FLAG Data Object 20 .. Object Coding: Value 15 0 SQ2 {Value = } UI16 [0.6.Variation: 08 Type: Static Description: The 16-bit delta counter represents a value that has accumulated since the last value was reported. This value increments until it is reported at which point it is reset to 0.e.15] <0. 7] UI32 [0. normal. 1.6. 1.31] <0. 1. The flag field has the same meaning as in previous objects. roll-over> BS1 [6] <0> BS1 [7] <0> DNP V3. off-line.232-1> BS1 [0] <0. The frozen value shows the value of the counter when the last counter freeze was performed at the originating device..00 Data Object Library (Version 0. forced> BS1 [4] <0. normal. roll-over> BS1 [5] <0. normal.9 32-BIT FROZEN COUNTER Data Object 21 . normal. restart> BS1 [2] <0. 1. normal. 1. on-line> BS1 [1] <0. 1.. Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 31 0 SQ2 {FLAG Frozen Value FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. 1.Variation: 01 Type: Frozen Static Description: The 32-bit frozen counter is a compound information object which contains information about a counter which was previously frozen.02) 6-11 . forced> BS1 [4] <0.. lost> BS1 [3] <0. normal. roll-over> BS1 [5] <0.216-1> BS1 [0] <0. 1. normal.15] <0.. lost> BS1 [3] <0. restart> BS1 [2] <0. 1. Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 15 0 SQ2 {FLAG Frozen Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. The counter accumulates pulses or transitions from a hardware or software point. The frozen value shows the value of the counter when the last counter freeze was performed at the originating device.6. 1. 1. forced> BS1 [4] <0. on-line> BS1 [1] <0.Variation: 02 Type: Frozen Static Description: The 16-bit frozen counter is a compound information object that contains information about a counter that was previously frozen. 1.. The flag field has the same meaning as in previous objects. normal.7] UI16 [0. 1. off-line. normal. roll-over> BS1 [6] <0> BS1 [7] <0> 6-12 DNP Users Group . forced> BS1 [4] <0.10 16-BIT FROZEN COUNTER Data Object 21 . normal. 1. normal.. normal. Variation: 03 Type: Frozen Static Description: The 32-bit frozen delta counter represents a frozen value that has accumulated since the last value was reported. 1. Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 31 0 SQ2 {FLAG Frozen Value FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. 1. 1.. normal. normal.7] UI32 [0. 1.11 32-BIT FROZEN DELTA COUNTER Data Object 21 . The frozen value shows the value of the counter when the last counter freeze was performed at the originating device. This can be accumulated pulses or transitions from a hardware or software point. normal. roll-over> BS1 [5] <0.00 Data Object Library (Version 0. off-line. 1.232-1> BS1 [0] <0. 1. lost> BS1 [3] <0.. roll-over> BS1 [6] <0> BS1 [7] <0> DNP V3. on-line> BS1 [1] <0. normal. The flag field has the same meaning as in previous objects. forced> BS1 [4] <0.31] <0. normal. normal. 1. restart> BS1 [2] <0.02) 6-13 .6. forced> BS1 [4] <0.. normal. This can be accumulated pulses or transitions from a hardware or software point. lost> BS1 [3] <0. 1.Variation: 04 Description: The 16-bit frozen delta counter represents a frozen value that has accumulated since the last value was reported. 1. The frozen value shows the value of the counter when the last counter freeze was performed at the originating device. 1.7] UI16 [0. 1. 1. normal. forced> BS1 [4] <0. 1. normal.. normal. roll-over> BS1 [6] <0> BS1 [7] <0> 6-14 DNP Users Group .12 16-BIT FROZEN DELTA COUNTER Data Object 21 . forced> BS1 [4] <0. on-line> BS1 [1] <0. The flag field has the same meaning as in previous objects. normal.15] <0. roll-over> BS1 [5] <0.216-1> BS1 [0] <0. restart> BS1 [2] <0. 1.6. Object Coding: FLAG 7 6 5 4 3 2 1 0 Type: Frozen Static Frozen Value 15 0 SQ2 {FLAG Frozen Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0.. off-line. normal.. 13 32-BIT FROZEN COUNTER WITH TIME OF FREEZE Data Object 21 . The flag field has the same meaning as in previous objects.6. The time of freeze field contains a time that this object was frozen.00 Data Object Library (Version 0. The frozen value shows the value of the counter when the time was time of freeze. DNP V3. The counter accumulates pulses or transitions from a hardware or software point.Variation: 05 Type: Frozen Static Description: The 32-bit frozen counter with time of freeze is a compound information object which contains information about a counter which was previously frozen. This time corresponds to the frozen value so that the current value of this object at time of freeze is frozen value.02) 6-15 . and milliseconds. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time of freeze is recorded as milliseconds since midnight. normal. forced> BS1 [4] <0. normal.Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 31 Time of Freeze 47 0 0 SQ4 {FLAG Frozen value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. normal. normal. normal. on-line> BS1 [1] <0. 1...7] UI32 [0.. seconds.232-1> UI48 [0. zero minutes. 1970. 1. off-line. roll-over> BS1 [5] <0. 1. 6-16 DNP Users Group .47] <248 -1 ms> BS1 [0] <0.31] <0. at zero hours. January 1st. restart> BS1 [2] <0. 1. normal. lost> BS1 [3] <0.. 1. 1. forced> BS1[4] <0. 1. The flag field has the same meaning as in previous objects. DNP V3.14 16-BIT FROZEN COUNTER WITH TIME OF FREEZE Data Object 21 .6.Variation: 06 Type: Frozen Static Description: The 16-bit frozen counter with time of freeze is a compound information object which contains information about a counter which was previously frozen. The time of freeze field contains a time that this object was frozen.00 Data Object Library (Version 0. The counter accumulates pulses or transitions from a hardware or software point. This time corresponds to the frozen value so that the current value of this object at time of freeze is frozen value. The frozen value shows the value of the counter when the time was time of freeze.02) 6-17 . zero minutes. on-line> BS1 [1] <0. normal. forced> BS1 [4] <0. roll-over> BS1 [5] <0.. 1. 1. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time of freeze is recorded as milliseconds since midnight. 1970.. lost> BS1 [3] <0. 1. off-line. normal.15] <0. and milliseconds. 1.. forced> BS1[4] <0.7] UI16 [0. January 1st. restart> BS1 [2] <0.Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 15 Time of Freeze 47 0 0 SQ4 {FLAG Frozen value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. seconds.. normal. normal.216-1> UI48 [0.47] <248 -1 ms> BS1 [0] <0. normal. 1. 6-18 DNP Users Group . 1. normal. at zero hours. 1. 02) 6-19 .00 Data Object Library (Version 0. The time of freeze field contains a time that this object was frozen.6.Variation: 07 Type: Frozen Static Description: The 32-bit frozen delta counter with time of freeze represents a frozen value that has accumulated since the last value was reported. The frozen value shows the value of the counter when the time was time of freeze. DNP V3. The flag field has the same meaning as in previous objects.15 32-BIT FROZEN DELTA COUNTER WITH TIME OF FREEZE Data Object 21 . This can be accumulated pulses or transitions from a hardware or software point. This time corresponds to the frozen value so that the current value of this object at time of freeze is frozen value. on-line> BS1 [1] <0. normal.47] <248 -1 ms> BS1 [0] <0. 1... January 1st. 1..232-1> UI48 [0.31] <0. and milliseconds.7] UI32 [0. 1970.Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen value 31 Time of Freeze 47 0 0 SQ4 {FLAG Frozen value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. restart> BS1 [2] <0. 1. 1. at zero hours. normal. 1. normal. 1. roll-over> BS1 [5] <0. forced> BS1 [4] <0. lost> BS1 [3] <0. seconds. 1. forced> BS1 [4] <0. 6-20 DNP Users Group . zero minutes. normal. normal. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time of freeze is recorded as milliseconds since midnight. normal.. off-line. The time of freeze field contains a time that this object was frozen. This time corresponds to the frozen value so that the current value of this object at time of freeze is frozen value.16 16-BIT FROZEN DELTA COUNTER WITH TIME OF FREEZE Data Object 21 . The frozen value shows the value of the counter when the time was time of freeze.02) 6-21 . This can be accumulated pulses or transitions from a hardware or software point.Variation: 08 Type: Frozen Static Description: The 16-bit frozen delta counter with time of freeze represents a frozen value that has accumulated since the last value was reported. DNP V3. The flag field has the same meaning as in previous objects.6.00 Data Object Library (Version 0. Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen value 15 Time of Freeze 47 0 0 SQ4 {FLAG Frozen value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. off-line.216-1> UI48 [0.. January 1st. 1. normal. normal. 1. 1. 1970. roll-over> BS1 [5] <0. 1. at zero hours. seconds. and milliseconds.7] UI16 [0. on-line> BS1 [1] <0. zero minutes. 1... normal. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time of freeze is recorded as milliseconds since midnight. normal.. restart> BS1 [2] <0. 1.47] <248 -1 ms> BS1 [0] <0. 1. normal. lost> BS1 [3] <0.15] <0. forced> BS1 [4] <0. 6-22 DNP Users Group . normal. forced> BS1 [4] <0. . The frozen value shows the value of the counter when the last counter freeze was performed at the originating device.17 32-BIT FROZEN COUNTER WITHOUT FLAG Data Object 21 . this variation implies that flag = 1)..Variation: 09 Type: Frozen Static Description: The 32-bit frozen counter is a compound information object which contains information about a counter which was previously frozen. Object Coding: Frozen Value 31 0 SQ2 {Frozen Value = } UI32 [0.232-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i.00 Data Object Library (Version 0.31] <0.02) 6-23 .e. DNP V3.6. 6. Object Coding: Frozen Value 15 0 SQ2 {Frozen Value } = UI16 [0.e.Variation: 10 Type: Frozen Static Description: The 16-bit frozen counter is a compound information object which contains information about a counter which was previously frozen.216-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i.18 16-BIT FROZEN COUNTER WITHOUT FLAG Data Object 21 . this variation implies that flag = 1).. 6-24 DNP Users Group ..15] <0. The counter accumulates pulses or transitions from a hardware or software point. The frozen value shows the value of the counter when the last counter freeze was performed at the originating device. 232-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i.e.00 Data Object Library (Version 0.19 32-BIT FROZEN DELTA COUNTER WITHOUT FLAG Data Object 21 .Variation: 11 Type: Frozen Static Description: The 32-bit frozen delta counter represents a frozen value that has accumulated since the last value was reported. The frozen value shows the value of the counter when the last counter freeze was performed at the originating device.31] <0.. this variation implies that flag = 1).6. DNP V3..02) 6-25 . Object Coding: Frozen Value 31 0 SQ2 {Frozen Value = } UI32 [0. This can be accumulated pulses or transitions from a hardware or software point. This can be accumulated pulses or transitions from a hardware or software point. Object Coding: Frozen Value 15 0 SQ2 {Frozen Value = } UI16 [0. this variation implies that flag = 1).216-1> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i. The frozen value shows the value of the counter when the last counter freeze was performed at the originating device..6.15] <0.e..Variation: 12 Type: Frozen Static Description: The 16-bit frozen delta counter represents a frozen value that has accumulated since the last value was reported.20 16-BIT FROZEN DELTA COUNTER WITHOUT FLAG Data Object 21 . 6-26 DNP Users Group . on-line> BS1 [1] <0.7] UI32 [0. normal.00 Data Object Library (Version 0. roll-over> BS1 [6] <0> BS1 [7] <0> DNP V3. roll-over> BS1 [5] <0. 1. 1.02) 6-27 . normal. 1. Object Coding: FLAG 7 6 5 4 3 2 1 0 Current value 31 0 SQ4 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. forced> BS1 [4] <0. The current value field shows the value of the counter which generated the event. The flag field has the same meaning as in previous objects. 1. normal.21 32-BIT COUNTER CHANGE EVENT WITHOUT TIME Data Object 22 ...6.Variation: 01 Type: Event Description: The 32-bit counter change event without time represents a counter value that. has exceeded a configured count. 1. normal.232-1> BS1 [0] <0. off-line. This can be accumulated pulses or transitions from a hardware or software point. lost> BS1 [3] <0.. forced> BS1 [4] <0. normal. 1.31] <0. 1. normal. restart> BS1 [2] <0. since last reported. 22 16-BIT COUNTER CHANGE EVENT WITHOUT TIME Data Object 22 . roll-over> BS1 [6] <0> BS1 [7] <0> 6-28 DNP Users Group . normal.216-1> BS1 [0] <0. normal.6. 1. 1. forced> BS1 [4] <0. restart> BS1 [2] <0. 1. off-line.. 1.. The current value field shows the value of the counter which generated the event. lost> BS1 [3] <0. Object Coding: FLAG 7 6 5 4 3 2 1 0 Current value 15 0 SQ4 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0.Variation: 02 Type: Event Description: The 16-bit counter change event without time represents a counter value that has exceeded a configured deadband. 1. normal. The flag field has the same meaning as in previous objects. normal. on-line> BS1 [1] <0. normal. roll-over> BS1 [5] <0. normal. forced> BS1 [4] <0.. 1. This can be accumulated pulses or transitions from a hardware or software point. 1.15] <0.7] UI16 [0. . normal.23 32-BIT DELTA COUNTER CHANGE EVENT WITHOUT TIME Data Object 22 . 1.00 Data Object Library (Version 0. on-line> BS1 [1] <0..7] UI32 [0.232-1> BS1 [0] <0.02) 6-29 . 1. lost> BS1 [3] <0. 1. restart> BS1 [2] <0. 1.6. This can be accumulated pulses or transitions from a hardware or software point. roll-over> BS1 [5] <0. normal. Object Coding: FLAG 7 6 5 4 3 2 1 0 Delta value 31 0 SQ4 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. The delta value field shows the change of the counter which generated the event.31] <0. normal. normal. forced> BS1 [4] <0. roll-over> BS1 [6] <0> BS1 [7] <0> DNP V3. 1. off-line.. normal. The flag field has the same meaning as in previous objects. 1. 1. normal.Variation: 03 Type: Event Description: The 32-bit delta counter change event without time represents a delta counter value that has exceeded a configured deadband. forced> BS1 [4] <0. roll-over> BS1 [5] <0. 1.24 16-BIT DELTA COUNTER CHANGE EVENT WITHOUT TIME Data Object 22 . Object Coding: FLAG 7 6 5 4 3 2 1 0 Delta value 15 0 SQ4 {FLAG Current value FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. This can be accumulated pulses or transitions from a hardware or software point. off-line. normal. restart> BS1 [2] <0. normal. forced> BS1 [4] <0. normal. The flag field has the same meaning as in previous objects.16] <0. The delta value field shows the change of the counter which generated the event. 1..Variation: 04 Type: Event Description: The 16-bit delta counter change event without time represents a delta counter value that has exceeded a configured deadband. lost> BS1 [3] <0. roll-over> BS1 [6] <0> BS1 [7] <0> 6-30 DNP Users Group . normal. 1.. 1. 1. normal. normal. 1.7] UI32 [0. on-line> BS1 [1] <0.216-1>} BS1 [0] <0.6.. 1. forced> BS1 [4] <0. 6. The Time field contains the time that processing generated the event.00 Data Object Library (Version 0. This can be accumulated pulses or transitions from a hardware or software point. The value field shows the value of the counter which generated the event.25 32-BIT COUNTER CHANGE EVENT WITH TIME Data Object 22 .02) 6-31 . The flag field has the same meaning as in previous objects. DNP V3.Variation: 05 Type: Event Description: The 32-bit counter change event with time represents a counter value that has exceeded a configured deadband. 232-1> UI48 [0. normal... seconds. roll-over> BS1 [5] <0. 6-32 DNP Users Group . on-line> BS1 [1] <0.31] <0. 1. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight.. restart> BS1 [2] <0. normal. normal.47] <248 -1 ms> BS1 [0] <0. normal. 1. zero minutes.. at zero hours.Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 31 Time 47 0 0 SQ4 {FLAG Value Time } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. January 1st. normal. forced> BS1 [4] <0. 1. forced> BS1 [4] <0.7] UI32 [0. and milliseconds. off-line. 1. 1. 1. lost> BS1 [3] <0. 1. normal. 1970. The flag field has the same meaning as in previous objects. DNP V3.02) 6-33 . The time field contains the time that processing generated the event. The value field shows the value of the counter which generated the event.26 16-BIT COUNTER CHANGE EVENT WITH TIME Data Object 22 . This can be accumulated pulses or transitions from a hardware or software point.Variation: 06 Type: Event Description: The 16-bit counter change event with time represents a counter value that has exceeded a configured deadband.6.00 Data Object Library (Version 0. 1. forced> BS1 [4] <0. on-line> BS1 [1] <0.7] UI16 [0.216-1> UI48 [0. normal.Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 15 Time 47 0 0 SQ4 {FLAG Value Time } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight. restart> BS1 [2] <0. January 1st. at zero hours.. normal. forced> BS1 [4] <0. normal. lost> BS1 [3] <0. normal. normal. roll-over> BS1 [5] <0. 1970. off-line.. 1. 1. normal. 1.47] <248 -1 ms> BS1 [0] <0. 6-34 DNP Users Group . 1. seconds..15] <0.. zero minutes. 1. and milliseconds. 1. Variation: 07 Type: Event Description: The 32-bit delta counter change event with time represents a delta counter value that has exceeded a configured deadband. This can be accumulated pulses or transitions from a hardware or software point.02) 6-35 .00 Data Object Library (Version 0. The flag field has the same meaning as in previous objects. The value field shows the value of the change which generated the event.6. DNP V3. The time contains the time that processing generated the event.27 32-BIT DELTA COUNTER CHANGE EVENT WITH TIME Data Object 22 . restart> BS1 [2] <0.. 1. seconds. off-line. 1. on-line> BS1 [1] <0. forced> BS1 [4] <0. 1970.. zero minutes..31] <0. normal. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight. forced> BS1 [4] <0. 1. 1. roll-over> BS1 [5] <0. normal. and milliseconds.. lost> BS1 [3] <0. normal. normal. 1. at zero hours.47] <248 -1 ms> BS1 [0] <0. 6-36 DNP Users Group . normal. 1. 1.7] UI32 [0.Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 31 Time 47 0 0 SQ4 {FLAG Value Time } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0.232-1> UI48 [0. normal. January 1st. This can be accumulated pulses or transitions from a hardware or software point. DNP V3.00 Data Object Library (Version 0. The time field contains the time that processing generated the event.6. The flag field has the same meaning as in previous objects.28 16-BIT DELTA COUNTER CHANGE EVENT WITH TIME Data Object 22 .02) 6-37 . The value field shows the value of the change which generated the event.Variation: 08 Type: Event Description: The 16-bit delta counter change event with time represents a delta counter value that has exceeded a configured deadband. Object Coding: FLAG 7 6 5 4 3 2 1 0 Value 15 Time 47 0 0 SQ4 {FLAG Value Time } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0.. 1.7] UI16 [0. normal.216-1> UI48 [0. normal. 1. normal.47] <248 -1 ms> BS1 [0] <0. normal. 1. normal. forced> BS1 [4] <0. forced> BS1 [4] <0. normal.. January 1st. seconds. 1.. at zero hours. and milliseconds. 1. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight. roll-over> BS1 [5] <0. off-line. restart> BS1 [2] <0. lost> BS1 [3] <0. zero minutes. 1. on-line> BS1 [1] <0. 1970..15] <0. 6-38 DNP Users Group . 1. 31] <0. Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen value 31 0 SQ4 {FLAG Frozen value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. normal. normal.. forced> BS1 [4] <0.02) 6-39 . off-line.. 1. This can be accumulated pulses or transitions from a hardware or software point. The flag field has the same meaning as in previous objects. restart> BS1 [2] <0. roll-over> BS1 [6] <0> BS1 [7] <0> DNP V3. normal. 1. roll-over> BS1 [5] <0. normal.Variation: 01 Type: Frozen Event Description: The 32-bit frozen counter event without time object represents a frozen counter value that is reported as an event. normal. 1. forced> BS1 [4] <0.29 32-BIT COUNTER CHANGE EVENT WITHOUT TIME Data Object 23 . The frozen value field shows the value at the time of freezing. lost> BS1 [3] <0. 1. 1.232-1> BS1 [0] <0..00 Data Object Library (Version 0. on-line> BS1 [1] <0. normal.6.7] UI32 [0. 1. 1. restart> BS1 [2] <0.7] UI16 [0. 1. 1. 1. normal. normal. normal. roll-over> BS1 [5] <0.30 16-BIT FROZEN COUNTER EVENT WITHOUT TIME Data Object 23 . on-line> BS1 [1] <0.. The flag field has the same meaning as in previous objects. roll-over> BS1 [6] <0> BS1 [7] <0> 6-40 DNP Users Group .Variation: 02 Type: Frozen Event Description: The 16-bit frozen counter event without time represents a frozen counter value that is reported as an event. lost> BS1 [3] <0. forced> BS1 [4] <0. 1. Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen value 15 0 SQ4 {FLAG Frozen value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0.15] <0.6. 1. The frozen value field shows the value at the time of freezing. This can be accumulated pulses or transitions from a hardware or software point. normal.. normal. off-line.216-1> BS1 [0] <0. 1. forced> BS1 [4] <0.. 1. normal. restart> BS1 [2] <0.31 32-BIT FROZEN DELTA COUNTER EVENT WITHOUT TIME Data Object 23 .6. off-line. normal. roll-over> BS1 [6] <0> BS1 [7] <0> DNP V3.. This can be accumulated pulses or transitions from a hardware or software point. 1.232-1> BS1 [0] <0. The frozen delta value field shows the change in counter value at the time of freezing. 1.. 1.02) 6-41 . 1. normal. Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen delta value 31 0 SQ4 {FLAG Frozen delta value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. normal. forced> BS1 [4] <0. normal. normal. 1.7] UI32 [0.Variation: 03 Type: Frozen Event Description: The 32-bit frozen delta counter event without time represents a frozen delta counter value that is reported as an event. 1. forced> BS1 [4] <0.00 Data Object Library (Version 0. 1. lost> BS1 [3] <0. on-line> BS1 [1] <0. roll-over> BS1 [5] <0. normal..31] <0. The flag field has the same meaning as in previous objects. 7] UI16 [0.6. 1. This can be accumulated pulses or transitions from a hardware or software point. roll-over> BS1 [5] <0. The flag field has the same meaning as in previous objects.32 16-BIT FROZEN DELTA COUNTER WITHOUT TIME Data Object 23 . 1.Variation: 04 Type: Frozen Event Description: The 16-bit frozen delta counter event without time represents a frozen delta counter value that is reported as an event.. normal... 1. 1.216-1> BS1 [0] <0. 1. on-line> BS1 [1] <0. normal. normal. normal. normal. off-line. The frozen delta value field shows the change in counter value at the time of freezing. forced> BS1 [4] <0. 1. roll-over> BS1 [6] <0> BS1 [7] <0> 6-42 DNP Users Group . Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen delta value 15 0 SQ4 {FLAG Frozen delta value } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = ={ = = = = = = = = = BS8 [0. lost> BS1 [3] <0. normal. forced> BS1 [4] <0. 1.15] <0. restart> BS1 [2] <0. The flag field has the same meaning as in previous objects. DNP V3.00 Data Object Library (Version 0.02) 6-43 .Variation: 05 Type: Frozen Event Description: The 32-bit frozen counter event with time represents a frozen counter value that is reported as an event. The time of freeze contains the time that the object was frozen. This can be accumulated pulses or transitions from a hardware or software point. The frozen value shows the value of the counter at time of freeze.33 32-BIT FROZEN COUNTER EVENT WITH TIME Data Object 23 .6. 7] UI32 [0.31] <0. roll-over> BS1 [5] <0. 6-44 DNP Users Group . normal. 1..232-1> UI48 [0. and milliseconds. normal.Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 31 Time of Freeze 47 0 0 SQ4 {FLAG Frozen Value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. forced> BS1 [4] <0. normal. on-line> BS1 [1] <0.47] <248 -1 ms> BS1 [0] <0.. 1. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight. zero minutes. lost> BS1 [3] <0. 1. 1. off-line. normal.. normal. seconds. 1970. 1. January 1st. 1. 1. restart> BS1 [2] <0.. at zero hours. normal. forced> BS1 [4] <0. 02) 6-45 .Variation: 06 Type: Frozen Event Description: The 16-bit frozen counter event with time represents a frozen counter value that is reported as an event.6.34 16-BIT FROZEN COUNTER EVENT WITH TIME Data Object 23 . The frozen value shows the value of the counter at time of freeze. The time of freeze contains the time that the object was frozen.00 Data Object Library (Version 0. This can be accumulated pulses or transitions from a hardware or software point. DNP V3. The flag field has the same meaning as in previous objects. forced> BS1 [4] <0. 1.. normal. 1. 1.7] UI16 [0. restart> BS1 [2] <0. 1970 at zero hours. forced> BS1 [4] <0.47] <248 -1 ms> BS1 [0] <0. off-line.. 1. January 1st. lost> BS1 [3] <0. normal. roll-over> BS1 [5] <0. 1. 1.Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 15 Time of Freeze 47 0 0 SQ4 {FLAG Frozen Value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. 1. zero minutes. normal.15] <0. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight. on-line> BS1 [1] <0. normal.216-1> UI48 [0.. seconds and milliseconds. normal. 6-46 DNP Users Group . normal.. The time of freeze contains the time that the object was frozen. The flag field has the same meaning as in previous objects. This can be accumulated pulses or transitions from a hardware or software point. The frozen value shows the change in the counter at time of freeze.Variation: 07 Type: Frozen Event Description: The 32-bit frozen delta counter event with time represents a frozen delta counter value that is reported as an event.00 Data Object Library (Version 0.02) 6-47 .6. DNP V3.35 32-BIT FROZEN DELTA COUNTER EVENT WITH TIME Data Object 23 . 1970 at zero hours. off-line. forced> BS1 [4] <0.. zero minutes. 1. 1.Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 31 Time of Freeze 47 0 0 SQ4 {FLAG Frozen Value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. on-line> BS1 [1] <0. normal. normal.. 6-48 DNP Users Group . 1. normal. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight. 1. forced> BS1 [4] <0. January 1st. normal. lost> BS1 [3] <0.. normal. seconds and milliseconds.47] <248 -1 ms> BS1 [0] <0.31] <0. roll-over> BS1 [5] <0. normal. 1.232-1> UI48 [0. 1.. restart> BS1 [2] <0.7] UI32 [0. 1. 02) 6-49 .36 16-BIT FROZEN DELTA COUNTER EVENT WITH TIME Data Object 23 . The flag field has the same meaning as in previous objects. DNP V3.Variation: 08 Type: Frozen Event Description: The 16-bit frozen delta counter event with time represents a frozen delta counter value that is reported as an event.00 Data Object Library (Version 0. The time of freeze contains the time that the object was frozen. This can be accumulated pulses or transitions from a hardware or software point.6. The frozen value shows the change in the counter at time of freeze. normal.15] <0. roll-over> BS1 [5] <0. 1.216-1> UI48 [0. off-line. roll-over> BS1 [6] <0> BS1 [7] <0> Narrative: Time is recorded as milliseconds since midnight. January 1st. normal. lost> BS1 [3] <0. zero minutes. on-line> BS1 [1] <0. 1. normal.47] <248 -1 ms> BS1 [0] <0. 1. 1. seconds.. restart> BS1 [2] <0... 1.Object Coding: FLAG 7 6 5 4 3 2 1 0 Frozen Value 15 Time of Freeze 47 0 0 SQ4 {FLAG Frozen Value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Roll-over Roll-over Reserved Reserved } = = = ={ = = = = = = = = = BS8 [0. 1.7] UI16 [0. forced> BS1 [4] <0.. normal. normal. normal. 6-50 DNP Users Group . 1. forced> BS1 [4] <0. at zero hours. and milliseconds. 1970. 7.Variation: 01 Type: Static Description: The 32-bit Analog Input is an information object used to represent a hardware or software analog point.1 32-BIT ANALOG INPUT Data Object 30 . 7.00 Data Object Library (Version 0. or -231 negatively. The 32-bit signed value could represent a digitized signal or calculated value. with these additions: • The out of range field indicates that the digitized signal or calculation has exceeded +231 -1 positively. DECLARATION RULES FOR INFORMATION ELEMENTS. The actual value will be +231 -1 or -231 if it is overrange or under-range. ANALOG INPUT OBJECT DEFINITIONS This section defines the analog input data objects using the rules established in section 2. The Value field shows the current value of the analog input at the time of reporting or the last reported value from the originating device. The reference check field indicates that the reference signal used to digitize the analog input is not stable and the resulting digitized value may not be correct.02) 7-1 . The flag field has the same meaning as previous objects. • DNP V3. . normal. 1. 1.31] <231-1. on-line> BS1 [1] <0.. over-range> BS1 [6] <0. normal. normal. forced> BS1 [5] <0. error> BS1 [7] <0> 7-2 DNP Users Group . normal. forced> BS1 [4] <0. off-line.7] I32 [0. normal. 1.Object Coding: FLAG 7 Current value 31 0 0 SQ2 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0. lost> BS1 [3] <0. 1. 1..-231> BS1 [0] <0. 1. restart> BS1 [2] <0. 1. normal. DNP V3.2 16-BIT ANALOG INPUT Data Object 30 . with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +215 1 positively. • The reference check field indicates that the reference signal used to digitize the analog input is not stable and the resulting digitized value may not be correct. or -215 negatively.00 Data Object Library (Version 0.7. The 16-bit signed value could represent a digitized signal or calculated value.02) 7-3 . The actual value field can be ignored as its value is not defined. or the last reported value from the originating device.Variation: 02 Type: Static Description: The 16-bit analog input is an information object used to represent a hardware or software analog point. The value field shows the current value of the analog input at the time of reporting. The flag field has the same meaning as previous objects. restart> BS1 [2] <0. 1. normal. normal. forced> BS1 [4] <0. normal. normal.. normal..15] <215-1. error> BS1 [7] <0> 7-4 DNP Users Group . off-line. 1.Object Coding: FLAG 7 Current value 15 0 0 SQ2 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0. over-range> BS1 [6] <0. forced> BS1 [5] <0.7] I16 [0. 1. lost> BS1 [3] <0.. 1. 1. 1. on-line> BS1 [1] <0.-215> BS1 [0] <0. normal. 1. DNP V3. this variation implies that flag = 1). The 32-bit signed value could represent a digitized signal or calculated value.e..31] <231-1.Variation: 03 Type: Static Description: The 32-bit analog input is an information object used to represent a hardware or software analog point. Object Coding: Current value 31 0 SQ2 {Current value = } I32 [0..02) 7-5 . or the last reported value from the originating device.3 32-BIT ANALOG INPUT WITHOUT FLAG Data Object 30 .-231> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i.00 Data Object Library (Version 0. The value field shows the current value of the analog input at the time of reporting.7. 15] <215-1.4 16-BIT ANALOG INPUT WITHOUT FLAG Data Object 30 . Object Coding: Current value 15 0 SQ2 {Current value = } I16 [0. The 16-bit signed value could represent a digitized signal or calculated value.Variation: 04 Type: Static Description: The 16-bit analog input is an information object used to represent a hardware or software analog point.7.. 7-6 DNP Users Group .e. this variation implies that flag = 1).-215> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i.. or the last reported value from the originating device. The current value field shows the current value of the analog input at the time of reporting. The flag field has the same meaning as previous objects. 1. 1. and the resulting digitized value may not be correct.Variation: 01 Type: Frozen Static Description: The 32-bit frozen analog input is an information object used to represent a frozen hardware or software analog point. off-line. 1.00 Data Object Library (Version 0. Object Coding: FLAG 7 Frozen value 31 0 0 SQ2 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +231 1 positively.7. The frozen value shows the value of the analog input at the time the last freeze command was performed on this point. 1.5 32-BIT FROZEN ANALOG INPUT Data Object 31 ..02) 7-7 .7] I32 [0. 1. restart> BS1 [2] <0. lost> BS1 [3] <0. 1.31] <231-1.-231> BS1 [0] <0. • The reference check field indicates that the reference signal used to digitize the analog input is not stable. error> BS1 [7] <0> DNP V3... normal. The actual value field can be ignored as its value is not defined. forced> BS1 [5] <0. normal. 1. over-range> BS1 [6] <0. or -231 negatively. normal. on-line> BS1 [1] <0. forced> BS1 [4] <0. normal. The 32-bit signed value could represent a digitized signal or calculated value. normal. normal. 6 16-BIT FROZEN ANALOG INPUT Data Object 31 . The flag field has the same meaning as previous objects.-215> BS1 [0] <0.15] <215-1. on-line> BS1 [1] <0. normal. normal. forced> BS1 [5] <0. over-range> BS1 [6] <0. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +215 1 positively. 1. normal. 1. The 16-bit signed value could represent a digitized signal or calculated value. • The reference check field indicates that the reference signal used to digitize the analog input is not stable.. or -215 negatively.. 1.. The frozen value shows the value of the analog input at the time the last freeze command was performed on this point.7. normal. 1. lost> BS1 [3] <0. forced> BS1 [4] <0. 1. 1.Variation: 02 Type: Frozen Static Description: The 16-bit frozen analog input is an information object used to represent a frozen hardware or software analog point. off-line. restart> BS1 [2] <0. 1.7] I16 [0. and the resulting digitized value may not be correct. Object Coding: FLAG 7 Frozen value 15 0 0 SQ2 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0. error> BS1 [7] <0> 7-8 DNP Users Group . normal. normal. The actual value field can be ignored as its value is not defined. 00 Data Object Library (Version 0. The frozen value shows the value of the analog input at the time specified in time of freeze. The flag field has the same meaning as previous objects.7. • The reference check field indicates that the reference signal used to digitize the analog input is not stable and the resulting digitized value may not be correct. DNP V3. The time of freeze field shows the time at which the frozen value was equal to the current value of the analog input. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +231 1 positively. or -231 negatively. The actual value field can be ignored as its value is not defined.7 32-BIT FROZEN ANALOG INPUT WITH TIME OF FREEZE Data Object 31 .02) 7-9 . These values are equated on reception of a freeze analog command.Variation: 03 Type: Frozen Static Description: The 32-bit frozen analog input with time of freeze is an information object used to represent a frozen hardware or software analog point. The 32-bit signed value could represent a digitized signal or calculated value. 31] <231-1. 2 48 > BS1 [0] <0. normal. lost> BS1 [3] <0. 1. normal.. 1.-231> UI48[0. 1. normal. off-line. 1.. 1. normal. on-line> BS1 [1] <0. forced> BS1 [4] <0. normal. 1. error> BS1 [7] <0> 7-10 DNP Users Group .7] I32 [0.Object Coding: FLAG 7 Frozen value 31 0 0 Time of Freeze 47 0 SQ2 {FLAG Current value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = = ={ = = = = = = = = BS8 [0.. forced> BS1 [5] <0. restart> BS1 [2] <0. over-range> BS1 [6] <0..47] <0 . normal. 1.. The time of freeze field shows the time at which the frozen value was equal to the current value of the analog input.8 16-BIT FROZEN ANALOG INPUT WITH TIME OF FREEZE Data Object 31 .7. The frozen value shows the value of the analog input at the time specified in time of freeze. • The reference check field indicates that the reference signal used to digitize the analog input is not stable. or -215 negatively.Variation: 04 Type: Frozen Static Description: The 16-bit frozen analog input with time of freeze is an information object used to represent a frozen hardware or software analog point. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +215 -1 positively. The actual value field can be ignored as its value is not defined.00 Data Object Library (Version 0.02) 7-11 . and the resulting digitized value may not be correct. These values are equated on reception of a freeze analog command. The 16-bit signed value could represent a digitized signal or calculated value. The flag field has the same meaning as previous objects. DNP V3. restart> BS1 [2] <0. error> BS1 [7] <0> 7-12 DNP Users Group . 1....-215> BS1 [0] <0. normal..Object Coding: FLAG 7 Frozen value 15 0 0 Time of Freeze 47 0 SQ2 {FLAG Time of freeze Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = = ={ = = = = = = = = BS8 [0. 1. 1. forced> BS1 [4] <0.47] <0 . forced> BS1 [5] <0. on-line> BS1 [1] <0. 1. normal. lost> BS1 [3] <0.7] UI48[0. 1. 1. normal. 2 48 -1> I16 [0. normal. normal. 1..15] <215-1. off-line. normal. over-range> BS1 [6] <0. 31] <231-1. this variation implies that flag = 1). Object Coding: Frozen value 31 0 SQ2 {Current value= } I32 [0.-231> NOTE: The use of this variation implies that the input point is on-line and that all other flag bits are normal (i...02) 7-13 . DNP V3.e.Variation: 05 Type: Frozen Static Description: The 32-bit frozen analog input is an information object used to represent a frozen hardware or software analog point.9 32-BIT FROZEN ANALOG INPUT WITHOUT FLAG Data Object 31 .7. The frozen value shows the value of the analog input at the time the last freeze command was performed on this point.00 Data Object Library (Version 0. The 32-bit signed value could represent a digitized signal or calculated value. Object Coding: Frozen value 15 0 SQ2 {Current value= } I16 [0.7.. The frozen value shows the value of the analog input at the time the last freeze command was performed on this point.15] <215-1. The 16-bit signed value could represent a digitized signal or calculated value..10 16-BIT FROZEN ANALOG INPUT WITHOUT FLAG Data Object 31 .-215> 7-14 DNP Users Group .Variation: 06 Type: Frozen Static Description: The 16-bit frozen analog input is an information object used to represent a frozen hardware or software analog point. This object will only be reported if the current value and the last reported value differ by a configurable deadband value. and the resulting digitized value may not be correct. The actual value field can be ignored as its value is not defined. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +231 -1 positively. or -231 negatively. DNP V3. The flag field has the same meaning as previous objects.Variation: 01 Type: Event Description: The 32-bit analog change event without time is an information object used to represent a changed hardware or software analog point. or the last reported value from the originating device.7.00 Data Object Library (Version 0.02) 7-15 . The current value field shows the current value of the analog input at the time of reporting. This filtering is commonly known as deadbanding.11 32-BIT ANALOG CHANGE EVENT WITHOUT TIME Data Object 32 . • The reference check field indicates that the reference signal used to digitize the analog input is not stable. The 32-bit signed value could represent a digitized signal or calculated value. .. lost> BS1 [3] <0. 1.. normal. 1. 1. 1. restart> BS1 [2] <0. normal. 1. normal.-231> BS1 [0] <0.Object Coding: FLAG 7 Current value 31 0 0 SQ2 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0. over-range> BS1 [6] <0. normal. normal. forced> BS1 [4] <0. forced> BS1 [5] <0. on-line> BS1 [1] <0. 1. error> BS1 [7] <0> 7-16 DNP Users Group . off-line. 1.7] I32 [0. normal.31] <231-1. DNP V3.12 16-BIT CHANGE EVENT WITHOUT TIME Data Object 32 . The flag field has the same meaning as previous objects. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +215 -1 positively. This object will only be reported if the current value and the last reported value differ by a configurable deadband value. The 16-bit signed value could represent a digitized signal or calculated value. The current value field shows the current value of the analog input at the time of reporting. and the resulting digitized value may not be correct.00 Data Object Library (Version 0.02) 7-17 . or -215 negatively. • The reference check field indicates that the reference signal used to digitize the analog input is not stable.7. or the last reported value from the originating device.Variation: 02 Type: Event Description: The 16-bit analog change event without time is an information object used to represent a changed hardware or software analog point. This filtering is commonly known as deadbanding. The actual value field can be ignored as its value is not defined. 1. normal. over-range> BS1 [6] <0. normal. lost> BS1 [3] <0. 1.Object Coding: FLAG 7 Current value 15 0 0 SQ2 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0.7] I16 [0. 1. error> BS1 [7] <0> 7-18 DNP Users Group . 1.. restart> BS1 [2] <0. normal. forced> BS1 [4] <0. 1.-215> BS1 [0] <0. forced> BS1 [5] <0. normal. on-line> BS1 [1] <0. 1. normal. 1. off-line.15] <215-1. normal... The flag field has the same meaning as previous objects. and the resulting digitized value may not be correct. or -231 negatively. The actual value field can be ignored as its value is not defined. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +231 -1 positively. The time field shows the time at which the processing caused the event.00 Data Object Library (Version 0.7. • The reference check field indicates that the reference signal used to digitize the analog input is not stable.13 32-BIT ANALOG CHANGE EVENT WITH TIME Data Object 32 .Variation: 03 Type: Event Description: The 32-bit analog change event with time is an information object used to represent a changed hardware or software analog point.02) 7-19 . The current value shows the value of the analog input at the time specified in time. The 32-bit signed value could represent a digitized signal or calculated value. DNP V3. normal.7] UI48[0.-231> BS1 [0] <0. 1. restart> BS1 [2] <0. 2 48 -1> I32[0. normal.31] <231-1. 1. error> BS1 [7] <0> 7-20 DNP Users Group . forced> BS1 [5] <0. over-range> BS1 [6] <0. normal. 1. normal.47] <0 . 1. 1.. forced> BS1 [4] <0. off-line.Object Coding: FLAG 7 Value 31 Time 47 0 0 0 SQ2 {FLAG Time Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = = ={ = = = = = = = = BS8 [0.. normal.. on-line> BS1 [1] <0... 1. normal. lost> BS1 [3] <0. 1. The flag field has the same meaning as previous objects. The 16-bit signed value could represent a digitized signal or calculated value.7. • The reference check field indicates that the reference signal used to digitize the analog input is not stable. The time field shows the time at which the processing caused the event. DNP V3. The current value shows the value of the analog input at the time specified in time. and the resulting digitized value may not be correct.14 16-BIT ANALOG CHANGE EVENT WITH TIME Data Object 32 .00 Data Object Library (Version 0.02) 7-21 . with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +215 -1 positively.Variation: 04 Type: Event Description: The 16-bit analog change event with time is an information object used to represent a changed hardware or software analog point. or -215 negatively. The actual value field can be ignored as its value is not defined. . normal. 1.47] <0 .-215> BS1 [0] <0. restart> BS1 [2] <0. 1. error> BS1 [7] <0> 7-22 DNP Users Group . forced> BS1 [5] <0. forced> BS1 [4] <0. off-line. normal. normal. normal. 1. normal. normal.. 1.15] <215-1.7] UI48 [0.Object Coding: FLAG 7 Value 15 Time 47 0 0 0 SQ2 {FLAG Time Value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = = ={ = = = = = = = = BS8 [0. over-range> BS1 [6] <0. 1. lost> BS1 [3] <0.... 2 48 -1> I16 [0. 1. on-line> BS1 [1] <0. 1. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +231 -1 positively. • The reference check field indicates that the reference signal used to digitize the analog input is not stable.7.15 32-BIT FROZEN ANALOG EVENT WITHOUT TIME Data Object 33 . The actual value field can be ignored as its value is not defined.00 Data Object Library (Version 0. The frozen value field shows the value of the analog input at the time of freeze.02) 7-23 .Variation: 01 Type: Frozen Event Description: The 32-bit frozen analog event without time is an information object used to represent a frozen hardware or software analog point that is reported as an event. and the resulting digitized value may not be correct. DNP V3. The 32-bit signed value could represent a digitized signal or calculated value. The flag field has the same meaning as previous objects. or -231 negatively. . normal. 1.Object Coding: FLAG 7 Frozen value 31 0 0 SQ2 {FLAG Frozen value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0. normal. 1. 1. forced> BS1 [5] <0. 1.31] <231-1.7] I32 [0.-231> BS1 [0] <0. error> BS1 [7] <0> 7-24 DNP Users Group . restart> BS1 [2] <0. normal. forced> BS1 [4] <0. normal. normal. lost> BS1 [3] <0. 1.. over-range> BS1 [6] <0. 1. normal. 1. off-line.. on-line> BS1 [1] <0. The frozen value field shows the value of the analog input at the time of freeze. The flag field has the same meaning as previous objects. The 16-bit signed value could represent a digitized signal or calculated value. • The reference check field indicates that the reference signal used to digitize the analog input is not stable. DNP V3. and the resulting digitized value may not be correct.7.02) 7-25 .Variation: 02 Type: Frozen Event Description: The 16-bit frozen analog event without time is an information object used to represent a frozen hardware or software analog point that is reported as an event.16 16-BIT FROZEN ANALOG EVENT WITHOUT TIME Data Object 33 . or -215 negatively. The actual value field can be ignored as its value is not defined.00 Data Object Library (Version 0. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +215 -1 positively. lost> BS1 [3] <0. 1.. on-line> BS1 [1] <0. 1. normal.7] I16 [0. normal. forced> BS1 [4] <0.Object Coding: FLAG 7 Frozen value 15 0 0 SQ2 {FLAG Frozen value } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = ={ = = = = = = = = BS8 [0. forced> BS1 [5] <0. normal. error> BS1 [7] <0> 7-26 DNP Users Group .. 1. normal. 1. normal. 1.15] <215-1. 1. normal. 1. restart> BS1 [2] <0..-215> BS1 [0] <0. off-line. over-range> BS1 [6] <0. The 32-bit signed value could represent a digitized signal or calculated value. or -231 negatively. • The reference check field indicates that the reference signal used to digitize the analog input is not stable. with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +231 -1 positively.02) 7-27 . These values are equated on reception of a freeze analog command.7. and the resulting digitized value may not be correct. The flag field has the same meaning as previous objects. DNP V3.Variation: 03 Type: Frozen Event Description: The 32-bit frozen analog event with time is an information object used to represent a frozen hardware or software analog point that is reported as an event.00 Data Object Library (Version 0. The frozen value field shows the value of the analog input at the time of a freeze. • The time of freeze field shows the time at which the frozen value was equal to the current value of the analog input.17 32-BIT FROZEN ANALOG EVENT WITH TIME Data Object 33 . The actual value field can be ignored as its value is not defined. forced> BS1 [4] <0.Object Coding: FLAG 7 Frozen value 31 0 0 Time of Freeze 47 0 SQ2 {FLAG Frozen value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = = ={ = = = = = = = = BS8 [0. over-range> BS1 [6] <0. restart> BS1 [2] <0. 1. 1.7] I32 [0.47] <0 . normal.. normal.. 1.. 1. off-line. 1. normal. normal. 1. forced> BS1 [5] <0. error> BS1 [7] <0> 7-28 DNP Users Group . on-line> BS1 [1] <0. 1. normal.31] <231-1.. 2 48 -1> BS1 [0] <0.-231> UI48[0.. lost> BS1 [3] <0. normal. The Flag field has the same meaning as previous objects with these additions: • The over-range field indicates that the digitized signal or calculation has exceeded +215 -1 positively.7. or -215 negatively. The frozen value field shows the value of the analog input at the time of a freeze. The 16-bit signed value could represent a digitized signal or calculated value. • The reference check field indicates that the reference signal used to digitize the analog input is not stable. and the resulting digitized value may not be correct.18 16-BIT FROZEN ANALOG EVENT WITH TIME Data Object 33 .02) 7-29 . DNP V3.00 Data Object Library (Version 0.Variation: 04 Type: Frozen Event Description: The 16-bit frozen analog event with time is an information object used to represent a frozen hardware or software analog point that is reported as an event. • The time of freeze field shows the time at which the frozen value was equal to the current value of the analog input. The actual value field can be ignored as its value is not defined. These values are equated on reception of a freeze analog command. . forced> BS1 [4] <0. over-range> BS1 [6] <0. normal.. 1. 2 48 -1> BS1 [0] <0. normal. forced> BS1 [5] <0. on-line> BS1 [1] <0.Object Coding: FLAG 7 Frozen value 15 0 0 Time of Freeze 47 0 SQ2 {FLAG Frozen value Time of Freeze } FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } = = = ={ = = = = = = = = BS8 [0. normal.15] <215-1. lost> BS1 [3] <0. restart> BS1 [2] <0. 1. 1. error> BS1 [7] <0> 7-30 DNP Users Group .-215> UI48[0. 1. 1. normal. normal..7] I16 [0.. off-line. normal.. 1.47] <0 . 1. 8.8. The actual value field contains the current value of the analog output.00 Data Object Library (Version 0. DECLARATION RULES FOR INFORMATION ELEMENTS. ANALOG OUTPUT OBJECT DEFINITIONS This section defines the analog output data objects using the rules established in section 2. DNP V3.1 32-BIT ANALOG OUTPUT STATUS Data Object 40 . The flag field has the same meaning as previous objects.Variation: 01 Type: Static Description: The 32-bit analog output status information object represents the actual value of an analog output or software point and associated status.02) 8-1 . 31] <231-1. 1. lost> BS1 [3] <0..7] I32 [0. 8-2 DNP Users Group . off-line. 1. forced> BS1 [4] <0> BS1 [5] <0> BS1 [6] <0> BS1 [7] <0> Narrative: This object can be returned after an analog output operation is performed in order to determine the success of the operation. normal... 1. restart> BS1 [2] <0. on-line> BS1 [1] <0. 1.Object Coding: FLAG 7 6 5 4 3 2 1 0 Current value 31 0 SQ3 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Reserved Reserved Reserved Reserved } = = ={ = = = = = = = = BS8 [0.-231> BS1 [0] <0. unlock. normal. lost> BS1 [3] <0. 1.Variation: 02 Type: Static Description: The 16-bit analog output status information object represents the actual value of a hardware DAC analog output or software point and associated status.-215> BS1 [0] <0.7] I16 [0..00 Data Object Library (Version 0.2 16-BIT ANALOG OUTPUT STATUS Data Object 40 . 1.02) 8-3 . restart> BS1 [2] <0.15] <215-1. normal. 1. The actual value field contains the current value of the analog output. DNP V3.. The flag field has the same meaning as previous objects. on-line> BS1 [1] <0. Object Coding: FLAG 7 6 5 4 3 2 1 0 Current value 15 0 SQ3 {FLAG Current value } FLAG On-line Restart Communication lost Remote forced data Reserved Reserved Reserved Reserved } = = ={ = = = = = = = = BS8 [0. forced> BS1 [4] <0> BS1 [5] <0> BS1 [6] <0> BS1 [7] <0> Narrative: This object can be returned after an analog output operation is performed in order to determine the success of the operation.8.. unlock. off-line. normal. 1. The control status field indicates the status of the analog control operation. as the value may be scaled and/or manipulated before any output level is set.7] <0.3 32-BIT ANALOG OUTPUT BLOCK Data Object 41 ... Object Coding: Requested value 31 Control Status 7 0 0 I32 [0.-231> Requested value = Status = I8 [0. The value represented is merely logical. The definition of this field is the same as the control relay output block.8.Variation: 01 Type: Static Description: The 32-bit analog output information object represents the desired value of a hardware DAC analog output or software point. in the same way that the control delay output block does. 8-4 DNP Users Group . The actual value of the analog output is returned in the analog output status object..255> This is used in a control request/response..31] <231-1. The requested value field contains the desired value of the analog output. .. as the value may be scaled and/or manipulated before any output level is set. Object Coding: Requested value 15 Control Status 7 0 0 I16 I8 Requested value Status = = I16 [0.7] <0. The definition of this field is the same as the control relay output block.Variation: 02 Type: Static Description: The 16-bit analog output block information object represents the desired value of a hardware DAC analog output or software point. The control status field indicates the status of the analog control operation in the same way as the control relay output block.00 Data Object Library (Version 0... The actual value of the analog output is returned in the analog output status object.8.4 16-BIT ANALOG OUTPUT BLOCK Data Object 41 .02) 8-5 .15] <215-1.-215> I8 [0. The value represented is merely logical.255> DNP V3. The requested value field contains the desired value of the analog output. 8-6 DNP Users Group . zero minutes. January 1st. Object Coding: Absolute Time 7 15 23 31 39 47 6 14 22 30 38 46 5 13 21 29 37 45 4 12 20 28 36 44 3 11 19 27 35 43 2 10 18 26 34 42 1 9 17 25 33 41 0 8 16 24 32 40 Absolute Time= UI48 [0. This object should be used for time-synchronization.1 TIME AND DATE Data Object 50 . and milliseconds.. 1970. DNP V3. zero seconds. msec> Narrative: Absolute Time is recorded as milliseconds since midnight.47] <0..248-1. TIME OBJECT DEFINITIONS This section defines the time data objects using the rules established in section 2.Variation: 01 Description: The time and date object is an information object that represents the absolute time of day and date.9. at zero hours.00 Data Object Library (Version 0.02) 9-1 . 9. DECLARATION RULES FOR INFORMATION ELEMENTS. The interval could be applied several times to the base time in order to specify a sequence of periodic times.2 TIME AND DATE WITH INTERVAL Data Object 50 . For example. this can be used to specify a sequence of times for periodic freezing of objects. This time is the real time-of-day.9.Variation: 02 Description: The time and date with interval represents both an absolute time and an interval time. and the interval time is a positive offset from the base time. The interval field specifies the periodic interval or offset from the base time. The absolute time field specifies the base time. The absolute time represents a starting time (or base time). 9-2 DNP Users Group . msec> Narrative: Absolute time is recorded as milliseconds since midnight..47] <0..02) 9-3 . at zero hours. zero minutes. and milliseconds.00 Data Object Library (Version 0. msec> UI32 [0. January 1st. 1970.232-1...Object Coding: Absolute time 7 15 23 31 39 47 6 14 22 30 38 46 5 13 21 29 37 45 4 12 20 28 36 44 3 11 19 27 35 43 2 10 18 26 34 42 1 9 17 25 33 41 0 8 16 24 32 40 Interval 7 15 23 31 6 14 22 30 5 13 21 29 4 12 20 28 3 11 19 27 2 10 18 26 1 9 17 25 0 8 16 24 SQ2 {Absolute time Interval } = = UI48 [0.31] <0. DNP V3. zero seconds.248 -1. Variation: 01 Description: The time and date CTO (common time of occurrence) object is an information object that represents the absolute time of day. This object should be used in conjunction with other objects that contain time references. zero seconds.9. at zero hours. 9-4 DNP Users Group . in order to obtain another absolute time reference. msec> Narrative: Absolute time is recorded as milliseconds since midnight. zero minutes. January 1st. Object Coding: Absolute Time 7 15 23 31 39 47 6 14 22 30 38 46 5 13 21 29 37 45 4 12 20 28 36 44 3 11 19 27 35 43 2 10 18 26 34 42 1 9 17 25 33 41 0 8 16 24 32 40 Absolute time = UI48 [0. This object is a base time to which a relative (incremental) time can be added. and milliseconds. 1970.248-1...47] <0.3 TIME AND DATE CTO Data Object 51 . or from which it can be subtracted. 47] <0. Object Coding: Relative Absolute Time 7 15 23 31 39 47 6 14 22 30 38 46 5 13 21 29 37 45 4 12 20 28 36 44 3 11 19 27 35 43 2 10 18 26 34 42 1 9 17 25 33 41 0 8 16 24 32 40 Relative-absolute time = UI48 [0. and come before the next common-time object that contains relative time. or from which it can be subtracted.00 Data Object Library (Version 0... and milliseconds.4 UN-SYNCHRONIZED TIME AND DATE CTO Data Object 51 . Relative-absolute time is the un-synchronized time-of-day at the station sending this object (i. This object is a relative base time to which a relative (incremental) time can be added. zero minutes. based on the reception time of the message containing this object.9. January 1st. the responding station).248-1. zero seconds. DNP V3. Any objects that follow this object.02) 9-5 . msec> Narrative: Relative-absolute time is recorded as milliseconds since midnight. in order to obtain another relative-absolute time reference. The real absolute time can be calculated by the message receiver. must be corrected using this relative-absolute time value. at zero hours.Variation: 02 Description: The un-synchronized time and date CTO object is an information object that represents the relative-absolute time of day.e. This object should be used in conjunction with other objects that contain time references. 1970. 5 TIME DELAY COARSE Data Object 52 .9.15] <0.Variation: 01 Description: The time delay coarse information object represents a relative time that indicates a time period starting from the time of message reception.535. Object Coding: Seconds 7 15 6 14 5 13 4 12 3 11 2 10 1 9 0 8 Seconds = UI16 [0...65. seconds> 9-6 DNP Users Group . 00 Data Object Library (Version 0..02) 9-7 .535. milliseconds> DNP V3.Variation: 02 Description: The time delay fine information object represents a relative time that indicates a time period starting from the time of message reception.15] <0. Object Coding: Milliseconds 7 15 6 14 5 13 4 12 3 11 2 10 1 9 0 8 Milliseconds = UI16 [0. This object can be used in timesynchronization to perform path delay measurement calculations or other functions that require time-based calibration..9.65.6 TIME DELAY FINE Data Object 52 . 9-8 DNP Users Group . 02) 10-1 . 10. or 3. Class 0 data is potentially any information object not assigned to class 1. DECLARATION RULES FOR INFORMATION ELEMENTS. 2. certain points of the variation. These elements can be entire object types. and therefore does not have an object coding. The data specified by this object type is configurable within the responding station. a specific variation. Narrative: The class 0 data object does not carry any information in itself.Variation: 01 Description: The class 0 data object is an object place-holder that specifies a class of zero or more information elements. That is. or any combination of these. Class 0 is a null class to which all data objects not assigned to other classes can belong by default.00 Data Object Library (Version 0. Object Coding: None. CLASS OBJECT DEFINITIONS This section defines the class data objects using the rules established in section 2.1 CLASS 0 DATA Data Object 60 . class 0 data is non-priority data. DNP V3.10. and therefore does not have an object coding. usually changes. Object Coding: None. Narrative: The class 1 data object is used to request a configured group. certain points of the variation. 10-2 DNP Users Group .10. class 1 data has higher priority than class 2. of information objects from a responding station. or any combination of these. but is simply an identifier for other objects.Variation: 02 Description: The class 1 data object is an object place-holder that specifies a class of zero or more information elements. The data specified by this object type is configurable within the responding station. This data object does not carry any information in itself. Typically. as it does not contain any actual information. These elements can be entire object types. class 3. The responding station does not send the class 1 data object.2 CLASS 1 DATA Data Object 60 . and class 0 data. a specific variation. 00 Data Object Library (Version 0. Narrative: The class 2 data object is used to request a configured group. This data object does not carry any information in itself. and therefore does not have an object coding. certain points of the variation. or any combination of these. These elements can be entire object types. as it does not contain any actual information. but is simply an identifier for other objects.Variation: 03 Description: The class 2 data object is an object place-holder that specifies a class of zero or more information elements. The responding station does not send the class 2 data object.10. usually changes.3 CLASS 2 DATA Data Object 60 . Object Coding: None. The data specified by this object type is configurable within the responding station. DNP V3.02) 10-3 . a specific variation. of information objects from a responding station. The data object does not carry any information in itself. as it does not contain any actual information. or any combination of these. and therefore does not have an object coding. usually an event. of information objects from a responding station. but is simply an identifier for other objects. a specific variation.10. Object Coding: None. 10-4 DNP Users Group . The responding station does not send the class 3 data object. The data specified by this object type is configurable within the responding station. These elements can be entire object types. Narrative: The class 3 data object is used to request a configured group.4 CLASS 3 DATA Data Object 60 . certain points of the variation.Variation: 04 Description: The class 3 data object is an object place-holder that specifies a class of zero or more information elements. etc. and so must be performed by the user of the Application Layer. the application must do whatever is necessary to obtain the file from the specified device.00 Data Object Library (Version 0.02) 11-1 . The receiving application should interpret this name as a network file name. then the following rules apply: • On reception of a non-local file request. The contents of the file object and the exact procedure to perform on the file will not be interpreted by the Application Layer. Sub-directories off of the root are interpreted as branches off of the root. FILE OBJECT DEFINITIONS This section defines the file data objects using the rules established in section 2. DECLARATION RULES FOR INFORMATION ELEMENTS. or more importantly.Variation: 01 Description: The file identifier object is an information object that represents information about a file in a network file system. 11. In particular. When an application receives a file that specifies a directory or file that does not reside in the current file system. This object is intended to be used for transferring large blocks of data that do not follow the format of an existing data object. If the remote device is a DNP 3 device. DNP V3. Networking Capability: The File_Name field defines a logical name of a file or device. this object is suitable for uploading and downloading configuration files to remote devices or data concentrators. the directory can be a remote file system which resides in a remote device that is accessible from the current node.11. A branch can be a new directory. The root (or /) represents the root of the host file system or receiving node. deleting. File operations are defined for this object to allow copying. of a file.1 FILE IDENTIFIER Data Object 70 . the application shall forward the request (in its entirety) to the appropriate DNP 3 device. This part of the object is sent in a request. The name from the Host to DC1 is: \DC2\IED\config1 The name from the DC1 to DC2 is: \IED\config1 The name from the DC2 to IED is: \config1 In this case DC2 and IED were logical directories which specified remote devices and config1 was the name of a physical file. 31 Attributes End_Record File_Size Time_Of_Creation Permission File_ID Owner_ID Group_ID Status X File_Name File_Function 0 24 23 16 15 File_Type 87 Name_Size Start_Record 0 11-2 DNP Users Group . an IED configuration is sent from a host through two data concentrators DC1 and DC2. Object Coding: This is not a fixed format object. but it is a variable format/sized object.• The File_Name field will be modified so that the root of the remote device is specified by the File_Name field. For example. This means stripping off any paths that were used to actually derive the name of the remote device. EXECUTE and READ. the File_Function field set to RESPONSE. The Start_Record indicates the first record to delete and the End_Record indicates the last record to delete.e.z. File_Name: Name of file to perform operation on. The device should respond with the file identifier object with all available fields filled in. "\" and "-" ONLY. x bits where x = Name_Size * 8 and Name_Size = 0 . "_". where " is a delimiter. The file identifier object is sent in a DNP application request message to a remote device using the Application Layer WRITE request function code.. "\" of the file system. Includes the following: APPEND.The File_Name field consists of 0 . WRITE.00 Data Object Library (Version 0. INSERT. Number of characters in File_Name above. Name_Size: File_Function: 0 = APPEND: 1 = DELETE: DNP V3. ERASE. Function to perform on specified records of file or on file system at user layer. The name can contain spaces ONLY to separate the file path/name from program arguments. and where the hyphen cannot be used as the first character of the file name. CWD.. PWD. Consists of 1 or more of the characters A . 9.02) 11-3 . A device responds to a request (or spontaneously reports) the file identifier object with an Application Layer RESPONSE or UNSOLICITED RESPONSE function code (where appropriate). ". The Start_Record field indicates the number of records to append to the file and also the number of data records following the file identifier header in the message.. Remove the specified records from the file (i. 65535. The following values are defined: Add data records specified at END of file. a. and the status field set to the status of the requested operation. Z... file shrinks). INFO. and the status field set to the status of the requested operation. The data records that follow the header are described in the WRITE function code (below). The device should respond with the file identifier object with all available fields filled in.e. There are no data records with this request. The name can contain all path information starting from the root (i.". the File_Function field set to RESPONSE. DELETE. The size of this field is determined by the Name_Size field below. 0 . The device should respond with the file identifier object with all available fields filled in. and previous data is replaced by these records). The data records that follow the header are described below. 11-4 DNP Users Group . The number of data records following the file identifier header in the message is End_Record . and the status field set to the status of the requested operation.e. the File_Function field set to RESPONSE. the File_Function field set to RESPONSE. the file stays same size. The device should respond with the file identifier object with all available fields filled in. and the status field set to the status of the requested operation. BUT data is cleared). The device should respond with the file identifier object with all available fields filled in. Place these records at the place specified by Start_Record field and continuing to End_Record field (i.. the File_Function field set to RESPONSE. The number of data records following the file identifier header in the message is End_Record Start_Record + 1. the file can potentially grow.e.2 = INSERT: Insert these records at the place specified by the Start_Record field and continuing to End_Record field (i. The data records that follow the header are described in the WRITE function code (below). There are no data records in this message. Record_Size 3 = WRITE: Data x 0 15 0 Where: 4 = ERASE: x = Record_Size * 8 Record_Size = 0 . and the status field set to the status of the requested operation. 65535 Clear (to NUL) or ERASE all records specified in Start and End record fields (i.e. the file grows in size).Start_Record + 1. the File_Function field set to RESPONSE.02) 11-5 . The device should respond with file identifier object headers for each file in the device's file system. If the device has only one file (and no directories) then this one file's file identifier object header should be returned. The device should respond with the file identifier object with all available fields filled in. The File_Name field can be set to the special name "/" which indicates ALL files. and the status field set to the status of the requested operation. and the status field set to the status of the requested operation. The device should respond with the file identifier object with all available fields filled in. The device should respond with the file identifier object with all available fields filled in. the File_Function set to RESPONSE and the status field set to the status of the requested operation. the File_Name field set to the new working directory. The device should respond with the file identifier object header with all fields filled in. Change working directory (CWD) to path specified in File_Name. 6 = CWD: 7 = PWD: 8 = EXEC: DNP V3. the File_Function field set to RESPONSE. Start or EXECUTE the application specified by File_Name and pass it parameters that follow the file name portion of File_Name (separated by spaces). the File_Function field set to RESPONSE and the status field set to the status of the requested operation.5 = INFO: This request is used to obtain INFORMATION on the specified file. Return the present working directory (PWD) in File_Name. the File_Name field set to the current working directory.00 Data Object Library (Version 0. Valid types are: 8-bit binary. WRITE. PWD. Baudot. International Baudot. BCD. and the End_Record field is 65535. The permission field specifies the READ. The EXECUTE privilege gives the user the right to run the specified application (EXEC request). The Start_Record specifies the first record to READ. This function code is used to indicate a response to a request. The READ privilege gives the user the right to read the file (READ. The File_Size field in the response should indicate the total size of the file. The data records that follow the header are described above under the WRITE function code. If the Start_Record field is 0. and the End_Record specifies the last record to READ. The following values are associated: 255 = RESP: Permission: File_Type: 0 = 8-bit binary (un-coded octets of binary) 1 = 8-bit ASCII (extended ASCII characters) 2 = 7-bit ASCII (ASCII characters) 3 = EBCDIC (extended binary coded decimal) 4 = BCD (binary coded decimal) 5 = Baudot (5-bit Baudot) 6 = International Baudot (6-bit Baudot) 11-6 DNP Users Group . INSERT. Indicates to a receiving application how to interpret the contents of the file object. INFO request). and the status field set to the status of the requested operation. 8-bit ASCII. and all requested data records (if possible). The contents of this message are defined by the function code in the request message. then the device should respond with all available records. WRITE. and EXECUTE privileges for the file owner. 7-bit ASCII. The device should respond with the file identifier object with all available fields filled in. ERASE). The WRITE privilege gives the user the right to change the file (APPEND. The number of data records following the file identifier header in the message is End_Record Start_Record + 1. CWD. EBCDIC. the File_Function field set to RESPONSE. the file owner's group and the world (all others).9 = READ: Read the specified records of file. DELETE. the Start_Record and End_Record should be set to the beginning and end data records returned in the response. Attributes: 0: 1: 2: 3: Status: File attributes consisting of: regular. consisting of: OK. Directory is a file of files (cannot be read). or FIFO. directory. Out_of_Space indicates that the file operation caused the file to exceed its maximum size as determined by the User ID.02) . Size in bytes of each individual data record excluding Record_Size field. Number of total bytes in file specified by File_Name. This field has the same format as Object 50 Variation 1. 11-7 End_Record: Record_Size: Time_of_Creation: DNP V3. File_Busy indicates that the file could not be delivered to the destination. An end record of 65535 combined with a start record of 0 in a READ request indicates the entire file. The status of the requested operation. The following values are associated: Regular file is a real PERMANENT file. Doesn't_exist indicates that the file name is not contained in the file system. Time that the file was created or last modified. Out_of_Space. FIFO is a first-in-first-out queue and can be used for inter-process communication (analogous to a socket or pipe). similar to the Start_record. No_Permission and File_Busy. and a start record of 65535 indicates the last record. Group ID.00 Data Object Library (Version 0. Temporary file is TEMPORARY and MUST be saved if changes are to be kept. and Permission. The end record number of file. No_Permission indicates that the file owner does not have enough privileges for the operation requested. A start record of 0 indicates the start of the file. The start record number of file. The following values are associated: 0: 1: 2: 3: 4: File_Size: Start_Record: OK indicates that the requested operation was successful. temporary. Doesn't_exist. The contents of the Data field will not be interpreted by the DNP Application Layer. These 8-bit objects are interpreted according to the File_Type field. Unique integer identifier for the file. the File_ID is only unique when concatenated with the File_Name and the Time_Of_Creation. This field can also be used to hold the error check (typically 16-bit CRC) for the file. Data: 11-8 DNP Users Group .Owner_ID: Group_ID: File_ID: Unique identifier for the owner of the file. Unique identifier for the owner's group. In this case. Actual data bytes that make up the file record. Variation: 01 Description: The internal indications is an information element used to convey internal states and diagnostic results of a responding station.0] State = BS1 [0] <0. Object Coding: 0 BS1 [0. 12. The number of internal indications objects sent in a message is device-dependent.00 Data Object Library (Version 0.12. This information can be used by a receiving station to perform error recovery or other functions..1 INTERNAL INDICATIONS Data Object 80 . 7 15 6 14 5 13 4 12 3 11 2 10 1 9 0 8 0 0 0 n n-1 n-2 n-3 n-4 DNP V3.1> Narrative: Transmission of the data object is always performed in complete octets. with unoccupied bit positions set to zero. The following example illustrates the packing of n of these data objects. DECLARATION RULES FOR INFORMATION ELEMENTS.02) 12-1 . DEVICE OBJECT DEFINITIONS This section defines the device data objects using the rules established in section 2. The group and variation fields together specify the exact data type. 12-2 DNP Users Group . The variation field indicates the variation of the object that the status field corresponds to. The overflow bit indicates that the buffer space for the specified data type has been over-utilized.2 STORAGE OBJECT Data Object 81 . and data objects have been lost.Variation: 01 Description: The storage object is an information element used to convey the status of internal buffers and storage areas for specific data types. The group field indicates the group (or data type) that the status field corresponds to.12. The status field shows what percentage of the buffer space allocated for this data type is currently used up. ...6] <0.255> Status = = BS7 [0.. 1.7] <0.7] UI8 [0. or other storage areas within the sending device. The object is generated by the device as configured in the device and described in the particular device profile. Overflow> Narrative: The storage object is used to indicate the status of buffer.00 Data Object Library (Version 0..7] <0.100> BS1 [7] <0.02) 12-3 .Object Coding: STATUS 7 6 5 4 3 2 1 0 GROUP 7 VARIATION 7 0 0 Storage Object ={ Status Group Variation } ={ Percent Overflow } = = = BS8 [0.. queues..255> UI8 [0. DNP V3. Principle of operation: The device profile object is intended to be sent by a slave device ONLY when the request sent by the master is not recognizable. The NumObjects field specifies how many sample object headers follow.12. In addition. upon reception of this object. can change its polling scheme. objects. The master. The functions field is an array of bits indicating support or non-support for each function code. only four bytes are needed. variation. The ObjectHeader fields have the same form as a DNP Application Layer object header. limit or expand the assumed functionality of the slave. poll request message. the objects section is a sample master poll object header for each object/variation. As a minimum. or objects referenced in the request are not supported. This object describes the station acting as a DNP master. 12-4 DNP Users Group . the header consists of the object. the range of indices for each object/variation is also given so that configuration can be done on a dynamic basis. Alternately.Variation: 01 Description: The device profile object provides for inter-operability between different DNP devices which use only a sub-set of the DNP Application Layer function codes and data objects. The device profile object consists of two sections. specifies the supported DNP Application Layer function codes.. The bit positions 0 . If the master station is less sophisticated. qualifier. This means that to describe most object variations. the slave station can be marked off-line. the slave could report (spontaneously) the device profile object upon start-up.3 DEVICE PROFILE Data Object 82 . specifies the range of indices valid for each object/variation combination. The second section. another functions field can follow the ObjectHeaders. Essentially. For request function codes beyond 63. functions. It is implied by the type of object what type of operation (function) can be performed on it so there is no need to map each function code to a set of objects. 63 correspond to DNP Application Layer function codes 0 to 63. and manual re-configuration would be necessary to obtain proper communications again. un-parsable. or re-configure the master database with objects specified in this object. and 8-bit quantity. if the slave is configured in a quiescent environment. The first section. Coincident with this message would be internal indications indicating a problem with parsing. and the valid function codes and objects that the slave device supports. .63] UI16 [0..7] <0.02) 12-5 ..7] <0.255> UI8 [0.7] <0...15] <0..7] <0. Some sample headers are: Object Header = SQ4 { Object Variation Qualifier Quantity } = = = = UI8 [0..Object Coding: Functions 63 NumObjects (n) 15 ObjectHeader 1 Quantity 7 0 7 Qualifier 0 7 Variation 0 7 Object 0 0 0 ObjectHeader 2 Quantity 7 0 7 Qualifier 0 7 Variation 0 7 Object 0 ObjectHeader n Quantity 7 0 7 Qualifier 0 7 Variation 0 7 Object 0 SQ2 {Functions = NumObjects = } BS64 [0..255> UI8 [0..255> UI8 [0.65535> Each object header that follows has a variable format determined by the rules for constructing Application Layer object headers.255> DNP V3..00 Data Object Library (Version 0. 7] <0..7] <0..7] <0.7] <0......255> UI8 [0...7] <0.15] <0.15] <0.255> UI8 [0.7] <0..65535> UI16 [0..65535> 12-6 DNP Users Group .7] <0..7] <0.255> UI8 [0.255> UI16 [0....255> UI8 [0.....255> = = = = = UI8 [0.255> UI8 [0..Object Header = SQ5 { Object Variation Qualifier Start Stop } Object Header = SQ5 { Object Variation Qualifier Start Stop } = = = = = UI8 [0.255> UI8 [0. 4 PRIVATE REGISTRATION OBJECT Data Object 83 . The description of the contents is entirely at the discretion of the vendor.216-1] U116 [0.D.. The Data Objects field contains the vendor's data (variable size and format) as described by the PROD object. The Private Registration Number (PRN) field is a vendor designated object I. The object consists of a fixed header to provide for transparent data transfer.12.Variation: 01 Type: Static\Event\Frozen Static\Frozen Event Description: This private registration object (PRO) object type is reserved for vendor-specific definition.232-1] U116[0. The Len field contains the length of the Data Objects field in octets. and a unique registration number of the following object.. Object Coding: VENDOR 31 PRN 15 LEN 15 DATA OBJECTS 0 0 0 0 SQx {Vendor PRN LEN SQn } = = = = U132 [0.00 Data Object Library (Version 0.02) 12-7 .216-1] Length of objects in <octets> sequence of n basic DNP objects DNP V3. The Vendor field is a four-byte ASCII vendor name.. Each object definition consists of the three fields: quantity. The Private Registration Number (PRN) field is a vendor designated object I. The private registration object description (PROD) object maintains a one-to-one relationship with the PRO object. specified by the object and variation fields. Each element consists in turn of a set of DNP object and variation numbers. The description of the contents is entirely at the discretion of the vendor. The Count field specifies the number of object definitions that follow this field. object and variation.Variation: 02 Type: Static Description: This object type is reserved for vendor private registration object description. which will be found in the PRO object. The object is matched one-to-one with its PRO object. The object consists of a fixed header to provide for transparent data transfer.D.12. 12-8 DNP Users Group . and a unique registration number of the following object.5 PRIVATE REGISTRATION OBJECT DESCRIPTOR Data Object 83 . and can be used to parse the PRO into basic DNP Objects for processing. The Quantity field specifies the number of objects. The Vendor field is a four-byte ASCII vendor name. The PROD consists of one element for each corresponding element of the PRO. ..Object Coding: VENDOR 31 PRN 15 COUNT 15 QUANTITY 15 OBJECT 7 VARIATION 7 QUANTITY 15 OBJECT 7 VARIATION 7 QUANTITY 15 OBJECT 7 VARIATION 7 0 0 0 0 0 0 0 0 0 0 0 0 SQx {Vendor PRN COUNT SQn = = = = { } UI32 [0..216-1] UI16 [0.28-1] Variation = U18 [0.232-1] UI16 [0..00 Data Object Library (Version 0.02) 12-9 .216-1] Sequence of n basic DNP object definitions U18 [0.216-1] Quantity = } DNP V3...28-1] Object = U18 [0. and A. • Count specifies that three definitions follow. object. • PRN is private object #16 for vendor A B B. and variation. with each definition consisting of quantity. 12-10 DNP Users Group . represent the vendor name. B.The following illustrations serve as examples for more clarification: PROD: (blank) B B 0 0 A 16 3 2 1 2 2 21 2 5 30 1 In the above example: • B. 02) 12-11 .The corresponding PRO object is: (blank) B B 0 0 A 16 33 binary input 1 binary input 2 Counter 1 Counter 2 Analog 1 Analog 2 Analog 3 Analog 4 Analog 5 DNP V3.00 Data Object Library (Version 0. 12-12 DNP Users Group . Variation: 01 Description: The application identifier object is an information object used to represent an application or operating system process within a device. or if the application is unknown. 13.1 APPLICATION IDENTIFIER Data Object 90 . DNP V3. This object is used in conjunction with the application functions of the application layer to control software applications. APPLICATION OBJECT DEFINITIONS This section defines the application data objects using the rules established in section 2. The free-format qualifier of the application layer should be used to identify the application in question.00 Data Object Library (Version 0. This object has no defined format and is simply used as a place holder. DECLARATION RULES FOR INFORMATION ELEMENTS.13. the ALL qualifier should be used to specify all relevant applications.02) 13-1 . 13-2 DNP Users Group . ALTERNATE NUMERIC OBJECT DEFINITIONS This section defines the alternate or custom numeric representation data objects using the rules established in section 2. The flag field holds information about the point and has the same meaning as previous objects. The value field holds the actual floating point number and follows the format for a short real as specified by the IEEE-754 standard.02) 14-1 . DNP V3. The format of this object complies with the IEEE-754 standard for floating-point number representation. DECLARATION RULES FOR INFORMATION ELEMENTS. 14. The units field determines the units of the value field.1 SHORT FLOATING POINT Data Object 100 .00 Data Object Library (Version 0. This is the scientific or engineering units associated with the measured or calculated quantity.Variation: 01 Description: The short floating point information object represents a calculated or measured scientific value.14. 1. s22 x 2 (Exp -127) Significant[i. 1.. on-line> BS1 [1] <0.. lost> BS1 [3] <0.. Significant. forced> BS1 [4] <0> BS1 [5] <0.s0 s1 s2 s3 s4 . 1. restart> BS1 [2] <0. and 1 if the number is negative.Object Coding: Units 7 0 Value Sign 0 0 7 Exponent 0 Significant 22 0 7 Flag 0 FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } ={ = = = = = = = = BS1 [0] <0. Significant binary digits in value. off-line. 1.7] 0 if number is positive. normal. 1. over-range> BS1 [6] <0. normal. normal. normal. error> BS1 [7] <0> Narrative: The absolute value can be derived from the value field as follows: Absolute_Value where: Sign: Exponent: Significant: si = = 1.i] and Exp= Exponent[0. Power of 2 applied to 1. 1. normal. 14-2 DNP Users Group . 00 Data Object Library (Version 0.02) 14-3 .The units field has the following defined values: 0: Volts p-p (peak-to-peak voltage) 1: Amperes p-p (peak-to-peak current) 2: Volts RMS 3: Amperes RMS 4: KW or kilowatts (real power or volt-amps resistive) 5: KVA or kilo volt-amps (volt-amps total) 6: KVAR or kilovars (imaginary power or volt-amps reactive) 7: KwH (kilowatt hours) 8: KVARH (kiloVAR hours) 9: PF (power factor) 10: Hz (frequency in cycles per second) 11: w (frequency in radians) 12: C (degrees Celsius) 13: F (degrees Fahrenheit) 14: K (degrees Kelvin) 15: N (force in Newtons) 16: kg (mass in kilograms) 17: m/s2 (acceleration) 18: N/m2 (pressure in Newtons per square meter) 19: N*m (torque in Newton-meters) DNP V3. 1.2 LONG FLOATING POINT Data Object 100 . forced> BS1 [4] <0> BS1 [5] <0. restart> BS1 [2] <0. This is the scientific or engineering units associated with the measured or calculated quantity. normal.14. lost> BS1 [3] <0.Variation: 02 Description: The long floating point information object represents a calculated or measured scientific value. 1. Object Coding: Units 7 0 Value Sign 0 0 Exponent 10 0 Significant 51 0 7 Flag 0 FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } ={ = = = = = = = = BS1 [0] <0. 1. The units field determines the units of the value field. The value field holds the actual floating point number and follows the format for a long real as specified by the IEEE-754 standard. off-line. 1. normal. The flag field holds information about the point and has the same meaning as previous objects. on-line> BS1 [1] <0. normal. 1. normal. over-range> BS1 [6] <0. normal. 1. error> BS1 [7] <0> 14-4 DNP Users Group . The format of this object complies with the IEEE-754 standard for floating-point number representation. 00 Data Object Library (Version 0. and 1 if the number is negative..7] 0 if number is positive. Significant. s51 x 2 (Exp -1023) Significant[i.02) 14-5 ..s0 s1 s2 s3 s4 .Narrative: The absolute value can be derived from the value field as follows: Absolute_Value where: Sign: Exponent: Significant: si = = 1. The units field has the following defined values: 0: Volts p-p (peak-to-peak voltage) 1: Amperes p-p (peak-to-peak current) 2: Volts RMS 3: Amperes RMS 4: KW or kilowatts (real power or volt-amps resistive) 5: KVA or kilo volt-amps (volt-amps total) 6: KVAR or kilovars (imaginary power or volt-amps reactive) 7: KwH (kilowatt hours) 8: KVARH (kiloVAR hours) 9: PF (power factor) 10: Hz (frequency in cycles per second) 11: w (frequency in radians) 12: C (degrees Celsius) 13: F (degrees Fahrenheit) 14: K (degrees Kelvin) 15: N (force in Newtons) 16: kg (mass in kilograms) 17: m/s2 (acceleration) 18: N/m2 (pressure in Newtons per square meter) 19: N*m (torque in Newton-meters) DNP V3..i] and Exp= Exponent[0. Power of 2 applied to 1. Significant binary digits in value. over-range> BS1 [6] <0. lost> BS1 [3] <0. normal. This is the scientific or engineering units associated with the measured or calculated quantity. Object Coding: Units 7 0 Value Sign 0 0 Exponent 14 0 Significant 63 0 7 Flag 0 FLAG On-line Restart Communication lost Remote forced data Local forced data Over-range Reference check Reserved } ={ = = = = = = = = BS1 [0] <0. error> BS1 [7] <0> 14-6 DNP Users Group . The units field determines the units of the value field.14. forced> BS1 [4] <0> BS1 [5] <0. The value field holds the actual floating point number and follows the format for a temp real as specified by the IEEE-754 standard. 1. 1. normal.Variation: 03 Description: The extended floating point information object represents a calculated or measured scientific value. 1. The flag field holds information about the point and has the same meaning as previous objects.3 EXTENDED FLOATING POINT Data Object 100 . restart> BS1 [2] <0. 1. off-line. 1. normal. The format of this object complies with the IEEE-754 standard for floating-point number representation. on-line> BS1 [1] <0. normal. normal. 1. Significant binary digits in value.i] and Exp= Exponent[0.7] 0 if number is positive.. Power of 2 applied to 1. The units field has the following defined values: 0: Volts p-p (peak-to-peak voltage) 1: Amperes p-p (peak-to-peak current) 2: Volts RMS 3: Amperes RMS 4: KW or kilowatts (real power or volt-amps resistive) 5: KVA or kilo volt-amps (volt-amps total) 6: KVAR or kilovars (imaginary power or volt-amps reactive) 7: KwH (kilowatt hours) 8: KVARH (kiloVAR hours) 9: PF (power factor) 10: Hz (frequency in cycles per second) 11: w (frequency in radians) 12: C (degrees Celsius) 13: F (degrees Fahrenheit) 14: K (degrees Kelvin) 15: N (force in Newtons) 16: kg (mass in kilograms) 17: m/s2 (acceleration) 18: N/m2 (pressure in Newtons per square meter) 19: N*m (torque in Newton-meters) DNP V3.Narrative: The absolute value can be derived from the value field as follows: Absolute_Value where: Sign: Exponent: Significant: si = = 1... s51 x 2 (Exp -1023) Significant[i.00 Data Object Library (Version 0.02) 14-7 . Significant. and 1 if the number is negative.s0 s1 s2 s3 s4 . 10> UI4 [0.10> UI4 [0.14.3] <0.3] <0...10> UI4 [0.10> 14-8 DNP Users Group .4 SMALL-PACKED BINARY CODED DECIMAL Data Object 101 .Variation: 01 Description: The small-packed binary coded decimal information object represents a sequence of BCD digits..... Each BCD digit can represent a variety of information from control outputs to analog inputs. Object Coding: Digit 4 3 0 3 Digit 3 0 3 Digit 2 0 3 Digit 1 0 SPBCD = SQ4 { Digit1 Digit2 Digit3 Digit4 } = = = = UI4 [0.3] <0...3] <0. 3] <0...3] <0.10> UI4 [0.10> UI4 [0..00 Data Object Library (Version 0..Variation: 02 Description: The medium-packed binary coded decimal information object represents a sequence of BCD digits.. Object Coding: Digit 4 3 0 3 Digit 3 0 3 Digit 2 0 3 Digit 1 0 Digit 8 3 0 3 Digit 7 0 3 Digit 6 0 3 Digit 5 0 MPBCD = SQ8 { Digit1 Digit2 Digit3 Digit4 Digit5 Digit6 Digit7 Digit8 } = = = = = = = = UI4 [0...10> UI4 [0.. Each BCD digit can represent a variety of information from control outputs to analog inputs.10> UI4 [0.10> UI4 [0.3] <0..3] <0.10> UI4 [0.3] <0.5 MEDIUM-PACKED BINARY CODED DECIMAL Data Object 101 ..02) 14-9 .10> DNP V3.3] <0...14.10> UI4 [0.3] <0..3] <0.... ....3] <0..3] <0.3] <0. Each BCD digit can represent a variety of information from control outputs to analog inputs...3] <0.10> UI4 [0.3] <0.3] <0.10> UI4 [0..10> UI4 [0.10> UI4 [0...10> UI4 [0..10> UI4 [0..Variation: 03 Description: The large-packed binary coded decimal information object represents a sequence of BCD digits.10> UI4 [0.3] <0.10> UI4 [0.3] <0.3] <0..10> UI4 [0.14...3] <0.10> UI4 [0.10> UI4 [0.... Object Coding: Digit 4 3 0 3 Digit 3 0 3 Digit 2 0 3 Digit 1 0 Digit 8 3 0 3 Digit 7 0 3 Digit 6 0 3 Digit 5 0 Digit 12 3 0 3 Digit 11 0 3 Digit 10 0 3 Digit 9 0 Digit 16 3 0 3 Digit 15 0 3 Digit 14 0 3 Digit 13 0 LPBCD = SQ16 { Digit1= Digit2= Digit3= Digit4= Digit5= Digit6= Digit7= Digit8= Digit9= Digit10= Digit11= Digit12= Digit13= Digit14= Digit15= } UI4 [0..3] <0.10> 14-10 DNP Users Group ..6 LARGE-PACKED BINARY CODED DECIMAL Data Object 101 ...10> UI4 [0..3] <0.10> UI4 [0.3] <0...3] <0....3] <0...10> UI4 [0. LIST OF ABBREVIATIONS AND ACRONYMS ASCII BCD BIN BS CRC CTO CTO CWD DA DAC DNP EBCDIC EXEC F FIFO I ID IEC IEEE LEN LPBCD MPBCD MSEC OS American Standard Code for Information Interchange binary coded decimal bit string cyclic redundancy check common time object common time of occurrence change working directory distributed automation data acquisition and control Distributed Network Protocol extended binary coded decimal execute fixed point first-in-first-out integer identification International Electrotechnical Commission Institute of Electrical and Electronics Engineers length large-packed binary coded decimal medium-packed binary coded decimal millisecond octet string DNP V3.02) 1 .00 Data Object Library (Version 0. PCB PRN PRO PROD PWD R RESP RMS SCADA SPBCD UF UI pattern control block private registration number private registration object private registration object description (return to) present working directory real response root mean squared supervisory control and data acquisition small-packed binary coded decimal unsigned fixed point unsigned integer 2 DNP Users Group . 1995 .00 SUBSET DEFINITIONS Document Number: P009-0IG.SUB Version: 2.DNP V3.00 Date: November. 12 95. the information contained in this manual is subject to change without notice. Version 2.20 95.DNP USERS GROUP The contents of this manual are the property of the DNP Users Group.NOTICE OF RIGHTS . In addition. An update program for DNP documents is provided upon request by the DNP Users Group.11. Revisions or additions to the definition and functionality of the DNP Protocol cannot be made without express written agreement from the DNP Users Group or its duly authorized party. MODIFICATION RECORD VERSION 0.06.29 INITIALS GG/PM GG GG ST COMMENT Changes from Aug 19 review. TRADEMARK NOTICES DNP is a trademark of the DNP Users Group.08 95.02 1. Changes to delete Harris references. Changes due to comments from the DNP Users Group Technical Committee.01 0.00 .00 DATE 94. ii DNP Users Group P009-0IG. The DNP Users Group has made every reasonable attempt to ensure the completeness and accuracy of this document.SUB. and does not represent a commitment on the part of the DNP Users Group. except as permitted by written agreement with the DNP Users Group or a Party duly authorized by the DNP Users Group. Any brand and product names mentioned in this document are trademarks or registered trademarks of their respective companies. Changes from Jan 1995 DNP Users Group meeting and May 30 review. However.00 2.07.09. no part of this document may be altered or revised or added to in any form or by any means. .............................................................. 1 4...............................................L3)................. 1 2......00 IMPLEMENTATION (DNP .................................................5.... 6 4..................... 5 4..... 1 3..1 INTENDED USE ..x GOALS AND ASSUMPTIONS..3 SLAVE DEVICE START-UP.................................................................................. 1 4.................................................................vi WHO SHOULD USE THIS GUIDE............................ 7 DNP V3.......................................................................................................2 Recommendations...........2.............................................................................L1)............................................................ 1 3................2 GENERAL DESCRIPTION ................................................2 GENERAL DESCRIPTION ............... 1 3.......1 Rules ................................................................................................................2 DATA CLASSES AND EVENTS .................................................. ix READING THE SUBSET TABLES ................................ 2 Chapter 2: LEVEL 2 DNP V3... 1 4............................................ 7 4........... 1 1.....3 IMPLEMENTATION TABLE ... 7 4..................... 2 4....................... viii OVERVIEW ..........................................1 Rules .......................................1 INTENDED USE ..................00 Subset Definitions P009-0IG....................................................1 Rules ......2 Recommendations.................... 1 2.......................1..........................................2 Recommendations......................2 GENERAL DESCRIPTION ....00 IMPLEMENTATION (DNP-L2)...................................................................... 1 1................................ 1 1...............................................SUB.........................1 ERROR RESPONSES....... ix TERMINOLOGY ...................3 IMPLEMENTATION TABLE ....... vii CONVENTIONS USED IN THIS GUIDE .......................................................vi HOW THIS GUIDE IS ORGANIZED ............................................... 1 2........1 Rules ....5 OPERATING BINARY OUTPUTS.............................1 Rules ...................................1 INTENDED USE ........ 2 Chapter 4: IMPLEMENTATION RULES AND RECOMMENDATIONS .4............. 1 Chapter 3: LEVEL 3 DNP V3......................................................... 6 4...............3 IMPLEMENTATION TABLE . 5 4................... Version 2.......................................5........................3...........vi ADDITIONAL DOCUMENTATION............. xii Chapter 1: LEVEL 1 DNP V3..3.............................................................................vi PURPOSE OF THIS GUIDE ......................... 2 4.................TABLE OF CONTENTS ABOUT THIS GUIDE ........................................... 4 4. 6 4..................................4 UNSOLICITED RESPONSES ..00 iii ...............................00 IMPLEMENTATION (DNP ..............................2.......................... ......................00 ........7 MULTIPLE OBJECTS IN A SINGLE REQUEST...............................8 MULTIPLE OBJECTS IN A SINGLE RESPONSE ..............................................................10 WITH-FLAG AND WITHOUT-FLAG VARIATIONS...11...........3 Rules for Counter Objects and the ROLL-OVER Flag............... 9 4...................... 1 5....... 15 4.................... 9 4......................................................................1 Rules ..........................................SUB...............................12.1 Rules ..... 9 4..2 MASTER DEVICES..................................1 Rules .9..................6.............2 Rules for Analog Inputs and the OVER-RANGE Flag ........1 Rules ......................11............................................ 10 iv DNP Users Group P009-0IG.......................................1 Rules .................................6 FRAGMENTS AND FRAMES ..10....................................................... 15 4.. 16 Chapter 5: CONFORMANCE....................................7.13 FREEZE OPERATIONS .. 15 4............................................. 8 4...2 Recommendations ....11 16-BIT AND 32-BIT VARIATIONS ......................................................... 2 Appendix A: DEVICE PROFILE DOCUMENT FORMAT................2 Recommendations ......13.....11..............6.................................................................................. 11 4. 8 LIST OF ACRONYMS AND ABBREVIATIONS .....9...............14...........................................................1 Rules ..... 9 4.......................................... 1 GLOSSARY OF TERMS .2 Recommendations ......... Version 2......................12 TIME TAGGED BINARY INPUT EVENTS ...... 8 4.......... 9 4................................................. 14 4.............. 9 4................ 11 4.............................................................. 16 4....................................9 CONFIRMATION AND RETRIES ......................................................... 8 4.. 12 4........... 12 4....................4 Recommendations Regarding the ROLL-OVER Flag..................................................1 Rules ................... 1 5........................12.......11............1 Rules ......4... 12 4........1 SLAVE DEVICES.......................1 Rules .............................. 15 4. 10 4......................................................8.. 14 4.... .................SUB............1-1 Valid Error Responses .....................................LIST OF TABLES Table 1 Qualifiers Used in the Subset Definitions ..............3-1 Level 1 Implementation (DNP-L1) ...............3-1 Level 3 Implementation (DNP-L3) ................... 13 DNP V3... Version 2....11-1 Examples of Over-Range Conditions and Values...00 v ..2 Table 4..2 Table 4....... xiii Table 1....3-1 Level 2 Implementation (DNP-L2) ....................2 Table 3..............................00 Subset Definitions P009-0IG.................3 Table 2.. 00 Data Link Layer and Transport Function. for the purpose of giving vendors and customers a common set of terms for describing what they have implemented and what they require. • Purchasing agents or certification agencies responsible for determining whether a vendor's product meets customers' standards. several supporting texts are available. respectively.00 Data Link Layer (P009-0PD.00 Application Layer. defined for the Distributed Network Protocol (DNP) V3.DL) Version 0. • Systems engineers responsible for determining compatibility between components of a network.TF) Version 0.00 Application Layer.SUB.01 vi DNP Users Group P009-0IG. ADDITIONAL DOCUMENTATION If you require more detail than this document provides.00 Transport Functions (P009-0PD. It is intended to be used as a reference for determining compatibility between implementations of the DNP V3.0 Basic 4-Document Set including: DNP V3.02 DNP V3.00 . or levels. These include: • Distributed Network Protocol 3.ABOUT THIS GUIDE PURPOSE OF THIS GUIDE This document defines the implementation subsets. although its audience is not necessarily limited to those listed here: • Designers responsible for determining what portion of the protocol to implement. WHO SHOULD USE THIS GUIDE This guide is intended to be used by the following people. It also briefly discusses some compatibility issues with respect to the DNP V3. This document describes several subsets of the protocol. Version 2. 00 Subset Definitions P009-0IG. and the duties of devices implementing the subsets. larger than Level 2. OVERVIEW describes basic concepts concerning DNP subsets: basic terminology. slightly larger than Level 1. typically between a master station and an Intelligent Electronic Device (IED).00 vii . how to interpret the implementation tables.00 IMPLEMENTATION (DNP-L3) describes a subset of the protocol.SUB.00 implementation. LEVEL 2 DNP V3.00 Data Object Library (P000-0BL) Version 0.APP) Version 0. CONFORMANCE describes the conditions under which a device is said to conform to a given DNP subset.03 DNP V3. Chapter 1: LEVEL 1 DNP V3. It is typically implemented between a master station and a large IED or small Remote Terminal Unit (RTU).00 DNP V3.00 Application Layer (P009-0PD. Chapter 2: Chapter 3: Chapter 4: Chapter 5: Appendix A: DEVICE PROFILE DOCUMENT FORMAT describes the information a device vendor must include in a document describing a device's implementation of DNP V3. Version 2.00 Application Layer protocol.00 IMPLEMENTATION (DNP-L2) describes a subset of the protocol.- DNP V3. IMPLEMENTATION RULES AND RECOMMENDATIONS describes rules and recommendations applying to all levels of DNP V3.00 IMPLEMENTATION (DNP-L1) describes the minimum subset of the protocol that can be implemented. Each chapter of the guide describes one subset of the DNP V3. It briefly discusses the goals used to develop the subsets. that can be implemented between a master station and a more advanced RTU. LEVEL 3 DNP V3.02 HOW THIS GUIDE IS ORGANIZED The organization of this guide is described below. • Chapter references are highlighted in bold text.g. Version 2. TRIP function. like this list. • Specific function and field names are in CAPITAL LETTERS. as are book and document titles. Chapter 2: SPECIAL REQUIREMENTS). viii DNP Users Group P009-0IG.00 . but not bold (e. • New or special terms are highlighted in bold text. • References to main section titles are highlighted using italics.g.SUB. GROUP ADDRESS field).CONVENTIONS USED IN THIS GUIDE There are a few formatting conventions used in this guide to make it easier to read and understand. • Lists of procedural instructions are numbered in the order they are to be performed. Table names are also bold (e. They are listed below. and words used with special emphasis. AXXX_CFG). Other lists of information are bulleted. with the chapter title in CAPITAL LETTERS (for example. For example. DNP V3. or just "This device implements DNP . TERMINOLOGY This section defines some of the terms used throughout this document.00 subset. The following terms are used throughout this document: configure To initialize a device so it operates in a particular way. The abbreviation for a DNP subset implementation consists of "DNP". For instance.g. Master A device that initiates requests to gather data or perform controls using DNP. and "L" followed by the level number.00 Application Layer protocol Level 1". A device may implement extra features in addition to these requirements and still conform. a dash.00 protocol subsets in general. parameters in ROM.OVERVIEW This section describes various concepts concerning DNP V3. dip switches or hardware jumpers).SUB. a customer may configure a device so the device never requests data link confirmations.00 ix . "This device implements the DNP V3. it is said to implement a particular level of the protocol. Version 2. ! NOTE: This document specifies only the minimum requirements for a particular implementation level. When a Master or Slave satisfies all the requirements of a particular DNP V3.00 Subset Definitions P009-0IG. Refer to CHAPTER 5: CONFORMANCE for more details. a vendor may be able to say. The term "Level" is chosen so as to not conflict with DNP data classes or the Open Systems Interconnect (OSI) concept of layers.L1". parameters in NVRAM. A vendor or customer may configure a device using a variety of mechanisms (e. To be able to send or parse a particular set of DNP objects. Version 2. To resolve a request or response into component parts.00 protocol discussed in this document are described in a common format. it must make any confirmation responses or other responses that the message requires. To actually send to a Master device a particular object variation. to parse a message means a device can break the message into pieces. variations.SUB. A Slave device may parse requests for a larger subset of objects than it actually reports. each of which consists of a header and sometimes some corresponding data. it can recognize each piece of a message. Used only in connection with Slave devices.Slave A device that gathers data or performs control operations in response to DNP requests from the Master. Each chapter of this document describing an implementation level contains a table having the following fields: OBJECT These fields describe a DNP application layer object: Obj Var Description The object group The object variation The text name of the object x DNP Users Group P009-0IG. A Slave device may also generate DNP Unsolicited Responses.00 . parse report support READING THE SUBSET TABLES The subsets of the DNP V3. In the context of DNP V3. function codes and/or qualifiers. However. It does not necessarily make use of the data found in that message. and sends response messages in return.00 messages. If a device is able to parse a message. function codes. it must be used with the function and qualifier codes in order to implement the subset.00 defined within this document.00 xi . Each level builds upon the level preceding it. outputs and data for all of the objects in the subset. ! NOTE: The subset describes the minimum set of objects. DNP V3.00 Subset Definitions P009-0IG. function codes. function codes. A list of the qualifier codes the Slave must parse in association with this object. If an object is supported.REQUEST These fields describe the set of DNP V3.00 objects. Func Codes A list of the response function codes the Master must accept as operators on this object.SUB. and qualifiers a Master device must be able to parse from an incoming response or unsolicited response in order to have implemented the subset. RESPONSE These fields describe the set of DNP V3.00 objects. There are three levels of implementation of DNP V3. and qualifiers the devices must parse in order to implement the subset. It does not specify that a Slave device must actually report inputs. These fields also define the minimum subset of responses a Slave device may make. Func Codes Qual Codes A list of the request function codes that the Slave must accept as operators on this object. and qualifiers a Slave device must be able to parse as a part of an incoming request in order to have implemented the subset. Qual Codes If these fields are blank. A list of the qualifier codes the Master must parse in association with this object. If these fields are blank. it means the Master need not be able to parse the specified object in order to implement the subset. The additions to a level from the preceding level are highlighted by shading in the table. Version 2. it means the Slave need not be able to parse the specified object in order to implement the subset. as discussed in section 4. The Slave device need not parse READ requests for 16-Bit Analog Input Without Flag objects using any other Qualifier Codes.. 06 30 16-Bit Analog Input without Flag . This entry indicates the following: • A Slave device must accept and respond to any READ request (Function Code 1) of 16-Bit Analog Input Without Flag objects. 01. A Master device must be able to parse either RESPONSEs (Function Code 129) or UNSOLICITED RESPONSEs (Function Code 130) from the Slave containing 16-Bit Analog Input Without Flag objects. The response must use Qualifier Code 0x01. 130 Qual Codes (hex) 01 Obj Va r 4 Description Func Codes 1 Qual Codes (hex) 00.SUB. The Master device cannot include a 16-Bit Analog Input Without Flag object in any request containing a function code other than READ. It may set an Internal Indication bit in its response. The READ request may use either 8-bit start and stop indices (Qualifier Code 0x00). The Master device need not parse responses or unsolicited responses containing 16-Bit Analog Input Without Flag objects using any other Qualifier Codes.. The Slave need not actually report any analog inputs. but can discard it after sending any necessary confirmation..00 . The Master need not use the data supplied by the Slave for any purpose.1 Error Responses. • • • GOALS AND ASSUMPTIONS These subset definitions were prepared with the following goals: xii DNP Users Group P009-0IG. suppose a subset table contains the following line: OBJECT REQUEST (slave must parse) RESPONSE (master must parse) Func Codes 129. 16-bit start and stop indices (Qualifier Code 0x01). or no range field (Qualifier Code 0x06).. Version 2.. or return a null response.For example. In a typical minimum implementation. interspersed with infrequent Class 0 Data polls. 08 Use in a Request A range of static points. Therefore. Time and Date) 17. the fewer points it would provide. There may be a few exceptions to these rules. the lower level subset definitions are based around polls of Class Data Objects. Qualifiers are a complex part of DNP. 2 or 3 Data. Allow flexibility for a variety of different.g. Table 1 illustrates the subset of qualifiers chosen and the intended use of each qualifier. It was assumed that the simpler the Slave device. More advanced implementations may take advantage of Unsolicited Responses and the more complex polling features available in DNP. Version 2. As a result of these goals and assumptions.g. so the number of qualifiers required to be supported by either a Master or a Slave devices was limited. or a single point with a point number All points A limited quantity of events A single point with no number (e. See 4. Where complexity must be added. it was added at the Master rather than the Slave. Time and Date) Event objects (usually one or more unrelated points) Table 1 Qualifiers Used in the Subset Definitions DNP V3. Allow all data provided by a Slave to be retrieved at any Level.00 xiii . but interoperable implementations. 01 06 07.2 Data Classes and Events for more discussion regarding the use of data classes. it is expected that a Master device will poll frequently for Class 1. Minimize the bandwidth used.• • • • Minimize the complexity of implementation. there would be less need for the more complex point range specifications available in DNP.00 Subset Definitions P009-0IG. 28 Controls (usually one or more unrelated points) Use in a Response Static objects Not valid A single point with no number (e.SUB. Qualifier (hex) 00. . 00 for communicating between a Master and a typical Intelligent Electronic Device (IED). meter.1 Error Responses). DNP V3. auto-recloser or capacitor bank controller). the Slave is allowed to respond OBJECT UNKNOWN (see 4. as described in the Goals and Assumptions section of the OVERVIEW.00 1 . Version 2. A Level 1 Slave must accept requests for: • • READs of Class Data Objects READs of Binary Output and Analog Output objects. It is intended for use with Slave devices whose input and output points are local to the device. It would typically be used between a master station or data concentrator and a small end device (eg. This implementation level is called Level 1 (L1).00 IMPLEMENTATION (DNP .1 INTENDED USE This level of implementation is intended to represent the simplest implementation of DNP V3.Chapter 1: LEVEL 1 DNP V3.2 GENERAL DESCRIPTION The Level 1 subset is based around Class Data polling.00 Subset Definitions P009-0IG. 1. if such outputs exist on the Slave.L1) This chapter describes the minimum subset of the DNP V3. 1.SUB. relay.00 Application Layer that can be supported and still be said to implement the protocol. ! NOTE: If such objects do not exist. if the Slave sets the TIME SYNCHRONIZATION REQUIRED Internal Indication (See 4. ! 1. a Level 1 Slave is not required to generate them.00 implementation. and qualifiers used in a Level 1 DNP V3. Version 2. If such objects do not exist. but includes most basic data types: • • • • • • Binary Inputs and Events Counters and Counter Events Analog Inputs and Events Binary and Analog Output Status Frozen objects Time-stamped objects. the Slave is allowed to respond OBJECT UNKNOWN.00 . because Sequence of Events (SOE) information is a common industry requirement The following are specifically NOT included: NOTE: Although a Level 1 Master must be able to parse many objects. a Slave need not provide Binary Output Status or Analog Output Status objects if it does not control any of these outputs. See 4. 2 DNP Users Group P009-0IG. A Level 1 Slave may send Unsolicited Responses of some objects.4 Unsolicited Responses. with the exception of Binary Inputs.13 Time Synchronization) A Level 1 Master must accept a subset of object variations that is about one-third of the total number defined in DNP. For example. if they exist on the Slave.• • • • Control operations to Binary Output or Analog Outputs.SUB.3 IMPLEMENTATION TABLE Table 1. The Slave may also choose to report Binary Input Without Time objects instead of Binary Input Change With Relative Time objects. function codes. but this capability must be configurable.3-1 describes the objects. WRITEs to the RESTART Internal Indication COLD RESTARTs DELAY MEASUREMENTs and WRITEs to Time and Date. 6 17.00 Subset Definitions P009-0IG. 01 00. Version 2.All Variations Binary Input Change without Time Binary Input Change with Time Binary Input Change with Relative Time Binary Output . 01 00 .All Variations 32-Bit Binary Counter 16-Bit Binary Counter 32-Bit Delta Counter 16-Bit Delta Counter 32-Bit Binary Counter without Flag 16-Bit Binary Counter without Flag 32-Bit Delta Counter without Flag 16-Bit Delta Counter without Flag 129 129 129 129 129 129 129 129 00. 4. 28 129 echo of request 129 00.00 3 .SUB.All Variations Binary Output Binary Output Status Control Block . 5.3-1 Level 1 Implementation (DNP-L1) OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes (dec) Qual Codes (hex) 1 1 1 2 2 2 2 10 10 10 12 12 12 12 20 20 20 20 20 20 20 20 20 21 0 1 2 0 1 2 3 0 1 2 0 1 2 3 0 1 2 3 4 5 6 7 8 0 Binary Input . 01 00. 130 129.01 00. 130 17. 01 00. 01 00. 28 17. 01 00. 28 129 129 00. 01 00.All Variations Binary Input Binary Input with Status Binary Input Change .All Variations 21 21 21 21 21 21 21 1 2 3 4 5 6 7 32-Bit Frozen Counter 16-Bit Frozen Counter 32-Bit Frozen Delta Counter 16-Bit Frozen Delta Counter 32-Bit Frozen Counter with Time of Freeze 16-Bit Frozen Counter with Time of Freeze 32-Bit Frozen Delta Counter with Time of Freeze DNP V3. 130 129. 01 Frozen Counter .All Variations Control Relay Output Block Pattern Control Block Pattern Mask Binary Counter . 01 3. 01 1 06 129. 28 17.Table 1. 130 129. 28 17. 28 4 DNP Users Group P009-0IG. 130 129. 01 129.All Variations 32-Bit Analog Input 16-Bit Analog Input 32-Bit Analog Input without Flag 16-Bit Analog Input without Flag Frozen Analog Input . Version 2.All Variations 32-Bit Counter Change Event without Time 16-Bit Counter Change Event without Time 32-Bit Delta Counter Change Event without Time 16-Bit Delta Counter Change Event without Time 32-Bit Counter Change Event with Time 16-Bit Counter Change Event with Time 32-Bit Delta Counter Change Event with Time 16-Bit Delta Counter Change Event with Time Frozen Counter Event . 28 17. 01 00.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes (dec) Qual Codes (hex) 21 21 21 21 21 22 22 22 22 22 22 22 22 22 23 23 23 23 23 23 23 23 23 30 30 30 30 30 31 31 31 31 31 8 9 10 11 12 0 1 2 3 4 5 6 7 8 0 1 2 3 4 5 6 7 8 0 1 2 3 4 0 1 2 3 4 16-Bit Frozen Delta Counter with Time of Freeze 32-Bit Frozen Counter without Flag 16-Bit Frozen Counter without Flag 32-Bit Frozen Delta Counter without Flag 16-Bit Frozen Delta Counter without Flag Counter Change Event . 01 00. 130 129.SUB.00 . 28 17.All Variations 32-Bit Frozen Analog Input 16-Bit Frozen Analog Input 32-Bit Frozen Analog Input with Time of Freeze 16-Bit Frozen Analog Input with Time of Freeze 129 129 129 129 00. 01 00.All Variations 32-Bit Frozen Counter Event without Time 16-Bit Frozen Counter Event without Time 32-Bit Frozen Delta Counter Event without Time 16-Bit Frozen Delta Counter Event without Time 32-Bit Frozen Counter Event with Time 16-Bit Frozen Counter Event with Time 32-Bit Frozen Delta Counter Event with Time 16-Bit Frozen Delta Counter Event with Time Analog Input . 130 17. 00 Subset Definitions P009-0IG.07.All Variations Time and Date Time and Date with Interval Time and Date CTO .28 1 06 129 00. 130 129. 6 17. quantity=1 129. 01 3. quantity=1 07. Version 2. 130 07.14) 07.00 5 . 28 129 echo of request 2 (see 4. quantity=1 129.All Variations 32-Bit Analog Change Event without Time 16-Bit Analog Change Event without Time 32-Bit Analog Change Event with Time 16-Bit Analog Change Event with Time Frozen Analog Event . quantity=1 07.All Variations Time Delay Coarse Time Delay Fine 129 129 07. 130 17.All Variations 32-Bit Analog Output Block 16-Bit Analog Output Block Time and Date . 4.SUB.08 DNP V3.28 17.All Variations Time and Date CTO Unsynchronized Time and Date CTO Time Delay . 5.All Variations 32-Bit Analog Output Status 16-Bit Analog Output Status Analog Output Block .All Variations 32-Bit Frozen Analog Event without Time 16-Bit Frozen Analog Event without Time 32-Bit Frozen Analog Event with Time 16-Bit Frozen Analog Event with Time Analog Output Status .OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes (dec) Qual Codes (hex) 31 31 32 32 32 32 32 33 33 33 33 33 40 40 40 41 41 41 50 50 50 51 51 51 52 52 52 60 60 60 5 6 0 1 2 3 4 0 1 2 3 4 0 1 2 0 1 2 0 1 2 0 1 2 0 1 2 0 1 2 32-Bit Frozen Analog Input without Flag 16-Bit Frozen Analog Input without Flag Analog Change Event . 130 129. quantity=1 Class 0 Data Class 1 Data 1 1 06 06. 14) 6 DNP Users Group P009-0IG.08 06.00 .07. Version 2. index=7 13 23 (see 4.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) 1 1 Qual Codes (hex) 06.07.SUB.08 RESPONSE (master must parse) Func Codes (dec) Qual Codes (hex) 60 60 70 80 81 82 83 83 90 100 100 100 101 101 101 3 4 1 1 1 1 1 2 1 1 2 3 1 2 3 Class 2 Data Class 3 Data File Identifier Internal Indications Storage Object Device Profile Private Registration Object Private Registration Object Descriptor Application Identifier Short Floating Point Long Floating Point Extended Floating Point Small Packed Binary-Coded Decimal Medium Packed Binary-Coded Decimal Large Packed Binary-Coded Decimal No object No object 2 00. See 4. A Level 2 Slave parses READ requests for Frozen Counter objects and may report Frozen Counter objects (but not Frozen Delta Counters) A Level 2 Slave may send unsolicited responses containing static data.SUB. A Level 2 Slave parses READ requests for variations 1.00 IMPLEMENTATION (DNP-L2) This chapter describes the second smallest subset of the DNP V3. 2 and 3 of Binary Input Change objects. the input and output points of such a device would be local to the device. This implementation level is called Level 2 (L2). 2. • • • • 2. 2.00 Application Layer.00 Subset Definitions P009-0IG. It is intended for communications between a master station or data concentrator and a device that could be called either a large Intelligent Electronic Device (IED) or a small Remote Terminal Unit (RTU).3 IMPLEMENTATION TABLE DNP V3.00 1 .Chapter 2: LEVEL 2 DNP V3. A Level 2 Slave parses READ requests for variation 0 of specific objects.13 Freeze Operations.2 GENERAL DESCRIPTION A Level 2 Slave implementation is the same as a Level 1 Slave implementation with the following additions: • A Level 2 Slave accepts FREEZE requests on Binary Counter objects (not Analog Input objects or Frozen Counters). within the constraints described in CHAPTER 4: IMPLEMENTATION RULES AND RECOMMENDATIONS.1 INTENDED USE This level contains a few more features than the Level 1 implementation. Typically. Version 2. 01 00.08 06 129.All Variations Binary Input 1 2 Binary Input with Status 129.All Variations Binary Output Binary Output Status Control Block . 01 2 2 2 2 10 10 10 12 12 12 12 20 20 20 20 20 20 20 20 20 21 21 21 0 1 2 3 0 1 2 0 1 2 3 0 1 2 3 4 5 6 7 8 0 1 2 Binary Input Change . 130 129.07. 28 17. 130 129.01 1 06 129. 130 129. 28 129 echo of request 1. 8. 130 129. 01 00.00 . 01 00. Note that additions and modifications from implementation Level 1 are shaded. 130 129.All Variations Binary Input Change without Time Binary Input Change with Time Binary Input Change with Relative Time Binary Output . 130 129. 130 129. 130 00. 130 00.01 00 . 28 129. 01 00.All Variations Control Relay Output Block Pattern Control Block Pattern Mask Binary Counter . 28 17.Table 2. 130 129. 130 129.3-1 Level 2 Implementation (DNP-L2) OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) 1 Qual Codes (hex) 06 129. 9.08 06.All Variations 32-Bit Frozen Counter 16-Bit Frozen Counter 1 1 1 1 1 06. 01 00.00 implementation.All Variations 32-Bit Binary Counter 16-Bit Binary Counter 32-Bit Delta Counter 16-Bit Binary Counter 32-Bit Binary Counter without Flag 16-Bit Binary Counter without Flag 32-Bit Delta Counter without Flag 16-Bit Delta Counter without Flag Frozen Counter .3-1 Describes the objects. 01 2 DNP Users Group P009-0IG. and qualifiers used in a Level 2 DNP V3.08 06. Version 2. 4. Table 2. 130 17. function codes. 01 RESPONSE (master must parse) Func Codes Qual Codes (hex) 1 1 0 1 Binary Input .07. 10 06 129.07. 130 129. 01 3. 5. 01 00 . 7. 130 00. 6 17. 01 00.07.SUB.08 06. 130 00. 130 00. 130 129.SUB. 130 129.All Variations 32-Bit Analog Input 16-Bit Analog Input 32-Bit Analog Input without Flag 16-Bit Analog Input without Flag 1 06 129. 130 129. 01 DNP V3. 01 1 06.All Variations 32-Bit Frozen Counter Event without Time 16-Bit Frozen Counter Event without Time 32-Bit Frozen Delta Counter Event without Time 16-Bit Frozen Delta Counter Event without Time 32-Bit Frozen Counter Event with Time 16-Bit Frozen Counter Event with Time 32-Bit Frozen Delta Counter Event with Time 16-Bit Frozen Delta Counter Event with Time Analog Input . 01 00. 01 00.All Variations 32-Bit Counter Change Event without Time 16-Bit Counter Change Event without Time 32-Bit Delta Counter Change Event without Time 16-Bit Delta Counter Change Event without Time 32-Bit Counter Change Event with Time 16-Bit Counter Change Event with Time 32-Bit Delta Counter Change Event with Time 16-Bit Delta Counter Change Event with Time Frozen Counter Event . 130 00. 01 00.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes Qual Codes (hex) 21 21 21 21 21 21 21 21 21 21 22 22 22 22 22 22 22 22 22 23 23 23 23 23 23 23 23 23 30 30 30 30 30 3 4 5 6 7 8 9 10 11 12 0 1 2 3 4 5 6 7 8 0 1 2 3 4 5 6 7 8 0 1 2 3 4 32-Bit Frozen Delta Counter 16-Bit Frozen Delta Counter 32-Bit Frozen Counter with Time of Freeze 16-Bit Frozen Counter with Time of Freeze 32-Bit Frozen Delta Counter with Time of Freeze 16-Bit Frozen Delta Counter with Time of Freeze 32-Bit Frozen Counter without Flag 16-Bit Frozen Counter without Flag 32-Bit Frozen Delta Counter without Flag 16-Bit Frozen Delta Counter without Flag Counter Change Event .07. 01 00. 130 129.00 3 . Version 2. 130 129. 28 129.00 Subset Definitions P009-0IG.08 129. 130 17. 28 17. 130 00. All Variations 32-Bit Analog Output Block 16-Bit Analog Output Block Time and Date . 130 17. 6 17.All Variations 32-Bit Analog Output Status 16-Bit Analog Output Status Analog Output Block . quantity=1 129. 28 129 echo of request 2 (see 4.08 129. 130 07. 5. 130 129. quantity=1 07. 130 00.28 1 06 129. 01 3.All Variations 32-Bit Frozen Analog Event without Time 16-Bit Frozen Analog Event without Time 32-Bit Frozen Analog Event with Time 16-Bit Frozen Analog Event with Time Analog Output Status . 4.07.All Variations Time Delay Coarse 129 07.All Variations Time and Date CTO Unsynchronized Time and Date CTO Time Delay .All Variations 32-Bit Frozen Analog Input 16-Bit Frozen Analog Input 32-Bit Frozen Analog Input with Time of Freeze 16-Bit Frozen Analog Input with Time of Freeze 32-Bit Frozen Analog Input without Flag 16-Bit Frozen Analog Input without Flag Analog Change Event .SUB.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes Qual Codes (hex) 31 31 31 31 31 31 31 32 32 32 32 32 33 33 33 33 33 40 40 40 41 41 41 50 50 50 51 51 51 52 52 0 1 2 3 4 5 6 0 1 2 3 4 0 1 2 3 4 0 1 2 0 1 2 0 1 2 0 1 2 0 1 Frozen Analog Input .28 17. 130 129. quantity=1 4 DNP Users Group P009-0IG.All Variations Time and Date Time and Date with Interval Time and Date CTO . Version 2.All Variations 32-Bit Analog Change Event without Time 16-Bit Analog Change Event without Time 32-Bit Analog Change Event with Time 16-Bit Analog Change Event with Time Frozen Analog Event .14) 07.00 . quantity=1 1 06. 08 06.00 5 .08 06.08 2 00.00 Subset Definitions P009-0IG. Version 2.07.14) DNP V3.SUB.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes 129 Qual Codes (hex) 07.07.07. quantity=1 52 60 60 60 60 60 70 80 81 82 83 83 90 100 100 100 101 101 101 2 0 1 2 3 4 1 1 1 1 1 2 1 1 2 3 1 2 3 Time Delay Fine Class 0 Data Class 1 Data Class 2 Data Class 3 Data File Identifier Internal Indications Storage Object Device Profile Private Registration Object Private Registration Object Descriptor Application Identifier Short Floating Point Long Floating Point Extended Floating Point Small Packed Binary-Coded Decimal Medium Packed Binary-Coded Decimal Large Packed Binary-Coded Decimal No Object 1 1 1 1 06 06. index=7 13 No Object 23 (see 4. . A Level 3 implementation supports enabling and disabling unsolicited responses on a Class-by-Class basis. VAR. Qual. variations.00 IMPLEMENTATION (DNP . VAR.2 Data Classes and Events and Section 4.00 is for communicating between a Master and a medium size slave device (e.00 1 . Qual. 06) A Level 3 implementation supports the assigning and re-assigning of data objects to classes dynamically (i. 4. A Master can enable or disable unsolicited responses for Class 1. 60.L3) This chapter describes a subset of the DNP V3.e. Qual. A Level 3 Slave implementation is the same as a Level 2 implementation with the following additions: • • • a Level 3 Slave will process read requests for many specific objects and variations.SUB. 3. 3. Version 2.2 GENERAL DESCRIPTION A Level 3 implementation uses a larger range of objects. VAR. during run-time). Data Concentrator). 60.4 Unsolicited Responses ): • Class 1 (Obj. 06) Class 3 (Obj.Chapter 3: LEVEL 3 DNP V3.g. 2. 3. 06) Class 2 (Obj. and Class 3 objects only. Class 2.00 Subset Definitions P009-0IG. function and qualifier codes than a Level 2 implementation.1 INTENDED USE This level of implementation of DNP V3. 60. RTU.00 Application Layer which contains more functionality than the Level 2 subset. An ASSIGN DNP V3. The request fragment may contain one or more of the following object headers only (refer to Section 4. a Level 3 Slave will process a larger range of requests with a larger range of function codes. 5. 9. 130 129. 28 17. function codes. 6 5. 01 2 DNP Users Group P009-0IG.All Variations Binary Input Binary Input with Status Binary Input Change . 06 00. 01 3. 6 1. Several sets of Class and data object headers may be contained in a single request fragment (refer to Section 4. 06 00. 130 17. 01 00.08 00.07.2 Data Classes and Events). 28 00. 01 00. 01 00. Note that additions and modifications from implementation Level 2 are shaded. 01 06 06. 130 129.3 IMPLEMENTATION TABLE Table 3. 22 1 1 1 1 1 1 1 Qual Codes (hex) 00. 130 00.07. and qualifiers used in a Level 3 DNP V3.All Variations Binary Input Change without Time Binary Input Change with Time Binary Input Change with Relative Time Binary Output . 7.All Variations Binary Output Binary Output Status Control Block . 28 129.CLASSES (Function Code 22) request will contain a Class 1. Version 2. 130 129. 01.08 06. 01. 01 00. 06 00. 01 RESPONSE (master must parse) Func Codes Qual Codes (hex) 1 1 1 2 2 2 2 10 10 10 12 12 12 12 20 0 1 2 0 1 2 3 0 1 2 0 1 2 3 0 Binary Input . 01. 28 17.3-1 Level 3 Implementation (DNP-L3) OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) 1.00 implementation. 4. 06 00. 130 129. 2 or 3 object header followed by one or more static data object headers. 130 129.SUB. 06 129 129 129 echo of request echo of request echo of request 20 20 20 20 1 2 3 4 32-Bit Binary Counter 16-Bit Binary Counter 32-Bit Delta Counter 16-Bit Delta Counter 00. 01. 6 5.All Variations 1 00. 130 00. 06 129. 06 00. 22 1 1 1 1 17. Table 3.08 06. 01. 06 129.3-1 Describes the objects. 01. 28 17.07. 3. 130 129. 8. 01.08 06. 01.All Variations Control Relay Output Block Pattern Control Block Pattern Mask Binary Counter . 10.07.00 . 130 00. 06 129. 01. 01 00. 06 129. 28 17. 130 129. 01 00. 06 00. 06 00. 01. 06 RESPONSE (master must parse) Func Codes 129.08 06. 130 129. 01. 01. 130 17.All Variations 32-Bit Counter Change Event without Time 16-Bit Counter Change Event without Time 32-Bit Delta Counter Change Event without Time 16-Bit Delta Counter Change Event without Time 32-Bit Counter Change Event with Time 16-Bit Counter Change Event with Time 32-Bit Delta Counter Change Event with Time 16-Bit Delta Counter Change Event with Time Frozen Counter Events .00 Subset Definitions P009-0IG.All Variations 32-Bit Frozen Counter 16-Bit Frozen Counter 32-Bit Frozen Delta Counter 16-Bit Frozen Delta Counter 32-Bit Frozen Counter with Time of Freeze 16-Bit Frozen Counter with Time of Freeze 32-Bit Frozen Delta Counter with Time of Freeze 16-Bit Frozen Delta Counter with Time of Freeze 32-Bit Frozen Counter without Flag 16-Bit Frozen Counter without Flag 32-Bit Frozen Delta Counter without Flag 16-Bit Frozen Delta Counter without Flag Counter Change Event . 01. 22 1 1 1 1 Qual Codes (hex) 00. 130 00. 130 129.07.08 06. 01.08 06.SUB. 06 00. 01 00. 130 129. 130 129.07.07. 06 00.08 06.07. 01. 28 17. 01 00. 130 17. 06 00. 01.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) 1 1 1 1 1.07.08 06.07.All Variations 32-Bit Frozen Counter Event without Time 16-Bit Frozen Counter Event without Time 32-Bit Frozen Delta Counter Event without Time 16-Bit Frozen Delta Counter Event without Time 32-Bit Frozen Counter Event with Time 16-Bit Frozen Counter Event with Time 129. 130 129.07. 130 Qual Codes (hex) 00. 01 1 1 00.08 06. 130 00. 130 129.07. 28 17. 01 1 1 1 1 1 06.00 3 . 06 00.07. 06 00. 28 1 1 1 1 1 06. 130 129. 28 17.07. 01.08 129. 01. 28 17. 01 00.08 06. 01 00.08 129. 06 00. 01. 01 20 20 20 20 21 21 21 21 21 21 21 21 21 21 21 21 21 22 22 22 22 22 22 22 22 22 23 23 23 23 23 23 23 5 6 7 8 0 1 2 3 4 5 6 7 8 9 10 11 12 0 1 2 3 4 5 6 7 8 0 1 2 3 4 5 6 32-Bit Binary Counter without Flag 16-Bit Binary Counter without Flag 32-Bit Delta Counter without Flag 16-Bit Delta Counter without Flag Frozen Counters . Version 2. 130 129.28 17. 06 00. 130 129. 01 00.08 06. 130 129. 01 00. 130 129. 28 DNP V3. 130 129. 01. 01.00 . 01. 06 00. 130 129.07. 01 00. 28 1 1 1 3. 22 1 1 1 1 00.All Variations 32-Bit Frozen Analog Event without Time 16-Bit Frozen Analog Event without Time 32-Bit Frozen Analog Event with Time 16-Bit Frozen Analog Event with Time Analog Output Status . 06 00. 130 129. 28 17. 01. 01.08 06. 01. 130 17. 01 00. 01.All Variations Time and Date 2 (see 4.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes Qual Codes (hex) 23 23 30 30 30 30 30 31 31 31 31 31 31 31 32 32 32 32 32 33 33 33 33 33 40 40 40 41 41 50 50 7 8 0 1 2 3 4 0 1 2 3 4 5 6 0 1 2 3 4 0 1 2 3 4 0 1 2 1 2 0 1 32-Bit Frozen Delta Counter Event with Time 16-Bit Frozen Delta Counter Event with Time Analog Input .08 06.All Variations 32-Bit Analog Change Event without Time 16-Bit Analog Change Event without Time 32-Bit Analog Change Event with Time 16-Bit Analog Change Event with Time Frozen Analog Event . 01 00. 5. 06 00.07.14) 1 07.SUB. 06 00.All Variations 32-Bit Analog Input 16-Bit Analog Input 32-Bit Analog Input without flag 16-Bit Analog Input without flag Frozen Analog Input .All Variations 32-Bit Frozen Analog Input 16-Bit Frozen Analog Input 32-Bit Frozen Analog Input with Time of Freeze 16-Bit Frozen Analog Input with Time of Freeze 32-Bit Frozen Analog Input without Flag 16-Bit Frozen Analog Input without Flag Analog Change Event . 130 129. Version 2. 6 00. 06 00. 6 3. 28 129. quantity = 1 1. 01 echo of request echo of request 07.All Variations 32-Bit Analog Output Status 16-Bit Analog Output Status 32-Bit Analog Output Block 16-Bit Analog Output Block Time and Date . 01. 130 129. 130 00.08 129. 5. 06 00. 4. tit 1 4 DNP Users Group P009-0IG. 06 17. 4. 130 129 129 00. 130 129.07. 01 00. tit 1 129 07. 06 129. 01 1 1 1 06. 01. 28 17. 22 06 06. 130 129. quantity=1 60 3 Class 2 Data 1 20.07.SUB.07.All Variations Time and Date CTO Unsynchronized Time and Date CTO Time Delay .08 06 06.00 Subset Definitions P009-0IG. 21 22 60 4 Class 3 Data 1 20.07.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) quantity = 1 RESPONSE (master must parse) Func Codes Qual Codes (hex) quantity=1 50 51 51 51 52 52 52 60 60 60 2 0 1 2 0 1 2 0 1 2 Time and Date with Interval Time and Date CTO . Version 2. 21. index=7 81 82 83 83 90 100 100 100 101 101 1 1 1 2 1 1 2 3 1 2 Storage Object Device Profile Private Registration Object Private Registration Object Descriptor Application Identifier Short Floating Point Long Floating Point Extended Floating Point Small Packed Binary-Coded Decimal Medium Packed Binary-Coded Decimal DNP V3. 01 00.All Variations Time Delay Coarse Time Delay Fine Not Defined Class 0 Data Class 1 Data 1 1 20.08 06 06. 130 07. 21 22 70 80 1 1 File Identifier Internal Indications 1 2 00. quantity=1 07. quantity=1 129.08 06 129 129 07. quantity=1 07.00 5 . 00 .14) 6 DNP Users Group P009-0IG.OBJECT Obj Var Description REQUEST (slave must parse) Func Codes (dec) Qual Codes (hex) RESPONSE (master must parse) Func Codes Qual Codes (hex) 101 3 Large Packed Binary-Coded Decimal No Object No Object 13 23 (see 4. Version 2.SUB. Response FUNCTION UNKNOWN OBJECT UNKNOWN IIN bit 0 Meaning means “My implementation level does not support this function on objects of this group and variation”.11 if there is an error in the request.00 Basic 4 Document Set.SUB.00 in addition to those described in the DNP V3. it is necessary to define the valid responses to a request that either: • • Is not a valid request for the given level.Chapter 4: IMPLEMENTATION RULES AND RECOMMENDATIONS This chapter describes several constraints on the implementation of DNP V3. “I have no 1 DNP V3.00 1 . The purpose of these additional rules and recommendations is to limit the possible variations of implementation and encourage standardization. or for static objects.00 Subset Definitions P009-0IG.1 Rules A Slave device may respond to Master requests as described in Table 4.1. 4. This section discusses those responses. It defines rules regarding those parts of the protocol that devices must satisfy in order to conform to any DNP implementation level. or Is valid for the given level.1 ERROR RESPONSES As a result of the definition of implementation levels. means either “My implementation level does not support this group and variation of object”. The Internal Indication bit numbers listed are in the second octet. Version 2. 4. but is not applicable to the particular device. It also makes some recommendations regarding further behaviour that a device may choose to implement. Not permitted if no range was specified. This section describes the interaction between data points. but no objects of the specified type returned) n/a Table 4.Response IIN bit Meaning objects with this group and variation”. 2 DNP Users Group P009-0IG. Cannot be used as a response for event objects if the request is defined for the level. Can be used instead of OBJECT UNKNOWN for static objects if no range was specified. Primarily used in response to event data polls. In that case. 4. The Class of event data is therefore an attribute of the data point and the event objects the data point reports. the Slave must send a Null Response (see below). Null Response (no IIN bits set. PARAMETER ERROR 2 means “I have objects of this group and variation. but not within the range of points specified”. it must designate each of its data points as generating either Class 1. event objects and DNP data classes.1-1 Valid Error Responses Event objects are treated differently than static objects because they are not tied to physical hardware.1 Rules If a Slave device reports event objects.2 DATA CLASSES AND EVENTS Many static data points (eg. Every event object reported by the Slave device therefore belongs to Class 1. and I have no objects of this type”. Class 2 or Class 3. analog input) within a Slave device can generate DNP event objects (eg. but this behaviour is not mandatory. even though the device is able to report them.00 . Class 2 or Class 3 event objects by default. Binary Input Change With Time. means “No point range was specified.2. binary input. Version 2. the Slave may choose to include in the response those objects that are available. This IIN bit must be set even if some of the points specified are available. They may not exist on a device at any given moment. Every static object reported by the Slave device belongs to Class 0. 4. Analog Input Change Event). In such a case. (This designation may be configurable).SUB. static objects belong to Class 0 by definition. a READ request of Class 2 data. 3) Analog Input (Obj. The actual event object the Slave device reports after the Master device enables event object reporting will vary depending on the request of the Master. a READ request containing both Class 1 and Class 2 object headers). to enable the generation of Class 2 events from DNP analog input point 4. • • • A particular implementation level may support only certain methods of reading data. To enable the reporting of event objects for a particular data point. 0. the Master device sends an ASSIGN CLASS request containing the following object headers: • • Class 2 (Obj. The Slave returns the first 20 event objects it collected that were assigned to Class 2). Version 2. and the request means all event objects generated by the data point will belong to the specified Class. a READ request for a quantity of Class objects (eg. Var.SUB. the Master specifies in its ASSIGN CLASS request a Class 1. when requesting a Class of data or requesting variation 0 of any object). a READ request for a class of objects (eg. A Master device tells a Slave device to stop reporting event objects for a particular data point by assigning event objects from the data point to Class 0. the static object represents the data point itself. the Slave 3 DNP V3. Var.00 . the Slave will not produce any further event objects for the data point. specifying a quantity of 20 objects.Level 3 Slave devices must permit a Master to enable or disable the reporting of event objects by making ASSIGN CLASS (function code 22) requests. a READ request for several Classes of data (eg. a READ request for Binary Input Change With Time objects. The Master may request event objects by sending: • a READ request for specific objects (eg.e. For example. If a Master does not specify a particular variation of object (i. 2 or 3 object header and the header of a static object for the appropriate data point. or a READ request for 16-Bit Analog Input Change Event Without Time objects). Since Class 0 is the class of static data and event objects cannot be Class 0. Index 4) Such a request does not mean the static object now belongs to Class 2. 60 . Instead. 30. a READ request for Class 2 data).00 Subset Definitions P009-0IG. The Slave device returns all event objects assigned to the Class. Refer to the appropriate chapters to determine whether a particular method is valid for a given implementation level. A particular combination of Master and Slave implementations will be interoperable even if event data are not supported. the Slave must return the events in the order listed above. however. consider a Slave device that detects the following events. In particular.Class 3 Binary Input Change Without Time point 1 . DNP provides several different means of retrieving data. If a Master READs several Classes of data in the same request. in which the Master polls frequently for event data and occasionally for Class 0 Data. and all communication is unsolicited report-by-exception. 3. the Slave must not group the event objects by Data Class in its response. The Slave must NOT send all the Class 3 events together before sending the Class 1 event. This default variation may be configured.SUB.reports the default variation of object for the data point. 2. efficient bandwidth usage is vital to market acceptance of a particular DNP implementation.00 . so polling can be very quick. as discussed below. in which most communication is unsolicited. This is only a recommendation because although DNP-L1 specifies Masters must be able to parse certain event objects. Unsolicited Report-by-Exception Operation. DNP is a relatively high-overhead set of protocols compared to its predecessors. 4 DNP Users Group P009-0IG. the bandwidth available to most utility companies is still quite limited. Class 2 and Class 1 data.2. Version 2.Class 1 Binary Input Change Without Time point 2 . but the Master occasionally sends integrity polls for Class 0 Data to verify its database is up to date.Class 3 Binary Input Change Without Time point 6 . The Master still sends application layer confirmations to the Slave. Most often the Slave’s response to the event polls will contain few objects. 0x08). The response size can be further limited if the Master requests a maximum number of events (qualifiers 0x07. 4. However. the Slave must report Binary Change events within a response in the order the events occurred. in the order listed: • • • • Binary Input Change Without Time point 3 . the combination may not be efficient or useful. Polled Report-by-Exception Operation. Therefore. Quiescent Operation. in which the Master never polls any Slave. They are listed here from most to least efficient: 1.Class 3 If the Master device sends a single READ request asking for Class 3. it does not specify that the Master necessarily uses them or that the Slave necessarily reports them. For example.2 Recommendations It is highly recommended that all Slave devices report event data and that all Masters provide a report-by-exception mode of operation. e. is the recommended minimum implementation. and or 3 Data. The Subset Definitions have been written with this in mind. 4. Polled Static Operation. Therefore frequent polls of Class 1.SUB. binary inputs. Version 2. They have also been written with the goal that all data from a Slave be accessible using the least bandwidth and the least parsing required by the Slave. it must immediately send an unsolicited response upon start-up. the response header plus the current state of ALL of its static data points (eg.4. analog inputs). This method is the simplest to implement. containing the Access Control.00 Subset Definitions P009-0IG.3. Function Code and IIN fields. the Slave must report them before the static data. in which the Master polls only for Class 0 data or the specific data it requires.00 5 . whether it DNP V3. and if so. Some systems may also choose to mix Polled and Unsolicited Report-byException operation. This initial unsolicited response must contain either: • • the response header only. The vendor of the device must specify in a Device Profile Document whether the device sends unsolicited responses.1 Rules Upon start-up of a Slave device. but can be very inefficient if the number of points that need to be retrieved is high and changes are infrequent. This rule allows the Master to report data changes in chronological order by simply parsing the message from beginning to end (i. If the Slave device is configured to send unsolicited responses. interspersed with occasional integrity polls of Class 0 Data. but had not yet reported to the Master.3 SLAVE DEVICE START-UP 4. the Slave device must set true(1) the DEVICE RESTART Internal Indication bit within the Internal Indication field of each subsequent response and unsolicited response. the most recent value of any point will be the last one reported in the message). 2. The initial unsolicited response may also contain any events objects the Slave device had generated while running previously. Given that unsolicited responses are not always possible using some physical layers. If such objects exist. This bit must remain set until a Master device clears it with a WRITE request. the recommended minimum implementation for a Slave is Polled Report-by-Exception Operation. 00 .includes static data in the initial unsolicited response. Class 2. 4. All Slave devices must provide a mode of operation in which the Slave never sends unsolicited responses.4 UNSOLICITED RESPONSES 4.2 Recommendations If a Slave device does not automatically report all of its static data in an initial unsolicited response. variations. Version 2. 4.4. the Master device must send a WRITE request to clear the DEVICE RESTARTED Internal Indication object reported by the Slave. it must send an initial unsolicited response upon start-up regardless of whether the Master sent any DISABLE UNSOLICITED requests (See Section 4.3. The rule applies even if the Master has disabled unsolicited responses from all points on the Slave device. If a Slave device is configured to send unsolicited responses. qualifiers and function codes the Slave device may include in those unsolicited responses.SUB. a Master device may disable unsolicited responses by sending a DISABLE UNSOLICITED request (function code 22). This document must also specify which objects. send a READ request for Class 1. Upon receiving this initial unsolicited response. This mode of operation must be configurable. Refer to APPENDIX A: DEVICE PROFILE DOCUMENT FORMAT for more details regarding the Device Profile Document. the Master device should immediately poll for all of the device's event data and static data (ie. This rule ensures the Master device is notified immediately if the device restarts.3: Slave Device Start-up for details).1 Rules A Slave device may optionally send unsolicited responses to a Master device. Refer to APPENDIX A: DEVICE PROFILE DOCUMENT FORMAT for more details regarding the Device Profile Document. Class 3 and Class 0 data). The following rules apply: 1. If a Slave device is configured to send unsolicited responses. The vendor of a Slave device must specify in a Device Profile Document whether the device can send unsolicited responses. 2. 6 DNP Users Group P009-0IG. The ability to configure unsolicited responses for the entire device is separate from the ability of the Master to disable unsolicited responses using requests. Slave devices implementing Level 2 or greater may report static data objects in unsolicited responses. This will provide some feedback to the Master. If a Slave device implements WRITEs to Binary Outputs in addition to operations on Control Relay Output Blocks. when the status flags of points (within the flag octet) change state. a Slave device must parse all output function codes (e. it is recommended that the device “loop back” the state of each output to a Binary Input object. it may respond with the PARAMETER ERROR or OBJECT UNKNOWN Internal Indications set.SUB. PULSE ON). VAR. All other events or exceptions must be reported using event data objects.00 Subset Definitions P009-0IG. They may do so only under the following conditions: • • upon start up of the Slave device. it must not respond with FUNCTION UNKNOWN. For example. Refer to APPENDIX A: DEVICE PROFILE DOCUMENT FORMAT for more details. 4. The control operations supported by a Slave device must be described in the Device Profile Document for the device. then 16-Bit Analog Input objects may be reported in an unsolicited response. 1) as a means of operating binary outputs is not recommended because the response to a WRITE request cannot give an indication of whether the operation was successful. It must respond with the value operation not supported in the STATUS field of the Control Relay Output Block. The destination address of the Master device to which the unsolicited responses are sent must be configurable in the Slave device. SELECT/OPERATE) and control types (e.00 7 .5.12.1 Rules All Slave devices must be able to parse operations on Control Relay Output Block objects (Obj.g. 10. All levels of Master devices must support unsolicited responses.5.2 Recommendations The use of WRITEs to Binary Output objects (Obj. Var. DNP V3. 4. If a Slave device does not actually have any binary output points.g.5 OPERATING BINARY OUTPUTS 4. Version 2.1) for operating binary outputs. Similarly. if a range of analog inputs go off-line. If the Slave does not choose to implement a particular function code or control type. The FUNCTION UNKNOWN Internal Indication is not a valid response in this case. SUB.1 Rules Devices must not transmit application layer fragments larger than 2048 bytes. 8 DNP Users Group P009-0IG. a response to a READ request for Class 1. the Slave device should accept as many control types (LATCH. if security is not a major issue and the device’s hardware does not require specific instructions.6. A single response may consist of one or more fragments. Slave devices behave in a “don’t care” manner regarding which output operations they support. 4. It is recommended that whenever possible. It is recommended that if possible. In other words. Class 2. Class 3 and Class 0 data must fit into a single response. PULSE. unless the fragment size is configurable and can be limited to 2048 bytes. to reduce the complexity of configuration for Masters. In other words. A Master device must accept multi-fragment responses. all output points on a particular Slave device support the same output function codes. The maximum frame size transmitted.6 FRAGMENTS AND FRAMES 4.6.2 Recommendations It is recommended that the maximum size of a fragment be configurable in both Slave devices and Master devices. All devices must accept maximum size data link layer frames (292 bytes). 4. Version 2. and whether or not a Slave device sends multi-fragment responses must be documented in the Device Profile Document for the Slave device.00 . the maximum fragment size transmitted. TRIP/CLOSE etc.! NOTE: Control Relay Output Block object index x and Binary Output object index x both refer to the same physical binary output point. Refer to APPENDIX A: DEVICE PROFILE DOCUMENT FORMAT for more information regarding Device Profile Documents.) as possible. A Master device must not send multi-fragment requests. A Slave device must be able to return all of its data (static and event) within a single response. All devices must accept application layer fragments of 249 bytes or fewer. All Variations Binary Input Change With Time. For example. A Slave or Master device must transmit a data link CONFIRM frame if it is requested to do so by a SEND/CONFIRM EXPECTED function code an incoming frame.00 9 . For example.7. only when configured. quantity 20 4. never or sometimes (e. If a Slave is waiting for an application layer confirmation to a Response (function code 129) and receives a new request instead. Counter Input and Binary Output Status objects. it must be able to parse a single response containing Binary Input. A Slave or Master device must transmit an Application Layer Confirmation Response if it is requested by the CONFIRM bit in an incoming fragment.7 MULTIPLE OBJECTS IN A SINGLE REQUEST 4.1 Rules All Slave devices of all levels must be able to parse a single Master request containing any subset of all of the objects the Slave device supports.00 Subset Definitions P009-0IG.9 CONFIRMATION AND RETRIES 4. only for certain messages) requests data link CONFIRM frames must be documented in the Device Profile Document for the device.1 Rules All Master devices must be able to parse a single Slave response or unsolicited response containing any subset of the objects the Master device supports. Analog Input.8.8 MULTIPLE OBJECTS IN A SINGLE RESPONSE 4. Refer to APPENDIX A: DEVICE PROFILE DOCUMENT FORMAT for more information regarding Device Profile Documents. a Level 2 Slave implementation must be able to parse a single READ request containing one or more of the following objects: • • • • Class 0 data Class 1 data Binary Counter . 4. Version 2. it must: DNP V3.1 Rules All levels of Slave and Master devices may choose when they request confirmation of outgoing data link frames.SUB. 4.9.It is recommended that Master devices choose the qualifiers and objects in their requests so as to minimize the amount of bandwidth required. Whether a device always.g. the number of retries performed must be configurable and be disabled by default.3 of the DNP V3. in particular File Identifier Objects. PROCESS_AFTER_CONFIRM mode applies: the Slave does not respond to the READ until it has received confirmation for its Unsolicited Response. This rule remains unchanged from the DNP V3. It is recommended that a Slave device only requests Application Layer Confirmation Responses: • on outgoing fragments that contain event data.00 Application Layer specification. This practice is recommended because the use of data link CONFIRM frames. If the new request asks for some of the unconfirmed event data. but not explicitly stated. As described in section 3. on large outgoing multi-fragment messages. 4. include this data in the response. across a highly reliable point to point physical media. such as a response to a READ request. without needing to account for retries by any particular Slave. 2. Assume the confirmation will not be forthcoming and therefore retain any event data for the next request.00 Application Layer. once in the Unsolicited Response. For READ requests. Process and respond to the new request. This rule is implied in the DNP V3. This provision allows Master devices to choose application response timeouts as needed by the overall network. can effectively halve communication throughput.00 .SUB. This permits the Master to perform application-layer flow control. If a Slave device supports application layer retries. since the Master may take a significant amount of time to process large messages. with one exception. this rule also applies to Unsolicited Responses (function code 130). and the Slave can therefore remove them from its internal buffers if it chooses.1.9. 3. It also ensures the Master retains control over any polling sequence. This rule ensures controls and other vital operations will receive priority over any operation pending at the Slave.00 Application Layer. This allows the Slave device to be sure the Master has received the event objects. once in the READ Response. Version 2. because it prevents the same event data from being sent to the master twice.2 Recommendations It is recommended that enabling or disabling Data Link Confirms be configurable in both Slave devices and Master devices. • 10 DNP Users Group P009-0IG. • when a particular IIN or status flag must be acted upon by the Master.10 WITH-FLAG AND WITHOUT-FLAG VARIATIONS 4. The Application Layer Confirmation Response is redundant.SUB. it only does so for unsolicited responses. Version 2.00 11 . Roll-Over or Buffer Overflow. It is recommended that a Master device does not request Application Layer Confirms on outgoing fragments.g. 16-Bit Analog Input Without Flag). The lack of a flag in an object implicitly implies that the flag = 1 (i. it can retry the request. the Master must account for this in its application response timeout. Application Layer Confirmation Responses are not usually needed for requests because most requests require a response from the Slave device. 4.. Data link layer retries are more efficient because they only re-transmit part of the application layer message. so it will not need to account for the retry in any timeout.00 Subset Definitions P009-0IG. If the Slave performs application layer retries. Application layer retries are not especially useful for ensuring reliability in solicited responses because: • • • • The data link layer may already have performed several retries. using application retries for unsolicited responses is more useful because: • • The Master was not expecting the data. Similarly. Because the Master was not expecting the data. 16-Bit Analog Input) when the Master has requested a without flag object variation (e.g.g.e. However. Conformance or otherwise to these recommendations must be documented in the Device Profile Document for the Slave device. a Slave may choose to return an object variation without a flag when the Master has requested an object variation with a flag.10. DNP V3. It is recommended that if a Slave device implements application layer retries. Whether or not the Slave device responds with an object containing a flag is the Slave's decision. which may affect system performance. e.1 Rules A Slave device may choose to return an object containing a flag (e. Conformance or otherwise to this recommendation must be documented in a Device Profile Document for the Master device. it cannot cause the Slave to resend the data as with solicited responses. the point is on-line and no other exceptions are occurring). If the Master does not receive the data. or for variation 0 of a particular object. Version 2.2: WithFlag and Without-Flag Variations. The Slave device sets the Over-Range bit within the flag field of the object.SUB. See Section 4.11 16-BIT AND 32-BIT VARIATIONS 4.g. either 16-bit or 32-bit. however. 4.11.11. sign extension is not considered a modification of the value.g. and the measured value of the data point within the Slave device is within the range for the DNP variation (e.9.A Master device must be able to process responses containing object variations both with flags and without flags. ! NOTE: There is one exception to this rule.2 Rules for Analog Inputs and the OVER-RANGE Flag Some analog input data gathered by a Slave device may be inherently a certain size (e.00 . If a Master requests a particular object variation (e. a Master device may request this data in any size. this procedure will simply involve sign extending the value to its 16-bit or 32-bit two's complement representation. For example. depending on an internal default or on the Slave device's configuration. However. a Slave may choose to report a counter input as either a 16-bit or 32-bit variation.1 Rules A Slave device chooses a default object variation to report in response to a READ request for a Class of data. then the Slave reports the value without modification within the requested variation. within 32767 to -32767). the chosen variation must be the size the Master requested. the Slave device must respond with a particular variation. If a Master requests a 16-bit variation and the value of the data point is outside of the range 32767 (7FFF hex) to -32768 (8000 hex).g. However. ! NOTE: For a data value stored within the device as (for example) a 12-bit two's complement number. a Master device explicitly requests a particular variation. The choice of whether or not to use a with flag or without flag variation is nonetheless up to the Slave device. Since DNP analog values are signed. 16-bit Analog Input). if the Slave's A/D convertors provide only 12 bits of resolution). 12 DNP Users Group P009-0IG. If. 4. then the Slave reports the value as either 32767 or -32768. The following rules govern how to report this type of data: 1. 2. the "rules" listed in this section for 16-bit Analog Inputs are actually recommendations. Table 4. 4. When a Slave returns a 16-bit Analog Input object and the Over-Range bit is set. For example. therefore.SUB. but not Rule #3. a Slave device with a 12-bit A/D converter must set the OverRange bit when the measured value exceeds 2047. since a Master may ignore the value of the object. There is no contradiction. If an input exceeds the range measurable by the hardware on the Slave device.00 13 . except the example of 33000 requested as a 32-Bit Analog Input. It does not alter the value reported by its hardware. as explained below. the Slave device sets the Over-Range bit within the flag field of the object. Over-Range is set in all other cases.00 Subset Definitions P009-0IG.00 Object Library makes certain statements that may appear to contradict these rules.11-1 Examples of Over-Range Conditions and Values NOTE: The DNP V3." This rule holds.11-1 illustrates these rules. Size Stored Internally by the Device (size of A/D convertor) 8 bits Measured Value Response to a Request for 16-bit Analog Inputs 007F FF80 07FF F800 7FFF 8000 7FFF 7FFF 8000 Response to a Request for 32-bit Analog Inputs 0000007F FFFFFF80 000007FF FFFFF800 00007FFF FFFF8000 7FFFFFFF 00080E8 * 80000000 > +127 < -128 12 bits > +2047 < -2048 16 bits > +32767 < -32768 32 bits > +2147483647 33000 (example) < -2147483648 * Over-Range flag is not set in this case. "The actual value field can be ignored [by the Master device] as its value is not defined. DNP V3. The Slave device sets the Over-Range bit within the flag field of an object.3. If a Master requests a 32-bit variation and the value of the data point is outside of the range 2147483647 (7FFF FFFF hex) to -2147483648 (8000 0000 hex). the DNP V3. Version 2. The Slave sets the Over-Range flag in each case described in the table. This is a case of Rule #2 applying. then the Slave device reports the value as either 2147483647 or -2147483648. The Slave device must still report the value as 2047 in the analog input object.00 Data Object Library states. ! • Table 4. for the reasons discussed in the previous section.11. 4. a Binary Counter object cannot be reported at its maximum value to indicate the device’s internal maximum range. but only describes the cases in which the Slave represents the object in 32 bits internally. it is the responsibility of the Master to poll often enough to capture any roll-over condition that occurs. This default size does not change unless the Slave device is re-configured. Therefore the following rules apply: 1. 2.11. Version 2. The counter must continue incrementing after being set to zero. "The actual value will be +231-1 or -231 if it is over-range or under-range.• When a Slave returns a 32-bit Analog Input object. Refer to APPENDIX A: DEVICE PROFILE DOCUMENT FORMAT for more information regarding Device Profile Documents. 4. If a Slave responds to both 16-bit and 32-bit requests.SUB.4 Recommendations Regarding the ROLL-OVER Flag It is highly recommended that Slave devices do not set the Roll-Over flag. 14 DNP Users Group P009-0IG. the DNP V3. If a polled mode of data reporting is used.00 . The Device Profile Document for a Slave device must identify the default size of counter the Slave reports when asked for Class Data or Variation 0. 4. the Slave must respond with the lower 16 bits of a 32-bit counter when asked for 16 bits." This rule also holds. It is highly recommended that Master devices ignore the Roll-Over flag. 32-bits. or information will be lost.00 Data Object Library states. 5. Unlike the case of the Over-Range flag for Analog Inputs. The Device Profile Document for a Slave device must identify the point at which the Slave device’s counters roll over. or some internal value.3 Rules for Counter Objects and the ROLL-OVER Flag The Roll-Over flag in counter objects is not a useful flag because of DNP’s flexibility in reporting object variations. 3. A Master device has no way of determining whether the counter rolled over at 16-bits. Slave devices may choose not to set the Roll-Over flag. or a request for Binary Input Change Events with variation 0. 4.2. If a Master device does not specify a particular variation of binary input event object in a READ request. If the Slave device implements this option.13 FREEZE OPERATIONS This section clarifies the use of the various FREEZE function codes. 2. it must respond with data in the requested variation. if the Slave receives a READ request for Binary Input Change With Relative Time (Obj. If a Master requests a particular Class of data.00 Subset Definitions P009-0IG.4.2. a Slave may choose to report. a Slave device must copy the appropriate Binary Counter values ("running" counters) into a "freeze" buffer. only a Binary Input Change Without Time event object. Upon receiving a FREEZE request. The 15 DNP V3. a Slave may choose what variation to report.12. The manner in which a Slave device reports binary input event objects must be described in the Device Profile Document for the Slave device. Refer to APPENDIX A: DEVICE PROFILE DOCUMENT FORMAT for details. both a Binary Input Change Without Time object and one of the timetagged binary event objects from the same event. VAR. VAR.1) or an Unsynchronized Time and Date CTO (Obj. the objects are preceded by either a Time and Date CTO (Obj.SUB. 4.00 .2 Recommendations Whenever a Slave responds with Binary Input Change With Relative Time objects (Obj.12 TIME TAGGED BINARY INPUT EVENTS 4. for a given event: • • • only a time-tagged event object. Binary Input Without Time objects (Obj. either Binary Input Change With Time or Binary Input Change With Relative Time.2) object. 2) must be returned in the sequence in which they occur. It is recommended that the Unsynchronized Time and Date CTO object be used if the Slave's Time and Date have not been set. VAR.12.51.3). For instance. For instance. i. VAR. the device must report that variation. Version 2. If a Master device requests a specific variation of binary input event object. The manner in which a Master device expects binary input event objects to be reported must be described in its Device Profile Document. it must be configurable so the user can disable the reporting of one variation or the other.1 Rules Slave devices must preserve the sequence of occurrence of binary input event objects within responses.e. VAR.51. 3). not all Binary Counters must have corresponding Frozen Counters. This is allowed because the DNP V3.13. 20) always return the values of the "running" counters. Version 2. 20) only. 4. A READ request of Binary Counter Input objects (Obj. 21). If a FREEZE AND CLEAR request is being processed. 16 DNP Users Group P009-0IG. If a Level 2 or Level 3 Slave device supports Binary Counter objects. 21). it need not support READs of Frozen Counter objects if it chooses not to. it must support FREEZE operations (it cannot return an error response).14. NOT on Frozen Counter objects (Obj.1 Rules A Slave device need not support WRITE operations on Time and Date objects or support DELAY MEASUREMENT requests if it never sets the TIME SYNCHRONIZATION REQUIRED Internal Indication bit in its responses or unsolicited responses.14 TIME SYNCHRONIZATION 4.SUB. However.Master may read these frozen values as Frozen Counter Input objects (Obj.00 .1 Rules A Master device must perform FREEZE operations on Binary Counter objects (Obj.00 Data Object Library states “Point i in obj 20 and point i in obj 21 are NOT necessarily the same point”. the Slave must clear the “running” values immediately after performing the FREEZE. 4. Therefore. The Slave device must be configurable to not transmit anything other than Level “X” responses to Level “X” requests. all subsets require a Slave device support Class 0 Data polls. For instance. It is nevertheless a requirement that in order for a device to conform to an implementation level. it must have implemented on it services of the Data Link Layer and Transport Functions (as defined in the DNP V3.00 Subset Definitions P009-0IG. The Device Profile Document consists of a form. A Slave device may accept and respond to additional requests not defined in Level “X” and still conform to that level.SUB.1 SLAVE DEVICES In order for a Slave device to implement a particular Level “X” of DNP V3.00 protocol. the device must conform to the following: • • • • The Slave device must be able to parse all Master requests defined for Level “X”. if the response to such a poll would exceed 249 octets. Any additional functions the Slave provides must not prevent a Master device from communicating with a Slave device on the defined level. 5.Chapter 5: CONFORMANCE This Chapter specifies the functions a Master or Slave device must support in order to conform to a defined implementation level. See APPENDIX A : DEVICE PROFILE DOCUMENT FORMAT for details. It may respond to such requests with data not defined in Level “X”. a DNP-L1 Slave may choose to accept WRITE requests of File 1 DNP V3. The vendor must describe the device's DNP implementation in a Device Profile Document and make this document available to users of the device.00 Basic 4 Document Set) sufficient to support the implementation level. For instance. The Slave device must obey all of the implementation rules defined in Chapter 4. The subset definitions deal primarily with the application layer of the DNP V3.00. segmentation by the Transport Function must be supported. Version 2.00 . an implementation table similar to those found in this document. and some optional accompanying text. Version 2. a Level 3 Master must be configurable so it does not send any requests to either a Level 1 Slave or a Level 2 Slave that they could not parse.00. However. an implementation table similar to those found in this document.Identifier Objects.SUB. The Master device must be configurable to limit the requests it sends to Slave devices with implementation levels lower than “X”. The vendor of the Master device must describe the device's DNP implementation in a Device Profile Document and make this document available to users of the device. and some optional accompanying text. The Master device must obey all of the implementation rules defined in Chapter 4. 2 DNP Users Group P009-0IG. the device must conform to the following: • • The Master device must be able to parse all Slave responses defined for Level “X”. See APPENDIX A : DEVICE PROFILE DOCUMENT FORMAT for details. For instance. This does not prevent the Master from sending Level 3 requests to a Level 3 Slave.2 MASTER DEVICES In order for a Master device to implement a particular level “X” of DNP V3. it must not require a Master to send such a request in order to operate.00 . • • The Device Profile Document consists of a form. 5. 00 documentation. OBJECT Obj Var Description REQUEST Func Codes Qual Codes (hex) 00.00 Subset Definitions P009-0IG. The Device Profile Document addresses Application Layer and Data Link Layer issues only. or all requests parsed by a Slave device. Version 2.. e. identifying which object variations. ! NOTE: Do not confuse the Device Profile Document with the Device Profile Object defined in the DNP V3.SUB.Appendix A: DEVICE PROFILE DOCUMENT FORMAT Vendors must produce a Device Profile Document for each device they manufacture implementing DNP V3.. This appendix describes the minimum information that a vendor must include in the Device Profile Document. 01. The Device Profile Document clearly identifies any deviations from the implementation subsets described in this document and any other issues that may arise when determining the device's compatibility with another device.00.g. The Request columns identify all requests sent by a Master device... 06 RESPONSE Func Codes Qual Codes (hex) 01 30 4 16-Bit Analog Input without Flag 1 129. function codes and qualifiers the device supports in both requests and responses. The Response columns DNP V3..00 1 . It must be modified in the future to include some of the information found in the Device Profile Document. Implementation Table A table similar to those found in this document. the Physical Layer is not addressed because of the multitude of different layers and configurations possible. The Device Profile Object does not at present contain sufficient information to establish compatibility between two devices. 130 . supply a separate Device Profile Document for each function.SUB. in octets. The largest size of Data Link Frame the device transmits. A brief description intended to quickly identify for the reader the most obvious features the device supports in addition to the Highest DNP Level. sufficient to distinguish it from any other device from the same organization.00 . Version 2. If the device does not actually use all the requests or responses that it can parse.identify all responses parsed by a Master device. If a single physical device can perform both functions. The model and name of the device. The number of times the device will re-transmit a confirmed data Notable Additions Maximum Data Link Frame Size Maximum Fragment Size Maximum Data Link 2 DNP Users Group P009-0IG. Point List This is an optional part of the Device Profile Document. attach notes (or add columns) to the Implementation Table identifying which are not used. Masters send DNP requests. The largest size of Application Layer fragment the device transmits. or all responses sent by a Slave device. while Slaves send DNP responses. The highest-numbered DNP implementation subset to which the device completely conforms. Either Master or Slave. The format of this list is optional. in octets. The complete list of features is described in the Implementation Table. Some vendors of Slave devices may wish to include a list of the data points provided by the device. but the following is suggested: Index Default Static Variation Obj Var Desc Default Event Variation O b j 2 3 2 Var Class Desc Point Name Description Binary Input Analog Input 7 3 1 30 1 1 No Status 32-bit 1 3 2 1 Without Time 32-Bit Without Time Breaker 'A' Tripped Phase 1 VARs Vendor Name Device Name Highest DNP Level Supported Device Function The name of the organization producing the device. if a vendor checks a box marked "Configurable". In general. A device may support an Analog Output or Control Relay Output Block. This information is optional but may aid vendors of Slave devices in being compatible with the Master device. See subset document section 4. Refer to subset document section 4. Sends Unsolicited Responses Sends Static Data Unsolicited Default Counter Object/Variation Counters Rollover At Sends MultiFragment Responses A list of the conditions under which a Slave device sends unsolicited responses. The control operations permitted by the device.Re-tries Maximum Application Re-tries Requires Data Link Confirmation link frame before aborting the transaction.12 Time-Tagged Binary Input Events.00 Subset Definitions P009-0IG. Reports Binary Input A description of what variation of objects a Slave device reports Change Events when asked for Binary Input Change events with variation 0 or when asked for Class data. A list of the conditions under which a Slave device sends static data (Class 0) as unsolicited responses. Yes or No. Requires Application Whether the device ever sends application layer messages with the Confirmation CONFIRM bit set in the APPLICATION CONTROL field. but not necessarily support all operations on that object. Version 2.USER DATA frames. Vendors of Master devices may optionally include text explaining under what conditions the Master device sends each type of request. whether a slave device sends multi-fragment responses (Master devices do not send multi-fragment requests) A blank device profile form follows.11.g. The object and variation a Slave Device uses to report counter objects when asked for Variation 0 or for Class data. See subset document section 4.: polling rates and methods. e.SUB. Timeouts Control Operations The time conditions under which the device will discard an incoming frame. The value at which a Slave device’s counters roll over. request or response. The form must be accompanied by an Implementation Table and may optionally be accompanied by a Point List.00 3 . etc. Whether the device ever transmits SEND/CONFIRM EXPECTED .3. the vendor must DNP V3. A vendor may check multiple boxes within a section.11. The number of times the device will re-transmit a confirmed application request or response before aborting the transaction. fragment.3. 4 DNP Users Group P009-0IG. or in the field? Using what equipment? Over what range is the item configurable? Under what conditions? Similarly. Version 2. if the vendor checks a box marked "Variable" or "Sometimes". but might answer some of the following questions: " " " " At the factory.00 . the vendor must attach more details explaining under what conditions the specified item will occur.SUB.attach an explanation of how an item can be configured. The format of such an explanation is optional. Version 2.00 Subset Definitions P009-0IG.00 5 . range ____ to _______ DNP V3.SUB. must be configurable) Received ________ (must be > 249) Maximum Data Link Re-tries: # None # Fixed at _______________________ Maximum Application Layer Re-tries: # None # Configurable.00 DEVICE PROFILE DOCUMENT This document must be accompanied by a table having the following headings: Object Group Request Function Codes Response Function Codes Object Variation Request Qualifiers Response Qualifiers Object Name (optional) Vendor Name: Device Name: Highest DNP Level Supported: For Requests For Responses Notable objects. functions. and/or qualifiers supported in addition to the Highest DNP Levels Supported (the complete list is described in the attached table): Device Function: # Master # Slave Maximum Data Link Frame Size (octets): Transmitted __________________ Received (must be 292) Maximum Application Fragment Size (octets): Transmitted ________ (if >2048.DNP V3. # Configurable. 6 DNP Users Group P009-0IG. Response # None # None # None # None # Fixed at _________ # Fixed at _________ # Fixed at _________ # Fixed at _________ # Variable # Variable # Variable # Variable # Configurable # Configurable # Configurable # Configurable Others __________________________________________________________________________ Attach explanation if 'Variable' or 'Configurable' was checked for any timeout Sends/Executes Control Operations: WRITE Binary Outputs # Never # Always # Sometimes # Configurable SELECT/OPERATE # Never # Always # Sometimes # Configurable DIRECT OPERATE # Never # Always # Sometimes # Configurable DIRECT OPERATE . how? ______________________________________________ Timeouts while waiting for: Data Link Confirm Complete Appl.SUB. when? __________________________________________ # Configurable If 'Configurable'.00 . how? ______________________________________________ Requires Application Layer Confirmation: # Never # Always (not recommended) # When reporting Event Data (Slave devices only) # When sending multi-fragment responses (Slave devices only) # Sometimes If 'Sometimes'. range ____ to _______ Requires Data Link Layer Confirmation: # Never # Always # Sometimes (Fixed is not permitted) If 'Sometimes'. when? ___________________________________________ # Configurable If 'Configurable'.NO ACK # Never # Always # Sometimes # Configurable Count > 1 Pulse On Pulse Off Latch On Latch Off Queue Clear Queue # Never # Never # Never # Never # Never # Never # Never # Always # Always # Always # Always # Always # Always # Always # Sometimes # Sometimes # Sometimes # Sometimes # Sometimes # Sometimes # Sometimes # Configurable # Configurable # Configurable # Configurable # Configurable # Configurable # Configurable Attach explanation if 'Sometimes' or 'Configurable' was checked for any operation. Version 2. Fragment Application Confirm Complete Appl. SUB. Version 2. one or the other (attach explanation) Sends Unsolicited Responses: # Never # Configurable (attach explanation) # Only certain objects # Sometimes (attach explanation) # ENABLE/DISABLE UNSOLICITED Function codes supported Default Counter Object/Variation: # No Counters Reported # Configurable (attach explanation) # Default Object ______________ Default Variation ______________ # Point-by-point list attached Counters Roll Over at: # No Counters Reported # Configurable (attach explanation) # 16 Bits # 32 Bits # Other Value _____________ # Point-by-point list attached Reports time-tagged Binary Input Change Events when no specific variation requested: # Never # Binary Input Change With Time # Binary Input Change With Relative Time # Configurable (attach explanation) Sends Static Data in Unsolicited Responses: # Never # When Device Restarts # When Status Flags Change No other options are permitted.00 Subset Definitions P009-0IG.FILL OUT THE FOLLOWING ITEM FOR MASTER DEVICES ONLY: Expects Binary Input Change Events: # Either time-tagged or non-time-tagged for a single event # Both time-tagged and non-time-tagged for a single event # Configurable (attach explanation) FILL OUT THE FOLLOWING ITEMS FOR SLAVE DEVICES ONLY: Reports Binary Input Change Events when no specific variation requested: # Never # Only time-tagged # Only non-time-tagged # Configurable to send both. Sends Multi-Fragment Responses: # Yes # No DNP V3.00 7 . The client or host station or computer. and to communicate the information back to the master station or host. A semi-permanent type of data storage (memory) that is backed up by batteries to maintain stored data even if system power is lost.SUB. Abbreviated as RAM. Abbreviation of binary digit. The smallest unit of information in a binary system. Binary Bit Master Non-volatile random-access memory Random-access memory Remote terminal unit 8 DNP Users Group P009-0IG. Abbreviated as RTU. Version 2. Data stored in random-access memory is lost if the system loses power. and where values are expressed in the base two number system. A piece of equipment located at a distance from a master station to monitor and control the status of outlying equipment.00 .GLOSSARY OF TERMS application A piece of software (a program) consisting of one or more processes and supporting functions. Abbreviated as NVRAM. Can be both read and changed by the system. Also referred to as a host or host computer. A type of temporary data storage (memory) that can be read and changed while the computer is in use. Has a value of either one (1) or zero (0). A number system having only two symbols (1 and 0). with which the RTU equipment communicates. 00 Subset Definitions P009-0IG.SUB. logged as part of a chronological record of significant changes in the condition of a particular point or points being monitored. Abbreviated as SOE.Sequence of events A time-tagged change of state.00 9 . Version 2. DNP V3. SUB.LIST OF ACRONYMS AND ABBREVIATIONS DNP IED NVRAM OSI RAM RTU SOE distributed network protocol intelligent electronic device non-volatile random-access memory open systems interconnect random-access memory remote terminal unit sequence of events 10 DNP Users Group P009-0IG. Version 2.00 . 00 Transporting DNP V3.00 over Local and Wide Area Networks Version 1. and review of this document.0 December 15. Norcross. .Distributed Network Protocol (DNP) V3. GA USA Acknowledgements: The author wishes to thank Parker McCauley and Ken Murphy for their advice. expertise. Other contributors: John Phillips Foxboro Australia Pty Limited Grant Gilchrist GE/Harris Energy Control Systems DNP is a trademark of the DNP Users Group. Inc. 1998 Prepared by: Michael Thesing Advanced Control Systems. All rights reserved. 1998 Copyright © 1998 DNP Users Group. ii .Transporting DNP over LAN/WAN December 15. .....................................................................................................................3 Transport layer .................................13 Socket requirements ....................................................5 Typical architecture ......................................................................................................................................2.................................................1 Confirmations ..................................................................2 Physical.............................................................................11 Time Sync ........................21 New Object (Obj 50.............19 ANNEX B (normative) Additions to Existing documents................................................3 3..................10 4.................................................................................................................................Transporting DNP over LAN/WAN December 15..........................1 Network A ................1 1........................................................................................3 Network C...............................1...................1 Desired Behavior ..............................................................2 Network Topologies ...................................................................................................................................................................................21 iii ....................................................................2 Procedure................................................................................................ UDP in a Wide Area Network .......................16 7..3 Protocol Stack...............................................................................................................18 2 3 4 5 6 7 8 ANNEX A (informative) TCP vs.................................................................................................................................1 Protocol characteristics......................3 3....... Link...............................................................................................................................1 Physical and Link layers..................................................................................................................................................................2 TCP......................................1 Changes to Table 3-1 in the Application Layer document....................................................................................................................................4 Broadcast Address ..........................................................................................2.......................3 3...16 References ..................................................................4 Broken connections ......................................................................................................................................21 B...............................................................14 7......................................1..........................................................................................13 7........................................................21 B...4 Conclusions ..............12 6....................................................................................................................................................2 TCP/UDP Port Number for DNP ...................................................................................................................................2 Keep-alive timer .............................................................................................................................................................................. 1998 Contents 1 Overview................................................................................................................................................................................10 4........................................................2.......................................................................................................................................................................3 Making TCP connections ..........................................................11 4.........10 4....................21 New Function Code (24) .3 2.......................................................11 Security........1 Background........................................................................1........................................2 Network B............2............3 3.............................................................................................2 Notes.............................. Var 03) ...............................................................................................................................................................3 Driver requirement ........................................................................................21 B..............1 Purpose ...................1 1...............................................11 6.......................................9 DNP Layers ......3 Multiple frames in UDP................1 1................3 2...........................2 Network layer ......3 3...........................................................................................................................4 3........................................................................................................................2 Addition to Chapter 4 in the Application Layer document...............................................................................................1.................................................................................................................................3 Summary...................................14 7.....................1 UDP ...........................................................................8 3...............................1 1..........................................................................................................................................................1 Addition to Data Object Library document ...............................................................................................................13 7...12 6............................................................................................. and Network layers .......................................................................................................................6 3................................ In order for devices to exchange DNP messages in a local (LAN) and/or wide area network (WAN). RS-485).Transporting DNP over LAN/WAN December 15. It is therefore easy to build DNP "on top of" the internet protocol suite since the internet layers appear transparent to the DNP layers (see Figure 1-1).g. virtual IED. to define how to transport DNP traffic on the internet protocol suite. TCP and UDP. RS232) with limited support for half duplex serial networks (e. 1.). one must either augment the protocol to support a network environment or use an existing network transport mechanism. the internet protocol suite is defined to include both transport layers. This document takes the latter approach. 1998 1 Overview 1. It is highly scalable (LAN to WAN) and many quality implementations exist for both embedded and workstation operating systems. each piece of the protocol stack in one station logically communicates with the corresponding piece in the other station(s). etc. a standalone product.3 Protocol Stack The most attractive reasons for choosing the internet protocol suite as a transport mechanism for DNP are: !" Seamless integration of the substation LAN to the corporate WAN of the utility !" Leverage existing equipment and standards The internet protocol suite is designed to be platform independent and is supported on virtually every computer system in the world. The internet protocol suite and DNP use the OSI layering paradigm.) or a logical entity within a physical unit (i. Throughout this document the term “device” as it applies to a DNP device may be interpreted to be either a physical unit (i. 1 .e. logical RTU.e. etc. The recent growth of the Internet has fueled the large availability of equipment and has proved that the internet protocol suite is capable of transporting tremendous quantities and types of data. specifically. as well as the IP network layer. RTU. 1.2 Notes The internet protocol suite is sometimes referred to as the TCP/IP protocol. IED.1 Purpose DNP V3. The individual layers are summarized in sections 2 and 3.00 (hereafter referred to simply as DNP) was designed for serial point-to-point communication (e. For this document.g. be they physical or logical. A periodic keep-alive message is recommended. and devices that are "downstream" in the SCADA system shall be the server-end of the connection. The DNP Enhanced Protocol Architecture (EPA) of DNP shall be retained so that the protocol requirements contained in each layer do not need to be reinvented. Data users such as RTUs. and devices that require access to the data shall be the client-end of the connection. This address must be set in a secure manner and verified at the server-end before a connection is made. 13].4 Conclusions All DNP devices. Meters. TCP is required for wide-area networks and is strongly recommended for local-area networks. All devices shall support connection-oriented (TCP) and connection-less sockets (UDP). All devices should be configured with the IP address of the communicating host. Data providers such as IEDs. Master Stations.UDP Transport Transport IP Network Network TCP/IP Protocol Suite device driver/link Link Link Figure 1-1 Protocol Stack. UDP may be used on high-reliability single-segment LANs and must be used if broadcast delivery is required. The method for time synchronization on a LAN is defined. that are to communicate in the DNP V3. General recommendations for making socket connections between devices are outlined. 1998 Logical Communications Station 1 APDU Station 2 APDU DNP Application DNP Transport TPDU TPDU DNP Protocol DNP Link Protocol LPDU LPDU TCP.00 Protocol over a LAN/WAN shall be subject to the following basic requirements: !" !" DNP shall use the internet protocol suite to transport messages over the LAN/WAN. the WAN case is not addressed in this document. but the internet protocol suite has been implemented over a wide variety of networks. Link Layer confirmations shall be disabled. A mechanism for verifying the on-line status of an Outstation must be implemented. The recommended physical/link layer is Ethernet.Transporting DNP over LAN/WAN December 15. UDP is appropriate for non-critical messages such as data monitoring or configuration. Application Layer confirmations shall be used per the subset definitions and technical bulletin [Ref. !" !" !" !" !" !" 2 . 1. The installation of Ethernet wiring and equipment is well understood and standardized. ARCnet. UDP supports all the addressing modes of IP – unicast. best effort datagram delivery service to the transport layer protocols. All that it adds beyond IP is the ability to exchange datagrams between multiple processes on a host and rudimentary error detection. 3. UDP can be used on a high-reliability single-segment LAN and in specific cases where small pieces of non-critical data need to be sent or when broadcasting is required. and Network layers 2.3 is clearly the dominant computer network technology. Token-Ring. This document recommends using Ethernet for the Link and Physical layers because of this ubiquity. but also because Ethernet provides the necessary bandwidth and physical media for substation and control center LANs. Sending one UDP datagram causes exactly one IP datagram to be sent. 3 Transport layer The Transport layer of the internet protocol suite consists of two distinct services.1 Protocol characteristics 3. 1998 2 Physical. Ethernet/IEEE 802. e. AppleTalk.2 Network layer Internet Protocol (IP) forms the basis for the internet Protocol suite and therefore is the recommended Network layer protocol. Reliability is left up to the transport layer protocol.1. and fiber optic cable with existing work to standardize 1000 Mbit/second networks ongoing. and broadcast. etc. Lost or corrupted packets are retransmitted transparently to the higher layers.g. Connectionless means that IP does not maintain any state information about the link so each datagram is routed independently of all others. sequencing of the data. Multicast and broadcast are not applicable in a connection-oriented protocol. 3. TCP shall be the primary transport service for DNP messages because of its reliably.1 Physical and Link layers Although there is nothing in the internet protocol suite that precludes operation on other types of networks. It accomplishes this using acknowledgements.. 10 and 100 Mbit/second is supported for twisted-pair copper. Link. and dynamic timer mechanisms.1. UDP can also be used in specific cases as listed in table 3-1.2 TCP TCP provides a connection-oriented service for sending a stream of bytes between hosts. coaxial cable. 2. Each topology diagram uses typical equipment on the various networks to illustrate basic 3 . The protocol determines how to break the stream into IP datagrams based on the characteristics of the network.Transporting DNP over LAN/WAN December 15. but that delivery is not guaranteed. 3. Best effort delivery means that the protocol has mechanisms for routing the datagram and simple error reporting. The only addressing mode supported by TCP is unicast. Annex A describes why UDP cannot be used if the DNP messages must be routed over the utility enterprise or wide area network. multicast.2 Network Topologies Following are the 3 possible network topologies in terms of IP routability from the perspective of a substation or remote LAN.1 UDP UDP provides a connectionless service for sending datagrams between hosts. User Datagram Protocol (UDP) and Transmission Control Protocol (TCP). TCP insures that the same stream of bytes sent to the transmitting side of the connection will be available on the receive side. IP provides a connectionless. Figure 3-2 shows a typical data transfer path from an IED.Transporting DNP over LAN/WAN December 15. 1998 functionality. Substation LAN RTU/Data Concentrator Ethernet Relays Meters Other IEDs Figure 3-1 Network Topology A This is the most basic implementation of a substation LAN in that it doesn't provide for the ability to access substation components outside of the LAN. 3. Clearly. It does provide for IED-to-IED communication in addition to the normal RTU-to-IED communication. many other types of devices can exist on enterprise wide area networks as well as on the substation LANs.2.1 Network A Control Center LAN Master station Master station Server Serial Link: Dedicated Radio Dial-up etc. 4 . IEDs may also establish connections to share data. 13]. TCP provides a reliable connection between all devices. This is a tremendously inefficient use of the network bandwidth and processing on all network hosts. For these reasons. this method must not be used. If broadcast messages are required. all hosts would have to process all messages up through the transport layer and all DNP hosts would have to process the message through the DNP Link layer. DNP link layer confirmations shall be disabled. An alternate method. This method is equivalent in functionality to a RS-485 network with the addition of defined media access and higher baud rate. UDP must be used since TCP is strictly a point-to-point protocol. The disadvantages are: !" An IED designed exclusively for this network cannot be used in networks requiring that the IP datagrams be routed. RTU/Data Concentrator Substation LAN Ethernet Relays Meters Other IEDs Figure 3-2 Network A IED Communication DNP traffic could be transported in a couple of ways in this topology. The second method is to use UDP to transport all DNP frames since the messages do not need to be routed and.Transporting DNP over LAN/WAN December 15. mentioned here because of its simplistic client implementation. would be to use UDP to broadcast all DNP Link Layer frames to the network and let each device determine its messages based on the DNP destination address. Application layer confirmations shall be used as recommended in the technical bulletin [Ref. Unsolicited responses are recommended for both TCP and UDP to improve efficiency. The first method is to use TCP to establish a connection between the RTU/Data Concentrator (RTU/DC) and each IED. 5 . the packet loss would be very low. 1998 Control Center LAN Master station Master station Master station Server Server Serial Link: Dedicated Radio Dial-up etc. !" Since all the frames would have the destination address set to the subnet broadcast address. assuming a fairly high reliability LAN construction. The advantage of this method is that it is very easy to implement in code and has the lowest possible RAM requirements. IEDto-IED. 6 . Remote workstation Substation LAN Router RTU/Data Concentrator Ethernet Relays Meters Other IEDs Figure 3-3 Network Topology B This implementation of a substation LAN provides access to substation components through the utility enterprise.Transporting DNP over LAN/WAN December 15. RTU-to-IED. 1998 3. and enterprise-to-IED communications are supported. Figure 3-3 represents a typical example given by most substation LAN standards currently under development.2 Network B To other parts of enterprise network Enterprise WAN PCs/Workstations Gateways Control Center LAN Master stations Router Servers PPP Fiber PPP Digital etc. Figure 3-4 shows a typical data transfer path from an IED.2. Remote workstation Substation LAN Router RTU/Data Concentrator Ethernet Relays Meters Other IEDs Figure 3-4 Network B IED Communication All devices on the substation LAN must support TCP connections since the IP datagrams are routed (see Annex A). UDP provides the ability to broadcast frames so that a device can share data with other LAN devices efficiently.Transporting DNP over LAN/WAN December 15. 7 . 1998 To other parts of enterprise network Enterprise WAN PCs/Workstations Gateways Control Center LAN Master stations Router Servers PPP Fiber PPP Digital etc. As in topology A. UDP can be used for non-critical data such as Virtual Terminal objects or device monitoring outside of the normal SCADA command and control loops. Transporting DNP over LAN/WAN December 15. Figure 3-6 shows a typical data transfer path from an IED. imagine a remote station requiring periodic monitoring but not full RTU functionality. The Data Acquisition Unit (DAU) could potentially handle multiple remote stations.3 Network C To other parts of enterprise network Enterprise WAN PCs/Workstations Gateways Control Center LAN Master stations Router Servers PPP Data Acquisition Unit Remote workstation Router Serial Link: Dedicated Radio Dial-up etc. Router Remote LAN Ethernet Relays Meters Other IEDs Figure 3-5 Network Topology C This implementation of a remote LAN provides access to devices only through a routed communication link. 8 .2. The Master Stations would then access the remote data via the DAU. For example. 1998 3. 1998 To other parts of enterprise network Enterprise WAN PCs/Workstations Gateways Control Center LAN Master stations Router Servers PPP Data Acquisition Unit Remote workstation Router Serial Link: Dedicated Radio Dial-up etc. single segment LAN. 9 . UDP cannot be used between an IED and the Data Acquisition Unit and only makes sense if an IED wishes to communicate with another IED on the remote LAN.Transporting DNP over LAN/WAN December 15. and when operating over a high reliability.3 Summary All devices shall support both TCP because of its reliable delivery characteristic over all network topologies and UDP because of the potential uses of broadcasting. 3. UDP would be appropriate when many computational nodes require a common IED value but the stability of the system is not compromised if a few values are lost. Router Remote LAN Ethernet Relays Meters Other IEDs Figure 3-6 Network C IED Communication All devices in this topology must support TCP. For example. its efficiency when small pieces of non-critical data need to be transported. Table 3-1 shows which transport layer to use in the various cases. the Application layer doesn't have any addressing mechanism. it will presumably try to reconnect when it comes back up. But. it is necessary to add some type of keep-alive timer to allow clients to periodically determine the on-line status of servers or peers. Note: If the client-side of a TCP connection goes down.Transporting DNP over LAN/WAN December 15. Therefore.g. nonmesh WAN. the functionality called out in the OSI 7-Layer model is either not needed in DNP or has been combined to simplify the design of DNP compatible devices. Using only the IP addresses precludes having more than one DNP entity (i. there is no need to break them apart. This architecture provides an additional benefit for vendors in that they can share most of the DNP code with existing serial channel implementations. The server will process this request. this is also in the Link Frame.g. 1998 Protocol Use in the case… TCP !" Most situations requiring point to point communications !" Mesh topology WAN UDP !" Broadcast on a LAN !" Equivalent to TCP on high-reliability single-segment LAN !" More economical for pay-per-byte.e. and reconnect. The only difference comes in the interface to the internet protocol suite which is very similar to a serial port in that TCP also provides a stream of data with no packet or frame demarcations. 13]. 4. but its uses are limited to cases where the reliability of the communications medium is very high or the transported data is not critical. 4. close the existing connection. the start characters and length field in the Link Frame provides this. For example.1 Confirmations Link layer confirmation shall be explicitly disabled when communicating via the internet protocols. 10 . Application layer confirmations may still be used in accordance with subset and technical bulletin recommendations [Ref.2 Keep-alive timer If the server-side of a TCP connection goes down and comes back up. Therefore. UDP does not have such a mechanism. Cellular Digital Packet Data (CDPD). !" Low priority data. virtual RTUs) per IP address. one might consider extracting the DNP Application layer and transporting it directly over the internet protocol suite. e. The three layers of DNP work together and cannot be separated without adding capabilities to a layer that are already contained within another layer. this could be minutes depending on the scheduling of integrity polls. this is contained in the Link Frame. Essentially. The Application Layer has no means for determining the start of a new message in the serial stream. since the protocol requirements of DNP are present in all three layers. the client-side has no way of knowing until it sends a message to the server and receives the RST flag in the TCP header. data monitor or configuration Table 3-1 Appropriate use of transport layer 4 DNP Layers The three protocol layers of DNP are integrated together to form what the Basic 4 documents call the Enhanced Performance Architecture (EPA). e. TCP has its own very robust mechanisms for insuring data delivery. If an outstation is operating in an unsolicited mode. TCP doesn't have error detection that is adequate for the critical nature of SCADA data. 1998 TCP offers such a timer. polling) provides on-line status detection.g. but a typical implementation is 2 hours. a method for controlling access needs to be defined by the vendor of each device.3. the DNP address must be set to 0xFFFF and all logical DNP devices at all IP addresses within the domain of the broadcast must receive the encapsulated DNP frame.3 Multiple frames in UDP If UDP is used in one of the cases specified in section 3. it must be possible to disable via configuration for cases where the normal application layer traffic (e. but this capability is not universal. 12] The valid host IP addresses can only be set in a secure manner. A suitable time would be once every 10 seconds (although it should be configurable) after there has been no other activity from that device. The recommended message to use for such a timer is the Link Layer Request Status message (0xC9). A server may wish to enable only one connected client at a time or provide for a failover capability. The source of the time at the local network shall be chosen as required by the system. Some possibilities for doing this include. which is not sufficient for the critical nature of the data carried by DNP. However. Each device needs to be configured such that only the intended connections are made. Using HTTP in this manner avoids having to invent new DNP objects to carry both the configuration info and the security info. This requires setting the IP address of the server host at the client side and setting the IP address of the client host (or list of clients) at the server side. !" A terminal-like interface using Virtual Terminal objects over UDP (see Technical Bulletin 9804-004).g. To facilitate interoperability. 4. 6 Time Sync All time synchronization shall be done at the local network only. If DNP is going to be transported over an enterprise wide network. Each equipment vendor will have to determine an appropriate method. 5 Security In a point-to-point serial channel. The Network Time Protocol (NTP) is too large and requires too many resources to be appropriate for DNP. This feature shall be supported by all devices. e. 11 . however it must be possible to disable via configuration. but are not limited to: !" A local interface using a proprietary program. the keep-alive timer shall be supported by all devices.Transporting DNP over LAN/WAN December 15. if a client fails then another client can connect with the server and continue the service that was provided by the failed client. DNP devices are protected from inadvertent or hostile access by the physical nature of the connection. a receiver must be capable of parsing multiple DNP Link Layer frames from a UDP fragment.4 Broadcast Address If UDP is used to broadcast a datagram to multiple devices on a LAN. [Ref. It is not practical to do time sync over IP routers as their delays are typically not consistent and vary based on network loads. It is very low overhead for the devices and is already supported at all subset levels. Servers then must use the IP address to validate client requests and make the appropriate logical port connections. !" A simple HTTP server with password accesses to the configuration information. Note: some internet protocol implementations allow this timeout to be changed. 4. 2 Procedure 1. In the following procedure. The Master would utilize UDP to send the broadcast datagram. 2]. This procedure can also use broadcast messages to synchronize multiple Outstations simultaneously since the Record Current Time request is received at all hosts on the LAN at the same instant. 1998 The time synchronization method defined in Chapter 6 of the Application Layer document is not appropriate for a high-speed (relative to RS-232) LAN because: !" The propagation delay measurement is negligible [Ref. The Master station sends a Record Current Time (FC 24) request to the outstation. The Outstation calculates the offset (MS_Time – OS_Time). !" Recording the time at the first bit of the first byte does not account for network collisions. the offset time between the Master Station and the Outstation can be measured directly. The following procedure outlines a method for both hosts to record their time at the same instant. See Annex B for a complete description of the new function code and object. !" The internet protocol stack causes a variable delay between DNP and the network. The Outstation can set its clock accordingly or apply the offset when event times are reported. when the last character of a message is transmitted from Master Station and received at the Outstation. 3. 2. The Outstation receives the message and records the time of reception of the last octet (denote this as OS_Time). 6. var 3) containing the value MS_Time. namely. and all Outstations that need synchronization must be capable of accepting this datagram.Transporting DNP over LAN/WAN December 15. the Master station is defined as the host on the LAN with the accurate time source. The Master records the time of transmission of the last octet sent to the network (denote this as MS_Time).1 Desired Behavior Since the propagation delay on an Ethernet LAN is very small. 12 . The Master Station issues a Write request with a Time And Date at Last Recorded Time object (obj 50. It returns a Null Response. 6. The difference in these times represents the offset between the two hosts and can be used as a correction factor in the Outstations. The time sync process is greatly influenced (and varied) by processor speed. this procedure requires that the Ethernet driver provide the ability to record the last octet time on transmission and receive. etc. TCP server The side of the link that calls the listen() function to wait for a connection request on a socket. This "fudge factor" does not take into account the delay caused by Ethernet collisions and retransmission. 13 DNP . interrupt latencies. Var 03) Calculate offset offset = value in Time & Date Obj minus time when Record Current Time Obj received Desired case offset = MS_Time .1 Background TCP client The side of the link that calls the connect() function to initiate the connection on a socket. 5]. either Berkeley or Winsock derived. 7. For information on the sockets API. this introduces an error factor in the synchronization process. A device may wish to minimize this error by adding (at the Master end) or subtracting (at the Outstation end) a predetermined value that reflects an average delay through the internet stack and Ethernet driver. Time resolution to the millisecond level cannot be accomplished without this capability.Transporting DNP over LAN/WAN December 15. 7 Socket requirements The following discussion assumes the use of some variation of the sockets API. If a device (Master or Outstation) cannot record time at the Ethernet driver.OS_Time Figure 6-1 Time line for synchronization 6. see [Ref. 1998 Master Station LAN Media Outstation Time MS_Time_DNP MS_Time Ethernet driver and hardware Record Current Time (FC 24) OS_Time Ethernet driver and hardware OS_Time_DNP internet stack internet stack DNP Null Response Time & Date at Last Recorded Time (Obj 50. it should do so as close as possible to the internet stack interface (shown in Figure 6-1 as MS_Time_DNP and OS_Time_DNP). As noted. However. However. it may reduce the average error to a level that can be tolerated in the system.3 Driver requirement As in the serial channel time synchronization. internet protocol stack design. in order to implement DNP over the internet protocol suite. the procedure is handled with application layer messages. each side includes the address and port number with each transmission. For example. 14 . All connection requests and all UDP data are sent to this common port number. For UDP (connection-less) communications. one side must be the server and one side must be the client. data is transferred without either side having to specify the IP address and port number. figure 7-1 shows the typical communication links between two Master Stations and an IED. The client requests a connection by specifying the IP address and port number of the server. This number has been registered with the IANA (Internet Assigned Numbers Authority) for use with DNP. Once the connection is made. internet protocol stack. Each host that receives a UDP datagram is then provided with the sending host address.3 Making TCP connections Making a TCP connection between two devices can be viewed conceptually as replacing the traditional serial port communication link with a sockets interface over the network. and sockets interface. 7. RTU/IED Logical RTU(s) Master Station A Logical RTU(s) DNP Communication Object Serial Port Driver DNP Communication Object Serial Port Driver DNP Communication Object Serial Port Driver RS232 Dedicated line Radio Dial-up etc.2 TCP/UDP Port Number for DNP All devices shall support TCP and UDP communications on port number 20000. 1998 For a TCP connection to take place. 7. RS232 RS232 Master Station B DNP Communication Object Serial Port Driver RS232 Dedicated line Radio Dial-up etc. replace the serial communication with an Ethernet network.Transporting DNP over LAN/WAN December 15. Figure 7-1 Serial port communications Now. etc. It may be capable of supporting multiple logical ports on a device.g. 1998 RTU/IED Logical RTU(s) Logical RTU(s) Master Station A DNP Communication Object Socket A DNP Communication Object Socket B DNP Communication Object Socket A IP/Ethernet driver IP/Ethernet driver Ethernet Ethernet Master Station B Hub DNP Communication Object Socket B IP/Ethernet driver Ethernet Figure 7-2 Network communications All of the DNP components stay the same. etc. it is recommended that: If the device is a data provider (e. SLIP/PPP dial-up): The data provider may initiate the connection as the client and the data user will have the listening socket. If a data provider has the capability to join a network but not be continuously accessible (e. the only part that changes is the lowest level communications drivers.g. meter. support the server end of a TCP connection (i.e.Transporting DNP over LAN/WAN December 15. it should be the server end of the connectionoriented (TCP) socket. the interface between the DNP Communication Object and the lower level driver can also remain virtually the same. For a network in which some devices need to establish a communication link before joining the network (e. RTU/Data Concentrator. Data users shall be configurable to support both ends (client and server) of the socket connection to insure universal support for all data providers and all system architectures. be capable of accepting connection requests on a listening socket). since TCP accepts a stream of data just like a serial port. For a network in which all devices are continually present and available.e.g. be capable of initiating connection requests). Master Station. In fact. RTU. IED. dial-up). it shall support the client end of a TCP connection (i.).g. peer IED. Requirements Data providers shall. Each data user (e. All devices shall be capable of simultaneously accepting messages via the connectionless (UDP) port and the connection oriented 15 .) should initiate the connection as the client end of the connection-oriented (TCP) socket. at minimum. This allows for each connection request to be validated in a secure manner (by the TCP Manager in this example) and each UDP datagram to be routed to the correct DNP Port.e. If there are multiple DNP logical entities within the device. Two TCP server connections are shown to illustrate how connection requests are controlled by the TCP Manager object. 7. 1998 (TCP) port. close the existing connection. virtual device. If the client-side goes down: When the client-side restarts and attempts a new connection. logical RTU. the server will process this request. It is recommended that each DNP Port be configured with the peer IP address. it must be able to configure these entities to use a single DNP Port.5 Typical architecture Figure 7-3 illustrates the architecture of a device that supports TCP client. logical RTUs). If the server-side goes down: When the next message is sent (see section 4. 16 . TCP server.g. This will cause subsequent calls to recv() or select() to return an error if the socket is non-blocking or the send() call will fail if the socket is blocking. the messages must be routed to the correct entity (e.4 Broken connections If a DNP/TCP connection is made and one of the devices losses power or inadvertently resets. there must be mechanisms to inform the other device so that the connection can be reestablished.2 regarding DNP keep-alive messages). and UDP connections. If a device supports multiple logical entities (i. the server will send a TCP packet with the RST flag set. etc.Transporting DNP over LAN/WAN December 15.). 7. The client must close the current connection and reconnect. and reconnect. validate connections Ethernet TCP Data Server-side socket driver DNP communication object Logical RTU(s) TCP Data Internet Protocol Physical and Link Layers Server-side socket driver DNP communication object Logical RTU(s) Connection request TCP Data Client-side socket driver DNP communication object Logical RTU(s) UDP Only driver DNP communication object Logical RTU(s) UDP Datagrams UDP Router .Transporting DNP over LAN/WAN December 15. 1998 sockets API Connection requests TCP Manager .to all ports Figure 7-3 Example sockets architecture 17 .TCP Listening socket . 1997. 18 ." SRI International. Jan. Prentice Hall. J. Ed. version 0.390-401. "Internet Protocol. "Path MTU Discovery." Nov. Richard. [6] Miklovic. Ed. "User Datagram Protocol. "Comments on 'Proposal for Use of Distributed Network Protocol in Substation LANs'. Instrumentation Society of America. version 0. vol. Sept. [10] Mogul. CA. Volume 1. Reading. W. [9] Postel. [5] Stevens. J.00 Technical Bulletin 9804-002. J. Research Triangle Park. Menlo Park. September 23. 5. John. "Proposal for Use of Distributed Network Protocol in Substation LANs. J. RFC-768. [7] Postel. 1998 8 References [1] DNP V3. [4] Stevens. Menlo Park. [11] Kent.. Basic 4 Document Set [2] Gilchrist.A. Richard. Ed." Foxboro Australia Pty Limited. UNIX Network Programming. 1990. 1987. DNP Confirmation and Retry Guidelines. September 1981. TCP/IP Illustrated. NJ. 1998. 1994. Dec. pp.C.00. 1996. Upper Saddle River." SRI International. J.. RFC-793. Real-time Control Networks. Sept. W." Computer Communications Review. 1981.0 over Local and Wide Area Networks." USC/Information Sciences Institute. 1998. RFC-1191. Grant. Addison Wesley Longman. 1981. "Fragmentation Considered Harmful. MA. [12] Phillips. Volume 1: The Protocols. Aug. 1993. [13] DNP V3. 2nd Edition. NC. No." SISCO. and Mogul. 11. S. and Deering. Daniel T. 17. CA.Transporting DNP over LAN/WAN December 15. 14. C. RFC-791. [3] Falk." Harris Distributed Automation Products.1.... [8] Postel. Herbert.. "Transmission Control Protocol Specification.2. "Transporting DNP 3. the entire datagram (1 or more DNP Link Layer frames) must be retransmitted. The only features that UDP adds to the underlying IP protocol is port addressing and a 16-bit checksum. Timeout and retransmission – Clearly. and dynamic timer mechanisms. TCP insures that the same stream of bytes sent to the transmitting side of the connection will be available on the receive side. sequencing of the data. TCP tries to avoid fragmentation by allowing both sides of a connection to optionally specify the maximum segment size (MSS). DNP includes a number of transport layer capabilities. a persist timer to keep window size information flowing. a keepalive timer for detecting if one end of the connection goes down without warning. If the destination IP address is "nonlocal". equipment failures. 3]. It accomplishes this using acknowledgements. the requirements for a local serial network versus an internet are different. See Ref. For most networks. RFC1191 outlines a way for hosts to determine the path MTU for paths that may include lower MTU connections. In a local network.[Ref. TCP adapts its retransmission timer to the conditions of the connection. etc. and a maximum segment lifetime timer for completing a disconnection operation. 237] Furthermore. if the datagram is fragmented in IP and one of the fragments is lost. Lost or corrupted packets are retransmitted transparently to the higher layers. First. the frame "packing" proposed in [Ref. So. Fragmentation – IP has no timeout or retransmit capabilities as well as no capabilities for transmitting individual fragments. DNP Link Layer confirms are not needed and performance is only limited by the characteristics of the connection. In a large internet. UDP in a Wide Area Network It has been proposed that User Datagram Protocol (UDP) be used for transporting DNP in a network. the RTT can change from packet to packet due to such factors as increased congestion on individual routes. For example: !" Reordering of packets received out of order and detecting duplicate packets – the DNP transport layer only has a 6-bit sequence number. 2] will exasperate the problem. Timeouts must be adaptive to account for these cases. the route and round-trip time (RTT) for IP packets remains relatively constant. On an internet. for example. it does not contain all of the necessary mechanisms for an enterprise wide internet. the minimum datagram size is 576 octets with two notable exceptions. 64 sequence numbers is not enough if. time critical SCADA information would have to be handled by DNP. TCP addresses the above internet deficiencies of DNP in the following manner: !" !" TCP uses a 32-bit sequence number and a 32-bit acknowledge number to insure that data is received in order. 1998 ANNEX A (informative) TCP vs. But since DNP was designed for RS-232 and RS-485 type serial communications. 2]. Both cases have real performance issues [Ref. Clearly. !" !" !" 19 .Transporting DNP over LAN/WAN December 15. DNP can handle this by either confirming all Link Layer packets or by throwing away the entire Application Layer fragment and letting the sending station timeout and retransmit. Second. Transmission Control Protocol (TCP) is a much better choice for transporting DNP data over a WAN. Modules that have this limitation are rare. [Ref. an internet contains a combination of slow serial links (PPP or SLIP connections) and LFNs (Long Fat Networks = networks with high bandwidth-delay products). the IP specification states that the minimum datagram size that a module must handle is 68 octets (RFC-791 IP). not by DNP. packets can arrive out of order since each packet is routed independently and may traverse totally different paths (different speeds). the MSS normally defaults to 536. TCP manages 4 timers for each connection – a retransmission timer for expected acknowledgements. 4 p. All of the other requirements for transporting the sensitive. The maximum size of a datagram using the DNP Link Layer on UDP/IP is 320 octets (maximum DNP link frame size (292 octets) + 28 octets for the UDP/IP headers). Since fragmentation is handled by TCP. 11 for further arguments as to why fragmentation should be avoided. the MTU (Maximum Transmission Unit)decreases to 296 octets for a low delay link (RFC-1191). if the Pointto-Point Protocol (PPP) is employed in the network. 1998 In addition. and repacketization to increase performance. At 4K/socket. albeit a fairly reasonable one. RAM is 25K + 4K/socket. this is reasonable and scalable. TCP includes such features as packet reduction using the Nagle algorithm. this is very small. Obviously. the number of sockets is still low since this would typically be required in only a few devices on the network. all of these features come at a price. For one popular embedded implementation. the ROM requirement for the full internet protocol stack is 115K. to share data points). 20 . congestion avoidance for links with slow segments.e. sliding data windows to allow multiple packets before acknowledgements.Transporting DNP over LAN/WAN December 15. If devices wish to establish IED-to-IED communications (i. Considering that most devices on a DNP network will have to maintain only 1 connection to a data concentrator of some sort. 2 Addition to Chapter 4 in the Application Layer document 4.1. This object should be used for timesynchronization in networked applications.Variation: 03 Description: The time and date at last recorded time object is an information object that represents the absolute time of day and date when the last Record Current Time function code was send.2. It is the first step in the network time synchronization process. 1998 ANNEX B (normative) Additions to Existing documents New Function Code (24) B. 21 . Reserved 25-120 Reserved for future use B.25 RECORD CURRENT TIME (FUNCTION CODE 24) This function is used to in a network application to allow the Master Station and the Outstation to record their time at the same instant. Time is recorded at the Outstation when the last character of the message is received.1.Transporting DNP over LAN/WAN December 15. Time is recorded by the Master Station when the last character of a message is transmitted. Var 03) B. The difference in these times represents the offset between the two hosts and can be used as a correction factor in the Outstation.1 Changes to Table 3-1 in the Application Layer document Time Synchronization Function Codes 23 24 Delay Measurement Record Current Time … Used in a network application to allow the Master Station and the Outstation to record their time at the same instant.1 Addition to Data Object Library document TIME AND DATE AT LAST RECORDED TIME Data Object 50 . AC FC = 24 Figure 4-45 Master Request to Record Current Time The Outstation responds with a Null Response New Object (Obj 50. Transporting DNP over LAN/WAN December 15. 1970.47] <0.. zero seconds. and milliseconds.. 1998 Object Coding: Absolute Time 7 15 23 31 39 47 6 14 22 30 38 46 5 13 21 29 37 45 4 12 20 28 36 44 3 11 19 27 35 43 2 10 18 26 34 42 1 9 17 25 33 41 0 8 16 24 32 40 Absolute Time = UI48 [0. zero minutes. msec> Narrative: Absolute Time is recorded as milliseconds since midnight.248-1. at zero hours. January 1st. 22 . Resolution: The time base used in synchronization requests remains an application decision to be based upon system issues. Discussion: There are two common time bases used by master stations when transmitting time synchronization messages to remote devices: UTC and local time. with or without daylight savings (summer) time. It may be confusing to field operation people when the time information presented on an intelligent electronic device’s (IED’s) LCD is not local time. Therefore. Device vendors should design for the usage of a UTC time base in future products. the system architect should keep in mind several DNP3-related considerations when selecting the time base. These applications will not operate correctly unless allowance is made for the UTC to local time offset. Time Base DNP3 does not specify which time base to use in a system or a device: Coordinated Universal Time (UTC) or local time. DNP3 does not make a recommendation regarding time base selection. This is because locally generated reports and time displayed data will be in UTC instead of local time. it is Page 1 of 2 TB2004-001 Synchronization Time Base 15 January 2004 . In some systems this may span multiple time zones. Also there may be application programs which are time-of-day dependent. This may or may not be true of the corresponding local time base. and the same time would be reported for common events occurring simultaneously at outstations located in multiple time zones. It is anticipated the UTC will become the preferred time base and it is recommended that new devices should support a UTC time base. Local time may be a better choice for devices which do not support converting UTC to local time. the system implementer must take care in matching the master station with outstation equipment. Local time refers to time at the master and/or outstation sites. At this time. Affected Documentation: The following text is to be inserted into the Application Layer documentation. Displayed data may not be meaningful to the user. all devices controlled by a single master are typically synchronized to. Sending UTC to a device which does not support converting to local time for local displays and applications may be a problem for the equipment users.DNP Technical Bulletin TB2004-001 Synchronization Time Base Selection Issue: Whether to use UTC (Coordinated Universal Time) or local time in outstation time synchronization messages. or adjusted for the same time. Universal support of the UTC time base will ease integration issues for the system implementer. allowing system wide correlation of event time tags. However. Because devices may have been designed to use different time base standards. UTC has an advantage in that it provides a constant time base. Whichever time base is used. UTC is widely used and could be converted to local time by software in field devices. not modified by summer (daylight’s saving) time adjustment. or master stations could convert from local time to UTC in a manner similar to the way multiple time zones are handled. • DNP3 requires transmission of events in the order in which they occurred. Master stations may need to support both UTC and local time bases for the foreseeable future. This is especially important when a data concentrator or a master station needs to time sequence events from various sources. • It is desirable to choose a time base that does not shift with daylight savings (summer) time because events that occur immediately after the bi-annual time change. a local display may need to show adjusted time values from the time stamps in buffered events. It is often desirable and/or necessary to provide a local time source (e.desirable to use a time base that is constant throughout the system. will be erroneously sequenced with other events that are properly time tagged. Outstation devices that execute application programs requiring actions to occur at specific times of the day can increase software complexity when the application time base is different from that used to report events to the master station. Similarly. or at least permits easy reconciliation of dissimilar time bases. IRIG-B or GPS) at a device.g. • • • Device vendors should design for a UTC time base in new products. A device may or may not be able to shift the time by a fixed hourly amount if required to coordinate time stamping of DNP events with a different time base. but before the device is time synchronized. Consideration should be given before forcing an IED or data concentrator to compensate for the exact time when daylight savings (summer) time starts and ends as this can put an undue burden on the device. At some unspecified future time. it is anticipated that a UTC time base will be preferred. Tip Last Updated: 15 January 2004 Status: Initial submittal 15 January 2004 Page 2 of 2 TB2004-001 Synchronization Time Base . some of which may communicate using a non-DNP3 protocol. 1. 7. SBO.3: 8. If the DUT does not have installed binary output points. 8. Issue a valid operate. Verify that the DUT echoes the object portion of the select byte for byte. 5. skip this section. Step 8.3 Errata Issue: An error was introduced in Version 2. Same Sequence Number Operate Retries 1. Corrected procedure (same as version 2. 2. skip this section. a error status was added that is incorrect per Technical Bulletin TB2000-002.2.1. 6. Subset Level 1 DNP3-2003. 9. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). Verify that the DUT operates the binary output. Last Updated: February 5. Verify that the DUT echoes the object portion of the operate byte for byte. 8. 9.3 of the IED Certification Procedures. Issue a valid operate. . Intelligent Electronic Device (IED) Certification Procedure. Resolution: Remove the incorrect error code in 8.13.1. Verify that the DUT echoes the object portion of the select byte for byte.13 Binary Output. 2004 Status: Approved by Technical Committee.13 Binary Output. incrementing the sequence number by 1 modulo 16. SBO.2. Issue the operate again using the same application layer sequence number. step 8. 5. Verify that the DUT does not operate the binary output.2 of the test procedures to fail. Verify that the DUT echoes the object portion of the operate byte for byte. Verify that the DUT does not operate the binary output. incrementing the sequence number by 1 modulo 16.2. In 8. This will cause a device that passed version 2.13. Intelligent Electronic Device (IED) Certification Procedure. If the DUT does not have installed binary output points. 7. Verify that the DUT operates the binary output. 6. 3.1. 2. Issue a valid select to an installed binary output point.2. 4. Issue a valid select to an installed binary output point. Subset Level 2 Changes to the Subset Level 1 and 2 Certification Procedures: Current procedure in version 2.2. Affected Documentation: DNP3-2003. Flag update for next revision of procedures. Levels 1 and 2.2): 8. 3.2. Same Sequence Number Operate Retries 1. Verify that the DUT echoes the object portion of the operate byte for byte.2.DNP3 Technical Bulletin 2004-002 IED Certification Procedures v2. Issue the operate again using the same application layer sequence number.2. 4. 2. Function code 2 (WRITE) is used for the write requests. and many others cannot be written. While not mandatory at this time. when either a master or outstation starts up. 8 April 2003 1 Device Attributes . The data type code and length provide keys for master and outstation devices to interpret the value. Outstations that implement attribute objects must include support for these two variations. Variations 254. it is possible that in the future. has a data type code. The value is self-explanatory. Variation 254 is used to request all of the attribute objects from an outstation in a single response. function code 1 (READ). using the DNP3 Protocol. to electronically read various outstation features and attributes in order to simplify the burden of configuring master stations. all devices will be required to support this feature. except variations 254 and 255. 0. Each insert describes a separate variation. a set of variation numbers may be set aside for private. Initially. 255. This convention is designed to permit adding attribute variations to existing object groups in the future. but not at this time. In the future. Two special variations are designed to assist master stations collect the attributes supported by an outstation.2 Variations Variations for object group 0 represent attributes in the outstation device. is permitted. but some variations may optionally be writable depending upon the outstation capabilities.3 Function codes All attribute variations are readable from a master by using a read request. Another goal is to negotiate fragment sizes without the need for configuration. Attributes characterizing an outstation’s features are conveyed using DNP3 objects as described below. 2. Attached to this Technical Bulletin are a series of sheets that are to become inserts in the DNP3 Object Library. • • Variation 255 is used to request a list of the attribute variation numbers supported by an outstation. Every attribute object. Ideally. vendor or user-specific attributes. the master can ask for information from the outstation and then perform self-configuration. Variations 1 through 253 are pre-assigned or reserved for assignment by the DNP Users Group.DNP Technical Bulletin TB2003-001 DEVICE ATTRIBUTES 1 Issue: There is a need.1 Group 0. 2 Resolution: All vendors are encouraged to implement device attributes functionality as described herein. length and value. 2. only a single index. Attribute variation numbers begin at 255 and decrease downward. Point 0 DNP3 object group 0 is assigned to the outstation device. 3. UINT8: Length. an outstation would most likely report an unsigned integer with 1. If more than one octet is required for a numeric formatted attribute.3 Attribute data type codes Every attribute value is constructed according to one of the following attribute data type codes.3.4–1 Attribute Data Type Codes Code 1. 2. Floating-point. length and value format.4 General Attribute Object Formats All attribute objects. 6.4. Unsigned integer. n. For example. required to convey the attribute value that follows. No other sizes are acceptable. Signed integer. Specifies the number of octets. Specifies the attribute data type code as described in paragraph 2. 5.2. 4. Octet string. 8 April 2003 2 Device Attributes . 2 or 4 octets.2 Formal structure UINT8: Attribute data type code. The number of octets in this field is specified by the length field.4. The second octet in a DNP3 attribute object always specifies the number of octets. The bit alignment in bit string types requires the first bit to appear in bit 0 of the first byte of the attribute value. except variations 254 and 255. Table 2. Variation specific: Attribute value Encoding of the attribute value is dependent upon the variation’s data type code. the least significant octet is transmitted first.4. Code Name VSTR UINT INT FLT OSTR BSTR Description Visible characters suitable for print and display. are read or written (function codes READ and WRITE) using a type. Attribute data type codes do not specify the number of octets required to convey the attribute value. Bit string.1 Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Attribute value 2.4. 2. Floating-point types are limited to 4 bytes and 8 bytes for transporting 32-bit and 64-bit floating point values. 2. using the READ function code for object group 0. variation 255.6. The outstation responds with a list of the device attribute variations. The outstation in this example supports 26 different device attribute variations: 217 to 233. 237 to 241. that it supports. E This example shows a request to read the maximum receive fragment size in the outstation. the second octet specifies the number of octets (2) in the actual attribute value (0x05DC) reported by the next two octets. 3 Device Attributes The procedure for uploading a list of device attributes from an outstation is 2. Procedure to retrieve a list of attribute variations The master issues a read request. and the properties of those attribute variations.2 1. It is used to retrieve a list of all of the attribute variation numbers. The receive fragment size was reported as being 1500 octets. This object has a variable length that depends upon the count of attribute variations supported by the outstation. The response uses qualifier code 0x5B and the 1-octet range field holds a count of 1. 2. 2.6. and the properties of those attribute variations. 248 to 250 and 252.2. Example This example shows a request to read a list of attribute variations from the outstation.6 2. unsigned integer). 2. from index 0. Observe that the first octet specifies the data type (2. supported by the outstation. Note: Qualifier 0x06 may be used instead of specifying an index of 0 because only a single index is permitted at this time.1 Reading a list of attribute variations supported in an outstation Variation 255 Variation 255 has special meaning. ►►► Request Message C3 AC 01 FC 00 Grp F2 Var 00 Qual 00 Range 00 ◄◄◄ Response Message (beginning) C3 AC 81 FC 00 IIN1 00 IIN2 0 Grp F2 Var 00 Qual 00 Range 00 ← 02 02 ◄◄◄ Continuation of Response Message DC 05 → The response contains a single object.6.5 Reading attributes The following examples illustrate reading attributes. The list does not include variations 254 and 255.3 E 8 April 2003 . Maximum Transmit Fragment Size. 8 April 2003 4 Device Attributes . 2. 224.7 Reading all of the attributes with a single request.7. is writable and all others are not. Also notice that attribute 240 (0xF0). Group 0. The second step requires the master to construct a request containing one object header in the request for each attribute it desires in the response. There are two methods to read all of the attributes associated with a single point. 0x00. suppose an outstation supports variations 221. This method can cause a lengthy request message but does not affect the response length. 229. 233 and 239. To find out.6. the master sends a request for a list of attributes using variation 255 in the request as described in paragraph 2. 2. As an example. qualifier 0x00 and range 0x00. variation 0xDD.1 Specific variations request The specific variation approach requires the master to know which attributes are available first.►►► Request Message C3 AC 01 FC 00 Grp FF Var 00 Qual 00 Range 00 ◄◄◄ Response Message (beginning) C3 AC 81 FC 00 IIN1 00 IIN2 00 Grp FF Var 5B Qual 01 Range 34 Prefix 00 ← D9 ◄◄◄ Continuation of Response Message 00 DA 00 DB 00 DC 00 DD Attribute variation numbers list 00 DE 00 ◄◄◄ Continuation of Response Message DF 00 E0 00 E1 00 E2 00 Attribute variation numbers list E3 00 E4 ◄◄◄ Continuation of Response Message 00 E5 00 E6 00 E7 00 E8 Attribute variation numbers list 00 E9 00 ◄◄◄ Continuation of Response Message ED 00 EE 00 EF 00 F0 01 Attribute variation numbers list F1 00 F8 ◄◄◄ Continuation of Response Message 00 F9 00 FA 00 FC 00 → Note that variations 254 (0xFE) and 255 (0xFF) are not included in the list. The request would include 5 object headers: 1. 8 April 2003 5 Device Attributes . all others cannot.2. qualifier 0x00 and range 0x00. or all of those attributes for which it has an interest. and the internal indications bit IIN2. attributes that were written by the master are not guaranteed to retain their values after a reset of any kind and for any reason. qualifier 0x06 and no range octets may be used instead of qualifier 0x00 and range 0x00.4. 5. qualifier 0x00 and range 0x00. variation 0xE0. The objects in a write message are formatted according to paragraph 2. 2.7. The following insert sheets are added to the DNP3 Object Library. qualifier 0x00 and range 0x00. Group 0. 0x00. 0x00 because only a single index is permitted at this time. 3. Group 0. Group 0. The master can then choose from the attribute objects returned in the response any. 0x00.2 Non-specific variations request The non-specific variation approach requires the master to construct a request containing a single object header having variation 254: 1. 1. The allowed values that may be written to numeric-valued attributes are not specified unless limits appear in the descriptions in the DNP3 Data Object Library. Affected Documentation: The Application Layer document is updated to include a description of attributes. variation 0xEF. Only those attributes in the returned list with the writable property bit set can be written. Vendors are not required to store attribute values in non-volatile memory. 0x00. variation 0xFE.2 [PARAMETER_ERROR] must be set in the response. the master must first send a request for a list of attributes using variation 255 in the request as described in paragraph 2. Note: In each of the 5 object headers. If a master writes a value that is unacceptable to the outstation.8 Writing attributes Those attributes in an outstation that are writable can be set from the master station. 2. qualifier 0x00 and range 0x00. Group 0. 4. Therefore. 0x00. variation 0xE9. Copies are attached to this Technical Bulletin.6. variation 0xE5. the outstation must not change its existing attribute value. 0x00. qualifier 0x00 and range 0x00. Vendors may limit the range to values suitable for their device. Group 0. To determine which of the attributes are writable. Reserved. Device manufacturer’s hardware version string. User-assigned ID code/number string. Analog output events supported. Maximum binary input index. 3. Number of binary input points. Duration of time accuracy (followin a time synchronization). Reserved for retrieval of attribute names. Number of double-bit binary input points. Number of binary output points. Number of analog input points. Maximum binary output index. DNP subset level and conformance. Number of analog output points. Number of counter points. Reserved for device manufacturer’s registered DNP device code. Analog input events supported. Last Updated: 8 April 2003. Changes to the Subset Level 1 and 2 Certification Procedures: None. Maximum analog input index. Special variation for requesting return of all attributes. Maximum counter index. Frozen counter events supported. Maximum receive fragment size. Maximum transmit fragment size.Object Group Variation 0 1 0 ●●● 0 216 0 217 0 218 0 219 0 220 0 221 0 222 0 223 0 224 0 225 0 226 0 227 0 228 0 229 0 230 0 231 0 232 0 233 0 234 0 235 0 236 0 237 0 238 0 239 0 240 0 241 0 242 0 243 0 244 0 245 0 246 0 247 0 248 0 249 0 250 0 251 0 252 0 253 0 254 0 255 Description Reserved Reserved Max number of binary outputs from object group 12 per request. Device manufacturer’s name string. User-assigned name string for the outstation. Maximum analog output index. Local timing accuracy. Device serial number string. User-assigned location name or code string. Binary input events supported. Frozen counts supported. Device manufacturer’s software version string. Special variation for requesting list of attributes. Device manufacturer’s product name and model. Maximum number of double-bit binary input index. Binary output events supported. Insert Document File DNPObjLibIns_G00_V216 DNPObjLibIns_G00_V217 DNPObjLibIns_G00_V218 DNPObjLibIns_G00_V219 DNPObjLibIns_G00_V220 DNPObjLibIns_G00_V221 DNPObjLibIns_G00_V222 DNPObjLibIns_G00_V223 DNPObjLibIns_G00_V224 DNPObjLibIns_G00_V225 DNPObjLibIns_G00_V226 DNPObjLibIns_G00_V227 DNPObjLibIns_G00_V228 DNPObjLibIns_G00_V229 DNPObjLibIns_G00_V230 DNPObjLibIns_G00_V231 DNPObjLibIns_G00_V232 DNPObjLibIns_G00_V233 DNPObjLibIns_G00_V234 DNPObjLibIns_G00_V235 DNPObjLibIns_G00_V236 DNPObjLibIns_G00_V237 DNPObjLibIns_G00_V238 DNPObjLibIns_G00_V239 DNPObjLibIns_G00_V240 DNPObjLibIns_G00_V241 DNPObjLibIns_G00_V242 DNPObjLibIns_G00_V243 DNPObjLibIns_G00_V245 DNPObjLibIns_G00_V246 DNPObjLibIns_G00_V247 DNPObjLibIns_G00_V248 DNPObjLibIns_G00_V249 DNPObjLibIns_G00_V250 DNPObjLibIns_G00_V252 DNPObjLibIns_G00_V254 DNPObjLibIns_G00_V255 2. 8 April 2003 6 Device Attributes . Counter events supported. Frozen analog inputs supported. Double-bit binary input events supported. Status: Pending General Membership Approval (circa February. 2004). 8 April 2003 7 Device Attributes .4. ) UINT8: Length. The maximum number of binary output objects from object group 12 that the master may include in control messages. UINTn: Maximum number of binary output objects. Specifies the attribute data type code.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Number of Binary Output Objects Per Request Group: 0 Variation: 216 Type: Attrib 1 Description: This attribute is the maximum number of binary output objects from object group 12 that the master may include in control messages. (Refer to section 1 of the DNP3 Data Object Library. Notes: Version: 1.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of binary output objects 2.2 Formal structure UINT8: Attribute data type code. UINT. 2 2. 3 None. Specifies the number of octets in the number of binary output objects field.00 Approval Date: 2 March 2003 DNPObjLibIns_G00_V216 Sheet 1 . Specifies the number of octets in the timing accuracy microseconds field. Resolution is the smallest interval of time between data sampling or computations or reported times. This value applies to the maximum error in the detection and time stamping of events when the time for those events is determined by the outstation. say 20. the period between time synchronizations.2 Formal structure UINT8: Attribute data type code. UINT. Specifies the attribute data type code. 2 2. (Refer to section 1 of the DNP3 Data Object Library. 3 Notes: Do not confuse this attribute with timing resolution.DNP3 Object Library Group Name: Variation Name: Device Attributes Local Timing Accuracy Group: 0 Variation: 217 Type: Attrib 1 Description: This attribute is the rated timing accuracy of an outstation stated in microseconds. If an outstation requires time synchronization from a master and asserts the internal indications bit IIN1. sampling resolution and other factors.) UINT8: Length. This hypothetical outstation’s timing accuracy could be much worse.4 [NEED_TIME]. might be able to detect the existence of an event every 100 microseconds. When reporting this value. the calculation shall assume that the time reported by the master is perfect. DNP3 events are reported with a time resolution of one millisecond. and passed on from other devices when the event time is determined by those other devices. This value is defined as the maximum difference in time. the calculations must take into consideration the drift in the device’s local clock source. An outstation.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Timing accuracy microseconds 2. It does not apply to events that are retrieved. for example. but that does not necessarily mean that its timing accuracy is 100 microseconds.00 Approval Date: 2 March 2003 DNPObjLibIns_G00_V217 Sheet 1 . The timing accuracy then depends upon Version: 1. between the time that would be given to an event by a hypothetical device having a perfect clock with infinitesimal resolution and no detection delays and the worst case time that the outstation could give. UINTn: Timing accuracy microseconds. stated as a positive number of microseconds.000 microseconds. Version: 1.4.00 Approval Date: 2 March 2003 DNPObjLibIns_G00_V217 Sheet 2 . Interrupt latency. How well the outstation can determine the time delay when a delay measurement (function code 23 [DELAY_MEASURE] is requested from the master. If an outstation is synchronized from a local source. Data sampling periods. the time accuracy reported must include the error in that product and other possible error sources such as those listed in the previous paragraph. such as a GPS receiver. Filter delays. Other factors.DNP3 Object Library Group Name: Variation Name: Device Attributes Local Timing Accuracy Group: 0 Variation: 217 Type: Attrib • • • • • • The drift in the outstation’s local oscillator and the period between assertions of bit IIN1. This includes devices that do not time tag events and devices that receive time from other sources such as a GPS receiver. this value must be zero. 3 Notes: Rated accuracy is not defined by DNP3 as this is a vendor and application specific parameter. The number of seconds that the device maintains its rated time accuracy following a time synchronization from the master. (Refer to section 1 of the DNP3 Data Object Library. UINTn: Number of seconds. Specifies the number of octets in the number of seconds field. This value must not exceed 0xFFFFFFFF. Version: 1.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V218 Sheet 1 .2 Formal structure UINT8: Attribute data type code.) UINT8: Length. 2 2.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of seconds 2.DNP3 Object Library Group Name: Variation Name: Device Attributes Duration of Time Accuracy Group: 0 Variation: 218 Type: Attrib 1 Description: This attribute is the number of seconds that the device maintains its rated time accuracy following a time synchronization from the master. then this value must be non-zero. If time synchronization is not required from the master. UINT. If time in the device is dependent upon periodic receipt of time from the master. Specifies the attribute data type code. 3 None. (Refer to section 1 of the DNP3 Data Object Library.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V219 Sheet 1 .1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Analog output events 2.2 Formal structure UINT8: Attribute data type code. INTn: Analog output events. Notes: Version: 1. Specifies the attribute data type code. 2 2. This is a Boolean having a value of 1 if the device supports analog output events and 0 if the device does not support analog output events.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Analog Output Events Group: 0 Variation: 219 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports analog output events. INT.) UINT8: Length. Specifies the number of octets in the analog output events field. 3 Notes: If there are gaps in the point indexes. Specifies the number of octets in the maximum analog output point index field.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Analog Output Index Group: 0 Variation: 220 Type: Attrib 1 Description: This attribute is maximum analog output point index controllable from the master.) UINT8: Length. (Refer to section 1 of the DNP3 Data Object Library. UINT.2 Formal structure UINT8: Attribute data type code.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V220 Sheet 1 .1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum analog output point index 2. Version: 1. 2 2. the number of points controllable by the master in variation 221 might not equal one more than the maximum point index. UINTn: Maximum analog output point index. The maximum analog output point index controllable from the master. Specifies the attribute data type code. DNP3 Object Library Group Name: Variation Name: Device Attributes Number of Analog Outputs Group: 0 Variation: 221 Type: Attrib 1 Description: This attribute is number of analog output points controllable from the master. 2 2. The number of analog output points controllable from the master.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of analog output points 2. Version: 1. (Refer to section 1 of the DNP3 Data Object Library. the number of points controllable by the master might not equal one more than the maximum point index in variation 220.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V221 Sheet 1 . UINT. UINTn: Number of analog output points. Specifies the number of octets in the number of analog output points field.) UINT8: Length. 3 Notes: If there are gaps in the point indexes.2 Formal structure UINT8: Attribute data type code. Specifies the attribute data type code. 2 2. This is a Boolean having a value of 1 if the device supports binary output events and 0 if the device does not support binary output events. (Refer to section 1 of the DNP3 Data Object Library. Specifies the number of octets in the binary output events field. INT.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Binary output events 2.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Binary Output Events Group: 0 Variation: 222 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports binary output events. Notes: Version: 1. 3 None.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V222 Sheet 1 . INTn: Binary output events.2 Formal structure UINT8: Attribute data type code.) UINT8: Length. Specifies the attribute data type code. (Refer to section 1 of the DNP3 Data Object Library. 2 2.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V223 Sheet 1 . Specifies the attribute data type code. Specifies the number of octets in the maximum binary output point index field. The maximum binary output point index controllable from the master. the number of points controllable from the master in variation 224 might not equal one more than the maximum point index. 3 Notes: If there are gaps in the point indexes. UINT.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Binary Output Index Group: 0 Variation: 223 Type: Attrib 1 Description: This attribute is maximum binary output point index controllable from the master. UINTn: Maximum binary output point index.) UINT8: Length.2 Formal structure UINT8: Attribute data type code. Version: 1.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum binary output point index 2. The number of binary output points controllable from the master. 2 2. the number of points controllable from the master might not equal one more than the maximum point index in variation 223. Version: 1.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V224 Sheet 1 . Specifies the attribute data type code. UINTn: Number of binary output points.) UINT8: Length. (Refer to section 1 of the DNP3 Data Object Library.2 Formal structure UINT8: Attribute data type code. UINT.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of binary output points 2. Specifies the number of octets in the number of binary output points field. 3 Notes: If there are gaps in the point indexes.DNP3 Object Library Group Name: Variation Name: Device Attributes Number of Binary Outputs Group: 0 Variation: 224 Type: Attrib 1 Description: This attribute is number of binary output points controllable from the master. 2 2. Specifies the number of octets in the frozen counter events field. This is a Boolean having a value of 1 if the device supports frozen counter events and 0 if the device does not support frozen counter events.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Frozen counter events 2.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V225 Sheet 1 .2 Formal structure UINT8: Attribute data type code. INT. Specifies the attribute data type code.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Frozen Counter Events Group: 0 Variation: 225 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports frozen counter events.) UINT8: Length. Notes: Version: 1. 3 None. INTn: Frozen counter events. (Refer to section 1 of the DNP3 Data Object Library. 00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V226 Sheet 1 . Notes: Version: 1. This is a Boolean having a value of 1 if the device supports frozen counters and 0 if the device does not support frozen counters.) UINT8: Length. 2 2.2 Formal structure UINT8: Attribute data type code.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Frozen counters 2. INTn: Frozen counters. (Refer to section 1 of the DNP3 Data Object Library. 3 None.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Frozen Counters Group: 0 Variation: 226 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports frozen counters. Specifies the attribute data type code. Specifies the number of octets in the frozen counters field. INT. This is a Boolean having a value of 1 if the device supports counter events and 0 if the device does not support counter events. INT. Specifies the attribute data type code.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Counter events 2. Specifies the number of octets in the counter events field. 2 2. 3 None.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V227 Sheet 1 . Notes: Version: 1.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Counter Events Group: 0 Variation: 227 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports counter events. INTn: Counter events.) UINT8: Length.2 Formal structure UINT8: Attribute data type code. (Refer to section 1 of the DNP3 Data Object Library. 1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum counter point index 2. Version: 1.) UINT8: Length. 3 Notes: If there are gaps in the point indexes. UINTn: Maximum counter point index. 2 2.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Counter Index Group: 0 Variation: 228 Type: Attrib 1 Description: This attribute is maximum counter point index reported by the device. UINT. (Refer to section 1 of the DNP3 Data Object Library. Specifies the number of octets in the maximum counter point index field.2 Formal structure UINT8: Attribute data type code.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V228 Sheet 1 . the number of points reported in variation 229 might not equal one more than the maximum point index. Specifies the attribute data type code. The maximum counter point index reported by the device. 2 Formal structure UINT8: Attribute data type code.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of counter points 2. Version: 1. 2 2.) UINT8: Length. (Refer to section 1 of the DNP3 Data Object Library. the number of points reported might not equal one more than the maximum point index reported in variation 228. UINTn: Number of counter points.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V229 Sheet 1 .DNP3 Object Library Group Name: Variation Name: Device Attributes Number of Counter Points Group: 0 Variation: 229 Type: Attrib 1 Description: This attribute is number of counter points reported by the device. Specifies the number of octets in the number of counter points field. 3 Notes: If there are gaps in the point indexes. The number of counter points reported by the device. UINT. Specifies the attribute data type code. 2 Formal structure UINT8: Attribute data type code.) UINT8: Length.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Frozen analog inputs 2. INT. Notes: Version: 1. Specifies the attribute data type code. This is a Boolean having a value of 1 if the device supports frozen analog inputs and 0 if the device does not support frozen analog inputs. (Refer to section 1 of the DNP3 Data Object Library. INTn: Frozen analog inputs. 2 2. Specifies the number of octets in the frozen analog inputs field. 3 None.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V230 Sheet 1 .DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Frozen Analog Inputs Group: 0 Variation: 230 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports frozen analog inputs. Specifies the number of octets in the analog input events field. Specifies the attribute data type code. INT.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Analog Input Events Group: 0 Variation: 231 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports analog input events.) UINT8: Length. (Refer to section 1 of the DNP3 Data Object Library. 3 None. INTn: Analog input events.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Analog input events 2. Notes: Version: 1.2 Formal structure UINT8: Attribute data type code. This is a Boolean having a value of 1 if the device supports analog input events and 0 if the device does not support analog input events. 2 2.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V231 Sheet 1 . UINT.2 Formal structure UINT8: Attribute data type code. 3 Notes: If there are gaps in the point indexes. UINTn: Maximum analog input point index. Version: 1. Specifies the attribute data type code.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V232 Sheet 1 . 2 2. (Refer to section 1 of the DNP3 Data Object Library. Specifies the number of octets in the maximum analog input point index field. the number of points reported in variation 233 might not equal one more than the maximum point index.) UINT8: Length. The maximum analog input point index reported by the device.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Analog Input Index Group: 0 Variation: 232 Type: Attrib 1 Description: This attribute is maximum analog input point index reported by the device.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum analog input point index 2. 3 Notes: If there are gaps in the point indexes.) UINT8: Length. Specifies the number of octets in the number of analog input points field. Specifies the attribute data type code. The number of analog input points reported by the device. the number of points reported might not equal one more than the maximum point index reported in variation 232.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of analog input points 2. 2 2.2 Formal structure UINT8: Attribute data type code. Version: 1. UINTn: Number of analog input points. (Refer to section 1 of the DNP3 Data Object Library.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V233 Sheet 1 . UINT.DNP3 Object Library Group Name: Variation Name: Device Attributes Number of Analog Input Points Group: 0 Variation: 233 Type: Attrib 1 Description: This attribute is number of analog input points reported by the device. 00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V234 Sheet 1 . 3 None.) UINT8: Length. INT. This is a Boolean having a value of 1 if the device supports double-bit binary input events and 0 if the device does not support double-bit binary input events. 2 2. (Refer to section 1 of the DNP3 Data Object Library.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Double-bit Binary Input Events Group: 0 Variation: 234 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports double-bit binary input events. Specifies the attribute data type code. Specifies the number of octets in the double-bit binary input events field. INTn: Double-bit binary input events.2 Formal structure UINT8: Attribute data type code. Notes: Version: 1.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Double-bit binary input events 2. the number of points reported in variation 236 might not equal one more than the maximum point index. The maximum double-bit binary input point index reported by the device.) UINT8: Length. (Refer to section 1 of the DNP3 Data Object Library.2 Formal structure UINT8: Attribute data type code. Specifies the attribute data type code.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V235 Sheet 1 . Version: 1. 3 Notes: If there are gaps in the point indexes.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Double-bit Binary Input Index Group: 0 Variation: 235 Type: Attrib 1 Description: This attribute is maximum double-bit binary input point index reported by the device. 2 2. UINT.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum double-bit binary input point index 2. Specifies the number of octets in the maximum double-bit binary input point index field. UINTn: Maximum double-bit binary input point index. ) UINT8: Length.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V236 Sheet 1 . UINTn: Number of double-bit binary input points.2 Formal structure UINT8: Attribute data type code. Version: 1. 2 2. The number of double-bit binary input points reported by the device.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of double-bit binary input points 2. Specifies the number of octets in the number of double-bit binary input points field. the number of points reported might not equal one more than the maximum point index reported in variation 235. UINT. (Refer to section 1 of the DNP3 Data Object Library. 3 Notes: If there are gaps in the point indexes. Specifies the attribute data type code.DNP3 Object Library Group Name: Variation Name: Device Attributes Number of Double-bit Binary Input Points Group: 0 Variation: 236 Type: Attrib 1 Description: This attribute is number of double-bit binary input points reported by the device. 2 Formal structure UINT8: Attribute data type code. 2 2. Specifies the number of octets in the binary input events field.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Binary input events 2. (Refer to section 1 of the DNP3 Data Object Library. INTn: Binary input events.DNP3 Object Library Group Name: Variation Name: Device Attributes Support for Binary Input Events Group: 0 Variation: 237 Type: Attrib 1 Description: This attribute is Boolean that indicates whether the device supports binary input events. This is a Boolean having a value of 1 if the device supports binary input events and 0 if the device does not support binary input events. INT.) UINT8: Length. Notes: Version: 1.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V237 Sheet 1 . 3 None. Specifies the attribute data type code. Specifies the number of octets in the maximum binary input point index field.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Binary Input Index Group: 0 Variation: 238 Type: Attrib 1 Description: This attribute is maximum binary input point index reported by the device. (Refer to section 1 of the DNP3 Data Object Library. UINT.2 Formal structure UINT8: Attribute data type code. 2 2. Specifies the attribute data type code.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V238 Sheet 1 . 3 Notes: If there are gaps in the point indexes. the number of points reported in variation 239 might not equal one more than the maximum point index. Version: 1.) UINT8: Length.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum binary input point index 2. The maximum binary input point index reported by the device. UINTn: Maximum binary input point index. 2 2. UINT. (Refer to section 1 of the DNP3 Data Object Library. Specifies the number of octets in the number of binary input points field.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V239 Sheet 1 . the number of points reported might not equal one more than the maximum point index reported in variation 238. UINTn: Number of binary input points.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Number of binary input points 2.) UINT8: Length.2 Formal structure UINT8: Attribute data type code.DNP3 Object Library Group Name: Variation Name: Device Attributes Number of Binary Input Points Group: 0 Variation: 239 Type: Attrib 1 Description: This attribute is number of binary input points reported by the device. 3 Notes: If there are gaps in the point indexes. Version: 1. The number of binary input points reported by the device. Specifies the attribute data type code. 3 None. UINTn: Maximum transmit fragment size. UINT.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum transmit fragment size 2. (Refer to section 1 of the DNP3 Data Object Library. Specifies the attribute data type code. Notes: Version: 1. The maximum number of octets the device will transmit in an Application Layer fragment. Specifies the number of octets in the maximum transmit fragment size field.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V240 Sheet 1 .2 Formal structure UINT8: Attribute data type code. 2 2.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Transmit Fragment Size Group: 0 Variation: 240 Type: Attrib 1 Description: This attribute is maximum number of octets the device will transmit in an Application Layer fragment.) UINT8: Length. 00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V241 Sheet 1 .2 Formal structure UINT8: Attribute data type code. UINTn: Maximum receive fragment size.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Maximum receive fragment size 2. Specifies the number of octets in the maximum receive fragment size field. UINT. Specifies the attribute data type code. The maximum number of octets the device will accept in a received Application Layer fragment. (Refer to section 1 of the DNP3 Data Object Library. 3 None.DNP3 Object Library Group Name: Variation Name: Device Attributes Maximum Receive Fragment Size Group: 0 Variation: 241 Type: Attrib 1 Description: This attribute is maximum number of octets the device will accept in a received Application Layer fragment. 2 2.) UINT8: Length. Notes: Version: 1. 3.DNP3 Object Library Group Name: Variation Name: Device Attributes Device Manufacturer’s Software Version Group: 0 Variation: 242 Type: Attrib 1 Description: This attribute is the version code of the manufacturer’s device software.12:2003-11-25-Standard”.006” and “1. VSTR.) UINT8: Length.2 Formal structure UINT8: Attribute data type code. 2 2. Specifies the attribute data type code. Two examples are “5.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Manufacturer’s software version string 2. Code assigned by the manufacturer for the installed version of the device’s software. 3 None. Specifies the number of octets in the manufacturer’s software version string. Notes: Version: 1. (Refer to section 1 of the DNP3 Data Object Library. VSTRn: Manufacturer’s software version string. The contents of this attribute is a free form string that is formatted according to the manufacturer’s normal practice.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V242 Sheet 1 . Specifies the attribute data type code. Two examples are “Rev D” and “2004-122”. Notes: Version: 1. 2 2. The contents of this attribute is a free form string that is formatted according to the manufacturer’s normal practice. Specifies the number of octets in the manufacturer’s hardware version string. VSTR.) UINT8: Length. VSTRn: Manufacturer’s hardware version string.DNP3 Object Library Group Name: Variation Name: Device Attributes Device Manufacturer’s Hardware Version Group: 0 Variation: 243 Type: Attrib 1 Description: This attribute is the version code of the manufacturer’s device hardware. Code assigned by the manufacturer for the installed version of the device’s hardware. 3 None.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Manufacturer’s hardware version string 2.2 Formal structure UINT8: Attribute data type code.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V243 Sheet 1 . (Refer to section 1 of the DNP3 Data Object Library. The contents of this attribute is a free form string that is formatted according to the user’s normal practice. Specifies the number of octets in the user-assigned location name or code.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length User-assigned device location name or code string 2. Name or code for location where the device is installed. 3 Notes: It is recommended that device manufacturers provide a configurable means for the end user to locally store a text location name or code. “Toora Wind Farm” and “Soho:Piccadilly Circus”.2 Formal structure UINT8: Attribute data type code. 2 2.DNP3 Object Library Group Name: Variation Name: Device Attributes User-assigned Location Name Group: 0 Variation: 245 Type: Attrib 1 Description: This attribute is a name or code given to the location where the device is installed by the end user. VSTRn: User-assigned location name or code string. “~”. it is recommended that he/she choose a delimiting character (“:”. If a user has a location naming convention consisting of sub-fields (like major and minor).00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V245 Sheet 1 . Three examples are “1954 Broad Street”. Specifies the attribute data type code. “+”.) UINT8: Length. (Refer to section 1 of the DNP3 Data Object Library. Version: 1. etc) as a standard method to separate the fields. It is assigned by end user. VSTR. Specifies the attribute data type code.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length User-assigned device code or number string 2.) UINT8: Length.2 Formal structure UINT8: Attribute data type code. VSTRn: User-assigned device code or number string. 3 Notes: It is recommended that device manufacturers provide a configurable means for the end user to locally store a text device code/number. (Refer to section 1 of the DNP3 Data Object Library. 2 2. Two examples are “4075” and “25-DS”. Version: 1. VSTR.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V246 Sheet 1 . The contents of this attribute is a free form string that is formatted according to the user’s normal practice. Code or number of device assigned by end user.DNP3 Object Library Group Name: Variation Name: Device Attributes User-assigned ID code/number Group: 0 Variation: 246 Type: Attrib 1 Description: This attribute is a code or number given to the device by the end user. Specifies the number of octets in the user-assigned device code or number. Specifies the number of octets in the user-assigned device name. Version: 1. Specifies the attribute data type code.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length User-assigned device name string 2. 2 2.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V247 Sheet 1 . 3 Notes: It is recommended that device manufacturers provide a configurable means for the end user to locally store a text device name. VSTRn: User-assigned device name string.2 Formal structure UINT8: Attribute data type code. (Refer to section 1 of the DNP3 Data Object Library. VSTR.DNP3 Object Library Group Name: Variation Name: Device Attributes User-assigned Device Name Group: 0 Variation: 247 Type: Attrib 1 Description: This attribute is a name given to the device by the end user.) UINT8: Length. Name of device assigned by end user. Two examples are “Main Street Sub” and “500805RTU100”. The contents of this attribute is a free form string that is formatted according to the user’s normal practice. 2 Formal structure UINT8: Attribute data type code.DNP3 Object Library Group Name: Variation Name: Device Attributes Device Serial Number Group: 0 Variation: 248 Type: Attrib 1 Description: This attribute is the serial number assigned by the device manufacturer. (Refer to section 1 of the DNP3 Data Object Library. VSTR. The contents of this attribute is a free form string that is formatted according to the manufacturer’s normal practice. Two examples are “2003-07-04:1234” and “5Z4B-6xy9”. 3 None. VSTRn: Manufacturer’s serial number string.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Manufacturer’s serial number string 2.) UINT8: Length. Manufacture’s serial number. Specifies the number of octets in the manufacturer’s serial number. Specifies the attribute data type code. Notes: Version: 1.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V248 Sheet 1 . 2 2. This is usually a calendar year number such as “2003”. If the device has not been tested.DNP3 Object Library Group Name: Variation Name: Device Attributes DNP Subset and Conformance Group: 0 Variation: 249 Type: Attrib 1 Description: This attribute has three fields that identify the DNP subset level. DNP3 Test Procedure version for which the device was certified to conform to by an independent testing facility.) UINT8: Length. Specifies the number of octets in the subset level. An ASCII colon. this field must be omitted from the object. ASCII “3” indicates subset level 3. VSTRn: Test procedure version. colon and test procedure versions. ASCII “2” indicates subset level 2. not determined or none claimed. VSTR1: Colon. VSTR. ASCII colon (0x3A) Test procedure version 2. (Refer to section 1 of the DNP3 Data Object Library. 2 2. VSTR1: Subset level. a separator and the DNP3 Test Procedure version for which the device was certified to conform to by an independent testing facility. ASCII “1” indicates subset level 1. Version: 1. Specifies the attribute data type code.2 Formal structure UINT8: Attribute data type code. This separator is mandatory and must appear in the attribute string. There are 4 subset level values permitted: ASCII “0” indicates unknown.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Subset level. “:” (binary value 0x3A).00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V249 Sheet 1 . DNP3 Object Library Group Name: Variation Name: Device Attributes DNP Subset and Conformance Group: 0 Variation: 249 Type: Attrib In the future.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V249 Sheet 2 . 3 Notes: An example attribute has 6 characters and looks is coded as “1:2003” Version: 1. this field may contain more characters if conformance levels are coded differently. VSTRn: Manufacturer’s product name and model string.DNP3 Object Library Group Name: Variation Name: Device Attributes Device Manufacturer’s Product Name and Model Group: 0 Variation: 250 Type: Attrib 1 Description: This attribute is the device manufacturer’s product name and model. (Refer to section 1 of the DNP3 Data Object Library. Notes: Version: 1. “SEL-351 Relay”.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V250 Sheet 1 . The string should not include the manufacturer’s name as that appears in attribute variation 252. 2 2. “IntelliCap” and “Multicomm”.2 Formal structure UINT8: Attribute data type code. VSTR. “Form 5 Recloser”.) UINT8: Length. “NTU-7500”. Several examples are “Callisto”. “D25 IED”. Specifies the number of octets in the manufacturer’s product name and model. Manufacture’s product name and model. 3 None. “PDS Magna”. Specifies the attribute data type code.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Manufacturer’s product name and model string 2. The contents of this attribute is a free form string that identifies an industry recognizable trade name and model. VSTRn: Manufacturer’s name string. Ltd”.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position Attribute data type code Length Manufacturer’s name string 2. Notes: Version: 1. Specifies the attribute data type code. (Refer to section 1 of the DNP3 Data Object Library.) UINT8: Length. Manufacture’s name. Specifies the number of octets in the manufacturer’s name. 3 None. 2 2. An example is “123 SCADA.00 Approval Date: 12 January 2003 DNPObjLibIns_G00_V252 Sheet 1 . VSTR.DNP3 Object Library Group Name: Variation Name: Device Attributes Device Manufacturer’s Name Group: 0 Variation: 252 Type: Attrib 1 Description: This attribute is the name of the device manufacturer.2 Formal structure UINT8: Attribute data type code. or 0x06. It must not be used in responses from outstations. Requests from a master use group 0. The master sends a single object header with this variation in lieu of including a possibly length list of object headers in the request. 0x00. variation 254. Version: 1. 3 Notes: This variation may only appear in a master request. Devices that implement attributes are required to support this variation. qualifier code • • 0x00 with a range field of 0x00.DNP3 Object Library Group Name: Variation Name: Device Attributes Non-Specific All Attributes Request Group: 0 Variation: 254 Type: Attrib 1 Description: This attribute is used as a shorthand to request an outstation to return all of its attributes in a single response. 2 Coding: This variation does not have an object.00 Approval Date: 2 March 2003 DNPObjLibIns_G00_V254 Sheet 1 . If the bit is set.00 Approval Date: 2 March 2003 DNPObjLibIns_G00_V255 Sheet 1 . BSTR8: Attribute Properties. } where n is the number of device attribute variations supported by the outstation. Responses from an outstation use group 0.1 Coding: Pictorial octet transmission order ↓ 7 6 5 4 3 2 1 0 ← bit position 1st attribute variation 1st attribute properties 2nd attribute variation number 2nd attribute properties ●●● Last attribute variation number Last attribute’s properties 2. 0x00. Version: 1. This object has a variable length that depends upon the count of attribute variations supported by the outstation. Requests from a master use group 0. The number of an attribute variation that is supported in the device.2 Formal structure SET of n { UINT8: Attribute variation number. qualifier code 0x5B and a range field with a count of 1 object.DNP3 Object Library Group Name: Variation Name: Device Attributes List of Attribute Variations Group: 0 Variation: 255 Type: Attrib 1 Description: This is a special attribute number that is used to retrieve a list of all of the device attribute variation numbers. and the properties of those attributes. 2 2. variation 255. Bits 1 through 7 are reserved. 3 Notes: The list does not include variations 254 and 255. the master can change the respective attribute by sending a request message having function code [WRITE]. and one of the following qualifier codes • • 0x00 with a range field of 0x00. supported by the outstation. Bit 0 indicates whether the device attribute is writable by the master. 0x06. variation 255. 00 Approval Date: 2 March 2003 DNPObjLibIns_G00_V255 Sheet 2 .DNP3 Object Library Group Name: Variation Name: Device Attributes List of Attribute Variations Group: 0 Variation: 255 Type: Attrib Devices that implement attributes are required to support this variation. Version: 1. This attribute variation is not writable. The terms “upstream” and “downstream” used to identify device hierarchy are also shown in this diagram. COMM_LOST. sending DNP3 messages to a master device. In this case each device in the communications chain other than the master is a reporting device. RESTART. In the following descriptions: • • • An “originating device” is one that gathers field data directly (for inputs) or issues controls directly to the field (for outputs). REMOTE_FORCED and LOCAL_FORCED flags are common to all object group types that contain flags. A “reporting device” is a device that acts as a DNP3 outstation. DNP Technical Bulletin 2003-002 Object Flags Page 1 of 8 11 June 2003 . Data from an originating device may arrive at the master via one or more “data concentrator” devices. Non-originating devices always pass flags through unchanged unless indicated below. This identification of various devices is illustrated below in Figure 1. The ONLINE. Communication Link Reporting devices Master NonOriginating Device NonOriginating Device Originating Device Field I/O Upstream devices Downstream devices Figure 1 The flag bits for each object group are described in Table 1 below. The other flags are specific to particular object groups as identified below. Each flag is “set” (has the value “1”) when active and is “clear” (has the value “0”) when inactive. Background: Resolution: The purposes and meanings of DNP3 Object Flags are defined below.DNP3 Technical Bulletin 2003-002 Object Flags Issue: The descriptions of the Object Flags are open to some misinterpretation and clearer definitions of the purpose and usage of all flags is required. A “non-originating device” is one that obtains data (for inputs) via a communications link to another device or issues control commands (for outputs) via a communications link to another device. out-of-service. In a nonoriginating device the bit remains set until it is overwritten by collecting output status information from a reporting device. In a non-originating device the bit remains set until it is overwritten by collecting data from a reporting device. For output status objects: The RESTART flag shall only be set while a device is restarting. The point may not be observable or may be not controllable. In an originating device this is when the field value is first written.) and unable to obtain field data. For input data objects: If set. For output status objects: If clear. irrespective of whether or not an output value (control) has been sent to the output object. the point is inactive or disabled (for example: powereddown. faulty.Table 1 Flag Descriptions Flag Function ONLINE Description For input data objects: If clear. RESTART The RESTART flag indicates that the data has not been updated from the field since device reset. Originating devices shall set this bit immediately upon resetting and keep the bit set until they place a non-default value into their database. The flag may optionally be cleared by a non-originating device if communications to the originating device fail. not installed or operating in local mode. having a value that has never been updated from the field since restart. it shall clear this flag. DNP Technical Bulletin 2003-002 Object Flags Page 2 of 8 11 June 2003 . Non-originating devices shall set this bit immediately upon restart and keep the bit set until it is overwritten by collecting data from a reporting device. the output point is inactive. The bit is cleared when the object is first updated. the object is in the initialization state. In an originating device the flag shall be cleared after the device is available to accept commands. In this case the COMM_LOST flag must also be set. Commands sent to the point may fail. unavailable. etc. Note: When an output point is in local mode. Flag Function COMM_LOST Description COMM_LOST indicates that there is a communication failure in the path between the device where the data originates and the reporting device. REMOTE_FORCED If set. once set. Reported Value X with REMOTE_FORCED set Nonoriginating Device Received Value X with LOCAL_FORCED or REMOTE_FORCED set See Note 2. this flag will remain set until it is overwritten by again collecting data for this point from a reporting device. A non-originating device will set this flag if it loses communication with the downstream device. This may be due to the device operating in a diagnostic or temporary mode or due to human intervention. Reported Value Y with LOCAL_FORCED set Device in which value is overridden to Y Input Value X If the value is forced in a non-originating device and overridden in a downstream device. DNP Technical Bulletin 2003-002 Object Flags Page 3 of 8 11 June 2003 . The REMOTE_FORCED flag will be set in an object if either the REMOTE_FORCED or LOCAL_FORCED flags (see below) are set in that object received from a downstream device. otherwise it propagates the state of this flag that is reported by the downstream device. An originating device may never set this bit. the data value reported shall be the last value available from the originating device before communications were lost. This means that. Only a non-originating device may set this flag. then the non-originating device shall set both REMOTE_FORCED and LOCAL_FORCED flags. LOCAL_FORCED If set. If set. This flag indicates that the value reported for the object may be stale. the data value is overridden in a downstream reporting device. the data value is overridden in the device that is reporting this flag as set. An originating device never sets this flag. Reported Value Y with LOCAL_FORCED and REMOTE_FORCED set Device in which value is overridden to Y Received Value X with REMOTE_FORCED set or LOCAL_FORCED set See Note 2. The flag is set when an overridden value is received. The determination of what constitutes “chattering” is device-dependent. If polled data reporting is used. While CHATTER_FILTER is set. When the “chattering” input again becomes stable. the originating device shall set the CHATTER_FILTER flag.: the maximum possible counter value). If set. In an originating device: This flag is set when the Counter value is reinitialized. DNP Technical Bulletin 2003-002 Object Flags Page 4 of 8 11 June 2003 . DISCONTINUITY Only applicable to Counter object groups.Flag Function CHATTER_FILTER Description Only applicable to Binary Input object groups. There is no mechanism within DNP3 for the outstation to report the value at which counter rollover occurs (i. no events are generated for the binary input. OVER_RANGE Only applicable to Analog Input object groups. ROLLOVER OBSOLETE. the reported counter value cannot be compared against a prior value to obtain “total counts”. the originating device shall clear the CHATTER_FILTER flag and report the current state of the input. Note: The resetting of a counter through the use of the Freeze and Clear commands is normal operation that shall not set DISCONTINUITY. Only applicable to Counter object groups. the binary data value is presently changing between the “On” and “Off” sufficiently frequently to activate a chatter filter that prevents reporting of the true state.e. While a binary input is “chattering”. the master is responsible for polling counter data frequently enough to detect rollover. See Note 3. the data object’s true value exceeds the valid measurement range of the object. The binary data value reported does not necessarily represent the input state. If set. The purpose of the chatter filter is to reduce bandwidth by suppressing event reporting for binary inputs that are experiencing a rapid series of state changes. If set. The flag is cleared after a new value has been acquired and transmitted to the host. In a non-originating device: Set when the DISCONTINUITY flag is set in a reporting device. Cleared after a new value has been acquired and transmitted to the host. The transitions to set and to clear the CHATTER_FILTER flag generate events. Hence outstations shall not set the ROLLOVER flag and master devices shall ignore the ROLLOVER flag. Flag Function REFERENCE_ERR Description Only applicable to Analog Input object groups. the measurement process determined that the object’s data value might not have the expected level of accuracy. If a Master requests a particular object variation (e. Note 2: For output status objects. The outstation sets the OVER_RANGE flag of the object. 2. within –32768 to 32767). For example: the reference signal used in the analog-to-digital conversion process is out of limits or a calculated value has been contaminated with noise. STATE bits show the state of an input or output and do not indicate an error condition.: 16-bit or 32-bit integer). Rules for setting the OVER_RANGE flag. CHATTER_FILTER. The state of the binary input or output object. NOTE: For a data value stored within the device as (for example) a 12-bit two's complement number. the ONLINE flag is set (1) and the exception condition flags (above) are all clear (0). COMM_LOST. The following rules govern how to report this type of data: 1. If a Master requests a 16-bit variation and the value of the data point is outside of the range –32768 (8000 hex) to32767 (7FFF hex). These flags do not indicate that a control was issued “locally” or “remotely” to the output object to set it to the reported state. Any other combination of the ONLINE and exception condition flags indicates that the data value might not correctly indicate the value of the corresponding field object. Note 1: The RESTART. the LOCAL_FORCED and REMOTE_FORCED flags indicate that the reported value has been overridden. OVER_RANGE. the master shall interpret this as if the flags were included with the ONLINE flag set and all the exception condition flags clear. a Master device may request this data in a particular format (e. If a Master requests a 32-bit variation and the value of the data point is outside of the range –2147483648 (8000 0000 hex) to 2147483647 (7FFF Note 3: DNP Technical Bulletin 2003-002 Object Flags Page 5 of 8 11 June 2003 .g. 3. then the outstation reports the value without modification within the requested variation. and the measured value of the data point within the outstation is within the range for the DNP variation (e. this procedure will simply involve sign extending the value to its 16-bit or 32-bit two's complement representation. However. DISCONTINUITY and REFERENCE_ERR flags all indicate “exception conditions”. Since DNP analog values are signed. if the A/D convertors provide only 12 bits of resolution). When an outstation reports a variation that has no flags. If any other condition holds. STATE Only applicable to Binary Input and Binary Output object groups.g. 16-bit Analog Input). ROLLOVER. This value might not correspond to the state of the output point. Some analog input data gathered by an outstation may be inherently a certain size (e. then the outstation shall report the variation with flags. sign extension is not considered a modification of the value. then the outstation reports the value as either –32768 or 32767. If set. LOCAL_FORCED. In normal operation. REMOTE_FORCED.g.g. If the converted input quantity exceeds the full-scale value. For example.FFFF hex). 4. The outstation sets the OVER_RANGE flag of the object. For example: a 12-bit A/D convertor could be scaled by multiplying the output value by 16 to report values in the range –32768 to 32752 (8000– 7FF0) with steps of 16 between adjacent contiguous values. In such cases. These rules are illustrated in Table 2 below. The COMM_LOST flag indicates that communication has failed somewhere in the downstream path. This flag can only be set by a non-originating device. OVER_RANGE is set in all other cases. the scaling used will provide some particular values for the “full-scale” or maximum positive and negative readings. The outstation must still report the value as 2047 in the analog input object. except that the ONLINE flag may optionally be cleared. Notes: In some devices. except the example of 33000 requested as a 32-Bit Analog Input. The setting or clearing of a flag does not necessarily cause other flags to set or clear. native analog ranges of less than 16-bits are “normalized” to fit into a 16-bit range and the measured value is scaled prior to being reported. Interaction or Combinations of Flags: • Each flag indicates a separate condition. the full-scale value is reported and the OVER_RANGE flag is set. the outstation sets the OVER_RANGE flag of the object. The reporting device shall not alter the object value or any other flag received from a downstream device if the communication is lost. but not Rule #3. If an input exceeds the range measurable by the hardware on the outstation. The Slave sets the OVER_RANGE flag in each case in Table 2. Table 2 Setting of OVER_RANGE Flag Size Stored Internally by the Device (size of A/D convertor) 8 bits signed 8 bits unsigned 12 bits signed 16 bits signed Measured Value > +127 < -128 > +255 <0 > +2047 < -2048 > +32767 < -32768 > +2147483647 32 bits signed 33000 (example) < -2147483648 Response to a Request for 16-bit Analog Inputs 007F FF80 00FF 0000 07FF F800 7FFF 8000 7FFF 7FFF 8000 Response to a Request for 32-bit Analog Inputs 0000007F FFFFFF80 000000FF 00000000 000007FF FFFFF800 00007FFF FFFF8000 7FFFFFFF 00080E8 * 80000000 * OVER_RANGE is not set in this case. Page 6 of 8 11 June 2003 • DNP Technical Bulletin 2003-002 Object Flags . an outstation with a 12-bit A/D converter must set OVER_RANGE when the measured value exceeds 2047. A data object with the COMM_LOST flag set can be used as an indication of the last known value of the input or output if the other exception condition flags are not set. Thus the value and other flags indicate the state of the input or output point when data was last collected prior to communication failure. It does not alter the value reported by its hardware. In particular: Clearing of the ONLINE flag shall not require that any other flag needs to be set. This is a case of Rule #2 applying. then the outstation reports the value as either –2147483648 or 2147483647. The variation without flags shall only be reported if the flag status for all data reported with that variation is ONLINE and none of the exception flag bits are set. at which time the value and flags shall be set to the state reported from that downstream device. In particular. but has not yet had its data updated from the field. REFERENCE_ERR and DISCONTINUITY flags shall not clear the ONLINE flag. • • Objects having variations with flags or without flags: Some objects have variations that include flags and other variations that do not include flags. If a downstream reporting device fails to communicate with the data concentrator. the object has not completed its startup process. it shall set the LOCAL_FORCED flag. the object is operating and reporting its default start-up value. then during the period between initialization and the time that the data object is first updated with field data. It may optionally also clear the ONLINE flag. For these objects. The state of these flags shall not affect or alter the state of any other flag. When communication with the lower level device is established or restored. the data concentrator updates all flags to the state reported by the downstream device when data is received (subject to the following rule for handling the forced data flags). Hence if a variation without flags is used. the receiving device shall interpret this to mean that the data is ONLINE with no exception conditions. a device is permitted to determine if it will report a variation with flags or a variation without flags. If a device is capable of reporting data (communicating with an upstream device) prior to the clearing of the RESTART flag in the reported objects. Alternatively. ROLLOVER. DNP Technical Bulletin 2003-002 Object Flags Page 7 of 8 11 June 2003 . If a device overrides the initial value of objects. OVER_RANGE. the data concentrator may set the COMM_LOST flag for all data objects from that reporting device. all flags are passed through unchanged. then the ONLINE flag shall be cleared at initialization and the following conditions shall hold: • • If the ONLINE flag is reported set while the RESTART flag is set. The data concentrator may alter some of the flags as follows: • • Unless otherwise specified. otherwise this flag shall be cleared. and is still off-line. If the LOCAL_FORCED or REMOTE_FORCED flags are set for an object from a downstream reporting device. These flags shall stay in this state until the first data update from the lower level reporting device. If any data point is not ONLINE or has some exception condition indicated by some other flag being set. then a variation with flags shall be used to report that data. the RESTART flag of that object may optionally remain unchanged. If the ONLINE flag is clear. When the data object is first updated with field data.• The REMOTE_FORCED and LOCAL_FORCED flags indicate an override state of the data. the RESTART flag shall be cleared. the setting of these flags shall not clear the ONLINE flag or set the RESTART flag unless that is what the reporting device actually does to the data object. Considerations for Data Concentrators (Non-originating devices) Data Concentrators are devices that act as “reporting devices” that collect data from “originating devices” or other reporting devices. the objects may optionally set their LOCAL_FORCED flag to indicate that the value has been overridden. • • Implementation Rules: If the value and flags of an object are preserved through a cold start or restart. but shall not alter any other flag. A data concentrator accepts data and flags values sent to it from a reporting device and passes these on to a master device. the REMOTE_FORCED flag shall be set and passed through to the master. If the data concentrator overrides a data point’s value. the data concentrator may choose to not respond until the first data update from the reporting device. Setting the CHATTER_FILTER. The data objects may optionally be initialized with the ONLINE and LOCAL_FORCED flags set as outlined above. it shall set the RESTART flag and clear all other flags for all database points. When the data concentrator undergoes a cold start. Other attributes of a specific variation requested by a master (for example: 16-bit or 32-bit data) must be observed by the outstation when responding. the outstation may respond with a different variation (with or without flags) as appropriate according to the condition stated above. Variations 1 and 2) as shown in the Data Object Library should include the LOCAL_FORCED flag. Affected Documentation: DNP V3. Specific Object Changes The Analog Output Status Object (Object 40.00 Data Object Library Chapter 3 Binary Input Object Definitions Chapter 4 Binary Output Object Definitions Chapter 5 Counter Object Definitions Chapter 6 Analog Input Object Definitions Chapter 7 Analog Output Object Definitions Chapter 13 Alternate Numeric Object Definitions Changes to the Subset Level 1 and 2 Certification Procedures: None Last Updated: 11 June 2003 Status: Protocol clarification: For immediate release. DNP Technical Bulletin 2003-002 Object Flags Page 8 of 8 11 June 2003 . which was omitted from the original definitions.Note that the sending device may determine if flags should or should not be sent for objects having variations with or without flags. Even if the master device requests a specific variation of an object. troubleshooting or maintaining a device on a dedicated communication channel such as a telephone line or a hardwired serial line. and the “self-address” feature is supported and enabled. 0xFFF0-FFFC for future use. it shall respond normally with its own source address instead of 0xFFFC.DNP Technical Bulletin 2003-003 Self-Address Reservation Issue: Under most circumstances. 11 November 2003 1 of 2 TB2003-003. Support for the “self-address” is optional and may be limited by device configuration or design. An exception to this is the predefined “all stations” or broadcast address. When commissioning. but until now has not been defined for DNP. it is desirable to be able to communicate with the device without a need to know its predefined address. it may be desired to prevent the “self-address” from being used for security reasons. Technical Bulletin 9912-003 expands this functionality to two other addresses. 0xFFFF. 0xFFFE and 0xFFFD. Resolution: Address 0xFFFC shall be reserved as a “self” communication address. If used on a shared communication channel. DNP requires an exact address match between an address configured in a target device and the destination address in a received DNP frame. A device may be programmed or configured to respond to this address as if the address matched the device’s unique communication address. If a device supports self-address. the concept of a predefined “self-address” is commonly used for this purpose. which devices must receive and respond to in a limited way. it could cause disruption of all communication on the channel. Security issues are associated with the use of such an address. Support for the “self-address” must be specified in the device conformance document. It must be possible to disable the feature if supported. Self-Address . The purpose of this bulletin is to reserve address 0xFFFC as the “self-address” to which a device may respond. In other protocols. it must provide a means to disable this feature. If a device receives a message with a destination address of 0xFFFC. which provide more explicit control over the handling of confirmations and the clearing of broadcast-related internal indication bits. 9912-003 also reserved the additional 13 addresses. This implies an environment in which the destination address is used to distinguish the desired device from other possible targets. Even on a dedicated line such as a dialup telephone line. determine if self-address is supported. Level 1 and Level 2 Certification Procedures Changes to the Subset Level 1 and 2 Certification Procedures Insert additional Procedure: Section # 6. Reconfigure the device to disable the self-address feature. to device address 0xFFFC. The device must respond with its own unique address as the source address and not 0xFFFC. If it is not supported. 6. skip this test. 2. From the device conformance document. 3.5 Self-Address Support 1. Self-Address .3. 8. Repeat steps 3 and 4. Verify that no response is generated.6. Verify that a valid response is received. Cycle the power to the DUT.Affected Documentation: Basic Four Document Set. 11 November 2003 2 of 2 TB2003-003. Issue a request for Class 0 data (Object group 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Device Profile Document. 4. Configure the device to support self-address. 5. 7. g. so that if they are not installed. irrespective of whether all these Point Indices are actually transmitted. This identifies the device reporting the data. analog inputs. Within a device. Gaps in the Point Index range are permissible.: binary inputs.DNP3 Technical Bulletin 2003-004 Point Index Ranges Issue: The intended assignment of Point Index values in DNP3 is not clearly stated in the protocol documentation. but some may be “absent”. The design aim is to assume that all objects in the Point Index range (from zero to the maximum installed Point Index) always exist in the device.). but should be avoided wherever possible. DNP3 models data objects as being members of “Object Groups”. binary outputs. • • • • The Device Address appears as the “Source Address” of all data responses. and is identified by its index in the array. Background: The DNP3 Protocol identifies individual data objects by the combination of Device Address. Page 1 of 2 DNP3 Technical Bulletin 2003-004 Point Index Ranges December 17. Some devices have not allocated Point Index values in the manner that permits the protocol to be used as efficiently as possible.e. DNP3 message transmission efficiency (particularly in static data responses) is maximized if the data objects in the Object Group are assigned a single contiguous range of Point Index values beginning at zero. This document clarifies the intended Point Index allocation strategy and outlines the departures from that strategy that are considered acceptable. where it may be installed or uninstalled without altering the Point Index values of the remainder of the objects in that Object Group). In some devices. each containing a single type of data object (e. • • Resolution: The assignment of Point Indices to objects should be performed in accordance with the following recommendations: • • The objects of each Object Group should be assigned a contiguous range of Point Index values beginning at zero. Each individual data point is an element of this array. Consider assigning the “optional” objects to the largest Point Index values. the remaining objects still form a group having a contiguous Point Index range with zero being the lowest Point Index value. For example: the Point Index does not imply any application-specific ordering or prioritization of objects. An example of an acceptable gap might be where an object is optional (i. Assume that memory and database resources are required for each object in the Point Index range from zero to the highest installed Point Index. storage and access mechanisms are simplified or optimized if all array elements are assigned the contiguous range of Point Indices from zero to one less than the number of objects in the array. called the Point Index. 2003 • . The Point Index value has no purpose other than to identify an array element. Object Group and Point Index. etc. Each Object Group is modeled as a separate one-dimensional array of objects. The Point Index range for accessing each array is an unsigned integer starting at zero for the first element of the array. each having a different device address. 2003 . Point Indices are not intended (and should not be used) for grouping data or implying some relationship between data points. if the objects are not installed. 1. 201. 202). 100. 102.• It is not acceptable to assign Point Indices in a sparse manner (e. Page 2 of 2 DNP3 Technical Bulletin 2003-004 Point Index Ranges December 17.g. 2. 101.: 0. that “virtual device” exists. This removes the possibility of introducing gaps in the Point Index ranges when optional objects are installed or uninstalled. the “virtual device” does not exist. Consider assigning sets of “optional” objects to one or more “virtual devices”. 2003 Status: Protocol clarification: For immediate release. • Affected Documentation: None Changes to the Subset Level 1 and 2 Certification Procedures: None Last Updated: December 17. If the objects are installed. 200. DNP3 Technical Bulletin TB-2002-001: Counter Objects September 18. 2002 Version 1 18-September-2002 TB-2002-001:Counter Objects . This operation can be requested via DNP3 protocol communications. However. After the maximum value that can be encoded for reporting is reached. Counts can be hardware generated by external transitions or pulses. A Frozen Counter Event is generated at every freeze operation. Frozen Counter values are recorded when a device processes a Freeze or Freeze-and-Clear operation. A read request for a Binary Counter returns the value of the underlying accumulation at the instance in time when the read is received. Binary Counter Event values are returned using DNP3 object 22. A Binary Counter Event is generated when the total number of accumulated counts has reached an “interesting” value. Rules applying to devices that support more than one Counter object are discussed later. Binary Counter values are returned using DNP3 object 20. an event might be declared when the value has exceeded a threshold. Devices may elect which objects to support. Object 22 Frozen Counter Events. variations. and flags Application confirm service recommendations Counter Definitions A Counter is an input point type whose value represents an accumulated value. and Frozen Counter Events. for all supported points. Counters are also referred to. Object 21 Binary Counter Events. 5. as compared against the most recent Binary Counter value successfully reported to the host. the value resets to zero and continues counting. whether or not the frozen value has changed. 4. Frozen Counters. Object 20 Static Frozen Counters. 3. Frozen Counter values reflect the accumulated value of the Counter point at a given instant of time. Counter objects include: • • • • Static Binary Counters. Frozen Counter values remain unchanged until the next Freeze or Freeze-and-Clear operation. The Frozen Counter Event value is the same value as that stored into the 18-September-2002 TB-2002-001:Counter Objects . DNP3 protocol defines four objects for reporting values associated with physical Counter points: Binary Counters. as pulse accumulators.Overview This technical bulletin clarifies definition of and processing related to Binary and Frozen Counter objects. Frozen Counter values are returned using DNP3 object 21. or incremented under software control. 2. in other protocols. A Binary Counter Event value is the accumulated amount in the respective Binary Counter at the instant when the event is generated. For example. Accumulated counts cause the value of the corresponding Counter point to increase. Binary Counter Events. Definition of Binary and Frozen Counters objects Object support rules Explanation of Freeze and Freeze-and-Clear operations Definition of objects. the actual cause of a Binary Counter Event is a local implementation matter and not defined by DNP3. or by other software or hardware. Binary Counter values reflect the current (instantaneous) accumulated value of the Counter point. Object 23 Points presented in this technical bulletin include: 1. Thus: • Binary Counter events may be reported for a particular index only if the corresponding Binary Counter is reported in response to a Class 0 poll. C. If a Frozen Counter exists. its index must match that of the corresponding Binary Counter. device hardware or software may maintain other internal Counter-related values to facilitate calculation and reporting of Binary and Frozen Counter values. A. As a side note. and to support Counter Freeze operations. Frozen Counter Event values are returned using DNP3 object 22. • Frozen Counter events may be reported for a particular index only if the corresponding Frozen Counter is reported in response to a Class 0 poll. • It is permissible for only Binary Counters or only Frozen Counters to be reported in response to a Class 0 poll. A Frozen Counter MAY exist for each Binary Counter (but not necessarily). If the device is capable of reporting both values It MUST be configurable to disable this capability. The presence and meanings of any such auxiliary values is not a DNP3 protocol issue and is not discussed in this document. It is optionally permissible to report both running and frozen values. reporting must use qualifier codes allowed by the subset definition. Optionally be configured to return BOTH Frozen and Binary Counters for the same index in response to a class 0 request. Report the frozen value c. • A base DNP3 requirement is that events for a particular object may only be reported if the corresponding object appears in response to a Class 0 poll. but if this is available it must be possible to force the outstation to only report one or the other. Report the running value b. Devices that maintain Frozen Counter values in non-volatile memory and that continue accumulation during a loss-of-power condition may possibly maintain valid Frozen Counter values across a device restart operation. • If Binary Counter events and Frozen Counter events are to be reported for the same index. B. A Binary Counter MUST exist for every counter point. on a point by point basis. Counter Object Support Rules The decision whether to support binary or frozen counters in a particular device may be based on several factors. Where a counter is reported in response to a Class 0 request. Frozen Counter values may be undefined prior to processing the first freeze operation. Freeze Operations Frozen Counter values are recorded whenever a Freeze or Freeze-and-Clear operation occurs. Notes: • In the event of non-contiguous point ranges. • The intention is that it be possible to report either the Binary Counter value or the Frozen Counter value for each index in response to a Class 0 poll.Frozen Counter when the device processes a Freeze or Freeze-and-Clear operation. a device MUST either: a. then both Binary Counter and Frozen Counter for that index MUST appear in response to a Class 0 response. D. A device may configure Counter support in any manner consistent with the following rules. 18-September-2002 TB-2002-001:Counter Objects . When a device restarts. Frozen Counter events are generated at this time. Freeze operations directed to any other Counter object are not defined and are non-interoperable. the underlying Binary Counter value is reset to zero immediately after the frozen value is recorded. object 20. A device that does not support Frozen Counters should respond after setting the “Function Code Not Implemented” indication. Use of any other qualifier is not defined. It is important that no counts are lost between recording the frozen value and resetting the Binary Counter value to zero.535 (216 – 1). If supported. Objects. freeze operations must use the “all points” qualifier. based on the number of bits used to maintain the underlying Counter value. variation 0. The largest value for a 16-bit Counter is 65. Freeze and Freeze-and-Clear commands must be directed to the static Binary Counter object.A Freeze or Freeze-and-Clear operation causes the current Binary Counter value to be copied and recorded as the current Frozen Counter value. code 6. code 0 or 1. They are not discussed further in this document. Events should be generated for all points during the first freeze following a system restart. A null response includes all octets up to and including the two IIN octets. A Binary Counter value read after a Freeze-and-Clear operation must return a value representing the number of counts occurring subsequent to the Freeze-and-Clear. A Frozen Counter value re-frozen after an initial Freeze-and-Clear operation must return a value representing the number of counts occurring between the two freeze operations. Subset level 3 devices allow freeze operations to specific point ranges using a start/stop qualifier. The null response is always sent in cases where a response message is warranted. A “normal/acknowledge” function sent to a global destination address (0xFFF0 to 0xFFFF) should be processed as if a corresponding “no acknowledgement” function was received.no acknowledgement (12) The only difference between “normal/acknowledge” and “no acknowledgment” cases is whether or not a device transmits a response after performing or queuing the requested action. Note that counts may be lost if a second Freeze-and-Clear command is issued before values from a prior Freeze-and-Clear command are read. Each count causes the value to increase by one. DNP defines six freeze related function codes: • • • • • • Immediate Freeze (7) Immediate Freeze – no acknowledgement (8) Freeze and Clear (9) Freeze and Clear – no acknowledgement (10) Freeze with Time (11) Freeze with Time . The two “Freeze with Time” functions are defined in the protocol but not required by any of the DNP subset levels. Devices that cannot conform to this rule must respond to a Freezeand-Clear request with a Null response setting the “Function Code Not Implemented” Internal Indication. A Freeze to object 20 creates Frozen Counter values in Object 21 and Frozen Counter events in object 23. and Flags Object Values A device may maintain Counters as 16-bit or 32-bit values. The wrap value can be any number up to and including the largest value that can be encoded. For a Freeze-and-Clear operation. wrapping at the highest number supported by the device. Devices that support Frozen Counters must support both Immediate Freeze and Freeze and Clear commands. to simultaneously freeze all Counters. The largest value for 18-September-2002 TB-2002-001:Counter Objects . even for devices that do not provide point data in response to a read for this object. Variations. For Subset Level 1 and 2 devices. DNP3 also supports both 16-bit and 32-bit variations for reporting Counter object values. if present. if the flag octet is missing. The value is transmitted after the flag octet. The variation numbers used for reporting Delta Counters remain as placeholders so that all of the other variation numbers stay the same. although not all are present in every case. either a 16-bit or 32-bit variation. If a device is asked for a 32-bit variation but maintains 16 bits or less. Within each communication message. Binary values are defined for Binary Counter and Binary Counter Event objects. but may not configure one as the default reporting variation. The time stamp. follows the value. the value is the last component transmitted. A summary is presented in this document. simply stated. the flag octet. refers to a point value calculated as the difference between underlying values obtained at two separate times. 18-September-2002 TB-2002-001:Counter Objects . If a 16-bit default is used. is transmitted first. A device that maintains 32-bit Counters may select. A null-response is not valid for any explicit request for a 16-bit variation if a null-response is not also transmitted in response to an explicit request for the corresponding 32-bit variation. Variation Structures A detailed description of each variation used to report Counter values can be found in the DNP3 Data Object Library section of the Basic 4.294. but because of many underlying problems they were declared obsolete as of 12-October-2001. or.967. Regardless of the default variation selected. It is strongly recommended that counters wrap at one of these maximum values. Devices that support only Delta Counter variations are not compliant with any DNP3 subset. For variations with no time stamp. Devices may continue to support Delta Counters variations. if present. is transmitted first. The DNP3 User’s Group recommends that Delta Counters not be implemented within a device. only the low 16-bits of the 32-bit value are reported.295 (232 – 1). devices that support 32-bit Counter values must respond to an explicit request for a 16-bit variation with data for all requested points. Frozen values are defined for Frozen Counter and Frozen Counter Event objects. as a default.A Delta Counter value. DNP3 documentation does not define how Delta Counters are maintained or how they should be reported. DNP3 previously defined a third reporting form.a 32-bit Counter is 4. DNP3 defines two forms for reporting Counter values: Binary and Frozen. • • • 8-bit flag octet 16-bit or 32-bit value 48-bit time stamp Only the value is present in all variations. it is recommended that the device respond by setting bit 1 of Internal Indication octet 2 (requested object unknown). Counter variations include the following components. Delta Counters. 16 or 32 bits Time stamp (applicable variations) b47 The next table lists variations for each Counter object. Different rules 18-September-2002 TB-2002-001:Counter Objects . represents the time the freeze operation was processed The flag octet is a set of one-bit indications. Each flag has a normal and an abnormal state. its normal state. The next table shows each flag. represents the time the event was recorded • For Frozen Counter Event objects. and rules for declaring an abnormal state.The basic format of all variations for all Counter objects can be diagrammed as follows: 7 0 b15 or b31 b0 6 DC 5 RL 4 LF 3 RF 2 CL 1 RS 0 OL ← bit position Flag octet (applicable variations) b0 Value. is available. indicating which contain flag and time stamp components. each describing something about the associated Counter point. and describing the form of the value component. a valid Counter point value. An abnormal state in one or more flags indicates a nonstandard condition such as the value has been obtained from an alternate source or is not available. When all flags are in the normal state. obtained from its normal source. Binary Counter Object Variations Value Obj Var Flag Time Size Type 20 1 32 Binary Static 2 16 Yes 3 32 Delta 4 16 No 5 32 Binary 6 16 No 7 32 Delta 8 16 Frozen Counter Object Variations Obj Var Flag Time Value Size Type 1 32 21 Frozen Static 2 16 No 3 32 Delta 4 16 Yes 5 32 Frozen 6 16 Yes 7 32 Delta 8 16 9 32 Frozen 10 16 No No 11 32 Delta 12 16 23 Event 1 2 3 4 5 6 7 8 32 16 32 16 32 16 32 16 Frozen No Delta Yes Frozen Yes Delta 22 Event 1 2 3 4 5 6 7 8 32 16 32 16 32 16 32 16 Binary No Delta Yes Binary Yes Delta The time stamp: • For Binary Counter Event objects. apply based on the source of the Counter value. SCADA Master Non-originating point Originating point Counter object Counter object Calculate Hardware Input detection Input terminal Communication channel(s) Counter object Calculate Hardware Input detection Originating device Input terminal Non-originating devices may be several levels deep. A “non-originating device” is a one that gathers Counter data from communication to a lowerlevel device. and a non-originating device for another. All devices except the one in direct control of the physical input are considered non-originating devices. One of two possible sources is indicated by the terms “originating device” and “non-originating device”. and one non-originating device. The following diagram illustrates a topology with a single point. The originating/non-originating designation is made on a point-by-point basis. one originating device. A non-originating 18-September-2002 TB-2002-001:Counter Objects . either under software control or using hardware. • • An “originating device” is one that gathers or calculates the Counter data directly. a single Counter may be transmitted from its physical input location through several devices before arriving at the final destination. That is. A device can be an originating device for one point. device calculates abnormal flag state conditions based on the best information available. Reset otherwise. for an explanation of these flags Reset DC Discontinuity Reset Definition: Counter value has exceeded its maximum and rolled over to zero. Confirm service is required in event reporting. Section 6. Data Object Library. Application Confirm Services Counters should be treated like any other DNP3 input point object. Originating Device: Set on first successful transmission to host after physical rollover occurs. Hence it is highly recommended that slave devices do not set the Rollover flag and that host devices ignore the Rollover flag. Reset:0) Flag OL RS CL LF RF RL Name On-line Restart Communication Lost Local Forced Data Remote Forced Data Rollover Description Please refer to the DNP3 Basic 4 Documentation Set. Non-originating device: Set when DC flag is set in the lower device. including analysis of flag information received from the lower device. Non-originating device: There is no general mechanism within DNP3 for a outstation device to report the value at which Counter rollover occurs. Data Object Library. Last Updated: 18-September-2002 18-September-2002 TB-2002-001:Counter Objects . Reset after a new value has been acquired and transmitted to the host. Changes • • Affected Documentation: DNP3 Basic 4 Documentation Set. Normal State (Set:1. Reset after a new value has been acquired and transmitted to the host. Definition: Current value cannot be compared against prior value to obtain “total counts” Originating device: Set when Counter value is reinitialized. 3. Request not accepted. 2 Resolution: 2. (An operate message was sent to activate an output that was not previously armed with a matching select message. provision exists for sending messages with multiple analog output objects. in the same request.1 Response Status Codes New status codes 7. or direct operate). of type object 12 and variation 1. do not adequately describe all the error conditions. Likewise. Request not accepted because no previous matching select request exists. Many DNP3 slaves are able to queue or simultaneously output these objects. and additional codes are needed.) Request not accepted because there were formatting errors in the control request (either select.1 Master Requirements Select-Operate If a master receives a response to a select request. initiated. Code Number 0 1 2 3 4 5 6 7 8 9 10 to 126 127 Identifier Name SUCCESS TIMEOUT NO_SELECT FORMAT_ERROR NOT_SUPPORTED ALREADY_ACTIVE HARDWARE_ERROR LOCAL TOO_MANY_OPS NOT_AUTHORIZED RESERVED UNDEFINED Description Request accepted. Request not accepted because of some other undefined reason. in the same message to a slave. The arm timer was started when the select operation for the same point was received.DNP Technical Bulletin TB2001-001 Multiple Control Objects and Status Codes 1 Issues: The DNP3 protocol permits a master to transmit a request containing multiple control objects. Request not accepted because of control hardware problems. The DNP3 Level 3 Implementation table. Qualifier codes 17 and 28 should be replaced with code 07. However. When a DNP3 outstation detects an error in a control or analog output request. The complete list of codes appears in the following table. Request not accepted because the operate message was received after the arm timer timed out. function code 3. because the control queue is full or the point is already active. specifies an incorrect qualifier code for object 12. 1 through 6. and DNP Technical Bulletin TB2001-001 Multiple Control Objects and Status Codes Page 1 of 1 15-December-2000 . Request not accepted because a control operation is not supported for this point. The existing status codes. 9 and 127 are defined and all status codes now have short identifier names. other devices can only output to a limited number of points—possibly just a single point—and may not be able to process a request containing a greater number of objects. or queued. DNP3’s Basic 4 documentation does not clearly explain how a device should behave or respond to a request containing more output objects than the device permits. variation 2. operate. Request not accepted because Local/Remote Switch is in Local position. of type object 41 and any variation. Reserved for future use. it must return a non-zero status code. Request not accepted because too many operations requested. 2. Request not accepted because of insufficient authorization. paragraph 3.2 2. 8.2. it shall use a pattern control block and a pattern mask.2 Configurable If a master has the capability to send multiple objects (binary or analog) in a single control output request. variation 3). level 3 slave devices must be able to parse messages containing these. 2. 2. paragraph 3. variation 2 is 07. then it shall not issue the subsequent operate command. Pattern Mask Slave devices are not required to implement Pattern Control Blocks (object 12.5 Device Profile The Device Profile Document of each slave device shall contain a statement specifying the maximum number of objects supported in a single request for objects 12 and 41.1 and issues an illegal operate command.3. 2-2 and 2-4 shall be set or cleared as applicable. 2-2 or 2-4 are set. and if so. 2. Examples are presented in section 3. 2.3 2. respectively.3.3.• • • any of the objects contains a non-zero status. for object 12.2. operate or direct operate—and one or more of the objects are unsuccessful.2. This is a truncated response. variation 2) or Pattern Masks (object 12. The slave’s behavior is not guaranteed when a master violates this rule. All of the objects up to and including the first unsuccessful object. what restrictions exist.2. the slave may take one of the following actions: • • 2. Execute those objects for which it returned a zero status code.2 Illegal Master Requests If the master violates the rule in section 2. The IIN bits 2-0. function code 4.3 Pattern Mask If the master desires simultaneous execution of controls. it must be configurable to send only one object per message. Each object returned in the response shall contain the appropriate status code indication. object 12 variations 2 and 3.3.4 Pattern Control Block The correct qualifier code in the DNP3 Level 3 Implementation table. its response shall include one of these • • • No objects if the request contains an unsupported function code or object variation. 2-1.pattern control mask operations. When a slave receives a control or analog output request—select. 2. DNP Technical Bulletin TB2001-001 Multiple Control Objects and Status Codes Page 2 of 2 15-December-2000 . There is no guarantee that multiple controls will execute simultaneously unless a pattern control block and mask are used—and—the slave supports this type of operation. Note that the IIN bits only need to reflect the state of the first error detected.1 Slave Requirements Responses The slave has the option to stop parsing the remainder of a request upon detection of the first error or continuing to the end of the request. nevertheless. All of the objects. 2. any of the objects are missing from the response or any of the IIN bits 2-0. 2-1. It shall also include a statement indicating whether it supports pattern control block .3 Ignore the request and not operate any of the points. paragraph 3. operate. Variation 1: Add sections 2. Device Profile Document: In the section that begins with “Sends/Executes Control Operations: Add three lines beneath DIRECT OPERATE – ACK as follows: • • • • Maximum number of CROB (object 12. describe any restrictions. 0 1 2 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 2. Object 41. variation 1) objects supported in a single message ________. B. function code 3. Indexes for objects C and D are beyond the maximum number of points installed in the slave. CROB (object 12) and analog output (object 41) permitted together in a single message. An analog output is requested and the value in Object D’s request exceeds the permitted level. The function code is not supported regardless of which indexes the objects have. 2. 5 0 0 0 0 0 0 0 1 0 0 IIN Bits 2. function code 5.3 Examples The following table shows example responses from control or analog output requests containing four objects.3. If so. Basic 4 Object Library. variations 2 and 3. variation 2. all variations: Add sections 2.1. function code 4 or direct operate.1. Object 12. Level 3 Implementation: The qualifier codes are replaced by a single code of 07 in the implementation table.” DNP Technical Bulletin TB2001-001 Multiple Control Objects and Status Codes Page 3 of 3 15-December-2000 .1 Paragraph 8. These objects are identified as A. all objects successful. Maximum number of analog output (object 41. Basic 4 Subset Definitions. Replace the listing of error codes with the table in section 2. 4 0 0 0 0 1 0 0 0 0 0 4 Affected Documentation: Basic 4 Object Library. any variation) objects supported in a single message ________.3 and 2. Obj A 0 NR NR 0 0 0 0 0 0 0 0 7 7 0 0 Status Codes Obj Obj B C 0 0 NR NR 0 0 5 5 8 8 0 0 0 NR 0 0 NR NR 4 4 0 NR 8 NR 9 9 7 NR 0 0 Obj D 0 NR NR 4 NR 0 NR 8 NR 0 NR 7 NR 3 3 1. C and D. Object B is already executing when this request arrives.3 and 2.1 – Desired Behavior in both certification procedures Change third bullet under device supports control operations to read. Key: NR means Not Reported.2. 5 Changes to the Subset Level 1 and 2 Certification Procedures: 5. 2. A control output is requested and the Control Relay Output Block in Object D’s request contains an illegal control code. for object 12.2 from above to the “Description”. The responses are identical regardless of whether the requests are select. The slave does not support the specific variation code in the request. The slave can only control one object at a time.2 from above to the “Narrative”. Basic 4 Subsets Definitions. Response Conditions in slave when Request is received No errors are detected. Object C is tagged or blocked to prevent its control. Pattern Control Block and Pattern Mask (object 12. “The DUT responds to selecting an uninstalled control point by returning an error response with IIN2-2 set and a status code of 4. The Remote/Local Switch is in the Local position. Appendix A. respectively) supported. 2. “The DUT responds to a direct operate to an uninstalled control point by returning an error response with IIN2-2 set and a status code of 4.5.3 Paragraph 8.2.1.1 – Desired Behavior in both certification procedures Change first bullet under device supports control operations to read. Note that controls may execute simultaneously or sequentially one after the other.2 – Test Procedure in both certification procedures Review the device’s profile document to understand how many control points are supported in a single request. Variation 1 and 16-bit indexing (qualifier 0x28). or IIN2-2 set and that each object returns a status code of 0. If the number of control objects supported in a single request is greater than or equal to either • • 8. issue a select to at least one more point than is supported in a single request. or IIN2-2 set and that each object returns a status code of 0. a control code supported by the device. 3. Verify that the DUT response has none of IIN2-0.2 Paragraph 8. skip to step 7.3. each point having a different index but otherwise able to be controlled. skip to step 13. step 2 – Test Procedure in both certification procedures Change to read. “The DUT responds to requests having more points than are supported in a single message with a status code of 8 for at least the first point that is beyond the point count limit.4.4 Paragraph 8. “Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4. 6. Immediately issue a matching execute. add a statement that says.” 5. 7. 2. “The DUT responds to a select to an uninstalled control point by returning an error response with IIN2-2 set and a status code of 4.4.2. and an appropriate on time/off time.2. This number shall be the smaller of • • • The number of controls supported in a single request The number of installed control points Sixteen Replace items 1 through 6 as follows: In a single request. Page 4 of 4 15-December-2000 DNP Technical Bulletin TB2001-001 Multiple Control Objects and Status Codes .1 – Desired Behavior in both certification procedures After the second bullet. IIN2-1. The number of control objects that fit into a single frame or The number of installed control points.” 5. In a single request. Paragraph 8.2. using Object 12. and an appropriate on time/off time. IIN2-1.2. “Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4.2.2.5 Paragraph 8.6 1. Variation 1 and 16-bit indexing (qualifier 0x28).2. a control code supported by the device.” Add a second bullet below the new statement that says. 5.” 5. issue a select to the above number of points using Object 12. Verify that each of the selected controls operated. Determine the number of installed points that can be successfully controlled in a single request.” 5. 4. step 2 – Test Procedure in both certification procedures Change to read.2. Verify that the DUT response has none of IIN2-0. “The following behavior assumes that the device supports control operations:” Add a bullet below the new statement that says. If this number is one. 4.4.4.9 Paragraph 8.1.2.” 5. If the DUT does not support direct operate. step 2 – Test Procedure in both certification procedures Change to read. and the last object returns a status code of 8. that the status code returned for the installed point is 0 and the status code returned for the non-installed point is 4. skip to step 13.” 5. Variation 1 and 16-bit indexing (qualifier 0x28). Variation 1 and 16-bit indexing (qualifier 0x28).12 1. “The DUT responds to a direct operate to an uninstalled analog output point by returning an error response with IIN2-2 set and a status code of 4.9. 14.” 5.4. that each object except the last returns a status code of 0. 11. Verify that all except the last control point operated. IIN2-1. a control code supported by the device.2. The installed point should be the first object in the request. 10.1 – Desired Behavior in both certification procedures Change second bullet under device supports analog output operations to read. and an appropriate on time/off time. Determine the number of installed points that can be successfully controlled in a single request. skip to step 7. that each object except the last returns a status code of 0 and the last object returns a status code of 8. issue a select to one installed control point and to one point that is not installed using Object 12. and an appropriate on time/off time.7 Paragraph 8. 2.1 . add a statement that says. In a single request.2.” Add a second bullet below the new statement that says. “Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4.3. If this number is one. Verify that the DUT response has IIN2-2 bit set.” 5. 5.8 Paragraph 8.1. Paragraph 8. 13.2.” 5.4.4.4.1 – Desired Behavior in both certification procedures After the second bullet. a control code supported by the device. “The DUT responds to requests having more points than are supported in a single message with a status code of 8 for at least the first point that is beyond the point count limit.2 – Test Procedure in both certification procedures Review the device’s profile document to understand how many analog output points are supported in a single request. step 2 – Test Procedure in both certification procedures Change to read. Verify that the DUT response has none of IIN2-0. In a single request. “The DUT responds to selecting an uninstalled analog output point by returning an error response with IIN2-2 set and a status code of 4. or IIN2-2 set. “Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4.10 Paragraph 8.2. Verify that the DUT response has none of IIN2-0.Desired Behavior in both certification procedures Change third bullet under device supports analog output operations to read. IIN2-1.11 Paragraph 8. issue a direct operate command to at least one more point than is supported in a single request.4. or IIN2-2 set. each point having a different index but otherwise able to be controlled. “The following behavior assumes that the device supports analog output operations:” Add a bullet below the new statement that says. 12. “The DUT responds to a select to an uninstalled analog output point by returning an error response with IIN2-2 set and a status code of 4. This number shall be the smaller of • • The number of controls supported in a single request The number of installed control points Page 5 of 5 15-December-2000 Replace items 1 through 5 as follows: DNP Technical Bulletin TB2001-001 Multiple Control Objects and Status Codes . using Object 12. using Object 41. 11. IIN2-1. If the DUT does not support direct operate. Verify that the DUT response has IIN2-2 bit set. The number of control objects that fit into a single frame or The number of installed control points. In a single request. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. 13. In a single request. or IIN2-2 set and that each object returns a status code of 0. Verify that the DUT response has none of IIN2-0. 6. each point having a different index but otherwise able to be outputted. Verify that the DUT response has none of IIN2-0. Immediately issue a matching execute. issue a select to one installed analog output point and to one point that is not installed using Object 41. Verify that all except the last analog output point outputted the new value(s). 10. IIN2-1. 7. Verify that the DUT response has none of IIN2-0. 6 Status: Approval Technical Committee (Feb-2001). 9. that each object except the last returns a status code of 0. skip to step 13. and a value supported by the device 3. In a single request. issue a select to at least one more point than is supported in a single request. If the number of control objects supported in a single request is greater than or equal to either • • 8. skip to step 13. Verify that each of the selected analog outputs occurred. Verify that the DUT response has none of IIN2-0. using Object 41. IIN2-1. 12. 4. or IIN2-2 set and that each object returns a status code of 0. that each object except the last returns a status code of 0 and the last object returns a status code of 8. a control code supported by the device. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. Variation 2 and 16-bit indexing (qualifier 0x28). that the status code returned for the installed point is 0 and the status code returned for the non-installed point is 4. or IIN2-2 set. and the last object returns a status code of 8. The installed point should be the first object in the request. 14. IIN2-1. 5. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. or IIN2-2 set.• Sixteen In a single request. issue a select to the above number of points using Object 41. each point having a different index but otherwise able to be outputted. DNP Technical Bulletin TB2001-001 Multiple Control Objects and Status Codes Page 6 of 6 15-December-2000 . . issue a direct operate command to at least one more point than is supported in a single request. Note outputs may occur simultaneously or sequentially one after the other. Graduated features/complexity (by implementing additional objects). Some of the following descriptions refer to timeout mechanisms used when handling file operations. FIFO and other types of dynamic files may be transferred using the sequential file transfer mechanisms described in this bulletin. it is a requirement that an application confirm be requested by the outstation when sending file status events. the first octet following the object header. not random file access. the dynamic file may be modified as the device so chooses. All Status objects defined herein are treated as events when sent from an outstation in a response. random access file support. Bandwidth management by limiting block sizes and allowing requested objects to be treated as events that can appear an arbitrary period after they were originally requested.DNP Technical Bulletin 2000-001 Sequential File Transfer Objects 1 Introduction The following document provides a replacement implementation for DNP File Transfer as described in the Basic 4 document set. While this bulletin addresses sequential file transfer only. a dynamic file must be treated as a static file during the time between opening the file and the corresponding file Close or Abort. The following functionality is provided: • • • • Simple reliable transfer of bulk data either up or down the communications chain. the communication processing that is responsible for the delivery of the events (eg. Legacy implementations of Object 70 Variation 1 cannot be relied upon to provide consistent implementation or interoperable file transfer capability. Straightforward implementation. It should be noted that file handling timeouts and the generation of file status events is independent of communication handling timeouts. through polling or unsolicited reporting) and collection of confirms is independent of the generation of the event. This bulletin is intended to address sequential file transfer only. All data shown in examples is expressed in Decimal unless preceded by 0x indicating Hexadecimal. As is the case for generation of any DNP event. This bulletin describes replacement objects and methods that should be used instead of the existing Object 70 Variation 1. i. and may be returned an arbitrary period after requested. will be supported in the future through the specification of additional objects. The following notes apply to all sections of the document Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 1 . As is the case when any DNP event is sent from an outstation. However. and other file access techniques.e. 2 • • • • • Notes All String offsets are relative to the start of the object. After the file is closed. Function Code 25 26 27 28 29 30 Table 1 Description Open a File Close a File Delete a File Get File Info Authenticate Abort 4 Authentication Devices that do not support authentication must not support this object. The Password Offset field is a 16 bit parameter which specifies the zero-based start of the password octets relative to the start of the object excluding the header. An Authentication Key is required to perform an Open or Delete command as described in the next section. Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 2 . Before proceeding with secure transactions the application must obtain an Authentication Key from the end device. A new object is defined to support the process as follows. It expires as soon as it is used. Table 2 Object Header Object 70 Variation 2 Qualifier 0x5B Range Field (=1) Number of Octets in object b7 b7 b7 b7 b15 b0 b0 b0 b0 b0 b15 b15 b15 b15 b31 bn bn Authentication Object Format User Name Offset User Name Size Password Offset Password Size Authentication Key User Name Octets Password Octets b0 b0 b0 b0 b0 b0 b0 The User Name Offset field is a 16 bit parameter which specifies the zero-based start of the name octets relative to the start of the object excluding the header.3 Application Layer Function Codes Additional application layer function codes are added to support authentication and file specific operations. They are defined as follows. The User Name Size field is a 16 bit parameter which specifies the number of name octets. Password Octets are the octets of the password. Delete and Abort. Delete and Abort functionality two objects are defined: The File Command Object (obj 70 var 3). Issuing an authentication request to the Authentication Object (obj 70 var 2) generates an Authentication Key. Close. The Authentication Key field is not used in the request and must be zero. For example. the response will contain a zero value for the Authentication Key. A unique Authentication Key may be obtained for each username via a separate authentication request. The outstation responds with 0xC0 129 IINs 70 02 0x5B 01 nn nn … (object data) The response contains the newly generated Authentication Key in the Authentication Key field and for security purposes the user name and password fields are null. The application can then use this key for exactly one secure transaction. The outstation responds with a pseudo random Authentication Key. This is acceptable if and only if the end device is permissive and allows it. Open and Delete are secure transactions. An application can issue secure transaction requests using a zero value Authentication Key. Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 3 . The File Command Object is used to initiate Open or Delete operations. A user name and password are passed to the outstation in the request. The Authentication Key field is a 32 bit number that is maintained by the outstation and uniquely specifies the permissions granted by the authentication process. If authentication fails. This technique also allows a mechanism for using secure dialogs without performing the authentication step.The Password Size field is a 16 bit parameter which specifies the number of Password octets. It is possible for there to be a set of user names and passwords that have different permissions. The outstation maintains the relationship between the key and the permitted transactions. A valid Authentication Key is required to successfully perform these transactions and expires as soon as it is used. Close. 5 Open. and the File Command Status Object (obj 70 var 4). User Name Octets are the octets of the user name. To retrieve an Authentication Key the host issues an authentication request to the authentication object as follows 0xC0 29 70 02 0x5B 01 nn nn … (object data) The object data includes the user name and password to be authenticated. if the end device provides user authentication it could permit reading of some files but exclude writing and deleting files. A zero value for the Authentication Key implies world (or guest) permissions. Using the Offset and Size technique effectively provides a jump-table to the strings included in the object definition. which implies world (or guest) permissions. It is up to the end device to interpret how to handle this. To support the Open. Delete and Abort commands and to return a file handle during opens. It is also used to initiate a file close or abort using a previously acquired file handle. The Permissions field is a 16 bit parameter whose value is defined in Table 4. Close. The Time of Creation field is a 48 bit parameter that represents the DNP time of creation of the file represented as the number of milliseconds since midnight January 1. The File Name Size field is a 16 bit parameter which specifies the number of file name octets. A value of zero in this field indicates that the time of creation of the file is unknown. The details of these objects are described in subsequent sections. The file name offset and file name size fields form a jump-table allowing direct access to the file name string at the end of the object. Table 3 Object Header Object 70 Variation 3 Qualifier 0x5B Range Field (=1) Number of Octets in object b7 b7 B7 b7 b15 b0 b0 b0 b0 b0 b15 b15 b47 b15 b31 b31 b15 b15 b15 bn File Command Object Format File Name Offset File Name Size Time of Creation Permissions Authentication Key File Size Operational Mode Maximum Block Size Request ID File Name Octets b0 b0 b0 b0 b0 b0 b0 b0 b0 b0 The File Name Offset field is a 16 bit parameter which specifies the zero-based start of the file name octets relative to the start of the object excluding the header.The File Command Status Object is used to indicate the success of Open. Offset is relative to the beginning of the object (zero based) excluding the header. Table 4 Permission Sequential File Transfer Objects 26 January 2000 Bit Fields DNP Technical Bulletin 2000-001 Page 4 . 1970. 5. It is defined as follows.1 File Command Object The File Command Object (obj 70 var 3) is used to facilitate file opens and deletes. The File Size field is a 32 bit parameter representing the number of octets contained in the file. The use of this field is optional. Otherwise the Time of Creation and Permissions fields must be zero when using this object. During an open for read the file size must be zero and is ignored by the outstation. This is particularly important when opening a file so that both ends have the opportunity to allocate adequate buffers. A file size of 0xffffffff is allowed and indicates that the actual file size is unknown. It is not used with the delete function.g. If the file is opened for writing. During an open for write the outstation may prepare its buffers appropriately.Owner Read Allowed: Owner Write Allowed: Owner Execute Allowed: Group Read Allowed: Group Write Allowed: Group Execute Allowed: World Read Allowed: World Write Allowed: World Execute Allowed: 0x0100 0x0080 0x0040 0x0020 0x0010 0x0008 0x0004 0x0002 0x0001 The Permissions field contains a UNIX-style file access permission bit field. the Time of Creation and Permissions fields of the File Command Object (obj 70 var 3) shall be used as attributes for the new file. before the expected File Size is satisfied (by receiving the Last Flag in the File Transport Object – see Section 6. if the received file exceeds the expected File Size. Its use is allowable only when the value is truly not known. and inhibited if the bit is clear (e. However. Devices may update any of these fields in response to Read or Info requests if they can provide correct values for these fields. Values for this field are defined as shown in the following table. Mode Value 0x00 0x01 0x02 0x03 Table 5 Description Null Read Write Append (Not required to be supported in a minimum implementation) DNP Technical Bulletin 2000-001 Page 5 Sequential File Transfer Objects 26 January 2000 . Devices may reject any request that exceeds the device’s resource limits. The key is obtained by issuing an Authentication Request (Function code 29) to the Authentication Object (obj 70 var 2) (see section 4). guest or world permissions in various file systems. The Operational Mode field is a 16 bit parameter denoting the mode a file should be opened in.2).: set Permission to 0x1FF to indicate no restrictions). If end of file is indicated to a device receiving a file. A value of 0 in this field indicates a permissive access level analogous to anonymous. In such a case the two devices will not inter-operate. the receiving device shall treat the file as completely received and shall not consider this to be an error condition. nor with function codes not requiring a file open (and must be zero in those cases). The relevant action is permitted if the bit is set. The Authentication Key field is a 32 bit parameter that facilitates secure transaction authentication. Devices that do not support authentication must ignore this field. the receiving device may treat this an error and reject the transfer. Devices are not required to accept an unknown file size. The File Size field is a 32 bit parameter that is used to return the file size when a file has been opened for read. For Write Operations it specifies the maximum number of octets that will be sent in a write request block. The value of this field is undefined in all other cases and must be zero. when Operational Mode 0x01 is used in the File Command Object (obj 70 var 3). Table 6 Object Header Object 70 Variation 4 Qualifier 0x5B Range Field (=1) Number of Octets in object b7 b7 b7 b7 b15 b0 b0 b0 b0 b0 b31 b31 b15 b15 b7 bx File Command Status Object Format File Handle File Size Maximum Block Size Request ID Status Optional ASCII Characters b0 b0 b0 b0 b0 b0 The File Handle field is a 32 bit parameter that provides a numeric identifier of the file opened. When files are opened they are assigned a unique file handle that is used to reference the file during future operations. They fully reference the file (including path within the device). For Read Operations it specifies the maximum number of octets an outstation is allowed to return in a file block.The Maximum Block Size field is a 16 bit parameter. Close. 5. issue a Close command (function code 26) using the File Command Status Object (obj 70 var 4) with the appropriate file handle. Other operations will reference this identifier. Delete and Abort commands.e. in response to a read request. Its value is arbitrary and provided by the end device but must be unique to the outstation DNP address. It can also be used as an Error response for a Get File Info command. and to abort a file transfer in progress. to facilitate closing a previously opened file. The outstation device must remember this value and copy it into the Request ID field of the corresponding response.2 File Command Status Object The File Command Status Object (obj 70 var 4) is used as a response to Open. Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 6 . This permits the host to correlate responses with their requests when multiple files are simultaneously opened in the same device. To Close a previously opened file. i. The Request ID field is a 16-bit parameter whose value is arbitrarily assigned by the host and sent in a request. File Name Octets are the octets of the file name. It can be reused after a corresponding close is issued. The values for this field are defined in Table 7. or 3. size. in response to a read request. For Write Operations it specifies the maximum number of octets that will be accepted by the outstation in a write request block. 5. File is closed and unusable. It is also acceptable to return it in the response to a request if the results are immediately known. Abort or Delete command. permissions and Authentication Key as follows 0xC0 25 70 03 0x5B 01 nn nn … (object data) Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 7 . This value should be less than or equal to the value set in the Maximum Block Size field of the File Command Object. block size. so that it can be either polled for specifically or assigned to class 1. Optional ASCII Characters may be appended to the object after the status code. It must be returned in each File Command Status Object as the value of the Request ID field specified in the File Command Object or File Descriptor Object for the corresponding file request. Note: The File Command Status Object (obj 70 var 4) is treated as an event when it is generated after an Open. The Request ID field is a 16 bit parameter. For Read Operations it specifies the maximum number of octets that the outstation will return in a file block.3 Opening a File To open a file issue an Open command (function code 25) to the File Command Object (obj 70 var 3) passing the correct file name. Any error not listed above (optional ASCII string may provide additional information) Note: A minimal implementation may restrict the number of open files to one. Table 7 Value of Status Field 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A – 0x0F 0xFF Name Operation Completed Successfully Permission Denied Invalid Mode File not found File locked by another user Open File Count Exceeded File Handle Invalid Requested block size not supported for writes Lost Communications Can’t Abort Reserved Other Usage • • • • • • • • • • • Requested operation successful Authenticated user not allowed to access file Unsupported or unknown Operational Mode Requested file does not exist Requested file already in use Too many files open Attempting to close a file that is not open Outstation cannot write blocks of requested size Intermediate device lost communications with end device File transaction Abort was not successful. 2. and are a printable ASCII string that may be used to provide additional error information for any error condition. The responding station reports any error conditions in this field. The Status field is a 8 bit parameter that is used to return the status of the operation and must be set to zero by the initiating station. Close.The Maximum Block Size field is a 16 bit parameter that is used to return the maximum block size that the outstation will return. The outstation has requested the host Confirm the response containing an event. and the file handle value is invalid. so the host responds as follows 0xC0 00 Note: If there is no activity referencing a file handle for a configurable length of time the outstation must do an automatic close on the file. Note: The final state of a file that is closed after receiving a File Transport Status Object (obj 70 var 6) with a non-zero status code value is also undefined. The final state of the file closed under this condition is undefined. Status must be set to zero. The application should use the returned file handle in future references to the file until it is closed. If the file is opened for writing it shall be truncated to zero length and the Time of Creation and Permissions fields of the File Command Object shall be used as attributes for the new file. issue a Close command (function code 26) to the File Command Status Object (obj 70 var 4) as follows 0xC0 26 70 04 0x5B 01 nn nn … (object data) The File handle field should be set to the value assigned in the previous open. The timeout value must be configurable up to 1 hour. If the file was opened for write the File Size field reports zero.g. so the host responds as follows 0xC0 00 5. the File Size field indicates the size of the file. If the file was opened for read. Sequential File Transfer Objects DNP Technical Bulletin 2000-001 26 January 2000 Page 8 .To open the file for read. set the Operation Mode to read (0x01). A non zero status code indicates that the file was not successfully opened. When this condition occurs the outstation will send a File Transport Status Object (obj 70 var 6) using a status code value of file handle expired (0x02). etc. set the Operation Mode to write (0x02).4 Closing a File To Close a file. The outstation has requested the host Confirm the response containing an event. The outstation responds with 0xE0 129 IINs 70 04 0x5B 01 nn nn … (object data) The object data shall be an echo of the request with the status field set to the appropriate value (e. Otherwise the Time of Creation and Permissions fields must be zero. and File Size to zero. Note: the file must be fully described as in Path\FileName The outstation responds with a File Command Status Object (obj 70 var 4) with the assigned file handle and status code as follows 0xE0 129 IINs 70 04 0x5B 01 nn nn … (object data) A status code of zero indicates that the file was successfully opened. file does not exist. To open the file for write. permission denied.) A status code of zero indicates that the file was successfully closed. so the host responds as follows 0xC0 00 Note: If Abort is supported by a device. The outstation has requested the host Confirm the response containing an event. The outstation shall respond with a File Command Status Object (obj 70 var 4) with the file handle value of zero and the status code set to the appropriate status value (e. The outstation responds with 0xE0 129 IINs 70 04 0x5B 01 nn nn … (object data) The object data shall be an echo of the request with the status field set to the appropriate value (e. in all circumstances. it may be necessary for the device to double-buffer the file during file transfer operations. etc. 5. file does not exist. Note: To completely recover a file after an Abort. file does not exist.g. permission denied. 5. then upon receiving an Abort command the device must terminate the file transfer indicated by the File Command Status Object and close the file. If a device does not support Abort. the device must return a “Can’t Abort” status code in a File Command Status Object (obj 70 var 4). issue a Delete command (function code 0x1B) to the File Command Object (obj 70 var 3) as follows 0xC0 27 70 03 0x5B 01 nn nn … (object data) Operation mode in the File Command Object must be set to zero.6 Aborting a File Transfer To Abort a file transfer. The outstation has requested the host Confirm the response containing an event.) as follows 0xE0 129 IINs 70 04 0x5B 01 nn nn … (object data) A status code of zero indicates that the file was successfully deleted.Note: If the host chooses to end the operation for any reason including a timeout it must send a close to the outstation to release the file for further use. issue an Abort command (function code 30) to the File Command Status Object (obj 70 var 4) as follows 0xC0 30 70 04 0x5B 01 nn nn … (object data) The File handle field should be set to the value assigned in the previous open. Status must be set to zero. If a file transfer Abort results in Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 9 . can’t abort. For more information on status codes see Table 7. so the host responds as follows 0xC0 00 Note: If a file is open while issuing a delete command a File Command Status Object (obj 70 var 4) shall be returned with a status code of “File locked by another user” (0x04).g.5 Deleting a File To delete a file.) A status code of zero indicates that the file transfer was successfully aborted. etc. 6. The block number starts at zero and increments by one for each block read or written. concurrently. The first is a File Transport Object (obj 70 var 5). or sent in an unsolicited response. The Data Octets represent the information to be transferred. 2. It is obtained by opening the file using the File Command Object (obj 70 var 3) (see sections 4-5). Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 10 . It is limited by the maximum block size field passed in the File Command Object (obj 70 var 3) during the open process. 6 Data Transfer Two objects are defined to support data transfer. It is also acceptable to return it in the response to a request if the results are immediately known. The size of the data portion is not relevant and need not be the same from block to block. The second is the File Transport Status Object (obj 70 var 6). and cleared to denote the indicated block number is not the last block.an unusable file the device must return a “Can’t Abort” status code in a File Command Status Object (obj 70 var 4). assigned to class 1.1 File Transport Object Table 8 Object Header Object 70 Variation 5 Qualifier 0x5B Range Field (=1) Number of Octets in object File Transport Object Format File Handle b30 The File Transport Object (obj 70 var 5) is defined as follows. or 3. The Last Flag is set to denote the indicated block number is the last block. Note: Using file handle qualification and block number allows multiple read/write operations to different files on the same device. Note: The File Transport Object (Obj 70 var 5) is treated as an event for file read responses so that it can be polled for specifically. b7 b7 b7 b7 b15 b0 b0 b0 b0 b0 b31 b31 LAST b0 b0 b0 Block Number Data Octets Bn The File Handle field is a 32 bit parameter that provides a numeric identifier of the file opened. The Block Number field is a 31 bit parameter plus a 1 bit Last Flag. 6. Alternatively it can be reported via unsolicited response or in response to the request if the results are immediately known.2. b7 b7 b7 b7 b15 b0 b0 b0 b0 b0 b31 b31 LAST b0 b0 b0 b0 Block Number Status Code Optional ASCII Characters b7 Bx The File Handle field is a 32 bit parameter that provides a numeric identifier of the file opened. or 3. corresponding to the Block Number and Last Flag in a File Transport Object for which this object is reporting status. The Block Number field is a 31 bit parameter plus 1 bit Last Flag. The Last Flag is set to denote the indicated block number is the last block. • Too much file data received to process 0x13 Fatal Error. File Unusable • File system error 0x14 Block Number Out Of Sequence • Already received data with this block number • Missing (skipped) block number in sequence 0x15 – 0x1F Reserved 0xFF Other • Any error not listed above (optional ASCII string may provide additional information) Note: The File Transport Status Object (obj 70 var 6) is treated as an event and can be polled for directly or assigned to class 1. Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 11 . The values for this field are defined as follows: Table 10 Value of Name Usage Status Field 0x00 Operation Completed Successfully • File Transport Object successfully written 0x08 Lost Communications • Intermediate device lost communications with end device 0x10 No Previous Matching Open • File handle does not reference an open file 0x11 Handle has Expired. and cleared to denote the indicated block number is not the last block. The responding station reports any error conditions in this field. • File previously closed due to inactivity timeout 0x12 Buffer Overrun. It is the value originally obtained by opening the file using the File Command Object (obj 70 var 3) (see sections 4-5). The Status field is an 8 bit parameter that is used to return the status of a corresponding File Transport Object operation.2 File Transport Status Object Table 9 Object Header Object 70 Variation 6 Qualifier 0x5B Range Field (=1) Number of Octets in object File Transport Status Format File Handle b30 The File Transport Status Object (obj 70 var 6) is defined as follows. The block number sent by the initiating station starts at zero and increments by one for each block read or written. When writing the last block set the Last Flag. 6.(object data) 0xE0 129 IINs 70 04 0x5B…. the outstation shall generate an event using the File Transport Status Object with status code 0x11 “Handle has Expired”. For example.3 • • • • • • Writing Data To write a file: Open the file in Write mode. providing authentication information (see section 4). Assuming the operation was successful increment the block number and write the next block. The File Transport Status Object provides flow control and bandwidth management when performing file write operations because • It is required/guaranteed that the end device sends it. A typical sequence is: Table 11 Operation Sequence Open Open Response Confirm Write (Block 0x00000000) Null Response N Polls Get Status Event (Block (0x00000000) Confirm Application Layer Octets 0xC0 25 70 03 0x5B…. Wait for a File Transport Status Object (obj 70 var 6) Event with the matching file handle and block number.(object data) 0xC1 129 IINs 0xC2 01 Class poll 0xE2 129 IINs (data) Object 70 var 06 0xC2 00 Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 12 .(object data) 0xC0 00 0xC1 02 70 05 0x5B….Note: Any optional data appended to the object after the status code is a printable ASCII string that is used to provide additional error information. After the event is generated. Close the file using the File Operation Status Object (obj 70 var 4) and file handle returned in the open command. When any file status changes it is reported using a File Transport Status Object (obj 70 var 6) as an event. • A configurable timeout limits how long to wait. This event will then be returned on the next poll or may be sent as an unsolicited response. when a file inactivity timer expires. Any subsequent access to the file results in a File Transport Status Object with status code 0x10 “No Previous Open”. • Normal polling continues while waiting for it. Perform write to the File Transport Object (obj 70 var 5). the outstation is no longer required to retain information about the file being opened. close the file using the File Operation Status Object (obj 70 var 4) and file handle returned in the open command. providing authentication information.4 Reading Data To Read a file • Open the file in Read mode. • Wait for the response. 6.(object data) 0xC7 00 Note: If there is an error during the above operations including a file operation timeout. Under error conditions the file must be implicitly closed by the outstation and the file contents must be considered indeterminate. as described in section 4.(object data) 0xC3 129 IINs 0xC4 01 Class poll 0xE4 129 IINs (data) Object 70 var 06 0xC4 00 0xC5 02 70 05 0x5B…. the referenced file handle becomes invalid.(object data) 0xC5 129 IINs 0xC6 01 Class poll 0xE6 129 IINs (data) Object 70 var 06 0xC6 00 0xC7 26 70 04 0x5B….(object data) 0xE7 129 IINs 70 04 0x5B…. • Assuming the operation was successful increment the block number and read the next block. Upon receiving a File Transport Status Object (obj 70 var 6) with a non-zero status code. • When the Last Flag is set in the response.Write (Block 0x00000001) Null Response N Polls Get Status Event (Block 0x00000001) Confirm Write (Last Block 0x80000002) Null Response N Polls Get Status Event (Last Block 0x80000002) Confirm Close Returns Status In Status Object Confirm 0xC3 02 70 05 0x5B…. • Perform a read to the File Transport Object (obj 70 var 5). . A typical sequence is: Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 13 . the device shall return the appropriate status object with status code. (object data) 0xC6 00 0xC7 01 70 05 0x5B…..(object data) 0xC9 00 0xCA 26 70 04 0x5B…..Table 12 Operation Sequence Open Open Response Confirm Read (Block 0x00000000) Null Response N Polls N+1 Poll Poll response (File Data returned as event) Confirm Read (Block 0x00000001) Null Response N Polls N+1 Poll Poll response (File Data returned as event) Confirm Read (Block 0x00000002) Null Response N Polls N+1 Poll Poll response:File Data returned as event with Last Flag set Confirm Close Returns Status In Status Object Confirm Application Layer Octets 0xC0 25 70 03 0x5B….(object data) 0xCA 00 Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 14 .(object data) 0xE0 129 IINs 70 04 0x5B…..(object data) 0xC4 129 IINs 0xC5 01 Class poll 0xC6 01 Class poll 0xE6 129 70 05 0x5B….(object data) 0xC3 00 0xC4 01 70 05 0x5B….(object data) 0xEA 129 IINs 70 04 0x5B.(object data) 0xC1 129 IINs 0xC2 01 Class poll 0xC3 01 Class poll 0xE3 129 70 05 0x5B….(object data) 0xC0 00 0xC1 01 70 05 0x5B….(object data) 0xC7 129 IINs 0xC8 01 Class poll 0xC9 01 Class poll 0xE9 129 70 05 0x5B…. The file name offset and file name size fields form a jump-table allowing direct access to the file name string at the end of the object. A zero value indicates a directory. excluding any links to itself or its parent directory. including a file operation timeout. and file contents at the host must be considered indeterminate. 7 Retrieving File Information The File Descriptor Object (obj 70 var 7) is used to get information about a file. The File Name Size field is a 16 bit parameter which specifies the number of file name octets. the file must be implicitly closed by the outstation and the host. Offset is relative to the beginning of the object (zero based) excluding the header. Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 15 .Note: in read requests there are no data octets included in the File Transport Object (obj 70 var 5). A value of 1 indicates a simple file. the device shall return the appropriate status object with status code. For a directory file type it indicates the number of entries in the sub-directory. The File Type field is a 16 bit parameter used to differentiate between simple files and directories. instead of a File Transport Object (obj 70 var 5). It is defined as follows: Table 13 Object Header b7 b0 Object 70 b7 b0 Variation 7 B7 b7 b15 Qualifier 0x5B Range Field (=1) Number of Octets in object b0 b0 b0 b15 b15 b15 b31 b47 b16 b15 bn File Descriptor Object Format File Name Offset File Name Size File Type File Size Time of Creation Permissions Request ID File Name Octets b0 b0 b0 b0 b0 b0 b0 b0 The File Name Offset field is a 16 bit parameter which specifies the zero-based start of the file name octets relative to the start of the object excluding the header. Upon receiving a File Transport Status Object (obj 70 var 6) with a non-zero status code the referenced file handle becomes invalid. Note: If there is an error during the above operations. The File Size field is a 32 bit parameter. Under error conditions. Note that a File Transport Status Object (obj 70 var 6) should be returned on error. For a simple file type it represents the number of octets contained in the file. 1) The Request ID field is a 16-bit parameter whose value is arbitrarily assigned by the host. The outstation device must remember this value and copy it into the Request ID field of the corresponding response. so the host responds as follows 0xC0 00 The end application could display this information in a browser or another appropriate application. as in: Path\FileName If the file referenced does not exist then the outstation should return a File Command Status Object (obj 70 var 4) with the status field set to File Not Found (0x02). 2. Time of Creation and Permissions fields of the File Descriptor Object in a request must be ignored by the outstation and must be set to zero by the initiating station.2. or 3. The device responds with a File Descriptor Object (obj 70 var 7) consisting of the requested information as follows 0xE0 129 IINs 70 07 0x5B 01 nn nn …(Object…”RequestID…Path\FileName” …Data) The outstation has requested the host Confirm the response containing an event. This permits the host to correlate responses with their requests when information on multiple files is requested in the same device. To retrieve file information on all files in a directory. 1970. the File Type field shall be zero to indicate a directory file and the File Size field shall indicate the number of entries in the sub-directory. issue a file read on the directory file. Note: the file shall be fully described. If the file referenced is a directory file.The Time of Creation field is a 48 bit parameter that represents the DNP time of creation of the file represented as the number of milliseconds since midnight January 1. The Permissions field is a 16 bit parameter whose values are defined in Table 4 (see section 5. as described in section 7. File Size.1 Retrieving Individual File Information To get information on a single file. issue a Get File Info Command (function code 28) to the File Descriptor Object (obj 70 var 7) specifying a Request ID and the full path file name in the File Name field as follows 0xC0 28 70 07 0x5B 01 nn nn …(Object…RequestID…”Path\FileName”…Data) The File Type. Note: The File Descriptor Object (obj 70 var 7) is treated as an event when it is generated after a Get File Info command. It is also acceptable to return it in the response to a request if the results are immediately known. They fully reference the file (including path within the device). File Name Octets are the octets of the file name. so that it can be either polled for specifically or assigned to class 1. 7. Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 16 . e. File Size. Permissions. Open.1 Example Assume that an outstation has the following directory structure \file0 \dir1 \file1 \file2 \dir2 \file3 \dir3 \file4 If the host reads the root directory file (“\”). then the outstation should return a file of zero length i. it would receive a file with information as follows: Filename offset Filename size File type File size Time of creation Permissions Request Id File name octets 0x14 00 05 00 01 00 nn nn nn nn nn nn nn nn nn nn 00 00 nn nn file0 Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 17 . The directory file can only be opened for Read. 7. (The path was specified in the File Command object used to Open the directory file for read).e. Sub-directories below the read directory are indicated as files with File Type zero (Directory file). The format of the “directory file” transferred from the outstation consists of one or more data objects.2. File Type. Authenticate (if necessary). File Name Size. Only the name of the file is included.4 for sequential file reads. Time Of Creation. and Close the file. The outstation responds in the same manner as for any other file read. in same format as the File Descriptor Object (obj 70 var 7) i.7. The directory file shall be read in the manner described in section 6.2 Retrieving Directory Information Information can be retrieved for all the files in a directory or sub-directory of a device by performing a file transfer of the directory file. File Transport Object (obj 70 var 5) is returned with no Data Octets. The file descriptor object data transferred in the directory file read does not include object header information. If the directory referenced does not exist then the outstation should return a File Command Status Object (obj 70 var 4) with the status field set to File Not Found (0x02). Read blocks up until the end of file. the details supplied for each file in the directory are: File Name Offset. A host wishing to retrieve file information for all files in a device may perform additional directory file transfers for each subdirectory file. File Name The end application may display this information in a browser or another appropriate application. ie. Request ID. If the directory exists but contains no files. one for each file in the directory. Retrieving directory information retrieves data for one directory level only. and with the File Size field indicating the number of entries in the sub-directory. The path to the directory is not contained in each of the individual File Descriptor Object’s File Name fields. 00 Data Object Library Chapter 10 File Object Definitions Changes to the Subset Level 1 and 2 Certification Procedures: None Last Updated: January 26. 2000 Status: Pending General Membership Approval (Feb 2000) Sequential File Transfer Objects 26 January 2000 DNP Technical Bulletin 2000-001 Page 18 . Table 14 Object Variation and Qualifier Codes Required OBJECT REQUEST (slave must parse) Obj Var Description Func Codes (dec) 70 70 70 70 70 70 2 3 4 5 6 7 Authentication Object File Command Object File Command Status Object File Transport Object File Transport Status Object File Descriptor Object 25.2 28 Qual Codes (hex) 0x5B 0x5B 0x5B 0x5B RESPONSE (master must parse) Func Codes (dec) Qual Codes (hex) 129.0x14 00 0x14 00 04 00 04 00 00 00 00 00 03 00 00 00 01 00 00 00 nn nn nn nn nn nn nn nn nn nn nn nn 00 00 00 00 nn nn nn nn dir1 dir3 If the host reads the directory file “\dir1”.30 1.130 129. it would receive a file with information as follows: Filename offset Filename size File type File size Time of creation Permissions Request Id File name octets 0x14 00 0x14 00 0x14 00 05 00 05 00 04 00 01 00 01 00 00 00 nn nn nn nn nn nn nn nn 01 00 00 00 nn nn nn nn nn nn nn nn nn nn nn nn nn nn nn nn nn nn 00 00 00 00 00 00 nn nn nn nn nn nn file1 file2 dir2 8 Minimum Implementation When a device supports Sequential File Transfer. the following implementation is required as a minimum.130 129.130 129.27 26.130 0x5B 0x5B 0x5B 0x5B Affected Documentation: DNP V3. Authentication and Unsolicited Responses are considered optional features of Sequential File Transfer. which is often represented as a cloud as shown in Figure 1. never send two output messages with the same sequence number for SELECT. and adds a new restriction on devices when performing select before operate controls. It is possible for the Host to safely issue more than one control attempt without risking duplicate operation. 2000 . As stated the requirement can be misinterpreted to mean that control operations should never be reissued without operator intervention. the remainder of this document will refer to the Host making more than one control attempt to be a “Control Retry”.DNP Technical Bulletin 2000-002 Control Retries Issue: This bulletin describes a method of operating controls reliably in the presence of a poor quality communications network. It is the purpose of this document to describe how more than one control attempt may be performed safely without risking duplicate control operation while making a “Best Effort Attempt” to operate the control “Exactly Once” without operator intervention. it appears as a retry from the operators perspective. OPERATE.e. or DIRECT OPERATE function codes. Background: In a SCADA communications environment all transmissions and receptions are received through the communications medium. This is technically not a retry from the protocol’s perspective. however. i. WAN Host Outstation Figure 1 It is possible for messages to get lost in the communications medium as shown in Figure 2 DNP 3 Technical Bulletin 2000-002 Control Retries Page 1 of 12 January 24." The requirement as stated above was intended to insure that duplicate controls would not be issued. This bulletin supercedes Technical Bulletin 9804-001 dated 4/22/98 Item 7 which states "A Host must never perform application layer retries of output operations. This is desirable in high noise environments to allow the system to make a “Best Effort Attempt” to operate the control “Exactly Once” without operator intervention. Therefore. Once the select portion has been satisfied. 2000 . 2) The Host may issue multiple retries on the “select” portion of the control dialog. the Outstation will respond to the select. 9) The Host must never retry direct operate controls. Notes: The following notes apply to the text that follows: • The term control is used generically to refer to analog and binary outputs. • When application sequence numbers are incremented they are always incremented modulo 16. and the Outstation’s select-to-operate timers will continue running without being reset. b) If the Host retries without incrementing the sequence number. The original selection will remain unchanged intact. This can result in duplicate controls.. the Outstation received it and responded. This also causes the Outstation to re-arm its select-tooperate timers. 5) The Outstation must reject any operate that does not a) contain a sequence number that is exactly one greater (modulo 16) than the previously accepted select. but the message is lost in the communications medium. the Outstation will respond to the select and re-arm the designated point. 4) The Host must increment the sequence number by exactly one (modulo 16) between the select and operate command. Technical Bulletin 9804-001 addresses how a Host and Outstation should handle the various failure scenarios. When the type of output is important.WAN Host Outstation Figure 2 In this case the Host transmitted a message. b) match the object portion of the select message byte for byte. if the operate portion fails the Host may not retry the select. 3) Incrementing the sequence number between retries of the select is at the discretion of the Host. Technical Bulletin 2000-002 addresses the processing of analog and binary operations in the various failure scenarios. excluding the application header. Rules: 1) Technical Bulletin 9804-001 fully applies with the exception of Item 7. DNP 3 Technical Bulletin 2000-002 Control Retries Page 2 of 12 January 24. • When sequence number is included in the following text it refers to the application sequence number unless otherwise noted. 6) The Host may only issue an operate after successful reception of a select echo from the Outstation. and act accordingly. This can result in duplicate controls. 7) The Host may issue multiple retries on the “operate” portion of control dialog as long as the sequence number does not change between retries. the proper name is used. • When the term “Retry” appears in the following text it refers to application layer retries unless otherwise noted. 8) At no time should the Host retry the select operate sequence in its entirety. a) If the Host increments the sequence number between retries. The Host must assume that the Outstation never received the message. 2000 .Scenarios: The following section presents several scenarios that illustrate the rules stated above. Scenario 1: Figure 3 shows a timeline representation of a successful select before operate sequence. Host Time To Host Issues Select SEQ N Outstation Oustation Receives Select Oustation Echoes Select Host Receives Echo Host Sends Operate SEQ N SEQ N+1 Outstation Receives Operate Oustation Operates Control Oustation Echos Operate SEQ N+1 Host Receives Echo Control Dialog Complete Time Tn Figure 3 DNP 3 Technical Bulletin 2000-002 Control Retries Page 3 of 12 January 24. Scenario 2: Figure 4 shows a timeline representation of a successful select before operate sequence. Host Time To Host Issues Select N SEQ N Outstation Oustation Receives Select N SEQ N Oustation Echoes Select Host Misses Echo N Host increments sequence number and retries Select SEQ N+1 Oustation Receives Select N+1 and resets its operate timer Oustation Echoes Select N+1 SEQ N+1 Host Receives Echo N+1 Host Sends Operate N+2 SEQ N+2 Outstation Receives Operate N+2 Oustation Operates Control Oustation Echos Operate N+2 SEQ N+2 Host Receives Echo N+2 Control Dialog Complete Time Tn Figure 4 DNP 3 Technical Bulletin 2000-002 Control Retries Page 4 of 12 January 24. 2000 . where the echo of the first select is lost and the Host increments the sequence number and retries the select. Scenario 3: Figure 5 shows a timeline representation of a successful select before operate sequence where the echo of the first several selects are lost. 2000 . It Echoes previous select without processing. It Echoes previous select without processing. Host Misses Echo N Host Retries Select N SEQ N SEQ N Oustation Detects Duplicate Sequence Number That Matches Byte for Byte last message. SEQ N+1 Outstation Receives Operate Oustation Operates Control Oustation Echos Operate SEQ N+1 Host Receives Echo N+1 Control Dialog Complete Time Tn Figure 5 DNP 3 Technical Bulletin 2000-002 Control Retries Page 5 of 12 January 24. Host Receives Echo N Host Sends Operate N+1 SEQ N Oustation Detects Duplicate Sequence Number That Matches Byte for Byte last message. Timer is not reset. Note: This can cause the operate to be rejected if the select-to-operate timer of the Outstation is configured to be less than the time it takes to retry the selects. It Echoes previous select without processing. Host Time To Host Issues Select SEQ N Outstation Oustation Receives Select SEQ N Oustation Echoes Select Host Misses Echo N Host Retries Select N SEQ N Host Misses Echo N Host Retries Select N SEQ N SEQ N Oustation Detects Duplicate Sequence Number That Matches Byte for Byte last message. Timer is not reset. Timer is not reset. The Host does not increment the sequence number when retrying the select. 2000 . Time Tn Figure 6 DNP 3 Technical Bulletin 2000-002 Control Retries Page 6 of 12 January 24.Scenario 4: Figure 6 shows a timeline representation of a successful select before operate sequence where the echo of the operate is lost. Host Time To Host Issues Select N SEQ N Outstation Oustation Receives Select Oustation Echoes Select Host Receives Echo N SEQ N Host Sends Operate N+1 SEQ N+1 Outstation Receives Operate Oustation Operates Control Oustation Echos Operate Host Misses Echo N+1 Host Retries Operate N+1 SEQ N+1 SEQ N+1 Host Receives Echo N+1 Control Dialog Complete SEQ N+1 Oustation Detects Duplicate Sequence Number That Matches Byte for Byte last message. It Echoes previous operate without processing. The Host does not increment the sequence number when retrying the operate. The echo of the operate is lost. This results in a false error.Scenario 5: Figure 7 shows a timeline representation of an invalid select before operate sequence. Host Time To Host Issues Select N SEQ N Outstation Oustation Receives Select Oustation Echoes Select Host Receives Echo N SEQ N Host Sends Operate N+1 SEQ N+1 Outstation Receives Operate Oustation Operates Control Oustation Echos Operate Host Misses Echo N+1 Host Retries Operate N+1 SEQ N+2 SEQ N+1 Host Receives Echo N+2 and believes the control did not operate when in fact it did. Control Dialog Error SEQ N+2 Outstation Detects Operate. Since the sequence number is not the same as the previous operate it processes the operate. The Host increments the sequence number when retrying the operate. setting the status field to NO MATCHING SELECT(status = 2). There was no select with sequence number N+1 so it echoes the operate. 2000 . Time Tn Figure 7 DNP 3 Technical Bulletin 2000-002 Control Retries Page 7 of 12 January 24. The control has already operated a second time at this point. 2000 .Scenario 6: Figure 8 shows a timeline representation that illustrates why direct operate controls cannot be retried. In this example the echo of the direct operate is lost. This result is unacceptable. The Host retries the direct operate and the control is eventually operated twice. SEQ N Time Tn Figure 8 DNP 3 Technical Bulletin 2000-002 Control Retries Page 8 of 12 January 24. The Outstation restarts after sending it. This cannot occur using select before operate controls. Host Time To Host Issues Direct Operate N SEQ N Outstation Host Misses Echo N Host Retries Direct Operate N SEQ N Outstation Receives Operate Oustation Operates Control Oustation Echos Operate Outstation Restarts SEQ N Outstation is Restarting SEQ N Host Misses Echo N Host Retries Direct Operate N SEQ N Outstation is Restarting Host Misses Echo N Host Retries Direct Operate N SEQ N Outstation becomes operational SEQ N Outstation Receives Operate Oustation Operates Control a second time Oustation Echos Operate Host Receives Echo N with the restart bit set. (Section # TBD) Incrementing Sequence Number Binary Output Select Retries 1. The Outstation must echo the operate command but must not operate the control more than once. 6. Verify that the DUT operates the binary output. Issue a valid operate. 3. incrementing the sequence number by 1 modulo 16. Issue a valid operate. If the DUT does not have installed binary output points skip this section. incrementing the sequence number by 1 modulo 16. 7. If the DUT does not have installed binary output points skip this section. Issue a valid select to an installed binary output point. Verify that the DUT echoes the object portion of the select byte for byte. 6. 5. 8. Issue a valid select to an installed binary output point. 5. 4. The Outstation must accept retries on the select portion of the control dialog that do not increment the application sequence number between retries.Affected Documentation: This document supersedes Technical Bulletin 9804-001 Item 7. Verify that the DUT operates the binary output. In this case the select-to-operate timer must be restarted after reception of each select. Verify that the DUT echoes the object portion of the select byte for byte. Issue a valid operate. Issue the operate again using the same application layer sequence number. incrementing the sequence number by 1 modulo 16. Verify that the DUT echoes the object portion of the operate byte for byte. 4. 8. 2. The Outstation must reject any operate that does not • contain a application layer sequence number that is exactly one greater (modulo 16) than the previously accepted select. • match the object portion of the select message byte for byte. Verify that the DUT echoes the object portion of the operate byte for byte. In this case the select-to-operate timer must remain unaltered by the reception of each additional select. 5. Verify that the DUT echoes the object portion of the select byte for byte. Verify that the DUT echoes the object portion of the select byte for byte. 3. The Outstation must accept retries on the operate portion of the control dialog that does not increment the application sequence number between retries. 2000 DNP 3 Technical Bulletin 2000-002 Control Retries . Verify that the DUT echoes the object portion of the operate byte for byte. 7. excluding the application header. 8. 2. Page 9 of 12 January 24. 3. Verify that the DUT operates the binary output. 7. 2. Issue the select again incrementing the application layer sequence number by 1 modulo 16. (Section # TBD) Same Sequence Number Binary Output Operate Retries 1. Verify that the DUT echoes the object portion of the select byte for byte. Issue a valid select to an installed binary output point. Issue the select again using the same application layer sequence number. 4. • • • (Section # TBD) Same Sequence Number Binary Output Select Retries 1. Verify that the DUT echoes the object portion of the operate byte for byte. 6. Changes to the Subset Level 1 and 2 Certification Procedures: Insert additional procedures in binary output section: Desired Behavior • The Outstation must accept retries on the select portion of the control dialog that increment the application sequence number between retries. If the DUT does not have installed binary output points skip this section. (Section # TBD) Incrementing Sequence Number Binary Output Operate Retries 1. 8. incrementing the select sequence number by 1 modulo 16 to make sure the mismatched operate cleared the previous select. (Section # TBD) Select/Operate Binary Output Sequence number checking 1. Issue a valid operate. Issue a valid operate. The Outstation must reject any operate that does not • contain a application layer sequence number that is exactly one greater (modulo 16) than the previously accepted select. Verify that the DUT does not operate the binary output. 5. 4. 2.9. Issue a valid select to an installed analog output point. 5. The Outstation must accept retries on the select portion of the control dialog that do not increment the application sequence number between retries. • • • (Section # TBD) Same Sequence Number Analog Output Select Retries 1. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). 2. incrementing the sequence number by anything but 1 modulo 16. • match the object portion of the select message byte for byte. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). 6. 3. 3. 2000 DNP 3 Technical Bulletin 2000-002 Control Retries . Verify that the DUT does not operate the binary output. If the DUT does not have installed binary output points skip this section. 7. 9. Verify that the DUT echoes the object portion of the select byte for byte. incrementing the sequence number by 1 modulo 16. incrementing the sequence number by 1 modulo 16. 4. In this case the select-to-operate timer must remain unaltered by the reception of each additional select. Verify that the DUT echoes the object portion of the operate byte for byte. Issue a valid operate. incrementing the sequence number by 1 modulo 16. Verify that the DUT echoes the object portion of the select byte for byte. If the DUT does not have installed binary output points skip this section. Issue a valid operate. Issue a valid select to an installed binary output point. 3. Page 10 of 12 January 24. 7. Issue the operate again. Verify that the DUT does not operate the binary output. Verify that the DUT operates the binary output. Verify that the DUT echoes the object portion of the operate byte for byte. 2. In this case the select-to-operate timer must be restarted after reception of each select. 7. Insert additional procedures in analog output section: Desired Behavior • The Outstation must accept retries on the select portion of the control dialog that increment the application sequence number between retries. Issue the select again using the same application layer sequence number. Verify that the DUT does not operate the binary output. If the DUT does not have installed analog output points skip this section. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). 9. 6. 5. The Outstation must echo the operate command but must not operate the control more than once. excluding the application header. Verify that the DUT echoes the object portion of the select byte for byte. Verify that the DUT echoes the object portion of the select byte for byte. Issue a valid select to an installed binary output point. The Outstation must accept retries on the operate portion of the control dialog that does not increment the application sequence number between retries. 4. 6. 8. Verify that the DUT does not operate the analog output. Verify that the DUT operates the analog output. 3. incrementing the sequence number by 1 modulo 16. incrementing the sequence number by 1 modulo 16. Verify that the DUT operates the analog output. (Section # TBD) Incrementing Sequence Number Analog Output Select Retries 1. 4. 2. 4. 4. 2. Issue a valid operate. 8. Issue a valid select to an installed analog output point. 3. Issue a valid select to an installed analog output point. incrementing the select sequence number by 1 modulo 16 to make sure the mismatched operate cleared the previous select. If the DUT does not have installed analog output points skip this section. incrementing the sequence number by 1 modulo 16. 3. Issue a valid operate. Verify that the DUT does not operate the analog output. Verify that the DUT echoes the object portion of the select byte for byte. 3. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). 9. Issue a valid operate.8. Issue the operate again. 6. 7. If the DUT does not have installed analog output points skip this section. 8. Verify that the DUT does not operate the analog output. (Section # TBD) Select/Operate Analog Output Sequence number checking 1. 4. Verify that the DUT echoes the object portion of the select byte for byte. 5. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). Verify that the DUT operates the analog output. 2. Issue a valid operate. 6. Issue a valid select to an installed analog output point. Verify that the DUT echoes the object portion of the operate byte for byte. If the DUT does not have installed analog output points skip this section. Verify that the DUT echoes the object portion of the operate byte for byte. 6. Verify that the DUT echoes the object portion of the select byte for byte. 6. incrementing the sequence number by anything but 1 modulo 16. If the DUT does not have installed analog output points skip this section. Verify that the DUT operates the analog output. 9. Verify that the DUT echoes the object portion of the select byte for byte. Verify that the DUT does not operate the analog output. Verify that the DUT echoes the object portion of the select byte for byte. incrementing the sequence number by 1 modulo 16. 8. 7. 5. Issue the operate again using the same application layer sequence number. 5. 2000 . Verify that the DUT echoes the object portion of the operate byte for byte. DNP 3 Technical Bulletin 2000-002 Control Retries Page 11 of 12 January 24. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). Issue the select again incrementing the application layer sequence number by 1 modulo 16. Issue a valid operate. (Section # TBD) Incrementing Sequence Number Analog Output Operate Retries 1. Issue a valid select to an installed analog output point. 9. Verify that the DUT echoes the object portion of the operate byte for byte. 7. 7. (Section # TBD) Same Sequence Number Analog Output Operate Retries 1. 5. 8. 2. 2000 . 2000 Status: Pending General Membership Approval (Feb-2000). DNP 3 Technical Bulletin 2000-002 Control Retries Page 12 of 12 January 24.Last Updated: January 24. DNP 3 Technical Bulletin 2000-003 Change Management Page 1 of 22 January 26. 2. Category 1 and 2 issues do not directly effect existing implementations and may be issued by the technical committee without requiring General Membership Approval.DNP Technical Bulletin 2000-003 Change Management Issue: The use of DNP3 in a wide variety of application areas and communication technologies has led to a need for periodic revisions and improvements. 3. membership requirements.g. Category 3 and 4 issues can potentially affect existing implementations. Background: The DNP Protocol is defined by an extensive documentation set. Bulletins fall into four categories 1. Rules that are required for inter-operability and will be tested for in the certification procedures. 2000 . Resolution: When needed the technical committee will issue Technical Bulletins that resolve identified problems and specify new features. However. etc). The Technical Committee will issue these bulletins with a status indicating “Pending General Membership Approval (Month and Year of Next Meeting)”. and in subsequent documentation and Technical Bulletins that have • • • • • failed to address areas of inter-operability provided ambiguous specifications provided conflicting requirements provided no guidance not provided suitable functions. Recommendations that are not required for inter-operability and will not be tested for in the certification procedures. this document outlines the mechanism that will be employed to manage changes. charter. Devices that passed the tests in those procedures are said to be DNP3-1999 compliant. As an example. as they become necessary. certification. the original certification procedures were approved by the General Membership in February 1999. In an effort to satisfy the desire for stability yet recognize the need for change. Enhancements or additions to the protocol that no one has implemented before. Procedural and Organizational rules and requirements (e. there are areas in the original documentation. It is the responsibility of the technical committee as maintainers of the protocol to address these issues in a timely manner while providing customers and implementers sufficient time to incorporate changes into their products and specifications. objects or methods for desired commands and data transferal. Each version of the certification procedures will be denoted by the year the contents were approved by the General Membership. 4. Each bulletin that specifies desired behavior must also include a certification test section to be included in the certification test procedures. the certification procedures included in the Technical Bulletins approved in February 2000 would be called DNP3. A fee may be assessed for the arbitration process at the discretion of the Steering Committee.Technical Bulletins may be published at any time between General Membership Meetings. will be incorporated into the certification procedures in normal course. Technical Bulletins that are rejected in a General Membership Meeting may be revisited or edited and resubmitted at the next General Membership meeting. where xxxx is the year in which the Technical Bulletins were approved by the general membership. For example. In the example given above. It is recommended that DNP3 users specify which level of compliance they require by specifying which version of the procedures a device must pass to be purchased. Six months after the General Membership meeting all previously certified devices must be tested against. Certification test procedures included in the Technical Bulletins that are approved in a General Membership Meeting will be incorporated into the certification procedures six months following the meeting. This bulletin will by definition be a category 3 bulletin. The Technical Committee will review the details of the issue and publish a technical bulletin that specifies the correct behavior. Last Updated: January 26. DNP 3 Technical Bulletin 2000-003 Change Management Page 2 of 22 January 26. While every attempt is made to insure that two devices that pass the certification procedures inter-operate. Implementers can use the technical bulletin as an advanced notification of additional requirements that resulted from the arbitration. Devices certified after July 2000 would be required to use the DNP3-2000 procedures. Affected Documentation: None Changes to the Subset Level 1 and 2 Certification Procedures: None. however those that require approval of the General Membership must be published for review not later than thirty days prior to the General Membership Meeting in which the General Membership will be asked to approve them. Devices tested during the 6 month grace period between General Membership Approval and the Effective Date can choose which version of the procedures they wish to be tested against. and when approved. and a compromise solution cannot be reached between the master and slave vendors. there may be instances in which a behavior has not been specified. Master devices are expected to reliably communicate and inter-operate with certified slave stations.2000. the issue may be submitted to the DNP Technical Committee for arbitration. and pass the revised certification procedures in order to be DNP3-xxxx compliant. 2000 . In these cases the vendors involved in the dispute can request arbitration from the technical committee. 2000 Status: Pending General Membership Approval (Feb 2000). devices certified between Feb 2000 and July 2000 could choose to be certified against either the DNP3-1999 procedures or the DNP3-2000 procedures. The Technical Committee will maintain a document on the web site that summarizes the inter-operability issues and enhanced features added for each version of the certification procedures. When they do not. the receiving application is required to confirm reception of an application message from the sending application.” Section 4 contradicts this by explicitly diagramming a Confirmation Response without the IIN. and The slave response to any such request by a non-compliant master is undefined. 2000 1 Issue DNP3 protocol defines an application layer message-confirmation service. The DNP Technical Committee has been asked to clarify application confirm requests transmitted by the master and corresponding application confirm responses transmitted by the slave.6 of the Application Layer document states that the IIN “… follows the function code in all responses. code 0. it has been resolved that: • • The master must not transmit any message that requests an application layer confirmation by the slave. Confirmation is accomplished by transmission of a message with the application layer “Confirm” function code. DNP3 Certification Procedures for Subset Level 1 and Level 2 do not contain any tests for application confirm messages sent by a slave device in response to a master request.DNP Technical Bulletin Application Layer Confirmation Messages August 30. Furthermore. 3 Last Updated: 30 August 2000 4 Status: Pending Technical Committee Approval DNP Technical Bulletin 2000-nnn Multiple Control Objects Page 1 of 1 17-August-2000 . and • The Basic IV does not clearly define the application confirmation message structure when transmitted by the slave. Section 3. It has been determined that any definition of the structure of a slave application confirm message may result in noncompliance and non-interoperability by some currently certified devices. The Basic IV is unclear whether or not IIN octets are to be included in application confirm messages sent by the slave. When used. 2 Resolution Since: • A slave device may pass certification without supporting master application confirm requests. since there are no meaningful uses of the application confirmation service when requested by the master. doc .Last Updated 31 May 2001 Status Awaiting User Group Comments 14-March-2001 2 TD-Counters-JV-1. 00. If the primary station transport function wants the secondary station transport function to throw away the current fragment it is building and start a new one. Discussion: It is undesirable to have the link layer independently "reset" other layers.00 Data Link Layer. DNP3-1999 IED Certification Procedure. 4.5 DNP3-1999 IED Certification Procedure. sections 6. This function shall not be used because there is no definition of the action to be performed by devices that receive this request and interoperability of devices that use it cannot be guaranteed. 2000 . Version 2. Subset Level 1.e. Any "restart" or "abort" type functionality that affects the application layer should be handled by the application layer.5 Invalid FCV Remove 3rd row of table (Code = D1). 3. 6. 4. The Data Link Layer document does not define what action the secondary station should take when it receives the command. sections 6.2.6. sections 3.00 and v1. Affected Documentation: DNP V3. Function code 1 is now obsolete. 3.2 Note: At the time of this bulletin. 6.2. Resolution: DNP3 does not define any action associated with the Data Link Layer Reset User Process request function code. it can simply send a frame having the FIR bit set. the Data Link Layer document is undergoing significant revision. 1.5 Changes to the Subset Level 1 and 2 Certification Procedures (v1.3.7. 9) with (i.2.6. Furthermore. Last Updated: November 13.e. 2000 DNP3 Technical Bulletin 2000-005 Reset of User Process Function Code Page 1 of 2 November 13. the document does not define what the "user process" of the link layer is or what should be involved in resetting it.01): 6 Link Layer Replace (i. Note: These changes have been incorporated into the DNP3-2000 IED Certification Procedures.3. function codes 0.2. but has not been found to map appropriately to the DNP3 environment. The above resolution will be incorporated into the new version.6. This function code was adopted from the IEC870-5-2 standard. Support of this function is not required. Subset Level 2. 9).DNP Technical Bulletin 2000-005 Reset of User Process Function Code Issue: The "Reset of User Process" service function (FC = 1) in the link layer control octet is not defined in the Basic 4 completely enough to guarantee interoperability. function codes 0. 6.6. DNP3 Technical Bulletin 2000-005 Reset of User Process Function Code Page 2 of 2 November 13. 2000 .Status: Pending General Membership Approval (Feb-2001). such as “Battery Test” may have no complementary function. This perverts the original intent of the CROB and makes it impossible for masters that statically configure control codes to be interoperable with such devices. Single function (activate) Resolution: CROB Index Types: Each DNP3 Control Relay Output Block index may only support either: A complementary control function. Without making 9701-002 obsolete. and provides rules that both the master and slave can follow that will guarantee that their use of the CROB object will interoperate. While this works in most cases. This type of implementation is also not transportable across legacy protocol boundaries. Many master vendors have attempted to achieve interoperability by configuring the control code on a point-by-point basis. some IED vendors have implemented pseudo-points that do different things based on the control code that is sent. Complementary function (trip/close) 2. but many interoperability problems continue to arise. While 9701-002 attempted to provide guidance on this issue. The Technical Bulletin 9701-002 limited the permissible set of functions. Examples of complementary control functions are: • Trip and Close • Raise and Lower • On and Off A single control function. For instance. A device may provide some indices that support complementary control functions as well as others that support only single control functions. it makes little sense to support all of the possible combinations of control codes in any case. Control Codes to be Used: Complementary control function indices may permit one of the complementary control code pairs: • 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) • 0x41(Pulse On/Close) and 0x81 (Pulse On/Trip) 20-June-2001 1 TB2000-006 . An index cannot support both methods of operation. and various vendors have chosen incompatible subsets of control codes to support. This is unnecessary and creates interoperability issues: not all devices support all control codes.DNP3 Technical Bulletin TB2000-006 Control Relay Output Block (CROB) Control Codes Issue: The Control Relay Output Block object provides a great variety of options for performing a control output. as most devices can only support one of two types of control operations on any give DNP3 index: 1. Some indices. Examples of single-function controls are: • Trip • Raise • Run Battery Test • Activate NOTE: Two single-function indices may provide complementary functions. this bulletin clarifies which control codes a device may support on a given DNP3 index (point). Finally. it left too much room for misinterpretation. one index provides the Trip function while the other provides the Close function. Discussion: The CROB in its current form exposes the details of device hardware to the protocol stack. the Device Profile Document shall note what the set is. If an index permits both pairs of codes. the Device Profile Document shall note them. or • Any one of the single control codes.Additional Rule Subset definitions . Affected Documentation: • • • Basic 4 . then: • 0x03 (Latch On/NUL) and 0x41 (Pulse On/Close) must perform the same function • 0x04 (Latch Off/NUL) and 0x81 (Pulse On/Trip) must perform the same function Single-function indices may permit one of the following control codes: • • • • • 0x01 (Pulse On/NUL) 0x03 (Latch On/NUL) 0x04 (Latch Off/NUL) 0x41 (Pulse On/Close) 0x81 (Pulse On/Trip) More than one of these codes may be accepted on a given index. • If the device is configurable per index to support a set of control codes.Complementary control function indices may permit either or both of these pairs. A Master device must be configurable to choose. each of the permitted codes must perform the same function on that index. a manufacturer might assign 0x41 to a breaker and 0x03 to a pseudo point. the outstation must accept at least one of the following control codes • 0x01 (Pulse On/NUL) • 0x03 (Latch On/NUL) • 0x04 (Latch Off/NUL) • 0x41 (Pulse On/Close) • 0x81 (Pulse On/Trip) 2 TB2000-006 • • 20-June-2001 . In DNP3 there is no significance to these codes providing the above restrictions are met. However. the vendor shall supply a points list with the Device Profile Document enumerating the codes. the Outstation must accept at least one of the following control code pairs • 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) • 0x41 (Pulse On/Close) and 0x81 (Pulse On/Trip). If it does: • control codes 0x03 (Latch On/NUL) and 0x41 (Pulse On/Close) must perform the same function • control codes 0x04 (Latch Off/NUL) and 0x81 (Pulse On/Trip) must perform the same function For single function indices. for each index: • Either one of the complementary control code pairs.Additional Tests Changes to the Subset Level 1 and 2 Conformance Procedures: Insert additional procedures in binary output section: Desired Behavior • For complementary function indices. A vendor must document the control codes its Slave devices support as follows: • If all indices support the same control codes. For example.Additional Rule Conformance Procedures . Vendors of slave devices are responsible for assigning control codes that are appropriate to their device. • If a fixed configuration of differing control codes is used for some or all of the indices. The outstation may optionally accept both forms of complementary control code pairs. • If the outstation accepts more than one control code for a single function index, it must perform the same function for each control code it accepts. Complementary Function Support 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. If the DUT does not have installed binary output points skip this section. If the DUT does not have installed complementary function binary output points skip this section. If the DUT does not support the 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) pair skip to step 8 Issue a valid control sequence to the first installed complementary function binary output point using control code 0x03 (Latch On/NUL). Verify the control operation completes successfully. Issue a valid control sequence to an installed complementary function binary output point using control code 0x04 (Latch Off/NUL). Verify the complementary control operation completes successfully. If the DUT does not support the 0x41(Pulse On/Close) and 0x81 (Pulse On/Trip) pair skip to step 13 Issue a valid control sequence to an installed complementary function binary output point using control code 0x41(Pulse On/Close). Verify the control operation completes successfully. Issue a valid control sequence to an installed complementary function binary output point using control code 0x81 (Pulse On/Trip). Verify the complementary control operation completes successfully. If the DUT does not support both the 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) control code pair and the 0x41(Pulse On/Close) and 0x81 (Pulse On/Trip) control code pair skip to step the next section. Issue a valid control sequence to an installed complementary function binary output point using control code 0x03 (Latch On/NUL). Verify the control operation completes successfully. Issue a valid control sequence to the same installed complementary function binary output point using control 0x81 (Pulse On/Trip). Verify that the complementary control operation completes successfully. Issue a valid control sequence to the same installed complementary function binary output point using control code 0x41(Pulse On/Close). Verify the complementary control operation completes successfully. Issue a valid control sequence to the same installed complementary function binary output point using control 0x04 (Latch Off/NUL). Verify the complementary control operation completes successfully. Single Function Support 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. If the DUT does not have installed binary output points skip this section. If the DUT does not have installed single function binary output points skip this section. For any point that is tested below, determine what action should happen when the control executes. If the DUT does not support the 0x01 (Pulse On/NUL) control code for single function binary output points at this index skip to step 7. Issue a valid control sequence to the first installed single function binary output point using control code 0x01 (Pulse On/NUL). Verify the control operation in step 3 completes successfully. If the DUT does not support the 0x03 (Latch On/NUL) control code for single function binary output points at this index skip to step 10. Issue a valid control sequence to the first installed single function binary output point using control code 0x03 (Latch On/NUL). Verify the control operation in step 3 completes successfully. If the DUT does not support the 0x04 (Latch Off/NUL) control code for single function binary output points at this index skip to step 13. Issue a valid control sequence to the first installed single function binary output point using control code 0x04 (Latch Off/NUL). Verify the control operation in step 3 completes successfully. If the DUT does not support the 0x41 (Pulse On/Close) control code for single function binary output points at this index skip to step 16. 3 TB2000-006 20-June-2001 14. Issue a valid control sequence to the first installed single function binary output point using control code 0x41 (Pulse On/Close). 15. Verify the control operation in step 3 completes successfully. 16. If the DUT does not support the 0x81 (Pulse On/Trip) control code for single function binary output points at this index skip to the next section. 17. Issue a valid control sequence to the first installed single function binary output point using control code 0x81 (Pulse On/Trip). 18. Verify the control operation in step 3 completes successfully. Last Updated: 20-June-2001 Status: Approved February 5, 2001 by General Membership 20-June-2001 4 TB2000-006 DNP Technical Bulletin 9905-001 Qualifier Code 11 (0x0B) Issue: The Basic 4 Application Layer document includes contradictory interpretations of fields associated with Qualifier Code 11. The use of Qualifier Code 11 must be clarified to permit consistent implementation of this feature. It is expected that the use of this qualifier will become more widespread with objects such as the File Identifier Object (Object 70). It is also desirable to be able to determine that Qualifier 11 usage correctly follows the interpretation indicated by this bulletin. Resolution: 1. Range Field The Range Field shall always be one octet when using Qualifier Code 11. The content of this octet specifies the number of objects that follow. 2. Object Size For each object (as indicated by the count value in the Range Field), the Object Size shall indicate the number of octets in the following Object Identifier and any following associated Object Data. By skipping forward this many octets, another Object Size field (as indicated by the count value in the Range Field), another Object Header or the end of fragment will be reached. This allows messages containing objects specified by Qualifier Code 11 to be parsed and the unrecognized objects ignored if the device does not support these objects. 3. Index Size Codes Qualifier Code 11 shall use the same definitions of Index Size code as used by all other Qualifier Codes. Index Size code 5 shall be used to specify the size of the object size prefix for each object that follows an Object Header using Qualifier Code 11. The obsolete Index Size codes (those defined for requests using Qualifier Code 11 that contain no data) shall be removed, leaving a single table of Index Size codes that are applicable in all situations. The use of Index Size code 5 with Qualifier Code 11 shall indicate that the Range Field and Object Size field are to be interpreted as defined by this bulletin. May 31, 1999 Page 1 of 6 plus Replacement Section 3.7.2 9905-001 Discussion: This section explains the basis for the analysis and resolution of Qualifier Code 11 issues. 1. Range Field The size of the Range Field (holding the Count of following objects) is described in separate places as being: • Always one octet • Sized according to the value of the Index Size field Only one of these interpretations is permissible. The following sections of the Basic 4 Application Layer document define the use and structure of object headers that include Qualifier Code 11. • Section 3.7.2 describes the Qualifier Codes. In the description of the “Free Format Qualifier” (Qualifier Code 11) this section states: “The Range Field is always a 1 octet value (Count) which specifies the number of object identifiers.” Section 3.7.3, figures 3-16 and 3-17 show examples for Qualifier Code 11 where the Range Field (Count of objects) is the same size as the object size field (i.e.: the Range Field is 1, 2 or 4 octets, for Index Size codes 1, 2 and 3 respectively). Sections 4.2.1, 4.2.2 and 4.3.1 show examples with Qualifier Code 11, Index Size 1 (Index/Qualifier octet value 0x1B). No examples are shown using Index Size codes 2 or 3 (specifying 2- or 4-octet Object Size fields). The associated text could be interpreted as suggesting either that the Object Count size is always one octet or that the Index Size sets both Object Count and Object Size to 1 octet. • • Currently, for all Qualifier Codes (other than 11), the selection of Qualifier Code value (alone) determines the form and size of the Range Field (i.e.: the Index Size code does not affect the form or size of the Range Field). To maintain consistency for all defined Qualifier Codes (0-9 and 11), the statement in Section 3.7.2 that the Range Field is always one octet must be observed. Therefore, figures 3-16 and 3-17 are rendered incorrect by this Technical Bulletin. For all Qualifier Codes (other than 11), the selection of the Qualifier Code value explicitly determines the form of the Range Field. If the statement in Section 3.7.2 (Range Field is always one octet) is observed, then the Qualifier Code alone will determine the size of the Range Field for all defined Qualifier Codes (0-9 and 11). In this case, the Index Size code only affects the size of each object’s index or object size fields, and never affects the size of the Range Field. This is a more consistent interpretation than to assume that figures 3-16 and 3-17 are correct and that the Index Size code also affects the size of the Range Field. May 31, 1999 Page 2 of 6 plus Replacement Section 3.7.2 9905-001 2. Object Size The Object Size field (holding the size in octets of the following object) is described in separate places as being the size of: • The object identifier but not the object data • The object identifier and the object data Only one of these interpretations is permissible. The following sections of the Basic 4 Application Layer document the use of the Object Size field specified in association with Qualifier Code 11. • Section 3.7.2 describes the Object Size field as being the size of the object identifier. It does not make explicit mention of object data: the description only mentions each object entry as consisting of a size and object identifier pairing. Section 3.7.3, figure 3-16 shows examples for Qualifier Code 11 with the Object Size being the number of octets in the object identifier. This figure does not include object data. Section 3.7.3, figure 3-17 shows examples for Qualifier Code 11 where the objects include data. Here the description explicitly states that the Object Size field is the count of octets in the object identifier only, and does not include the object data. Section 4.2.1 shows an example for Qualifier Code 11 with the Object Size being the number of octets in the object identifier. This example does not include object data. Section 4.2.2 shows an example for Qualifier Code 11 where the objects include data. Here the description explicitly states that the Object Size field is the count of octets in the object identifier and the object data. Section 4.3.1 shows an example for Qualifier Code 11 where the objects include data. Here the description explicitly states that the Object Size field is the count of octets in the object identifier and the object data. • • • • • The format of objects specified when using Qualifier Code 11 is a number of consecutive objects, each of which is preceded by a Size field indicating the size of that object. The size of each object may be variable, and the inclusion of the size permits each object to be parsed to its end. Thus a device parsing the object need not provide explicit support for the object in order to be able to parse to the end of the object(s) and process the remainder of the message. If the Object Size field includes the size of the object identifier and any following object data, it would not be necessary to interpret any part of the object identifier in order to be able to skip to the next field. It appears that this is the logical purpose for this construct. Therefore the Size field should include the number of octets in both the object identifier and the object data. 3. Index Size Codes The interpretation of Index Size codes for Qualifier Code 11 differ from the interpretation of Index Size codes for other Qualifier Code values, and the definition of these codes is May 31, 1999 Page 3 of 6 plus Replacement Section 3.7.2 9905-001 not consistently applied in various sections of the documents. A consistent interpretation of Index Size values for Qualifier Code 11 is required. The following sections of the Basic 4 Application Layer document the use of the Index Size codes (specifically with relation to Qualifier Code 11). • Section 3.7.2 defines the Index Size codes. This contains a description specifying a table of Index Size code values to be used in a Request (with no object data) using Qualifier Code 11 (codes 1, 2 and 3 only), and a table of values to use in all other cases. Section 3.7.2 defines Qualifier Code 11. Here it states that Qualifier Code 11 should be used with Index Size codes 4, 5 or 6 to define the object size. Section 3.7.3, figure 3-16 shows examples of requests or responses without data for Qualifier Code 11. These examples use Index Size codes 1, 2, and 3. Section 3.7.3, figure 3-17 shows examples of requests or responses with data for Qualifier Code 11. These examples use Index Size codes 1, 2, and 3. Section 4.2.1 shows an example of a request without data for Qualifier Code 11. This example uses Index Size code 1. Section 4.2.2 shows an example of a response with data for Qualifier Code 11. This example uses Index Size Code 1. Section 4.3.1 shows an example of a request with data for Qualifier Code 11. This example uses Index Size Code 1. • • • • • • All examples (sections 3.7.3 to 4.3.1) use Index Size codes 1, 2 or 3. This is only consistent with the Index Size code definition in Section 3.7.2 when used for requests without data. The definition of Qualifier Code 11 in Section 3.7.2 suggests the use of Index Size codes 4, 5 and 6 to specify the object size, and does not suggest codes 1, 2 or 3. This is consistent for use of Qualifier Code 11 in responses or in requests that contain data. The purpose of Index Size codes 4, 5 and 6 is to specify an object size. This is the same purpose achieved by Index Size codes 1, 2 and 3 for requests without data using Qualifier Code 11. Thus the special cases of Index Size codes for requests without data using Qualifier Code 11 are degenerate forms of codes 4, 5 and 6. The special cases may be eliminated completely by using Index Size codes 4, 5 and 6 for all cases to specify Object Sizes. It is likely that existing implementations using Qualifier Code 11 will have followed the examples from Sections 3.7.3 to 4.3.1, using Index Size codes 1, 2 or 3, and may have made either interpretation for size of the Range Field and the content of the Object Size field. Enforcing the adoption of Index Size codes 4, 5 and 6 in line with their usage for all other Qualifier Codes will differentiate conformant implementations from nonconformant (or possibly non-conformant) implementations. Note: To further simplify processing, only Index Size code 5 (specifying a 2-octet size field) shall be permitted with Qualifier Code 11. Page 4 of 6 plus Replacement Section 3.7.2 9905-001 May 31, 1999 Affected Documentation: Application Layer Section 3.7.3. Figures 3-16 and 3-17: Alter the diagrams for Qualifier Code 11: • • • Remove 2nd and 3rd examples Change “Size N1” and “Size NQ” fields to be 16-bit Change “Index Size MUST be 1” to “Index Size code MUST be 5” Figure 3-17: Replace the description after “Q-code 11; Index size MUST be 5” with: Octets Oi1 .. OiN form the object identifier for object i where 0<=i<Q (quantity) which is followed by the object identified (IDi). The size field Ni contains a count of the octets in the object identifier (Oi1 .. OiN) and the object identified (IDi). Note that the Size N+1 field is located Size N octets after the Size N field. Note also that it is not necessary to be able to interpret the object identifiers or data in order to be able to process the remainder of the message. Application Layer Sections 4.2.1, 4.2.2 and 4.3.1: In all diagrams showing Qualifier Code 11: Replacing Index Size code 1 with code 5. In the descriptions that follow diagrams showing Qualifier Code 11: Replace: • The qualifier code specifies a list of object identifiers in the identifier field and the range field is an 8 bit quantity. The size field is also an 8 bit quantity specifying that the object identifier plus data is ‘size’ octets in length. • The range field specifies the list contains 1 entry. The index size specifies that the quantity field and Size field are 8-bit in length. With: • The qualifier code 11 specifies a list of object identifiers in the identifier field. • The index size code of 5 specifies that a 16-bit object size field precedes each object. • The range field is an 8-bit quantity specifying the number of object identifiers that follow. May 31, 1999 Page 5 of 6 plus Replacement Section 3.7.2 9905-001 Application Layer Sections 4.17, 4.18 and 4.19: Figures 4-30, 4-32 and 4-34: In the Qualifier field, replace Index Size code 1 with code 5. Replace: • The qualifier indicates the range field is an 8 bit quantity specifying the number of object identifiers that follow With: • The qualifier indicates that the application identifier size field is a 16-bit quantity. • The range field is an 8-bit quantity specifying the number of object identifiers that follow. Application Layer Section 4.20: Figure 4-36: In the Qualifier field, replace Index Size code 1 with code 5. Replace: • The qualifier indicates the range field is an 8 bit quantity specifying the number of object identifiers that follow With: • The qualifier indicates that the configuration identifier size field is a 16-bit quantity. • The range field is an 8-bit quantity specifying the number of object identifiers that follow. Application Layer Section 3.7.2: Replace this section in its entirety with the reworded section appended below: May 31, 1999 Page 6 of 6 plus Replacement Section 3.7.2 9905-001 3.7.2 Qualifier Field The qualifier field specifies the meaning of the following Range Field. bit: 7 R 6 5 Index Size 4 3 2 1 0 4-bit Qualifier Code Figure 3-15 Qualifier Field R Reserved bit always set to 0 The Range Field is used to index data or as an identifier. The structure and use of the Range Field is dependent on the value in the Qualifier Code field. When the Range Field is used to index data, it often consists of a Start Range value and a Stop Range value. Together they define a range of objects in the data following the Object Header. Each of the Start Range and Stop Range sub-fields is termed as index. The Range Field may also be a single value, or may be absent if so specified by the Qualifier Code. A single value may be a count of the objects following the Object Header, or may specify the index range zero to (range field value – 1). Table 3-1 lists the commonly-used combinations of Qualifier Code and Index Size Code (Qualifier Field values), showing the size of the Range Field (in octets). DNP permits combinations of Qualifier Code and Index Size Code that are not shown in Table 3-1. These combinations are explained in Figures 3-16 and 3-17. Note that combinations that do not appear in Table 3-1 are rarely used in DNP implementations, and only where special conditions warrant their inclusion. It is recommended that only combinations appearing in Table 3-1 should be used. Explanations of the purpose of each Qualifier Code and Index Size Code appear following the tables. Description Range Field contains 8 bit start and stop indices Range Field contains 16 bit start and stop indices Range Field is omitted, entire range is specified Range Field contains an 8 bit object count Range Field contains a 16 bit object count Free Format Qualifier Qualifier Field (hexadecimal) 00 01 06 07, 17 08, 28 5B Range Size (octets) 2 4 0 1 2 1 Table 3-1 Commonly-Used Qualifier & Index Codes 3-24 May 31, 1999 9905-001 DNP User Group Index Size (3-bits) The 3 bit Index Size field specifies the size of the indices or object size prefixing each object. 0 1 2 3 4 5 6 7 = = = = = = = = objects are packed with no index prefixing them objects are prefixed with a 1 octet index objects are prefixed with a 2 octet index objects are prefixed with a 4 octet index objects are prefixed with a 1 octet object size objects are prefixed with a 2 octet object size objects are prefixed with a 4 octet object size Reserved Qualifier Code (4-bits) The Qualifier Code is used to specify the meaning of the Range Field. Qualifier Code values are: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 = = = = = = = = = = = = = = = = 8 bit start and stop indices in the Range Field 16 bit start and stop indices in the Range Field 32 bit start and stop indices in the Range Field 8 bit absolute address identifiers in the Range 16 bit absolute address identifiers in the Range 32 bit absolute address identifiers in the Range no Range Field (implies all the specified objects) 8 bit single field quantity 16 bit single field quantity 32 bit single field quantity Reserved free format qualifier Reserved Reserved Reserved Reserved • Start and Stop Sub-Fields in the Range Field (Qualifier Codes 0–5) The Range Field following the Qualifier field often contains sub-fields (Start Range and Stop Range) that designate a range of integer values starting numerically from Start Range (including the number Start Range) to Stop Range (including the number Stop Range). For Qualifier Codes 0, 1 and 2, Start Range and Stop Range are interpreted as indices of data. For Qualifier Codes 3, 4 and 5, Start Range and Stop Range are interpreted as virtual memory addresses. 3-25 May 31, 1999 9905-001 DNP User Group The Qualifier Code can be used both in the request and response messages as it can uniquely identify data objects whether they do or do not exist in the message. The Index Size field should be 0 in a data-less message to indicate no further indexing. The Index Size field can be 4, 5 or 6 in a message with data objects to indicate that each data object (with indices specified by the Range Field) has an object size prefix (with this size determined by the Index Size). A message with data can also use Index Size of 0 to indicate no more indexing. For Qualifier Codes specifying Start and Stop Indices in the Range, Index Size values of 1, 2 and 3 cannot be used. • All objects of the given object type (Qualifier Code 6) When the Qualifier Field equals 6, the length of the Range Field is 0 (i.e. no Range Field) because all the data objects of the specified type are being referred to. This qualifier can be used in messages with object headers only because it cannot uniquely identify data objects if they are present in the message. The Index Size should be set to 0 when this Qualifier Code is used. Qualifier Code 6 = no Range Field (implies all the specified objects) • Single field quantity (Qualifier Codes 7, 8 and 9) Qualifier Codes 7, 8 and 9 are used to indicate that the Range Field consists of a single count indicating the number of data objects in question. The Range Field that follows designates the number of objects referenced. If the Index Size field equals zero, the Range Field specifies the number of objects referenced starting numerically from 0 (including 0) to the value in the Range Field minus 1. If the Index Size field is 1, 2 or 3 then the Range Field specifies the number of indices and objects following the Range Field. Qualifier Codes 7, 8 and 9 can be used in the request and response messages. In a message with or without data objects, the value in the Range Field specifies the number of data objects to be referred to. The Index Size field should be set to the size of the indices that either pre-fix each data object (for messages with data objects) or that form a sequential list of identifiers. The Index Size field should not indicate an object size identifier as this would not uniquely specify the data objects in question and should be set to 0 if no identifiers or indices are following. The order of identifiers (and optional data objects) is arbitrary but should not consist of duplicate indices unless specifying distinct data instances for the same object (e.g.: multiple binary events for a single binary input). • Free-format Qualifier (Qualifier Code 11) 3-26 May 31, 1999 9905-001 DNP User Group This Qualifier Code is used to specify objects when other Qualifier Codes are inadequate or do not provide enough identifying information. Qualifier 11 is used only when the Range Field (index) cannot uniquely specify the data objects in question. In this case, the Qualifier Code defines a variable length array of octets (string) that contains the object. This object has a free-format and need not be interpreted in any way by the application layer. The Range Field is always a 1-octet value (Count) which specifies the number of objects. Following the Range Field are Count object size field/object pairs. The object size field that prefixes each object determines the size of the object (in octets). The size of the object size field is determined by the Index Size code. To simplify processing, only Index Size code 5 is permitted, specifying the size of the object size field to be 16-bits. • Reserved Qualifier Codes (Qualifier Codes 10, 12–15) Qualifier Codes 10 and 12–15 are reserved and should not be used. 3-27 May 31, 1999 9905-001 DNP User Group This page intentionally blank 3-28 May 31, 1999 9905-001 DNP User Group DNP Technical Bulletin 9912-002 Unsolicited Event Reporting: Retry Configuration Note: This Bulletin identifies a protocol revision approved by the DNP Technical Committee on December 8, 1999, subject to ratification by the DNP Users Group. Issue: Although DNP provides a method for reporting events through unsolicited reporting by exception (URBE), successful system deployment requires tuning of the reporting parameters on a system-by-system basis. This is due to variations in the performance of communication systems that cannot be universally predicted during design of a reporting device. For this reason, the Subset Level 2 Certification Procedure requires that a configurable timeout be included in devices supporting URBE. Due to the variations in communication system reliability, varying numbers of retries may be necessary before the URBE is successfully confirmed. In addition, experience has shown that in systems dictating a very low frequency of integrity polls, it can take an excessive amount of time to resume normal operation after a communication interruption. Thus, it is essential to also be able to configure the retry count such that retries continue on an indefinite basis until communication of the exception report is successful. Resolution: This Bulletin further extends the requirements for configuration of URBE in slave devices. Devices must support the ability of the end user or system integrator to choose the maximum number of URBE retry attempts during configuration. One of the choices must provide for an indefinite (and potentially infinite) number of retries. Affected Documentation: Level 1 and 2 Subset Definitions and Certification Procedures Modifications to Certification Procedure Insert additional Procedure: December 8, 1999 1 of 2 9912-002.doc (Section # TBD) Retries unsolicited responses configurable number of times 1. Configure DUT for a predefined number of retries. 2. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60, Variation 2; Object 60, Variation 3; and Object 60, Variation 4. 3. Verify that the DUT responds with a null response indicating the request was processed without error. 4. Disconnect the communication cable so that confirmations cannot be received in the slave. 5. Generate class 1, 2, or 3 event data. 6. Verify that an unsolicited response is transmitted. This may involve waiting for an amount of time, dictated by the DUT and specified by the DUT’s Device Profile Document, within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. 7. Verify that the unsolicited response requests an application layer confirmation. 8. Verify that DUT retries reporting until number of retries exceeds predefined number set in (1) above. 9. Repeat procedure, reconnecting communication cable after at least one retry. Verify that retries are terminated when confirmation is received. 10. Repeat procedure with indefinite retry count configured in DUT. 11. Verify that retries continue for an extended period of time. December 8, 1999 2 of 2 9912-002.doc DNP Technical Bulletin 9912-003 Broadcast Message Confirmation and Address Reservation Note: This Bulletin identifies a protocol revision approved by the DNP Technical Committee on December 8, 1999, subject to ratification by the DNP Users Group. Issue: Broadcast messages serve diverse needs for application functionality as well as for communication bandwidth optimization. However, these diverse requirements dictate different processing in response to the broadcast request. For example, in systems requiring simultaneous freezing of accumulated values (meter reading, load monitoring, etc.), writing the accumulator freeze application request to the broadcast address allows this function to be performed in parallel to multiple devices over communications. Because the delivery of messages to the broadcast address is not guaranteed, in this application it is essential for the master to reliably interrogate the IIN1-0 bit (All Stations Message Received) to know which slaves received the freeze request. The only way to do this is for the slave to inhibit clearing of IIN1-0 until it knows that the master has received the message. This is accomplished in DNP by having the slave’s next response include a confirmation request, and to suppress clearing of the IIN bit until the confirmation has been received. In contrast to the first example, consider the case where the message being broadcast is “Disable Unsolicited Messages” being sent to reduce communication traffic caused by a major system event. It may not be desirable to generate the additional communication traffic for subsequent requests particularly when the receipt of the original broadcast message was intended to reduce bandwidth usage. Both of the applications above may coexist in a single network. Thus it is desired that the confirmation of the receipt of the broadcast message be dynamically controlled by the master depending upon its requirements. The DNP specification does not explicitly require or preclude the use of application layer confirmations to confirm receipt of broadcast messages. Thus there is a need to further refine the specification to enhance interoperability. Resolution: Additional broadcast addresses will be assigned for the purpose of signaling the slave to request or suppress confirmation of receipt of the broadcast message. The December 8, 1999 1 of 3 9912-003.doc following device addresses are now reserved (Note: All addresses are in hexadecimal): FFFF Presently assigned broadcast address. When a message is received on this address, the slave must set IIN1-0 in the next message it transmits to the master that sent the broadcast message. The use of this address signifies that the slave implementation may determine whether or not to request confirmation of messages sent with IIN1-0 set (that would not otherwise require confirmation), and whether or not to require the receipt of that confirmation before clearing IIN1-0 in subsequent messages. This provides compatibility with existing implementations, and will provide the same behavior as either one or other of the addresses FFFD and FFFE. FFFE Messages sent to this address require that the IIN1-0 bit must be returned with the application layer request for confirmation bit (Application Control, bit 5) set. IIN1-0 may not be cleared in the slave until the confirmation is received. Note: If unsolicited event reporting is enabled, since IIN1-0 may be reported in conjunction with an unsolicited event report, this response (which requires confirmation) will serve as the notification that the All Stations message was received. FFFD Messages sent to this address request the IIN1-0 bit to be returned with the application layer request for confirmation bit (Application Control, bit 5) suppressed. IIN1-0 will be cleared in the slave upon transmitting the first response from the slave. Note: IIN1-0 may be reported in conjunction with responses to requests that otherwise require confirmation, or with an unsolicited event report, and since these requests/responses otherwise require confirmation, the confirmation will not be suppressed even though the message is sent with IIN1-0 set. Thus the use of the FFFD broadcast address implies that confirmation requests in responses sent with the IIN10 set should be suppressed, but that the confirmation may be requested if required by the details of the response being issued. FFF0–C These addresses are now reserved for future use. Affected Documentation: Basic Four Document Set, Level 1 and Level 2 Certification Procedures Changes to the Subset Level 1 and 2 Certification Procedures Insert additional Procedure: (Section # TBD) Broadcast Address Specifying Confirmed Response Options 1. Cycle the power to the DUT. 2. Issue a request for Object 60 Variation 2. December 8, 1999 2 of 3 9912-003.doc 3. Verify that the device responds with IIN1-7 set indicating the device has been restarted. 4. Issue a Write to Object 80 Variation 1 using the qualifier 0x00. Use a start index of 7 and a stop index of 7, followed by the value 0. Specify broadcast address FFFE. Request a data link layer confirmation. 5. Wait a reasonable application layer timeout, for example, 2 seconds. 6. Verify that the device does not respond, with either a data link layer confirmation or a response to the Write operation. 7. Issue a request for Object 60 Variation 2. 8. Verify the DUT responds with a Null Response with IIN1-7 (restart) cleared and IIN1-0 (all stations message received) set, and an application layer confirmation requested. 9. Before sending the requested confirmation, repeat the request for Object 60 Variation 2, and verify that IIN1-0 is still set in the response. 10. Send the application layer confirmation. 11. Issue a request for Object 60 Variation 2. 12. Verify the DUT responds with a Null Response with both IIN1-7 and IIN1-1 cleared. 13. Repeat steps 1-12 using address FFFD as the broadcast address. In step 8, verify that an application layer confirmation is NOT requested. In step 9, verify that IIN1-0 is not set in the response. Note: Step 10 will not be necessary. December 8, 1999 3 of 3 9912-003.doc DNP V3.00 Technical Bulletin 9804-001 Rules for Synchronizing Application Sequence Numbers Issue: The DNP V3.00 Application Layer specification discusses how to use and increment application layer sequence numbers to detect duplicate messages. However, it does not specify how these sequence numbers should be initialized or synchronized between two devices. Because of this, it is possible for a device to erroneously believe it has received a duplicate message if it or its peer device has recently restarted. Furthermore, the specification does not discuss how a device receiving a broadcast message should interpret the sequence number. This is a problem because each device on a broadcast link may be expecting a different sequence number. Resolution: 1. The receiver (master or slave) of a broadcast message does not check the sequence number. Multi-fragment broadcast messages are not permitted. 2. The receiver (master or slave) of a non-broadcast fragment always checks the sequence number against that of the previous fragment received, except as noted in (5) and (6) below. 3. If the sequence number matches the previous fragment, the receiver compares the incoming fragment and the previous fragment byte-by-byte. This comparison was not specified in the original DNP Application Layer description. 4. If both messages match byte-for-byte, then the receiver responds with the same data it sent as its previous response but does not perform any further action. 5. If a Master is receiving an unsolicited response and the RESTART IIN bit is set, the master accepts and executes the message regardless of sequence number, then clears the device’s RESTART IIN. (This need not be a special case, since the RESTART bit will necessarily make the unsolicited response at least one bit different that the previous one.) It continues checking sequence numbers thereafter. 6. A device that has just restarted always accepts and executes the first message it receives, regardless of sequence number. It begins checking sequence numbers thereafter. 7. A Master must never perform application layer retries of output operations, i.e. never send two output messages with the same sequence number for SELECT, OPERATE, or DIRECT OPERATE function codes. Affected Documentation: DNP V3.00 Application Layer Chapter 3: Definition of DNP Message Fields Section 3.2: Communication Flow Control Section 3.3: Master Request & Unsolicited Response Collisions April 22, 1998 1 of 1 9804-001.doc DNP Technical Committee Technical Bulletin 9804-002 DNP Confirmation and Retry Guidelines DNP V3.00 Technical Bulletin 9804-002 DNP Confirmation and Retry Guidelines 1. Introduction There has been significant confusion about the usage of Link layer confirmations vs. Application layer confirmations and when neither, one or both should be used. The general users group membership has requested that the Technical Committee provide a guideline on this subject. It is the purpose of this document to review what we are trying to accomplish by the confirmation mechanisms and present a general guideline for how to use these services effectively. This guideline supersedes the recommendations presented in the Subset Definitions Revision 2.00 Dated November 1995. 2. 2.1 Background Why are confirmations necessary Certain operations a SCADA (Supervisory Control and Data Acquisition) Remote Electronic Device must perform require a mechanism to verify that the recipient of a transmission received that transmission correctly. A classic example is the processing of Status (or Binary Data) changes that have been queued in the remote device. This data is sometimes referred to as Sequence of Events (SOE) data. The remote station must insure that the data transmitted to the host remains in order so that a recreation of the real world “scenario” of status changes can be accomplished by the end user. It must also guarantee that no data is lost in the transmission process. In the above example a remote device may have 100 binary changes queued to report to its host. The host may, however, request that only 20 changes be returned in the current request. The remote device must have a mechanism for determining when and if the host received the 20 changes so that it can 1. Remove those changes from its change queue 2. Know what to return in the next request 2.2 What are Application Layer Fragments Each DNP message can consist of one or more application layer “fragments”. Each fragment contains a whole number of DNP objects, qualifiers, and point indices and is “Parsable” without any additional assembling of partial messages (otherwise referred to as fragments or packets). In other words, a DNP application layer is a “Understandable and Fully Digestible” piece of SCADA information. 2.3 What are Application Layer confirmations A remote device can request that the receiving station (host) send an application layer message in response to its’ transmission indicating that it received and understood the fragment. Furthermore, the host only responds to the confirmation request if it can process the message (e.g. it has room in its database for the information). April 22, 1998 1 of 6 9804-002.doc DNP Technical Committee Technical Bulletin 9804-002 DNP Confirmation and Retry Guidelines 2.4 How the Application Layer Confirmation mechanism works When a remote station transmits vital information (usually event data) that must not be lost and can not be reproduced (e.g. static data is easily reproduced so it is usually not confirmed) It requests that the host station send a confirmation message. This confirmation message indicates that the message was received, understood, and processed (or will be processed) by the host. The remote device has therefore transferred responsibility for transmission of this data to any subsequent destinations to the host. It can confidently delete these items from its change buffers. 2.5 What are Link Layer Frames Each application layer fragment is made up of one or more link layer “frames”. For small messages there will be one link layer frame for each application fragment. For large messages there will be several link layer frames for each application layer fragment. Link frames are not necessarily parsable by themselves. For example, it may take 5 link layer frames combined together to form a large DNP object that can be parsed by the application Layer. 2.6 What are Link Layer confirmations When a remote device transmits a link layer frame it can request a link layer confirmation from the host station. When requested, the host station will transmit a link layer confirm frame to the remote station indicating that it received that frame and that it was properly formatted. 2.7 How the Link Layer Confirmation mechanism works In theory a remote station can guarantee delivery of each frame sent to the host station by requesting a link layer confirmation for each frame. If it receives a confirmation for each and every frame in a transmission it can be assured that the host accepted the formatting of the frames and that they arrived without any CRC errors. It cannot, however, determine whether the frames were assembled correctly, or whether the host understood the objects contained within the assembled application fragment. Only the application layer confirmation can guarantee this. 2.8 Retransmissions When the remote device requests either an application layer or a link layer confirmation it waits a specified period of time before proceeding on to its next task. If the confirmation is not received within this period of time the request is deemed to have “timed out” and the remote device can either give up for this transmission or try again, retransmitting the exact same message again. The number of times a device will try again is set to a relatively low number (usually 3). Retransmissions can cause synchronization errors in the dialog between the remote device and the host if one party retransmits and the other was not expecting it. In particular, this can cause collisions in a Frequently Polled environment. Retries can be used in some cases, but require careful consideration • In half-duplex systems, it is possible to configure polling intervals and timeouts large enough to allow for all possible retries from a device. However this practice sometimes makes polling intervals larger than desired. • The use of collision avoidance in the data link and/or physical layers makes retries possible. • Retries are recommended in the case of unsolicited responses, since collision avoidance is required as a matter of course. If retries were not employed the master will not be expecting the unsolicited April 22, 1998 2 of 6 9804-002.doc DNP Technical Committee Technical Bulletin 9804-002 DNP Confirmation and Retry Guidelines data and therefore will not know that it is missing. It should also be noted that the successful application of retries using collision avoidance techniques depends on several factors. Among the most important factors include the robustness of the collision avoidance mechanism employed and the load on the communications channel. If the mechanism is unable to avoid a collision, retries may aggravate the situation and further reduce effective bandwidth of the communications channel. As with any communications system, careful attention must be paid to bandwidth allocation and management for a successful system design. In particular, overloading communications circuits will have undesirable effects on system performance. In a frequently polled configuration overloaded circuits will elongate polling cycles (e.g. scans per second). In an unsolicited response configuration overloaded circuits will render response times non-deterministic during periods of peak activity. 3. • Summary It is recommended that Application layer confirmation be used for binary event data and data link confirmations be disabled for all data for the following reasons. 1) For most messages Link Layer confirmations are redundant. 2) Link layer confirmations do not insure that the host understands the data sent therefore… a) Application confirms are required for event data anyway. 1) It only costs 5 bytes of additional overhead to use a more robust confirmation mechanism. 2) There is less ambiguity associated with the sequencing of fragments. It is recommended that Application Fragment size be reduced as necessary in extremely noisy environments which will provide similar performance to link layer confirms. This parameter should be selectable. NOTE: Due to the requirement that each application fragment be independently parsable, DNP developers should consider that the application layer fragment cannot be reduced to smaller than the largest object to be transferred, plus headers and overhead. It is recommended that retries be disabled in frequently polled environments. Retries are recommended in unsolicited response configurations, but careful consideration must be given to communications circuit loading. These recommendations do not eliminate the requirement for devices to respond correctly to frames requiring data link confirmation. Devices must respond with CONFIRM - ACK or CONFIRM NACK frames (as specified in the protocol documentation) to any SEND/CONFIRM frames they receive. • • • • 4. 4.1 Discussion Why Application Layer Confirms are preferred 4.1.1 Link Layer Confirms are Redundant For most remote station responses that amount of data returned will fit in one link layer frame. This results in there being one link layer frame for each application layer message. Since we can not determine from a link layer confirmation whether the host understood our message we need to request an application layer confirmation for critical data anyway. This makes the link layer confirmation redundant. April 22, 1998 3 of 6 9804-002.doc DNP Technical Committee Technical Bulletin 9804-002 DNP Confirmation and Retry Guidelines It should be noted that almost every Level 1 device (IEDs) returns its’ entire static data set in one application fragment using only one link layer frame. In fact, at 9600 baud a full link layer message takes approximately 1/3 of a second to transmit. In a typical Multi-dropped environment where the host will poll each device for data in a round robin fashion, IEDs returning one full link frame per response would limit the channel to 6 IEDs per port to maintain the typical 2 second update requirement of most SCADA systems. This estimate does not include the time required by the host to transmit the request or the latency in the turn around time of the remote device or the key-on time of the communications circuit. In the “Real World” a 2 second update can be guaranteed for 3-4 IEDs that return full link layer frames assuming normal latencies. If you add a link layer confirm to every packet you add at least 10 mS to each exchange between the host and the remote device, not including device latency or communications latency. Devices capable of report-by-exception greatly alleviate this problem by transmitting only the data that has changed since the last request. In the steady state most responses indicate nothing has changed since the last poll and consume only 17 mS per response. A host can manage (or limit) how much event data the remote device returns by specifying a maximum number of events to return in the request, thereby guaranteeing worst case turn around time. 4.1.3 Assures understanding not just reception Application layer confirmations guarantee that the data transmitted by the remote was assembled and understood. Link layer confirmations guarantee that the frame arrived with no bit errors. For critical data, arrival without bit error is not sufficient cause to delete the information from the remote’s change buffers. Confirmation of proper assembly and understanding of the message are required before a remote can transfer responsibility of data deliver to the host. Application layer confirmations alone can provide this information. 4.1.4 Marginal performance penalty A link layer confirmation requires 10 bytes to transmit. An application layer confirmation requires 17 bytes to transmit. That is approximately 7 mS at 9600 Baud. It can argued that the latency of device (time required to begin transmitting) is less for link layer confirms than for application layer confirms. While this is highly implementation specific and may in some cases be true, the actual latency is often dwarfed by the turn on time of the transmitter (e.g. radio). In any case, we have shown previously, that for critical data a link layer confirmation is redundant because an application layer confirmation is required anyway. 4.1.5 Application sequencing is more robust Link layer frames are much more susceptible to synchronization errors that are Application layer fragments. Link layer services provide a single bit that toggles for detecting packet ordering. Application layer services provide an incrementing sequence number for detecting packet ordering. Sequence numbers are significantly more robust, and less susceptible to synchronization errors. 4.2 Noisy Environments 4.2.1 Smaller packet sizes at higher bit error rates In high bit error rate (noisy) environments, the probability of an error being introduced into a transmitted packet increases with the length of the packet. Therefore, the smaller the packet the lower the probability there will be an error in that packet. When large application layer messages are made up of several link frames it was intended that each link frame be confirmed individually to minimize the risk of having to resend the entire application layer fragment because one link layer frame was corrupted. Since the April 22, 1998 4 of 6 9804-002.doc DNP Technical Committee Technical Bulletin 9804-002 DNP Confirmation and Retry Guidelines performance penalty for application layer confirms is not significant the same thing can be accomplished by reducing the application layer fragment size. This has the added benefit of intelligently requesting confirms as well. 4.2.2 Only Application layer fragment size sets reliability Typically link layer frame size is not selectable while application layer fragment size is. Since the link layer frame size is fixed, the probability of error cannot be reduced below Plinkerror where: Plinkerror = (1 – Pnbitscorrect) Plinkerror = (1 –(Ponebitcorrect )n ) Plinkerror = (1 - (1 - BER)n ) BER = Bit Error Rate n = 296 Reducing application layer fragments sizewill correspondingly reduce the transmitted link layer frame size (e.g. reducing n) and realize a reduction of error probability beyond that provided by link services (e.g. Perror = (1 - (1 - BER)n )). It should be noted that by reducing application size below link layer size: • the probability that any one piece of data will make it successfully in high noise environments is increased. • the number of turn arounds necessary for large amounts of critical (event) data is increased. • a practical minimum is no smaller than the largest application object that must be transmitted plus overhead. And 4.3 Retries and Polling 4.3.1 Stepping on your neighbors toes Application or Link layer retries are not recommended for use in frequently polling environments. If a remote device requests a confirmation from the host and it does not receive it, the remote device should wait for the next request to send the information again. If the remote device were to retry it is highly likely that the host has moved on the next remote device in the polling loop. According to Murphy, that device will be transmitting its response to the host request when the first device retries and causes a collision. Even in cases when there is only one device on a line, the device may retry while the host is sending the next request and cause a collision. 4.3.2 No real benefit In a polling environment each request can be viewed as an invitation for the remote device to place data on the share communications circuit. The host acts to manage the bandwidth on the link so the collisions DO NOT occur, and that the response is predictable under all situations. If any on response is lost, the host will ask again allowing the remote device to re-send its data. This is effectively a managed retry anyway, but has eliminated the possibility of collisions. 4.4 Retries and Unsolicited Responses In a system using unsolicited responses, the physical layers and data link layers of the devices together manage the bandwidth on the link and avoid collisions. Retries are therefore not a liability in this situation, April 22, 1998 5 of 6 9804-002.doc DNP Technical Committee Technical Bulletin 9804-002 DNP Confirmation and Retry Guidelines because (e.g.collisions) rarely occur. In fact, retries are a requirement when unsolicited responses are used. Unsolicited data is by definition not expected by the master, and therefore it does not know to request the data it is missing. The burden is therefore on the remote device to ensure it gets through. 4.5 Unconfirmed User Data Only Since we are not recommending the use of link layer confirmations, the Frame Control Bit (FCB) and its associated logic and problems become unnecessary. If you plan never to request a link layer confirm then there is not need to reset the link, or incorporate the added complexity in the device implementation. Note however, that all devices must nevertheless respond to RESET LINK and confirmed user data frames with the appropriate ACK or NACK frames. This is required for interoperability. 5. Conclusion. It is the recommendation of the technical committee that link layer confirmation services not be used, but that unconfirmed user data services be used at the link layer, and that application layer confirmation services be used exclusively. It is further recommended that in high bit error rate environments (noisy) that the application fragment size be reduced accordingly. Finally, Application layer or link layer retries should never be used by a slave device in a frequently polled environment but are acceptable in a unsolicited response environment assuming adequate collision recovery techniques are used. Note: Despite the above recommendations certain devices may not be able to receive unconfirmed data link frames back to back. If a device is capable of generating multiple link layer frames in a single response it is recommended that it also be able to enable, via configuration, data link confirm requests for flow control. April 22, 1998 6 of 6 9804-002.doc DNP V3.00 Technical Bulletin 9804-003 Recommended Layer Terminology Issue: Some User’s Group members have had difficulty discussing protocol issues because the DNP documentation does not distinguish well between the sections of DNP messages defined at the Data Link Layer, Transport Function, and Application Layer. Resolution: This bulletin formally distiguishes between an Application Layer fragment, a Transport Function segment, and a Data Link Layer frame, and clarifies how these terms relate to the Open Systems Interconnect (OSI) terminology used in much of the Basic 4 documentation. OSI terminology refers to a Service Data Unit (SDU) and a Protocol Data Unit (PDU). The SDU is the data presented to the service (upper) interface of a protocol layer by the layer above. The PDU is the data actually formatted by the layer and passed to the layer below. In the DNP 3-layer model, “PDU” or “SDU” may be preceded by “Application”, “Transport” or “Link”. Therefore, an APDU is the data transferred from the application layer to the transport function, and may also be called a TSDU. The following table defines fragment, segment, and frame and their corresponding OSI terms. Function Application Layer Common DNP Name Fragment Consists of... Application Header, Object Headers, Object Data OSI Term APDU, TSDU Function and Use A response to a request may consist of multiple fragments. Each fragment must be separately parseable. Fragmentation at the application layer permits the setting of an upper limit on the parsing buffer required by the receiving side. The recommended maximum fragment size is 2K, per the DNP V3.00 Subset Definitions. Segmentation breaks up a fragment into pieces that will fit in a Data Link Layer frame. A segment need not be parseable. Each segment contains a Transport Header, but only the first segment of any fragment contains an application header. A segment consists of up to 250 octets, 249 of which are application layer data. The data link layer uses a small frame size relative to the application data to ensure excellent error detection and recovery. A frame may be up to 292 octets including all headers and CRCs. Transport Function Segment Transport Header + part of an APDU TPDU, LSDU Data Link Layer Frame Data Link Header + CRCs + complete TPDU LPDU Affected Documentation: DNP V3.00 Transport Functions Chapter 2 April 22, 1998 1 of 1 9804-003.doc DNP V3.00 Technical Bulletin 9804-004 Virtual Terminal Objects 112 and 113 Issue DNP 3.0 does not define a protocol suitable for arbitrary, unstructured data flow between Master and Slave sides of a link. Many IEDs (Intelligent Electronic Devices) have a separate serial interface used for configuration and diagnostic purposes and directly interfaces with either dumb terminals or portable computers. The intent of this Virtual Terminal (VT) Protocol is to allow data transfers which previously required a separate physical connection to a non-DNP port to proceed over the existing DNP port. Support for VT is optional at the discretion of the IED vendor. Resolution The VT protocol is defined to be the emulation of one or more independent communication links between the Master and Slave devices which can exchange data. Each Slave communication channel is assigned a Virtual Port number. These communication links transport proprietary protocols and are typically used during initial testing and commissioning of a complete system. The VT proposal is modeled after the TELNET portion of the Internet Protocol Suite. This Technical Bulletin defines the VT protocol which can be used with DNP 3.0 devices. Two new DNP objects are defined, along with the procedures for accessing these objects. Both polled and report-by-exception (RBE) environments are supported. A number of observations are made regarding this protocol along with recommendations to vendors and integrators concerning tradeoffs. Finally, rules are defined for VT devices. Two new objects are defined. Object 112 is named the “Virtual Terminal Output Block” which is a static object structured identically to object 110 (Octet String Object). This object is used only with the Function code WRITE (FC=2) to send data from the Master side to the Slave side of the link. Object 113 is named the “Virtual Terminal Event Data” which is an event structured identically to object 111 (Octet String Event Object). This object is used to send data from the Slave side to the Master side of the link. Master devices may use only Function codes READ (FC=1) or ENABLE UNSOLICITED MESSAGE (FC=20) or DISABLE UNSOLICIED MESSAGES (FC=21) or ASSIGN CLASS (FC=22) with this object whereas Slave use only Function codes RESPONSE (FC=129) or UNSOLICITED MESSAGE (FC=130). These objects obey the usual DNP rules for static and event objects except that object 112 is NEVER returned in a Class 0 poll. In particular, object 113 can be assigned to Classes 1-3, optionally support the assign class function code, and optionally be sent in an unsolicited response. The procedure for accessing these objects is as follows. Master devices transmit data to slave devices by WRITEing one or more of object 112 to a Slave using the Virtual Port number as the DNP point number. Slaves send information to the Master using the Virtual Port number either by responding to a Master READ (FC=1) request of object 113 or using an Unsolicited Response message (FC=130). Messages can flow in either direction at any time. There are no explicit procedures for the initiation or conclusion of a VT session (i.e. implicit connections exist by the mere presence of a VT compatible Slave IED). April 22, 1998 1 of 3 9804-004.doc In the following (hypothetical) example of a VT session, xx/yy is the object number and variation and all message use point 0: 1. Master: 2. Slave: 3. Master: 4. Slave: Master) 5. Master: 6. Slave: 7. Master: 8. Master: 9. Master: 10.Slave: Write 112/1, data=13 decimal= <CR> (our wakeup command) respond only IIN (FC=129, two IIN bytes) Read 113/0 respond with IIN only (Slave has no data to send to Read 113/0 respond with Write 112/6, Write 112/7, Read 113/0 respond with 113/3, data= "OK"<CR> data= "CLEAR"<CR> (clear slave command) data= "LOGOFF"<CR> (end the IED session) 113/7, data = "OK"<CR>"BYE"<CR> (at this point, the Master somehow knows that the Slave will not send additional messages and therefore it can cease polling the Slave VT port 0) The above example illustrates a few important points: Line 4 shows how Slaves respond when no data is available for transmission to the Master Line 7 and 8 show how a Master could send any number of messages without polling for responses Line 10 shows that Slaves MAY accumulate responses (they could also respond with two separate Messages). Not shown is that Masters could poll for Slave responses without sending data. Responsibility for VT maintenance is split between the Master and Slave. The Master is responsible for maintaining an environment that allows Slaves responses to be sent in a timely manner. In a polled system, the Master must periodically poll for Slave responses whenever a response is possible. In an unsolicited response environment, the Master must ensure that the background data traffic is at a low enough level to ensure that Slave responses can be sent without impacting more important event data. Slaves are responsible for generation of VT messages either in response data sent by the Master or spontaneously. Observations • The VT definition allows users to interactively “log onto” an IED without requiring another serial communication channel beyond the required DNP port. No structure has been defined for the data passing in either direction. There are two implications of this: • any octet oriented protocol (including both binary and ASCII) can be sent over VT • there is no pre-defined "end-of-transmission" indicator. The lack of an "end-of-transmission" indicator implies that Masters must continuously poll every possible Slave VT port unless responses will never be generated. Three conditions allow Master to cease polling: • Slave device is not VT capable • the system is pre-configured for only unsolicited responses • (somehow) the Master knows that responses cannot be sent from a VT-capable Slave Since DNP requires point numbers to begin at zero, every VT-capable Slave must support Virtual Port 0 VT traffic will use some DNP bandwidth. There is an implicit assumption made that excess DNP bandwidth is to be traded for access to other communication channels within the IED. • • • April 22, 1998 2 of 3 9804-004.doc If there is no excess bandwidth, using VT to support high-priority IED communications is pointless. Recommendations • • Masters should have some method to attempt retries of data transfer. If a human issues commands, then this may be as simple as asking the human to repeat the command. Masters should have some means to determine the "end-of-transmission". Again, if a human issues commands, this could be as simple as forcing the user to "disconnect" from the IED when finished. If a Slave device has multiple communication ports with different capabilities, Virtual Ports should also be provided. This allows a one-to-one mapping of physical ports to virtual ports. Note that additional virtual ports could provide flexibility which does not exist at the physical connection level. IEDs with large amounts of data transportable over VT should make provisions for limiting the usage of the DNP link by VT. Possibilities include the ability to disable unsolicited reporting and allowing configuration of object 113 to Class 1 or Class 2 or Class 3 polls. Limiting the length of the message strings both ensures maximum compatibility with memory-limited devices and allows other higher priority messages to be interspersed with VT messages. Note that a single data link fame accommodates up to a 240 octets VT message. • • • Rules • • • Object 112 is used only with the WRITE function code from the Master. Reads are not allowed. The point number(s) to be used for VT must appear in the Device Profile Document. Slaves which support VT must support the Response function code (FC=129). They may optionally support Unsolicited Response and Assign Class functions. Affected Documents DNP 3.0 Data Object Library Chapter 14: New chapter name to be determined. April 22, 1998 3 of 3 9804-004.doc DNP Technical Bulletin 9804-005 8-Bit Unsigned Integer Object 102 Issue: Some devices require the capability to read and write single-byte values, for which the existing analog input and output values are insufficient. Resolution: A new object, Object 102, is defined as an 8-bit Unsigned Integer Object Reading and Writing of 8 bit memory locations could be implemented using this object together with absolute addressing qualifiers. Please refer to the following Object Definition for Details. Affected Documentation: DNP V3.00 Object Library Chapter 13: Alternate Numeric Object Definitions April 22, 1998 1 of 2 9804-005.doc This object is not included in Class 0 poll response.. For this object only read. Object Coding: Current Value [0] 7 0 Type: Static UI1 = SQ1 { Current Value = UI [0.doc .8-Bit Unsigned Integer Object Data Object 102 Variation 1 Description: The 8-Bit Unsigned Integer Object represents a value from 0 to 255.255>} April 22.7] <0.. write and response function codes are permitted. 1998 2 of 2 9804-005. 32. It is recommended that existing group 100 objects not be used in the future. Short and Long Floating point variations have been added to object groups 30. The extended format used in Object 100 Variation 3 has not included. These variations shall not be part of any current subset definition. The floating point variations of objects 30. 32. 33. 31. Note that this includes floating point outputs as well as static.DNP Technical Bulletin 9804-006 Analog Object Floating Point Variations Issue: The DNP User’s Group required a definition for a standard implementation of Floating Point Objects and Floating Point Event Objects. An alternate mechanism for providing this information may be provided in the future. Events can be reported with or without timestamps. 31. Resolution: Floating Point Object reporting is defined as follows: • • • The existing object group 100 is not designated “Static”. 33.00 Data Object Library Chapter 6 Analog Input Object Definitions Chapter 7 Analog Output Object Definitions Chapter 13 Alternate Numeric Object Definitions April 22. 1998 1 of 199 9804-006. It is appropriate for the device to set the over-range flag if necessary due to conversion problems. frozen and event floating point inputs. 40 and 41 do not include the Units field used in Object 100. These are required for representation of analog quantities in floating point format. When not configured to force reporting as integer. it is necessary to specifically request that group. it must provide a configuration mechanism that will force these points to be reported as integers when polled for Class Data or variation zero (0). 40 and 41. Attached Object Definitions specify details.doc . If a device supports these floating point variations. a remote device may default to responding to a request for Class Data or variation zero (0) by reporting some data as integer and some data as floating point. To read a group 100 value. • • • Note: • • Affected Documentation: DNP V3. The format of this object complies with the IEEE-754 standard for floating-point number representation. and follows the format for a short real as specified by the IEEE-754 standard.7] <0..223-1> } } April 22.255> Mantissa = UI23 [0.. 1998 2 of 199 9804-006.Variation: 05 Description: The Short Floating Point Analog Input information object represents a hardware or software analog point. The flag field holds information about the point and has the same meaning as previous objects with the following additions: The over-range field indicates that the analog signal is out of range for the A to D converter to process. Object Coding: Flag 7 0 Value S Exponent 0 7 0 *S = Sign Type: Static Mantissa 22 0 SQ2 { Flag Value = = BS8 [0. The value field holds the current floating point value of the analog input at the time of reporting or the last reported value from the originating device.SHORT FLOATING POINT ANALOG INPUT Data Object 30 .doc . positive. The reference check field indicates that the reference signal used to digitize the analog input is not stable and the resulting digitized value may not be correct...7] R32 { Sign = BS1 [0] <0. 1. negative> Exponent = UI8 [0.22] <0.. s22 s21 s20 s19 s18 .7] 0 if number is positive... s0 x 2 (Exp -127) Mantissa[0.Narrative: The absolute value can be derived from the value field as follows: Absolute_Value where: and Sign: Exponent: Mantissa: si Exp = = = 1. 1998 3 of 199 9804-006..22] Exponent[0.Mantissa). Power of 2 applied to (1. and 1 if the number is negative. April 22.doc . Binary digits in value following the binary point. .doc ..2047> Mantissa = UI23 [0. and follows the format for a long real as specified by the IEEE-754 standard. The value field holds the current floating point value of the analog input at the time of reporting or the last reported value from the originating device.LONG FLOATING POINT ANALOG INPUT Data Object 30 .7] R64 { Sign = BS1 [0] <0. 1998 4 of 199 9804-006.51] <0.10] <0. 1. positive..Variation: 06 Description: The Long Floating Point Analog Input information object represents a hardware or software analog point.252-1> } } April 22.. negative> Exponent = UI8 [0. The format of this object complies with the IEEE-754 standard for floating-point number representation.. The flag field has the same meaning as the flag field of Object 30 Variation 5. Object Coding: Flag 7 0 Value S Exponent 0 10 0 *S = Sign Type: Static Mantissa 51 0 SQ2 { Flag Value = = BS8 [0. April 22. 1998 5 of 199 9804-006...51] and Exponent[0.Narrative: The absolute value can be derived from the value field as follows: Absolute_Value where: Sign: Exponent: Mantissa: si Exp = = = 1. Binary digits in value following the binary point.. s0 x 2 (Exp -1023) Mantissa[0.Mantissa). Power of 2 applied to (1. and 1 if the number is negative.10] 0 if number is positive.s51 s50 s49 s48 s47 .doc . 22] <0...255> Mantissa = UI23 [0. and follows the format for a short real as specified by the IEEE-754 standard. 1.7] <0. positive.Variation: 07 Description: The Short Floating Point Frozen Analog Input information object represents a frozen hardware or software analog point. 1998 6 of 199 9804-006. The flag field has the same meaning as the flag field of Object 30 Variation 5.doc . This field is as described for the value field of Object 30 Variation 5. The format of this object complies with the IEEE-754 standard for floating-point number representation.. negative> Exponent = UI8 [0.SHORT FLOATING POINT FROZEN ANALOG INPUT Data Object 31 .7] R32 { Sign = BS1 [0] <0.. Object Coding: Flag 7 0 Frozen Value Mantissa 22 Type: Frozen Static S Exponent 0 7 0 *S = Sign 0 SQ2 { Flag Value = = BS8 [0.. The frozen value field holds the floating point value of the analog input at the time of the last Freeze command was completed on this point.223-1> } } April 22. 7] R64 { Sign = BS1 [0] <0.LONG FLOATING POINT FROZEN ANALOG INPUT Data Object 31 .. The flag field has the same meaning as the flag field of Object 30 Variation 5.51] <0.Variation: 08 Description: The Long Floating Point Frozen Analog Input information object represents a frozen hardware or software analog point.. Object Coding: Flag 7 0 Frozen Value Mantissa 51 Type: Frozen Static S Exponent 0 10 0 *S = Sign 0 SQ2 { Flag Value = = BS8 [0.2047> Mantissa = UI23 [0. The frozen value field holds the floating point value of the analog input at the time of the last Freeze command was completed on this point..doc .10] <0.. positive..252-1> } } April 22. The format of this object complies with the IEEE-754 standard for floating-point number representation. negative> Exponent = UI8 [0. This field is as described for the value field of Object 30 Variation 6. 1. 1998 7 of 199 9804-006. and follows the format for a long real as specified by the IEEE-754 standard. doc . negative> Exponent = UI8 [0. The format of this object complies with the IEEE-754 standard for floating-point number representation.255> Mantissa = UI23 [0.Variation: 05 Description: The Short Floating Point Analog Change Event information object represents a changed hardware or software analog point..7] <0.22] <0. The value field holds the current floating point value of the analog input at the time of reporting or the last reported value from the originating device.. Object Coding: Flag 7 0 Value S Exponent 0 7 0 *S = Sign Type: Event Mantissa 22 0 SQ2 { Flag Value } = = BS8 [0.SHORT FLOATING POINT ANALOG CHANGE EVENT Data Object 32 .. 1.223-1>} April 22. This object is only reported when an event occurs such as a deadband excursion. and follows the format for a short real as specified by the IEEE-754 standard... The flag field has the same meaning as the flag field of Object 30 Variation 5. 1998 8 of 199 9804-006. positive.7] R32 { Sign = BS1 [0] <0. This field is as described for the value field of Object 30 Variation 5. . 1998 9 of 199 9804-006.Variation: 06 Description: The Long Floating Point Analog Change Event information object represents a changed hardware or software analog point. negative> Exponent = UI8 [0.7] R64 { Sign = BS1 [0] <0.doc . positive.. 1. Object Coding: Flag 7 0 Value S Exponent 0 10 0 *S = Sign Type: Event Mantissa 51 0 SQ2 { Flag Value } = = BS8 [0.. The value field holds the current floating point value of the analog input at the time of reporting or the last reported value from the originating device. and follows the format for a long real as specified by the IEEE-754 standard.2047> Mantissa = UI23 [0. The format of this object complies with the IEEE-754 standard for floating-point number representation. This object is only reported when an event occurs such as a deadband excursion.252-1>} April 22. The flag field has the same meaning as the flag field of Object 30 Variation 5..10] <0.LONG FLOATING POINT ANALOG CHANGE EVENT Data Object 32 .51] <0. This field is as described for the value field of Object 30 Variation 6.. SHORT FLOATING POINT ANALOG CHANGE EVENT WITH TIME Data Object 32 . 1..7] <0. 1998 10 of 199 9804-006. The value field holds the current floating point value of the analog input at the time of reporting or the last reported value from the originating device.255> Mantissa = UI23 [0.47] <0.223-1>} UI48 [0. 248-1> April 22. The format of this object complies with the IEEE-754 standard for floating-point number representation.7] R32 { Sign = BS1 [0] <0... positive.doc .. and follows the format for a short real as specified by the IEEE-754 standard.. Object Coding: Flag 7 0 Value S Exponent 0 7 0 48 *S = Sign Type: Event Mantissa 22 Time 0 0 SQ3 { Flag Value Time } = = = BS8 [0. The time field shows the time at which the processing caused the event.22] <0. negative> Exponent = UI8 [0.Variation: 07 Description: The Short Floating Point Analog Change Event information object represents a changed hardware or software analog point. The flag field has the same meaning as the flag field of Object 30 Variation 5. This field is as described for the value field of Object 30 Variation 5.. This object is only reported when an event occurs such as a deadband excursion. 252-1>} UI48 [0.. The flag field has the same meaning as the flag field of Object 30 Variation 5. The time field shows the time at which the processing caused the event. positive.2047> Mantissa = UI23 [0.Variation: 08 Description: The Long Floating Point Analog Change Event information object represents a changed hardware or software analog point..7] R64 { Sign = BS1 [0] <0...10] <0. This field is as described for the value field of Object 30 Variation 6. Object Coding: Flag 7 0 Value S Exponent 0 10 0 48 *S = Sign Type: Event Mantissa 51 Time 0 0 SQ3 { Flag Value Time } = = = BS8 [0. This object is only reported when an event occurs such as a deadband excursion.51] <0. 1. The format of this object complies with the IEEE-754 standard for floating-point number representation.. 1998 11 of 199 9804-006.47] <0.LONG FLOATING POINT ANALOG CHANGE EVENT WITH TIME Data Object 32 . and follows the format for a long real as specified by the IEEE-754 standard. 248-1> April 22. negative> Exponent = UI8 [0..doc . The value field holds the current floating point value of the analog input at the time of reporting or the last reported value from the originating device. .255> Mantissa = UI23 [0. negative> Exponent = UI8 [0. and follows the format for a short real as specified by the IEEE-754 standard..SHORT FLOATING POINT FROZEN ANALOG EVENT Data Object 33 ..22] <0. Object Coding: Flag 7 0 Frozen Value Mantissa 22 Type: Frozen Event S Exponent 0 7 0 *S = Sign 0 SQ2 { Flag Value } = = BS8 [0.7] R32 { Sign = BS1 [0] <0. 1.223-1>} April 22.7] <0.. The frozen value field holds the floating point value of the analog input at the time of the last Freeze command was completed on this point. 1998 12 of 199 9804-006. This field is as described for the value field of Object 30 Variation 5.. The format of this object complies with the IEEE-754 standard for floating-point number representation.Variation: 05 Description: The Short Floating Point Frozen Analog Event information object represents a frozen hardware or software analog point that is reported as an event. The flag field has the same meaning as the flag field of Object 30 Variation 5. positive.doc . LONG FLOATING POINT FROZEN ANALOG EVENT Data Object 33 .2047> Mantissa = UI23 [0. The flag field has the same meaning as the flag field of Object 30 Variation 5.. and follows the format for a long real as specified by the IEEE-754 standard. The frozen value field holds the floating point value of the analog input at the time of the last Freeze command was completed on this point.10] <0... Object Coding: Flag 7 0 Frozen Value Mantissa 51 Type: Frozen Event S Exponent 0 10 0 *S = Sign 0 SQ2 { Flag Value } = = BS8 [0. The format of this object complies with the IEEE-754 standard for floating-point number representation. This field is as described for the value field of Object 30 Variation 6.7] R64 { Sign = BS1 [0] <0. 1998 13 of 199 9804-006.. positive..Variation: 06 Description: The Long Floating Point Frozen Analog Event information object represents a frozen hardware or software analog point that is reported as an event.doc .51] <0. negative> Exponent = UI8 [0. 1.252-1>} April 22. Variation: 07 Description: The Short Floating Point Frozen Analog Event information object represents a frozen hardware or software analog point that is reported as an event. 248-1> April 22. Object Coding: Flag 7 0 Frozen Value Mantissa 22 Time Type: Frozen Event S Exponent 0 7 0 48 *S = Sign 0 0 SQ3 { Flag Value Time } = = = BS8 [0. The frozen value field holds the floating point value of the analog input at the time of the last Freeze command was completed on this point.7] R32 { Sign = BS1 [0] <0.7] <0.255> Mantissa = UI23 [0.. and follows the format for a short real as specified by the IEEE-754 standard. The format of this object complies with the IEEE-754 standard for floating-point number representation. 1998 14 of 199 9804-006.223-1>} UI48 [0. This field is as described for the value field of Object 30 Variation 5. The flag field has the same meaning as the flag field of Object 30 Variation 5. 1.47] <0.22] <0. The time field shows the time at which the processing caused the event.. positive.....SHORT FLOATING POINT FROZEN ANALOG EVENT WITH TIME Data Object 33 . negative> Exponent = UI8 [0.doc . The format of this object complies with the IEEE-754 standard for floating-point number representation. and follows the format for a long real as specified by the IEEE-754 standard.LONG FLOATING POINT FROZEN ANALOG EVENT WITH TIME Data Object 33 .47] <0.. The flag field has the same meaning as the flag field of Object 30 Variation 5.252-1>} UI48 [0. Object Coding: Flag 7 0 Frozen Value Mantissa 51 Time Type: Frozen Event S Exponent 0 10 0 48 *S = Sign 0 0 SQ3 { Flag Value Time } = = = BS8 [0. The frozen value field holds the floating point value of the analog input at the time of the last Freeze command was completed on this point.51] <0.. 248-1> April 22.7] R64 { Sign = BS1 [0] <0.. positive.. The time field shows the time at which the processing caused the event.doc ..Variation: 08 Description: The Long Floating Point Frozen Analog Event information object represents a frozen hardware or software analog point that is reported as an event. negative> Exponent = UI8 [0. 1.10] <0. 1998 15 of 199 9804-006.. This field is as described for the value field of Object 30 Variation 6.2047> Mantissa = UI23 [0. Object Coding: Flag 7 0 Value S Exponent 0 7 0 *S = Sign Type: Static Mantissa 22 0 SQ2 { Flag Value } Narrative: = = BS8 [0.223-1>} This object can be returned after an analog output block operation is performed to determine the success of the operation..7] R32 { Sign = BS1 [0] <0. This field is as described for the value field of Object 30 Variation 5. April 22. and follows the format for a short real as specified by the IEEE-754 standard.. The value field holds the current floating point value of the analog output. 1998 16 of 199 9804-006. negative> Exponent = UI8 [0.255> Mantissa = UI23 [0. The format of this object complies with the IEEE-754 standard for floating-point number representation. positive. 1..doc ..Variation: 03 Description: The Short Floating Point Analog Output Status information object represents the actual value of an analog output or software point and associated status.SHORT FLOATING POINT ANALOG OUTPUT STATUS Data Object 40 ..22] <0. The flag field holds information about the point and has the same meaning as previous objects.7] <0. The format of this object complies with the IEEE-754 standard for floating-point number representation. This field is as described for the value field of Object 30 Variation 6.10] <0.doc . The value field holds the current floating point value of the analog output.252-1>} This object can be returned after an analog output block operation is performed to determine the success of the operation..Variation: 04 Description: The Long Floating Point Analog Output Status information object represents the actual value of a hardware or software analog output point. April 22.LONG FLOATING POINT ANALOG OUTPUT STATUS Data Object 40 .7] R64 { Sign = BS1 [0] <0.. Object Coding: Flag 7 0 Value S Exponent 0 10 0 *S = Sign Type: Static Mantissa 51 0 SQ2 { Flag Value } Narrative: = = BS8 [0. 1998 17 of 199 9804-006. negative> Exponent = UI8 [0. positive.51] <0.. The flag field holds information about the point and has the same meaning as previous objects... and follows the format for a long real as specified by the IEEE-754 standard. 1.2047> Mantissa = UI23 [0. The control status field indicates the status of the analog control operation in the same way as the control relay output block.SHORT FLOATING POINT ANALOG OUTPUT BLOCK Data Object 41 . and follows the format for a short real as specified by the IEEE-754 standard.Variation: 03 Description: The Short Floating Point Analog Output Block information object represents the desired value of a hardware or software analog output point. The actual value is returned in the analog output status object. Object Coding: Requested Value S Exponent Mantissa 0 7 0 22 Control Status 7 0 *S = Sign Type: Static 0 SQ2 { Value = Ctrl Stat = } R32 { Sign = BS1 [0] <0.7] April 22.7] <0.doc .255> Mantissa = UI23 [0.223-1>} BS8 [0.22] <0. positive. This field is as described for the value field of Object 30 Variation 5. 1998 18 of 199 9804-006. 1. The definition of this field is the same as the control relay output block. The format of this object complies with the IEEE-754 standard for floating-point number representation...... The requested value field holds the desired floating point value of the analog output. negative> Exponent = UI8 [0. Object Coding: Requested Value S Exponent Mantissa 0 10 0 51 Control Status 7 0 *S = Sign Type: Static 0 SQ2 { Value = Ctrl Stat = } R64 { Sign = BS1 [0] <0..51] <0.10] <0.. This field is as described for the value field of Object 30 Variation 6. and follows the format for a long real as specified by the IEEE-754 standard.doc . The format of this object complies with the IEEE-754 standard for floating-point number representation.LONG FLOATING POINT ANALOG OUTPUT BLOCK Data Object 41 . The definition of this field is the same as the control relay output block.252-1>} BS8 [0.Variation: 04 Description: The Long Floating Point Analog Output Block information object represents the desired value of a hardware or software analog output point.. 1. The status field indicates the status of the analog control operation in the same way as the control relay output block. The requested value field holds the desired floating point value of the analog output.2047> Mantissa = UI23 [0.7] April 22. The actual value is returned in the analog output status object... positive. negative> Exponent = UI8 [0. 1998 19 of 199 9804-006. 00 Data Link Layer specification. it does not clearly describe how to avoid collisions between messages. This provides a minimum "window" of access time for the master(s). it could be zero (0) for masters and non-zero for all the slave devices. Resolution: The physical layer must provide an indication to the data link layer of when the link is in use. it waits until it is no longer busy. or up to a configurable maximum number of retries. The fixed_delay can be adjusted per device to provide priority of access. e. especially unsolicited messages. If a maximum is used. either indefinitely. Chapter 7: Physical Procedures.doc .00 Data Link Layer Chapter 7: Physical Procedures April 22. This bulletin is intended to provide that description. 1998 1 of 1 9804-007. the protocol behaves as if a link failure occurred. multi-drop link. sent by several devices sharing a half-duplex. i.g. discusses many different issues and configurations of physical connections in a general manner. Affected Documentation: DNP V3. If a device prepares to transmit and finds the link busy. using the DCD (Data Carrier Detect) signal. then waits a backoff_time as follows: backoff_time = fixed_delay + random( max_random_delay ) After the backoff_time.00 Technical Bulletin 9804-007 Clarification of Collision Avoidance Procedures Issue: The DNP V3.e. data is returned to buffers at the application layer and application layer retries take place if desired. the device tries again. Unfortunately.DNP V3. For instance. The Technical Committee may alter any proposed object or variation numbering in accordance with established guidelines. 1998 1 of 1 9804-008.DNP Technical Bulletin 9804-008 Unissued Object and Variation Numbers Issue: It has been noted that some vendors have assigned as-yet-unallocated DNP Object and Variation numbers to private objects. Note that it is extremely rare for the Technical Committee to introduce new features to the protocol that are not completely backward-compatible with the existing published protocol definition.doc . • • • Affected Documentation: Nil. or make recommendations on aspects of protocol implementation. together with relevant supporting documentation describing the proposed new object or variation and its purpose. Proposals for extensions to the protocol can be presented for consideration by the User Group’s Technical Committee. Proposals should be submitted to the Secretary of the DNP User Group. Implementors should note that the Private Registration Object (Object 83) permits the definition of vendor-specific data objects. This allocation can lead to incompatible extensions to the protocol. Resolution: The DNP User Group advises that: • DNP must not be used to transport objects other than those already published by the DNP User Group in the DNP Protocol Specification documents or in DNP Technical Bulletins. and will be included in the protocol if considered appropriate. From time to time the Technical Committee may issue advisory bulletins that clarify the protocol definition. and may also revise other details of the proposal to ensure compatibility with other aspects of the protocol. Guidelines regarding this practice are required. This object may be used for adding proprietary features to devices that communicate using DNP. April 22. If the absolute value of the difference between the last-reported value of an analog input object and the current value of that object exceeds the deadband value. Integrating Deadband. events on this point are reported as Object 32 index n. For a fixed deadband. It is recommended that for each individual point. This means that a single deadband value is assigned for each analog input point. Object 34 has no flags. When the integral of the difference exceeds the deadband. It will not be reported in response to Read requests for Class 0 Data (that is: It will only be returned in response to a Read command that specifically requests Object 34). the same format (integer or floating-point as required) be used with Objects 30. and must perform conversion between integer and floating-point formats as required by DNP Technical Bulletin 9804-006. • It is assumed that only one of these two mechanisms is being used. then an event is generated for that object with the current value sent as the value for the event. The master may alter the value of an analog input’s deadband by issuing a Write command containing the Analog Input Reporting Deadband Object. Systems that can report analog events using floating-point formats (Object 32 Variation 5–8) may use either the floating-point variation of Object 34 (Variation 3) or the integer variations (Variations 1 and 2). 1998 1 of 6 9809-001. the value set will be the absolute September 10. then an event is generated for that object with the current value sent as the value for the event. Systems that only report analog events using integer formats (Object 32 Variations 1–4) should use the integer variations of Object 34 (Variations 1 and 2). This object will support the Read and Write functions. the difference is integrated over time.DNP Technical Bulletin 9809-001 Analog Input Reporting Deadband Issue: There is perceived to be a need for a mechanism to permit the master station to retrieve and set the reporting deadband parameter for analog inputs. Object 34 may be used for setting or reporting either a Fixed Deadband value or an Integrating Deadband value. Resolution: The DNP Technical Committee has allocated Object 34 as the means of reporting or setting the reporting deadband value of an Analog Input. While the value of an analog input object differs from the last-reported value for that object. not two separate values (a fixed deadband value and an integrating deadband value) assigned for each point. Three variations of Object 34 are defined: 16-bit and 32-bit integer formats and a floating-point format. This means that the reporting deadband for Object 30 Index n is Object 34 Index n.doc . Explanatory Notes: The analog input reporting deadband is normally used in one of two ways depending on the capabilities and configuration of the reporting equipment: • Fixed Deadband. 32 and 34. The indices assigned to Object 34 parallel those assigned to Object 30. A device receiving a negative floating-point deadband value should convert (or report) this to be a zero deadband value. then this should be noted in the device profile.e. For an Integrating Deadband. Object 34 Variation 2 uses a 32-bit unsigned integer data representation. setting the reporting deadband for this point to 255 (or more) will prevent all event reporting for that point. Any deadband values altered by the use of Object 34 prior to the slave reset may be lost. Implementation notes: A deadband of zero will permit any change to generate an event and a deadband of the full range of the variable will prevent events from ever being generated. The DNP Master is responsible for re-sending any updated deadband values to the slave after a slave reset if this is deemed necessary. Deadbands are positive values. the range of deadbands that can be represented is 0–65535 (0x0– 0xFFFF). in accordance with the slave device’s capabilities and configuration. and selecting a value of +INF (positive infinity) prevents event generation from any floatingpoint analog input object. If the slave device preserves updated deadband values through reset.doc . September 10. Deadbands are positive values. and may revert to configured (or default) deadband values on reset. If a Read request for Object 34 Variation 1 is issued. Note that if the device is capable of reporting Object 34 Variation 3 (floating-point). While this format permits negative values. Object 34 Variation 3 uses the short real (32-bit) floating-point format specified in the IEEE 754 standard. deadbands should only be set to positive values (0. the range of deadbands that can be represented is 0–4294967295 (0x0– 0xFFFFFFFF). A Read request for Object 34 Variation 2 should be issued if integer deadband values greater than 65535 must be reported correctly. any point deadband value greater than 65535 will be reported in the response as the value 65535 (the largest value that can be reported in a 16-bit unsigned integer). The response to a Read request for Object 34 Variation 0 may include any variation of Object 34. A slave device that supports Object 34 is not required to maintain deadband values through reset (when it sets IIN Bit 7). For example: An 8-bit analog input may have a range of -128–127. Hence selecting a deadband of 4294967295 prevents event generation from any integer analog input. as any change in the input will be larger than the deadband. in accordance with the requirements stated in DNP Technical Bulletin 9804-006.0–+INF). Any negative floating-point deadband value is equivalent to a zero deadband. 1998 2 of 6 9809-001. the value set will be the difference value in Count Seconds (Variations 1 and 2) or Engineering Unit Seconds (Variation 3) (i. then the device must be configurable to only report data using Variations 1 and 2.: The integral over time of the difference between the last reported value and the current value).difference value in Counts (Variations 1 and 2) or floating-point Engineering Units (Variation 3). Object 34 Variation 1 uses a 16-bit unsigned integer data representation. setting the deadband value to the maximum range of the analog input will inhibit event generation for that input. In systems that use fixed deadbands. 00 Object Library Chapter 6: Analog Input Object Definitions Updated Device Profile Document Details: 16-Bit Analog Input Reporting Deadband Object Data Object 34 Variation 1 Description: The Analog Deadband Object is an information object used to allow a DNP device to report the magnitude of the deadband of an Analog Input Object. The response to a Read request using Variation 1 will report the value 65535 for any deadband value that is greater than 65535. Not in Class 0 0 = UI16 [0. Object Coding: Deadband Value 15 SQ1 { Deadband Value } NOTES: • This object is valid with the Application Layer function codes Read.doc Type: Static. The deadband value field contains the value of the deadband. Write and Response.65535> • • September 10. This object is NOT returned in response to a Read request of Class 0 data. the Deadband Value is the integrated deadband in count-seconds. 1998 .15] <0.Affected Documentation: DNP V3.. Write command (master alters the deadband value) or Response command (when the slave supplies the data in response to the master’s Read command). 3 of 6 9809-001. For analog inputs using integrating deadbands. For analog inputs having fixed deadbands. The object will only be included in a Response message if specifically requested in a Read message. or to permit the master station to alter the deadband of an Analog Input Object. This object may be specified with the Read command (master requests slave to return the deadband value). the Deadband Value is the deadband count value.. The index number identifying a deadband object is the index number of the corresponding Analog Input Object (Object 30). This object is NOT returned in response to a Read request of Class 0 data. the Deadband Value is the integrated deadband in count-seconds. Write and Response. The index number identifying a deadband object is the index number of the corresponding Analog Input Object (Object 30). Not in Class 0 • September 10.31] <0.doc . 1998 4 of 6 9809-001. The object will only be included in a Response message if specifically requested in a Read message.4294967295 > Type: Static.. For analog inputs having fixed deadbands. 0 = UI32 [0. Object Coding: Deadband Value 31 SQ1 { Deadband Value } NOTES: • This object is valid with the Application Layer function codes Read. Write command (master alters the deadband value) or Response command (when the slave supplies the data in response to the master’s Read command). This object may be specified with the Read command (master requests slave to return the deadband value).. or to permit the master station to alter the deadband of an Analog Input Object. The deadband value field contains the value of the deadband. For analog inputs using integrating deadbands.32-Bit Analog Input Reporting Deadband Object Data Object 34 Variation 2 Description: The Analog Deadband Object is an information object used to allow a DNP device to report the magnitude of the deadband of an Analog Input Object. the Deadband Value is the deadband count value. For analog inputs using integrating deadbands.255> Mantissa = UI23 [0. Object Coding: Type: Static.. For analog inputs having fixed deadbands. or to permit the master station to alter the deadband of an Analog Input Object.. the Deadband Value is the integrated deadband in engineering unit-seconds. Not in Class 0 Deadband Value S Exponent Mantissa 0 7 0 22 *S = Sign.. the Deadband Value is the deadband engineering unit value. This is as described for the value field of Object 30 Variation 5 (Refer to DNP Technical Bulletin 9804-006). The index number identifying a deadband object is the index number of the corresponding Analog Input Object (Object 30). negative> Exponent = UI8 [0. If a negative value is received (Sign bit set).7] <0. Write and Response.223-1> } } NOTES: • This object is valid with the Application Layer function codes Read. 1. The deadband value field contains the value of the deadband in the 32-bit short real format specified in the IEEE 754 Standard. Write command (master alters the deadband value) or Response command (when the slave supplies the data in response to the master’s Read command).Floating Point Analog Input Reporting Deadband Object Data Object 34 Variation 3 Description: The Analog Deadband Object is an information object used to allow a DNP device to report the magnitude of the deadband of an Analog Input Object. should only be zero (positive value) 0 SQ1 { Value = R32 { Sign = BS1 [0] <0. 1998 . This object is NOT returned in response to a Read request of Class 0 data.. this should be interpreted as a zero value.doc • • September 10. 5 of 6 9809-001. This object may be specified with the Read command (master requests slave to return the deadband value). The object will only be included in a Response message if specifically requested in a Read message.22] <0. positive. e. an Exponent of 255 and a Mantissa of 0 (i. September 10.: the deadband value of 0x7F800000). 1998 6 of 6 9809-001.• The +INF (positive infinity) value is represented by a Sign bit of zero.doc . if appropriate. 1996 1 of 1 9701-001. Affected Documents: DNP 3. the Data Link layer will make the indication to the application layer to determine the course of action. A power up failure will now be detected quickly by not having to wait for retries to be completed. A Slave device always perform an immediate application layer retry. Upon receipt of the NACK . communications may not be recovered for the polling interval. Resolution: Following a restart or power-up. This will prevent the first transaction after power up from failing. It is further recommended that upon receiving an indication of a transaction failure due to a NACK: • • A Master Device performs an immediate application layer retry. perhaps hours or days.doc .DNP Technical Bulletin 9701-001 Data Link Restart Recovery Issue: The data link had a problem when one station or the other is powered down and up without the other stations knowledge. prior to receiving a Reset Link frame both Master and Slave devices must respond with a data link layer CONFIRM NACK having DFC=0 when they receive a frame having FCV=1 (SEND/CONFIRM).0 Data Link Layer Protocol Description Chapter 3 DNP Data Link Description Data Link Function Codes Reset January 15. Without application retries. The first poll to a remote device failed because the remote has not yet received a LINK RESET frame. rather than just discarding the frame. Set to 0. Set to 0 unless Code value is Pulse On. the Slave device must return value 4 (operation not supported) in the Status field. FIELD: Trip/Close Clear Queue Code Count On-Time Off-Time Status Function Desired Latching Relay ON Latching Relay OFF Unpaired Momentary Relay (e. Set to 1. January 15. Must be Pulse On if Trip/Close is not NULL. Trip/Close NULL (0) NULL (0) NULL (0) Trip (2) Close (1) Code Latch On (3) Latch Off (4) Pulse On (1) Pulse On (1) Pulse On (1) On-Time Zero (ignored) Zero (ignored) Non-zero Non-zero Non-zero Addressing Issues There are two possible ways to provide access to Trip/Close or Raise/Lower relays: 2 Points Per Address . 1 Point Per Address . If a particular function is not supported by the hardware.The Trip or Raise operation is performed on a different DNP point number than the Close or Lower operation. 1996 1 of 2 9701-002. Set to 0. See following table.doc .DNP Technical Bulletin 9701-002 Control Relay Output Block Minimum Implementation Issue: The DNP User’s Group required the Subset Definition be amended to include a list of minimum subset options in the Control Relay Output Block. Only used if the command is to be performed multiple times. Only used for continuously repeating commands. Invalid with Code values of Latch On or Latch Off. The remote device may return a Status of 4 (operation not supported) if an inappropriate operation is performed. The value of the Trip/Close field selects the appropriate one of a pair of relays. Only used for continuously repeating commands.Both operations are performed specifying the same DNP point number. Set to 0 in the output request. Set to 0.g Pushbutton. Only used for Pulse Off values of Code or Count greater than 1. Resolution: The following is a minimum implementation. See following table. given that appropriate hardware exists. The “2 Points Per Address” method is not recommended for new designs. Alarm) Trip Breaker/Relay or Raise Transformer Tap Close Breaker/Relay or Lower Transformer Tap MINIMUM IMPLEMENTATION: See following table. 0 Data Object Library Chapter 4 Binary Output Object Definitions DNP 3.0 Subset Definitions Chapter 4 Implementation Rules and Recommendations Operating Binary Outputs Updated Device Profile Document January 15.00 Data Object Library shall be updated to redefine the Trip/Close field as: Paired Operation = BS2[ 6. or neither) must be documented. Documentation The addressing method for Trip/Close or Raise/Lower operations and any features supported in addition to the minimum specified above must be described in the Device Profile Document. or variable Count. 10.. the method used for variable Raise/Lower operations (variable On-Time.doc . 1996 2 of 2 9701-002. NULL. 01. Affected Documentation: DNP 3.7] <00. Trip| Raise> On-Time It is recommended that if a device’s hardware only supports one pulse width (specified by On-Time). This will help with interoperability. Close|Lower. it does not reject other values but simply ignores the specified width. In particular.DNP Technical Bulletin 9701-002 Control Relay Output Block Minimum Implementation (Continued) The next version of the DNP V3. Any features not supported because of lack of hardware must also be documented. This implies that restart should begin immediately after sending the response. Affected Documentation: DNP V3.00 Application Layer Protocol Description Chapter 4 Detailed Function Code Descriptions Cold Restart (Function Code 13) Warm Restart (Function Code 14) January 15. 1996 1 of 1 9701-003.doc .DNP Technical Bulletin 9701-003 Cold/Warm Restart Sequence Issue: The DNP User’s Group required a definition for a standard implementation for Cold/Warm Restart implementation sequence. Devices that cannot be sure exactly when the response will be completely sent can wait a suitably large time and “pad” that time into the master wait time returned in the response. It was previously unclear when a remote should actually perform a restart after receiving a restart request: • immediately after transmitting the response • after receiving a data link confirm to the response • after receiving an application confirm Resolution: It is recommended that neither data link layer nor application layer confirmation be requested when sending a response to a Cold Restart or Warm Restart request. but other uses have arisen as well.doc . Object 110. Please refer to the following Data Link Object Definitions for Details. Initial uses considered were for Passwords or other character strings. 1996 1 of 3 9701-004. Resolution: A new object. The need arose to transport ASCII or other data of varying lengths. The variation within the object represents the length for the Octet string. The event object associated for the Octet String Object is Object 111.DNP Technical Bulletin 9701-004 Octet (Character) Strings Objects 110 and 111 Issue: The DNP User’s Group required a definition for a standard object for Octet (Character) strings. Affected Documentation: DNP V3. Devices are not required to support any particular length of string. NOTE: Reading and Writing of 8 bit memory locations could be implemented using this object together with absolute addressing qualifiers. is defined as an Octet String Object.00 Object Library Chapter to be determined August 21. . Object Coding: Current Value [0] 7 0 Type: Static Current Value [N-1] 7 0 OSN = SQ1 { Current Value = UI [0. 1996 2 of 3 9701-004. For this object only read.Variation = Octet string length Description: The Octet String Object represents a value from 0 to 255.doc .255>} where N = variation which is the length of the octet string August 21.Octet String Object Data Object 110 . This object is not included in Class 0 poll response.7] <0. write and response function codes are permitted. Each 8 bit data element may contain a variety of information from ASCII passwords to configuration details.. The variation within the object represents the length. For this object only read. response and unsolicited response function codes are permitted. 1996 3 of 3 9701-004.7] <0. Object Coding: Current Value [0] 7 0 Type: Event Current Value [N-1] 7 0 OSN = SQ1 { Current Value = UI [0.Octet String Event Object Data Object 111 . Each 8 bit data element may contain a variety of information from ASCII passwords to configuration details.255>} where N = variation which is the length of the octet string August 21...doc .Variation = Octet string Length Description: The Octet String Event Object represents an event value from 0 to 255. The variation within the object represents the length. DNP 3.00 Data Object Library Chapter 6 Analog Input Object Definitions Analog Input Data Object 30 Variations Frozen Analog Input Data Object 31 Variations Analog Change Event Data Object 32 Variations Frozen Analog Event Data Object 33 Variations Chapter 7 Analog Output Object Definitions Analog Output Status Data Object 40 Variations Analog Output Block Data Object 41 Variations Chapter 13 Alternate Numeric Object Definitions Floating Point Data Object 100 Variations (object 100 is no longer recommended) 5 to 7 7 to 9 5 to 7 5 to 7 3 to 5 3 to 5 1 to 3 August 21.0 Technical Bulletin 9701-006 Extended Engineering Units for Floating Point Objects Issue: The DNP User’s Group required new engineering unit definitions for Floating Point Objects. 1996 1 of 1 9701-006.doc . Resolution: The following “Units” codes have been added to all floating point objects defined within DNP: 20 quantity having no unit of measurement 21 m3 /s (volumetric flow in cubic meters per second) 22 kPa (pressure in kilopascals) 255 units unknown or undefined 23 to 254 remain available for future assignment Affected Documentation: DNP V3. Any other response or no response at all indicates that the receiver is unable to perform the link reset. 1997 1 of 1 9704-007. To avoid possible incompatibilities. Resolution: • • • A device is not required to transmit a RESET LINK frame if that device transmits only SEND/NO REPLY EXPECTED frames. Any device receiving a RESET LINK frame must respond with a CONFIRM ACK. Affected Documentation: DNP V3.doc .0 Technical Bulletin 9704-007 Implementation Rules for Reset Link Frames Issue: The implementation of Reset Link Frames has recently caused some controversy with different vendors providing differing subsets.00 Data Link Layer Chapter 3: DNP Data Link Description Data Link Function Codes April 16. A device must not require the reception of a RESET LINK frame before accepting SEND/NO REPLY EXPECTED frames.DNP 3. the following resolutions were adopted. for example: • • If an end device performs a restart If communications between devices is lost and buffer overflows occur Also the user’s communications network may be based on dial-up devices and it is useful to collect information pertaining to the performance of the dial-up network: Page 1 19 February 2004 AN2004-001 System Management Data Points . Information pertaining to the network disturbance will be present in the event log whilst the system is behaving as normal. especially when building systems of a hierarchical nature with devices that may be provisioned from multiple vendors. then systems designers. Implementing pseudo points and communicating their data using standard DNP3 data objects for these “system management” functions provides a solution that is inter-operable between different vendor devices. need to provide a solution. Details: When building a system such as shown in Figure 1 below it is necessary that the master have enough information to enable the user to perform system reviews and audits at any time after a network disturbance has occurred. These requirements are often overlooked during the early stages of a project and may be costly to implement at a latter stage of the project. The following parts of this Application Note describe a solution using system management data points that may benefit users when these are designed into the outstation and sub-master devices. If the user has these requirements.DNP3 Application Note AN2004-001 System Management Data Points Preface: Users often have a requirement that their system should not lose information that may be used as part of a post disturbance fault review or system behavior audit. but there are situations where information could be lost. The user may also want to manage and control the behavior of the communications process in his system. DNP3 RTU (device B) DNP3 SubMaster (device A) DNP3 Master Comms Network DNP3 RTU (device C) DNP3 RTU (device D) end devices Figure 1 – Typical system with hierarchical communications These reviews and audits are often performed using the telemetry event log held at the master. 3 indications to (pseudo) binary inputs in the sub-master’s database. terminate prematurely Even when the user has permanent communications circuits.e. The master performs standard DNP3 pulse or latch ON/OFF control requests. and it should cause the sub-master to disable unsolicited reporting by issuing a function code 21 request to that end device. number of messages with bad crc. there is the potential for the event buffers to overflow in those end devices. Similarly. or if one of the devices is taken out of service for maintenance reasons. • A (pseudo) binary output point in the sub-master’s database manages enabling and disabling communications to an end device. as shown in figure 1 above. If. they report this to the sub-master (device A) using the internal indication IIN1. in turn reports this restart to its master by mapping the state of the end device IIN1. The sub-master. then setting this point to OFF should stop the sub-master from issuing integrity scans requests (class 0 read requests for example) to the end device. Binary input points Page 2 • 19 February 2004 AN2004-001 System Management Data Points . he often wants details about the performance of these circuits (number of time-outs. one of the end devices B. The actual method of mapping of these IIN1. Preservation of Internal Indications Key internal indications to be preserved and reported throughout the device hierarchy are those for “device restart” and “event buffer overflow”. resulting in lost events. A number of (pseudo) binary input points in the sub-master’s database manage the monitoring of the communications enabled status between sub-master and each end device. to control the sub-master scanning algorithm. disabled from polling. Similarly. then setting this point to the OFF state will stop the sub-master from issuing data read requests to that end device. An overflowed buffer condition is reported to the sub-master using the internal indication IIN2. Users frequently desire the ability to stop a sub-master device from polling one of its end devices. C or D is experiencing communications problems with the sub-master (continuing failures and recoveries). as well as wanting to know (at any instant in time) the communications status with an end device (i. needs to monitor and control the communications process in the sub-master.3 indications to binary input points is a local configuration issue. C or D.• • • The number of calls initiated from a device The number of calls “not answered” by the master The number of calls that “drop out” i.7 indications to (pseudo) binary inputs in the sub-master’s database. using object group 12. The occurrence of these indications shows that devices cannot guarantee that they have captured all changes of plant data – and this fact is made available to all masters in the hierarchy: • In Figure 1 above when any of the end devices B. • 2.3. B. if the sub-master experiences communications problems with its end devices. for example. The actual method of mapping of these IIN2. Control and monitoring of subservient scanning algorithms There are occasions where the master. if the sub-master is using unsolicited report by exception mode. The sub-master also needs to maintain indications showing the current communications enabled status with each end device. Implementation: The system management data points can be described under a number of different functional requirements: 1.7 indications to binary input points is a local configuration issue. communications failed).e. The sub-master reports the possible loss of events to its master by mapping the state of end device IIN2. then the user (at the master) may choose to request the sub-master disable communications with that end device. etc). C or D undergo a restart.7. If the submaster polls the end device. The point can be used to give additional information about the quality of the end device's data points that are present in the submaster's database: If "not connected" then the values of the end-device's points in the sub-master database may not be up to date (i. − The actual method of mapping these control and monitoring functions to binary output points and to binary input points is a local configuration issue. Maintenance of communications statistics Commonly. If the end device fails to respond to the sub-master's request then the point is set to the "failed" state.e. DNP3 communications with the end device is currently connected / not connected. the data values may be old and hence unreliable. This point is used to show the outcome of the last DNP3 request to the end device. For end devices connected to the sub-master via dial-up communications circuits then this point is also set to the "failed" state if the sub-master's attempt at establishing the communications circuit fails (for example the end-device fails to answer an incoming call request).e. The point is set to the "connected" state when there is a current connection between the submaster and the end device and a DNP3 message exchange has been successful (i. When the connection is terminated this point is set to the "not connected" state.e. This information can be used to determine degradation of communications lines and equipment. 3. For permanent communications circuits the performance of the circuit can be determined by recording: − − − − The number of bytes transmitted and received The number of messages transmitted and received The number of messages received with bad CRC The number of messages where an acknowledgement has timed-out (not been received) For dial-up communications circuits it can be useful to additionally record: − − − − The number of calls that have been attempted The number of calls that have been un-answered The number of call requests that have returned a busy status The number of times that an established call has terminated prematurely Page 3 19 February 2004 AN2004-001 System Management Data Points . but the values do reflect the values from the end-device at the time of the last communications exchange). the sub-master database either has the current values as seen by the end-device or the sub-master is in the process of updating its database). SCADA systems maintain statistical information about the behavior of their communications between devices. otherwise it is set to the "OK" state. as well as the performance of equipment from third-party network suppliers. the submaster is actively communicating with the end device). If "connected" and not failed then the values of the end-device's points in the sub-master database are reliable (i.should be mapped in the sub-master database (for each end device) to show: − − Communications are enabled / disabled (this point reflecting the state of the binary output object detailed above) Communications with the end device is OK / failed. This point is specific to end devices connected to the sub-master via dial-up communications circuits. 4. While this Application Note has been reviewed by the DNP Technical Committee. The DNP Technical Committee does not warrant the completeness of the information contained within this document. This information can be mapped to conventional data points (one example of this is making information about software revisions available to higher level masters). They illustrate how the features of DNP3 were used to meet specific user requirements. These points can then be read by interested masters. Other users must make their own determination as to the suitability of this information for their specific application.This maintenance of the communications statistics can be implemented using pseudo points – recording the information into counter data points. Final words The examples above are by no means an exhaustive list. it may not contain all of the details that are necessary for a complete DNP3 implementation. nor does it warrant that the approach taken is the most appropriate in all situations. Disclaimer Application Notes contain information developed by users and are provided for the benefit of other users. and can be configured to generate counter change events when certain thresholds are reached (for example more than 10 unanswered dial-up requests). and IEDs and sub-masters may have other information that may be important for managing these nodes. The actual method of mapping these communications statistics to counter points is a local configuration issue. Page 4 19 February 2004 AN2004-001 System Management Data Points . at 15 minute intervals • Page 1 30 December 2003 AN2003-001 Using DNP3 In the UK Water Industry . preferably using outstation features that are compatible with the IEC 61131-3 standard (Programmable Controllers Part 3. Although this does not immediately impact the communications protocol there are user requirements to: − − • Change the user programs from a remote location (usually the SCADA master) Allow the SCADA master to change operational values employed by the user programmable logic • • • Both of these requirements do have an impact on the communications protocol. The ability of an outstation to perform local computations and logic functions. These are user defined. These proprietary protocols have evolved over the years to meet specific requirements of the end-users. If open protocols such as DNP3 are to be used then they must meet the base requirements of the users. store these (with a timestamp) for a reasonable amount of time. The user requires downloading these values from the SCADA master. Details: Some of the user requirements were easily identified: • The ability of an outstation to sample measured values at periodic intervals.DNP3 Application Note AN2003-001 Case History: Using DNP3 in the UK Water Industry Preface: SCADA systems in the UK water industry have traditionally been implemented with a communications protocol that is proprietary to the system vendor. Programming Languages). and other analogue measurements. This computation needs a number of configuration values that are dependent on the characteristics of the specific weir site. A number of UK users are now collaborating in an initiative to move to an open protocol in order to gain some independence from specific vendor solutions. It is a requirement that eventing co-reside with normal unsolicited alarm reporting by the outstation. The ability of an outstation to maintain a list of critical events that cause immediate unsolicited reporting from the outstation. and then either report all of the values to the SCADA master at a later time or wait until the SCADA master solicits their values. The ability of the SCADA master to send configuration parameters to the outstation Implementation: The end-user installed outstations at sites where he had special. The following parts of this Application Note describe how one UK user incorporated DNP3-based outstations into his SCADA system as his choice for applying an open protocol. advanced requirements: • To compute the flow of water from a measurement of the head of water at a weir. To trend the computed flow value. The ability of an outstation to maintain a list of non-critical events that do not cause immediate unsolicited reporting from the outstation. This requirement is referred to as alarming. This requirement is referred to as trending. This requirement is referred to as eventing. The protocol implements three event classes. These modes are detailed below: Page 2 30 December 2003 AN2003-001 Using DNP3 In the UK Water Industry . known as Variations. class 2 and class 3. Any utility planning to use this case study as an implementation guideline should verify that the equipment that they propose to use does implement these optional variations. In this mode the master station does not need to continually request the outstation to report events — the outstation reports the events to the master station as and when they occur. an important aspect of this is that the specific requirement being satisfied is the only one to be assigned to that class. Although these event variations are not mandatory in the subset definitions. the requirements could be met with any choice of event classes. However. not all DNP3 devices support them. Some variations are commonly used and are specified as required variations for conformance to the DNP3 implementation subset levels. These are configured as class 3 events. Some of the variations described in this case study are not required in the subset specifications. The user locally configures which outstation database analogue inputs are to be trended and the event generation interval. A brief DNP3 tutorial Implementing these user requirements made use of a number of basic features of the protocol: • Event classes. therefore. Outstations can operate in a number of different modes. The protocol gives the master station the ability to read events from individual classes. referred to as class 1. one being the unsolicited RBE mode. these events being configurable such that they are assigned to any of the three classes. Data points in an outstation may be configured to generate events when the data points change value. experience has shown that all commonly used DNP3 Test Sets and SCADA systems parse and process these events. known as Object Groups. or to read events from any combination of classes with a single read request. the outstation is required to hold up to 5000 trended values. The master station can individually select which of the three event classes are enabled for unsolicited reporting. • Data object variations. at these future sites the user requires eventing for up to 1000 events. Under circumstances where the communications are lost for a period of time. The user requires several modes for accessing these trend events. • 2. DNP3 permits data from various data types. Similarly. which is controlled by the timing of the actual flow of the trend events into a class queue and by the enabling and disabling of unsolicited reporting of this class of events. This is readily verified by reference to the relevant device’s DNP3 standard implementation documentation. Trending Trending was achieved using a software application in the outstation that periodically generates "Analogue Input Change Events" — using variations with time. These values can be reported with or without the time of measurement. These advanced user requirements were implemented into the SCADA system using standard DNP3 protocol features: 1. to be reported in various formats. This unsolicited RBE mode is additionally controlled with enable and disable commands from the master station. For example: The change of an analog measurement can be sent with 16-bit or 32-bit integer resolution or as a floating-point value. known as the “DNP Device Profile”.The outstations may be used in the future at sites where the trend values are taken at a different interval. The choice of which specific event classes are used was an arbitrary decision. Unsolicited report by exception (RBE) mode of operation. In the following sections details are given of meeting the user requirements using the event class feature of the protocol. with a repetition time set to 24 hours. 3. except in this case the SCADA master has been triggered by a system event (which may be totally unrelated to data points in this outstation) to go to the outstation to read the trend events that are available. However. The SCADA master must have previously enabled unsolicited reporting for class 3 events (using function code 0x14). the SCADA master must have previously ensured that unsolicited reporting for class 3 events is disabled (either by default at outstation restart or by using function code 0x15). Eventing Eventing was achieved by configuring the events generated from binary inputs associated with noncritical status conditions (either real inputs or pseudo inputs derived from the IEC 61131-3 user program) to class 2. The SCADA master ensures that unsolicited reporting is disabled for class 2.in the particular case for this UK user every 1 hour. using class 1 or class 2 can also achieve the required functionality. This mode of operation uses the same trending configuration in the outstation as for mode (b). or on-demand if the SCADA master sees a system event that triggers a solicited read). (b) Periodically solicited from the SCADA master When the user requires this mode of operation the outstation is configured to put trend events into the DNP3 class 3 reporting queue at a regular interval. Page 3 30 December 2003 AN2003-001 Using DNP3 In the UK Water Industry .(a) Unsolicited trend retrieval. typically 15 minutes. and thus the events are not reported until solicited by the SCADA master (typically once per day. using class 1 or class 2 can also achieve the required functionality. once per day When the user requires this mode the outstation is configured with the time of day that trend events are to be sent to the SCADA master. The choice of class 3 is arbitrary. The choice of class 3 is arbitrary. unsolicited response to SCADA master at the configured time of day unsolicited reporting is enabled Class 3 event queue (see note 1) Analogue change events with time Notes: 1. The trend events are now available in the class 3 event queue for the SCADA master to read at its leisure . (c) On-demand read request from the SCADA master This mode of operation is very similar to the mode (b) above. read request for class 3 event(s) from SCADA master solicited response to SCADA master at 00:00:00 and repeated every 15 minutes Class 3 event queue (see note 1) unsolicited reporting is disabled Analogue change events with time Notes: 1. At the configured time of day the outstation puts the trend events into the DNP3 class 3 reporting queue. This is a desired future requirement. Alarming Alarming was achieved by the user configuring the events generated from binary inputs associated with critical alarm conditions (either real inputs or soft inputs derived from IEC 61131-3 user program) to class 1. The user had no requirement to remotely load the IEC 61131-3 user program. It is expected that this requirement can be satisfied by using file control objects (DNP Object Group 70). The SCADA master ensures that unsolicited reporting is enabled for class 1. This Application Note has been reviewed by the DNP Technical Committee. The master writes values to output points at RTU restart time. At any time the SCADA master can set new values by issuing a command to the respective point using an analogue output block object (DNP Object Group 41) and the select and operate function codes. and the Committee does not warrant that the approach taken is the only way to use DNP3 to meet the user requirements. Remote configuring Remote configuring was only partially defined for the initial application. the UK user required sending a limited set of configuration values to the outstation from the SCADA master. This note illustrates how the features of DNP3 were used to meet specific user requirements. to be provided once the general scope of remote loading is analyzed across the complete group of UK water users.4. The IEC 61131-3 program uses the values stored in these pseudo analogue outputs for its computations. It does not contain all of the details that are mandatory for a complete DNP3 implementation. Thus alarm events are reported in unsolicited responses to the SCADA master as soon as they occur. 5. These values are used at the outstation by the locally defined IEC 61131-3 program. Further notes will be written when: • • The industry decides that it wants to use DNP3 as its "open" protocol The industry clearly defines its requirements Disclaimer Application Notes contain application information developed by users and are provided for the benefit of other users. This requirement was satisfied by the outstation analogue output pseudo points that are locally configured with default values. Page 4 30 December 2003 AN2003-001 Using DNP3 In the UK Water Industry . Future work: This application note is the first in what is expected to be a series of application notes describing the use of DNP3 in the UK water industry. However. Distributed Network Protocol (DNP3-2003) DNP3-2003 Intelligent Electronic Device (IED) Certification Procedure Subset Level 1 Version 2.3 29-Sept-03 . Neither the author nor the publisher assumes any liability to anyone for any loss or damage caused by any error or omission in the work. Neither the DNP Users Group nor any authors/developers of DNP documentation guarantee. The DNP User Group is a global forum for users and implementers of the protocol and promotes implementers and developer information and interaction exchange. the information contained in this manual is subject to change without notice. Copyright  1999 . Any brand and product names mentioned in this document are trademarks or registered trademarks of their respective companies. All rights reserved. while the author/developer and publisher believe that the information and guidance given in this work serves as an enhancement to users. the accuracy or completeness of any information published herein. and neither the DNP Users Group nor its authors/developers shall be responsible for any errors. and does not represent a commitment on the part of the DNP Users Group.2003 DNP Users Group. Any and all such liability is disclaimed. all parties must rely upon their own skill and judgment when making use of it. TRADEMARK NOTICES DNP is a trademark of the DNP Users Group.DNP USERS GROUP The contents of this manual are the property of the DNP Users Group. Information contained in this and other works has been obtained from sources believed to be reliable. no part of this document may be altered or revised or added to in any form or by any means. NOTICE OF RIGHTS . Revisions or additions to the definition and functionality of the DNP Protocol cannot be made without express written agreement from the DNP Users Group or its duly authorised party. and reviewed by credible members of the DNP User Group and/or the DNP User Group Technical Committee. In addition. whether such error or omission is the result of negligence or any other cause.Disclaimer Statement DNP User Group documents and publications are not consensus documents. and each such person expressly disclaims responsibility for ensuring. The DNP User Group is not responsible for any statements and/or opinions advanced in this publication. This work is published with the understanding that the DNP User Group and its authors/developers are supplying information through this publication. An update program for DNP documents is provided upon request by the DNP Users Group. . the assistance of an appropriate professional should be sought. This statement was developed by the DNP User Group Technical Committee and represents the considered judgment of a group of software developers with expertise in the subject field. However. or damages arising out of use of this document. not attempting to render engineering or other professional services. The DNP Users Group has made every reasonable attempt to ensure the completeness and accuracy of this document. except as permitted by written agreement with the DNP Users Group or a Party duly authorised by the DNP Users Group. omissions. If such services are required. Likewise. 13.3.2...1..2. step 9 8.6."Issue a link reset using link control block 0xC0" Added test procedure from TB2000-006 Added status code in error response as required in TB2001-01 5-July-01 2.2.4..4.2.01 2.4.1.5.1.2.g.6.1.5.2.1 Added test procedures from TB2001-001 Removed. step 2 8.9.3.3. SBO" with "skip this section" Added step 2 .8.11.2.11 .5.1 .4 8.in tables 8-3 and 8-4.4.2 Section 9.2.Revision History Date 18-Jan-99 15-Dec-99 10-July-00 Version 1..1-8.0" to "Variations 2..2. Changed "Variations 3.g.2.1.3 – 29-Sept-03 .1..2. Add at the end "using link control block 0xF3".1 8.2. 8.2.2. 8. 8.6. step 7 8.maximum number of unsolicited retries Added test procedure from TB9912-002 Added desired response to addresses 0xFFFE and 0xFFFD Added test procedure from TB9912-003 Added requirements for Control SBO retries Added test procedures from TB2000-002 Added requirements for Analog Output SBO retries Added test procedures from TB2000-002 Removed reference to function code 1 Removed function code 0xD1 from table Replace "end testing of Binary Output. 8.00 8.12 6 6.1.2.2. 8.1.6.1. step 1 8.4. step 3 8.15 8.5.12.00 Sections affected ALL see errata sheet for 1.1 .." Changed text to handle case where only two fragments are expected. step 1 8.5 8.2..11." to ".1 8.5. Appendices A and B 8..4. step 5 8. steps 9 and 12 8.2.end testing of Analog Output SBO" Changed ".3..2.2 8.2.6.2.does support.2.4.6.2.1.4.4. Added new steps to confirm the changes Add at the end "with a status code value of 2 (NO MATCHING SELECT)".5.2. 8.. step 3 8.2. 8.00 1.3.2.11.2.8 .00 with extensions) Added required parameter .7..3.2.6. 0x03 to e.2.2..2.end testing of Analog Outputs" to "..6.9 8.6.6.1. step 8 Tables 8-3 and 8-4 6.2 2.6..2.1...4. 0x83 Changed ".does not support.1.4.2.2. steps 14 and 15 8.1 8.3 DNP3-2003 IED Certification Procedure Subset Level 1 Page i Rev 2." to ". Removed references to delta counter objects Changed e. and 4" Changed 0xF4 to 0xC4 Updated to test Local Forced Data flag as well as IIN1-5 21-July-02 29-Sept-03 2.2.1.1.2.2. 8.1.4..5 8.1.2.4.2.4.1. the information required for these sections is not available and may not be for some time.2.5.4.1.10.1. SBO" with "skip this section" Replace "end testing of Analog Output." Changed ".4 Reason for change Initial Release Fixes inconsistencies and errors Designates protocol as DNP3-1999 (formerly DNP V3.6.1 8.8.in table 8-4.4. step 1 8..4 8. . 10 6...4 Invalid CRC ........................................................................................................................6.......................1 Reset Link and Passive Confirm support .........4.............................. 8 6............................................6......................................................6...........................................2 Invalid Primary Function Code...................................................2............................................................................... 9 6..............................................4 Invalid CRC ...................................................................................1 General.................................................................... 1 Definitions .....................................................................................................2 Test Procedure .......................................... 15 Page ii Rev 2...................................................................2 Test Procedure ....................... 9 6..............3................................................................................... 9 6....................................................................................................................................................................................................................................................................................................................................2 Internal Indications .........................................2.................................................................................................................................. 3 3.......................................... 13 Application Layer ..... 4 3......................... 8 6........................................................1 Desired Behavior ................................................6............................................................................1.................................................1 Desired Behavior .........................1...........................................1 Desired Behavior ................................ 6 6...............2 Test Procedure ....................................................................3...........................................................................2........3 – 29-Sept-03 4 5 6 7 8 DNP3-2003 IED Certification Procedure Subset Level 1 .........................................2 Invalid Secondary Function Code...................................................................................................................... 8 6..............................................................................................2...........................................1 Select Before Operate ...............................................1 Protocol specification ......1 Desired Behavior ..................................................... 7 6............................1 Invalid Start Octets .............................................................................. 3 3........................................................................................ 10 6.............1 Desired Behavior ................ 11 6................................................................................................................. 8 6......................................................................................................................6.....................................................2...........................................................3.............3 Error Responses ...................................................................................................................................................................................... 6 6....................................... 10 6..........................................................................................................................................................................................................................................................................3 Test Procedure – Secondary Frames ............................................................................................................................................6.2 Binary Outputs.................3 Request Link Status ................................................................................................................................................................................ 12 6..........2.............. 6 6..........................................................................................................1 Binary Output Status................. 7 6..................................1 Invalid Start Octets ............5 § DIR and FCV Bits....... 14 8................................................................................................................................................................................................................................................................... 15 8............................................................1 Device Profile Review ........3....................................................5................3 Invalid Destination Address............................................... 11 6.....................................................................1 Desired Behavior ............................. 5 Link Layer ........................................................................................................................................................................................................3 Invalid Destination Address...............2..2 Test Procedure ................2..................5 § Invalid FCV ...................4 Changes or Events .............6 Data Link Rejects Invalid Frames.................................2 Test Procedure .................................................. 7 6................................................................................. 11 6.................................................................. 13 7...........................................................................6...............................................................................................................................6.......................................3.......... 14 8.................. 14 8...........1......... 7 6.......................... 14 8................................................................................4 Test Retries ................................1 § Rules .... 7 6................................................................................. 12 Transport Layer .................................................................2 Test Procedure – Primary Frames ........................................................... 5 5................2 Equipment Review...................... 10 6.......5................................... 6 6.............................6.............................. 7 6.......................................................................... 14 8........... 5 Pretest Review ...............................3............................Contents 1 2 3 Overview..............................................................................................................................2 Test Procedure .............................................................................................................................................................................................. 3 3................................................4.................................................................................................................4.................................................................................................................................................... 3 3........6...........................................................................................................................2 Test Procedure ............ 12 6.............................................1................... 8 6.............................................................1 Desired Behavior ...............................1..................................................... 1 Notes.......................................................................... 8 6......6..........................1 Desired Behavior ................................................................................6............................................................................................... 1 1............................................................... 5 5.2 Test Link................................ 13 7....................................................................................................................................................................................1 Desired Behavior .......... 4 Reference Documents ...............................................................................................2.................................................................. ........2...... Incrementing Sequence Number Operate Retries ...............3......12 Analog Output.......4............................................2.......2........2....4 Multiple Object Requests............................................... 21 8............... Configurable Device....21 8...............................2............2................................ SBO.............2......................................4.............................18 8.......1.............................................................. to an Uninstalled Point ............................................1.................... Single Function Support ..............................1................................................................................................4................. Select with supported Code..............3.....2......26 8....................1...............9 Analog Output............1.............10 Binary Output.......2............................19 8......... SBO............25 8............. 24 8....... SBO..........................................2 Analog Output.........................25 8...................................................................... Incrementing Sequence Number Select Retries ....... SBO..1...................2...........1...............2.....3 Analog Output.........................22 8.......12 Binary Output....2........................................................1...............................2 Test Procedure ..1 Binary Output.......................2 Test Procedure ........2 Test Procedure ............. SBO...4.........1 Desired Behavior .....16 8..............................................2... SBO............ to Uninstalled Point..16 8.................................................... Direct Operate..........................17 8............................. 0x17....... To Uninstalled Point .. Configurable Device ......4............................................................................... 21 8......2.......................... Sequence number checking ...............................13 Binary Output.18 8..................4....................... Same Sequence Number Select Retries.................................3 Analog Output Status........3.........................2...........................6 Binary Output....................................... No Acknowledge .................................................................................... Execute On Time does not match Select On Time................. Direct Operate....2 Test Procedure ............ Configurable Device .. SBO.................2..........2...............26 8...........................3....... No Acknowledge................ 18 8...................4...................2 Test Procedure ......................................25 8.........1...........1......4........................................................ Incrementing Sequence Number Operate Retries ..........................1..................................... No Acknowledge...... 19 8.... SBO...4.......2...................... 0x28............2..............1 Binary Output..........4 Analog Outputs .2......1 Desired Behavior ......2...25 8..................1 Binary Output.......................................2......................1 Desired Behavior .............. 23 8............1 Binary Output..............................3....... Direct Operate.........2.2...................26 8.......17 8.........................2...... Complementary Function Support .......... Execute with different Code......................2....25 8.........2.................1 Desired Behavior ......................... 18 8. Direct Operate.....................................2.4...........................2.......................1.........................2.........3...............2...... 19 8............. SBO.. SBO.............................2.....................5............................................4...2.......................................2................ Execute Issued After Timeout.....................................4..... SBO...................... 19 8...................2........................ 23 8..10 Analog Output...........5 Binary Output......3 Binary Output...19 8..............2 Test Procedure .....16 8..................25 8....................... Same Sequence Number Operate Retries.........5 Analog Output......2......4.......................1............................. SBO.........26 8.....................................2...............................................14 Binary Output...2....2.........2................2.....4...............................2...................2..........1 Desired Behavior ............ 21 8............. SBO............................... 19 8.......................... Execute 0x17 ................................ Direct Operate........... SBO................ No Acknowledge.2...............2.................................................. SBO..................................5..... Configurable Device.....1......... 20 8...5....19 8............... 16 8...............................1.2.....7 Binary Output.........................5....20 8........................2....2....................1....................11 Analog Output.......................................................16 8..................5 Control Code Support ........4 Analog Output.................. Same Sequence Number Operate Retries...... Execute Issued After Time-out.. Direct Operate to Uninstalled Point ........ 20 8........2.................................................2................11 Binary Output...17 8..............................3..............4.2....................2 Binary Output..............2....................2.... SBO...... SBO... Same Sequence Number Select Retries.... SBO.......................................... Execute 0x17 ...................................26 8.......17 8.........................................8 Analog Output..1 Select Before Operate ...........2.2...................................................................2... 0x28...........................................3 Direct Operate.... SBO....... Execute Value does not match Select Value ............16 8.................1..... SBO.....3 Binary Output.....1..........1.................. SBO.2 Binary Output.................. SBO.............2.......... SBO................................16 8................... 24 8.......................2 Direct Operate with Acknowledge............ 20 8..... Select 0x28................................................................ SBO.......................4 Binary Output............. SBO.........2 Binary Output...............2.........2.......4..........................2........................................3 – 29-Sept-03 .26 DNP3-2003 IED Certification Procedure Subset Level 1 Page iii Rev 2.... Incrementing Sequence Number Select Retries .............2...................................9 Binary Output....19 8..1..........1...................... 23 8.................. 23 8......................................................... 25 8.........2.............................15 Binary Output..................................2....................................2..........................3 Binary Output.2........2........2 Test Procedure ..............1........................................1............................2.................20 8......................2....1 Desired Behavior .. Execute Off Time does not match Select Off Time .....2......................4...........7 Analog Output...................6 Analog Output.........2.........................17 8............8 Binary Output.......... SBO......2..............................................1 Analog Output.....................................................................2. SBO.......1...................1........2 Binary Output...1..1..........1......................................17 8.... 0x17...........................................2. Execute to Different Point Than Select............2.......18 8.................. Select 0x28.........................1... Sequence number checking............1............2...................2.......8........ ....................................................................................................6...........................................4................................. 0x07 ........4....................................................................................1 Class 1 Data..............................................1 Desired Behavior ..........2.........................5........................4 Class 3....................................................................................................2 Test Procedure ...............2..........4............4 Multiple Object Requests.................................4.......................................2...5.................6............ 0x06 ................34 8...................1 Desired Behavior .............................. Configurable Device..........................5...........2...................1 Desired Behavior ................ 27 8............5............5...5...................2..............Direct Operate with Acknowledge.........................................2....4.............1 Class 0....................37 8..............1 Desired Behavior ...................2........................................................................................... 28 8............................1 Desired Behavior ..................................6.3...........................................5 Multiple Object Request ...................... 30 8.................................32 8.....27 8...................................................................... 37 8.........................3 Class 2....31 8...........................2....................5....2.................................................................................................. Configurable Device..................................................................... 0x06 .............................................................................................2..2 Class 1......................... 28 8........ 38 8................2...................1 Class 3 Data........ 0x07 .......................3 – 29-Sept-03 ............2....2 Class 2 Data..................... 38 8.2.................................................................................................................................................................4...................3...................................... 37 8........... 38 8.2 Test Procedure ........5........6.................................................4 § Class 2 Data Without Confirm................ 39 DNP3-2003 IED Certification Procedure Subset Level 1 Page iv Rev 2....................................................................2..................................................................... No Acknowledge................................................... 39 8...................................3 Class 3 Data.............................. Direct Operate...............4.......................................2 Test Procedure ....................................3.........................1 Class 2 Data........3 Class 2 Data.....................4..................5................................ and 3............2 Test Procedure ........................2.................................... 31 8........................2 Test Procedure ................................... 27 8..................................................................4........................................... 28 8..................................................................................3........................... 35 8................1 Restart ...................................2....4..27 8..........................................................................4.................2 Test Procedure ...........................2 8............................................4..............................3...................................................2..28 8.......2 Test Procedure ...............4.......................... 27 8.......................................................2......3 Analog Output........................... 0x08 .................................................2.....................2.....4 § Class 1 Data Without Confirm.....2.................5...............2.. 0x06 ............................................5........3..............................................................................................................5......................................5.............. 38 8. 3.....4.............................................................................................................6 Class Assignment Verification..36 8...4...............2........................2.........36 8..............................33 8........................................................................................... to Uninstalled Point ........ to an Uninstalled Point...........................2 Test Procedure ............................................1 Analog Output....33 8........ 37 8.............. Direct Operate...........2............................................................5... and 0...............................2 Test Procedure ....... 28 8.......................................................................................................................... 38 8...................5.....5.......4.............4.................6............................................2...................................................................................... 37 8...................................................................................................3...........4......................... Direct Operate.....................5....... 0x08 .............................35 8.................................. Class 1.............27 8................ 35 8.....................2 Bad Function.......... 28 8.......4..............5...3...........................................6 Indications......................2...... 28 8...........32 8.....5.............. Direct Operate...2.............................2.......................... Direct Operate..................................................5................1..5............. 33 8.......6.................................................. No Acknowledge ............................................................................................................... Direct Operate..1.5...............28 8....................................31 8............. 0x07 .................................... 39 8.......................................5......... 30 8.........................................2 Test Procedure ..................2..................................1 Multiple Object Request..........................................................28 8.....................................5..................................1 Desired Behavior .............................................................................2 Analog Output......................................................................................4 § Class 3 Data Without Confirm...5..................................................................................................... 37 8.....5.................2 Multiple Object Request...........1 Desired Behavior .......5..............................1.......5......................................................... 31 8...........35 8...........2...... Class 1..........................................................................................2 Class 3 Data...................... No Acknowledge ...............2 Test Procedure .............2 Analog Output............................................................ 29 8........4............................. No Acknowledge...............................................................1 Desired Behavior ............................5 Class Data .................2............................................................................6.................................................4.. 33 8............ 33 8..................3 Direct Operate............5....6...........................3.......1 Analog Output...............................5......................................................... 29 8....... 35 8......3...............................................................5.....4................. 2... 2........... 30 8......................................2 Class 1 Data..............1 Desired Behavior ..........................................................................5.............................1 Desired Behavior .....................................4.....34 8..5..........................5..........5...............................................................1 Desired Behavior .............................3 Class 1 Data............... 0x08 ........3...........3 Analog Output.......2.....................................................................................................................................5...1......................................37 8.................. ..2 Clears transmitted data upon confirmation ......................................................................2...................................................4. 48 8.............................................................41 8....................................................................... 45 8...............................................................................9 Application Layer Fragmentation ..11...........................................................4.......2 Test Procedure ...................2 Test Procedure ....................................................... 41 8........................................11....8....................................................................... 44 8................................. 44 8..7...........................6..............................................................................................................................2 § Test Procedure ............................................... 44 8..........5....................... 39 8.............42 8.................................. 41 8........................................2 Test Procedure ...........2 Test Procedure ...... 46 8................. 41 8.....................................................................................................................................7........1 Desired Behavior ............................11............................6.....................................................................................................................1 Desired Behavior ........................................... 40 8................................................................................ 46 8..6..........6....50 8.....1 Desired Behavior ........................... 41 8..................................................................... 47 8................................................................................................................................................................. 39 8..........3 Buffer Overflow.........................................................1 Transmits data-filled unsolicited responses ..........................................................................................................................2 Test Procedure for Devices with Global Remote Supervisory Control............................................................9..........3 Restart Behavior...............................11 Unsolicited Responses ...................2...........................................10...Class 1 Data ....................................1 Buffer Overflow......................9............................................................................................................................................2 Test Procedure .......................................... 42 8................................................................2..........................1..........................................................50 8..........4 Runtime Behavior .6..........6.............6...............................................................................................9..............2....7................................................................................................................................................. Confirmed Response Options .2 Test Procedure .........................2 Test Procedure ................ 39 8.............................3 Unsolicited Response ..................................... 42 8......................... 50 8...........6.............4............2................50 8.................................................................1......................6.................................9....................................................................................2 § Use of Confirmation in Fragmentation ................ 45 8.....................................6.............4 Local ...................................... 44 8..........1 Desired Behavior .........................1 Use of FIR. 40 8............................................. 43 8.....2..............2 Buffer Overflow..................................................................8.......... 49 8........ 43 8............................................... 45 8..........7............2...................1...2 Synchronization ..........................11....................................................................................................Class 2 Data .....1...........7 Time...........................7.............................................................6...................................... 47 8...............................1 Desired Behavior .................... 39 8.................6...........................................................1..................11..........8 Cold Restart ........................................................................... 39 8..........1 Desired Behavior ..................... 46 8.......................................................................9.....................5. 44 8...........11.........................................................................................1..10..1 Configuration .... 39 8...............4 Defers READ requests until after confirmation received ......................11.1 Delay Measurement ..........................................................3 Processes non-READ requests immediately....................................................5 Unsolicited and Polled Responses .........2 Test Procedure ............5 Broadcast Address and All Stations Indication..................11..................7.1 Unsolicited Response Configuration/Startup ................................ 40 8..........................................11........ 43 8........ 42 8.........................................11.....1 Desired Behavior ......................... 44 8........2.....6 Buffer Overflow.. FIN and SEQUENCE in Fragmentation...................................................11....................................................................................................................6.....................1...... 47 8.........................3 Test Procedure ... 42 8....................1..................................................................................6................1 § Desired Behavior ............................................................ Binary Counter Change Event Buffers.....................................................6.............6.....2....................2. 49 8......................Object Unknown ............. 46 8..5...........6............3.............................................................................................................3...5.....................................5....6..............Class 3 Data ...................3 Test Procedure for Devices with Individual Remote Supervisory Control ................................1 Desired Behavior ..........11.6.................. 47 8....11...............................5 Unsolicited and Polled Responses .................3 8......5..........6................6.......3 – 29-Sept-03 .................................9.................2........ 43 8.....................................................................4 § Test Procedure............2 Sequence Numbers and Confirmation ............................................. 40 8..........................................2 § Test Procedure ......................................................................6......... 43 8.....................................................................................................................2..6............................. Analog Input Change Event Buffers ....................................................1 Desired Behavior ............... 39 8.........1............................41 8...5..............................................................2.............................................................................................................51 DNP3-2003 IED Certification Procedure Subset Level 1 Page v Rev 2.......................................................................2.....2 Unsolicited Response ..................................1 Desired Behavior ............. 45 8..........................................................................................................................................5..........11............2.......................................................................................................11..........................................................................4 Unsolicited Response ............................................................................................2......................................... 46 8. Binary Input Change Event Buffers ............................................................ 43 8....................................................11................................10 Multi-Drop Support ........ ...............11..................................3 – 29-Sept-03 ...................................2..........11.......... 54 8...............5.......52 8.........2..................................11........2.............................................6 Unsolicited Responses Off..............2 Test Procedure ..12..............5..5...........11..12............................... 53 8...........11.. 53 8............51 8.................................................................................................12 § Collision Avoidance .................2...........9 Retries unsolicited responses configurable number of times .....................................1 Desired Behavior .........5 8.................................................5...........................................................51 8...............................................................................7 Abandons READ requests upon subsequent READ requests.............................8 Inhibits Unsolicited responses until after polled confirmation .................................... 54 9 Appendix A – DNP3 Reference Sheets .....................51 8............................11.......................Defers READ requests until after confirmation timeout ...................................................52 8...5.................................................. 55 DNP3-2003 IED Certification Procedure Subset Level 1 Page vi Rev 2.....2....2......................................................................................6 Abandons READ requests upon subsequent non-READ requests..... This certification procedure is designed specifically to determine an IED’s compliance to level 1 of the Subset Definitions. Therefore only selected outputs will be tested to verify protocol operation. 6. This is not a factory acceptance test. They do however verify that the reported times are updated in a reasonable manner. 10. it is acceptable to use an alternate number supported by the device provided that the intent of the test is still satisfied.3 – 29-Sept-03 . Wherever the following procedures generate a specific number of events. 9. Transport Layer. Unless otherwise specified. and Subset Definitions). If the request generates multiple application fragments also verify that the application sequence number of each subsequent fragment increments by 1 modulo 16. If not explicitly stated all tests imply verification that all points in a normal operating state are reported with all flag bits except the ONLINE bit clear and the ONLINE bit is set. all Application Layer retries are disabled. 2 Notes 1. Record the point numbers used in all tests in the log. These requirements and clarifications will greatly improve interoperability and extensive efforts have been made to minimize the impact on existing implementations. If not explicitly stated all tests imply verification that a response to a request has the same application sequence number as the request. as specified in the procedure. When time tagged events are reported the certification procedures do not measure the absolute accuracy of the reported times.1 Protocol specification The protocol is defined by the Basic 4 Document set (Link Layer. it does gives reasonable assurance that Masters which can be configured to match items in the IED Device Profile Document will interoperate. 1. DNP3-2003 IED Certification Procedure Subset Level 1 Page 1 Rev 2. All application layer tests use unconfirmed link services using a request link control block of 0xC4 unless specified otherwise. 3. This procedure is an attempt to produce interoperability between Master and IED devices.00). Technical Notes published by the Technical Committee. However. verification that the object is reported with the “without flags” variation is also implied. and this Certification Procedure. not the certification procedures. This accuracy is guaranteed by the vendor.1 Overview It is the purpose of this document to describe a set of tests that will determine an Intelligent Electronic Devices’ (IED) compliance with the Distributed Network Protocol (formly known as DNP V3. although such interoperability can NOT be guaranteed. 4. 2. 5. 8. However. 7. The Device Profile Document specifies the accuracy with which the device measures the event. the DNP Users' Group approved these changes at the annual 1999 meeting based on strong recommendation from the Technical Committee. Alternatively. Application Layer. but a protocol test. The protocol defined by these documents shall be denoted DNP3-2003. These tests assume that the device will only generate events as controlled by the tester. Sections in this document marked with the symbol "§" constitute new requirements or clarifications beyond the Basic 4 Document set. Sections marked with three asterisks (***) extend the requirements of the device beyond DNP3-2000. 11. These sections may create interoperability problems with implementations done prior to the publication of this test procedure. A device must pass all of the tests to be considered compliant to this procedure. must result in either the specific action or behavior described in the protocol or in a correctly-formed. devices must continue to operate without interruption or anomalous behavior in response to properly or improperly formed requests. DNP3-2003 IED Certification Procedure Subset Level 1 Page 2 Rev 2. It is strongly recommended that the tester run the device for a least 24 hours at some point during the testing to insure that it does not exhibit any unusual or unexpected behavior.3 – 29-Sept-03 . Responses to all properly formed requests. In addition. appropriate protocol error response. 13. This is not a requirement for compliance to this procedure.12. Local mode.6 and the Subset Definitions section 4. 3. Class 2 event data available. The inability to observe an operation does not mean that an operation failed to take place. Operate This is an action taken by the Slave in response to a Master DNP request. Bits are named IINx-y. The following is a summary of the definitions. Can be set at any time and does not indicate an error condition.1 for detailed explanations of the IIN bits. x=1 for first transmitted octet and 2 for second transmitted octet. Can be set at any time and does not indicate an error condition. Note that some operations are difficult to observe without intimate knowledge of the Slave device. IIN2-0 or IIN2-1 or IIN2-2).e.3 Definitions 3. Device restart. Does not indicate an error condition. Set only under specific conditions. IIN1-1 IIN1-2 IIN1-3 IIN1-4 IIN1-5 IIN1-7 IIN2-0 IIN2-1 IIN2-2 3. DNP3-2003 IED Certification Procedure Subset Level 1 Page 3 Rev 2.2 Internal Indications IIN Octets 3 and 4 of the application response header. Parameter Error. Class 3 event data available. This action does not include transmission of a response. Device that sends DNP application function code 0. Response Message from Slave caused by a Master Request.129 (also known as “IED”). • For Multi-fragment responses the first fragment must have the same sequence number as the request and each subsequent fragment must increment the sequence number by 1 modulo 16. Examples of an operation are an audible relay click.1. Object Unknown.. Request Any message from a Master to a Slave where a response from the Slave is expected.128. Time synchronization required. y=bit number where 0=least significant bit.3 – 29-Sept-03 . or change in the internal state of the Slave. Generally means that the function code (octet 2 of the request header) cannot be processed.1 General Master Slave Device that sends DNP application function codes 0-23. Generally means that the function code could be processed but the object group / variation could not be processed. change in an LED status. Function Unknown. • Normal Response: Message containing an application response which has no error IIN bits set. and has no objects which indicate errors • All responses must begin with the same application sequence number as the corresponding request. Can be set at any time and does not indicate an error condition. Generally indicates that both the function code and object group / variation could be processed but that the qualifier / range field is in error. Responses are classified as follows: • No response: No octets are sent by Slave • Link only response: 10 octet message consisting of only a link layer message • Null Response: Message containing a 17-octet link/transport/application response with no error IIN bits set and no application objects. Set if some points are uncontrollable via DNP. Refer to the Basic Four Application Layer section 3. Error Response A response that has any or all of the Error IIN bits set which may also contain data. Can be set at any time and does not indicate an error condition. Class 1 event data available.3 Error Responses Error IIN bits IIN bits that indicate a request error (i. 2. 1. are explicitly forbidden. For numeric Change Objects. on any change in value greater than the point’s threshold Corresponding Static Object Name Binary Input Counter Frozen Counter Analog Input Frozen Analog Input Object 1 20 21 30 31 3. limited only by qualifier and range codes in the request.4. directly or indirectly.1 § Rules A device may claim that it supports a specific Change Object if and only if processing for that Change Object can be configured to adhere to the following rules. Change processing must be supported for all points in the corresponding Static Object. Change Objects and Static Objects are related in that a significant change in a point’s static value results in the creation of a corresponding Change Object entry A significant change for a point is defined to occur: • for a binary point. 3. 2.Unexpected Error Response Slaves may generate responses with any or all of the following: • unexpected bits in the IIN set • unexpected bits in any returned flags set • unexpected status code errors Any unexpected responses must be noted by the tester and “explained” in the test log. DNP3-2003 IED Certification Procedure Subset Level 1 Page 4 Rev 2. 4. 3. Some devices may decide to limit the set of points included in Change Object processing (in violation of rule 1). Change Object Name Binary Input Change Counter Change Events Frozen Counter Change Events Analog Change Events Frozen Analog Change Events Object 2 22 23 32 33 Table 3-1 1. Decisions based on information about any other point. on any change in state. and • for a numeric point. such devices may not check compliance with the corresponding Change Object in their Device Profile Documentation unless the device is configurable to conform to the rules above. The term “significant change” refers to any of the synonymous terms: “event” or “change event”. 3. The determination that a point has undergone a significant change can be determined only by using information from that point’s current or past value. While these implementations may be useful in specific instances.4 Changes or Events This section clarifies processing rules related to the following objects. the Device Profile must clearly specify the algorithm used for each point or set of points that specifies how the deadband(s) for those points are determined. All changes must be returned to a host that issues a request for any specific Change Object.3 – 29-Sept-03 . or to invoke a more complicated algorithm for determining a significant change (in violation of rule 2). This document describes the vendors’ specification of the behavior of the device.3 – 29-Sept-03 .00 Transport Functions DNP Version 3.00 Data Link Layer DNP Version 3. IEEE 802.3) • Input connections 5. A manufacturer’s representative should be available by phone to answer questions during the testing of the device.2 Equipment Review Before testing proceeds. This behavior should be compared to Level 1 requirements and any discrepancies resolved before testing proceeds. Bell 202. • Wiring diagrams and equipment necessary for Input stimulation. • Input power specifications. In particular the vendor must have provided the test facility with the following items.00 Data Object Library Layer DNP Version 3. 5.00 Application Layer DNP Version 3. DNP3-2003 IED Certification Procedure Subset Level 1 Page 5 Rev 2.1 Device Profile Review Before connecting any equipment the Device Profile should be carefully reviewed. It must be noted in the test results that the device is Level 1 compliant for requests only. Specifically the Device Profile should indicate that the device: • • Responds to all Level 1 requests that a slave device is required to parse. the following actions should be taken: • • • Testing can continue. Responds to Level 1 requests only with Objects/Variations and Qualifiers that a Level 1 master is required to parse. The required Master Level must be noted in the test results.00 (§ Version 3. • Device Profile Document • Device to be tested • Wiring Diagrams for • Power • Communications (e. the device will be examined to insure the proper equipment is available for the following: • Physical interfaces present and compatible.g.00 Subset Definitions Version 2. RS232. If a device generates any response requiring a higher level master to parse it. RS485. the vendor must supply to the tester a point number and method to determine whether or not a binary control and/or analog output has operated.00) 5 Pretest Review Before testing proceeds it is necessary to review documentation and equipment supplied by the vendor for completeness and appropriateness to the application.4 Reference Documents • • • • • DNP Version 3. • If it is not readily apparent whether an output point has operated. continue testing at section 6. Verify that the DUT either sends a NACK with the DFC bit clear or does not respond. 23. 24. Verify that the DUT responds by sending a data link reset (control block 0x40). 22. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. 16. 13. Cycle power to the DUT. Verify that the DUT responds with a valid message. 8. • A device can choose not to request link layer reset if it is using unconfirmed link services but MUST respond with a link layer confirm if a link layer reset is requested. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3.1 Desired Behavior • • • • • • The Device under test (DUT) must respond to a link reset with a link confirm. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xD3. this means that a device need not request link layer service but must support any services requested by another device. The following tests are designed to verify this functionality.1 Reset Link and Passive Confirm support 6. DNP3-2003 IED Certification Procedure Subset Level 1 Page 6 Rev 2. 6. 7.2. 9. Verify that the DUT responds with a link layer confirm and a valid application layer response. Issue a link reset using link control block 0xC0. 2. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3.1. Verify that the DUT responds with a link layer confirm and a valid application layer response. For example: • A device can choose not to request link layer confirms but MUST respond with a link layer confirm if requested to do so. 19. 12. Verify that the DUT responds with a link layer confirm (link control block 0x00) and no application response. Verify that the DUT either sends a NACK with the DFC bit clear or does not respond. DUT must not respond to application layer data requests using confirmed link services without a preceding link reset. function codes 0. 10. 21. 18.6 Link Layer Any DNP device is required to passively implement all link layer services.2 Test Procedure 1. Perform repeated requests of Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and alternating link control blocks 0xD3 and 0xF3. 11. Send a data link acknowledge (control block 0x80). Specifically. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Verify that the DUT responds with a link layer confirm (link control block 0x00) and no application response. 6. 20.1. DUT must respond to application layer data requests using unconfirmed link services without requiring a link reset. 27. Verify that the DUT responds with a link layer confirm (link control block 0x00).3 – 29-Sept-03 .e. Verify that the DUT responds with a link layer confirm (link control block 0x00). If the DUT cannot be configured to request data link confirms when transmitting. 14. DUT must issue a data link reset if transmitting requests that require a data link confirm. 26. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. 4. DUT must acknowledge but not otherwise respond to requests with the wrong FCB. 25. • § A device must respond to all unconfirmed link requests (i. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. 17. 6. Cycle power to the DUT. 3. DUT must respond to application layer data requests using confirmed link services after a link reset has been issued. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xD3. Verify that the DUT responds with a link layer confirm and a valid application layer response for each request. Issue a link reset using link control block 0xC0. Configure the DUT to request data link confirm when transmitting. 15. 9) without a preceding link reset. 4. 5. ACK (link control code 0x00). it has functioned correctly. 6.2. 10. 2. 2. 4. Request a Link Test Frame using link control block 0xD2. 4.ACK if the FCB bits are correct in the test request. If the DUT then issues a data link reset (control block 0x40).1 Desired Behavior • • • The DUT must respond with a Link Confirm . 9. Verify that the DUT responds with a Confirm . The DUT must ignore FCB when FCV = 0.ACK (link control code 0x00). 15.NACK with DFC=0 (link control code 0x01) or does not respond. the DUT must respond with the last secondary confirm frame. Verify that the DUT responds with a valid message having control block 0x73. respond by sending an acknowledge control block 0x80). Verify that the DUT responds with a Confirm . Verify that the DUT responds with a valid link status message with link control block 0x0B or 0x1B. Issue a Link Reset using link control block 0xC0. 29. This behavior is not tested since it was deemed by the Technical Committee as too difficult to test in a reliable manner. 5. Request a Link Test Frame using link control block 0xF2. If the DUT receives a test link frame without a previous link reset. 14. steps 25 through 28 should be repeated as shown above. Verify that the DUT responds with a Confirm . 6. Request a Link Test Frame using link control block 0xD2. the DUT must respond with a valid Status of Link message.3 Request Link Status 6.3. 11.ACK (link control code 0x00).2 Test Procedure 1. 5. Issue a Link Reset using link control block 0xC0. 16. continue testing at section 6.ACK (link control code 0x00).2. the DUT must either not respond or respond with a NACK with DFC = 0.1 Desired Behavior • • When issued a Request Link Status message. 3. 8. Verify that the DUT responds with a Confirm . Verify that the DUT responds with a Confirm . Cycle power to the DUT. Request a Link Test Frame using link control block 0xD2. 3.2 Test Procedure 1. 6. DNP3-2003 IED Certification Procedure Subset Level 1 Page 7 Rev 2. 13. Request a Link Test Frame using link control block 0xF2. DUT responses other than those of steps 26 and 28 indicate incorrect operation. Cycle power to the DUT. 30. Otherwise. If the DUT then repeats the Class 0 response message (control block 0x73).3 – 29-Sept-03 . and this test is complete.NACK with DFC=0 (link control code 0x01) or does not respond.3. 31.28. Verify that the DUT responds with a valid link status message with link control block 0x0B or 0x1B. Request a Link Status Frame using link control block 0xE9.2. Request a Link Status Frame using link control block 0xC9. Cycle power to the DUT. 6. Request a Link Test Frame using link control block 0xF2. including a request for data link confirm. 12. If the DUT did not issue a link reset at step 30. This is the response to the Class 0 data request. 6.2 Test Link 6. 7. Verify that the DUT responds with a Confirm . Issue a data link NACK with DFC clear (control block 0x81). Verify that no further retries are sent. § The DUT must be able to disable retries through configuration. The DUT must set the FCV bit to zero in all frames except SEND/CONFIRM User Data and SEND/CONFIRM Test Link. 12. It shall do this n times where n is a specified number of retries before aborting transmission (LINK RETRYCOUNT).2 Test Procedure 1. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. configure it to NOT request data link confirmations. continue testing in the next section.4. but do not respond in each case.1 Desired Behavior • • The DUT must clear (set to zero) the DIR bit in each data link frame it transmits. Both LINK TIMEOUT and LINK RETRYCOUNT must be specified in the Device Profile Document or they can optionally be configurable parameters.2 Test Procedure 1. If the DUT is capable of requesting data link confirmations. 18. or REQUEST LINK STATUS. it shall retransmit the link frame. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. 10. 8. cause it to do so. cause it to do so. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4.4. If the DUT does not support link layer confirms or link layer retries on primary transmissions. 15. Verify that the DUT responds with a RESET LINK frame.5 § DIR and FCV Bits 6. 17. Configure the device to enable link layer confirms on primary transmissions and if retries are configurable. Do not send a data link CONFIRM frame. 16. Verify that it repeats this exactly LINK RETRYCOUNT times. 6. The rest of these behaviors apply only to DUTs that support link layer retries. 6. RESET USER PROCESS. Verify that the DUT sends a valid application layer response in a SEND/CONFIRM USER DATA frame. 5. 19. the DUT must perform retries on all SEND/CONFIRM and REQUEST/RESPOND frames. Repeat steps 18 and 19 for each of these frames that can be generated. If it is possible to cause the DUT to send TEST LINK. 6. Do not send a data link CONFIRM frame. Repeat steps 11 and 12 for each of these frames that can be generated.4 Test Retries 6. Page 8 Rev 2. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame.6. set them to a reasonable value. 9. Send a data link CONFIRM. or REQUEST LINK STATUS. 2. If configured to enable link layer confirms on primary transmissions. RESET USER PROCESS. 3. Verify that the DUT sends a valid application layer response in a SEND/CONFIRM USER DATA frame. Cycle power to the DUT. Send a data link CONFIRM.5. Send a data link CONFIRM. but do not respond in each case. 6. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. If it is possible to cause the DUT to send TEST LINK. Do not send a data link CONFIRM frame. 14. Verify that the DUT responds with a RESET LINK frame. If the device requests a link layer confirm and does not receive it within a specified period of time (LINK TIMEOUT). These frames are tested elsewhere. Verify that it repeats this exactly LINK RETRYCOUNT times. 11.1 Desired Behavior • • • • • • DUTs are not required to support link layer retries. 4.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . 20. 7. Verify that the DUT sends a RESET LINK frame.5. 13. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. 4. no further testing is required in this section. 5.1 Desired Behavior The DUT must detect errors due to transmission line errors or the incorrect functioning of other devices. 13. and is therefore not tested here. If the DUT can generate RESET USER PROCESS or REQUEST LINK STATUS. Cycle power to the DUT. NOTES: • These procedures do not test whether the DUT rejects frames having the DIR bit set incorrectly. Verify that the DUT responds with application layer data. Verify that the DUT responds with a link layer confirm (link control block 0x00). a general-purpose protocol analyzer capable of generating any sequence of data is necessary. Verify that the DUT responds with a link layer confirm (link control block 0x00). If the DUT is capable of requesting data link confirmations. the DUT may also respond with LINK SERVICE NOT IMPLEMENTED. 9. 4. If the DUT is not capable of requesting data link confirmations.6 Data Link Rejects Invalid Frames 6. Implementers of Slave IEDs must. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. cause it to do so and verify that these frames have the DIR bit clear and FCV bit set.6. If a DNP-specific protocol analyzer is being used for testing.ACK. Issue a link reset using link control block 0xC0. to frames that are otherwise valid but have one of the following errors: • Incorrect start sequence • Incorrect destination address • Incorrect CRC • Invalid function code • Invalid FCV (Frame Count Valid) bit For an invalid function code or invalid FCV. This is tested in section “DIR and FCV Bits”. Verify the DUT first sends a frame with data link control block 0x40. 7.e.e. Verify the response from the DUT uses data link control block 0x44 i. it should be used to monitor the exchange between the general-purpose analyzer and the DUT. 6. RESET LINK with DIR=0 and FCV=0. 5.2 Test Procedure – Primary Frames Before performing the remainder of these tests: 1.6. It must therefore not respond. clear this bit (0) in all their transmissions to aid monitoring their device’s output on protocol analyzers. 3. Unconfirmed User Data with the DIR bit not set and the FCV bit not set. Verify the DUT sends a frame with data link control block 0x73 i. 11. 12. 6. Reply with a data link CONFIRM . 3. 6. SEND/CONFIRM USER DATA with FCV=1 and FCB = 1. DNP3-2003 IED Certification Procedure Subset Level 1 Page 9 Rev 2. The Device Profile Document indicates whether or not filtering is performed based on the source address. If the DUT can generate TEST LINK. • It is optional whether devices choose to filter frames based on source address. Prepare and send a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xC4. Cycle power to the DUT.e. configure it to do so. 10. i. 8. Cycle power to the DUT. 2. however. cause it to do so and verify none of these frames have the DIR or FCV bit set. Prepare and send a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xC4.2. Configure DUT to NOT request data link confirmations. 6. To perform the remainder of this test. either at a data link layer or application layer.3 – 29-Sept-03 . 7. 12. 2. 2. Alter the CRC of the data link layer header so the CRC is correct for the invalid control field. 6. Verify that the DUT does not send a link layer confirm or application layer response. Wait several seconds. 7.2. Send the request. Modify the frame so it begins with 0x05. 1. 3. 4. Send a READ request to different address. 3. 11. Modify the frame so it begins with an invalid initial start octet (e. FCB and FCV fields. Wait several seconds. Repeat this test once with different incorrect CRC values. 6. Modify the frame so the control field contains the correct settings of the DIR. 9. 5. e. 8. Modify the CRC of the data link layer header so the CRC is correct for the invalid start octet. Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block of 0xD3. 4.6. 6. Send the request.g.3 Invalid Destination Address 1. 6. 5. Send the request.e. but the second start octet is invalid (e.6. 4. 2.g. 10. but has an invalid function code. Verify that the DUT either does not send a link layer confirm. 10. PRM. 5. 6.6. 9. 2. 0xff).3 – 29-Sept-03 . Send the request.2.4 Invalid CRC Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xD3. Wait several seconds. Modify the frame so the CRC of the data link layer header is correct but the CRC of the application layer request is incorrect. Modify the CRC of the data link layer header so the CRC is correct for the invalid start octet. DNP3-2003 IED Certification Procedure Subset Level 1 Page 10 Rev 2. Send the request. 0xD5. 3. Repeat this test once with a different destination address. Verify that the DUT does not send an application layer response. Wait several seconds. 8.6. Note: For devices that can be configured to represent multiple logical devices (i.2. Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xD3. Verify that the DUT does not send a link layer confirm or application layer response. Repeat this test once with a different invalid function code. 0x09) instead of 0x05. can respond to requests directed to more than one address). Wait several seconds. Verify that the DUT does not send a link layer confirm or application layer response. 7.1 Invalid Start Octets 1.6.2.g. or responds with a valid LINK SERVICE NOT IMPLEMENTED frame (control field 0x0F). Modify the frame so the CRC of the data link layer header is incorrect. 6. Verify that the DUT does not send a link layer confirm or application layer response. Wait several seconds.2 Invalid Primary Function Code 1. Verify that the DUT does not send a link layer confirm or application layer response. ensure that the selected address is not one of the other valid addresses configured for the device. Repeat this test once using different start octet values. 4. 3. FCB = 0 ignored 6. The DUT may respond with a link layer frame with function code LINK SERVICE NOT IMPLEMENTED. 8. Configure the device to enable link layer confirms on primary transmissions and if retries are configurable set them to a reasonable value. FCB = 0 ignored FCV=1 incorrect. i. SEND/NO CONFIRM USER DATA.6. Cycle power to the DUT. it should be used to monitor the exchange between the general-purpose analyzer and the DUT.3. 4.6. Verify the DUT responds with application layer data.3 Test Procedure – Secondary Frames The tests in this section are optional. 5. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. Repeat this test once with different start octet values. 0x09). Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xC3. 7. i. 4. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. The retries are used to detect whether the device processed the data link layer confirmation.e. 9. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4.3 – 29-Sept-03 . 2. Verify that the DUT does not send a link layer confirm or application layer response. the DUT sends a RESET LINK frame. Repeat steps 5-8 using the control blocks in the following table: Code C2 D0 D9 Description Test Link RESET LINK Link Status Request Notes FCV = 0 incorrect FCV=1 incorrect. The DUT may respond with a link layer frame with function code LINK SERVICE NOT IMPLEMENTED. 0xff). Send a data link CONFIRM – ACK frame in reply. 8. requesting data link confirmation.g. Send a CONFIRM – ACK frame modified so its start octet is invalid (e. 3. 6. Wait several seconds. 7. 5. 2.g. To perform the remainder of this test. Verify the DUT responds with application layer data. Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xD4. If a DNP-specific protocol analyzer is being used for testing. but with FCV=1 (incorrect). 6. SEND/CONFIRM USER DATA. 6. Send the request. requesting data link confirmation.1 Invalid Start Octets 1. 6. Send a CONFIRM – ACK frame modified so the start octet is correct (0x05).6. a general-purpose protocol analyzer capable of generating any sequence of data is necessary. Before performing these tests: 1. 3.e. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame.6. DNP3-2003 IED Certification Procedure Subset Level 1 Page 11 Rev 2. but with FCV=0 (incorrect). Verify that the DUT does not send a link layer confirm or application layer response. Verify that before responding with application layer data. 5. Verify the DUT responds with application layer data. Send the request. 4. 3.2. but the second octet is incorrect (e. requesting data link confirmation. Wait several seconds. 2. 9. and must pass only if the DUT requests data link confirmations and performs retries.5 § Invalid FCV 1. Send a valid CONFIRM – ACK frame in reply. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame.g.2 Invalid Secondary Function Code 1. 2. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. 6. 2. 3.3 – 29-Sept-03 .6. 6. 2. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. 4. Repeat this test once with a different CRC value. Ensure that the CRC is correct for the invalid function code value. Repeat this test once with a different function code value. This test may be performed with a DNP-specific test set.3. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. 3. PRM and DFC bits of the control field are correct. 4. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. requesting data link confirmation. 0x83). but the function code is invalid (e. Verify the DUT responds with application layer data. 6.4 Invalid CRC 1.3.6. Send a CONFIRM – ACK frame to a destination address that is not that of the DUT. 5. 4. Verify the DUT responds with application layer data. DNP3-2003 IED Certification Procedure Subset Level 1 Page 12 Rev 2. Repeat this test once with a different destination address.6. 5. 5. Verify the DUT responds with application layer data.3. requesting data link confirmation.6. requesting data link confirmation. 3. Send a CONFIRM – ACK frame modified such that the CRC is incorrect.3 Invalid Destination Address 1. Send a CONFIRM – ACK frame modified so the DIR. If the DUT’s reply contains less than 250 octets in the Data Link Frame then the FIR bit is set to one and the FIN bit is also set to one. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06. 5. If the DUT’s reply contains more than 249 octets then verify that the first response message sets the FIR bit to a one.3 – 29-Sept-03 . c) Distribute the data correctly. and the sequence number increments by one. and the SEQ value increments by one. b) Set the correct sequence information. Verify that the last message has the FIR bit is zero and the FIN bit is one. If the device does not contain enough data. 4. • 7. 7. signifying the last data fragment. the FIN bit is zero.2 Test Procedure 1. d) Signify to the initiating station that the reply contains multiple LPDU’s e) Provide the appropriate information for assembly at the receiving station. Cycle power to the DUT. 3. Verify that the DUT responds with a valid message. the FIN bit is set to zero. bit 7 FIN Transport Header bit 6 bits 5-0 FIR Sequence number Table 7-1 7.7 Transport Layer Whenever FIR. FIN and sequence numbers are referenced in this section they refer to the definitions present in the transport header which is reproduced here for convenience.1 Desired Behavior • If the DUT contains enough data to cause the reply to an application request to be larger than one Link Protocol Data Unit. 2. Verify subsequent messages to assure that the FIR bit is zero. a) Set the proper FIR and FIN bits. then the FIR and FIN bits must signify that there is only one LPDU in the reply. it is required to. 6. DNP3-2003 IED Certification Procedure Subset Level 1 Page 13 Rev 2. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. A device may be configurable to disable any subset of the modes. Verify that the data is reported using either 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01). it is required to be configurable to support all three modes of operation of control. the device must be configured with at least one Binary Output point installed or enabled before proceeding with the test procedure.0=normal.1 Desired Behavior • • • If the device supports binary outputs the device must respond to a Binary Output read request with a binary output status object (object 10 Variation 2) using qualifiers 0x00 or 0x01. 1=forced 0 0 STATE .1. it must return a control status value of 4 (control operation not supported for this point).0=normal. 1= restart COMMUNICATION LOST . It is also the hosts’ responsibility to perform select before operate control when it is unacceptable to have the control point operated more than once. 8. 1=lost REMOTE FORCED DATA .0=normal. namely Select Before Operate.8 Application Layer 8. If the device does not support binary outputs the device must respond to a Binary Output read request with a Null Response. 1=forced LOCAL FORCED DATA .3 – 29-Sept-03 . If the DUT is configurable in a manner such that points can be uninstalled or disabled. Optionally. If the device does not support Binary Outputs verify that the DUT responds with a Null Response.1 Binary Output Status The binary output status object represents the current state and status of the associated binary output. If the device supports Binary Outputs verify that the DUT responds with a Binary Output Status object (Object 10 Variation 2).2 Binary Outputs § If a device supports control outputs. and Direct Operate No Acknowledgment.0. 2. Note #5. 3.1.2 Test Procedure 1. The status is an 8-bit flag field (repeated here for your convenience): Flag Bit 0 1 2 3 4 5 6 7 Value ONLINE . This is typically a configuration item in the host and is the responsibility of the end user to configure properly. 1= on-line RESTART . The device can optionally set IIN2-1. 5. It is the outstations’ responsibility to perform the control operation if a correct control dialog has been issued from the host. If a device has been configured to reject a particular mode. 8.0=normal. 4. DNP3-2003 IED Certification Procedure Subset Level 1 Page 14 Rev 2. Direct Operate. the device can return an error response with IIN2-1. Verify that flag behavior complies with Section 2.0=off-line. It is the hosts’ responsibility to determine the appropriate control mechanism. 1 Table 8-1 8. The control point does not operate. DNP3-2003 IED Certification Procedure Subset Level 1 Page 15 Rev 2.1. qualifier. it must respond to a select with an Error Response setting IIN2-1. The specified control operates. variation. An example of this is a recloser. and all object data must match exactly byte for byte the data sent in the select message. • The DUT responds to executing an installed control point after the configured acceptable select to execute delay by echoing the execute and setting the status field to 1 [Execute received after timeout]. – match the object portion of the select message byte for byte.2. The outstation then echoes the exact control request byte for byte to the host. • The DUT responds to selecting an uninstalled control point by returning an error response with IIN2-2 set and a status code of 4. The host first initiates the select portion of the dialog. • The DUT supports 8 and 16 bit point indexing. • The DUT must accept retries on the operate portion of the control dialog that does not increment the application sequence number between retries. qualifier. The following assumes that the device supports control operations: • The maximum select to execute delay time must be specified in the Device Profile Document. • The DUT responds to matching select and execute requests by echoing each request with the status field set to 0. • No further testing in this section is necessary. but that the object. If this message matches the select message byte for byte and it is received within the configured acceptable delay between select and execute the outstation must operate the control point.1 Select Before Operate Select before operate control is used under circumstances when it is absolutely imperative that the control point operate only once. excluding the application header. 8. The following assumes that the device supports control operations and were added as a result of Technical Bulletin TB2000002 (Control Retries): • The DUT must accept retries on the select portion of the control dialog that increment the application sequence number between retries. it must respond to a select with an Error Response setting IIN2-1 or IIN2-2. In this case the select-to-operate timer must be restarted after reception of each select. • The DUT must reject any operate that does not: – contain a application layer sequence number that is exactly one greater (modulo 16) than the previously accepted select. however there are no control points installed/enabled: • If the device does not have any control outputs installed.8. The following assumes that the device does support control operations. Note that the encapsulation information need not match.3 – 29-Sept-03 . The host then sends the execute portion of the dialog. The DUT must echo the operate command but must not operate the control more than once. The object. • The DUT must accept retries on the select portion of the control dialog that do not increment the application sequence number between retries. and all object data must match exactly. • An Error Response with IIN2-2 set is an invalid response. variation. In this case the select-to-operate timer must remain unaltered by the reception of each additional select. The control point does not operate • The DUT responds to a non-matching execute with a status field of 2 [No previous matching select] and does not operate the control under the following conditions: • No prior select issued • On time mismatch • Off time mismatch • Control code mismatch • The DUT operates various selected control points.2.1 Desired Behavior The following assumes that the device does not support control operations: • If the device does not support control outputs. 8.1. 5. SBO.2 Test Procedure 8.2. If the device does support control outputs. 0x28 1.8. Immediately issue an execute to Object 12 Variation 1 to a different installed point using 8 bit indexing (qualifier 0x17). Verify that the selected control operates. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 3. 4.2. 5.1. 4. 2. 4.2. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. Issue a matching execute and verify that the DUT echoes the execute with the control status field set to 1[Execute received after timeout]. Execute Issued After Timeout 1. Verify that the selected control operates. a control code supported by the device and an appropriate on time/off time. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 8. the on time incremented by 1 and the same off time as the previous select. 4. Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . Immediately issue a execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 2. SBO. 8.1. Verify that no control point operates.2.2. Page 16 Rev 2. 2. SBO. Wait 1 second past the configured maximum select to execute delay time.5 Binary Output.2. To Uninstalled Point 1. SBO. Execute to Different Point Than Select 1.4 Binary Output.1. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select].6 Binary Output. 3.1. 5. 8. verify that the DUT responds by echoing the select message exactly.1.1. 0x17 1. Issue a select using Object 12 Variation 1 to an uninstalled point using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time.2. 3. Verify that no control point operates. 2.1 Binary Output. Verify that the DUT responds by echoing the select message exactly.2. Immediately issue a matching execute.3 Binary Output. 5. 3.2 Binary Output.2.2.2. Verify that the DUT echoes the execute. 6. 5. 8. a control code supported by the device and an appropriate on time/off time. If the device does not support control outputs. Verify that the DUT responds by echoing the select message exactly. a control code supported by the device and an appropriate on time/off time. and the same on time/off time as the previous select. the same control code as the select. Issue a select using Object 12 Variation 1 to an installed point using 16 bit indexing (qualifier 0x28). Issue a select using Object 12 Variation 1 to a different installed point using 8 bit indexing (qualifier 0x17). verify that the DUT responds with a Error Response with IIN2-1 set. Verify that the DUT echoes the execute.2. 2.2. Execute On Time does not match Select On Time 1. Issue a select to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). Verify that no control point operates. 3. 4. Verify that the DUT responds by echoing the select message exactly. End testing of Binary Output SBO. a control code supported by the device and an appropriate on time/off time. Immediately issue a matching execute. Verify that the DUT responds by echoing the select message exactly. SBO. the same control code as the select. a control code supported by the device and an appropriate on time/off time. 2. Verify that no control point operates. 3. SBO. SBO. Select with supported Code. a control code supported by the device and an appropriate on time/off time. 2. 2. 3. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17).2. Select 0x28. Verify that no control point operates.2. 4. skip this section. SBO. 8. If the DUT does not have installed binary output points. 2. Execute Off Time does not match Select Off Time 1.1. 5.12 Binary Output.10 Binary Output. 3. 3.7 Binary Output. a control code supported by the device and an appropriate on time/off time.1.11 Binary Output. Verify that the DUT echoes the object portion of the select byte for byte. SBO. 3. Immediately issue an execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). a control code supported by the device and an appropriate on time/off time. Verify that the DUT responds by echoing the select message exactly. Verify that no control point operates. If the device is not configurable in a manner such that control points can be uninstalled or disabled. 2. 4. 6. Immediately issue an execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). Verify that the DUT responds by echoing the select message exactly.2. Verify that no control point operates. Page 17 Rev 2.2.8. Issue a valid select to an installed binary output point. a control code supported by the device and an appropriate on time/off time. the same control code as the select. 3. a control code supported by the device and the same on time/off time as the previous select. Verify that the DUT operates the binary output. 2.1.1. Verify that no control point operates. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select].2. Incrementing Sequence Number Select Retries 1. Verify that the DUT responds by echoing the select message exactly. 4. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 8. 8. Issue a valid operate. 4. Verify that the DUT echoes the object portion of the select byte for byte.2. Configurable Device 1. Issue a select using Object 12 Variation 1 to an installed point using 16 bit indexing (qualifier 0x28). 5. 2.1.2. Verify that the DUT echoes the object portion of the operate byte for byte. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set. skip this section.8 Binary Output. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. a control code different from the previous select.2. incrementing the sequence number by 1 modulo 16. Configure the DUT such that all Binary Output points are uninstalled or disabled. 7.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . Immediately issue an execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). Execute 0x17 1. 8.2. 8.2. 6. 8. 4. same on time as the previous select and the off time incremented by 1. If the DUT does not have installed binary output points. SBO. Issue the select again using the same application layer sequence number. incrementing the sequence number by 1 modulo 16. Issue a valid select to an installed binary output point. Issue a select using Object 12 Variation 1 to point 0 using 16 bit indexing (qualifier 0x28). SBO. and the same on time/off time as the previous select. Same Sequence Number Select Retries 1. 4. 5.9 Binary Output. 3.2. SBO.2. Verify that the DUT echoes the object portion of the select byte for byte. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. skip this section. 5. Verify that the DUT echoes the object portion of the select byte for byte. Issue the select again incrementing the application layer sequence number by 1 modulo 16. Execute with different Code 1. 5. 5.1. Issue a valid operate. 2. it must respond to a direct operate with an Error Response setting IIN2-1.2. incrementing the sequence number by 1 modulo 16. 4. 3. SBO. Verify that the DUT echoes the object portion of the select byte for byte. 2.14 Binary Output. 9. skip this section. Issue the operate again. 3. The following behavior assumes that the device supports control operations: • The DUT responds to a direct operate to an uninstalled data point by returning an Error response with IIN2-2 set and a status code of 4. Verify that the DUT operates the binary output. • No further testing in this section is necessary. incrementing the select sequence number by 1 modulo 16 to make sure the mismatched operate cleared the previous select. The control does not operate. 5. Verify that the DUT echoes the object portion of the operate byte for byte. SBO.15 Binary Output. DNP3-2003 IED Certification Procedure Subset Level 1 Page 18 Rev 2. Sequence number checking 1. If the DUT does not have installed binary output points. 7.2. If the DUT does not have installed binary output points. Issue a valid operate. 8. Issue a valid operate.2. Issue the operate again using the same application layer sequence number. Verify that the DUT does not operate the binary output. Verify that the DUT echoes the object portion of the operate byte for byte. incrementing the sequence number by 1 modulo 16. SBO. 7. 6. Verify that the DUT operates the binary output. 5. Verify that the DUT does not operate the binary output. 8. 8. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). skip this section. Verify that the DUT echoes the object portion of the select byte for byte.2. Incrementing Sequence Number Operate Retries 1.7.2. skip this section.1. Issue a valid operate. 6. 2. incrementing the sequence number by 1 modulo 16. 4.3 – 29-Sept-03 . Issue a valid select to an installed binary output point. 8.13 Binary Output. 8. 2. Verify that the DUT echoes the object portion of the select byte for byte. Verify that the DUT does not operate the binary output. incrementing the sequence number by anything but 1 modulo 16. 3. If the DUT does not have installed binary output points. Verify that the DUT does not operate the binary output. 5. Verify that the DUT operates the binary output. Same Sequence Number Operate Retries 1. Verify that the DUT echoes the object portion of the operate byte for byte. 8. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). Issue a valid select to an installed binary output point.2. Issue a valid select to an installed binary output point.1 Desired Behavior The following behavior assumes that the device does not support control operation: • If the device does not support control outputs.2. 4. • An Error Response with IIN2-2 set is an invalid response.2. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). 9.1. 8. 8.1. 7. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). Issue a valid operate.2 Direct Operate with Acknowledge 8. 6. 9. 2.2 Binary Output.2. 2.2. DNP3-2003 IED Certification Procedure Subset Level 1 Page 19 Rev 2. it must respond to a direct operate with an Error Response setting IIN2-1 or IIN2-2. verify that the proper control point operates.2 Test Procedure 8. 4. If the device does not support control outputs.2. 2. however there are no control points installed/enabled: • If the device does not have any control outputs installed.• The DUT responds to a direct operate to an installed data point by echoing the direct operate and setting the status field to 0.2.3 Direct Operate. Direct Operate to Uninstalled Point 1. Issue a direct operate using Object 12 Variation 1 to an uninstalled point using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. 4. If the device supports binary outputs and the operate message is correct then the binary output point must operate.2. 8. Configure the DUT such that all Binary Output points are uninstalled or disabled. Binary Output. If the device does not support control outputs verify that the DUT responds with an Error Response with IIN2-1 set and end testing of this section. Configurable Device If the device is not configurable in a manner such that control points can be uninstalled or disabled.2. 3. Direct Operate. No Acknowledge using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17).1 Binary Output.2.3. Issue a direct operate using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). Verify that no control operates. The following behavior assumes that the device does support control operations. Direct Operate. 4.3 – 29-Sept-03 . end testing of this section. 8.2.3 1. a control code supported by the device and an appropriate on time/off time. Issue a direct operate using Object 12 Variation 1 to point 0 using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time.2. 8. Direct Operate 1. The specified control operates. No Acknowledge 1. 5.2. No Acknowledge 8. Verify that the DUT responds by returning an Error response with IIN2-2 set and a status code of 4.2. Direct Operate. Verify that the DUT does not respond. 3.1 Binary Output. Issue a Direct Operate.2. If the device does support control outputs verify that the DUT responds by echoing the direct operate message exactly with status field of 0.3. 2. 8. 8.3. Verify that no control operates.2.2 Test Procedure 8.2. If the device does support control outputs. 2. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set. 3.2. a control code supported by the device and an appropriate on time/off time. Verify that the specified control operates.1 Desired Behavior • • The DUT must not respond to in any way to the direct operate no acknowledge. 3. end testing of Binary Output. 1 Desired Behavior • • The DUT must parse requests for all control operations within a single frame.4. 8. 2. a control code supported by the device. and an appropriate on time/off time. Configure the DUT such that all Binary Output points are uninstalled or disabled.2. Up to a full frame of request operations must be supported. 8. The following assumes that the device supports control operations and were added as a result of Technical Bulletin TB2001001 (Multiple Control Object and Status Codes): • The DUT responds to requests having more points than are supported in a single message with a status code of 8 for at least the first point that is beyond the point count limit. No Acknowledge. using Object 12.2 Test Procedure 1. Direct Operate. This number shall be the smaller of: • The number of controls supported in a single request • The number of installed control points • Sixteen In a single request. No Acknowledge using Object 12 Variation 1 to point 0 using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. In a single request.3 1. Issue a Direct Operate. Verify that each of the selected controls operated.4 Multiple Object Requests 8. Verify that the DUT does not respond. and the last object returns a status code of 8. 5.2.2.2.2. or IIN2-2 set and that each object returns a status code of 0. 4. or IIN2-2 set and that each object returns a status code of 0. to an Uninstalled Point 1. 3. No Acknowledge. No Acknowledge using Object 12 Variation 1 to an uninstalled point using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. issue a select to the above number of points using Object 12. Verify that the DUT does not respond. skip to step 13. Immediately issue a matching execute. IIN2-1. 7. Verify that the DUT response has none of IIN2-0. 4. If this number is one. skip to step 7. 8.3 – 29-Sept-03 3. 9. DNP3-2003 IED Certification Procedure Subset Level 1 .2. each point having a different index but otherwise able to be controlled. 3.2. • The DUT responds to a select to an uninstalled control point by returning an error response with IIN2-2 set and a status code of 4.8.2 Binary Output. 2. Review the device’s profile document to understand how many control points are supported in a single request. issue a select to at least one more point than is supported in a single request. Direct Operate. 8. Direct Operate. Verify that no control operates. 6. or IIN2-2 set. Page 20 Rev 2. Configurable Device If the device is not configurable in a manner such that control points can be uninstalled or disabled. Variation 1 and 16-bit indexing (qualifier 0x28). Verify that no control operates. a control code supported by the device. Determine the number of installed points that can be successfully controlled in a single request. end testing of Binary Output. Verify that the DUT response has none of IIN2-0. Issue a Direct Operate.3. Note that controls may execute simultaneously or sequentially one after the other.4. IIN2-1. No Acknowledge. and an appropriate on time/off time. IIN2-1. 2. 5. that each object except the last returns a status code of 0. Binary Output. Variation 1 and 16-bit indexing (qualifier 0x28).3. Verify that the DUT response has none of IIN2-0. If the number of control objects supported in a single request is greater than or equal to either • The number of control objects that fit into a single frame or • The number of installed control points. 4.1 Binary Output.5. Complementary Function Support 1. 8. If the DUT does not have installed complementary function binary output points skip this section. skip to step 13.2. • • 8. Issue a valid control sequence to the first installed complementary function binary output point using control code 0x03 (Latch On/NUL). Verify that the DUT response has none of IIN2-0.2 Test Procedure 8.2. If the DUT does not support direct operate.10.1 Desired Behavior The following assumes that the device supports control operations and were added as a result of Technical Bulletin TB2000006 (CROB Control Codes): • For complementary function indices. Verify the control operation completes successfully. In a single request. In a single request.5. 6. If it does: – control codes 0x03 (Latch On/NUL) and 0x41 (Pulse On/Close) must perform the same function – control codes 0x04 (Latch Off/NUL) and 0x81 (Pulse On/Trip) must perform the same function For single function indices. Verify that all except the last control point operated. If the DUT does not support the 0x41(Pulse On/Close) and 0x81 (Pulse On/Trip) pair skip to step 13. Issue a valid control sequence to an installed complementary function binary output point using control code 0x41(Pulse On/Close). Variation 1 and 16-bit indexing (qualifier 0x28). 5. 9. 13. and an appropriate on time/off time.5 Control Code Support 8.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . If the DUT does not support the 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) pair skip to step 8. a control code supported by the device. it must perform the same function for each control code it accepts. 8. 11. or IIN2-2 set. Verify the complementary control operation completes successfully.2. issue a direct operate command to at least one more point than is supported in a single request. the outstation must accept at least one of the following control codes: – 0x01 (Pulse On/NUL) – 0x03 (Latch On/NUL) – 0x04 (Latch Off/NUL) – 0x41 (Pulse On/Close) – 0x81 (Pulse On/Trip) If the outstation accepts more than one control code for a single function index.5. each point having a different index but otherwise able to be controlled. IIN2-1. that each object except the last returns a status code of 0 and the last object returns a status code of 8. a control code supported by the device. 12. 14. that the status code returned for the installed point is 0 and the status code returned for the non-installed point is 4. issue a select to one installed control point and to one point that is not installed using Object 12. the Outstation must accept at least one of the following control code pairs: – 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) – 0x41 (Pulse On/Close) and 0x81 (Pulse On/Trip) • The outstation may optionally accept both forms of complementary control code pairs. using Object 12. 7.2. The installed point should be the first object in the request. 2. Verify that the DUT response has IIN2-2 bit set. If the DUT does not have installed binary output points skip this section. Issue a valid control sequence to an installed complementary function binary output point using control code 0x04 (Latch Off/NUL). 3. Page 21 Rev 2.2. and an appropriate on time/off time. Variation 1 and 16-bit indexing (qualifier 0x28). 2. 9. Verify the complementary control operation completes successfully. Verify the control operation completes successfully. 6. 21. 20. 11. Verify the control operation completes successfully. 13.2. Verify the control operation in step 3 completes successfully. 14. 13. Issue a valid control sequence to the first installed single function binary output point using control code 0x03 (Latch On/NUL). DNP3-2003 IED Certification Procedure Subset Level 1 Page 22 Rev 2.3 – 29-Sept-03 . 8. 14. 18. 16.2. If the DUT does not support the 0x04 (Latch Off/NUL) control code for single function binary output points at this index skip to step 13. Verify the control operation in step 3 completes successfully. 19. 11. 3. 17. 7. 8. Issue a valid control sequence to the first installed single function binary output point using control code 0x81 (Pulse On/Trip). Issue a valid control sequence to the first installed single function binary output point using control code 0x01 (Pulse On/NUL). Verify the complementary control operation completes successfully. 15. 5. Single Function Support 1. Verify that the complementary control operation completes successfully. Verify the control operation in step 3 completes successfully. For any point that is tested below. If the DUT does not support the 0x41 (Pulse On/Close) control code for single function binary output points at this index skip to step 16. Issue a valid control sequence to the same installed complementary function binary output point using control 0x81 (Pulse On/Trip).10. Issue a valid control sequence to the first installed single function binary output point using control code 0x41 (Pulse On/Close). If the DUT does not support both the 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) control code pair and the 0x41(Pulse On/Close) and 0x81 (Pulse On/Trip) control code pair skip to step the next section. Issue a valid control sequence to the first installed single function binary output point using control code 0x04 (Latch Off/NUL). 17. If the DUT does not support the 0x01 (Pulse On/NUL) control code for single function binary output points at this index skip to step 7. Issue a valid control sequence to an installed complementary function binary output point using control code 0x03 (Latch On/NUL).5. If the DUT does not support the 0x03 (Latch On/NUL) control code for single function binary output points at this index skip to step 10. 18. 10. 16. 12. Issue a valid control sequence to an installed complementary function binary output point using control code 0x81 (Pulse On/Trip). Verify the complementary control operation completes successfully. Verify the control operation in step 3 completes successfully. If the DUT does not have installed binary output points skip this section. If the DUT does not support the 0x81 (Pulse On/Trip) control code for single function binary output points at this index skip to the next section. Verify the control operation in step 3 completes successfully. Issue a valid control sequence to the same installed complementary function binary output point using control code 0x41(Pulse On/Close).2 Binary Output. 12. 4. Issue a valid control sequence to the same installed complementary function binary output point using control 0x04 (Latch Off/NUL). If the DUT does not have installed single function binary output points skip this section. 15. determine what action should happen when the control executes. 3 Analog Output Status The Analog Output Status object represents the actual value of an analog output or software point and the associated status reported by an 8-bit flag field (repeated here for convenience): Flag Bit 0 1 2 3 4 5 6 7 Value ONLINE . Issue a Direct Operate to Object 41 Variation 2 to an installed point using 16 bit indexing (qualifier 0x28) and an appropriate value. The device can optionally return an Error Response with IIN2-1or IIN2-2 set. 8.3.0=normal. 1= restart COMMUNCATION LOST . the device must be configured with at least one Analog Output point installed or enabled before proceeding with the test procedure. 1= on-line RESTART . This is typically a configuration item in the host and is the responsibility of the end user to configure properly. If the DUT is configurable in a manner such that points can be uninstalled or disabled. If the device does not support Analog Outputs verify that the DUT responds with a Null Response. 4.2 Test Procedure 1.0=off-line.8. If the device does not support analog outputs the device must respond to an analog output read request with a Null Response or an Error Response with IIN2-1 or IIN2-2 set. 6. Issue a request for Object 40 Variation 0 using the all data qualifier 0x06. The value returned in the Analog Output Status must reflect the value written to the corresponding Analog Output point within the tolerances specified by the manufacturer. A device may be configurable to disable any subset of the modes. Verify that the value returned in the Analog Output Status object reflects the value sent in step 1 within the tolerances specified by the manufacturer. If the device supports Analog Outputs verify that the DUT responds with an Analog Output Status object (object 40 Variation 2).0=normal.1 Desired Behavior • • • If the device supports analog outputs the device must respond to an analog output read request with an analog output object (object 40 variation 2) using qualifier 0x00 or 0x01. 5. Direct Operate. It is also the hosts’ responsibility to perform select before operate control when it is unacceptable to have the analog output point operate more than once. it must return a control status value of 4 (control operation not supported for this point). 3.0=normal. 8.0=normal. 1=forced LOCAL FORCED DATA . 2. If a device has been configured to reject a particular mode. 1=lost REMOTE FORCED DATA . It is the outstations’ responsibility to perform the analog output operation if a correct control dialog has been issued from the host. and Direct Operate no Acknowledgment.3.3 – 29-Sept-03 . it is required to be configurable to support all three modes of operation.4 Analog Outputs § If a device supports analog outputs. DNP3-2003 IED Certification Procedure Subset Level 1 Page 23 Rev 2. It is the hosts’ responsibility to determine the appropriate analog output mechanism. 1=forced 0 0 0 Table 8-2 8. namely Select Before Operate. Verify that the data is reported using either 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01). • No further testing in this section is necessary. variation. and all object data must match exactly. In this case the select-to-operate timer must remain unaltered by the reception of each additional select. the outstation operates the analog output point. qualifier. • match the object portion of the select message byte for byte. DNP3-2003 IED Certification Procedure Subset Level 1 Page 24 Rev 2. The host then sends the execute portion of the dialog. • Value does not match. The outstation then echoes the exact analog output request byte for byte to the host. however there are no analog output points installed/enabled: • If the device does not have any analog outputs installed. If the execute message matches the select message byte for byte and it is received within the configured acceptable delay between select and execute. excluding the application header. • The DUT must reject any operate that does not • contain a application layer sequence number that is exactly one greater (modulo 16) than the previously accepted select. • The DUT responds to selecting an uninstalled analog output point by returning an error response with IIN2-2 set and a status code of 4. In this case the select-to-operate timer must be restarted after reception of each select. • The DUT must accept retries on the operate portion of the analog output dialog that does not increment the application sequence number between retries. • The DUT responds to a non-matching execute with a status field of 2 [No previous matching select] and does not operate the analog output under the following conditions: • No prior select issued. The analog output point does not operate. The analog output does not operate. it must respond to a select with an Error Response setting IIN21 or IIN2-2.1 Select Before Operate The host first initiates the select portion of the dialog. • The DUT must accept retries on the select portion of the analog output dialog that do not increment the application sequence number between retries.4.8. The specified analog output operates. • The DUT responds to executing an installed analog output point after the configured acceptable select to execute delay by echoing the execute and setting the status field to 1[Execute received after timeout]. and all object data must match exactly byte for byte the data sent in the select message. The following assumes that the device supports analog output operations and were added as a result of Technical Bulletin TB2000-002 (Control Retries): • The DUT must accept retries on the select portion of the analog output dialog that increment the application sequence number between retries. • An Error Response with IIN2-2 set is an invalid response.3 – 29-Sept-03 . Note that the encapsulation information need not match. • The DUT supports 8 and 16 bit point indexing. The DUT must echo the operate command but must not operate the analog output more than once. variation.1. 8. but that the object. • The DUT operates various selected analog output points. • The DUT responds to matching select and execute requests by echoing each request with the status field set to 0.4. qualifier. The object. The following behavior assumes that the device does support analog output operations. The following behavior assumes that the device supports analog output operations: • The maximum select to execute delay time must be specified in the Device Profile Document.1 Desired Behavior The following behavior assumes that the device does not support analog output operations: • If the device does not support analog outputs it must respond to a select with an Error Response setting IIN2-1. 1. 8. If an analog output is observed to operate. 3.2. Immediately issue an execute to Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and the same value as the previous select.1. Execute Value does not match Select Value 1. Verify that the DUT responds by echoing the select message exactly.4. the test fails. 5. Verify that the DUT responds by echoing the select message exactly. 4.4 Analog Output. If the device does support analog outputs. If the device does not support analog outputs verify that the DUT responds with an Error Response with IIN2-1 set. SBO. Immediately issue a matching execute. 3. 3. 8. 2.1. Issue a select using Object 41 Variation 2 to an uninstalled point using 16 bit indexing (qualifier 0x28) and an appropriate value. 2. 0x17 1.1.4. Select 0x28. 2. Verify that the selected analog output operates. Verify that the DUT echoes the execute. SBO.2 Test Procedure 8. Verify that the selected analog output operates. 6. Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4. the test fails. Immediately issue a matching execute.4. Issue a select using Object 41 Variation 2 to an installed point using 16 bit indexing (qualifier 0x28) and an appropriate value. Issue a select using Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value. 0x28 1. SBO. verify that the DUT responds by echoing the select message exactly.1. Execute Issued After Time-out 1.2. Verify that the DUT responds by echoing the select message exactly. 2.2. 2.4. SBO. 4.4. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. Execute 0x17 1. Verify that the DUT echoes the execute with the status field set to 2 [No previous matching select].6 Analog Output. 4.1.1. the test fails. Immediately issue an execute to Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and the same value incremented by 1.2. 4. 5. 4.3 Analog Output. 8. Issue a matching execute and verify that the DUT echoes the execute with the status field set to 1 [Execute received after timeout]. If an analog output is observed to operate. If an analog output is observed to operate. 8. 3. Verify that the DUT responds by echoing the select message exactly. the test fails. 3. 5.4. 3. Issue a select using Object 41 Variation 2 to a different point using 8 bit indexing (qualifier 0x17) and an appropriate value. 5. SBO. 8.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 .2. 2. to Uninstalled Point 1.5 Analog Output.2 Analog Output. 5. Issue a select using Object 41 Variation 2 to an installed point using 16 bit indexing (qualifier 0x28) and an appropriate value.1 Analog Output. Verify that the DUT echoes the execute. Issue a select using Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value.2. If an analog output is observed to operate. Page 25 Rev 2. Wait 1 second past the configured maximum select to execute delay time.8.4. End testing of Analog Output SBO. SBO. 1. 6. Verify that the DUT echoes the object portion of the select byte for byte. 8. 5. Verify that the DUT does not operate the analog output. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set. Incrementing Sequence Number Select Retries 1. 8. Issue the select again using the same application layer sequence number. skip this section. incrementing the sequence number by 1 modulo 16.8 Analog Output. incrementing the sequence number by 1 modulo 16.2. Verify that the DUT echoes the object portion of the operate byte for byte. 6. Verify that the DUT operates the analog output.10 Analog Output. skip this section. 7. Verify that the DUT operates the analog output. 7. Sequence number checking 1. 2. If the DUT does not have installed analog output points. If the DUT does not have installed analog output points.4. Verify that the DUT echoes the object portion of the select byte for byte. Same Sequence Number Select Retries 1. 7.1. Verify that the DUT does not operate the analog output. Issue a valid operate. 8. 3. Same Sequence Number Operate Retries 1. Verify that the DUT echoes the object portion of the operate byte for byte.4. 5. 2. SBO. 4. 2. Issue a valid select to an installed analog output point. 8. Issue a valid operate. 8. If an analog output is observed to operate. skip this section. SBO.11 Analog Output. If the DUT does not have installed analog output points. Verify that the DUT echoes the object portion of the operate byte for byte. Configure the DUT such that all Analog Output points are uninstalled or disabled.8. Incrementing Sequence Number Operate Retries 1.4. SBO. 3. Issue the select again incrementing the application layer sequence number by 1 modulo 16.2. Issue a valid select to an installed analog output point. Verify that the DUT echoes the object portion of the select byte for byte. If the DUT does not have installed analog output points. SBO. Issue a valid operate. 8. If the device is not configurable in a manner such that analog output points can be uninstalled or disabled.4. 5. skip this section.2. Verify that the DUT echoes the object portion of the select byte for byte. Issue a valid operate. Verify that the DUT echoes the object portion of the operate byte for byte. 4. the test fails. 6. Issue a valid select to an installed analog output point. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). 8. Verify that the DUT echoes the object portion of the select byte for byte. 3. Issue a valid select to an installed analog output point. 9. incrementing the sequence number by 1 modulo 16. 5. 8.1. 8. Issue the operate again. 9.4. Verify that the DUT operates the analog output.1. 7. Verify that the DUT echoes the object portion of the operate byte for byte. 4. incrementing the sequence number by 1 modulo 16. Verify that the DUT echoes the object portion of the select byte for byte. skip this section. SBO.2.4. Configurable Device 1.1. incrementing the sequence number by 1 modulo 16. 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . Page 26 Rev 2. 2.9 Analog Output.2. 5. skip this section. Verify that the DUT operates the analog output. 3. SBO. Issue the operate again using the same application layer sequence number.2. 4. If the DUT does not have installed analog output points.1.12 Analog Output. 4. 3.7 Analog Output. Issue a select using Object 41 Variation 2 to point 0 using 16 bit indexing (qualifier 0x28) and an appropriate value. 6. Page 27 Rev 2. • The DUT operates various analog output points.1 Desired Behavior The following assumes that the device does not support analog output operations: • If the device does not support analog outputs. 7. Issue a valid select to an installed analog output point. 9. it must respond to a direct operate with an Error Response setting IIN2-1 or IIN2-2.2.2. however there are no analog output points installed/enabled: • If the device does not have any analog outputs installed. to Uninstalled Point 1. 8. 5. If the device does support analog outputs verify that the DUT responds by echoing the direct operate message exactly with status field of 0. The following assumes that the device supports analog output operations: • The DUT responds to a Direct Operate to an installed analog output point echoing the direct operate and setting the status field to 0. 8. 3. The specified analog output operates. Verify that the DUT does not operate the analog output. 4. Direct Operate. Issue a Direct Operate to Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value. 3.4. 2. Analog Output. Verify that the DUT responds by return an Error Response with IIN2-2 set and a status code of 4.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . 6. • No further testing in this section is necessary.4.2. Direct Operate.2 Analog Output. incrementing the select sequence number by 1 modulo 16 to make sure the mismatched operate cleared the previous select. 8. 8. incrementing the sequence number by anything but 1 modulo 16.2. Configurable Device If the device is not configurable in a manner such that analog output points can be uninstalled or disabled. Verify that the DUT does not operate the analog output.4. 8. Direct Operate 1.2 Test Procedure 8.1 Analog Output.4. Issue a Direct Operate to Object 41 Variation 2 to an uninstalled point using 16 bit indexing (qualifier 0x28) and an appropriate value. it must respond to a direct operate with an Error Response setting IIN2-1. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). No analog outputs shall be observed to operate. Issue a valid operate.4. Configure the DUT such that all Analog Output points are uninstalled or disabled. • The DUT responds to a Direct Operate to an uninstalled analog output point by returning an Error Response with IIN2-2 set and a status code of 4.2. Issue a valid operate.2. The following assumes that the device does support analog output operations.4.3 1. end testing of Analog Output. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT).2. If the device does not support analog output verify that the DUT responds with an Error Response with IIN2-1 set and end testing of this section.2 Direct Operate with Acknowledge 8. the test fails. Direct Operate.2. 2. 4. 3. Verify that the specified analog output operates.2. 2. If an analog output is observed to operate. Verify that the DUT echoes the object portion of the select byte for byte. 8.4.2. the test fails. 4.4. Direct Operate. the test fails.3. Direct Operate. 4.4. Configure the DUT such that all Analog Output points are uninstalled or disabled. 5.4 Multiple Object Requests 8. Page 28 Rev 2.4. Issue a Direct Operate No Acknowledge using Object 41 Variation 2 to an uninstalled point using 16 bit indexing (qualifier 0x28) and an appropriate value. If this number is one. verify that the proper analog output point operates.4. 2. No Acknowledge.1 Desired Behavior • • The DUT must not respond in any way to the direct operate no acknowledge. 3. to an Uninstalled Point 1. end testing of this section.3 1.4. Review the device’s profile document to understand how many analog output points are supported in a single request. 8.2. If an analog output is observed to operate. 3. Direct Operate. Verify that the DUT does not respond. Analog Output.4. 8. No Acknowledge. Configurable Device If the device is not configurable in a manner such that control points can be uninstalled or disabled.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . 3. If the device does not support analog outputs.3. 8.3. 4.2 Analog Output. Verify that the DUT does not respond.2 Test Procedure 1. 8. 2. Issue a direct operate to Object 41 Variation 2 to point 0 using 16 bit indexing (qualifier 0x28) and an appropriate value.4. If the device supports analog outputs and the operate message is correct then the analog output point must operate.3. Issue a Direct Operate No Acknowledge using Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value. the test fails. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set.1 Analog Output. 8. No Acknowledge. 5.3. skip to step 7.2. Direct Operate.1 Desired Behavior • • The DUT must parse requests for all writes within a single frame Up to a full frame of request operations must be supported The following assumes that the device supports analog output operations and were added as a result of Technical Bulletin TB2001-001 (Multiple Control Object and Status Codes): • The DUT responds to requests having more points than are supported in a single message with a status code of 8 for at least the first point that is beyond the point count limit.3 Direct Operate. If an analog output is observed to operate. • The DUT responds to a select to an uninstalled analog output point by returning an error response with IIN2-2 set and a status code of 4. Issue a Direct Operate No Acknowledge using Object 41 Variation 2 to point 0 using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. end testing of Analog Output. If the device does support analog outputs.2 Test Procedure 8. Verify that the DUT does not respond.4. No Acknowledge 8. No Acknowledge 1.3.4. If an analog output is observed to operate.4. 2. Note outputs may occur simultaneously or sequentially one after the other. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value.3 – 29-Sept-03 . using Object 41. 3. or IIN2-2 set and that each object returns a status code of 0. 8. issue a direct operate command to at least one more point than is supported in a single request. and a value supported by the device Verify that the DUT response has none of IIN2-0.4. 10. that the status code returned for the installed point is 0 and the status code returned for the non-installed point is 4. The installed point should be the first object in the request. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. skip to step 13. In a single request. 12. each point having a different index but otherwise able to be outputted. If the DUT does not support direct operate. issue a select to at least one more point than is supported in a single request. or IIN2-2 set. 4. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3. or IIN2-2 set and that each object returns a status code of 0. Verify that the DUT response has none of IIN2-0. Verify that each of the selected analog outputs occurred. that each object except the last returns a status code of 0 and the last object returns a status code of 8. Immediately issue a matching execute. IIN2-1. If the number of control objects supported in a single request is greater than or equal to either: • The number of control objects that fit into a single frame or • The number of installed control points skip to step 13. IIN2-1. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. each point having a different index but otherwise able to be outputted. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. IIN2-1. Verify that the DUT response has IIN2-2 bit set. Verify that all except the last analog output point outputted the new value(s). Verify that the DUT response has none of IIN2-0. 9. DNP3-2003 IED Certification Procedure Subset Level 1 Page 29 Rev 2. and the last object returns a status code of 8. The device must respond with the current state of its data when this object is requested. This allows efficient use of bandwidth. 13. In a single request. 11.1 Class 0 This request is used to read all static data from a device. IIN2-1.5. using Object 41. 14. issue a select to one installed analog output point and to one point that is not installed using Object 41. This number shall be the smaller of: • The number of controls supported in a single request • The number of installed control points • Sixteen In a single request. issue a select to the above number of points using Object 41. Variation 2 and 16-bit indexing (qualifier 0x28). 7. that each object except the last returns a status code of 0. Numbers preceded by 0x are in hex. 5. In a single request.2. When no events are pending the device responds with the Null Response. or IIN2-2 set. a control code supported by the device. Acceptable object variations and qualifier combinations included in a device response are specified in the following table. . Determine the number of installed points that can be successfully controlled in a single request.5 Class Data 8. 8. 6. Verify that the DUT response has none of IIN2-0. When no events are pending the device responds with the Null Response.5. Note #5.0x01 0x00. Issue a request for Object 60 Variation 1 using the all data qualifier 0x06.4.3 – 29-Sept-03 . variation and qualifier variations specified in table 8-3. Points can be assigned to a class by configuration and through the protocol. Verify that flag behavior complies with Section 2. 2.0x01 0x00.5. This allows efficient use of bandwidth. Acceptable object variations and qualifier combinations included in a device response are specified in the following table. If a device can be configured to generate Application Layer retries. The device must respond with events that have occurred since the last poll/confirm sequence. the request for the application layer confirm is optional and may be eliminated to reduce bandwidth. If the response is not null. Numbers preceded by 0x are in hex.5.1. The minimum level of compliance is for the device to respond with a Null Response. If the response is null. DNP3-2003 IED Certification Procedure Subset Level 1 Page 30 Rev 2. 3.Single-Bit Binary Input Binary Input with Status Binary Output Status 32-Bit Binary Counter 16-Bit Binary Counter 32-Bit Binary Counter w/o Flag 16-Bit Binary Counter w/o Flag 32-Bit Analog Input 16-Bit Analog Input 32-Bit Analog Input w/o Flag 16-Bit Analog Input w/o Flag 16-Bit Analog Output Status Table 8-3 Object 1 1 10 20 20 20 20 30 30 30 30 40 Variation 1 2 2 1 2 5 6 1 2 3 4 2 Qualifier 0x00.0x01 0x00.2 Class 1 This request is used to read change or event data from a device.1 Desired Behavior • Device responds to a Class 0 poll with the current state of all data. this feature must be disabled for all tests in this section unless otherwise specified.0x01 0x00.0x01 0x00. Neither is required for compliance. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points.0x01 8.0x01 0x00.2 Test Procedure 1. 8. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3.0x01 0x00.1. verify that the device requests an application layer confirm.0x01 0x00.0x01 0x00. 8. Verify that the device responds with the current state of its inputs using only the object.0x01 0x00.0x01 0x00. 0x06 1. Verify that the device responds with all the Class 1 event data generated in a single response.0x28 0x17.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . Note #5. the device must respond with a quantity of its change events no greater than specified in the request.1 Class 1 Data. Binary Input changes more than 0xFFFF milliseconds apart must have a second CTO Object. § Verify that the device requests an application layer confirm.5. 2. Variation01 or 02) precede it in the same APDU. verify that it responds with a Null Response. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first).2. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06 to empty the device of pending events.0x28 0x17. Verify that the DUT responds with a Null Response. 14. * Note: Common Time of Occurrence objects 8. If requested. Generate known Class 1 event data. verify that the device responds with all the event data in its event buffers or responds with a Null Response. If the DUT does support Class 1 events. Note: A device is not required to return event data in any particular class.2 Test Procedure 8.0x28 0x17. 7.0x28 0x07 0x07 † Note: Use of the Binary Change with Relative Time Object (Object 2. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. § If the response is not Null. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06.2 Class 1 Data. 9. If the DUT does not support Class 1 events.2. 13.5. 10. issue an application layer confirm to empty the device of pending events. Page 31 Rev 2. This behavior must be verified in any response that contains a Binary Change with Relative Time Object.0x28 0x17. 6. 5. Variation3) requires that a Common Time of Occurrence Object (Object 51. 12. No further testing is required in this section.1 Desired Behavior • • • • § The device must respond with all of its change events when polled with the all data qualifier (0x06). 8.Binary Input Change w/o Time Binary Input Change with Time Binary Input Change with Relative Time 32-Bit Counter Change Event w/o Time 16-Bit Counter Change Event w/o Time 32-Bit Analog Change Event w/o Time 16-Bit Analog Change Event w/o Time Time and Date CTO* Unsynchronized Time and Date CTO* Table 8-4 Object 2 2 2 22 22 32 32 51 51 Variation 1 2 3† 1 2 1 2 1 2 Qualifier 0x17. 11. verify that the device requests an application layer confirm. § Verify that if the DUT responds to a class 0 poll with more than one link layer frame it also performs report-by exception processing. 8. Verify that flag behavior complies with Section 2.2. 2. The device must request an application layer confirm for all responses that contain event data. When polled with the limit data qualifiers (0x07 and 0x08). 3. The response point ordering shall be prioritized by time (oldest first).2.2. 4.5. 0x07 1.0x28 0x17.0x28 0x17.5. 8. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06. Note: Application layer confirms are always sent by the Master upon request from the Slave unless otherwise noted in this section.2. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). § If the response is not Null. Verify that only objects in table 8-4 are returned. 13. § Verify that the device requests an application layer confirm. 14. § Verify that the device requests an application layer confirm. 5. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Note #5. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28).2. 6. 7. 17. 11. issue an application layer confirm to empty the device of pending events. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x08 requesting the remaining changes. Verify that the device has not retransmitted the previous Application Layer fragment. 3. 11.2. 6.3 Class 1 Data. 16. issue an application layer confirm to empty the device of pending events. § Verify that the device requests an application layer confirm. If requested. Generate known Class 1 event data. 7. Note #5. 10. Verify that the device responds with the same Class 1 event data and the additional data generated in step 14. 7. 12. 4. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06.2.4 § Class 1 Data Without Confirm 1. 20. 14. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Note #5. Verify that only objects in table 8-4 are returned. 3. 18.2. 0x08 1. verify that the device requests an application layer confirm. 5. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06.5. Verify that the device responds with the requested Class 1 events in a single response. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x07 requesting the remaining changes. Verify that the device responds with the requested Class 1 events in a single response. 10. 12. Generate several Class 1 events. Verify that flag behavior complies with Section 2.3. Issue an application layer confirm to empty the device of pending events. Verify that the device responds with all the Class 1 event data.3 – 29-Sept-03 . 8. 2. § If the response is not Null. If requested. 13. 10. verify that the device requests an application layer confirm. 15. 4. 2. Generate additional Class 1 event data. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that flag behavior complies with Section 2. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06 to empty the device of pending events. 8. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x07 requesting some changes. Generate several Class 1 events. Verify that device responds with the remaining Class 1 events. 15. Verify that the DUT responds with a Null Response. If requested. § Verify that the device requests an application layer confirm. Wait for a period of time exceeding several of the Application Layer retry delays. 9.5. Do not issue an application layer confirm to the device. Verify that the device responds with a Null Response. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x08 requesting some changes. issue an application layer confirm to empty the device of pending events. DNP3-2003 IED Certification Procedure Subset Level 1 Page 32 Rev 2. if one exists. 8. Verify that device responds with the remaining Class 1 events. 12. 6. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 9. 14. 19. Verify that flag behavior complies with Section 2. 5. 4. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 11. 15. § Verify that the device requests an application layer confirm. 9. 8. Verify that the DUT responds with a Null Response. 13. 8. Verify that only objects in table 8-4 are returned. § Verify that the device requests an application layer confirm. 7. issue an application layer confirm to empty the device of pending events. Generate known Class 2 event data. 4. this feature must be disabled for all tests in this section unless otherwise specified. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first). 5. verify that it responds with a Null Response. If the response is null. If requested. Generate several Class 2 events. When no events are pending the device responds with the Null Response. Verify that the device responds with all the Class 2 event data generated in a single response. the request for the application layer confirm is optional and may be eliminated to reduce bandwidth. verify that the device responds with all the event data in its event buffers or responds with a Null Response. This allows efficient use of bandwidth. Note: A device is not required to return event data in any particular class. No further testing is required in this section. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. 8. § Verify that if the DUT responds to a class 0 poll with more than one link layer frame it also performs report-by exception processing. 14. If the DUT does support Class 2 events. 8.5.5. 12. The device must request an application layer confirm for all responses that contain event data. 13.5.2 Class 2 Data. The response point ordering shall be prioritized by time (oldest first). Issue another request for Object 60 Variation 3 using the all data qualifier 0x06. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28).3. The minimum level of compliance is for the device to respond with a Null Response. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. the device must respond with a quantity of its change events no greater than specified in the request. 0x06 1.5. Page 33 Rev 2. Neither is required for compliance. verify that the device requests an application layer confirm. § If the response is not Null. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06 to empty the device of pending events. Verify that the DUT responds with a Null Response. 6. If a device can be configured to generate Application Layer retries. § Verify that the device requests an application layer confirm. Points can be assigned to a class by configuration and through the protocol. When polled with the limit data qualifiers (0x07 and 0x08). 2. 8. 3. 8.3. If the response is not null. 4.2. Note: Application layer confirms are always sent by the Master upon request from the Slave unless otherwise noted in this section. If the DUT does not support Class 2 events. verify that the device requests an application layer confirm.1 Desired Behavior • • • • § The device must respond with all of its change events when polled with the all data qualifier (0x06). 3. issue an application layer confirm to empty the device of pending events.3. If requested.4. 10.2.2 Test Procedure 8. 2.3 Class 2 This request is used to read change or event data from a device.3. 11.5. 0x07 1. The device must respond with events that have occurred since the last poll/confirm sequence. Issue another request for Object 60 Variation 3 using the all data qualifier 0x06.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . 9.8. Verify that flag behavior complies with Section 2.1 Class 2 Data. Note #5. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3. 10. 3. § If the response is not Null.3. 8. 9. Verify that only objects in table 8-4 are returned. 9. Wait for a period of time exceeding several of the Application Layer retry delays. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. 15. 7. 12. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that the DUT responds with a Null Response. 6. § Verify that the device requests an application layer confirm. 8. 8. Note #5. 11. § Verify that the device requests an application layer confirm. 11. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x07 requesting some changes. 13. 6. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x07 requesting the remaining changes. if one exists. 12. Do not issue an application layer confirm to the device.5. Verify that the device has not retransmitted the previous Application Layer fragment. 13. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. issue an application layer confirm to empty the device of pending events. 15. Note #5. § Verify that the device requests an application layer confirm. 12. 2. If requested. DNP3-2003 IED Certification Procedure Subset Level 1 Page 34 Rev 2. 11. Verify that only objects in table 8-4 are returned. Verify that the device responds with the requested Class 2 events in a single response. 2. 14. Verify that flag behavior complies with Section 2. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. § Verify that the device requests an application layer confirm. 0x08 1. Generate several Class 2 events. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 6.3 – 29-Sept-03 . 15. 16. Verify that flag behavior complies with Section 2. 14. 4.3. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x08 requesting the remaining changes. 5. Verify that only objects in table 8-4 are returned. 8. 17. Issue another request for Object 60 Variation 3 using the all data qualifier 0x06. 13. 5.2. verify that the device requests an application layer confirm.5. Verify that the device responds with all the Class 2 event data. Generate additional Class 2 event data. § Verify that the device requests an application layer confirm.5. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Generate known Class 2 event data. Verify that the device responds with the same Class 2 event data and the additional data generated in step 14. Verify that the device responds with the requested Class 2 events in a single response. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06 to empty the device of pending events. § Verify that the device requests an application layer confirm. Note #5. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x08 requesting some changes.3 Class 2 Data. issue an application layer confirm to empty the device of pending events. Verify that the device responds with a Null Response. Issue an application layer confirm to empty the device of pending events. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. Issue another request for Object 60 Variation 3 using the all data qualifier 0x06. 8. § If the response is not Null. 9. Verify that flag behavior complies with Section 2. verify that the device requests an application layer confirm. 20. 19. 3. 18. Verify that device responds with the remaining Class 2 events.2. 7. 10. 7.4 § Class 2 Data Without Confirm 1. Verify that device responds with the remaining Class 2 events. If requested. Verify that the DUT responds with a Null Response. 4. 14. 10. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. 7. Verify that flag behavior complies with Section 2.8.4 Class 3 This request is used to read change or event data from a device. Note: Application layer confirms are always sent by the Master upon request from the Slave unless otherwise noted in this section. issue an application layer confirm to empty the device of pending events. 13.5.4.5. 3.4.1 Desired Behavior • • • • § The device must respond with all of its change events when polled with the all data qualifier (0x06). 11.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . Verify that the DUT responds with a Null Response.4.5.5. Page 35 Rev 2. If the DUT does support Class 3 events.4. 9. § If the response is not Null. the device must respond with a quantity of its change events no greater than specified in the request. 3. Note: A device is not required to return event data in any particular class. issue an application layer confirm to empty the device of pending events. verify that the device requests an application layer confirm. The response point ordering shall be prioritized by time (oldest first). Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. § Verify that if the DUT responds to a class 0 poll with more than one link layer frame it also performs report-by exception processing. Issue another request for Object 60 Variation 4 using the all data qualifier 0x06.1 Class 3 Data. 2. 2. 12. 8.2 Class 3 Data. verify that it responds with a Null Response. The device must respond with events that have occurred since the last poll/confirm sequence.2 Test Procedure 8. verify that the device responds with all the event data in its event buffers or responds with a Null Response. Verify that the device responds with all the Class 3 event data generated in a single response. this feature must be disabled for all tests in this section unless otherwise specified. 5. 8.4. Note #5. 14. Points can be assigned to a class by configuration and through the protocol. If requested. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first). Issue another request for Object 60 Variation 4 using the all data qualifier 0x06.5. This allows efficient use of bandwidth. § Verify that the device requests an application layer confirm. If requested.2. 4. Generate several Class 3 events. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3. 0x06 1. 10. If a device can be configured to generate Application Layer retries. No further testing is required in this section. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06 to empty the device of pending events. If the response is not null. When no events are pending the device responds with the Null Response. 6. The minimum level of compliance is for the device to respond with a Null Response. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). When polled with the limit data qualifiers (0x07 and 0x08). 4. If the response is null. If the DUT does not support Class 3 events.2. 0x07 1. 8. Generate known Class 3 event data. verify that the device requests an application layer confirm. 8. the request for the application layer confirm is optional and may be eliminated to reduce bandwidth. Neither is required for compliance. The device must request an application layer confirm for all responses that contain event data. 12. 6.3 – 29-Sept-03 . § If the response is not Null. 18. § Verify that the device requests an application layer confirm. § Verify that the device requests an application layer confirm. 7. 13.4. 3. 14. 9. 0x08 1. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that flag behavior complies with Section 2. Issue another request for Object 60 Variation 4 using the all data qualifier 0x06. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. 8. 10. Verify that the DUT responds with a Null Response. § Verify that the device requests an application layer confirm. 12. 19. Verify that the DUT responds with a Null Response. If requested. if one exists. Generate additional Class 3 event data. issue an application layer confirm to empty the device of pending events. Verify that flag behavior complies with Section 2. Verify that the device responds with the requested Class 3 events in a single response. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06 to empty the device of pending events. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x08 requesting the remaining changes. 9. 6. 8. 4. 2.2. Verify that the device responds with a Null Response. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. 12. 8. 6. 17.4. § If the response is not Null. Issue another request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). § Verify that the device requests an application layer confirm. 8. 15. Verify that device responds with the remaining Class 3 events. 5. Verify that only objects in table 8-4 are returned. Verify that device responds with the remaining Class 3 events. § Verify that the device requests an application layer confirm.5. issue an application layer confirm to empty the device of pending events.4 § Class 3 Data Without Confirm 1. Verify that the device has not retransmitted the previous Application Layer fragment. verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x07 requesting some changes.3 Class 3 Data. Do not issue an application layer confirm to the device. 11. Verify that the device responds with all the Class 1 event data. 13. 5. 7. 2. If requested. 16. Note #5. Verify that flag behavior complies with Section 2. Verify that the device responds with the requested Class 3 events in a single response. 15. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. 10.2. 14. Issue an application layer confirm to empty the device of pending events. Note #5. 8.5. Wait for a period of time exceeding several of the Application Layer retry delays. 20. 13. 10.5. 11. § Verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x07 requesting the remaining changes. Verify that the device responds with the same Class 1 event data and the additional data generated in step 14. 15. Verify that only objects in table 8-4 are returned. DNP3-2003 IED Certification Procedure Subset Level 1 Page 36 Rev 2. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x08 requesting some changes. Verify that only objects in table 8-4 are returned. 9. Note #5. 3. 14. verify that the device requests an application layer confirm. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 11. Generate known Class 3 event data. 7. Generate several Class 3 events. 4. Verify that all static data is returned after all event data in the same response.2 Test Procedure 8. and 4 using the all data qualifier 0x06. 9.5. issue an application layer confirm to empty the device of pending events.5.3.4.6. 3.5 Multiple Object Request This test verifies that the device can parse multiple object requests.5. Issue a request for Object 60 Variations 2.5. and 3. and 3 1.5. 2. Class 1. Generate known event data that includes events from all three classes. 3. 2. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first). If the request generates multiple application fragments verify that the application sequence number of each subsequent fragment increments by 1 modulo 16. Class 1. they must be configured for at least one of each class for these tests. § If the response is not Null. § Verify that the device requests an application layer confirm. and 4 using the all data qualifier 0x06. 4.5. 11. 2. Verify that the device responds with all the event data as described in the Desired Behavior.5. 9.2 Multiple Object Request.3 – 29-Sept-03 . 8. 2. Issue a request for Object 60 Variations 2. 8. and 4 using the all data qualifier 0x06. 5. 6. Generate known event data that includes events from classes 1. verify that the device requests an application layer confirm. DNP3-2003 IED Certification Procedure Subset Level 1 Page 37 Rev 2.5. 7. Note: If Binary Inputs can be configured in more than one class. 6. 8. 3. 4. If requested.3. 12. Issue an application layer confirm to empty the device of pending events.2. 5.1 Desired Behavior • • • The device must respond to a multiple object request in a single response. Issue an application layer confirm to empty the device of pending events.2.6 Class Assignment Verification 8. Note #5.3. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). § If the response is not Null. and 0 1. Issue a request for Object 60 Variations 2. 10. If requested. 11. Verify that the device responds with all the event data as described in the Desired Behavior. 7. issue an application layer confirm to empty the device of pending events. 10. Verify that the response has the same application sequence number as the request.5. verify that the device requests an application layer confirm. Verify that flag behavior complies with Section 2.1 Desired Behavior • The device must respond to a request for Class 1 events with only Class 1 events. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28) for event data and 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01) for static data. all events for the same point will be sent in the chronological order of occurrence of those events (oldest first).5. 8. § Verify that the device requests an application layer confirm. 2. Issue a request for Object 60 Variations 2.5. Verify that only objects in tables 8-3 and 8-4 are returned. and 1 using the all data qualifier 0x06. 8. § When a device generates multiple analog or counter events for the same point. all events reported within a single application fragment will be sent in the chronological order of occurrence of those events (oldest first).8. For binary points. 13.1 Multiple Object Request. Note #5.3. 8. Verify that flag behavior complies with Section 2. 6. This bit is cleared when the master station writes a 0 into this location. Issue a request for Object 60 Variations 2. Issue a Write to Object 80 Variation 1 using the qualifier 0x00. 16.3 – 29-Sept-03 . The host can clear this bit by writing to the Internal Indications Object (Object 80. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06.2 Test Procedure 1. Generate some Class 1 events.6.3 and 4 using the all data qualifier 0x06 to empty the device of pending events.• • The device must respond to a request for Class 2 events with only Class 2 events. 8. Verify that the device responds with only Class 3 events in a single response. 9. Issue a request for Object 60 Variations 2. 4.1 Desired Behavior • • The DUT. Verify that the device responds with only Class 2 events in a single response. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. Verify that the device responds with a Null Response. 8. 10. 19. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. followed by the value 0. 2. 5. 11. 13.e. 8.6 Indications The Internal Indications is an information element used to convey internal states and diagnostic results of a device. 18. a device's input power is cycled. Verify that only objects in table 8-4 are returned. verify that the device requests an application layer confirm.6. 23.1. Verify that the device responds with IIN1-7 set indicating that the device has been restarted. after a power cycle.1. 6. 7. Cycle the power to the DUT. 26. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. 3. If a specific indication is not supported it must be reported as de-asserted (0) in all cases. § Verify that the device requests an application layer confirm. i. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Use a start index of 7 and a stop index of 7.5. 14. 24. 4.6. 17.2 Test Procedure 1. 5. 8.1 Restart The Restart Bit of the Internal Indications field is set to 1 when the user application at the device restarts. 3. 2. must set IIN1-7. Verify that only objects in table 8-4 are returned. Verify that only objects in table 8-4 are returned. Issue a request for Object 60 Variation 2. 25. 12. 20. 21. The device must respond to a request for Class 3 events with only Class 3 events. 8. Verify that the device responds with a Null Response and that IIN1-7 is cleared. § If the response is not Null. Generate some Class 2 events. 15. Verify that only objects in table 8-4 are returned. 8.3 and 4 using the all data qualifier 0x06. 22. Verify that the device responds with a Null Response. § Verify that the device requests an application layer confirm. § Verify that the device requests an application layer confirm. Verify that the device responds with a Null Response. Verify that the device responds with only Class 1 events in a single response. Variation 01). Generate some Class 3 events. Verify that the device responds with a Null Response. DNP3-2003 IED Certification Procedure Subset Level 1 Page 38 Rev 2. After a device has issued a message containing a valid function code. Issue a request for Object 0 Variation 0. 8. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. 5. If the DUT does not support placing its binary outputs in a local state no further testing is required in this section. 4.6. Page 39 Rev 2. After a device has issued a message containing a valid function code. 3. If the device supports individual control point supervisory control. If the DUT supports a global feature for enabling or disabling remote supervisory control.4 Local 8.6.3 Object Unknown 8. no further testing is required in this section.6. 6. 8. Verify that the device responds with none of the Error IIN bits set. using a Function Code of 0x01.4. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. Issue a request for Object 60 Variation 1.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . 2. Qualifier 0x06. Verify that the device responds with Object 10 Variation 2 and that IIN1-5 is cleared. 7.2.6. 4. using a Function Code of 0x70.2 Test Procedure 1.3. 8. the response shall have no Error IIN bits set.2 Bad Function 8.6. Verify that the device responds with an Error Response with IIN2-0 set indicating that the device has received a message containing a bad function code.2 Test Procedure for Devices with Global Remote Supervisory Control 1. 2. 3.1 Desired Behavior • • If a device receives a message containing an unsupported function code it must return an Error Response with IIN2-0 set.4.3. 8. 8. 2. the response shall have no Error IIN bits set.1 Desired Behavior • • If the device supports control outputs and supports placing them in a local or disabled stated then it must set IIN1-5 whenever some or all of the control outputs are in the Local or Disabled state. If the DUT does not support placing its binary outputs in a local state. Verify that the device responds with a valid message and that IIN1-5 is set.2. ensure that this is set to the “Enabled” or “Remote” mode.6.4. 3.6. 4. Verify that the device responds with none of the Error IIN bits set. all points should be set to the “Enabled” or “Remote” mode. Issue a request for Object 60 Variation 1. 3. Issue a request for Object 60 Variation 1. each object must set the Local Forced Data bit when the corresponding point is in the Local or Disabled state. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. Function Code 0x01. it must return an Error Response with IIN2-1 set.3 Test Procedure for Devices with Individual Remote Supervisory Control 1.6.6.2 Test Procedure 1. 4. Verify that the device responds with a valid message and that IIN1-5 is cleared. Qualifier 0x06. Change the DUT’s global switch to the “Disabled” or “Local” mode. If the device allows for individual control point remote supervisory control.8.1 Desired Behavior • • If a device receives a message containing an unknown object. 2. 8. Verify that the device responds with an Error Response with IIN2-1 set indicating that the device has received a message containing an unknown Object code.6. followed by the value 0 using the broadcast address (0xFFFF). or with an unsolicited event report. perform this operation using Object 41 Variation 2. Verify the DUT responds with a valid response with IIN1-7 (restart) cleared and IIN1-0 (all stations message received) set. 5. Issue a Direct Operate No Acknowledgement using Object 12 Variation 1 to an installed point using 8-bit indexing (qualifier 0x17). Verify that the device does not respond. 7. Verify that the device responds with Object 10 Variation 2 and that IIN1-5 is set. 8. Verify the DUT responds with a Null Response with IIN1-0 cleared. Verify that the appropriate object has the "On-line" bit is set. 2. 9. 4. 12. 11. but that the confirmation may be requested if required by the details of the response being issued. Note: IIN1-0 may be reported in conjunction with responses to requests that otherwise require confirmation. the confirmation will not be suppressed even though the message is sent with IIN1-0 set. § Messages sent to address 0xFFFE require that the IIN1-0 bit must be returned with the application layer request for confirmation bit (Application Control.5. the "Local forced data" bit set. 6. 8. for example. Use a start index of 7 and a stop index of 7.1 Desired Behavior • • • • • • The DUT must execute any request sent to the broadcast address § The DUT must not respond in any way to any request sent to the broadcast address The DUT must set the All Stations Internal Indication (IIN1-0) in the next response it transmits The DUT must clear the All Stations Internal Indication on the next response following the one in which it was set. Send an application layer confirmation if requested. Page 40 Rev 2. 6. for example.6. 1. Wait a reasonable application layer timeout.5.6. and all the remaining bits clear. Issue a request for Object 60 Variation 2. IIN1-0 will be cleared in the slave upon transmitting the first response from the slave. Request a data link layer confirmation.6. 3. 7. 2 seconds. 2 seconds. 2. and since these requests/responses otherwise require confirmation. with either a data link layer confirmation or a response to the Write operation. Verify that each object has the "On-line" bit is set. Issue a link reset using link control block 0xC0. Verify the DUT responds with IIN1-0 (all stations message received) set. 7. 8.5. IIN1-0 may not be cleared in the slave until the confirmation is received. 8. 10.3 Test Procedure 1. Verify that the device does not respond. 5. Send an application layer confirmation if requested. the "State" bit either set or cleared. Thus the use of the FFFD broadcast address implies that confirmation requests in responses sent with the IIN1-0 set should be suppressed. Issue a request for Object 60 Variation 2. bit 5) set. and all the remaining bits clear. 8. Issue a Write to Object 80 Variation 1 using the qualifier 0x00. 8. Verify the DUT responds with a Null Response with both IIN1-7 and IIN1-0 cleared. the "State" bit either set or cleared.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . § Messages sent to address 0xFFFD request the IIN1-0 bit to be returned with the application layer request for confirmation bit (Application Control. 6. 9.5 Broadcast Address and All Stations Indication 8. Change a single remote supervisory control switch or setting to the “Disabled” or “Local” mode. Verify the requested output operation was executed.5. If the device does not support control outputs. Wait a reasonable application layer timeout. 3. bit 5) suppressed.2 § Test Procedure Cycle the power to the DUT. a control code supported by the device and an appropriate on/off-time using the broadcast address (0xFFFF). Verify that the device responds with IIN1-7 set indicating the device has been restarted. Issue a request for Object 60 Variation 2. 9. Issue a request for Object 60 Variation 2.6. 4. Issue a request for Object 60 Variation 2. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. Issue a request for Object 60 Variation 2.2 Buffer Overflow. Verify that IIN2-3 is NOT set.6. and an application layer confirmation requested. with either a data link layer confirmation or a response to the Write operation. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 13. Verify the DUT responds with a Null Response with both IIN1-7 and IIN1-1 cleared. or does not queue multiple events for the same point.5. 3. 12. Issue a request for Object 60 Variations 2. Verify the DUT responds with a Null Response with IIN1-7 (restart) cleared and IIN1-0 (all stations message received) set. followed by the value 0. 9. verify that IIN1-0 is not set in the response.6.6.2 Test Procedure 8.6. 8. but DO NOT issue an application confirm to the device. 2 seconds. Specify broadcast address FFFE. Issue a request for Object 60 Variation 2. Issue an application layer confirmation. 9. Binary Input Change Event Buffers If the device does not support Binary Input Change Events. repeat the request for Object 60 Variation 2. Issue an application layer confirmation. Analog Input Change Event Buffers. Send the application layer confirmation. 8.8. 1. Generate 1 additional change event of this type on the DUT. 5.4 § Test Procedure.2. Wait a reasonable application layer timeout. end testing of Buffer Overflow. 8.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . 8. Confirmed Response Options 1. Verify that the device returns a single Binary Input Change Event and IIN2-3 is not set. 10.1 Buffer Overflow. Binary Input Change Event Buffers.6. verify that an application layer confirmation is NOT requested. 3. end testing of Buffer Overflow. 2.6. Before sending the requested confirmation.3 and 4 using the all data qualifier 0x06 to empty the device of pending events. Verify that the device returns a single Binary Input Change Event and IIN2-3 is set. Page 41 Rev 2. 7. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. Issue a Write to Object 80 Variation 1 using the qualifier 0x00. 8.6. 6. Obtain the maximum Binary Input Change Event buffer size from the device documentation and generate this number of corresponding events on the DUT. and verify that IIN1-0 is still set in the response. 11. 6.6 Buffer Overflow The Buffer Overflow Bit of the Internal Indications field is set to 1 when any event buffers overflow such that change event data is subsequently being lost. If the device does not support Analog Input Change Events. Issue a request for Object 60 Variation x (appropriate Class) using the all data qualifier 0x06. Use a start index of 7 and a stop index of 7. for example. 14. 4.6. Analog Input Change Event Buffers 1. Note: Step 11 will not be necessary. hence making event buffer space available. 4. 5.2. Cycle the power to the DUT. 12. Issue a link reset using link control block 0xC0. 10. Verify that the device does not respond.6. In step 9.1 Desired Behavior • • The DUT must set IIN2-3 after a given event buffer overflows such that change events are being lost. 2. This bit is cleared when the master station confirms change event data from the DUT. In step 10. Verify that the device responds with IIN1-7 set indicating the device has been restarted. Issue a request for Object 60 Variation 2. Request a data link layer confirmation using link control block 0xF3. Repeat steps 1-13 using address FFFD as the broadcast address. 7.6. 8. 11. The DUT must clear IIN2-3 after a master confirms a change event(s) from the DUT such that event buffer space is made available. 7. Verify that the device returns a single Binary Counter Change Event and IIN2-3 is no longer set. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. Issue an application layer confirmation. 8. or does not queue multiple events for the same point. 12. 3. but DO NOT issue an application confirm to the device. • Maximum internal time reference error when set from the protocol. Issue a request for Object 60 Variations 2.1. 7. Binary Counter Change Event Buffers. 4. 1. Generate 1 additional change event of this type on the DUT.7 Time § If the device sets IIN1-4. The device will respond to a Time Delay Measurement request with the number of milliseconds elapsed between the device receiving the first bit of the first byte of the request and the time of transmission of the first bit of the first byte of the response. Verify that IIN2-3 is NOT set. Issue an application layer confirmation. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 3. 10.3 – 29-Sept-03 . Verify that IIN2-3 is NOT set.7.3 and 4 using the all data qualifier 0x06 to empty the device of pending events. 10. Verify that the device returns a single Binary Counter Change Event and has set IIN2-3.2 Test Procedure 1. Obtain the maximum Binary Counter Change Event buffer size from the device documentation and generate this number of corresponding events. 12. 6. 8.1 Delay Measurement This function is used to calculate the communication delay for a particular device. 8. the Device Profile must state the worst case values for the following parameters for the full operating temperature and support all of the tests in this section. 4. Issue an application layer confirmation. Issue a request for Object 60 Variation x (appropriate Class) using the all data qualifier 0x06. to the DUT.1 Desired Behavior • § The device must respond to a Delay Measurement request with a Time Delay Fine response. Verify that the device returns a single Analog Input Change Event and IIN2-3 is not set. Obtain the maximum Analog Input Change Event buffer size from the device documentation and generate this number of corresponding events on the DUT. 5.2. • Maximum response time. If a device does not set IIN1-4 it need not support any of the tests in this section. 11. • Time base drift over a 10-minute interval. 2. 5. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change.3 and 4 using the all data qualifier 0x06 to empty the device of pending events. 8. Verify that the device returns a single Analog Input Change Event and IIN2-3 is set. 8. Issue a request for Object 60 Variation x (appropriate Class) using the all data qualifier 0x06.3 Buffer Overflow. 9. 8. DNP3-2003 IED Certification Procedure Subset Level 1 Page 42 Rev 2. 11. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change.6. 8.6. 6. Generate 1 additional change event of this type.7.Issue a request for Object 60 Variations 2. 7. Issue an application layer confirmation. Binary Counter Change Event Buffers If the device does not support Binary Counter Change Events. 2. 9. • Maximum delay measurement error. but DO NOT issue an application confirm to the device. Issue a request for Delay Measurement using Function Code 23.1. end testing of Buffer Overflow. 3. Issue a Write using Object 80 Variation 1 with the qualifier 0x00. Wait for a period of time longer than the time returned in step 2. Verify that the device replies with Object 52 Variation 2 Qualifier 0x07 Quantity 1 and a millisecond time stamp of the measured delay. or 4 as appropriate. 3. using the all data qualifier 0x06. 4. This object is usually used for time-synchronization.2.7.1 Desired Behavior • • The device must respond to a Time and Date object by null response with IIN1-4 cleared. Verify that the accuracy of the delay reported is within the maximum error specified in the Device Profile Document. 6. 8. Verify that the device responds with a valid time tagged event and that the time reported is within the maximum error specified in the Device Profile Document. Verify the response is a Time Delay Fine or Coarse (Object 52 Variation 1 or Variation 2). and that synchronization appears to have occurred. verify that the time format is correct. to the DUT.2 Test Procedure 1. 5. 4.3 – 29-Sept-03 . Reset the DUT. 1970. Generate a supported time tagged event at a known time. 8. 8. followed by the value 0. 8. restarting. 7. Perform the test two more times to guarantee repeatability. January 1. 3. 2. Note that the following procedures verify the mechanics of time synchronization. and zero milliseconds. Issue a request for Object 60 Variation 2. 5. 6. Verify that the device responds with a Null Response and that IIN1-7 is cleared. at zero minutes. and setting IIN1-7. Issue a request for Object 60 Variation 1.7. 7. recorded as milliseconds since midnight. Use a start index of 7 and a stop index of 7. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. § The Device Profile must specify the maximum time from startup to IIN1-4 assertion. Wait the specified maximum time from reset to IIN1-4 assertion. 9. DNP3-2003 IED Certification Procedure Subset Level 1 Page 43 Rev 2. Verify that the device responds with IIN1-7 set indicating that the device has been restarted. 3. If the DUT requests an Application Layer Confirm send it before starting the wait period. zero seconds. Set the time and date using a WRITE request and Object 50 Variation 1 with Qualifier 0x07 taking into account the delay measured in the previous section. Verify that the device responds with a valid message and that IIN1-4 is set indicating that the device is requesting time synchronization.8 Cold Restart 8.2.7.2 Test Procedure 1. 8.1 Desired Behavior • The device must respond to a Cold Restart request by sending a Time Delay response. Verify that the device responds with a Null Response and that IIN1-4 is cleared indicating the device no longer needs time.2 Synchronization The Time and Date Object (Object 50 Variation 01) is an information object that represents the absolute time of day and date. 8. 4. The actual accuracy of time synchronization is dependent on device accuracy and system configuration and should be tested separately (factory and/or site acceptance tests). Issue a request for Cold Restart using Function Code 13.2. 8. 2.8.8. Verify that each fragment of the response contains no more than the configured fragment size. the FIN bit is zero. 11.1. i.9. If the DUT’s reply contains more than one fragment then verify that the first response message sets the FIR bit to a one. 8. The DUT must not send subsequent fragments if it does not receive a valid confirmation within a timeout.e. no further testing is required in the Application Layer Fragmentation section. Transport layer segmentation must operate correctly within each fragment. 8. 6.1 Use of FIR. 1. 8. The application layer sequence number must increment between fragments.8. Cycle power to the DUT. If there is no way to cause the DUT to generate multiple fragments. 7. If the device cannot generate more than one fragment.9 Application Layer Fragmentation 8.9. Verify each fragment is properly segmented by the transport layer as described in that section of this document. its Class 0 response is less than a fragment and it does not support event data. it must meet the following criteria: • • • • • • • • The application layer FIR bit must be set in the first fragment (only). it must behave accordingly.2 Test Procedure If the DUT has a configurable fragment size. 4. 3. signifying the last data fragment.1 § Desired Behavior • • • The DUT must request an application layer confirmation between fragments. Verify that the DUT responds with valid data. 2. If the fragment size is configurable. If the DUT’s fragment size is configurable.9. Verify that the last fragment has the FIR bit cleared and the FIN bit set. 10.2 § Use of Confirmation in Fragmentation 8. repeat this test with a different fragment size and verify the data for each fragment does not exceed the configured size. The application layer FIN bit must be set in the final fragment (only).1.1 Desired Behavior If the DUT can generate enough data to create multiple application layer fragments. Alternately. The DUT must not send subsequent fragments until it receives confirmation of the previous fragment.9. configure it to be no more than 2048 octets.9. The fragment size must be able to be configured to be no larger than 2048 octets. Verify that the sequence number of the first fragment matches the request. 9. If the DUT’s reply contains only a single fragment then verify the FIR bit is set to one and the FIN bit is also set to one. the FIR and FIN bits in the application layer header must signify that there is only one APDU in the reply. The application layer sequence number of the first fragment must match that of the request. 12. if this will generate a multi-fragment response. Verify subsequent fragments to assure that the FIR bit is zero. FIN and SEQUENCE in Fragmentation 8. with a correct sequence number.2. generate enough event data to fill more than one fragment and request the appropriate class of data with Qualifier Code 0x06. 5. DNP3-2003 IED Certification Procedure Subset Level 1 Page 44 Rev 2.3 – 29-Sept-03 . Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06. and the sequence number increments by one. NOTE: The DUT is not required to request application layer confirmation on the last fragment of a response (unless required for other reasons tested elsewhere in this document). the FIN bit is set to zero. this must be noted on the Implementation Conformance Statement and in the Device Profile Document. Wait a time period less than the application confirmation timeout. Wait the application confirmation timeout for the DUT. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06. if this will generate a multi-fragment response. Repeat as necessary to verify that the DUT responds in an appropriate manner for the physical layer which may include: a) Raising carrier (or asserting RTS) an appropriate period of time before transmitting the first bit of data. 6. if this will generate a multi-fragment response. Do not send an application confirmation.2 Test Procedure 1. FIN and sequence number set correctly). 9.1 Desired Behavior • • The DUT must only respond to requests when the destination address field of the link layer portion of the request matches its assigned DNP address.9.8. Verify the DUT does not send the next fragment because it did not receive confirmation of the first fragment. Verify the DUT does not send the next fragment because it has timed out. If a third fragment is expected. Verify that the CON bit is set in the second fragment if a third fragment is expected. Verify the DUT does not send the next fragment because the confirmation it received was invalid. 5. Issue a request for Object 60 Variations 2.10. 3. 4. If the DUT does not support multi-drop physical layers. 6. b) Dropping carrier (or de-asserting RTS) an appropriate period of time after transmitting the last bit of data. 2. Connect an oscilloscope and/or protocol analyzer to the DUT communications signals.g. Issue a request for Object 60 Variations 2. Verify that the DUT sends the second fragment (with FIR. Do not send an application confirmation.10.3. 11. 16. 8. and 4 using the all data qualifier 0x06 to the DUT. Verify the DUT does not send the next fragment because it has timed out. 2.3 – 29-Sept-03 . Send the valid application layer confirmation. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06. Wait the application layer confirmation timeout for the DUT. 19. 15. generate enough event data to fill more than one fragment and request the appropriate class of data with Qualifier Code 0x06.10 Multi-Drop Support 8. 10. Send the valid application layer confirmation before the application confirmation timeout. 13. Send the valid application layer confirmation. 9. Verify that the DUT responds with valid data. Verify the DUT does not send the second fragment yet. first send a valid application layer confirmation and then a request for multi-fragment data as in steps 1-3. DNP3-2003 IED Certification Procedure Subset Level 1 Page 45 Rev 2. 20. and 4 using the all data qualifier 0x06 to the broadcast address.2 § Test Procedure 1. asserting RTS) during periods in which it is not responding. 17. Verify that the DUT does not respond in any way. Alternately. Connect the DUT and at least two additional DNP devices to the same communications drop. 18. The DUT must remain silent in all other cases. generate enough event data to fill more than one fragment and request the appropriate class of data with Qualifier Code 0x06. Issue a request for Object 60 Variations 2. No further testing is required in this section. 12. 4. 8. 8. This includes not raising carrier (e. Send an application layer confirmation with an incorrect sequence number. Verify that the DUT does not respond in any way.3. including raising carrier or asserting RTS. including raising carrier or asserting RTS. Verify that the CON bit is set in the first fragment. 7. 8.3. 5. If not. Alternately. 7. and 4 using the all data qualifier 0x06 to each of the other devices on the communications channel. 3.2. Verify that the CON bit is set in the first fragment. 14. Verify the sequence number matches the request. skip to step 16. This is the amount of time between transmissions of unconfirmed unsolicited responses. • § The device must respond to all function requests to which it would normally respond. 8. regardless of whether the message has the restart bit (IIN1-7) set. repeat this test for the lower of the two following cases. The range of configurable values must include 1 second to 1 minute. or another parameter that performs the same purpose only for unsolicited responses. If a device does not support unsolicited responses. including READ function requests. • § All unsolicited response messages must request application layer confirmation.11. but support unsolicited responses in a dial-up environment. • § The initial unsolicited response message must request an application layer confirmation.3 – 29-Sept-03 . 8. the device is to behave exactly like an equivalent device that has no support for unsolicited responses. Therefore. • Ignore Master device application layer confirmations of unsolicited responses if their sequence numbers do not match those of the corresponding unsolicited responses. For instance.11 Unsolicited Responses Support for unsolicited responses is optional.2 Sequence Numbers and Confirmation At all times: • Application layer sequence numbers (the value of bits 0–4 of the application layer control field) must be in the correct range for all messages sent: 0–15 for polled responses and 16–31 for unsolicited responses. regardless of whether they are null (no data) or contain data.1. • The unsolicited response mode (either “on” or “off”). all that is needed to test unsolicited responses is a full-duplex serial connection to the DUT. while waiting for the confirmation of the initial unsolicited response. This may be either the normal application confirmation timeout. • § Maximum number of unsolicited retry attempts. this section may be skipped in its entirety. • The initial unsolicited response message must have the restart bit (IIN1-7) set if the Master has not already sent a command to clear it.: by front-panel user interface or off-line configuration): • The destination address of the Master device to which the unsolicited responses are to be sent. When the unsolicited response mode is configured “off”.3 Restart Behavior If the unsolicited response mode is configured “on. One of the choices must provide for an indefinite (and potentially infinite) number of retries.11. maximum. DNP3-2003 IED Certification Procedure Subset Level 1 Page 46 Rev 2. and two intermediate values 8.1 Desired Behavior 8.e. or to compensate for. Although unsolicited responses may be used with collision avoidance. i.c) If the pre and post RTS to transmit delay parameters are configurable. • § The initial unsolicited response message must be null..” then upon device restart: • The device must transmit an initial unsolicited response message.11. • § The device must continue to transmit initial null unsolicited responses forever at the rate set by the unsolicited confirmation timeout.1. • § The unsolicited confirmation timeout.11.g. but may be extended in either direction (slower or faster) to take advantage of.1 Configuration Devices that support unsolicited responses must support end-user configuration of the following parameters (e. it must not contain static or event data objects.1. the two features are independent. until that initial unsolicited response message is confirmed. a device might not support collision avoidance. 8. faster or slower devices or communications media. i) the total number of selections or ii) the minimum. This disabled status does not apply to initial null unsolicited responses. the event data must be cleared from the device and no longer transmitted in subsequent unsolicited or polled responses. § The device cannot generate an additional unsolicited response until it has responded to a pending READ request. § If a READ function code request is received while waiting for a confirmation of an unsolicited response.4 Runtime Behavior Once an initial unsolicited response message has been confirmed. READ requests for data. the device must defer responding to the READ request (the READ request is therefore “pending”) until after either the unsolicited confirmation timeout occurs. Use this capability to configure the unsolicited response mode to “on. Note: Enabling and disabling exception reporting does not enable/disable the storage of the events. or static data for which no event object types exist: binary output status (Object 10 Variation 2) and analog output status (Object 40 Variation 2). if function code 0x15 is requested. and the new function code should be processed according the desired behavior rules of this section. it must respond to function codes 0x14 and 0x15. 2.5 • Unsolicited and Polled Responses • • • • • • If an unsolicited response message containing event data is not confirmed. 8. for example. the device must immediately process it.11.11. § If a READ function code request is pending while waiting for a confirmation of an unsolicited response. do not allow the Master being used to test the device to issue any of these requests automatically. Class 2.2. then after restart. i. support the enabling and disabling of unsolicited responses for Class 1. Unsolicited Response Configuration/Startup Verify that the DUT has off-line capability to configure the unsolicited response mode (either “on” or “off”). 8. and another (new) function code request is received.e. including: requests to clear the restart bit (IIN1-7). analog input change events may be updated to reflect new current values of analog inputs).• § The device must not send any more unsolicited responses after the initial null unsolicited response message has been confirmed. object 60. • § At a minimum. If a non-READ function code request is received while waiting for a confirmation of an unsolicited response. data-filled unsolicited messages are always disabled on restart. Once an unsolicited response message containing event data is confirmed. and variations 2..” § Verify the DUT has off-line capability to configure the unsolicited confirmation timeout. • Only send unsolicited responses for those classes of data that have been enabled. The event data does not have to be re-transmitted exactly (new change events may have occurred. until a function code 0x14 (enable data-filled unsolicited messages) request has been received. i. • Unsolicited response messages must contain only the following kinds of data: event data. or Class 3 data.1. and if no off-line configuration is altered. • § Process function code 0x15 requests (to disable data-filled unsolicited messages). or. 2.1 1. DNP3-2003 IED Certification Procedure Subset Level 1 Page 47 Rev 2. 8.2 Test Procedure Unless explicitly specified by the tests in these sections. just the reporting. 3 and 4 without error responses. Verify that it can be set to at least as small as 1 second. and to at least as large as 1 minute. when static data is returned in unsolicited responses. then the device must: • § Process function code 0x14 requests (to enable data-filled unsolicited messages).3 – 29-Sept-03 . the rules for event processing still apply as specified in section 3. application layer confirmations and requests to enable or disable unsolicited responses. and 3 data. do not issue any requests to the DUT. or the confirmation of the unsolicited response is received. the original READ function code request must be abandoned (with no response transmitted). Even if the device does not have Class 1. and re-transmit the event data either in subsequent unsolicited response messages or in polled response messages. an initial unsolicited response message must again be transmitted. retain the event data.e. the device must timeout.4. Note. This enabled status must not be retained through a device restart.11. 8. Similarly.1. The device cannot generate unsolicited responses if it is waiting for an application confirmation to a previous polled or unsolicited response.11. and Object 60. Verify that the DUT transmits an initial unsolicited response to the configured Master destination address. and verify that another unsolicited response is transmitted by the DUT. Verify that an initial unsolicited response is transmitted by the DUT. Wait at least 10 seconds. Page 48 Rev 2. Wait at least 5 seconds. 22. 5. Verify that the unsolicited response contains the restart bit (IIN1-7) set. however. Verify that the application sequence number is in the correct range. § Verify that the unsolicited response is null (contains no data).2 1. 14. Variation 4.3. For example. Use this capability to configure a specific destination address. 8. but use an incorrect application-layer sequence number. 9. Variation 3. 13. 30. 12. Generate known events. § Verify that the unsolicited responses request application layer confirmations. nor is it the purpose of this test to verify the accuracy of the time keeping capability of the DUT. 25. than once every 5 seconds. to verify that the parameter has been implemented. 2.5 seconds. Use the off-line configuration capability to configure the destination address to a different destination address. 5. Cycle power to the DUT. Object 60. This may involve waiting for an amount of time. and verify that two or more unsolicited responses are transmitted by the DUT.11. Variation 2. 20. 17. Verify that the DUT responds with a null response that has the restart bit (IIN1-7) cleared. 15. Issue an application layer confirmation of the unsolicited response. As a further simplification for the purposes of this test. 6. Variation 2. 16. Verify that an unsolicited response is transmitted. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. and verify that another unsolicited response is transmitted by the DUT.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . 4. 8. 28. and no less often. Verify that the DUT responds with a null response indicating the request was processed without error. Wait at least 5 seconds.) Verify the DUT has off-line capability to configure the destination address of the Master device to which unsolicited responses are to be sent. 3. 19. It is the purpose of this test. generate such data. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. 11. Unsolicited Response . § Verify that the unsolicited response requests an application layer confirmation. 29.1. Verify that the unsolicited response requests an application layer confirmation. 27. 24. 9. 23. 7. § Verify that the unsolicited responses are null (contains no data). For the remainder of Section 8. object 60. 18.Class 1 Data Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60. 4. if there is a binary input change event that is (or can be assigned to) Class 1. 10. It is not the purpose of this test to verify the full range of this parameter. Wait at least 5 seconds. 8. Issue a request to clear the restart bit (IIN1-7). and verify that another unsolicited response is transmitted by the DUT. Verify that these new unsolicited responses are transmitted no more often. then ensure that it is assigned to Class 1. 21. If it is not possible to generate Class 1 data that would generate unsolicited responses. If the DUT has Class 1 data.2. 26. Issue a READ request (function code 0x01) for Object 60 Variation 1 (class 0) using the all data qualifier 0x06. Cycle power to the DUT. measurement accuracy can be within 0. and is used to simplify the description and execution of this test. Verify that it has been transmitted to the configured Master destination address. when the test steps below exercise and rely upon this value. and generate one such event. 7. Verify that the DUT responds with a null response indicating the request was processed without error. dictated by the DUT and specified by the DUT’s Device Profile Document. 6. § Verify that the DUT responds to the READ request with class 0 data. Verify that the restart bit (IIN1-7) remains set in these unsolicited responses. set this time to be 5 seconds.11. Issue a request to enable unsolicited responses for Class 1 data by using function code 0x14. § Verify that no further unsolicited responses are transmitted by waiting for such responses for at least 5 seconds.2. (The value of 5 seconds is arbitrary. steps 8 through 14 are not applicable. Verify that the restart bit (IIN1-7) is clear in the unsolicited responses. and use the correct application-layer sequence number. Issue an application-layer confirmation of the unsolicited response. 12. 8. It is also possible for new event data to have been generated. wait for the unsolicited confirmation timeout to expire. but use an incorrect application-layer sequence number. 16. (It is not required that the unsolicited responses be identical. Unsolicited Response . 10. Verify that the DUT responds with a null response indicating the request was processed without error.10.3 1. 11.) Issue an application layer confirmation of the unsolicited response. Wait for the unsolicited confirmation timeout to expire. Variation 2. 17.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . Page 49 Rev 2. If the DUT has Class 3 data. 8.4 1. 7. Variation 4. 9. then generate such data. then ensure that it is assigned to Class 3. Verify that at least the same event data is present in the unsolicited response. Verify that at least the same event data is present in the unsolicited response. Issue an application layer confirmation of the unsolicited response. Without issuing an application layer confirmation. Variation 3. 3. if there is a binary input change event that is (or can be assigned to) Class 3. For data such as analog input change events. and generate one such event. 2. Verify that the DUT responds with a null response indicating the request was processed without error. If the DUT has Class 3 data. and verify that another unsolicited response is transmitted by the DUT. If the DUT has Class 3 data. and generate one such event. Variation 2. and Object 60.Class 3 Data Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60. It is also possible for new event data to have been generated. 11. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. the data may be updated to reflect current values. For example. and verify that another unsolicited response is transmitted by the DUT. 6. Issue a request to enable unsolicited responses for Class 2 data by using function code 0x14. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. 16. Variation 3. Verify that the unsolicited response requests an application layer confirmation.11. 3.2. then generate such data. generate such data. still containing the same event data.) 13. Verify that an unsolicited response is transmitted.2. 15. and verify that another unsolicited response is transmitted by the DUT. Variation 4. and Object 60. Variation 3. if there is a binary input change event that is (or can be assigned to) Class 2. then also generate Class 3 data. Issue an application-layer confirmation of the unsolicited response. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. and use the correct application-layer sequence number. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Object 60.Class 2 Data Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60. 14. still containing the same event data. but use an incorrect application-layer sequence number. This may involve waiting for an amount of time. and use the correct application-layer sequence number. Wait for the unsolicited confirmation timeout to expire.11. 2. and verify that another unsolicited response is transmitted by the DUT. If the DUT has Class 2 data. 17. 8. If the DUT has Class 1 data. 13. If the DUT has Class 2 data. Verify that the DUT responds with a null response indicating the request was processed without error. then ensure that it is assigned to Class 2. Unsolicited Response . 12. Object 60. wait for the unsolicited confirmation timeout to expire. 14. steps 8 through 14 are not applicable. 15. Verify that the application sequence number is in the correct range. Issue an application-layer confirmation of the unsolicited response. 5. the data may be updated to reflect current values. Without issuing an application layer confirmation. Object 60. dictated by the DUT and specified by the DUT’s Device Profile Document. For data such as analog input change events. If it is not possible to generate Class 2 data that would generate unsolicited responses. Verify that the application sequence number is in the correct range. then also generate Class 3 data. For example. (It is not required that the unsolicited responses be identical. 4. generate such data. Issue an application-layer confirmation of the unsolicited or polled response. the data may be updated to reflect current values. Variation 3. and Object 60. 9.2. Issue a request to enable unsolicited responses for Class 3 data by using function code 0x14. 8.2 Clears transmitted data upon confirmation 1. still containing the same event data. Issue a READ request (function code 0x01) for Object 60 Variations 2. Generate class 1.11. but use an incorrect application-layer sequence number.2. 12. Verify that none of the event data transmitted by the unsolicited response is contained in the polled response. Wait for the unsolicited confirmation timeout to expire.2. 16. Verify that the unsolicited response requests an application layer confirmation. then generate such data. Without issuing an application layer confirmation. and 4 using the all data qualifier 0x06. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. dictated by the DUT and specified by the DUT’s Device Profile Document. This may involve waiting for an amount of time. and use the correct application-layer sequence number.5 Unsolicited and Polled Responses This is a complicated test procedure. For data such as analog input change events.2. 17. 2. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. Variation 4. Verify that an unsolicited response is transmitted.11. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. 8. Variation 2. Wait for this unsolicited response to be sent. 3. 13. Verify that at least the same event data is present in the unsolicited response. 2. issue a function code request other than READ (for example. 5.1 Transmits data-filled unsolicited responses 1.11. (It is not required that the unsolicited responses be identical.5.) Issue an application layer confirmation of the unsolicited response. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Verify that the DUT responds with a null response indicating the request was processed without error.4. Verify that the application sequence number is in the correct range.5. 4. steps 8 through 14 are not applicable. and verify that another unsolicited response is transmitted by the DUT. and verify that another unsolicited response is transmitted by the DUT. Verify that an unsolicited response is transmitted. Variation 4. Verify that the unsolicited response requests an application layer confirmation. Issue an application-layer confirmation of the unsolicited response. 4. Verify that the DUT responds with a null response indicating the request was processed without error. dictated by the DUT and specified by the DUT’s Device Profile Document. Object 60. If the DUT has Class 2 data. or 3 event data to trigger the transmission of an unsolicited response. 14. 10. 15. 7.11. 2. 2. 11. Verify that the DUT immediately responds without error. 8. Wait for the unsolicited confirmation timeout to expire. If it is not possible to generate Class 2 data that would generate unsolicited responses. 8. This may involve waiting for an amount of time. DNP3-2003 IED Certification Procedure Subset Level 1 Page 50 Rev 2.3 Processes non-READ requests immediately 1. 8. 5. Without issuing an application layer confirmation. or 3 event data. 3. function code 0x02 – WRITE to clear the restart flag IIN1-7).5. 6. Object 60. The test has been divided into sections for clarity. wait for the unsolicited confirmation timeout to expire. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. 3. and verify that another unsolicited response is transmitted by the DUT. 3. 2. If the DUT has Class 1 data. Generate class 1. It is also possible for new event data to have been generated. then also generate Class 2 data.3 – 29-Sept-03 . 2. 2. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Verify that the DUT does not respond within the unsolicited confirmation timeout. and 4 using the all data qualifier 0x06. 2.5. It is also possible for new event data to be generated. 3. 2. 3. issue a READ request for Object 60. Immediately after the unsolicited response. 3. 7.11. issue a function code request other than READ (for example. 3. Verify that the DUT immediately responds without error.5.4 Defers READ requests until after confirmation received 1. 3.2. Immediately after the unsolicited response. 2.6 Abandons READ requests upon subsequent non-READ requests 1. Wait for an amount of time less than the unsolicited confirmation timeout and verify that the DUT does not respond. 2.5. function code 0x02 – WRITE to clear the restart flag IIN1-7). then issue an application-layer confirmation of the polled response. or 3 event data to trigger the transmission of an unsolicited response. verify that it contains class 1. Verify that the event data in this unsolicited response includes the events reported in the previous unsolicited response that was not confirmed. Verify that the polled response is a response to the request for Object 60. the data may be updated to reflect current values. Immediately after the unsolicited response. and without issuing an application layer confirmation. 3. Issue an application-layer confirmation of the polled response to clear the device of event data. verify that the device responds with a polled response to the READ request (and not an unsolicited response). issue a READ request (function code 0x01) for Object 60 Variations 2. Variations 2. Before the unsolicited confirmation timeout. DNP3-2003 IED Certification Procedure Subset Level 1 Page 51 Rev 2. 6.2. 5. It is not required that the unsolicited responses be identical. Before the unsolicited confirmation timeout. Verify that the DUT does not respond within the unsolicited confirmation timeout. Generate class 1. Variations 2. Verify that none of the event data transmitted by the unsolicited response is contained in the polled response.11. Verify that the polled response contains at least the same event data that was in the unsolicited response that was not confirmed. 4. or 3 event data to trigger the transmission of an unsolicited response.7 Abandons READ requests upon subsequent READ requests 1. For data such as analog input change events. and without issuing an application layer confirmation.2. and 4.5. 8. and then verify that another unsolicited response is transmitted by the DUT. 4. issue a READ request (function code 0x01) for Object 60 Variations 2. Wait for this unsolicited response to be sent.5 Defers READ requests until after confirmation timeout 1. and 4 READ request (and not an unsolicited response). Verify that the event data in this unsolicited response includes the events reported in the previous unsolicited response that was not confirmed.2. Wait for the unsolicited confirmation timeout to expire. in other words. Verify that the polled response requests an application layer confirmation.11. and without issuing an application layer confirmation. and 4 using the all data qualifier 0x06. 3. 4. and without issuing an application layer confirmation. Issue an application-layer confirmation of the unsolicited response before the unsolicited confirmation timeout occurs. 5. 3. issue a READ request (function code 0x01) for Object 60 Variations 2. Generate class 1. Variation 2. If the polled response requested an application layer confirmation. After the unsolicited confirmation timeout. 5. 8.5. verify that the device responds with a polled response to the Object 60. or 3 data and not class 0 data. 6. Wait for this unsolicited response to be sent. 3. 3. 8. 8.11. 4. 8.3 – 29-Sept-03 . Immediately after the unsolicited response. Verify that the device immediately transmits a response to the READ request. using the all data qualifier 0x06. and 4 using the all data qualifier 0x06. After the unsolicited confirmation timeout. 2. and 4 – not Variation 1. issue a READ request (function code 0x01) for Object 60 Variation 1 using the all data qualifier 0x06. 6. 5. Verify that the unsolicited response contains at least the same event data that was in the polled response that was not confirmed.2. Verify that the unsolicited response requests an application layer confirmation. Use this capability to configure the maximum number of retries to 5. Page 52 Rev 2. If the device has a minimum amount of event data that will cause the immediate transmission of an unsolicited response.5. 2. Verify that the polled response requests an application layer confirmation. 3.8 Inhibits Unsolicited responses until after polled confirmation 1. and Object 60. 7. 10. Issue a request to clear the restart bit (IIN1-7). generate more event data that would otherwise cause the transmission of an unsolicited response. or 3 event data. 9. 17. nor before any application layer retries are attempted. 8. if there is a window of time between the generation of event data and the subsequent transmission of an unsolicited response. Generate class 1. Verify that the polled response requests an application layer confirmation. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. Or. 7. Variation 2. Issue an application-layer confirmation of the unsolicited response to clear the device of event data. 5. Issue an application-layer confirmation of the polled response to clear the device of event data. Variation 4. Variation 4. Verify that retries are terminated when confirmation is received. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. issue a READ request (function code 0x01) for Object 60 Variations 2. Variation 3. then the remaining steps in this procedure are not applicable. 8. 6.11. dictated by the DUT and specified by the DUT’s Device Profile Document. Variation 2. 12. and Object 60. 4. Before an unsolicited response is transmitted.5. 10. Verify that the DUT does not transmit an unsolicited response within the application confirmation timeout. Cycle power to the DUT. Verify that events are reported in the response to the READ request 4. 16. 19. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. Verify that DUT retries the response 5 times. 3. Do not send an application layer confirmation. Issue a request to clear the restart bit (IIN1-7). 11. 9. 2. 6. 18. 13. then generate event data and perform the next test procedure step before this time elapses. and 4 using the all data qualifier 0x06. Cycle power to the DUT. 14. Verify that an unsolicited response is transmitted. 8. Do not issue an application layer confirm. If necessary. Object 60. If neither of these procedures are possible. Verify the DUT has off-line capability to configure the maximum number of unsolicited retries and that one of the choices causes the DUT to retry indefinitely. 2. Issue an application-layer confirmation of the initial unsolicited response. but less than this amount of class 1. Generate class 1. This may involve waiting for an amount of time. 8. verify that the device responds with an unsolicited response. 3. Variation 3. Configure the maximum number of retries to indefinite. 2. 9. 2. Verify that the DUT responds with a null response indicating the request was processed without error.11. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. After the application confirmation timeout.6. 7.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 1 . Object 60.9 Retries unsolicited responses configurable number of times 1. and after any application layer retries. Verify that the polled response contains at least the same event data that was in the unsolicited response that was not confirmed. or 3 event data. 8. Verify that an unsolicited response is transmitted. 11. Issue an application-layer confirmation of the initial unsolicited response. Issue an application layer confirm after at least one retry. Verify that the DUT responds with a null response indicating the request was processed without error. 5.2. 15. then generate at least some. or 3 event data. 27. Generate class 1.) and test equipment suitable for testing this feature. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. A device may be certified as supporting collision avoidance in one of the following ways: • Detecting out-of-band carrier (e. Verify that the DUT responds with an Error Response with IIN2-0 set indicating that the DUT has received a message containing a bad function code. 3. Variation 4. Issue an application-layer confirmation of the initial unsolicited response. and 4 using the all data qualifier 0x06 to cause the DUT to report (and clear) all pending events. DNP3-2003 IED Certification Procedure Subset Level 1 Page 53 Rev 2. but support unsolicited responses in a dial-up environment. Although unsolicited responses may be used with collision avoidance. Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60. a device might not support collision avoidance. 9. Cycle power to the DUT. 25. and Object 60. Variation 2. Variation 3. 21. issue an application layer confirm. Issue a request to clear the restart bit (IIN1-7). 13. Cycle power to the DUT. Variation 2. 28. TX/RX line). 4. 11. 26. 8.3 – 29-Sept-03 . Variation 4. If necessary. the supplier of the DUT must specify which method the DUT uses to detect other devices are transmitting. 23. Generate several change events or other data. The test equipment must be capable of measuring time between two characters transmitted on the link. If requested. However.g. Object 60.12 § Collision Avoidance The functions tested in this section are optional. Variation 3. without the aid of an external device • Detecting transmitted data (e.g. For instance. Verify that no initial unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Variation 4. 14. or 3 event data.11. 3. 12. Issue a request for Object 60 Variations 2. 5. Verify that the DUT responds with a null response that has the restart bit (IIN1-7) cleared. Verify that the DUT responds with a null response indicating the request was processed without error. 2. which would otherwise cause an unsolicited response. 6. Variation 3. Verify that an unsolicited response is transmitted. the two features are independent. 24. Unsolicited Responses Off Configure the unsolicited response mode to “off”. and Object 60. with the aid of an external device 2. it must pass the tests in this section to be compliant. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. However.6 1. the supplier must supply hardware (modems etc. if a device claims in its Device Profile Document that it implements collision avoidance. Verify that the DUT responds with an Error Response with IIN2-0 set indicating that the DUT has received a message containing a bad function code.2. 8. 2. Issue a request to clear the restart bit (IIN1-7). 22. Object 60. Variation 2. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. DCD) 1. 15. 7. Object 60. For these tests. 10. 8. Verify that no initial unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60.20. Do not issue an application layer confirm. Verify that retries continue for an extended period of time. and Object 60. unsolicited responses in a multi-drop environment require collision avoidance. The operation of collision avoidance is as follows: The physical layer must provide an indication to the data link layer of when the link is in use, e.g. using the DCD (Data Carrier Detect) signal or simply monitoring all data on the link. If a device prepares to transmit and finds the link busy, it waits until it is no longer busy, then waits a backoff_time as follows: backoff_time = fixed_delay + random( max_random_delay ) After the backoff_time, the device tries again, either indefinitely, or up to a configurable maximum number of retries. If a maximum is used, the protocol behaves as if a link failure occurred, i.e. data is returned to buffers at the application layer and application layer retries take place if desired. The fixed_delay can be adjusted per device to provide priority of access. For instance, it could be zero (0) for masters and non-zero for all the slave devices. The fixed_delay for the slaves must be greater than the max_random_delay for the master. This provides a minimum "window" of access time for the master(s). To absolutely guarantee the master’s priority, the master would not have a random delay. 8.12.1 Desired Behavior When implementing collision avoidance, the DUT must meet the following requirements: • The fixed_delay and the max_random_delay must be configurable. • The DUT must transmit as quickly as possible if no other device is transmitting. • The DUT must wait the backoff_time when it tries to transmit and another device is already transmitting. • The backoff_time must start at the moment when the other device stops transmitting. • The backoff_time must be greater than the fixed_delay. • The backoff_time must not exceed the fixed_delay plus the max_random_delay. • If another device is still transmitting when the backoff_delay expires, the DUT must wait until the line becomes free and then restart the backoff timer. 8.12.2 Test Procedure Request Class 1 data (Object 60 Variation 2) using Qualifier Code 0x06 and link control block 0xC4. Verify the device responds with data. Measure the turnaround delay between receipt of the request and the response. Prepare a request for Class 1 data as above, followed immediately by “noise” data sufficient to exceed the measured turnaround delay and the fixed_delay but less than the turnaround delay plus the maximum backoff_delay. The noise data may consist of a poll to a nonexistent device. 4. Send the request. 5. Verify the DUT sends a response AFTER the noise data has finished transmitting. Verify the noise and the response do not overlap. 6. Verify the delay between the end of the noise data and the start of the response is less than the maximum back_off delay and more than the fixed_delay plus the max_random_delay. 7. Repeat steps 4 through 6 at least 10 times. Verify the measured backoff_delay is different in each case although it remains less than the maximum backoff_delay and the length of the noise data remains constant. 8. Add more noise data to the prepared request so that the noise data now exceeds several times the fixed_delay plus the max_random_delay, then a gap in the noise less than the fixed_delay, followed by noise several times longer than fixed_delay plus the max_random_delay. 9. Repeat steps 4 through 6 to verify the DUT will back off more than once. 10. Reconfigure the device with a different fixed_delay and maximum_random_delay. 11. Repeat steps 1 through 10. 1. 2. 3. DNP3-2003 IED Certification Procedure Subset Level 1 Page 54 Rev 2.3 – 29-Sept-03 9 Appendix A – DNP3 Reference Sheets QUICK REFERENCE FOR DNP DATA LINK CONTROL FIELD Definitions: MSB 1 DIR PRM 0 0 7 DIR PRM FCB FCV DFC Function Codes: Primary Frames (PRM=1) Fn Code 0 1 2 3 4 9 Function RESET link Reset User Process TEST link User Data User Data Request Link Status Frame Type SEND/CONFIRM SEND/CONFIRM SEND/CONFIRM SEND/CONFIRM SEND/NO REPLY REQUEST/RESPOND FCV 0 0 1 1 0 0 6 5 DFC 4 3 2 1 0 Secondary FCB FCV FUNCTION CODE LSB Primary 1 = Master, 0 = Remote 1 = Data Link Request, 0 = Data Link Response Frame Count Bit, alternates 1 and 0 Frame Count Valid; 1 = valid, 0 = invalid Data Flow Control; 1 = no buffers left Secondary Frames (PRM = 0) Fn Code 0 1 11 Function ACK NACK Link Status Frame Type CONFIRM CONFIRM RESPOND DNP3-2003 IED Certification Procedure Subset Level 1 Page 55 Rev 2.3 – 29-Sept-03 QUICK REFERENCE FOR DNP DATA LINK CONTROL FIELD List of Valid Control Field values by hex value; most common in bold: From Remote 00 01 0B 10 11 1B 40 41 44 49 52 53 60 61 64 69 72 73 From Master 80 81 8B 90 91 9B C0 C1 C4 C9 D2 D3 E0 E1 E4 E9 F2 F3 Function ACK NACK Link Status Reply ACK NACK Link Status Reply RESET LINK Reset User Process Unconfirmed User Data Link Status Request Test Link Confirmed User Data RESET LINK Reset User Process Unconfirmed User Data Link Status Request Test Link Confirmed User Data Other Failed transaction No flow Control Frame accepted, no more buffers left Frame not accepted, no buffers available No buffers available FCB = 0 FCB = 0 FCB = 1 ignored FCB = 1 ignored FCB = 1 ignored FCB = 1 ignored FCB = 1 FCB = 1 Frame Header: Byte Name 1 05 2 64 3 LEN 4 CTRL 5 DEST 6 7 8 9 CRC 10 11 TH SOURCE Transport Header(TH): Bit 7 = FINAL, Bit 6 = FIRST DNP3-2003 IED Certification Procedure Subset Level 1 Page 56 Rev 2.3 – 29-Sept-03 DNP APDU APCI Message Header DUI Object Header IO Data DUI Object Header IO Data Request Header Appl. Ctrl Func Code Response Header Appl. Ctrl Func Code Internal Indication Object Group Object Variation Qualifier Range See Data Object Library 7 7 6 5 4 3 2 1 0 0x00 Confirm 0x00 Confirm 0x01 Read 0x81 Response 0x02 Write 0x82 Unsolicited Response 0x03 Select 0x04 Operate 0x05 Direct Operate 0x06 Direct Op, No Ack 0x07 Immediate Freeze 0x08 Immediate Freeze No Ack 0x09 Freeze and Clear 0x0A Freeze and Clear No Ack 0x0B Freeze with Time 0x0C Freeze with Time No Ack 0x0D Cold Restart 0x0E Warm Restart 0x0F Init Data to Defaults 0x10 Initialize Application 0x11 Start Application 0x12 Stop Application 0x13 Save Configuration 0x14 Enable Unsolicited Msgs 0x15 Disable Unsolicited Msgs 0x16 Assign Class 0x17 Delay Measurement 0x18 Record Current Time 6 5 4 3 2 1 0 Depends on Qualifier Code FIRST OCTET 7 6 5 4 3 2 1 0 CONFIRM FIRST FINAL UNSOLICITED SEQUENCE LOCAL DEV. TROUBLE ALL STATIONS NEED TIME CLASS 3 CLASS 2 RESTART CLASS 1 INDEX SIZE 0 – No Index, Packed 1 – 1 Octet Index 2 – 2 Octet Index 3 – 4 Octet Index 4 – 1 Octet Object Size 5 – 2 Octet Object Size 6 – 4 Octet Object Size QUALIFIER CODE 0 – 8-Bit Start and Stop Indices 1 – 16-Bit Start and Stop Indices 2 – 32-Bit Start and Stop Indices 3 – 8-Bit Absolute Address Identifers 4 – 16-Bit Absolute Address Identifiers 5 – 32-Bit Absolute Address Identifers 6 – No Range Field (all) 7 – 8-Bit Quantity 8 – 16-Bit Quantity 9 – 32-Bit Quantity 11 – (0xB) Variable Array DNP = Distributed Network Protocol Application Protocol Data Unit Application Protocol Control Information Data Unit Identifier Information Object APDU = SECOND OCTET 7 6 5 4 3 2 1 0 APCI = BUFFER OVERFLOW OBJECT UNKNOWN BAD CONFIG RESERVED RESERVED ALREADY EXEC OUT OF RANGE BAD FUNCTION INDEX SIZE (QUAL CODE = 11) 0 – Dataless Object; No Further Indexing 1 – 1 Octet Index or Identifier Size 2 – 2 Octet Index or Identifier Size 3 – 4 Octet Index or Identifier Size DUI IO = = DNP3-2003 IED Certification Procedure Subset Level 1 Page 57 Rev 2.3 – 29-Sept-03 Distributed Network Protocol (DNP3-2003) DNP3-2003 Intelligent Electronic Device (IED) Certification Procedure Subset Level 2 Version 2.3 29-Sept-03 Disclaimer Statement DNP User Group documents and publications are not consensus documents. Information contained in this and other works has been obtained from sources believed to be reliable, and reviewed by credible members of the DNP User Group and/or the DNP User Group Technical Committee. Neither the DNP Users Group nor any authors/developers of DNP documentation guarantee, and each such person expressly disclaims responsibility for ensuring, the accuracy or completeness of any information published herein, and neither the DNP Users Group nor its authors/developers shall be responsible for any errors, omissions, or damages arising out of use of this document. Likewise, while the author/developer and publisher believe that the information and guidance given in this work serves as an enhancement to users, all parties must rely upon their own skill and judgment when making use of it. Neither the author nor the publisher assumes any liability to anyone for any loss or damage caused by any error or omission in the work, whether such error or omission is the result of negligence or any other cause. Any and all such liability is disclaimed. This statement was developed by the DNP User Group Technical Committee and represents the considered judgment of a group of software developers with expertise in the subject field. The DNP User Group is a global forum for users and implementers of the protocol and promotes implementers and developer information and interaction exchange. This work is published with the understanding that the DNP User Group and its authors/developers are supplying information through this publication, not attempting to render engineering or other professional services. If such services are required, the assistance of an appropriate professional should be sought. The DNP User Group is not responsible for any statements and/or opinions advanced in this publication. NOTICE OF RIGHTS - DNP USERS GROUP The contents of this manual are the property of the DNP Users Group. Revisions or additions to the definition and functionality of the DNP Protocol cannot be made without express written agreement from the DNP Users Group or its duly authorised party. In addition, no part of this document may be altered or revised or added to in any form or by any means, except as permitted by written agreement with the DNP Users Group or a Party duly authorised by the DNP Users Group. The DNP Users Group has made every reasonable attempt to ensure the completeness and accuracy of this document. However, the information contained in this manual is subject to change without notice, and does not represent a commitment on the part of the DNP Users Group. An update program for DNP documents is provided upon request by the DNP Users Group. TRADEMARK NOTICES DNP is a trademark of the DNP Users Group. Any brand and product names mentioned in this document are trademarks or registered trademarks of their respective companies. Copyright  1999 - 2003 DNP Users Group. All rights reserved. Revision History Date 18-Jan-99 15-Dec-99 10-July-00 Version 1.00 1.01 2.00 Sections affected ALL see errata sheet for 1.00 8.11.1.1 8.11.2.5.9 8.6.5.1 8.6.5.4 8.2.1.1 8.2.1.2.11 - 15 8.4.1.1 8.4.1.2.8 - 12 6 6.6.2.5 8.2.1.2.10, step 1 8.4.1.2.7, step 1 8.6.5.4 8.2.5 8.2.1.1, 8.2.1.2.3, 8.2.2.1, 8.2.2.2.2, 8.4.1.1, 8.4.1.2.3, 8.4.2.1, 8.4.2.2.2 8.2.4.1 - 8.2.4.2, 8.4.4.1 - 8.4.4.2 Section 9, Appendices A and B 8.5.1, Table 8-3 8.6.5.4, step 5 8.6.6.2.1-8.6.6.2.3, steps 9 and 12 8.14.2.10-8.14.2.11, step 4 8.14.2.13-8.14.2.14, step 4 8.14.2.15, steps 4 and 6 8.16.2.2.5, step 9 8.2.1.2.13, step 8 8.14.2.9, step 2 (plus others in same section) 8.14 (several subsections) 8.16.1.2,Tables 8-3,8-4 8.16.1.2.2 and 8.16.2.2.2 6.6.3.2, step 3 8.15 8.4.1.2.1, step 2 8.4.3.2.1, step 3 8.5.5.2.2, step 9 8.19.2.1, step 14 8.9.2.2, steps 14 and 15 DNP3-2003 IED Certification Procedure Subset Level 2 Reason for change Initial Release Fixes inconsistencies and errors Designates protocol as DNP3-1999 (formerly DNP V3.00 with extensions) Added required parameter - maximum number of unsolicited retries Added test procedure from TB9912-002 Added desired response to addresses 0xFFFE and 0xFFFD Added test procedure from TB9912-003 Added requirements for Control SBO retries Added test procedures from TB2000-002 Added requirements for Analog Output SBO retries Added test procedures from TB2000-002 Removed reference to function code 1 Removed function code 0xD1 from table Replace "end testing of Binary Output, SBO" with "skip this section" Replace "end testing of Analog Output, SBO" with "skip this section" Added step 2 - "Issue a link reset using link control block 0xC0" Added test procedure from TB2000-006 Added status code in error response as required in TB2001-01 Added test procedures from TB2001-001 Removed; the information required for these sections is not available and may not be for some time. Added frozen counter objects Added at the end "using link control block 0xF3". Added new steps to confirm the changes Added "with Time" after "Binary Input Change" Added "with Relative Time" after "Binary Input Change" Added "with Relative Time" after "Binary Input Change" Replaced "Issue a freeze counter command" with "Issue a freeze and clear"; replaced function code 0x08 with 0x0A Added at the end "with a status code value of 2 (NO MATCHING SELECT)". Added "If the response is not Null, " Corrected various numbering and consistency issues Removed references to delta counter objects Added text to exclude flag verification for non-flag variations Changed e.g. 0x03 to e.g. 0x83 Added text to skip time sync and delay measurement steps if IIN1-4 not set by the DUT Changed "...end testing of Analog Outputs" to "...end testing of Analog Output SBO" Changed "...does support..." to "...does not support..." Changed "...in table 8-4..." to "...in tables 8-3 and 8-4..." Changed "step 11" to "step 12" Changed text to handle case where only two fragments are expected. Page i Rev 2.3 – 29-Sept-03 5-July-01 2.1 21-July-02 2.2 8-Sept-03 2.3 8.11.2.6, step 7 8.12.2, step 1 8.6.4 Changed "Variations 3,2,1,0" to "Variations 2,3, and 4" Changed 0xF4 to 0xC4 Updated to test Local Forced Data flag as well as IIN1-5 DNP3-2003 IED Certification Procedure Subset Level 2 Page ii Rev 2.3 – 29-Sept-03 Contents 1 2 3 Overview 1.1 Protocol specification Notes Definitions 3.1 General 3.2 Internal Indications 3.3 Error Responses 3.4 Changes or Events 3.4.1 § Rules Reference Documents Pretest Review 5.1 Device Profile Review 5.2 Equipment Review Link Layer 6.1 Reset Link and Passive Confirm support 6.1.1 Desired Behavior 6.1.2 Test Procedure 6.2 Test Link 6.2.1 Desired Behavior 6.2.2 Test Procedure 6.3 Request Link Status 6.3.1 Desired Behavior 6.3.2 Test Procedure 6.4 Test Retries 6.4.1 Desired Behavior 6.4.2 Test Procedure 6.5 § DIR and FCV Bits 6.5.1 Desired Behavior 6.5.2 Test Procedure 6.6 Data Link Rejects Invalid Frames 6.6.1 Desired Behavior 6.6.2 Test Procedure – Primary Frames 6.6.2.1 Invalid Start Octets 6.6.2.2 Invalid Primary Function Code 6.6.2.3 Invalid Destination Address 6.6.2.4 Invalid CRC 6.6.2.5 § Invalid FCV 6.6.3 Test Procedure – Secondary Frames 6.6.3.1 Invalid Start Octets 6.6.3.2 Invalid Secondary Function Code 6.6.3.3 Invalid Destination Address 6.6.3.4 Invalid CRC Transport Layer 7.1 Desired Behavior 7.2 Test Procedure Application Layer 8.1 Binary Output Status 8.1.1 Desired Behavior 8.1.2 Test Procedure 8.2 Binary Outputs 8.2.1 Select Before Operate 8.2.1.1 Desired Behavior 1 1 1 3 3 3 3 4 4 5 5 5 5 6 6 6 6 7 7 7 7 7 7 8 8 8 8 8 8 9 9 9 10 10 10 10 11 11 11 12 12 12 13 13 13 14 14 14 14 14 15 15 Page iii Rev 2.3 – 29-Sept-03 4 5 6 7 8 DNP3-2003 IED Certification Procedure Subset Level 2 8.2.1.2 Test Procedure 8.2.1.2.1 Binary Output, SBO, 0x28 8.2.1.2.2 Binary Output, SBO, 0x17 8.2.1.2.3 Binary Output, SBO, To Uninstalled Point 8.2.1.2.4 Binary Output, SBO, Execute Issued After Timeout 8.2.1.2.5 Binary Output, SBO, Execute to Different Point Than Select 8.2.1.2.6 Binary Output, SBO, Execute On Time does not match Select On Time 8.2.1.2.7 Binary Output, SBO, Execute Off Time does not match Select Off Time 8.2.1.2.8 Binary Output, SBO, Select with supported Code, Execute with different Code 8.2.1.2.9 Binary Output, SBO, Select 0x28, Execute 0x17 8.2.1.2.10 Binary Output, SBO, Configurable Device 8.2.1.2.11 Binary Output, SBO, Same Sequence Number Select Retries 8.2.1.2.12 Binary Output, SBO, Incrementing Sequence Number Select Retries 8.2.1.2.13 Binary Output, SBO, Same Sequence Number Operate Retries 8.2.1.2.14 Binary Output, SBO, Incrementing Sequence Number Operate Retries 8.2.1.2.15 Binary Output, SBO, Sequence number checking 8.2.2 Direct Operate with Acknowledge 8.2.2.1 Desired Behavior 8.2.2.2 Test Procedure 8.2.2.2.1 Binary Output, Direct Operate 8.2.2.2.2 Binary Output, Direct Operate to Uninstalled Point 8.2.2.2.3 Binary Output, Direct Operate, Configurable Device 8.2.3 Direct Operate, No Acknowledge 8.2.3.1 Desired Behavior 8.2.3.2 Test Procedure 8.2.3.2.1 Binary Output, Direct Operate, No Acknowledge 8.2.3.2.2 Binary Output, Direct Operate, No Acknowledge, to an Uninstalled Point 8.2.3.2.3 Binary Output, Direct Operate, No Acknowledge, Configurable Device 8.2.4 Multiple Object Requests 8.2.4.1 Desired Behavior 8.2.4.2 Test Procedure 8.2.5 Control Code Support 8.2.5.1 Desired Behavior 8.2.5.2 Test Procedure 8.2.5.2.1 Binary Output, Complementary Function Support 8.2.5.2.2 Binary Output, Single Function Support 8.3 Analog Output Status 8.3.1 Desired Behavior 8.3.2 Test Procedure 8.4 Analog Outputs 8.4.1 Select Before Operate 8.4.1.1 Desired Behavior 8.4.1.2 Test Procedure 8.4.1.2.1 Analog Output, SBO, 0x28 8.4.1.2.2 Analog Output, SBO, 0x17 8.4.1.2.3 Analog Output, SBO, to Uninstalled Point 8.4.1.2.4 Analog Output, SBO, Execute Issued After Time-out 8.4.1.2.5 Analog Output, SBO, Execute Value does not match Select Value 8.4.1.2.6 Analog Output, SBO, Select 0x28, Execute 0x17 8.4.1.2.7 Analog Output, SBO, Configurable Device 8.4.1.2.8 Analog Output, SBO, Same Sequence Number Select Retries 8.4.1.2.9 Analog Output, SBO, Incrementing Sequence Number Select Retries 8.4.1.2.10 Analog Output, SBO, Same Sequence Number Operate Retries 8.4.1.2.11 Analog Output, SBO, Incrementing Sequence Number Operate Retries 8.4.1.2.12 Analog Output, SBO, Sequence number checking DNP3-2003 IED Certification Procedure Subset Level 2 16 16 16 16 16 16 16 17 17 17 17 17 17 18 18 18 18 18 19 19 19 19 19 19 19 19 20 20 20 20 20 21 21 21 21 22 23 23 23 23 24 24 25 25 25 25 25 25 25 26 26 26 26 26 26 Page iv Rev 2.3 – 29-Sept-03 Direct Operate with Acknowledge 8.4.2 8.4.2.1 Desired Behavior 8.4.2.2 Test Procedure 8.4.2.2.1 Analog Output, Direct Operate 8.4.2.2.2 Analog Output, Direct Operate, to Uninstalled Point 8.4.2.2.3 Analog Output, Direct Operate, Configurable Device 8.4.3 Direct Operate, No Acknowledge 8.4.3.1 Desired Behavior 8.4.3.2 Test Procedure 8.4.3.2.1 Analog Output, Direct Operate, No Acknowledge 8.4.3.2.2 Analog Output, Direct Operate, No Acknowledge, to an Uninstalled Point 8.4.3.2.3 Analog Output, Direct Operate, No Acknowledge, Configurable Device 8.4.4 Multiple Object Requests 8.4.4.1 Desired Behavior 8.4.4.2 Test Procedure 8.5 Class Data 8.5.1 Class 0 8.5.1.1 Desired Behavior 8.5.1.2 Test Procedure 8.5.2 Class 1 8.5.2.1 Desired Behavior 8.5.2.2 Test Procedure 8.5.2.2.1 Class 1 Data, 0x06 8.5.2.2.2 Class 1 Data, 0x07 8.5.2.2.3 Class 1 Data, 0x08 8.5.2.2.4 § Class 1 Data Without Confirm 8.5.3 Class 2 8.5.3.1 Desired Behavior 8.5.3.2 Test Procedure 8.5.3.2.1 Class 2 Data, 0x06 8.5.3.2.2 Class 2 Data, 0x07 8.5.3.2.3 Class 2 Data, 0x08 8.5.3.2.4 § Class 2 Data Without Confirm 8.5.4 Class 3 8.5.4.1 Desired Behavior 8.5.4.2 Test Procedure 8.5.4.2.1 Class 3 Data, 0x06 8.5.4.2.2 Class 3 Data, 0x07 8.5.4.2.3 Class 3 Data, 0x08 8.5.4.2.4 § Class 3 Data Without Confirm 8.5.5 Multiple Object Request 8.5.5.1 Desired Behavior 8.5.5.2 Test Procedure 8.5.5.2.1 Multiple Object Request, Class 1, 2, and 3 8.5.5.2.2 Multiple Object Request, Class 1, 2, 3, and 0 8.5.6 Class Assignment Verification 8.5.6.1 Desired Behavior 8.5.6.2 Test Procedure 8.6 Indications 8.6.1 Restart 8.6.1.1 Desired Behavior 8.6.1.2 Test Procedure 8.6.2 Bad Function 8.6.2.1 Desired Behavior 8.6.2.2 Test Procedure DNP3-2003 IED Certification Procedure Subset Level 2 27 27 27 27 27 27 28 28 28 28 28 28 28 28 28 29 29 30 30 30 31 31 31 31 32 32 33 33 33 33 33 34 34 35 35 35 35 35 36 36 37 37 37 37 37 37 37 38 38 38 38 38 39 39 39 Page v Rev 2.3 – 29-Sept-03 Object Unknown 8.6.3 8.6.3.1 Desired Behavior 8.6.3.2 Test Procedure 8.6.4 Local 8.6.4.1 Desired Behavior 8.6.4.2 Test Procedure for Devices with Global Remote Supervisory Control 8.6.4.3 Test Procedure for Devices with Individual Remote Supervisory Control 8.6.5 Broadcast Address and All Stations Indication 8.6.5.1 Desired Behavior 8.6.5.2 § Test Procedure 8.6.5.3 Test Procedure 8.6.5.4 § Test Procedure, Confirmed Response Options 8.6.6 Buffer Overflow 8.6.6.1 Desired Behavior 8.6.6.2 Test Procedure 8.6.6.2.1 Buffer Overflow, Binary Input Change Event Buffers 8.6.6.2.2 Buffer Overflow, Analog Input Change Event Buffers 8.6.6.2.3 Buffer Overflow, Binary Counter Change Event Buffers 8.7 Time 8.7.1 Delay Measurement 8.7.1.1 Desired Behavior 8.7.1.2 Test Procedure 8.7.2 Synchronization 8.7.2.1 Desired Behavior 8.7.2.2 Test Procedure 8.8 Cold Restart 8.8.1 Desired Behavior 8.8.2 Test Procedure 8.9 Application Layer Fragmentation 8.9.1 Use of FIR, FIN and SEQUENCE in Fragmentation 8.9.1.1 Desired Behavior 8.9.1.2 Test Procedure 8.9.2 § Use of Confirmation in Fragmentation 8.9.2.1 § Desired Behavior 8.9.2.2 § Test Procedure 8.10 Multi-Drop Support 8.10.1 Desired Behavior 8.10.2 Test Procedure 8.11 Unsolicited Responses 8.11.1 Desired Behavior 8.11.1.1 Configuration 8.11.1.2 Sequence Numbers and Confirmation 8.11.1.3 Restart Behavior 8.11.1.4 Runtime Behavior 8.11.1.5 Unsolicited and Polled Responses 8.11.2 Test Procedure 8.11.2.1 Unsolicited Response Configuration/Startup 8.11.2.2 Unsolicited Response - Class 1 Data 8.11.2.3 Unsolicited Response - Class 2 Data 8.11.2.4 Unsolicited Response - Class 3 Data 8.11.2.5 Unsolicited and Polled Responses 8.11.2.5.1 Transmits data-filled unsolicited responses 8.11.2.5.2 Clears transmitted data upon confirmation 8.11.2.5.3 Processes non-READ requests immediately 8.11.2.5.4 Defers READ requests until after confirmation received DNP3-2003 IED Certification Procedure Subset Level 2 39 39 39 39 39 39 39 40 40 40 40 41 41 41 41 41 41 42 42 42 42 42 43 43 43 43 43 43 44 44 44 44 44 44 45 45 45 45 46 46 46 46 46 47 47 47 47 48 49 49 50 50 50 50 51 Page vi Rev 2.3 – 29-Sept-03 Defers READ requests until after confirmation timeout 8.11.2.5.5 8.11.2.5.6 Abandons READ requests upon subsequent non-READ requests 8.11.2.5.7 Abandons READ requests upon subsequent READ requests 8.11.2.5.8 Inhibits Unsolicited responses until after polled confirmation 8.11.2.5.9 Retries unsolicited responses configurable number of times 8.11.2.6 Unsolicited Responses Off 8.12 § Collision Avoidance 8.12.1 Desired Behavior 8.12.2 Test Procedure 8.13 Binary Inputs 8.13.1 Desired Behavior 8.13.2 Test Procedure 8.13.2.1 Device does not have Binary Inputs 8.13.2.2 Device has Binary Inputs 8.13.2.3 Device supports Binary Inputs, Configurable Device 8.14 Binary Input Change 8.14.1 Desired Behavior 8.14.2 Test Procedure 8.14.2.1 Device does not support Binary Input Changes 8.14.2.2 Binary Input Change, 0x06 8.14.2.3 Binary Input Change, 0x07 8.14.2.4 Binary Input Change, 0x08 8.14.2.5 § Binary Input Change Without Confirm 8.14.2.6 Binary Input Change Without Time, 0x06 8.14.2.7 Binary Input Change Without Time, 0x07 8.14.2.8 Binary Input Change Without Time, 0x08 8.14.2.9 Binary Input Change With Time, 0x06 8.14.2.10 Binary Input Change With Time, 0x07 8.14.2.11 Binary Input Change With Time, 0x08 8.14.2.12 Binary Input Change With Relative Time, 0x06 8.14.2.13 Binary Input Change With Relative Time, 0x07 8.14.2.14 Binary Input Change With Relative Time, 0x08 8.14.2.15 Binary Input Change with Relative Time, Long Interval 8.15 Common Time of Occurrence 8.15.1 Desired Behavior 8.15.2 Test Procedure 8.16 Binary Counters 8.16.1 Binary Counters, Running 8.16.1.1 Desired Behavior 8.16.1.2 Test Procedure 8.16.1.2.1 Device does not have Binary Counters 8.16.1.2.2 Device responds with Binary Counters 8.16.1.2.3 Device supports Binary Counters, Configurable Device 8.16.2 Binary Counters, Frozen 8.16.2.1 Desired Behavior 8.16.2.2 Test Procedure 8.16.2.2.1 Device does not have Frozen Counters. 8.16.2.2.2 Binary Counter, Freeze 8.16.2.2.3 Binary Counter, Freeze And Clear 8.16.2.2.4 Binary Counter, Freeze, No Acknowledge 8.16.2.2.5 Binary Counter, Freeze And Clear, No Acknowledge 8.17 Binary Counters, Event 8.17.1 Desired Behavior 8.17.2 Test Procedure 8.17.2.1 Device does not support Binary Counter Events DNP3-2003 IED Certification Procedure Subset Level 2 51 51 51 52 52 53 53 54 54 55 55 55 55 55 55 55 56 56 56 56 56 57 57 57 58 58 58 59 59 59 60 60 61 61 61 62 63 63 63 63 63 64 64 64 64 64 64 65 65 65 66 66 66 66 66 Page vii Rev 2.3 – 29-Sept-03 8.17.2.2 Binary Counters, Event, 0x06 8.17.2.3 Binary Counters, Event, 0x07 8.17.2.4 Binary Counters, Event, 0x08 8.17.2.5 § Binary Counters, Event Without Confirm 8.18 Analog Input 8.18.1 Desired Behavior 8.18.2 Test Procedure 8.18.2.1 Device does not have Analog Inputs 8.18.2.2 Device has Analog Inputs 8.19 Analog Change Event 8.19.1 Desired Behavior 8.19.2 Test Procedure 8.19.2.1 Analog Input Change 8.19.2.2 § Analog Input Change, Without Confirm 8.20 Multiple Read Requests 8.20.1 Desired Behavior 8.20.2 Test Procedure 9 Appendix A – DNP3 Reference Sheets 66 67 67 67 68 68 68 68 68 68 69 69 69 69 70 70 70 71 DNP3-2003 IED Certification Procedure Subset Level 2 Page viii Rev 2.3 – 29-Sept-03 1 Overview It is the purpose of this document to describe a set of tests that will determine an Intelligent Electronic Devices’ (IED) compliance with the Distributed Network Protocol (formly known as DNP V3.00). This certification procedure is designed specifically to determine an IED’s compliance to Level 2 of the Subset Definitions. A device must pass all of the tests to be considered compliant to this procedure. 1.1 Protocol specification The protocol is defined by the Basic 4 Document set (Link Layer, Transport Layer, Application Layer, and Subset Definitions), Technical Notes published by the Technical Committee, and this Certification Procedure. The protocol defined by these documents shall be denoted DNP3-2003. Sections in this document marked with the symbol "§" constitute new requirements or clarifications beyond the Basic 4 Document set. These sections may create interoperability problems with implementations done prior to the publication of this test procedure. However, the DNP Users' Group approved these changes at the annual 1999 meeting based on strong recommendation from the Technical Committee. These requirements and clarifications will greatly improve interoperability and extensive efforts have been made to minimize the impact on existing implementations. 2 Notes 1. This procedure is an attempt to produce interoperability between Master and IED devices, although such interoperability can NOT be guaranteed. However, it does gives reasonable assurance that Masters which can be configured to match items in the IED Device Profile Document will interoperate. Wherever the following procedures generate a specific number of events, it is acceptable to use an alternate number supported by the device provided that the intent of the test is still satisfied. This is not a factory acceptance test, but a protocol test. Therefore only selected outputs will be tested to verify protocol operation. Unless otherwise specified, all Application Layer retries are disabled. If not explicitly stated all tests imply verification that all points in a normal operating state are reported with all flag bits except the ONLINE bit clear and the ONLINE bit is set. Alternatively, verification that the object is reported with the “without flags” variation is also implied. Sections marked with three asterisks (***) extend the requirements of the device beyond DNP3-2000. Record the point numbers used in all tests in the log. All application layer tests use unconfirmed link services using a request link control block of 0xC4 unless specified otherwise. When time tagged events are reported the certification procedures do not measure the absolute accuracy of the reported times. They do however verify that the reported times are updated in a reasonable manner. The Device Profile Document specifies the accuracy with which the device measures the event. This accuracy is guaranteed by the vendor, not the certification procedures. 2. 3. 4. 5. 6. 7. 8. 9. 10. If not explicitly stated all tests imply verification that a response to a request has the same application sequence number as the request. If the request generates multiple application fragments also verify that the application sequence number of each subsequent fragment increments by 1 modulo 16. 11. These tests assume that the device will only generate events as controlled by the tester, as specified in the procedure. DNP3-2003 IED Certification Procedure Subset Level 2 Page 1 Rev 2.3 – 29-Sept-03 In addition. appropriate protocol error response.3 – 29-Sept-03 . This is not a requirement for compliance to this procedure. It is strongly recommended that the tester run the device for a least 24 hours at some point during the testing to insure that it does not exhibit any unusual or unexpected behavior. must result in either the specific action or behavior described in the protocol or in a correctly-formed. devices must continue to operate without interruption or anomalous behavior in response to properly or improperly formed requests. 13. DNP3-2003 IED Certification Procedure Subset Level 2 Page 2 Rev 2. Responses to all properly formed requests.12. y=bit number where 0=least significant bit. Generally means that the function code (octet 2 of the request header) cannot be processed.1. IIN1-1 IIN1-2 IIN1-3 IIN1-4 IIN1-5 IIN1-7 IIN2-0 IIN2-1 IIN2-2 3. Generally means that the function code could be processed but the object group / variation could not be processed. change in an LED status. Request Any message from a Master to a Slave where a response from the Slave is expected. The following is a summary of the definitions. or change in the internal state of the Slave.128.6 and the Subset Definitions section 4. The inability to observe an operation does not mean that an operation failed to take place. Note that some operations are difficult to observe without intimate knowledge of the Slave device. Class 2 event data available. Object Unknown. Responses are classified as follows: • No response: No octets are sent by Slave • Link only response: 10 octet message consisting of only a link layer message • Null Response: Message containing a 17-octet link/transport/application response with no error IIN bits set and no application objects. Can be set at any time and does not indicate an error condition. Set if some points are uncontrollable via DNP. DNP3-2003 IED Certification Procedure Subset Level 2 Page 3 Rev 2. IIN2-0 or IIN2-1 or IIN2-2). Set only under specific conditions. Can be set at any time and does not indicate an error condition.2 IIN Internal Indications Octets 3 and 4 of the application response header. Refer to the Basic Four Application Layer section 3. Operate This is an action taken by the Slave in response to a Master DNP request.3 – 29-Sept-03 .3 Definitions 3. This action does not include transmission of a response. x=1 for first transmitted octet and 2 for second transmitted octet. Can be set at any time and does not indicate an error condition. Device that sends DNP application function code 0.. Does not indicate an error condition. Class 3 event data available.3 Error Responses Error IIN bits IIN bits that indicate a request error (i. Examples of an operation are an audible relay click. and has no objects which indicate errors • All responses must begin with the same application sequence number as the corresponding request. Local mode.1 Master Slave General Device that sends DNP application function codes 0-23. Error Response A response that has any or all of the Error IIN bits set which may also contain data. Function Unknown. Parameter Error. Can be set at any time and does not indicate an error condition. Class 1 event data available. Device restart. • For Multi-fragment responses the first fragment must have the same sequence number as the request and each subsequent fragment must increment the sequence number by 1 modulo 16.129 (also known as “IED”). Bits are named IINx-y. 3. Generally indicates that both the function code and object group / variation could be processed but that the qualifier / range field is in error.e.1 for detailed explanations of the IIN bits. • Normal Response: Message containing an application response which has no error IIN bits set. Time synchronization required. Response Message from Slave caused by a Master Request. 1. 3. are explicitly forbidden. The determination that a point has undergone a significant change can be determined only by using information from that point’s current or past value. Change Objects and Static Objects are related in that a significant change in a point’s static value results in the creation of a corresponding Change Object entry A significant change for a point is defined to occur: • for a binary point. 1. Decisions based on information about any other point. All changes must be returned to a host that issues a request for any specific Change Object. 2. directly or indirectly.4. on any change in state. such devices may not check compliance with the corresponding Change Object in their Device Profile Documentation unless the device is configurable to conform to the rules above. limited only by qualifier and range codes in the request. the Device Profile must clearly specify the algorithm used for each point or set of points that specifies how the deadband(s) for those points are determined. While these implementations may be useful in specific instances. Some devices may decide to limit the set of points included in Change Object processing (in violation of rule 1). DNP3-2003 IED Certification Procedure Subset Level 2 Page 4 Rev 2. The term “significant change” refers to any of the synonymous terms: “event” or “change event”.4 Changes or Events Change Object Name Binary Input Change Counter Change Events Frozen Counter Change Events Analog Change Events Frozen Analog Change Events Object 2 22 23 32 33 Table 3-1 Corresponding Static Object Name Binary Input Counter Frozen Counter Analog Input Frozen Analog Input Object 1 20 21 30 31 This section clarifies processing rules related to the following objects. 3.3 – 29-Sept-03 . 4. Change processing must be supported for all points in the corresponding Static Object. or to invoke a more complicated algorithm for determining a significant change (in violation of rule 2). 2. For numeric Change Objects. 3. on any change in value greater than the point’s threshold 3. and • for a numeric point.1 § Rules A device may claim that it supports a specific Change Object if and only if processing for that Change Object can be configured to adhere to the following rules.Unexpected Error Response Slaves may generate responses with any or all of the following: • unexpected bits in the IIN set • unexpected bits in any returned flags set • unexpected status code errors Any unexpected responses must be noted by the tester and “explained” in the test log. • If it is not readily apparent whether an output point has operated.1 Device Profile Review Before connecting any equipment the Device Profile should be carefully reviewed.00) 5 Pretest Review Before testing proceeds it is necessary to review documentation and equipment supplied by the vendor for completeness and appropriateness to the application. IEEE 802.3 – 29-Sept-03 . This behavior should be compared to Level 2 requirements and any discrepancies resolved before testing proceeds.00 Application Layer DNP Version 3.00 (§ Version 3.3) • Input connections 5.4 Reference Documents • • • • • DNP Version 3. • Wiring diagrams and equipment necessary for Input stimulation. RS232. The required Master Level must be noted in the test results. Bell 202. A manufacturer’s representative should be available by phone to answer questions during the testing of the device. It must be noted in the test results that the device is Level 2 compliant for requests only. If a device generates any response requiring a higher level master to parse it.00 Transport Functions DNP Version 3. • Device Profile Document • Device to be tested • Wiring Diagrams for • Power • Communications (e. • Input power specifications.00 Subset Definitions Version 2.2 Equipment Review Before testing proceeds.00 Data Link Layer DNP Version 3.00 Data Object Library Layer DNP Version 3. 5.g. This document describes the vendors’ specification of the behavior of the device. Specifically the Device Profile should indicate that the device: • • Responds to all Level 2 requests that a slave device is required to parse. DNP3-2003 IED Certification Procedure Subset Level 2 Page 5 Rev 2. RS485. the device will be examined to insure the proper equipment is available for the following: • Physical interfaces present and compatible. In particular the vendor must have provided the test facility with the following items. the vendor must supply to the tester a point number and method to determine whether or not a binary control and/or analog output has operated. the following actions should be taken: • • • Testing can continue. Responds to Level 2 requests only with Objects/Variations and Qualifiers that a Level 2 master is required to parse. 11.1. 23. Issue a link reset using link control block 0xC0. Configure the DUT to request data link confirm when transmitting. 3. DUT must not respond to application layer data requests using confirmed link services without a preceding link reset. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. Specifically. 7. Verify that the DUT responds with a link layer confirm (link control block 0x00) and no application response. 5. If the DUT cannot be configured to request data link confirms when transmitting. DUT must acknowledge but not otherwise respond to requests with the wrong FCB. DUT must respond to application layer data requests using confirmed link services after a link reset has been issued. 16. Verify that the DUT either sends a NACK with the DFC bit clear or does not respond.1 • • • • • • Reset Link and Passive Confirm support 6. 17. 25. 4.3 – 29-Sept-03 . Perform repeated requests of Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and alternating link control blocks 0xD3 and 0xF3. 12. Verify that the DUT responds with a link layer confirm (link control block 0x00). For example: • A device can choose not to request link layer confirms but MUST respond with a link layer confirm if requested to do so. 10.1 Desired Behavior The Device under test (DUT) must respond to a link reset with a link confirm. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. Send a data link acknowledge (control block 0x80). 26.6 Link Layer Any DNP device is required to passively implement all link layer services. Verify that the DUT responds by sending a data link reset (control block 0x40). Verify that the DUT either sends a NACK with the DFC bit clear or does not respond.1. 8. 21. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. 4. Verify that the DUT responds with a link layer confirm (link control block 0x00) and no application response. Issue a link reset using link control block 0xC0. 14. 19. 2. 9. • A device can choose not to request link layer reset if it is using unconfirmed link services but MUST respond with a link layer confirm if a link layer reset is requested. Cycle power to the DUT. The following tests are designed to verify this functionality.2 Test Procedure 1. Cycle power to the DUT. 6.e. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xD3. 6. DUT must issue a data link reset if transmitting requests that require a data link confirm. function codes 0. continue testing at section 6. Verify that the DUT responds with a link layer confirm (link control block 0x00). 13. Verify that the DUT responds with a valid message.2. 6. DNP3-2003 IED Certification Procedure Subset Level 2 Page 6 Rev 2. 27. Verify that the DUT responds with a link layer confirm and a valid application layer response. 22. 20. 24. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. Verify that the DUT responds with a link layer confirm and a valid application layer response for each request. this means that a device need not request link layer service but must support any services requested by another device. 15. DUT must respond to application layer data requests using unconfirmed link services without requiring a link reset. 18. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xD3. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. • § A device must respond to all unconfirmed link requests (i. 9) without a preceding link reset. Verify that the DUT responds with a link layer confirm and a valid application layer response. This behavior is not tested since it was deemed by the Technical Committee as too difficult to test in a reliable manner. Cycle power to the DUT.1 Desired Behavior The DUT must respond with a Link Confirm . the DUT must respond with the last secondary confirm frame. Request a Link Test Frame using link control block 0xD2. 9. Verify that the DUT responds with a Confirm . including a request for data link confirm.ACK (link control code 0x00). If the DUT receives a test link frame without a previous link reset. 5. the DUT must either not respond or respond with a NACK with DFC = 0. Request a Link Status Frame using link control block 0xE9. 5. This is the response to the Class 0 data request. 11. Verify that the DUT responds with a Confirm .ACK (link control code 0x00). DNP3-2003 IED Certification Procedure Subset Level 2 Page 7 Rev 2. 14. DUT responses other than those of steps 26 and 28 indicate incorrect operation. Request a Link Test Frame using link control block 0xF2. 30.3.ACK (link control code 0x00).2. 31.3. Cycle power to the DUT. 10. 7.3 • • Request Link Status 6. The DUT must ignore FCB when FCV = 0.28. If the DUT then repeats the Class 0 response message (control block 0x73). 6.2. Issue a Link Reset using link control block 0xC0. 12.ACK (link control code 0x00).1 Desired Behavior When issued a Request Link Status message. 8. Request a Link Test Frame using link control block 0xF2. respond by sending an acknowledge control block 0x80).2 Test Procedure 1. Verify that the DUT responds with a valid message having control block 0x73. 2. Request a Link Test Frame using link control block 0xD2. 6.NACK with DFC=0 (link control code 0x01) or does not respond. 6. Verify that the DUT responds with a Confirm . 15. 29. Request a Link Test Frame using link control block 0xD2. 3.NACK with DFC=0 (link control code 0x01) or does not respond.3 – 29-Sept-03 . Verify that the DUT responds with a Confirm . and this test is complete. 13. 4. steps 25 through 28 should be repeated as shown above. 3. Verify that the DUT responds with a valid link status message with link control block 0x0B or 0x1B. 16. Verify that the DUT responds with a valid link status message with link control block 0x0B or 0x1B. Otherwise. continue testing at section 6. 4.2 • • • Test Link 6. Verify that the DUT responds with a Confirm . Request a Link Test Frame using link control block 0xF2. Issue a Link Reset using link control block 0xC0. the DUT must respond with a valid Status of Link message. Verify that the DUT responds with a Confirm . 2. it has functioned correctly. If the DUT did not issue a link reset at step 30.2 Test Procedure 1. If the DUT then issues a data link reset (control block 0x40). Cycle power to the DUT. Issue a data link NACK with DFC clear (control block 0x81). 6.2. Request a Link Status Frame using link control block 0xC9.ACK if the FCB bits are correct in the test request. 6. 15. Verify that the DUT sends a RESET LINK frame. Verify that the DUT responds with a RESET LINK frame. or REQUEST LINK STATUS.1 Desired Behavior The DUT must clear (set to zero) the DIR bit in each data link frame it transmits. It shall do this n times where n is a specified number of retries before aborting transmission (LINK RETRYCOUNT). but do not respond in each case. 6. The DUT must set the FCV bit to zero in all frames except SEND/CONFIRM User Data and SEND/CONFIRM Test Link. Verify that it repeats this exactly LINK RETRYCOUNT times. 6. Repeat steps 11 and 12 for each of these frames that can be generated. 12. the DUT must perform retries on all SEND/CONFIRM and REQUEST/RESPOND frames.2 Test Procedure 1. 5. Verify that the DUT responds with a RESET LINK frame. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. Repeat steps 18 and 19 for each of these frames that can be generated. These frames are tested elsewhere. 7. 4. Verify that no further retries are sent. Verify that the DUT sends a valid application layer response in a SEND/CONFIRM USER DATA frame. § The DUT must be able to disable retries through configuration. 18. 6. Do not send a data link CONFIRM frame.6.2 Test Procedure 1. RESET USER PROCESS. or REQUEST LINK STATUS. If it is possible to cause the DUT to send TEST LINK.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 .5. The rest of these behaviors apply only to DUTs that support link layer retries. Do not send a data link CONFIRM frame. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. Send a data link CONFIRM.5 • • § DIR and FCV Bits 6. Configure the device to enable link layer confirms on primary transmissions and if retries are configurable. 13. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. but do not respond in each case.4. 8. cause it to do so. 6. Verify that the DUT sends a valid application layer response in a SEND/CONFIRM USER DATA frame. 9. If it is possible to cause the DUT to send TEST LINK. Send a data link CONFIRM. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Both LINK TIMEOUT and LINK RETRYCOUNT must be specified in the Device Profile Document or they can optionally be configurable parameters. If configured to enable link layer confirms on primary transmissions. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. 10. If the device requests a link layer confirm and does not receive it within a specified period of time (LINK TIMEOUT). Verify that it repeats this exactly LINK RETRYCOUNT times. 16. 14. Do not send a data link CONFIRM frame.1 Desired Behavior DUTs are not required to support link layer retries. 2.5. Send a data link CONFIRM.4. Page 8 Rev 2. Cycle power to the DUT. If the DUT does not support link layer confirms or link layer retries on primary transmissions. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. 11. If the DUT is capable of requesting data link confirmations. RESET USER PROCESS. 19. configure it to NOT request data link confirmations. 20. continue testing in the next section. cause it to do so. 3. 17. set them to a reasonable value. it shall retransmit the link frame.4 • • • • • • Test Retries 6. 6. either at a data link layer or application layer.2.6. 13. Issue a link reset using link control block 0xC0. If the DUT can generate RESET USER PROCESS or REQUEST LINK STATUS. 8. i. If the DUT can generate TEST LINK. Verify that the DUT responds with a link layer confirm (link control block 0x00). 4.e. If the DUT is not capable of requesting data link confirmations.6. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xF3. the DUT may also respond with LINK SERVICE NOT IMPLEMENTED. Unconfirmed User Data with the DIR bit not set and the FCV bit not set. Verify the DUT sends a frame with data link control block 0x73 i. 12.2 Test Procedure – Primary Frames Before performing the remainder of these tests: 1. Cycle power to the DUT. Prepare and send a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xC4. • It is optional whether devices choose to filter frames based on source address. 2. It must therefore not respond. and is therefore not tested here. This is tested in section “DIR and FCV Bits”. Verify that the DUT responds with a link layer confirm (link control block 0x00). however. DNP3-2003 IED Certification Procedure Subset Level 2 Page 9 Rev 2. 10. 5. Cycle power to the DUT. To perform the remainder of this test. SEND/CONFIRM USER DATA with FCV=1 and FCB = 1. If the DUT is capable of requesting data link confirmations. 6. 3. configure it to do so. Implementers of Slave IEDs must. Configure DUT to NOT request data link confirmations. Verify the DUT first sends a frame with data link control block 0x40. The Device Profile Document indicates whether or not filtering is performed based on the source address. If a DNP-specific protocol analyzer is being used for testing. RESET LINK with DIR=0 and FCV=0. NOTES: • These procedures do not test whether the DUT rejects frames having the DIR bit set incorrectly. it should be used to monitor the exchange between the general-purpose analyzer and the DUT. cause it to do so and verify that these frames have the DIR bit clear and FCV bit set.6 Data Link Rejects Invalid Frames 6. Reply with a data link CONFIRM . 6.3 – 29-Sept-03 . cause it to do so and verify none of these frames have the DIR or FCV bit set.1 Desired Behavior The DUT must detect errors due to transmission line errors or the incorrect functioning of other devices. 9.e. 4. Prepare and send a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xC4. 3. 5. 6. clear this bit (0) in all their transmissions to aid monitoring their device’s output on protocol analyzers.e. Cycle power to the DUT. 11. 7.ACK. Verify that the DUT responds with application layer data. no further testing is required in this section. Verify the response from the DUT uses data link control block 0x44 i. a general-purpose protocol analyzer capable of generating any sequence of data is necessary. to frames that are otherwise valid but have one of the following errors: • Incorrect start sequence • Incorrect destination address • Incorrect CRC • Invalid function code • Invalid FCV (Frame Count Valid) bit For an invalid function code or invalid FCV. g. Wait several seconds. Modify the frame so it begins with an invalid initial start octet (e. 6. 6. Wait several seconds.6. 7. Wait several seconds. 6.2. Modify the frame so the CRC of the data link layer header is correct but the CRC of the application layer request is incorrect.3 – 29-Sept-03 . Send the request. ensure that the selected address is not one of the other valid addresses configured for the device.2. 0xD5. Wait several seconds.6.g. Alter the CRC of the data link layer header so the CRC is correct for the invalid control field.6. Modify the CRC of the data link layer header so the CRC is correct for the invalid start octet. Repeat this test once with different incorrect CRC values.2 Invalid Primary Function Code 1. 7. 11. Verify that the DUT does not send a link layer confirm or application layer response. Repeat this test once with a different invalid function code. 5. Modify the frame so the control field contains the correct settings of the DIR. 4. 2. Modify the CRC of the data link layer header so the CRC is correct for the invalid start octet. Wait several seconds. Verify that the DUT does not send a link layer confirm or application layer response.g. Wait several seconds. 6. 0x09) instead of 0x05. Send a READ request to different address.2. 2. 12.4 Invalid CRC Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xD3. 7. Send the request. Verify that the DUT does not send a link layer confirm or application layer response. 4. can respond to requests directed to more than one address). 2. Verify that the DUT either does not send a link layer confirm. 8. 5. Modify the frame so it begins with 0x05. 3. Repeat this test once using different start octet values.2. Send the request.6. 10. 9. 2.e.3 Invalid Destination Address 1. FCB and FCV fields. Verify that the DUT does not send a link layer confirm or application layer response. 9. DNP3-2003 IED Certification Procedure Subset Level 2 Page 10 Rev 2. but has an invalid function code. PRM.6. 6. 6. Repeat this test once with a different destination address. but the second start octet is invalid (e. 10. Send the request. Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block of 0xD3. 1. Modify the frame so the CRC of the data link layer header is incorrect. 4. Send the request. 8. Verify that the DUT does not send a link layer confirm or application layer response. 0xff). Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xD3. 4. 3.1 Invalid Start Octets 1. Note: For devices that can be configured to represent multiple logical devices (i. Verify that the DUT does not send an application layer response. 3. or responds with a valid LINK SERVICE NOT IMPLEMENTED frame (control field 0x0F). e. 3. 5. 2. requesting data link confirmation. The retries are used to detect whether the device processed the data link layer confirmation.5 § Invalid FCV 1. 0x09). Send a CONFIRM – ACK frame modified so the start octet is correct (0x05). Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xC3. 5. Before performing these tests: 1.2. Send a data link CONFIRM – ACK frame in reply.6.6.3 – 29-Sept-03 . 4. 3. Verify the DUT responds with application layer data. 6. Wait several seconds. Verify that the DUT does not send a link layer confirm or application layer response. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. Verify the DUT responds with application layer data. i. Verify that the DUT does not send a link layer confirm or application layer response.3 Test Procedure – Secondary Frames The tests in this section are optional. Repeat steps 5-8 using the control blocks in the following table: Code C2 D0 D9 Description Test Link RESET LINK Link Status Request Notes FCV = 0 incorrect FCV=1 incorrect.g. but the second octet is incorrect (e. 3. requesting data link confirmation.g. Send a valid CONFIRM – ACK frame in reply. Prepare a READ request for Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and a link control block 0xD4. the DUT sends a RESET LINK frame. Repeat this test once with different start octet values. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame.6. Send a CONFIRM – ACK frame modified so its start octet is invalid (e. a general-purpose protocol analyzer capable of generating any sequence of data is necessary. i. Cycle power to the DUT. SEND/NO CONFIRM USER DATA. but with FCV=0 (incorrect). 0xff). and must pass only if the DUT requests data link confirmations and performs retries. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. FCB = 0 ignored 6. Verify that before responding with application layer data. 9. 2.6. Configure the device to enable link layer confirms on primary transmissions and if retries are configurable set them to a reasonable value. 4. 3. Send the request.1 Invalid Start Octets 1. but with FCV=1 (incorrect). 9. 8. 2. 5. 6. To perform the remainder of this test. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. it should be used to monitor the exchange between the general-purpose analyzer and the DUT.e. FCB = 0 ignored FCV=1 incorrect. 6. 7. 5. Wait several seconds. 6.e. 8.3. DNP3-2003 IED Certification Procedure Subset Level 2 Page 11 Rev 2. If a DNP-specific protocol analyzer is being used for testing. SEND/CONFIRM USER DATA. 4. The DUT may respond with a link layer frame with function code LINK SERVICE NOT IMPLEMENTED. 7. Send the request. Verify the DUT responds with application layer data. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. The DUT may respond with a link layer frame with function code LINK SERVICE NOT IMPLEMENTED. requesting data link confirmation. Send a CONFIRM – ACK frame to a destination address that is not that of the DUT. Send a CONFIRM – ACK frame modified such that the CRC is incorrect. 6. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Repeat this test once with a different destination address. 4. PRM and DFC bits of the control field are correct.g.4 Invalid CRC 1. requesting data link confirmation.6.6. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Verify the DUT responds with application layer data. 5.3.2 Invalid Secondary Function Code 1. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame.3 – 29-Sept-03 . 6. 5.6. 5. Repeat this test once with a different CRC value. DNP3-2003 IED Certification Procedure Subset Level 2 Page 12 Rev 2. 4. 2. 0x83). 6. This test may be performed with a DNP-specific test set. 2. 4. requesting data link confirmation.3. 3. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06 and link control block 0xC4. Repeat this test once with a different function code value.3. Verify the DUT responds with application layer data.6.3 Invalid Destination Address 1. requesting data link confirmation. but the function code is invalid (e. Verify that the DUT waits LINK TIMEOUT and then retransmits the link frame. Ensure that the CRC is correct for the invalid function code value. 2. Verify the DUT responds with application layer data. 3. Send a CONFIRM – ACK frame modified so the DIR. 3. d) Signify to the initiating station that the reply contains multiple LPDU’s e) Provide the appropriate information for assembly at the receiving station. FIN and sequence numbers are referenced in this section they refer to the definitions present in the transport header which is reproduced here for convenience. If the DUT’s reply contains less than 250 octets in the Data Link Frame then the FIR bit is set to one and the FIN bit is also set to one.1 • Desired Behavior • If the DUT contains enough data to cause the reply to an application request to be larger than one Link Protocol Data Unit. and the SEQ value increments by one. signifying the last data fragment. c) Distribute the data correctly. the FIN bit is zero. it is required to. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06. 4. If the device does not contain enough data. 7. a) Set the proper FIR and FIN bits. Verify subsequent messages to assure that the FIR bit is zero. DNP3-2003 IED Certification Procedure Subset Level 2 Page 13 Rev 2. 5. 6. Verify that the DUT responds with a valid message. bit 7 FIN Transport Header bit 6 bits 5-0 FIR Sequence number Table 7-1 7. 2. 3.7 Transport Layer Whenever FIR. Test Procedure Cycle power to the DUT.2 1. the FIN bit is set to zero. 7. and the sequence number increments by one.3 – 29-Sept-03 . Verify that the last message has the FIR bit is zero and the FIN bit is one. b) Set the correct sequence information. then the FIR and FIN bits must signify that there is only one LPDU in the reply. If the DUT’s reply contains more than 249 octets then verify that the first response message sets the FIR bit to a one. 1 Desired Behavior • • • If the device supports binary outputs the device must respond to a Binary Output read request with a binary output status object (object 10 Variation 2) using qualifiers 0x00 or 0x01. it is required to be configurable to support all three modes of operation of control. If the DUT is configurable in a manner such that points can be uninstalled or disabled.0. Verify that the data is reported using either 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01). 2.0=normal. the device can return an error response with IIN2-1. and Direct Operate No Acknowledgment.1. 1=forced LOCAL FORCED DATA . The status is an 8-bit flag field (repeated here for your convenience): Flag Bit 0 1 2 3 4 5 6 7 Value ONLINE . 8. 1= restart COMMUNICATION LOST . 5. A device may be configurable to disable any subset of the modes. 1=lost REMOTE FORCED DATA . If the device does not support Binary Outputs verify that the DUT responds with a Null Response. 1 Table 8-1 8. the device must be configured with at least one Binary Output point installed or enabled before proceeding with the test procedure. If the device does not support binary outputs the device must respond to a Binary Output read request with a Null Response. Direct Operate.1.0=off-line. It is the outstations’ responsibility to perform the control operation if a correct control dialog has been issued from the host. If a device has been configured to reject a particular mode. It is the hosts’ responsibility to determine the appropriate control mechanism.0=normal.8 Application Layer 8. 8.2 Test Procedure 1. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06.2 Binary Outputs § If a device supports control outputs.0=normal. namely Select Before Operate.1 Binary Output Status The binary output status object represents the current state and status of the associated binary output. 1= on-line RESTART . Optionally. 3. 1=forced 0 0 STATE . Note #5. Verify that flag behavior complies with Section 2. DNP3-2003 IED Certification Procedure Subset Level 2 Page 14 Rev 2. 4.3 – 29-Sept-03 .0=normal. It is also the hosts’ responsibility to perform select before operate control when it is unacceptable to have the control point operated more than once. it must return a control status value of 4 (control operation not supported for this point). This is typically a configuration item in the host and is the responsibility of the end user to configure properly. If the device supports Binary Outputs verify that the DUT responds with a Binary Output Status object (Object 10 Variation 2). The device can optionally set IIN2-1. The DUT must echo the operate command but must not operate the control more than once. In this case the select-to-operate timer must be restarted after reception of each select. • The DUT responds to selecting an uninstalled control point by returning an error response with IIN2-2 set and a status code of 4. • The DUT responds to executing an installed control point after the configured acceptable select to execute delay by echoing the execute and setting the status field to 1 [Execute received after timeout]. • The DUT must accept retries on the operate portion of the control dialog that does not increment the application sequence number between retries. The following assumes that the device supports control operations and were added as a result of Technical Bulletin TB2000002 (Control Retries): • The DUT must accept retries on the select portion of the control dialog that increment the application sequence number between retries. In this case the select-to-operate timer must remain unaltered by the reception of each additional select. 8.1 Select Before Operate Select before operate control is used under circumstances when it is absolutely imperative that the control point operate only once.1 Desired Behavior The following assumes that the device does not support control operations: • If the device does not support control outputs. An example of this is a recloser. it must respond to a select with an Error Response setting IIN2-1 or IIN2-2. it must respond to a select with an Error Response setting IIN2-1. The following assumes that the device does support control operations.2. The following assumes that the device supports control operations: • The maximum select to execute delay time must be specified in the Device Profile Document. variation. The object. The host then sends the execute portion of the dialog. excluding the application header.1. variation. but that the object. • The DUT supports 8 and 16 bit point indexing.2. The control point does not operate • The DUT responds to a non-matching execute with a status field of 2 [No previous matching select] and does not operate the control under the following conditions: • No prior select issued • On time mismatch • Off time mismatch • Control code mismatch • The DUT operates various selected control points. The specified control operates. The control point does not operate. however there are no control points installed/enabled: • If the device does not have any control outputs installed. • An Error Response with IIN2-2 set is an invalid response.3 – 29-Sept-03 . • The DUT must accept retries on the select portion of the control dialog that do not increment the application sequence number between retries. DNP3-2003 IED Certification Procedure Subset Level 2 Page 15 Rev 2. Note that the encapsulation information need not match. The outstation then echoes the exact control request byte for byte to the host. – match the object portion of the select message byte for byte. The host first initiates the select portion of the dialog. • The DUT responds to matching select and execute requests by echoing each request with the status field set to 0.8. • No further testing in this section is necessary. and all object data must match exactly. qualifier. If this message matches the select message byte for byte and it is received within the configured acceptable delay between select and execute the outstation must operate the control point. and all object data must match exactly byte for byte the data sent in the select message. qualifier. • The DUT must reject any operate that does not: – contain a application layer sequence number that is exactly one greater (modulo 16) than the previously accepted select. SBO. 2.1. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). Issue a matching execute and verify that the DUT echoes the execute with the control status field set to 1[Execute received after timeout]. To Uninstalled Point 1. 5. 8.3 Binary Output.8.1. 4. Verify that the DUT responds by echoing the select message exactly. Immediately issue a matching execute. Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4. Verify that the selected control operates. 5. Immediately issue an execute to Object 12 Variation 1 to a different installed point using 8 bit indexing (qualifier 0x17). Verify that the DUT responds by echoing the select message exactly. 8. Issue a select using Object 12 Variation 1 to an installed point using 16 bit indexing (qualifier 0x28). Verify that no control point operates. 5.2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . verify that the DUT responds by echoing the select message exactly.1 Binary Output.2. Verify that no control point operates.2. Immediately issue a execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 8.5 Binary Output. 4. 3. and the same on time/off time as the previous select. End testing of Binary Output SBO. 4. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. Wait 1 second past the configured maximum select to execute delay time. SBO. a control code supported by the device and an appropriate on time/off time. Issue a select to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). a control code supported by the device and an appropriate on time/off time.4 Binary Output. 0x17 1. Immediately issue a matching execute. verify that the DUT responds with a Error Response with IIN2-1 set. 5. Verify that the DUT responds by echoing the select message exactly. a control code supported by the device and an appropriate on time/off time.1. 0x28 1. Verify that the DUT responds by echoing the select message exactly.2. 3. Execute to Different Point Than Select 1. Execute On Time does not match Select On Time 1. a control code supported by the device and an appropriate on time/off time. 4. Execute Issued After Timeout 1.1. SBO.2. 6. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). Verify that the selected control operates.2. Verify that the DUT echoes the execute. Page 16 Rev 2. 3.2. 3. 3. Issue a select using Object 12 Variation 1 to an uninstalled point using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time.2. SBO. the on time incremented by 1 and the same off time as the previous select. the same control code as the select. SBO.1.6 Binary Output. 2.2.2 Test Procedure 8. the same control code as the select.1.1.2. Issue a select using Object 12 Variation 1 to a different installed point using 8 bit indexing (qualifier 0x17). Verify that no control point operates. 2.2 Binary Output.2.2. SBO. 8. 2. 5. If the device does not support control outputs. Verify that no control point operates. 2. 8. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. 3. Verify that the DUT echoes the execute. If the device does support control outputs. a control code supported by the device and an appropriate on time/off time.2. 2. 4. 2. 4. skip this section. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set. a control code supported by the device and the same on time/off time as the previous select.2. a control code supported by the device and an appropriate on time/off time.1.2.2. 2. Verify that no control point operates. 4.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Issue a valid select to an installed binary output point. Issue the select again incrementing the application layer sequence number by 1 modulo 16. Verify that no control point operates. If the device is not configurable in a manner such that control points can be uninstalled or disabled. 5. incrementing the sequence number by 1 modulo 16. Verify that the DUT echoes the object portion of the select byte for byte. same on time as the previous select and the off time incremented by 1. Configurable Device 1. Issue a select using Object 12 Variation 1 to an installed point using 16 bit indexing (qualifier 0x28). 4. Verify that the DUT operates the binary output. If the DUT does not have installed binary output points. Verify that the DUT echoes the object portion of the select byte for byte. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. Verify that the DUT echoes the object portion of the operate byte for byte. 2. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. 3. Issue a valid operate. 8.8 Binary Output.1.2. 6. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 5. Configure the DUT such that all Binary Output points are uninstalled or disabled.8. SBO. SBO. 4. Incrementing Sequence Number Select Retries 1.2. a control code supported by the device and an appropriate on time/off time. 5. Execute Off Time does not match Select Off Time 1.1. Immediately issue an execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 8. 8. the same control code as the select. Issue a select using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 2. If the DUT does not have installed binary output points.2. SBO. 5.1. Execute with different Code 1. Same Sequence Number Select Retries 1. Verify that the DUT responds by echoing the select message exactly. Issue the select again using the same application layer sequence number. 7. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select]. Issue a valid select to an installed binary output point. skip this section. incrementing the sequence number by 1 modulo 16. Verify that the DUT echoes the object portion of the select byte for byte. 4.7 Binary Output.1. 4. Select 0x28. Select with supported Code. skip this section.2. 2.1. 6. Issue a valid operate. Verify that no control point operates.2. 3. SBO. Verify that no control point operates.11 Binary Output.10 Binary Output. 3.2. SBO. 3.12 Binary Output. SBO. 3. 5. a control code supported by the device and an appropriate on time/off time. 2. Immediately issue an execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 3. Verify that the DUT responds by echoing the select message exactly. Verify that the DUT echoes the object portion of the select byte for byte. Issue a select using Object 12 Variation 1 to point 0 using 16 bit indexing (qualifier 0x28). Verify that the DUT responds by echoing the select message exactly. a control code supported by the device and an appropriate on time/off time.2.2. a control code different from the previous select. Immediately issue an execute to Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17). 8.2.9 Binary Output. 8. and the same on time/off time as the previous select. 5. Execute 0x17 1. 8. Page 17 Rev 2. Issue a valid operate. 7. 4. Verify that the DUT echoes the object portion of the select byte for byte. Issue a valid select to an installed binary output point. 8. 5.2. 6. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT).2. Issue the operate again. Issue a valid select to an installed binary output point. 3. If the DUT does not have installed binary output points. Verify that the DUT echoes the object portion of the select byte for byte. Verify that the DUT does not operate the binary output. Issue a valid select to an installed binary output point. 8.2 Direct Operate with Acknowledge 8. SBO. skip this section. 4. skip this section. • No further testing in this section is necessary. Issue a valid operate. 9. Verify that the DUT echoes the object portion of the operate byte for byte. DNP3-2003 IED Certification Procedure Subset Level 2 Page 18 Rev 2. Verify that the DUT echoes the object portion of the operate byte for byte. incrementing the sequence number by anything but 1 modulo 16. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). incrementing the sequence number by 1 modulo 16. 2. • An Error Response with IIN2-2 set is an invalid response. 9. SBO.1 Desired Behavior The following behavior assumes that the device does not support control operation: • If the device does not support control outputs.15 Binary Output. Same Sequence Number Operate Retries 1. The following behavior assumes that the device supports control operations: • The DUT responds to a direct operate to an uninstalled data point by returning an Error response with IIN2-2 set and a status code of 4.2.14 Binary Output. 7.1.2. 8. Verify that the DUT echoes the object portion of the select byte for byte. 7.2.13 Binary Output. incrementing the sequence number by 1 modulo 16. Verify that the DUT does not operate the binary output. If the DUT does not have installed binary output points. Verify that the DUT echoes the object portion of the operate byte for byte. incrementing the sequence number by 1 modulo 16. 5. 9. SBO. 3. Verify that the DUT operates the binary output. Issue the operate again using the same application layer sequence number. Verify that the DUT does not operate the binary output.1. 8. 8. Sequence number checking 1.7. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT).2. Verify that the DUT operates the binary output.2. skip this section.2.3 – 29-Sept-03 .2. 8. The control does not operate. 4. 6. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). 3. 8. 6. 8. Incrementing Sequence Number Operate Retries 1. Verify that the DUT operates the binary output.1. 5. 2. incrementing the select sequence number by 1 modulo 16 to make sure the mismatched operate cleared the previous select. 2. it must respond to a direct operate with an Error Response setting IIN2-1. Verify that the DUT does not operate the binary output. Issue a valid operate. If the DUT does not have installed binary output points. Issue a valid operate. Verify that the DUT responds by returning an Error response with IIN2-2 set and a status code of 4.2. 4. Direct Operate. 4. 4. a control code supported by the device and an appropriate on time/off time.2. end testing of Binary Output.2. a control code supported by the device and an appropriate on time/off time. Configurable Device If the device is not configurable in a manner such that control points can be uninstalled or disabled.3.3 1. 2.2. Direct Operate 1. The following behavior assumes that the device does support control operations.3.2.2.2. Direct Operate. 8. 5. Verify that the specified control operates. 3.2.2. Issue a Direct Operate.1 Desired Behavior • • The DUT must not respond to in any way to the direct operate no acknowledge. Issue a direct operate using Object 12 Variation 1 to an uninstalled point using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. 8. The specified control operates. 8. Verify that the DUT does not respond. Verify that no control operates. If the device does support control outputs.3 Direct Operate. No Acknowledge 8. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set. it must respond to a direct operate with an Error Response setting IIN2-1 or IIN2-2.2.2 Test Procedure 8. 2.1 Binary Output. 3. 3. 2. If the device does support control outputs verify that the DUT responds by echoing the direct operate message exactly with status field of 0.2. 8.3. DNP3-2003 IED Certification Procedure Subset Level 2 Page 19 Rev 2. verify that the proper control point operates. end testing of this section. 2. Configure the DUT such that all Binary Output points are uninstalled or disabled.3 – 29-Sept-03 .2. however there are no control points installed/enabled: • If the device does not have any control outputs installed.1 Binary Output. 3. If the device does not support control outputs verify that the DUT responds with an Error Response with IIN2-1 set and end testing of this section.2. Issue a direct operate using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17).2. 8. If the device does not support control outputs. If the device supports binary outputs and the operate message is correct then the binary output point must operate. Direct Operate.2. Verify that no control operates.2 Binary Output.2. Direct Operate to Uninstalled Point 1. Binary Output. Issue a direct operate using Object 12 Variation 1 to point 0 using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time.• The DUT responds to a direct operate to an installed data point by echoing the direct operate and setting the status field to 0. No Acknowledge 1. No Acknowledge using Object 12 Variation 1 to an installed point using 8 bit indexing (qualifier 0x17).2 Test Procedure 8. Verify that the DUT does not respond. and an appropriate on time/off time. Verify that no control operates. or IIN2-2 set and that each object returns a status code of 0. 2. issue a select to at least one more point than is supported in a single request. Variation 1 and 16-bit indexing (qualifier 0x28).3 – 29-Sept-03 3. Immediately issue a matching execute. Direct Operate.2. 6.2. Configure the DUT such that all Binary Output points are uninstalled or disabled. No Acknowledge. 8.2.2 Binary Output. 3. Configurable Device If the device is not configurable in a manner such that control points can be uninstalled or disabled. No Acknowledge using Object 12 Variation 1 to point 0 using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. Verify that each of the selected controls operated. Issue a Direct Operate. • The DUT responds to a select to an uninstalled control point by returning an error response with IIN2-2 set and a status code of 4. that each object except the last returns a status code of 0. Determine the number of installed points that can be successfully controlled in a single request. 8. IIN2-1. 9.8. This number shall be the smaller of: • The number of controls supported in a single request • The number of installed control points • Sixteen In a single request. a control code supported by the device. 8. 8. The following assumes that the device supports control operations and were added as a result of Technical Bulletin TB2001001 (Multiple Control Object and Status Codes): • The DUT responds to requests having more points than are supported in a single message with a status code of 8 for at least the first point that is beyond the point count limit. Note that controls may execute simultaneously or sequentially one after the other.4. end testing of Binary Output. IIN2-1. to an Uninstalled Point 1. or IIN2-2 set and that each object returns a status code of 0. Page 20 Rev 2. In a single request.2. skip to step 7. Direct Operate.2 Test Procedure 1. each point having a different index but otherwise able to be controlled. issue a select to the above number of points using Object 12. Verify that the DUT does not respond.4 Multiple Object Requests 8. Verify that the DUT response has none of IIN2-0.2.1 Desired Behavior • • The DUT must parse requests for all control operations within a single frame. If this number is one. skip to step 13. Direct Operate. a control code supported by the device. 5. and the last object returns a status code of 8. 2.4. Variation 1 and 16-bit indexing (qualifier 0x28). using Object 12.3 1. Verify that the DUT response has none of IIN2-0. 3. If the number of control objects supported in a single request is greater than or equal to either • The number of control objects that fit into a single frame or • The number of installed control points. 7.3.3. or IIN2-2 set. 4. DNP3-2003 IED Certification Procedure Subset Level 2 . Verify that the DUT response has none of IIN2-0. No Acknowledge using Object 12 Variation 1 to an uninstalled point using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. 4. and an appropriate on time/off time. Up to a full frame of request operations must be supported. Issue a Direct Operate. 5. No Acknowledge. Verify that no control operates. Review the device’s profile document to understand how many control points are supported in a single request.2. No Acknowledge. Binary Output.2. IIN2-1. 2. The installed point should be the first object in the request.5. • • 8. that the status code returned for the installed point is 0 and the status code returned for the non-installed point is 4.2. 7. In a single request. 11.2 Test Procedure 8. each point having a different index but otherwise able to be controlled. IIN2-1. it must perform the same function for each control code it accepts. Issue a valid control sequence to an installed complementary function binary output point using control code 0x04 (Latch Off/NUL). a control code supported by the device. issue a select to one installed control point and to one point that is not installed using Object 12. Variation 1 and 16-bit indexing (qualifier 0x28). 2.2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Issue a valid control sequence to an installed complementary function binary output point using control code 0x41(Pulse On/Close). issue a direct operate command to at least one more point than is supported in a single request. using Object 12. that each object except the last returns a status code of 0 and the last object returns a status code of 8. a control code supported by the device. or IIN2-2 set. Verify that the DUT response has none of IIN2-0. If it does: – control codes 0x03 (Latch On/NUL) and 0x41 (Pulse On/Close) must perform the same function – control codes 0x04 (Latch Off/NUL) and 0x81 (Pulse On/Trip) must perform the same function For single function indices. Page 21 Rev 2. Verify that all except the last control point operated. 3. Variation 1 and 16-bit indexing (qualifier 0x28). 4.10. and an appropriate on time/off time. 12.2. and an appropriate on time/off time. Verify that the DUT response has IIN2-2 bit set. 9. If the DUT does not have installed complementary function binary output points skip this section. 8. Issue a valid control sequence to the first installed complementary function binary output point using control code 0x03 (Latch On/NUL). If the DUT does not have installed binary output points skip this section. the outstation must accept at least one of the following control codes: – 0x01 (Pulse On/NUL) – 0x03 (Latch On/NUL) – 0x04 (Latch Off/NUL) – 0x41 (Pulse On/Close) – 0x81 (Pulse On/Trip) If the outstation accepts more than one control code for a single function index.5. Complementary Function Support 1. If the DUT does not support the 0x41(Pulse On/Close) and 0x81 (Pulse On/Trip) pair skip to step 13. 8.1 Binary Output.2. the Outstation must accept at least one of the following control code pairs: – 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) – 0x41 (Pulse On/Close) and 0x81 (Pulse On/Trip) • The outstation may optionally accept both forms of complementary control code pairs.5 Control Code Support 8. skip to step 13. Verify the control operation completes successfully. 14. In a single request. If the DUT does not support direct operate.1 Desired Behavior The following assumes that the device supports control operations and were added as a result of Technical Bulletin TB2000006 (CROB Control Codes): • For complementary function indices.2. Verify the complementary control operation completes successfully. 6. 13.5. 5. If the DUT does not support the 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) pair skip to step 8. determine what action should happen when the control executes. If the DUT does not have installed binary output points skip this section. Verify the control operation completes successfully.10. 14. 17. Verify the control operation in step 3 completes successfully. Verify that the complementary control operation completes successfully. Verify the complementary control operation completes successfully. 6. 7. If the DUT does not support the 0x04 (Latch Off/NUL) control code for single function binary output points at this index skip to step 13. Verify the control operation in step 3 completes successfully. 2. Verify the control operation in step 3 completes successfully. 19. Issue a valid control sequence to the first installed single function binary output point using control code 0x04 (Latch Off/NUL). 5. Issue a valid control sequence to the same installed complementary function binary output point using control 0x04 (Latch Off/NUL). Single Function Support 1. 18. 13. 4. 17. Issue a valid control sequence to the first installed single function binary output point using control code 0x81 (Pulse On/Trip). 15.3 – 29-Sept-03 . 20. Verify the complementary control operation completes successfully.2.2 Binary Output. 16. Issue a valid control sequence to an installed complementary function binary output point using control code 0x03 (Latch On/NUL). 10. If the DUT does not support the 0x03 (Latch On/NUL) control code for single function binary output points at this index skip to step 10. If the DUT does not support both the 0x03 (Latch On/NUL) and 0x04 (Latch Off/NUL) control code pair and the 0x41(Pulse On/Close) and 0x81 (Pulse On/Trip) control code pair skip to the next section. DNP3-2003 IED Certification Procedure Subset Level 2 Page 22 Rev 2. If the DUT does not have installed single function binary output points skip this section. For any point that is tested below. Issue a valid control sequence to the same installed complementary function binary output point using control 0x81 (Pulse On/Trip). Verify the control operation in step 3 completes successfully. 8. 3. Issue a valid control sequence to an installed complementary function binary output point using control code 0x81 (Pulse On/Trip).2. 15. 11. 8. If the DUT does not support the 0x01 (Pulse On/NUL) control code for single function binary output points at this index skip to step 7.5. 16. 12. If the DUT does not support the 0x81 (Pulse On/Trip) control code for single function binary output points at this index skip to the next section. Verify the control operation in step 3 completes successfully. 9. Issue a valid control sequence to the same installed complementary function binary output point using control code 0x41(Pulse On/Close). Issue a valid control sequence to the first installed single function binary output point using control code 0x01 (Pulse On/NUL). If the DUT does not support the 0x41 (Pulse On/Close) control code for single function binary output points at this index skip to step 16. 14. 18. 12. Issue a valid control sequence to the first installed single function binary output point using control code 0x03 (Latch On/NUL). 11. Issue a valid control sequence to the first installed single function binary output point using control code 0x41 (Pulse On/Close). 21. Verify the complementary control operation completes successfully. 13. Verify the control operation completes successfully. Direct Operate. the device must be configured with at least one Analog Output point installed or enabled before proceeding with the test procedure.3 – 29-Sept-03 . 8.8. 4. 1=forced LOCAL FORCED DATA .3 Analog Output Status The Analog Output Status object represents the actual value of an analog output or software point and the associated status reported by an 8-bit flag field (repeated here for convenience): Flag Bit 0 1 2 3 4 5 6 7 Value ONLINE .0=normal. 6. 1=forced 0 0 0 Table 8-2 8. Issue a Direct Operate to Object 41 Variation 2 to an installed point using 16 bit indexing (qualifier 0x28) and an appropriate value. 1=lost REMOTE FORCED DATA .0=off-line. Issue a request for Object 40 Variation 0 using the all data qualifier 0x06. It is also the hosts’ responsibility to perform select before operate control when it is unacceptable to have the analog output point operate more than once. If a device has been configured to reject a particular mode. it must return a control status value of 4 (control operation not supported for this point). If the device supports Analog Outputs verify that the DUT responds with an Analog Output Status object (object 40 Variation 2). If the DUT is configurable in a manner such that points can be uninstalled or disabled. DNP3-2003 IED Certification Procedure Subset Level 2 Page 23 Rev 2. 2. If the device does not support analog outputs the device must respond to an analog output read request with a Null Response or an Error Response with IIN2-1 or IIN2-2 set. It is the outstations’ responsibility to perform the analog output operation if a correct control dialog has been issued from the host.1 Desired Behavior • • • If the device supports analog outputs the device must respond to an analog output read request with an analog output object (object 40 variation 2) using qualifier 0x00 or 0x01. namely Select Before Operate.0=normal. It is the hosts’ responsibility to determine the appropriate analog output mechanism.4 Analog Outputs § If a device supports analog outputs. 1= restart COMMUNCATION LOST .0=normal. This is typically a configuration item in the host and is the responsibility of the end user to configure properly. The device can optionally return an Error Response with IIN2-1or IIN2-2 set. it is required to be configurable to support all three modes of operation.3. 5. A device may be configurable to disable any subset of the modes. and Direct Operate no Acknowledgment. Verify that the value returned in the Analog Output Status object reflects the value sent in step 1 within the tolerances specified by the manufacturer. The value returned in the Analog Output Status must reflect the value written to the corresponding Analog Output point within the tolerances specified by the manufacturer.2 Test Procedure 1.3. 1= on-line RESTART .0=normal. If the device does not support Analog Outputs verify that the DUT responds with a Null Response. 3. 8. Verify that the data is reported using either 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01). 1. The object. The DUT must echo the operate command but must not operate the analog output more than once. • The DUT responds to matching select and execute requests by echoing each request with the status field set to 0.4. but that the object.3 – 29-Sept-03 .1 Select Before Operate The host first initiates the select portion of the dialog. The analog output point does not operate. and all object data must match exactly. • The DUT must reject any operate that does not • contain a application layer sequence number that is exactly one greater (modulo 16) than the previously accepted select. The specified analog output operates. The host then sends the execute portion of the dialog. excluding the application header. and all object data must match exactly byte for byte the data sent in the select message. The outstation then echoes the exact analog output request byte for byte to the host. • The DUT must accept retries on the select portion of the analog output dialog that do not increment the application sequence number between retries. • The DUT operates various selected analog output points. The following assumes that the device supports analog output operations and were added as a result of Technical Bulletin TB2000-002 (Control Retries): • The DUT must accept retries on the select portion of the analog output dialog that increment the application sequence number between retries. • The DUT responds to selecting an uninstalled analog output point by returning an error response with IIN2-2 set and a status code of 4.4. variation. The following behavior assumes that the device supports analog output operations: • The maximum select to execute delay time must be specified in the Device Profile Document. qualifier. • The DUT supports 8 and 16 bit point indexing. Note that the encapsulation information need not match. • The DUT responds to executing an installed analog output point after the configured acceptable select to execute delay by echoing the execute and setting the status field to 1[Execute received after timeout]. 8. DNP3-2003 IED Certification Procedure Subset Level 2 Page 24 Rev 2. • No further testing in this section is necessary. In this case the select-to-operate timer must remain unaltered by the reception of each additional select. If the execute message matches the select message byte for byte and it is received within the configured acceptable delay between select and execute.1 Desired Behavior The following behavior assumes that the device does not support analog output operations: • If the device does not support analog outputs it must respond to a select with an Error Response setting IIN2-1. • The DUT must accept retries on the operate portion of the analog output dialog that does not increment the application sequence number between retries. In this case the select-to-operate timer must be restarted after reception of each select. qualifier. it must respond to a select with an Error Response setting IIN21 or IIN2-2. however there are no analog output points installed/enabled: • If the device does not have any analog outputs installed. • match the object portion of the select message byte for byte. • The DUT responds to a non-matching execute with a status field of 2 [No previous matching select] and does not operate the analog output under the following conditions: • No prior select issued. • An Error Response with IIN2-2 set is an invalid response. variation. the outstation operates the analog output point.8. The analog output does not operate. The following behavior assumes that the device does support analog output operations. • Value does not match. 4. 8. 2. Issue a select using Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value. Verify that the DUT echoes the execute with the status field set to 2 [No previous matching select].2. Verify that the DUT responds by echoing the select message exactly. If an analog output is observed to operate. 2. Verify that the DUT responds by returning an error response with IIN2-2 set and a status code of 4.5 Analog Output. If the device does not support analog outputs verify that the DUT responds with an Error Response with IIN2-1 set. 2.4. Verify that the DUT echoes the execute.1 Analog Output.4. SBO. SBO. Execute 0x17 1. Immediately issue an execute to Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and the same value incremented by 1. 3. Wait 1 second past the configured maximum select to execute delay time. 5. 3. Issue a select using Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value.2 Analog Output. 3. Verify that the selected analog output operates. Verify that the DUT responds by echoing the select message exactly.1. the test fails. 5. Verify that the DUT echoes the execute.1.1. 8.1. 4. If an analog output is observed to operate.1. 0x17 1.4 Analog Output.2 Test Procedure 8.6 Analog Output. the test fails.2.1. Issue a select using Object 41 Variation 2 to a different point using 8 bit indexing (qualifier 0x17) and an appropriate value. 5. verify that the DUT responds by echoing the select message exactly. 8. Issue a select using Object 41 Variation 2 to an installed point using 16 bit indexing (qualifier 0x28) and an appropriate value.2. to Uninstalled Point 1. SBO. Issue a select using Object 41 Variation 2 to an uninstalled point using 16 bit indexing (qualifier 0x28) and an appropriate value. Immediately issue a matching execute. the test fails. 8. 4. 3.2. Immediately issue a matching execute. Page 25 Rev 2. If an analog output is observed to operate. SBO.8. 3. 0x28 1. SBO. If an analog output is observed to operate. 2. Immediately issue an execute to Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and the same value as the previous select.4. SBO.4. 2. Verify that the DUT responds by echoing the select message exactly. 4. Execute Value does not match Select Value 1. 3. 5. Verify that the DUT responds by echoing the select message exactly.3 Analog Output. Issue a select using Object 41 Variation 2 to an installed point using 16 bit indexing (qualifier 0x28) and an appropriate value. 8. 5. End testing of Analog Output SBO. 2.2. Verify that the selected analog output operates. 4. Select 0x28. Execute Issued After Time-out 1. the test fails. Issue a matching execute and verify that the DUT echoes the execute with the status field set to 1 [Execute received after timeout].1. 6.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 .2. If the device does support analog outputs.4.4. Verify that the DUT echoes the execute with the control status field set to 2 [No previous matching select].4. Issue a valid select to an installed analog output point. 5.11 Analog Output. Verify that the DUT echoes the object portion of the select byte for byte. 8. Verify that the DUT operates the analog output. 3. Page 26 Rev 2. 2.1. 5.4. Verify that the DUT echoes the object portion of the select byte for byte. 7. 4. 4. Same Sequence Number Select Retries 1.1. 5. If the DUT does not have installed analog output points.8.4. 6. 8. 2. Issue a valid operate. 8. Verify that the DUT operates the analog output. If the device is not configurable in a manner such that analog output points can be uninstalled or disabled.1. incrementing the sequence number by 1 modulo 16. 2. Verify that the DUT echoes the object portion of the select byte for byte. 7. 8.2. 8.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . 8. Verify that the DUT echoes the object portion of the select byte for byte.1. Verify that the DUT echoes the object portion of the operate byte for byte. Issue the operate again using the same application layer sequence number.2. 3. Verify that the DUT echoes the object portion of the operate byte for byte. Issue a valid select to an installed analog output point. 2. 8. Incrementing Sequence Number Select Retries 1. 4. 5.12 Analog Output. 8. 6. Configurable Device 1. SBO. 9. 7.4. Verify that the DUT does not operate the analog output. Verify that the DUT echoes the object portion of the select byte for byte. SBO. 3. Verify that the DUT echoes the object portion of the operate byte for byte. 8. Issue a valid operate. Issue a select using Object 41 Variation 2 to point 0 using 16 bit indexing (qualifier 0x28) and an appropriate value.8 Analog Output. incrementing the sequence number by 1 modulo 16. 5. SBO. SBO.2. Issue the select again using the same application layer sequence number. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set. 6.4. Issue a valid operate. Verify that the DUT operates the analog output. Verify that the DUT does not operate the analog output.10 Analog Output.2. If an analog output is observed to operate. Verify that the DUT echoes the object portion of the select byte for byte. skip this section. Issue a valid select to an installed analog output point. If the DUT does not have installed analog output points.2. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). Issue a valid select to an installed analog output point. 2. If the DUT does not have installed analog output points. Configure the DUT such that all Analog Output points are uninstalled or disabled. Verify that the DUT operates the analog output. Sequence number checking 1. SBO. 9. 3. Verify that the DUT echoes the object portion of the operate byte for byte. skip this section. Same Sequence Number Operate Retries 1.1. incrementing the sequence number by 1 modulo 16. 3.4. Issue the select again incrementing the application layer sequence number by 1 modulo 16. incrementing the sequence number by 1 modulo 16. skip this section.1. Incrementing Sequence Number Operate Retries 1. Verify that the DUT echoes the object portion of the operate byte for byte. 4.7 Analog Output. the test fails. Issue a valid operate. skip this section.9 Analog Output. Issue the operate again. skip this section. SBO. 7. If the DUT does not have installed analog output points. If the DUT does not have installed analog output points. incrementing the sequence number by 1 modulo 16. skip this section. 4. 6.2.4. Direct Operate. Direct Operate.3 1. 3. The specified analog output operates. • The DUT operates various analog output points. Issue a valid operate. 9.4.2 Analog Output.1 Analog Output. No analog outputs shall be observed to operate. 7. Configurable Device If the device is not configurable in a manner such that analog output points can be uninstalled or disabled. Issue a Direct Operate to Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value. Verify that the DUT responds by return an Error Response with IIN2-2 set and a status code of 4. Verify that the DUT echoes the object portion of the select byte for byte. incrementing the select sequence number by 1 modulo 16 to make sure the mismatched operate cleared the previous select. The following assumes that the device does support analog output operations.2 Test Procedure 8. Issue a valid select to an installed analog output point. the test fails. 3.2. however there are no analog output points installed/enabled: • If the device does not have any analog outputs installed.2.2.4. 8.2. 8. • The DUT responds to a Direct Operate to an uninstalled analog output point by returning an Error Response with IIN2-2 set and a status code of 4.2 Direct Operate with Acknowledge 8. 2.2.2. If the device does not support analog output verify that the DUT responds with an Error Response with IIN2-1 set and end testing of this section. to Uninstalled Point 1.2. Issue a valid operate. Configure the DUT such that all Analog Output points are uninstalled or disabled.2. Issue a Direct Operate to Object 41 Variation 2 to an uninstalled point using 16 bit indexing (qualifier 0x28) and an appropriate value. Analog Output. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). The following assumes that the device supports analog output operations: • The DUT responds to a Direct Operate to an installed analog output point echoing the direct operate and setting the status field to 0. 4. Direct Operate. • No further testing in this section is necessary. Verify that the specified analog output operates. incrementing the sequence number by anything but 1 modulo 16. 3.4. 4. If an analog output is observed to operate. Verify that the DUT echoes the object portion of the operate byte for byte with a status code value of 2 (NO MATCHING SELECT). Verify that the DUT does not operate the analog output. it must respond to a direct operate with an Error Response setting IIN2-1.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . 8. If the device does support analog outputs verify that the DUT responds by echoing the direct operate message exactly with status field of 0.4.4. Page 27 Rev 2. Verify that the DUT does not operate the analog output. end testing of Analog Output. 8. 8.2. 2.1 Desired Behavior The following assumes that the device does not support analog output operations: • If the device does not support analog outputs. 6. Direct Operate 1. 5. it must respond to a direct operate with an Error Response setting IIN2-1 or IIN2-2.4. 2. 4.2 Test Procedure 1. If an analog output is observed to operate.4. 8. the test fails. end testing of this section. Direct Operate. If the device does not support analog outputs.3.2. skip to step 7.1 Desired Behavior • • The DUT must not respond in any way to the direct operate no acknowledge.3.2 Test Procedure 8.4. Verify that the DUT does not respond.2.4. No Acknowledge. 8. 5. 2.3. Issue a Direct Operate No Acknowledge using Object 41 Variation 2 to point 0 using 16 bit indexing (qualifier 0x28) using a control code supported by the device and an appropriate on time/off time. Verify that the DUT does not respond.3. 3.1 Analog Output. No Acknowledge 8. 4. Direct Operate. No Acknowledge. Issue a Direct Operate No Acknowledge using Object 41 Variation 2 to an installed point using 8 bit indexing (qualifier 0x17) and an appropriate value. 5.3 1. • The DUT responds to a select to an uninstalled analog output point by returning an error response with IIN2-2 set and a status code of 4. 4. If the device supports analog outputs and the operate message is correct then the analog output point must operate.4. No Acknowledge. Analog Output.3. 8. Page 28 Rev 2. 8.4. 8.4. verify that the proper analog output point operates. Verify that the DUT does not respond. If this number is one.3 Direct Operate. 3. If an analog output is observed to operate. No Acknowledge 1.2. Direct Operate. Issue a Direct Operate No Acknowledge using Object 41 Variation 2 to an uninstalled point using 16 bit indexing (qualifier 0x28) and an appropriate value. end testing of Analog Output. the test fails. 4. Review the device’s profile document to understand how many analog output points are supported in a single request. If the device does support analog outputs. 2. to an Uninstalled Point 1.4. 2.2 Analog Output. Verify that the DUT responds by returning an error response with IIN2-1 or IIN2-2 set.4 Multiple Object Requests 8.4. Configure the DUT such that all Analog Output points are uninstalled or disabled.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Configurable Device If the device is not configurable in a manner such that control points can be uninstalled or disabled. Issue a direct operate to Object 41 Variation 2 to point 0 using 16 bit indexing (qualifier 0x28) and an appropriate value. Direct Operate.4.1 Desired Behavior • • The DUT must parse requests for all writes within a single frame Up to a full frame of request operations must be supported The following assumes that the device supports analog output operations and were added as a result of Technical Bulletin TB2001-001 (Multiple Control Object and Status Codes): • The DUT responds to requests having more points than are supported in a single message with a status code of 8 for at least the first point that is beyond the point count limit. 8. 3. the test fails.3. If an analog output is observed to operate.4. 9. and the last object returns a status code of 8. 8. 13.5 Class Data 8. a control code supported by the device. Verify that all except the last analog output point outputted the new value(s). 10. issue a direct operate command to at least one more point than is supported in a single request. When no events are pending the device responds with the Null Response. Verify that the DUT response has none of IIN2-0. 8. each point having a different index but otherwise able to be outputted. IIN2-1. Note outputs may occur simultaneously or sequentially one after the other. 6. or IIN2-2 set and that each object returns a status code of 0. that each object except the last returns a status code of 0. or IIN2-2 set and that each object returns a status code of 0. In a single request. issue a select to the above number of points using Object 41. DNP3-2003 IED Certification Procedure Subset Level 2 Page 29 Rev 2. In a single request. skip to step 13. Verify that the DUT response has none of IIN2-0. IIN2-1. 4. Determine the number of installed points that can be successfully controlled in a single request. that each object except the last returns a status code of 0 and the last object returns a status code of 8. Acceptable object variations and qualifier combinations included in a device response are specified in the following table. that the status code returned for the installed point is 0 and the status code returned for the non-installed point is 4. 11. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. each point having a different index but otherwise able to be outputted. IIN2-1.2. If the number of control objects supported in a single request is greater than or equal to either: • The number of control objects that fit into a single frame or • The number of installed control points skip to step 13. Verify that the DUT response has none of IIN2-0. 14.5. Verify that each of the selected analog outputs occurred. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. Numbers preceded by 0x are in hex. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3.1 Class 0 This request is used to read all static data from a device. Verify that the DUT response has IIN2-2 bit set. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. In a single request. If the DUT does not support direct operate. issue a select to one installed analog output point and to one point that is not installed using Object 41. 5. and a value supported by the device Verify that the DUT response has none of IIN2-0. or IIN2-2 set. This number shall be the smaller of: • The number of controls supported in a single request • The number of installed control points • Sixteen In a single request. The device must respond with the current state of its data when this object is requested. using Object 41.3 – 29-Sept-03 . using Object 41. Variation 2 and 16-bit indexing (qualifier 0x28) and an appropriate value. IIN2-1. Variation 2 and 16-bit indexing (qualifier 0x28).4. issue a select to at least one more point than is supported in a single request. or IIN2-2 set. 12. Immediately issue a matching execute. 7. . 3. The installed point should be the first object in the request. This allows efficient use of bandwidth. 5.0x01 0x00. the request for the application layer confirm is optional and may be eliminated to reduce bandwidth. The minimum level of compliance is for the device to respond with a Null Response. Verify that flag behavior complies with Section 2. When no events are pending the device responds with the Null Response.0x01 8.0x01 0x00.5. 3.0x01 0x00.0x01 0x00. Verify that the device responds with the current state of its inputs using only the object. verify that the device requests an application layer confirm.2 Class 1 This request is used to read change or event data from a device. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3. 8. 2.0x01 0x00. Numbers preceded by 0x are in hex.4. Issue a request for Object 60 Variation 1 using the all data qualifier 0x06. If a device can be configured to generate Application Layer retries. This allows efficient use of bandwidth.0x01 0x00. Note #5. Acceptable object variations and qualifier combinations included in a device response are specified in the following table. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points.0x01 0x00.0x01 0x00.0x01 0x00. DNP3-2003 IED Certification Procedure Subset Level 2 Page 30 Rev 2.1 Desired Behavior • Device responds to a Class 0 poll with the current state of all data. variation and qualifier variations specified in table 8-3.0x01 0x00. 8. The device must respond with events that have occurred since the last poll/confirm sequence. If the response is null.0x01 0x00.0x01 0x00. If the response is not null. Points can be assigned to a class by configuration and through the protocol.2 Test Procedure 1.1.0x01 0x00. Neither is required for compliance.Single-Bit Binary Input Binary Input with Status Binary Output Status 32-Bit Binary Counter 16-Bit Binary Counter 32-Bit Binary Counter w/o Flag 16-Bit Binary Counter w/o Flag 32-bit Frozen Counter 16-bit Frozen Counter 32-bit Frozen Counter w/o Flag 16-bit Frozen Counter w/o Flag 32-Bit Analog Input 16-Bit Analog Input 32-Bit Analog Input w/o Flag 16-Bit Analog Input w/o Flag 16-Bit Analog Output Status Table 8-3 Object 1 1 10 20 20 20 20 21 21 21 21 30 30 30 30 40 Variation 1 2 2 1 2 5 6 1 2 9 10 1 2 3 4 2 Qualifier 0x00.0x01 0x00. this feature must be disabled for all tests in this section unless otherwise specified.3 – 29-Sept-03 .5.0x01 0x00.1. verify that the device responds with all the event data in its event buffers or responds with a Null Response. 5. Verify that the DUT responds with a Null Response.2 Test Procedure 8. 3. The response point ordering shall be prioritized by time (oldest first).5. No further testing is required in this section. Binary Input changes more than 0xFFFF milliseconds apart must have a second CTO Object. 8. 7. Verify that the device responds with all the Class 1 event data generated in a single response. Variation3) requires that a Common Time of Occurrence Object (Object 51. 0x06 Issue a request for Object 60 Variation 2 using the all data qualifier 0x06.2.Binary Input Change w/o Time Binary Input Change with Time Binary Input Change with Relative Time 32-Bit Counter Change Event w/o Time 16-Bit Counter Change Event w/o Time 32-Bit Analog Change Event w/o Time 16-Bit Analog Change Event w/o Time Time and Date CTO* Unsynchronized Time and Date CTO* Table 8-4 Object 2 2 2 22 22 32 32 51 51 Variation 1 2 3† 1 2 1 2 1 2 Qualifier 0x17.2. Class 1 Data. § Verify that the device requests an application layer confirm.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 .1 1. 8. Class 1 Data. 11. verify that the device requests an application layer confirm. § If the response is not Null. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first). When polled with the limit data qualifiers (0x07 and 0x08).2. If the DUT does not support Class 1 events. 0x07 Issue a request for Object 60 Variation 2 using the all data qualifier 0x06 to empty the device of pending events.2 1. Note: Application layer confirms are always sent by the Master upon request from the Slave unless otherwise noted in this section. 12. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Note: A device is not required to return event data in any particular class.5. Generate known Class 1 event data.5. Note #5. 9.2. verify that it responds with a Null Response. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06. § Verify that if the DUT responds to a class 0 poll with more than one link layer frame it also performs report-by exception processing. 14. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06.0x28 0x17.0x28 0x07 0x07 † Note: Use of the Binary Change with Relative Time Object (Object 2.2.0x28 0x17.0x28 0x17.0x28 0x17. This behavior must be verified in any response that contains a Binary Change with Relative Time Object.5. Page 31 Rev 2. Variation01 or 02) precede it in the same APDU. 8. 13.1 Desired Behavior • • • • § The device must respond with all of its change events when polled with the all data qualifier (0x06). 6. 2. Verify that flag behavior complies with Section 2. * Note: Common Time of Occurrence objects 8.2. If requested. The device must request an application layer confirm for all responses that contain event data. If the DUT does support Class 1 events. the device must respond with a quantity of its change events no greater than specified in the request. 4.0x28 0x17. issue an application layer confirm to empty the device of pending events. 10. 2.0x28 0x17. § Verify that the device requests an application layer confirm. 8. Verify that the device responds with the requested Class 1 events in a single response. 12. issue an application layer confirm to empty the device of pending events. 13. 10. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that the device has not retransmitted the previous Application Layer fragment.2. 8. 14. 5. Verify that the device responds with a Null Response. 7. 10. 7. 16. Verify that the device responds with the requested Class 1 events in a single response. 9. Note #5. Verify that only objects in table 8-4 are returned. § If the response is not Null. 6. 3. verify that the device requests an application layer confirm. 14. 14. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that device responds with the remaining Class 1 events. 4. Verify that the DUT responds with a Null Response. 17. Verify that flag behavior complies with Section 2.3 1. 4. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x08 requesting some changes.4 1. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. 0x08 Issue a request for Object 60 Variation 2 using the all data qualifier 0x06 to empty the device of pending events. Verify that the device responds with the same Class 1 event data and the additional data generated in step 14. 13.2. 3. Generate known Class 1 event data. issue an application layer confirm to empty the device of pending events. DNP3-2003 IED Certification Procedure Subset Level 2 Page 32 Rev 2. § Verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x07 requesting the remaining changes. Wait for a period of time exceeding several of the Application Layer retry delays. 18. Verify that only objects in table 8-4 are returned.2. Note #5. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). issue an application layer confirm to empty the device of pending events. 9. § Verify that the device requests an application layer confirm. 2.3 – 29-Sept-03 . 19. Do not issue an application layer confirm to the device. 7. Generate additional Class 1 event data. 12. 15. Verify that flag behavior complies with Section 2. 20. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 10. 15.3. 8. 9. § Verify that the device requests an application layer confirm. 5.2. § Verify that the device requests an application layer confirm. 8. 13.5. Note #5. 12. § If the response is not Null. 6. if one exists. § Class 1 Data Without Confirm Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that device responds with the remaining Class 1 events. verify that the device requests an application layer confirm. 4. Verify that flag behavior complies with Section 2.5. If requested. Issue another request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that the DUT responds with a Null Response. Verify that only objects in table 8-4 are returned. 5. 8. Generate several Class 1 events. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x07 requesting some changes. 11. Issue a request for Object 60 Variation 2 using the limit data qualifier 0x08 requesting the remaining changes. § Verify that the device requests an application layer confirm. 2. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. If requested. Generate several Class 1 events. If requested. 15. 11. 6. Issue an application layer confirm to empty the device of pending events. 11. Class 1 Data. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that the device responds with all the Class 1 event data. 10.3. Note: A device is not required to return event data in any particular class. If the DUT does not support Class 2 events. 13. 8. The minimum level of compliance is for the device to respond with a Null Response.5. issue an application layer confirm to empty the device of pending events. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3.1 1. 4. If the DUT does support Class 2 events. The device must respond with events that have occurred since the last poll/confirm sequence. 4. Class 2 Data. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first).2 1. The response point ordering shall be prioritized by time (oldest first). 0x06 Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. this feature must be disabled for all tests in this section unless otherwise specified. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. If requested. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Class 2 Data. § If the response is not Null.4. Verify that flag behavior complies with Section 2. If requested. Issue another request for Object 60 Variation 3 using the all data qualifier 0x06.3. 6. If a device can be configured to generate Application Layer retries. verify that it responds with a Null Response. Issue another request for Object 60 Variation 3 using the all data qualifier 0x06. Verify that the device responds with all the Class 2 event data generated in a single response. Points can be assigned to a class by configuration and through the protocol. 3. 3.8.5.5. 2. 14. This allows efficient use of bandwidth. § Verify that the device requests an application layer confirm. Note #5. No further testing is required in this section. 9. 8. verify that the device responds with all the event data in its event buffers or responds with a Null Response. 2. Generate several Class 2 events. 8.2 Test Procedure 8. If the response is not null. The device must request an application layer confirm for all responses that contain event data. 11. 12. Neither is required for compliance. Generate known Class 2 event data.3 Class 2 This request is used to read change or event data from a device. verify that the device requests an application layer confirm. When no events are pending the device responds with the Null Response. the device must respond with a quantity of its change events no greater than specified in the request. 8. verify that the device requests an application layer confirm. issue an application layer confirm to empty the device of pending events. 7. the request for the application layer confirm is optional and may be eliminated to reduce bandwidth. Note: Application layer confirms are always sent by the Master upon request from the Slave unless otherwise noted in this section.5. 5. When polled with the limit data qualifiers (0x07 and 0x08).2.2.3.5. § Verify that if the DUT responds to a class 0 poll with more than one link layer frame it also performs report-by exception processing. Verify that the DUT responds with a Null Response.3.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 .1 Desired Behavior • • • • § The device must respond with all of its change events when polled with the all data qualifier (0x06). 0x07 Issue a request for Object 60 Variation 3 using the all data qualifier 0x06 to empty the device of pending events. If the response is null. Page 33 Rev 2. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. 9. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 0x08 Issue a request for Object 60 Variation 3 using the all data qualifier 0x06 to empty the device of pending events. 7. 7. 4. 15.2. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x08 requesting some changes. if one exists. 13. 2. Verify that the device has not retransmitted the previous Application Layer fragment. Verify that the DUT responds with a Null Response. Verify that the device responds with the requested Class 2 events in a single response. 17. § Verify that the device requests an application layer confirm. 12. 6. Verify that flag behavior complies with Section 2. 8. 15. § Verify that the device requests an application layer confirm. 8. Verify that only objects in table 8-4 are returned. Note #5. 8. Verify that the device responds with all the Class 2 event data. verify that the device requests an application layer confirm. 14. 18. If requested. Class 2 Data. Wait for a period of time exceeding several of the Application Layer retry delays. Note #5.3. issue an application layer confirm to empty the device of pending events. Do not issue an application layer confirm to the device. 11. Verify that only objects in table 8-4 are returned. Verify that flag behavior complies with Section 2. If requested. 7. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x07 requesting the remaining changes.4 1. § Verify that the device requests an application layer confirm. 16. 14. § Verify that the device requests an application layer confirm. Generate several Class 2 events. Verify that the device responds with a Null Response. 2. Generate additional Class 2 event data. DNP3-2003 IED Certification Procedure Subset Level 2 Page 34 Rev 2. 19. 10. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. verify that the device requests an application layer confirm. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Issue an application layer confirm to empty the device of pending events. 8.3. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x08 requesting the remaining changes. 20. 3. 9. issue an application layer confirm to empty the device of pending events. Verify that device responds with the remaining Class 2 events.5. § Verify that the device requests an application layer confirm.3 – 29-Sept-03 . 14. Issue a request for Object 60 Variation 3 using the limit data qualifier 0x07 requesting some changes. 10. 6. 4.2. Generate known Class 2 event data. Issue another request for Object 60 Variation 3 using the all data qualifier 0x06. 5. 6. § If the response is not Null. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 5.3 1. Verify that the DUT responds with a Null Response. Verify that flag behavior complies with Section 2. 13. 9. 12. Verify that the device responds with the requested Class 2 events in a single response. § Class 2 Data Without Confirm Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. 8.5.5. 10. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. § If the response is not Null. Note #5. 11. Verify that device responds with the remaining Class 2 events. Verify that only objects in table 8-4 are returned. 15. 12. Verify that the device responds with the same Class 2 event data and the additional data generated in step 14. § Verify that the device requests an application layer confirm. 3. 11. Issue another request for Object 60 Variation 3 using the all data qualifier 0x06. 13. 8.5.4 Class 3 This request is used to read change or event data from a device. The device must respond with events that have occurred since the last poll/confirm sequence. If the response is not null, verify that the device requests an application layer confirm. If the response is null, the request for the application layer confirm is optional and may be eliminated to reduce bandwidth. Points can be assigned to a class by configuration and through the protocol. Neither is required for compliance. The minimum level of compliance is for the device to respond with a Null Response. If a device can be configured to generate Application Layer retries, this feature must be disabled for all tests in this section unless otherwise specified. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3.4. This allows efficient use of bandwidth. When no events are pending the device responds with the Null Response. 8.5.4.1 Desired Behavior • • • • § The device must respond with all of its change events when polled with the all data qualifier (0x06). When polled with the limit data qualifiers (0x07 and 0x08), the device must respond with a quantity of its change events no greater than specified in the request. The device must request an application layer confirm for all responses that contain event data. Note: Application layer confirms are always sent by the Master upon request from the Slave unless otherwise noted in this section. The response point ordering shall be prioritized by time (oldest first). Note: A device is not required to return event data in any particular class. 8.5.4.2 Test Procedure 8.5.4.2.1 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. Class 3 Data, 0x06 Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. § Verify that if the DUT responds to a class 0 poll with more than one link layer frame it also performs report-by exception processing. If the DUT does not support Class 3 events, verify that it responds with a Null Response. No further testing is required in this section. If the DUT does support Class 3 events, verify that the device responds with all the event data in its event buffers or responds with a Null Response. If requested, issue an application layer confirm to empty the device of pending events. Generate known Class 3 event data. Issue another request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the device responds with all the Class 3 event data generated in a single response. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first). Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that flag behavior complies with Section 2, Note #5. § Verify that the device requests an application layer confirm. Issue another request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the DUT responds with a Null Response. 8.5.4.2.2 1. 2. 3. 4. Class 3 Data, 0x07 Issue a request for Object 60 Variation 4 using the all data qualifier 0x06 to empty the device of pending events. § If the response is not Null, verify that the device requests an application layer confirm. If requested, issue an application layer confirm to empty the device of pending events. Generate several Class 3 events. Page 35 Rev 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x07 requesting some changes. Verify that the device responds with the requested Class 3 events in a single response. Verify that only objects in table 8-4 are returned. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that flag behavior complies with Section 2, Note #5. § Verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x07 requesting the remaining changes. Verify that device responds with the remaining Class 3 events. § Verify that the device requests an application layer confirm. Issue another request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the DUT responds with a Null Response. 8.5.4.2.3 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. Class 3 Data, 0x08 Issue a request for Object 60 Variation 4 using the all data qualifier 0x06 to empty the device of pending events. § If the response is not Null, verify that the device requests an application layer confirm. If requested, issue an application layer confirm to empty the device of pending events. Generate several Class 3 events. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x08 requesting some changes. Verify that the device responds with the requested Class 3 events in a single response. Verify that only objects in table 8-4 are returned. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that flag behavior complies with Section 2, Note #5. § Verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 4 using the limit data qualifier 0x08 requesting the remaining changes. Verify that device responds with the remaining Class 3 events. § Verify that the device requests an application layer confirm. Issue another request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the DUT responds with a Null Response. 8.5.4.2.4 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. § Class 3 Data Without Confirm Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. § If the response is not Null, verify that the device requests an application layer confirm. If requested, issue an application layer confirm to empty the device of pending events. Generate known Class 3 event data. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the device responds with all the Class 1 event data. Verify that only objects in table 8-4 are returned. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that flag behavior complies with Section 2, Note #5. § Verify that the device requests an application layer confirm. Do not issue an application layer confirm to the device. Wait for a period of time exceeding several of the Application Layer retry delays, if one exists. Verify that the device has not retransmitted the previous Application Layer fragment. Generate additional Class 3 event data. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the device responds with the same Class 1 event data and the additional data generated in step 14. § Verify that the device requests an application layer confirm. Issue an application layer confirm to empty the device of pending events. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the device responds with a Null Response. DNP3-2003 IED Certification Procedure Subset Level 2 Page 36 Rev 2.3 – 29-Sept-03 8.5.5 Multiple Object Request This test verifies that the device can parse multiple object requests. Note: If Binary Inputs can be configured in more than one class, they must be configured for at least one of each class for these tests. 8.5.5.1 Desired Behavior • • • The device must respond to a multiple object request in a single response. For binary points, all events reported within a single application fragment will be sent in the chronological order of occurrence of those events (oldest first). § When a device generates multiple analog or counter events for the same point, all events for the same point will be sent in the chronological order of occurrence of those events (oldest first). 8.5.5.2 Test Procedure 8.5.5.2.1 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. Multiple Object Request, Class 1, 2, and 3 Issue a request for Object 60 Variations 2,3, and 4 using the all data qualifier 0x06. § If the response is not Null, verify that the device requests an application layer confirm. If requested, issue an application layer confirm to empty the device of pending events. Generate known event data that includes events from all three classes. Issue a request for Object 60 Variations 2,3, and 4 using the all data qualifier 0x06. Verify that the device responds with all the event data as described in the Desired Behavior. Verify that only objects in table 8-4 are returned and that the events are in time order (oldest first). Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that flag behavior complies with Section 2, Note #5. § Verify that the device requests an application layer confirm. Issue an application layer confirm to empty the device of pending events. 8.5.5.2.2 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. Multiple Object Request, Class 1, 2, 3, and 0 Issue a request for Object 60 Variations 2,3, and 4 using the all data qualifier 0x06. § If the response is not Null, verify that the device requests an application layer confirm. If requested, issue an application layer confirm to empty the device of pending events. Generate known event data that includes events from classes 1, 2, and 3. Issue a request for Object 60 Variations 2,3,4, and 1 using the all data qualifier 0x06. Verify that the device responds with all the event data as described in the Desired Behavior. Verify that all static data is returned after all event data in the same response. Verify that the response has the same application sequence number as the request. If the request generates multiple application fragments verify that the application sequence number of each subsequent fragment increments by 1 modulo 16. Verify that only objects in tables 8-3 and 8-4 are returned. Verify that the data is reported using either 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28) for event data and 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01) for static data. Verify that flag behavior complies with Section 2, Note #5. § Verify that the device requests an application layer confirm. Issue an application layer confirm to empty the device of pending events. 8.5.6 Class Assignment Verification 8.5.6.1 Desired Behavior • • The device must respond to a request for Class 1 events with only Class 1 events. The device must respond to a request for Class 2 events with only Class 2 events. Page 37 Rev 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 • The device must respond to a request for Class 3 events with only Class 3 events. 8.5.6.2 Test Procedure 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. Issue a request for Object 60 Variations 2,3 and 4 using the all data qualifier 0x06 to empty the device of pending events. Verify that only objects in table 8-4 are returned. § If the response is not Null, verify that the device requests an application layer confirm. Generate some Class 1 events. Generate some Class 2 events. Generate some Class 3 events. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that the device responds with only Class 1 events in a single response. Verify that only objects in table 8-4 are returned. § Verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that the device responds with a Null Response. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. Verify that the device responds with only Class 2 events in a single response. Verify that only objects in table 8-4 are returned. § Verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 3 using the all data qualifier 0x06. Verify that the device responds with a Null Response. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the device responds with only Class 3 events in a single response. Verify that only objects in table 8-4 are returned. § Verify that the device requests an application layer confirm. Issue a request for Object 60 Variation 4 using the all data qualifier 0x06. Verify that the device responds with a Null Response. Issue a request for Object 60 Variations 2,3 and 4 using the all data qualifier 0x06. Verify that the device responds with a Null Response. 8.6 Indications The Internal Indications is an information element used to convey internal states and diagnostic results of a device. If a specific indication is not supported it must be reported as de-asserted (0) in all cases. 8.6.1 Restart The Restart Bit of the Internal Indications field is set to 1 when the user application at the device restarts, i.e. a device's input power is cycled. This bit is cleared when the master station writes a 0 into this location. 8.6.1.1 Desired Behavior • • The DUT, after a power cycle, must set IIN1-7. The host can clear this bit by writing to the Internal Indications Object (Object 80, Variation 01). 8.6.1.2 Test Procedure 1. 2. 3. 4. 5. Cycle the power to the DUT. Issue a request for Object 60 Variation 2. Verify that the device responds with IIN1-7 set indicating that the device has been restarted. Issue a Write to Object 80 Variation 1 using the qualifier 0x00. Use a start index of 7 and a stop index of 7, followed by the value 0. Verify that the device responds with a Null Response and that IIN1-7 is cleared. DNP3-2003 IED Certification Procedure Subset Level 2 Page 38 Rev 2.3 – 29-Sept-03 8.6.2 Bad Function 8.6.2.1 Desired Behavior • • If a device receives a message containing an unsupported function code it must return an Error Response with IIN2-0 set. After a device has issued a message containing a valid function code, the response shall have no Error IIN bits set. 8.6.2.2 Test Procedure 1. 2. 3. 4. Issue a request for Object 60 Variation 1, Qualifier 0x06, using a Function Code of 0x70. Verify that the device responds with an Error Response with IIN2-0 set indicating that the device has received a message containing a bad function code. Issue a request for Object 60 Variation 1, Qualifier 0x06, using a Function Code of 0x01. Verify that the device responds with none of the Error IIN bits set. 8.6.3 Object Unknown 8.6.3.1 Desired Behavior • • If a device receives a message containing an unknown object, it must return an Error Response with IIN2-1 set. After a device has issued a message containing a valid function code, the response shall have no Error IIN bits set. 8.6.3.2 Test Procedure 1. 2. 3. 4. Issue a request for Object 0 Variation 0, Function Code 0x01. Verify that the device responds with an Error Response with IIN2-1 set indicating that the device has received a message containing an unknown Object code. Issue a request for Object 60 Variation 1. Verify that the device responds with none of the Error IIN bits set. 8.6.4 Local 8.6.4.1 Desired Behavior • • If the device supports control outputs and supports placing them in a local or disabled stated then it must set IIN1-5 whenever some or all of the control outputs are in the Local or Disabled state. If the device supports individual control point supervisory control, each object must set the Local Forced Data bit when the corresponding point is in the Local or Disabled state. 8.6.4.2 Test Procedure for Devices with Global Remote Supervisory Control 1. 2. 3. 4. 5. 6. 7. If the DUT does not support placing its binary outputs in a local state no further testing is required in this section. If the DUT supports a global feature for enabling or disabling remote supervisory control, ensure that this is set to the “Enabled” or “Remote” mode. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. Verify that the device responds with a valid message and that IIN1-5 is cleared. Change the DUT’s global switch to the “Disabled” or “Local” mode. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. Verify that the device responds with a valid message and that IIN1-5 is set. 8.6.4.3 Test Procedure for Devices with Individual Remote Supervisory Control 1. 2. 3. 4. If the DUT does not support placing its binary outputs in a local state, no further testing is required in this section. If the device allows for individual control point remote supervisory control, all points should be set to the “Enabled” or “Remote” mode. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. Verify that the device responds with Object 10 Variation 2 and that IIN1-5 is cleared. Page 39 Rev 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 5. 6. 7. 8. 9. Verify that each object has the "On-line" bit is set, the "State" bit either set or cleared, and all the remaining bits clear. Change a single remote supervisory control switch or setting to the “Disabled” or “Local” mode. Issue a request for Object 10 Variation 0 using the all data qualifier 0x06. Verify that the device responds with Object 10 Variation 2 and that IIN1-5 is set. Verify that the appropriate object has the "On-line" bit is set, the "State" bit either set or cleared, the "Local forced data" bit set, and all the remaining bits clear. 8.6.5 Broadcast Address and All Stations Indication 8.6.5.1 Desired Behavior • • • • • • The DUT must execute any request sent to the broadcast address § The DUT must not respond in any way to any request sent to the broadcast address The DUT must set the All Stations Internal Indication (IIN1-0) in the next response it transmits The DUT must clear the All Stations Internal Indication on the next response following the one in which it was set. § Messages sent to address 0xFFFE require that the IIN1-0 bit must be returned with the application layer request for confirmation bit (Application Control, bit 5) set. IIN1-0 may not be cleared in the slave until the confirmation is received. § Messages sent to address 0xFFFD request the IIN1-0 bit to be returned with the application layer request for confirmation bit (Application Control, bit 5) suppressed. IIN1-0 will be cleared in the slave upon transmitting the first response from the slave. Note: IIN1-0 may be reported in conjunction with responses to requests that otherwise require confirmation, or with an unsolicited event report, and since these requests/responses otherwise require confirmation, the confirmation will not be suppressed even though the message is sent with IIN1-0 set. Thus the use of the FFFD broadcast address implies that confirmation requests in responses sent with the IIN1-0 set should be suppressed, but that the confirmation may be requested if required by the details of the response being issued. 8.6.5.2 § Test Procedure Cycle the power to the DUT. Issue a link reset using link control block 0xC0. Issue a request for Object 60 Variation 2. Verify that the device responds with IIN1-7 set indicating the device has been restarted. Issue a Write to Object 80 Variation 1 using the qualifier 0x00. Use a start index of 7 and a stop index of 7, followed by the value 0 using the broadcast address (0xFFFF). Request a data link layer confirmation. 6. Wait a reasonable application layer timeout, for example, 2 seconds. 7. Verify that the device does not respond, with either a data link layer confirmation or a response to the Write operation. 8. Issue a request for Object 60 Variation 2. 9. Verify the DUT responds with a valid response with IIN1-7 (restart) cleared and IIN1-0 (all stations message received) set. 10. Send an application layer confirmation if requested. 11. Issue a request for Object 60 Variation 2. 12. Verify the DUT responds with a Null Response with both IIN1-7 and IIN1-0 cleared. 1. 2. 3. 4. 5. 8.6.5.3 Test Procedure 1. 2. 3. 4. 5. 6. 7. 8. 9. Issue a Direct Operate No Acknowledgement using Object 12 Variation 1 to an installed point using 8-bit indexing (qualifier 0x17), a control code supported by the device and an appropriate on/off-time using the broadcast address (0xFFFF). If the device does not support control outputs, perform this operation using Object 41 Variation 2. Verify the requested output operation was executed. Wait a reasonable application layer timeout, for example, 2 seconds. Verify that the device does not respond. Issue a request for Object 60 Variation 2. Verify the DUT responds with IIN1-0 (all stations message received) set. Send an application layer confirmation if requested. Issue a request for Object 60 Variation 2. Verify the DUT responds with a Null Response with IIN1-0 cleared. Page 40 Rev 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 8.6.5.4 § Test Procedure, Confirmed Response Options 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. Cycle the power to the DUT. Issue a link reset using link control block 0xC0. Issue a request for Object 60 Variation 2. Verify that the device responds with IIN1-7 set indicating the device has been restarted. Issue a Write to Object 80 Variation 1 using the qualifier 0x00. Use a start index of 7 and a stop index of 7, followed by the value 0. Specify broadcast address FFFE. Request a data link layer confirmation using link control block 0xF3. Wait a reasonable application layer timeout, for example, 2 seconds. Verify that the device does not respond, with either a data link layer confirmation or a response to the Write operation. Issue a request for Object 60 Variation 2. Verify the DUT responds with a Null Response with IIN1-7 (restart) cleared and IIN1-0 (all stations message received) set, and an application layer confirmation requested. Before sending the requested confirmation, repeat the request for Object 60 Variation 2, and verify that IIN1-0 is still set in the response. Send the application layer confirmation. Issue a request for Object 60 Variation 2. Verify the DUT responds with a Null Response with both IIN1-7 and IIN1-1 cleared. Repeat steps 1-13 using address FFFD as the broadcast address. In step 9, verify that an application layer confirmation is NOT requested. In step 10, verify that IIN1-0 is not set in the response. Note: Step 11 will not be necessary. 8.6.6 Buffer Overflow The Buffer Overflow Bit of the Internal Indications field is set to 1 when any event buffers overflow such that change event data is subsequently being lost. This bit is cleared when the master station confirms change event data from the DUT, hence making event buffer space available. 8.6.6.1 Desired Behavior • • The DUT must set IIN2-3 after a given event buffer overflows such that change events are being lost. The DUT must clear IIN2-3 after a master confirms a change event(s) from the DUT such that event buffer space is made available. 8.6.6.2 Test Procedure 8.6.6.2.1 1. Buffer Overflow, Binary Input Change Event Buffers If the device does not support Binary Input Change Events, end testing of Buffer Overflow, Binary Input Change Event Buffers. 2. Issue a request for Object 60 Variations 2,3 and 4 using the all data qualifier 0x06 to empty the device of pending events. 3. Obtain the maximum Binary Input Change Event buffer size from the device documentation and generate this number of corresponding events on the DUT. 4. Issue a request for Object 60 Variation x (appropriate Class) using the all data qualifier 0x06, but DO NOT issue an application confirm to the device. 5. Verify that IIN2-3 is NOT set. 6. Generate 1 additional change event of this type on the DUT. 7. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 8. Verify that the device returns a single Binary Input Change Event and IIN2-3 is set. 9. Issue an application layer confirmation. 10. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 11. Verify that the device returns a single Binary Input Change Event and IIN2-3 is not set. 12. Issue an application layer confirmation. 8.6.6.2.2 1. Buffer Overflow, Analog Input Change Event Buffers If the device does not support Analog Input Change Events, or does not queue multiple events for the same point, end testing of Buffer Overflow, Analog Input Change Event Buffers. Page 41 Rev 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 Issue a request for Object 60 Variations 2,3 and 4 using the all data qualifier 0x06 to empty the device of pending events. Obtain the maximum Analog Input Change Event buffer size from the device documentation and generate this number of corresponding events on the DUT. 4. Issue a request for Object 60 Variation x (appropriate Class) using the all data qualifier 0x06, but DO NOT issue an application confirm to the device. 5. Verify that IIN2-3 is NOT set. 6. Generate 1 additional change event of this type on the DUT. 7. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 8. Verify that the device returns a single Analog Input Change Event and IIN2-3 is set. 9. Issue an application layer confirmation. 10. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 11. Verify that the device returns a single Analog Input Change Event and IIN2-3 is not set. 12. Issue an application layer confirmation. 2. 3. 8.6.6.2.3 1. Buffer Overflow, Binary Counter Change Event Buffers If the device does not support Binary Counter Change Events, or does not queue multiple events for the same point, end testing of Buffer Overflow, Binary Counter Change Event Buffers. 2. Issue a request for Object 60 Variations 2,3 and 4 using the all data qualifier 0x06 to empty the device of pending events. 3. Obtain the maximum Binary Counter Change Event buffer size from the device documentation and generate this number of corresponding events. 4. Issue a request for Object 60 Variation x (appropriate Class) using the all data qualifier 0x06, but DO NOT issue an application confirm to the device. 5. Verify that IIN2-3 is NOT set. 6. Generate 1 additional change event of this type. 7. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 8. Verify that the device returns a single Binary Counter Change Event and has set IIN2-3. 9. Issue an application layer confirmation. 10. Issue a request for Object 60 Variation x using the limit data qualifier 0x07 requesting a single change. 11. Verify that the device returns a single Binary Counter Change Event and IIN2-3 is no longer set. 12. Issue an application layer confirmation. 8.7 Time § If the device sets IIN1-4, the Device Profile must state the worst case values for the following parameters for the full operating temperature and support all of the tests in this section. • Time base drift over a 10-minute interval. • Maximum delay measurement error. • Maximum internal time reference error when set from the protocol. • Maximum response time. If a device does not set IIN1-4 it need not support any of the tests in this section. 8.7.1 Delay Measurement This function is used to calculate the communication delay for a particular device. The device will respond to a Time Delay Measurement request with the number of milliseconds elapsed between the device receiving the first bit of the first byte of the request and the time of transmission of the first bit of the first byte of the response. 8.7.1.1 Desired Behavior • § The device must respond to a Delay Measurement request with a Time Delay Fine response. 8.7.1.2 Test Procedure 1. Issue a request for Delay Measurement using Function Code 23, to the DUT. DNP3-2003 IED Certification Procedure Subset Level 2 Page 42 Rev 2.3 – 29-Sept-03 2. 3. 4. Verify that the device replies with Object 52 Variation 2 Qualifier 0x07 Quantity 1 and a millisecond time stamp of the measured delay. Verify that the accuracy of the delay reported is within the maximum error specified in the Device Profile Document. Perform the test two more times to guarantee repeatability. 8.7.2 Synchronization The Time and Date Object (Object 50 Variation 01) is an information object that represents the absolute time of day and date, recorded as milliseconds since midnight, January 1, 1970, at zero minutes, zero seconds, and zero milliseconds. This object is usually used for time-synchronization. Note that the following procedures verify the mechanics of time synchronization, verify that the time format is correct, and that synchronization appears to have occurred. The actual accuracy of time synchronization is dependent on device accuracy and system configuration and should be tested separately (factory and/or site acceptance tests). 8.7.2.1 Desired Behavior • • The device must respond to a Time and Date object by null response with IIN1-4 cleared. § The Device Profile must specify the maximum time from startup to IIN1-4 assertion. 8.7.2.2 Test Procedure 1. 2. 3. 4. 5. 6. 7. 8. 9. Reset the DUT. Wait the specified maximum time from reset to IIN1-4 assertion. Issue a request for Object 60 Variation 2 using the all data qualifier 0x06. Verify that the device responds with a valid message and that IIN1-4 is set indicating that the device is requesting time synchronization. Set the time and date using a WRITE request and Object 50 Variation 1 with Qualifier 0x07 taking into account the delay measured in the previous section. Verify that the device responds with a Null Response and that IIN1-4 is cleared indicating the device no longer needs time. Generate a supported time tagged event at a known time. Issue a request for Object 60 Variation 2, 3, or 4 as appropriate, using the all data qualifier 0x06. Verify that the device responds with a valid time tagged event and that the time reported is within the maximum error specified in the Device Profile Document. 8.8 • Cold Restart 8.8.1 Desired Behavior The device must respond to a Cold Restart request by sending a Time Delay response, restarting, and setting IIN1-7. 8.8.2 Test Procedure 1. 2. 3. 4. 5. 6. 7. 8. Issue a request for Cold Restart using Function Code 13, to the DUT. Verify the response is a Time Delay Fine or Coarse (Object 52 Variation 1 or Variation 2). If the DUT requests an Application Layer Confirm send it before starting the wait period. Wait for a period of time longer than the time returned in step 2. Issue a request for Object 60 Variation 1. Verify that the device responds with IIN1-7 set indicating that the device has been restarted. Issue a Write using Object 80 Variation 1 with the qualifier 0x00. Use a start index of 7 and a stop index of 7, followed by the value 0. Verify that the device responds with a Null Response and that IIN1-7 is cleared. DNP3-2003 IED Certification Procedure Subset Level 2 Page 43 Rev 2.3 – 29-Sept-03 8.9 Application Layer Fragmentation 8.9.1 Use of FIR, FIN and SEQUENCE in Fragmentation 8.9.1.1 Desired Behavior If the DUT can generate enough data to create multiple application layer fragments, it must meet the following criteria: • • • • • • • • The application layer FIR bit must be set in the first fragment (only). The application layer FIN bit must be set in the final fragment (only). The application layer sequence number of the first fragment must match that of the request. The application layer sequence number must increment between fragments. Transport layer segmentation must operate correctly within each fragment. The fragment size must be able to be configured to be no larger than 2048 octets. If the fragment size is configurable, it must behave accordingly. If the device cannot generate more than one fragment, the FIR and FIN bits in the application layer header must signify that there is only one APDU in the reply. 8.9.1.2 Test Procedure If the DUT has a configurable fragment size, configure it to be no more than 2048 octets. Cycle power to the DUT. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06, if this will generate a multi-fragment response. Alternately, generate enough event data to fill more than one fragment and request the appropriate class of data with Qualifier Code 0x06. 4. Verify that the DUT responds with valid data. 5. Verify that the sequence number of the first fragment matches the request. 6. Verify that each fragment of the response contains no more than the configured fragment size. 7. If the DUT’s reply contains only a single fragment then verify the FIR bit is set to one and the FIN bit is also set to one. If there is no way to cause the DUT to generate multiple fragments, i.e. its Class 0 response is less than a fragment and it does not support event data, no further testing is required in the Application Layer Fragmentation section. 8. If the DUT’s reply contains more than one fragment then verify that the first response message sets the FIR bit to a one, the FIN bit is set to zero. 9. Verify subsequent fragments to assure that the FIR bit is zero, the FIN bit is zero, and the sequence number increments by one. 10. Verify that the last fragment has the FIR bit cleared and the FIN bit set, signifying the last data fragment. 11. Verify each fragment is properly segmented by the transport layer as described in that section of this document. 12. If the DUT’s fragment size is configurable, repeat this test with a different fragment size and verify the data for each fragment does not exceed the configured size. 1. 2. 3. 8.9.2 § Use of Confirmation in Fragmentation 8.9.2.1 § Desired Behavior • • • The DUT must request an application layer confirmation between fragments. The DUT must not send subsequent fragments until it receives confirmation of the previous fragment, with a correct sequence number. The DUT must not send subsequent fragments if it does not receive a valid confirmation within a timeout. NOTE: The DUT is not required to request application layer confirmation on the last fragment of a response (unless required for other reasons tested elsewhere in this document). DNP3-2003 IED Certification Procedure Subset Level 2 Page 44 Rev 2.3 – 29-Sept-03 8.9.2.2 § Test Procedure 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06, if this will generate a multi-fragment response. Alternately, generate enough event data to fill more than one fragment and request the appropriate class of data with Qualifier Code 0x06. Verify that the DUT responds with valid data. Verify that the CON bit is set in the first fragment. Verify the sequence number matches the request. Wait the application confirmation timeout for the DUT. Do not send an application confirmation. Verify the DUT does not send the next fragment because it did not receive confirmation of the first fragment. Send the valid application layer confirmation. Verify the DUT does not send the next fragment because it has timed out. Request Class 0 data (Object 60 Variation 1) using Qualifier Code 0x06, if this will generate a multi-fragment response. Alternately, generate enough event data to fill more than one fragment and request the appropriate class of data with Qualifier Code 0x06. Verify that the CON bit is set in the first fragment. Wait a time period less than the application confirmation timeout. Verify the DUT does not send the second fragment yet. Send the valid application layer confirmation before the application confirmation timeout. Verify that the DUT sends the second fragment (with FIR, FIN and sequence number set correctly). Verify that the CON bit is set in the second fragment if a third fragment is expected. If a third fragment is expected, skip to step 16. If not, first send a valid application layer confirmation and then a request for multi-fragment data as in steps 1-3. Send an application layer confirmation with an incorrect sequence number. Wait the application layer confirmation timeout for the DUT. Do not send an application confirmation. Verify the DUT does not send the next fragment because the confirmation it received was invalid. Send the valid application layer confirmation. Verify the DUT does not send the next fragment because it has timed out. 8.10 Multi-Drop Support 8.10.1 Desired Behavior • • The DUT must only respond to requests when the destination address field of the link layer portion of the request matches its assigned DNP address. The DUT must remain silent in all other cases. This includes not raising carrier (e.g. asserting RTS) during periods in which it is not responding. 8.10.2 Test Procedure 1. 2. 3. 4. 5. 6. 7. 8. 9. If the DUT does not support multi-drop physical layers, this must be noted on the Implementation Conformance Statement and in the Device Profile Document. No further testing is required in this section. Connect the DUT and at least two additional DNP devices to the same communications drop. Connect an oscilloscope and/or protocol analyzer to the DUT communications signals. Issue a request for Object 60 Variations 2,3, and 4 using the all data qualifier 0x06 to each of the other devices on the communications channel. Verify that the DUT does not respond in any way, including raising carrier or asserting RTS. Issue a request for Object 60 Variations 2,3, and 4 using the all data qualifier 0x06 to the broadcast address. Verify that the DUT does not respond in any way, including raising carrier or asserting RTS. Issue a request for Object 60 Variations 2,3, and 4 using the all data qualifier 0x06 to the DUT. Repeat as necessary to verify that the DUT responds in an appropriate manner for the physical layer which may include: a) Raising carrier (or asserting RTS) an appropriate period of time before transmitting the first bit of data. b) Dropping carrier (or de-asserting RTS) an appropriate period of time after transmitting the last bit of data. DNP3-2003 IED Certification Procedure Subset Level 2 Page 45 Rev 2.3 – 29-Sept-03 c) If the pre and post RTS to transmit delay parameters are configurable, repeat this test for the lower of the two following cases. i) the total number of selections or ii) the minimum, maximum, and two intermediate values 8.11 Unsolicited Responses Support for unsolicited responses is optional. If a device does not support unsolicited responses, this section may be skipped in its entirety. Although unsolicited responses may be used with collision avoidance, the two features are independent. For instance, a device might not support collision avoidance, but support unsolicited responses in a dial-up environment. Therefore, all that is needed to test unsolicited responses is a full-duplex serial connection to the DUT. 8.11.1 Desired Behavior 8.11.1.1 Configuration Devices that support unsolicited responses must support end-user configuration of the following parameters (e.g.: by front-panel user interface or off-line configuration): • The destination address of the Master device to which the unsolicited responses are to be sent. • The unsolicited response mode (either “on” or “off”). When the unsolicited response mode is configured “off”, the device is to behave exactly like an equivalent device that has no support for unsolicited responses. • § The unsolicited confirmation timeout. This is the amount of time between transmissions of unconfirmed unsolicited responses. The range of configurable values must include 1 second to 1 minute, but may be extended in either direction (slower or faster) to take advantage of, or to compensate for, faster or slower devices or communications media. This may be either the normal application confirmation timeout, or another parameter that performs the same purpose only for unsolicited responses. • § Maximum number of unsolicited retry attempts. One of the choices must provide for an indefinite (and potentially infinite) number of retries. 8.11.1.2 Sequence Numbers and Confirmation At all times: • Application layer sequence numbers (the value of bits 0–4 of the application layer control field) must be in the correct range for all messages sent: 0–15 for polled responses and 16–31 for unsolicited responses. • Ignore Master device application layer confirmations of unsolicited responses if their sequence numbers do not match those of the corresponding unsolicited responses. • § All unsolicited response messages must request application layer confirmation, regardless of whether they are null (no data) or contain data. 8.11.1.3 Restart Behavior If the unsolicited response mode is configured “on,” then upon device restart: • The device must transmit an initial unsolicited response message. • The initial unsolicited response message must have the restart bit (IIN1-7) set if the Master has not already sent a command to clear it. • § The initial unsolicited response message must be null; i.e., it must not contain static or event data objects. • § The initial unsolicited response message must request an application layer confirmation, regardless of whether the message has the restart bit (IIN1-7) set. • § The device must continue to transmit initial null unsolicited responses forever at the rate set by the unsolicited confirmation timeout, until that initial unsolicited response message is confirmed. • § The device must respond to all function requests to which it would normally respond, including READ function requests, while waiting for the confirmation of the initial unsolicited response. DNP3-2003 IED Certification Procedure Subset Level 2 Page 46 Rev 2.3 – 29-Sept-03 • § The device must not send any more unsolicited responses after the initial null unsolicited response message has been confirmed, until a function code 0x14 (enable data-filled unsolicited messages) request has been received. Note: Enabling and disabling exception reporting does not enable/disable the storage of the events, just the reporting. 8.11.1.4 Runtime Behavior Once an initial unsolicited response message has been confirmed, then the device must: • § Process function code 0x14 requests (to enable data-filled unsolicited messages). This enabled status must not be retained through a device restart; i.e. data-filled unsolicited messages are always disabled on restart. • § Process function code 0x15 requests (to disable data-filled unsolicited messages). This disabled status does not apply to initial null unsolicited responses; i.e., if function code 0x15 is requested, and if no off-line configuration is altered, then after restart, an initial unsolicited response message must again be transmitted. • § At a minimum, support the enabling and disabling of unsolicited responses for Class 1, 2, and 3 data. Even if the device does not have Class 1, Class 2, or Class 3 data, it must respond to function codes 0x14 and 0x15, object 60, and variations 2, 3 and 4 without error responses. • Only send unsolicited responses for those classes of data that have been enabled. • Unsolicited response messages must contain only the following kinds of data: event data, or static data for which no event object types exist: binary output status (Object 10 Variation 2) and analog output status (Object 40 Variation 2). Note, when static data is returned in unsolicited responses, the rules for event processing still apply as specified in section 3.4. 8.11.1.5 • Unsolicited and Polled Responses • • • • • • If an unsolicited response message containing event data is not confirmed, the device must timeout, retain the event data, and re-transmit the event data either in subsequent unsolicited response messages or in polled response messages. The event data does not have to be re-transmitted exactly (new change events may have occurred, or, for example, analog input change events may be updated to reflect new current values of analog inputs). Once an unsolicited response message containing event data is confirmed, the event data must be cleared from the device and no longer transmitted in subsequent unsolicited or polled responses. The device cannot generate unsolicited responses if it is waiting for an application confirmation to a previous polled or unsolicited response. If a non-READ function code request is received while waiting for a confirmation of an unsolicited response, the device must immediately process it. § If a READ function code request is received while waiting for a confirmation of an unsolicited response, the device must defer responding to the READ request (the READ request is therefore “pending”) until after either the unsolicited confirmation timeout occurs, or the confirmation of the unsolicited response is received. § The device cannot generate an additional unsolicited response until it has responded to a pending READ request. § If a READ function code request is pending while waiting for a confirmation of an unsolicited response, and another (new) function code request is received, the original READ function code request must be abandoned (with no response transmitted), and the new function code should be processed according the desired behavior rules of this section. 8.11.2 Test Procedure Unless explicitly specified by the tests in these sections, do not issue any requests to the DUT, including: requests to clear the restart bit (IIN1-7); READ requests for data; application layer confirmations and requests to enable or disable unsolicited responses. Similarly, do not allow the Master being used to test the device to issue any of these requests automatically. 8.11.2.1 1. 2. Unsolicited Response Configuration/Startup Verify that the DUT has off-line capability to configure the unsolicited response mode (either “on” or “off”). Use this capability to configure the unsolicited response mode to “on.” § Verify the DUT has off-line capability to configure the unsolicited confirmation timeout. Verify that it can be set to at least as small as 1 second, and to at least as large as 1 minute. DNP3-2003 IED Certification Procedure Subset Level 2 Page 47 Rev 2.3 – 29-Sept-03 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. 18. 19. 20. 21. 22. 23. 24. 25. 26. 27. 28. 29. 30. For the remainder of Section 8.11.2.1, set this time to be 5 seconds. (The value of 5 seconds is arbitrary, and is used to simplify the description and execution of this test. As a further simplification for the purposes of this test, when the test steps below exercise and rely upon this value, measurement accuracy can be within 0.5 seconds. It is not the purpose of this test to verify the full range of this parameter, nor is it the purpose of this test to verify the accuracy of the time keeping capability of the DUT. It is the purpose of this test, however, to verify that the parameter has been implemented.) Verify the DUT has off-line capability to configure the destination address of the Master device to which unsolicited responses are to be sent. Use this capability to configure a specific destination address. Cycle power to the DUT. Verify that the DUT transmits an initial unsolicited response to the configured Master destination address. Use the off-line configuration capability to configure the destination address to a different destination address. Cycle power to the DUT. Verify that an initial unsolicited response is transmitted by the DUT. Verify that the unsolicited response contains the restart bit (IIN1-7) set. § Verify that the unsolicited response is null (contains no data). § Verify that the unsolicited response requests an application layer confirmation. Verify that the application sequence number is in the correct range. Verify that it has been transmitted to the configured Master destination address. Wait at least 10 seconds, and verify that two or more unsolicited responses are transmitted by the DUT. Verify that these new unsolicited responses are transmitted no more often, and no less often, than once every 5 seconds. Verify that the restart bit (IIN1-7) remains set in these unsolicited responses. § Verify that the unsolicited responses are null (contains no data). § Verify that the unsolicited responses request application layer confirmations. Issue a request to clear the restart bit (IIN1-7). Verify that the DUT responds with a null response that has the restart bit (IIN1-7) cleared. Wait at least 5 seconds, and verify that another unsolicited response is transmitted by the DUT. Verify that the restart bit (IIN1-7) is clear in the unsolicited responses. Issue a READ request (function code 0x01) for Object 60 Variation 1 (class 0) using the all data qualifier 0x06. § Verify that the DUT responds to the READ request with class 0 data. Wait at least 5 seconds, and verify that another unsolicited response is transmitted by the DUT. Issue an application layer confirmation of the unsolicited response, but use an incorrect application-layer sequence number. Wait at least 5 seconds, and verify that another unsolicited response is transmitted by the DUT. Issue an application-layer confirmation of the unsolicited response, and use the correct application-layer sequence number. Generate known events. § Verify that no further unsolicited responses are transmitted by waiting for such responses for at least 5 seconds. 8.11.2.2 1. 2. 3. 4. 5. 6. 7. 8. 9. Unsolicited Response - Class 1 Data Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60, Variation 2; Object 60, Variation 3; and Object 60, Variation 4. Verify that the DUT responds with a null response indicating the request was processed without error. If the DUT has Class 1 data, generate such data. For example, if there is a binary input change event that is (or can be assigned to) Class 1, then ensure that it is assigned to Class 1, and generate one such event. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Issue a request to enable unsolicited responses for Class 1 data by using function code 0x14, object 60, Variation 2. Verify that the DUT responds with a null response indicating the request was processed without error. If it is not possible to generate Class 1 data that would generate unsolicited responses, steps 8 through 14 are not applicable. Verify that an unsolicited response is transmitted. This may involve waiting for an amount of time, dictated by the DUT and specified by the DUT’s Device Profile Document, within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. Verify that the unsolicited response requests an application layer confirmation. Page 48 Rev 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 10. Verify that the application sequence number is in the correct range. 11. Without issuing an application layer confirmation, wait for the unsolicited confirmation timeout to expire, and verify that another unsolicited response is transmitted by the DUT. 12. Verify that at least the same event data is present in the unsolicited response. (It is not required that the unsolicited responses be identical. For data such as analog input change events, the data may be updated to reflect current values. It is also possible for new event data to have been generated.) 13. Issue an application layer confirmation of the unsolicited response, but use an incorrect application-layer sequence number. 14. Wait for the unsolicited confirmation timeout to expire, and verify that another unsolicited response is transmitted by the DUT, still containing the same event data. 15. Issue an application-layer confirmation of the unsolicited response, and use the correct application-layer sequence number. 16. If the DUT has Class 2 data, then generate such data. If the DUT has Class 3 data, then also generate Class 3 data. 17. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. 8.11.2.3 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. Unsolicited Response - Class 2 Data Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60, Variation 2; Object 60, Variation 3; and Object 60, Variation 4. Verify that the DUT responds with a null response indicating the request was processed without error. If the DUT has Class 2 data, generate such data. For example, if there is a binary input change event that is (or can be assigned to) Class 2, then ensure that it is assigned to Class 2, and generate one such event. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Issue a request to enable unsolicited responses for Class 2 data by using function code 0x14, Object 60, Variation 3. Verify that the DUT responds with a null response indicating the request was processed without error. If it is not possible to generate Class 2 data that would generate unsolicited responses, steps 8 through 14 are not applicable. Verify that an unsolicited response is transmitted. This may involve waiting for an amount of time, dictated by the DUT and specified by the DUT’s Device Profile Document, within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. Verify that the unsolicited response requests an application layer confirmation. Verify that the application sequence number is in the correct range. Without issuing an application layer confirmation, wait for the unsolicited confirmation timeout to expire, and verify that another unsolicited response is transmitted by the DUT. Verify that at least the same event data is present in the unsolicited response. (It is not required that the unsolicited responses be identical. For data such as analog input change events, the data may be updated to reflect current values. It is also possible for new event data to have been generated.) Issue an application layer confirmation of the unsolicited response, but use an incorrect application-layer sequence number. Wait for the unsolicited confirmation timeout to expire, and verify that another unsolicited response is transmitted by the DUT, still containing the same event data. Issue an application-layer confirmation of the unsolicited response, and use the correct application-layer sequence number. If the DUT has Class 1 data, then generate such data. If the DUT has Class 3 data, then also generate Class 3 data. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. 8.11.2.4 1. 2. 3. Unsolicited Response - Class 3 Data Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60, Variation 2; Object 60, Variation 3; and Object 60, Variation 4. Verify that the DUT responds with a null response indicating the request was processed without error. If the DUT has Class 3 data, generate such data. For example, if there is a binary input change event that is (or can be assigned to) Class 3, then ensure that it is assigned to Class 3, and generate one such event. Page 49 Rev 2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 dictated by the DUT and specified by the DUT’s Device Profile Document. Issue an application-layer confirmation of the unsolicited response.5 Unsolicited and Polled Responses This is a complicated test procedure. 17. DNP3-2003 IED Certification Procedure Subset Level 2 Page 50 Rev 2.2. or 3 event data.11. Object 60.5. For data such as analog input change events. 5. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. 2. and Object 60. still containing the same event data. 11. Variation 3. The test has been divided into sections for clarity. then also generate Class 2 data. Verify that the unsolicited response requests an application layer confirmation.3 – 29-Sept-03 .) Issue an application layer confirmation of the unsolicited response. Wait for the unsolicited confirmation timeout to expire. 14. This may involve waiting for an amount of time. 13. 6. Verify that at least the same event data is present in the unsolicited response. the data may be updated to reflect current values. Variation 2. and 4 using the all data qualifier 0x06. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Verify that the DUT immediately responds without error.2. 8. 4. Verify that the unsolicited response requests an application layer confirmation. 7. 3. Variation 4. wait for the unsolicited confirmation timeout to expire. dictated by the DUT and specified by the DUT’s Device Profile Document. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message.3 Processes non-READ requests immediately 1.11. and verify that another unsolicited response is transmitted by the DUT. 2.11. 10. Issue an application-layer confirmation of the unsolicited or polled response. Verify that the DUT responds with a null response indicating the request was processed without error. Generate class 1.1 Transmits data-filled unsolicited responses 1. issue a function code request other than READ (for example. 2. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response.2. Wait for this unsolicited response to be sent.4. It is also possible for new event data to have been generated. Issue a READ request (function code 0x01) for Object 60 Variations 2. If the DUT has Class 2 data. but use an incorrect application-layer sequence number. and verify that another unsolicited response is transmitted by the DUT.5. Issue a request to enable unsolicited responses for Class 3 data by using function code 0x14. If it is not possible to generate Class 2 data that would generate unsolicited responses. Verify that none of the event data transmitted by the unsolicited response is contained in the polled response. 16. function code 0x02 – WRITE to clear the restart flag IIN1-7). and use the correct application-layer sequence number. Wait for the unsolicited confirmation timeout to expire. 3. Variation 4. 8. and verify that another unsolicited response is transmitted by the DUT. 8. 9. 2. 8. Verify that an unsolicited response is transmitted. Without issuing an application layer confirmation.2 Clears transmitted data upon confirmation 1. or 3 event data to trigger the transmission of an unsolicited response. If the DUT has Class 1 data.5. 3. then generate such data. steps 8 through 14 are not applicable. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. Verify that the application sequence number is in the correct range.2.11. 12. 15. Verify that the DUT responds with a null response indicating the request was processed without error. 2. 8. 4. Generate class 1. Verify that an unsolicited response is transmitted. 5. This may involve waiting for an amount of time. Object 60. (It is not required that the unsolicited responses be identical. 3. Without issuing an application layer confirmation. Immediately after the unsolicited response.5. Verify that the polled response is a response to the request for Object 60. or 3 event data to trigger the transmission of an unsolicited response. 8. issue a READ request (function code 0x01) for Object 60 Variations 2.6 Abandons READ requests upon subsequent non-READ requests 1. 8. 4. Verify that the polled response requests an application layer confirmation. After the unsolicited confirmation timeout. Wait for this unsolicited response to be sent.7 Abandons READ requests upon subsequent READ requests 1. Verify that the event data in this unsolicited response includes the events reported in the previous unsolicited response that was not confirmed. the data may be updated to reflect current values. After the unsolicited confirmation timeout. Wait for an amount of time less than the unsolicited confirmation timeout and verify that the DUT does not respond. Variations 2. Verify that the DUT immediately responds without error. Variations 2. Issue an application-layer confirmation of the polled response to clear the device of event data. and without issuing an application layer confirmation. 5. Before the unsolicited confirmation timeout.11. If the polled response requested an application layer confirmation. issue a READ request (function code 0x01) for Object 60 Variations 2. Issue an application-layer confirmation of the unsolicited response before the unsolicited confirmation timeout occurs. 3. 3.5. Verify that the DUT does not respond within the unsolicited confirmation timeout.5. 7. 5. 3.2. 2.11. and 4 using the all data qualifier 0x06. and without issuing an application layer confirmation. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. and 4. or 3 event data to trigger the transmission of an unsolicited response. 5.5. Verify that the DUT does not respond within the unsolicited confirmation timeout. For data such as analog input change events. 2. 5. and without issuing an application layer confirmation. 3. and then verify that another unsolicited response is transmitted by the DUT. 8. 2. It is also possible for new event data to be generated. It is not required that the unsolicited responses be identical. Before the unsolicited confirmation timeout.2. 3. verify that the device responds with a polled response to the Object 60. 6. using the all data qualifier 0x06. Wait for this unsolicited response to be sent. Immediately after the unsolicited response. 4. 3. Verify that none of the event data transmitted by the unsolicited response is contained in the polled response. 3. and 4 READ request (and not an unsolicited response).11. Verify that the event data in this unsolicited response includes the events reported in the previous unsolicited response that was not confirmed. issue a READ request (function code 0x01) for Object 60 Variations 2. 2. and 4 using the all data qualifier 0x06. verify that it contains class 1. issue a READ request for Object 60. 3. 4.2. and 4 using the all data qualifier 0x06.2. 8. Generate class 1. or 3 data and not class 0 data. verify that the device responds with a polled response to the READ request (and not an unsolicited response). Immediately after the unsolicited response. in other words. Wait for the unsolicited confirmation timeout to expire. 2.5 Defers READ requests until after confirmation timeout 1. 3.4 Defers READ requests until after confirmation received 1. DNP3-2003 IED Certification Procedure Subset Level 2 Page 51 Rev 2. 3. 6.3 – 29-Sept-03 . then issue an application-layer confirmation of the polled response. Immediately after the unsolicited response. 4.5.11. 2. and 4 – not Variation 1. Generate class 1. issue a READ request (function code 0x01) for Object 60 Variation 1 using the all data qualifier 0x06. and without issuing an application layer confirmation. Verify that the polled response contains at least the same event data that was in the unsolicited response that was not confirmed. Variation 2. 6. Verify that the device immediately transmits a response to the READ request. function code 0x02 – WRITE to clear the restart flag IIN1-7). 2. 8. issue a function code request other than READ (for example. 7. Cycle power to the DUT. 3. 11. Verify that the unsolicited response requests an application layer confirmation. Issue an application-layer confirmation of the polled response to clear the device of event data. After the application confirmation timeout. Verify that the DUT responds with a null response indicating the request was processed without error. 2. 2. Verify that the polled response requests an application layer confirmation. and 4 using the all data qualifier 0x06.6. 5.11. 8. Configure the maximum number of retries to indefinite. Issue an application-layer confirmation of the initial unsolicited response. 8. Before an unsolicited response is transmitted. 19. nor before any application layer retries are attempted. dictated by the DUT and specified by the DUT’s Device Profile Document. 8. Verify that events are reported in the response to the READ request 4. Verify that an unsolicited response is transmitted. issue a READ request (function code 0x01) for Object 60 Variations 2. and Object 60. Verify that the DUT does not transmit an unsolicited response within the application confirmation timeout. or 3 event data. 9. 17. Verify the DUT has off-line capability to configure the maximum number of unsolicited retries and that one of the choices causes the DUT to retry indefinitely. Verify that the DUT responds with a null response indicating the request was processed without error. 15. or 3 event data. Verify that an unsolicited response is transmitted. if there is a window of time between the generation of event data and the subsequent transmission of an unsolicited response. Verify that the polled response requests an application layer confirmation. 8. 10.5.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . 9. Variation 3. 18. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60.9 Retries unsolicited responses configurable number of times 1. then generate at least some. 7. Issue an application-layer confirmation of the unsolicited response to clear the device of event data. 13. 2. 8. Page 52 Rev 2. 3. 16. Issue a request to clear the restart bit (IIN1-7). 12. Generate class 1. 5. Object 60. 6. If the device has a minimum amount of event data that will cause the immediate transmission of an unsolicited response. 11. Variation 2. 2. 7. 3. and Object 60. If necessary.11. then the remaining steps in this procedure are not applicable. 4.5. This may involve waiting for an amount of time. Generate class 1. or 3 event data. Verify that the unsolicited response contains at least the same event data that was in the polled response that was not confirmed. Verify that no further unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Variation 3. Or. If neither of these procedures are possible. 2. generate more event data that would otherwise cause the transmission of an unsolicited response. Verify that DUT retries the response 5 times. and after any application layer retries. then generate event data and perform the next test procedure step before this time elapses. 9. Do not send an application layer confirmation.8 Inhibits Unsolicited responses until after polled confirmation 1. Verify that retries are terminated when confirmation is received. Variation 4. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. Issue an application-layer confirmation of the initial unsolicited response. 6. but less than this amount of class 1. verify that the device responds with an unsolicited response.2. 10. Variation 2. Object 60. Use this capability to configure the maximum number of retries to 5. Do not issue an application layer confirm. Verify that the polled response contains at least the same event data that was in the unsolicited response that was not confirmed. Issue an application layer confirm after at least one retry. Variation 4. within which the DUT may wait for a minimum number of events to be collected before transmission of an unsolicited message. 14.2. Cycle power to the DUT. Issue a request to clear the restart bit (IIN1-7). For instance. Variation 3. 15. For these tests. TX/RX line). Variation 2. 9. 8. 4. DNP3-2003 IED Certification Procedure Subset Level 2 Page 53 Rev 2. 14. Issue a request to clear the restart bit (IIN1-7).g. Verify that an unsolicited response is transmitted. 2. 24. 8. The test equipment must be capable of measuring time between two characters transmitted on the link. However.6 1. Variation 4. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. 21. Cycle power to the DUT. without the aid of an external device • Detecting transmitted data (e. A device may be certified as supporting collision avoidance in one of the following ways: • Detecting out-of-band carrier (e. 2. Although unsolicited responses may be used with collision avoidance.2. Unsolicited Responses Off Configure the unsolicited response mode to “off”. or 3 event data. Variation 3. the supplier must supply hardware (modems etc. 22. Issue a request for Object 60 Variations 2. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. 25. Generate several change events or other data. 26. the supplier of the DUT must specify which method the DUT uses to detect other devices are transmitting. Issue a request to enable unsolicited responses for all classes of data by using function code 0x14 with three object data headers: Object 60. 10. and Object 60. 12. Issue a request to disable unsolicited responses for all classes of data by using function code 0x15 with three object data headers: Object 60. Variation 4. 13. DCD) 1. 23. If necessary.g. if a device claims in its Device Profile Document that it implements collision avoidance. with the aid of an external device 2. Variation 2. 27. Verify that the DUT responds with a null response that has the restart bit (IIN1-7) cleared.3 – 29-Sept-03 . 3. Cycle power to the DUT. Verify that no initial unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Issue an application-layer confirmation of the initial unsolicited response. Variation 4. 28. Verify that the DUT responds with an Error Response with IIN2-0 set indicating that the DUT has received a message containing a bad function code. 6. and Object 60. 8. a device might not support collision avoidance. issue an application layer confirm. However. Generate class 1. the two features are independent.) and test equipment suitable for testing this feature. but support unsolicited responses in a dial-up environment. Variation 2. Variation 3. Verify that the DUT responds with a null response indicating the request was processed without error.20. Object 60. and 4 using the all data qualifier 0x06 to cause the DUT to report (and clear) all pending events. 11.11. Verify that no unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Verify that the DUT responds with an Error Response with IIN2-0 set indicating that the DUT has received a message containing a bad function code. it must pass the tests in this section to be compliant. If requested. and Object 60. 3. Object 60. Verify that retries continue for an extended period of time. 5. Verify that no initial unsolicited responses are transmitted by waiting for such responses for a length of time at least as great as what would be necessary for the DUT to otherwise generate an unsolicited response. Object 60.12 § Collision Avoidance The functions tested in this section are optional. which would otherwise cause an unsolicited response. Do not issue an application layer confirm. 7. Issue a request to clear the restart bit (IIN1-7). Verify the measured backoff_delay is different in each case although it remains less than the maximum backoff_delay and the length of the noise data remains constant. the DUT must meet the following requirements: • The fixed_delay and the max_random_delay must be configurable. If a device prepares to transmit and finds the link busy. Repeat steps 4 through 6 to verify the DUT will back off more than once.12. Verify the device responds with data. e.g. 11. the master would not have a random delay. • The DUT must wait the backoff_time when it tries to transmit and another device is already transmitting.unsolicited responses in a multi-drop environment require collision avoidance. DNP3-2003 IED Certification Procedure Subset Level 2 Page 54 Rev 2. The operation of collision avoidance is as follows: The physical layer must provide an indication to the data link layer of when the link is in use.3 – 29-Sept-03 . 1. Verify the delay between the end of the noise data and the start of the response is less than the maximum back_off delay and more than the fixed_delay plus the max_random_delay. Send the request. either indefinitely. 2. 9. or up to a configurable maximum number of retries. 8. Reconfigure the device with a different fixed_delay and maximum_random_delay.2 Test Procedure Request Class 1 data (Object 60 Variation 2) using Qualifier Code 0x06 and link control block 0xC4. Repeat steps 1 through 10.12. The fixed_delay can be adjusted per device to provide priority of access. 3. it could be zero (0) for masters and non-zero for all the slave devices. 4.1 Desired Behavior When implementing collision avoidance. the protocol behaves as if a link failure occurred. the DUT must wait until the line becomes free and then restart the backoff timer. The noise data may consist of a poll to a nonexistent device. Repeat steps 4 through 6 at least 10 times. 8. • The backoff_time must not exceed the fixed_delay plus the max_random_delay. it waits until it is no longer busy. 5. If a maximum is used. Verify the noise and the response do not overlap. • The DUT must transmit as quickly as possible if no other device is transmitting. To absolutely guarantee the master’s priority. 8. i. followed immediately by “noise” data sufficient to exceed the measured turnaround delay and the fixed_delay but less than the turnaround delay plus the maximum backoff_delay. The fixed_delay for the slaves must be greater than the max_random_delay for the master. then a gap in the noise less than the fixed_delay. • The backoff_time must be greater than the fixed_delay. Verify the DUT sends a response AFTER the noise data has finished transmitting. then waits a backoff_time as follows: backoff_time = fixed_delay + random( max_random_delay ) After the backoff_time. data is returned to buffers at the application layer and application layer retries take place if desired. 6. • The backoff_time must start at the moment when the other device stops transmitting. Add more noise data to the prepared request so that the noise data now exceeds several times the fixed_delay plus the max_random_delay. followed by noise several times longer than fixed_delay plus the max_random_delay. the device tries again. 7. Prepare a request for Class 1 data as above. Measure the turnaround delay between receipt of the request and the response. • If another device is still transmitting when the backoff_delay expires.e. This provides a minimum "window" of access time for the master(s). For instance. using the DCD (Data Carrier Detect) signal or simply monitoring all data on the link. 10. Verify that the DUT responds with a Null Response. Configurable Device If the device is not configurable in a manner such that Binary Input points can be uninstalled or disabled. 8. 4.2. If the device does not support Binary Input Change Events.8. the device must be configured with at least one Binary Input point installed or enabled before proceeding with the test procedure.3 – 29-Sept-03 . 6. Verify that the DUT responds with a Null Response. Device supports Binary Inputs. No further testing in this section is necessary. The device must respond with events that have occurred and have not yet been read from the device with a poll/confirm sequence. Generate binary data to various installed points. Issue a request for Object 1 Variation 0 using the all data qualifier of 0x06.2 Test Procedure 8. Verify that the device responds with Object 1 Variation 1 or 2 and the proper binary data is returned. 3. Issue a request for Object 1 Variation 0 and the all data qualifier 0x06. • Optionally.1 Desired Behavior The following behavior assumes that the device does not support binary inputs: • If the device does not support Binary Inputs.2.1 1.13. 2. 2. The device can optionally set IIN2-1.13.13. 4. If the response contains Object 1 Variation 2. 8. Issue a request for Object 1 Variation 0 using the all data qualifier of 0x06. Note #5. The following behavior assumes that the device does support binary inputs. Variation 0) with either Object 1 Variation 1 or Object 1 Variation 2.3 1. 8. Device does not have Binary Inputs Issue a request for Object 1 Variation 0 using the all data qualifier of 0x06. Verify that the DUT responds with Object 1 Variation 1 or 2 using either 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01).2. Device has Binary Inputs Generate a known binary input pattern. however there are no binary input points installed: • If the device supports Binary Inputs. 8.13 Binary Inputs If the DUT is configurable in a manner such that points can be uninstalled or disabled. 8.2 1. it must return a null response.13. it must respond to a request with a null response and no further testing in this section is necessary.14 Binary Input Change This request is used to read binary change or event data from a device. The following behavior assumes that the device supports binary inputs: • If the device supports Binary Inputs the device must respond to an Any Variation Binary Input read request (Object 1. verify that flag behavior complies with Section 2. the device can return an Error Response with IIN2-1 set. it must respond to a request with a Null Response or an Error Response setting IIN2-1. DNP3-2003 IED Certification Procedure Subset Level 2 Page 55 Rev 2. If the response contains Object 1 Variation 1 verify that the response contains the proper indication of binary inputs from step 1. 7. 5. If the response contains Object 1 Variation 2 verify that the response contains the proper indication of binary inputs from step 1 with an 8-bit flag field. no further testing in this section is necessary. Configure the DUT such that all Binary Input points are uninstalled or disabled. 9. 2. 8. The device can optionally set IIN2-1.13. 3. 0x07 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events.14. the device must respond with a quantity of its binary change events no greater than specified in the request. Binary Input Change. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. 6. 3. Device does not support Binary Input Changes Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. 8. 12. 3. 0x06 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. The DUT uses only qualifier codes 0x17 or 0x28 when building its’ response.1 1. § Verify that the device requests an application layer confirm. verify that the device requests an application layer confirm. Note #5.14. 2. 8. 2. § The device must request an application layer confirm for all responses that contain event data.2 Test Procedure 8. 2. No further testing is required in this section. Neither is required for level 2 compliance. When polled with the limit data qualifier (0x08).2. 11. Verify that the device responds with a Null Response. verify that it also performs report-by exception processing. the device must respond with a quantity of its binary change events no greater than specified in the request. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3. 10. 13.Points can be assigned to a class by configuration and through the protocol. Generate several Binary Input Change Events. Verify that the device responds with the correct number of generated events in a single response. 5. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. If the DUT does not support report by exception processing.1 Desired Behavior • • • • • • • If a device does not support report by exception on binary inputs it must respond with a Null Response. § The device must clear all of the binary change events reported in the last response upon receipt of an application layer confirm with a matching sequence number. Verify that flag behavior complies with Section 2.2. When no events are pending the device responds with the Null Response. When polled with the limit data qualifier (0x07). Page 56 Rev 2. Verify that the device responds with all generated events in a single response. 9.14. Issue an application layer confirm if requested to empty the device of pending events. 4.2 1. Issue an application layer confirm if requested to empty the device of pending events. § If the response is not Null. 5. Verify that the device responds with a Null Response. and/or 3. 8. § If the DUT has binary inputs and it responds to a Class 0 poll with more than one link layer frame. Generate several Binary Input Change Events. 8. 2. 7. 6.14. 4.2. verify that it responds with a Null Response. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. 8.14. Binary Input Change. 3. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28).3 1. The device must respond with all of its binary change events when polled with the all data qualifier (0x06). Issue a request for Object 2 Variation 0 using the limit data qualifier 0x07 requesting some of the changes.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . This allows efficient use of bandwidth.4. Note: Application layer confirms are always sent upon request unless stated otherwise in this section. Verify that the response contains only Object 2. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. Variation 1. 3. 4. 4. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that the device responds with all of the events in a single response. 15. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). § Verify that the device requests an application layer confirm. verify that the device requests an application layer confirm. 13. 8. Wait for a period of time exceeding several of the Application Layer retry delays. 2. § Binary Input Change Without Confirm Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. 8. Verify that flag behavior complies with Section 2. Page 57 Rev 2. 13. Generate Binary Input Change Events. Verify that flag behavior complies with Section 2. 6. 9. Issue a request for Object 2 Variation 0 using the limit data qualifier 0x07 requesting the remaining changes.4 1. Issue a request for Object 2 Variation 1 using the all data qualifier 0x06. Verify that only Object 2. and/or 3 are returned. Generate several Binary Input Change Events. 2. 18. and/or 3 are returned. 3. Generate several Binary Input Change Events.2. Verify that the device has not retransmitted the previous Application Layer fragment. 12. 5.2. 9. § If the response is not Null. 0x08 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. 19. 12. Note #5. 2. 5. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Do not issue an application layer confirm to the device. § If the response is not Null. 10. Issue an application layer confirm if requested to empty the device of pending events. Verify that the device responds with a Null Response. Verify that only Object 2. Verify that the device responds with all the event data generated in a single response. Binary Input Change.7. Verify only Object 2. verify that the device requests an application layer confirm.14. 10. 11. 8. 2. Issue an application layer confirm if requested to empty the device of pending events. 3. 9. Verify that the device responds with the remaining events. Issue an application layer confirm if requested to empty the device of pending events. 14. Variation 1. § Verify that the device requests an application layer confirm. Verify that the device responds with the same event data generated in step 4 and that the additional data generated in step 14 is in time order (oldest first) in a single response. Generate additional Binary Input Change Events. 6. 7. 11. Note #5. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. Issue an application layer confirm to empty the device of pending events.2. Variation 1. 17.14. 2. Issue a request for Object 2 Variation 0 using the limit data qualifier 0x08 requesting the remaining changes. Verify that flag behavior complies with Section 2. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. 7. 11. 4. verify that the device requests an application layer confirm. 2. if one exists. 20. 8. 10. Note #5.14.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . 0x06 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. § Verify that the device requests an application layer confirm.5 1. 13. Issue a request for Object 2 Variation 0 using the limit data qualifier 0x08 requesting some of the changes. 16. § Verify that the device requests an application layer confirm. 12. 8. 6. Verify that the device responds with the remaining Binary Input Change Events. Variation 1. Binary Input Change Without Time. Verify that the device responds with the correct number of Binary Input Change Events in a single response. Verify that the device requests an application layer confirm. 5.6 1. and/or 3 are returned. 8. § If the response is not Null. § Verify that the device requests an application layer confirm. 4. 11.2. 16.7. Verify that only Object 2.14. Issue a request for Object 2 Variation 1 using the limit data qualifier 0x07 requesting the remaining changes. 3. 0x06 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. Issue an application layer confirm to empty the device of pending events. 4. Verify that the device responds with a Null Response. 8.2.14. Verify that flag behavior complies with Section 2.9 1.2. Verify that the device responds with the remaining events. Issue an application layer confirm to empty the device of pending events. 9. 3. 3. 14. 7. Generate several Binary Input Change Events. Generate several Binary Input Change Events. verify that the device requests an application layer confirm. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). § If the response is not Null. Binary Input Change Without Time. Issue an application layer confirm if requested to empty the device of pending events. Verify that the device responds with data using either qualifier 0x17 or 0x28. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. 8. § Verify that the device requests an application layer confirm. verify that the device requests an application layer confirm. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. Verify that the device responds with the requested events in a single response. If the device does support Binary Input Change with Time Events. Verify that the device responds with the remaining events. 6. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. Note #5. If the device does not support Binary Input Change with Time Events. 12. 11. 8. 10. 0x07 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. Variation 1 is returned. § Verify that the device requests an application layer confirm. Note #5.8 1.14. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Verify that the device responds with a Null Response. 7. 15. 14. 6. verify that the device replies with a null response and skip all binary input change with time tests. 12. 16. 10.7 1. 9. § Verify that the device requests an application layer confirm. 9. Issue a request for Object 2 Variation 2 (binary change with time) using the all data qualifier 0x06. 13. verify that the device requests an application layer confirm. Issue a request for Object 2 Variation 1 using the limit data qualifier 0x07 requesting some of the changes. 13. Generate several Binary Input Change with Time Events. Issue a request for Object 2 Variation 1 using the limit data qualifier 0x08 requesting some of the changes. Binary Input Change Without Time. 7. 11. Verify that flag behavior complies with Section 2. § If the response is not Null. Verify that the device responds with the requested events in a single response. Page 58 Rev 2. § Verify that the device requests an application layer confirm. Variation 1 is returned. 5. Issue a request for Object 2 Variation 1 using the limit data qualifier 0x08 requesting the remaining changes. 15. § Verify that the device requests an application layer confirm. 2. 5. 8. Verify that the device responds with a Null Response. § If the response is not Null. 8. 8. 5. 4. 2. 6. Issue an application layer confirm if requested to empty the device of pending events. 2. 10. Issue an application layer confirm to empty the device of pending events. Binary Input Change With Time. verify that the device responds with all the event data generated in a single response. Issue an application layer confirm if requested to empty the device of pending events.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Verify that only Object 2. 0x08 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. 8. § Verify that the device requests an application layer confirm. Note #5. 11. Issue an application layer confirm to empty the device of pending events. § Verify that the device requests an application layer confirm. Verify that only Object 2. Issue a request for Object 2 Variation 2 using the limit data qualifier 0x07 requesting some changes. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28).14. Issue an application layer confirm if requested to empty the device of pending events. 10. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28).2. 12. Issue a request for Object 2 Variation 2 using the limit data qualifier 0x07 requesting the remaining changes. 3. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28).e. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. 8. 6. 15. Binary Input Change With Relative Time. 3.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . 9. 17.14. Issue an application layer confirm if requested to empty the device of pending events. Note #5.12 1. 7. Verify that the timestamps returned are reasonable (i. Verify that the timestamps returned are reasonable (i. 2. 0x07 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. Verify that flag behavior complies with Section 2. Generate several Binary Input Change with Time Events. 14. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile). § If the response is not Null. 13. 16. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile). Verify that flag behavior complies with Section 2. Verify that only Object 2. verify that the device requests an application layer confirm.14. Verify that the device responds with a Null Response. 4. Note #5. Verify that flag behavior complies with Section 2. 9. 12. 8. 10. Issue an application layer confirm if requested to empty the device of pending events. 13. Verify that the device responds with the requested number of events in a single response. 7. 17.2. 5. Page 59 Rev 2. Variation 2 is returned. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile). Verify that the device responds with the remaining events. § Verify that the device requests an application layer confirm. Variation 2 is returned. Binary Input Change With Time. 16. 14. 11. 9. 12. 15. 8. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. verify that the device requests an application layer confirm. 2. Verify that the device responds with a Null Response. 11. 3. Variation 2 is returned. 0x08 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. Verify that the device responds with the remaining events. § If the response is not Null. Issue a request for Object 2 Variation 2 using the limit data qualifier 0x08 requesting some changes. Verify that only Object 2. 14. 5. Generate several Binary Input Change with Time Events. 2.11 1. 10. 6. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. verify that the device requests an application layer confirm. Verify that the timestamps returned are reasonable (i. 0x06 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events.10 1. § Verify that the device requests an application layer confirm. 4.2. Binary Input Change With Time. Verify that the device responds with a Null Response. Issue an application layer confirm if requested to empty the device of pending events. § Verify that the device requests an application layer confirm. 8. Issue a request for Object 2 Variation 2 using the limit data qualifier 0x08 requesting the remaining changes. Verify that the device responds with the requested number of events in a single response.e. 8.e. 13. § If the response is not Null. Variation 1 or 2) must be inserted into the response before the data for that event. 13. 9. Issue a request for Object 2 Variation 3 using the limit data qualifier 0x07 requesting some changes. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile). Variation 1 or 2) in the same APDU. 5. Variation 1 or 2) must be inserted into the response before the data for that event. Verify that flag behavior complies with Section 2. 9. Verify that the device responds with the remaining events preceded by the Common Time of Occurrence Object (Object 51. § Verify that the device requests an application layer confirm. 14.2. Verify that the device responds with requested events in a single response preceded by the Common Time of Occurrence Object (Object 51. 10.4. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. 4. § Verify that the device requests an application layer confirm. Variation 1 or 2) in the same APDU. 8. verify that the device requests an application layer confirm. Verify that the timestamps returned are reasonable (i. Generate several Binary Input Change with Relative Time Events. 3. Verify that the device responds with a Null Response. 13. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile). Issue a request for Object 2 Variation 0 using the all data qualifier 0x06.14. 12. Generate several Binary Input Change with Relative Time events. 5. Verify that the timestamps returned are reasonable (i. Note #5. Note: If any subsequent event occurs more than 0xffff milliseconds after the first change a new Common Time of Occurrence Object (CTO Object 51. 6. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Issue an application layer confirm if requested to empty the device of pending events. Variation 1 or 2) and Object 2.2. 11. This CTO can then be used for all additional changes that occur within 0xffff milliseconds. 2.13 1. Variation 3 are returned. 0x07 7. 6. § If the response is not Null. 12. Verify that the device responds with a Null Response. Generate several Binary Input Change with Relative Time Events. Issue an application layer confirm if requested to empty the device of pending events. Variation 1 or 2) in the same APDU. 3. 15. Note: If any subsequent event occurs more than 0xffff milliseconds after the first change a new Common Time of Occurrence Object (CTO Object 51. Note #5. 2. Variation 1 or 2) in the same APDU.e. Binary Input Change With Relative Time. Verify that the device responds with requested events in a single response preceded by the Common Time of Occurrence Object (Object 51. § Verify that the device requests an application layer confirm. DNP3-2003 IED Certification Procedure Subset Level 2 Page 60 Rev 2.e. Issue a request for Object 2 Variation 3 using the limit data qualifier 0x07 requesting the remaining changes. § If the response is not Null. Verify that only the Common Time of Occurrence Object (Object 51. If the device does support Binary Input Changes with Relative Time. Binary Input Change With Relative Time. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28).14. 11. verify that the device responds with all the event data generated in a single response preceded by the Common Time of Occurrence Object (Object 51. 8. Variation 1 or 2) and Object 2. 6. 8. Verify that flag behavior complies with Section 2. 7. 16. Variation 3 are returned. Verify that only the Common Time of Occurrence Object (Object 51. verify that the device requests an application layer confirm.14 1. If the device does not support Binary Input Change with Relative Time events verify that the device replies with a null response and skip all Binary Input Change with Relative Time tests. 4.3 – 29-Sept-03 . Issue a request for Object 2 Variation 3 (binary change with relative time) using the all data qualifier 0x06. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. 8. Issue a request for Object 2 Variation 3 using the limit data qualifier 0x08 requesting some changes. 14. 10. 5. This CTO can then be used for all additional changes that occur within 0xffff milliseconds. 0x08 Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. Variation 3) are returned. § Verify that the device requests an application layer confirm. Verify that the timestamps returned are reasonable (i. • NOTE: When the following procedures require the test to “Verify that the objects returned are formatted correctly” interpret that to specifically mean the following: DNP3-2003 IED Certification Procedure Subset Level 2 Page 61 Rev 2. When responding to a request for binary input events AFTER the time and date are set for the first time after the DUT restarts: The DUT must send a Synchronized Common Time of Occurrence Object in each application fragment prior to any Binary Input Change with Relative Time Objects contained in that fragment. 10. 13. Issue a request for Object 2 Variation 0 using the all data qualifier 0x06. Variation 1 or 2) in the same APDU. 16. Variation 1 or 2) must be inserted into the response before the data for that event. Binary Input Change with Relative Time. 8.14. Verify that the device responds with a Null Response. 11. 14. Verify that the device responds with a Null Response. 13. 4. Issue a request for Object 2 Variation 3 (binary change with relative time) using the all data qualifier 0x06. Issue an application layer confirm if requested to empty the device of pending events. Verify that the device responds with the remaining events preceded by the Common Time of Occurrence Object (Object 51. Variation 1 or 2) and Object 2. Verify that flag behavior complies with Section 2. Verify that each group of events that occurred more than 0xffff milliseconds apart are preceded by a new Common Time of Occurrence Object (Object 51. This CTO can then be used for all additional changes that occur within 0xffff milliseconds. Long Interval Issue a request for Object 2 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. 10. Note: If any subsequent event occurs more than 0xffff milliseconds after the first change a new Common Time of Occurrence Object (CTO Object 51. Verify that the device responds with the requested events in a single response.7.1 Desired Behavior • • If the DUT does not support Binary Input Change with Relative Time Events testing in this section is not required.3 – 29-Sept-03 . 11. verify that the device requests an application layer confirm. Variation 3 are returned. 8. Verify that only the Common Time of Occurrence Object (Object 51.e. Generate several Binary Input Change with Relative Time Events. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Note #5. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Variation 1 or 2) in the same APDU. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile). 8.e. 3. 12.15. Issue a request for Object 2 Variation 3 using the limit data qualifier 0x06 requesting all changes. Note #5. Wait longer than 0xffff milliseconds. 8. 7.2.15 1. 15. 9.15 Common Time of Occurrence 8. § Verify that the device requests an application layer confirm. 9. 14. Verify that only the Common Time of Occurrence Objects (Object 51. 5. 12. § If the response is not Null. 2. Variation 1 or 2) and Binary Input Change with Relative Time Objects (Object 2. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile Document). § Verify that the device requests an application layer confirm. 15. Issue a request for Object 2 Variation 3 using the limit data qualifier 0x08 requesting the remaining changes. Verify that flag behavior complies with Section 2. 16. 6. When responding to a request for binary input events BEFORE the time and date are set for the first time after the DUT restarts or if the DUT does not set IIN1-4: The DUT must send an Unsynchronized Common Time of Occurrence Object in each application fragment prior to any Binary Input Change with Relative Time Objects contained in that fragment. Generate several Binary Input Change with Relative Time Events. Verify that the timestamps returned are reasonable (i. Verify that the objects returned are formatted correctly. Set the time and date using Object 50 Variation 1 with Qualifier 0x07. 23. Set the time and date using Object 50 Variation 1 with Qualifier 0x07.2 Test Procedure 1. 5. 13. 19. 18. Issue a request for Object 2 Variation 3 using the all data qualifier 0x06. If the response consists of multiple fragments each fragment must have a Synchronized/ Unsynchronized Common Time of Occurrence Object preceding any Binary Input Change with Relative Time Objects. Variation 1) and Binary Input Change with Relative Time Objects (Object 2. 4. Wait the specified maximum time between time synchronization requests. 3. This CTO can then be used for all additional changes that occur within 0xffff milliseconds. 9. 7. 33. 20. 6. 31. 5. 14. Cause the DUT to restart. 21. 2. to empty the device of pending events. that they are incrementing by approximately the intervals in which the events were generated within the resolution specified in the Device Profile Document). 26. Generate several Binary Input Change with Relative Time events. Variation 1) and Binary Input Change with Relative Time Objects (Object 2. 10. 22. Issue a request for Object 2 Variation 3 using the all data qualifier 0x06.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Issue an application layer confirm. 16. Issue an application layer confirm to empty the device of pending events. Page 62 Rev 2. 2. If the DUT does not support Binary Input Change with Relative Time events no further testing is required in this section. Perform a time delay measurement. Generate several Binary Input Change with Relative Time events.1. § Verify that the device responds with a valid message and that IIN1-4 is set indicating that the device is requesting time synchronization. The Synchronized/Unsynchronized Common Time of Occurrence Object precedes the Binary Input Change with Relative Time Objects in each fragment of the response. The data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). Variation 3) are returned. Verify that the objects returned are formatted correctly. Issue a request for Object 2 Variation 3 using the all data qualifier 0x06. a new Synchronized/Unsynchronized Common Time of Occurrence Object must be inserted into the response before the data for that event. 29. Variation 3) are returned. 15. Verify that only the Synchronized Common Time of Occurrence Object (Object 51. 8. 25. § Verify that the device requests an application layer confirm. 28. If any subsequent event occurs more than 0xffff milliseconds after the first change. 6. Variation 3) are returned. Note #5. Issue a request for Object 2 Variation 3 using the all data qualifier 0x06. Verify that the device responds with a Null Response and that IIN1-4 is cleared indicating the device no longer needs time. 30. Verify that only the Synchronized Common Time of Occurrence Object (Object 51. skip the rest of this section. The timestamps returned are reasonable (i. Verify that the device responds with a Null Response and that IIN1-4 is cleared indicating the device no longer needs time. 17. 3. Clear the Restart IIN. 24. Perform a time delay measurement. Flag behavior complies with Section 2. 12. Verify that the objects returned are formatted correctly. Verify that only the Unsynchronized Common Time of Occurrence Object (Object 51.15. Variation 2) and Binary Input Change with Relative Time Objects (Object 2.e. Do Not issue the application layer confirm. wait the specified maximum time from reset to IIN1-4 assertion. 4. 11. If the DUT does set IIN1-4. § Verify that the device responds with a valid message and that IIN1-4 is set indicating that the device is requesting time synchronization. 27. Generate several Binary Input Change with Relative Time events. If the DUT does not set IIN1-4. § Verify that the device requests an application layer confirm. § Verify that the device requests an application layer confirm. 32. 8. 16. however there are no binary counter points installed: • If the device supports binary counters. running counters and frozen counters. DNP3-2003 IED Certification Procedure Subset Level 2 Page 63 Rev 2. Frozen binary counters report values that were previously frozen by a command from the originating station. Running binary counters report the current value of the counter at the time of reporting or the last reported value from the device. then the values are cleared to 0. 8. • Optionally.16 Binary Counters A binary counter represents an accumulated value.0x01 16-Bit Binary Counter 0x00. the device can return an Error Response with IIN2-1.1. 37.2. Issue a request for Object 20 Variation 0 using the all data qualifier 0x06. 8.2 Test Procedure 8. to empty the device of pending events.0x01 32-Bit Binary Counter Without Flag 0x00. The device can optionally return an Error Response with IIN2-1 set. 36.1. Verify that the DUT responds with a null response. Verify that the device responds with a Null Response. The following behavior assumes that the device supports binary counters: • If the device supports running binary counters.1.3 – 29-Sept-03 . There are two primary types of binary counters. the device must be configured with at least one Binary Counter point installed or enabled before proceeding with the test procedure. the device must respond to a binary counter read request with a binary counter read object (see table 8-5) using qualifiers 0x00 or 0x01. Issue a request for Object 2 Variation 3 using the limit data qualifier 0x06 requesting all changes. 38. the device can return an Error Response with IIN2-1 set. No further testing in this section is necessary.16.34.1 Device does not have Binary Counters 1. 8. • Frozen binary counters will be tested in the next section. the device must respond to a binary counter read request with a null response and no further testing in this section is necessary.1 Binary Counters. If the DUT is configurable in a manner such that points can be uninstalled or disabled.0x01 32-Bit Binary Counter 0x00. 2. or the counter rolls over.16. Object 20 20 20 20 Variation 1 2 5 6 Qualifier Description 0x00.1 Desired Behavior The following behavior assumes that the device does not support binary counters: • If the device does not support binary counters the device must respond to a binary counter read request with a null response and no further testing in this section is necessary. 35. § Verify that the device requests an application layer confirm.0x01 16-Bit Binary Counter Without Flag Table 8-5 8. The following behavior assumes that the device does support binary counters. Verify that the objects returned are formatted correctly. Running Acceptable object variations and qualifier combinations included in a device response are specified in the following table. This can be accumulated pulses or transitions from a hardware or software point.16. These values increment indefinitely until a counter clear operation is received. Issue an application layer confirm. • Optionally. 3. or 6 are reported with qualifiers 0x00 or 0x01. No further testing in this section is necessary. Configure the DUT such that all Binary Counter points are uninstalled or disabled.1. 8. the device can return an Error Response with IIN2-1 set. 2. • Optionally. variation 0. Issue a request for Object 20 Variation 0 using the all data qualifier 0x06. 7. 8. 2.2. Issue a read request for Object 21. 8.16. The following behavior assumes that the device does support frozen binary counters. 0x09. Verify that the DUT responds with a null response.16.16. Frozen Acceptable object variations and qualifier combinations included in a device response are specified in the following table. Record the values for future reference. using the all data qualifier 0x06. 0x08. 4. Issue a request for Object 20 Variation 0 using the all data qualifier 0x06. Verify any points reported with Object 20. Verify that flag behavior complies with Section 2.2. 2.3 Device supports Binary Counters. • Frozen binary counter data must only be updated after a freeze request is issued to object 20 Variation 0 (function codes 0x07. 5.0x01 Description 32-Bit Frozen Counter 16-Bit Frozen Counter 32-Bit Frozen Counter Without Flag 16-Bit Frozen Counter Without Flag Table 8-6 8. Issue a request for Object 20 Variation 0 using the all data qualifier 0x06. The following behavior assumes that the device supports frozen binary counters: • If the device supports frozen binary counters the device must respond to a frozen binary counter read request with a frozen binary counter object (object 21 variation 1-8) using qualifiers 0x00 or 0x01. no further testing in this section is necessary.16. Note #5 if variations 1 or 2 reported. Verify that the DUT responds with binary counter objects (object 20 Variation 1-8).1. The device can optionally return an Error Response with IIN2-1 set.2. The device can optionally return an Error Response with IIN2-1 set. 2. Object 21 21 21 21 Variation 1 2 9 10 Qualifier 0x00.1 Device does not have Frozen Counters.2. however there are no frozen binary counter points installed: • If the device supports frozen binary counters the device must respond to a frozen binary counter read request with a null response and no further testing in this section is necessary.0x01 0x00.8. Configurable Device 1. or 0x0A).0x01 0x00.2. Variations 1.0x01 0x00.2 Binary Counters. 1. Generate binary counter input data. Verify that the DUT responds with a null response.2 Device responds with Binary Counters 1. 6.2. • Optionally. 8. Page 64 Rev 2. 4.1 Desired Behavior The following behavior assumes that the device does not support frozen binary counters: • If the device does not support frozen binary counters the device must respond to a frozen binary counter read request with a null response and no further testing in this section is necessary.2 Test Procedure 8.16. Verify that the reported values match the values recorded previously plus the counts generated in step 4. 3. 5.16. If the device is not configurable in a manner such that Binary Counter points can be uninstalled or disabled.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . the device can return an Error Response with IIN2-1 set. Freeze. 6. Issue a read request for Object 21. 2. 7. 13. Generate counter data. 2. 10. Issue a freeze counter command to Object 20 Variation 0 using function code 0x08 using the all data qualifier 0x06. using the all data qualifier 0x06. 4. Verify that the values returned are non zero. 9. 4. variation 0. 10. 9. 9. Issue a read request for Object 21.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Issue a freeze to Object 20 Variation 0 using function code 0x07 and the all data qualifier 0x06. 12. Verify that the DUT responds with a Null Response.2. Verify that the DUT responds with a Null Response.3 Binary Counter. Generate counter data. or 10. 16. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1. 2. using the all data qualifier 0x06. 4. using the all data qualifier 0x06.16. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1.16. 8.2. 8.2. Generate counter data. 13. using the all data qualifier 0x06. 12. 7. 9. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1. or 10. using the all data qualifier 0x06. 2. 7. 6. using the all data qualifier 0x06. or 10. Verify that the DUT does not respond. 8. Issue a read request for Object 21 Variation 0. or 10. Verify that the reported values match the values recorded previously. variation 0. 9. 10. Verify that the DUT responds with a Null Response. or 10.2. Verify that the reported values are all zero. Record the values for future reference. 3. 8. using the all data qualifier 0x06. 9. 2. 11. or 10. 11. 9. Verify that the data is reported using 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01) Verify that flag behavior complies with Section 2. Note #5. 9. Issue a read request for object 21 Variation 0.4 Binary Counter. Record the values for future reference. 16. 12. Freeze And Clear 1. Verify that the data is reported using 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01) Verify that flag behavior complies with Section 2. 9.2 Binary Counter. Issue a read request for object 21 Variation 0. Issue a freeze to Object 20 Variation 0 using function code 0x08 and the all data qualifier 0x06. Verify that the DUT does not respond. 13. Page 65 Rev 2. Issue a freeze counter command to Object 20 Variation 0 using function code 0x07 and the all data qualifier 0x06. 2. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1. 2. 15. 9. 15. Verify that the reported values match the values recorded previously plus the counts generated in step 6. or 10. 14. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1. 2. No Acknowledge 1.2. 6. 11.2. or 10. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1. 9. Issue a read request for Object 21. 5. 5. Freeze 1. Issue a read request for object 21 Variation 0. 5. 8. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1. Verify that the DUT responds with a Null Response. variation 0. Verify that the reported values match the values recorded previously. Issue a freeze and clear to Object 20 Variation 0 using function code 0x09 and the all data qualifier 0x06. Note #5 if variations 1 or 2 are reported.8. 2. 3. 2. Verify that the data is reported using 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01) Verify that flag behavior complies with Section 2. Verify that the reported values match the values recorded previously plus the counts generated in step 6. 3. using the all data qualifier 0x06. Note #5. 2. Issue a freeze and clear counter command to Object 20 Variation 0 using function code 0x09 using the all data qualifier 0x06. Issue a read request for Object 21 Variation 0. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1. 14.16. 1 Desired Behavior • • • • • The device must respond with all of its Binary Counter Change Events when polled with the all data qualifier 0x06. No further testing is required in this section. Verify that the DUT does not respond. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1.2. Issue an application layer confirm if requested to empty the device of pending events. Verify that the reported values are all zero.2.16. 8. Freeze And Clear. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06.8. verify that it responds with a Null Response.2 1. All event requests in this section are to be followed by a confirm message to the device unless otherwise indicated. 3. When no events are pending the device responds with the Null Response. If the device does not support Binary Counter Events it must respond to a request with a null response and no further testing in this section is necessary. the device must respond with a quantity of its binary counter change events no greater than specified in the request. Note #5. Event. 0x06 Issue a request for Object 22 Variation 0 using the all data qualifier 0x06 to empty the device of pending events.17 Binary Counters. 5. Generate some Counter Change Events. using the all data qualifier 0x06. using the all data qualifier 0x06. 3.17.17. or 10. 8. 4. or 10. variation 0. 6. The device must clear all of its Binary Counter Change Events only when an application confirm is received from the master.17. Device does not support Binary Counter Events Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. 8. If the DUT does not support Binary Counter Events. Issue a read request for Object 21. verify that the device requests an application layer confirm. 5. 6. 13. 11. 2. Issue a freeze and clear to Object 20 Variation 0 using function code 0x0A and the all data qualifier 0x06.1 1. Event Binary Counter Change Event represents a counter value that has changed since it was last reported. 3. 8. § If the response is not Null. This value can be accumulated transitions from a hardware or software point. 9. 10. 12.5 Binary Counter. Verify that the values returned are non zero. Issue a freeze and clear to Object 20 Variation 0 using function code 0x0A and the all data qualifier 0x06. Verify that the DUT does not respond. When polled with the limit data qualifier 0x07 or 0x08. 8.4.2 Test Procedure 8. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3.2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Generate counter data. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. 4. Binary Counters. No Acknowledge 1. This allows efficient use of bandwidth. § Verify that if the DUT does have binary counter inputs and it responds to a Class 0 poll with more than one link layer frame it also performs report-by exception processing. 2. Page 66 Rev 2. 2. Issue a read request for object 21 Variation 0. 9. Verify that the device responds with a Null Response. 9. 2. 2.2. Verify that the data is reported using 8 bit start/stop indexing (qualifier 0x00) or 16 bit start/stop indexing (qualifier 0x01) Verify that flag behavior complies with Section 2. 7. 7. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. Verify that the DUT responds with a Frozen Binary Counter Object 21 Variation 1.17. Page 67 Rev 2. 15.2. 5. Binary Counters. 15. 11. Verify that the device responds with the remaining Binary Counter Change Events. Variations 1 and/or 2 are returned. 4. 0x08 Issue a request for Object 22 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. Note #5. Generate several Binary Counter Change Events. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28) Verify that flag behavior complies with Section 2. Issue an application layer confirm to empty the device of pending events. 14. Verify that the device responds with the requested Binary Counter Change Events in a single response. Verify that the device responds with the remaining Binary Counter Change Events. § Verify that the device requests an application layer confirm. 4. 7. Note #5. 15. 11. Event. 10. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 9. 7. § If the response is not Null. 8. 12. Verify that the device responds with the requested Binary Counter Change Events in a single response. Verify that only Object 22. 8. Issue a request for Object 22 Variation 0 using the limit data qualifier 0x07 requesting the remaining changes. verify that the device requests an application layer confirm. Verify that the device responds with all the event data generated in a single response. Variations 1 and/or 2 are returned. 13. Event Without Confirm Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. 3. Verify that only Object 22. § Verify that the device requests an application layer confirm. 6. 9. 3. verify that the device requests an application layer confirm Issue an application layer confirm if requested to empty the device of pending events. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. 8. 2.8. 12.17. Generate several Binary Counter Change Events. 10. 16.17. 12. 11. 0x07 Issue a request for Object 22 Variation 0 using the all data qualifier 0x06 to empty the device of pending events. 3. 5.4 1. Verify that the reported values match the values recorded previously plus the counts generated in step 14. Do not issue an application layer confirm to the device. Issue a request for Object 22 Variation 0 using the limit data qualifier 0x08 requesting the remaining changes. Event.2.3 – 29-Sept-03 DNP3-2003 IED Certification Procedure Subset Level 2 . Generate Binary Counter Change Events. § Binary Counters. Verify that only Object 22. Generate additional Counter Change Events. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. 8. 14. 6. Record the values for future reference. Verify that the device responds with all of the events in a single response. 8.2. Verify that the device responds with a Null Response. 6. Issue a request for Object 22 Variation 0 using the limit data qualifier 0x07 requesting some changes. § Verify that the device requests an application layer confirm. Issue a request for Object 22 Variation 0 using the limit data qualifier 0x08 requesting some changes. 14.17. § Verify that the device requests an application layer confirm. 2. 13. Binary Counters.3 1. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 10. § Verify that the device requests an application layer confirm. 4. Variations 1 and/or 2 are returned.5 1. 7. 9. 2. § Verify that the device requests an application layer confirm. Verify that the device responds with a Null Response. Note #5. 5. If the response is not Null. § If the response is not Null. 8. verify that the device requests an application layer confirm Issue an application layer confirm if requested to empty the device of pending events. 13. Verify that flag behavior complies with Section 2. Verify that flag behavior complies with Section 2. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. which is usually configurable. 19. the device can set IIN2-1. Optionally.19 Analog Change Event The analog input change object is used to represent a hardware or software analog point. The response could contain Object 30 Variations 1. 4. Qualifier 0x00. DNP3-2003 IED Certification Procedure Subset Level 2 Page 68 Rev 2. Issue an application layer confirm to empty the device of pending events. 3 or 4.9. 13.18. 2. 11. 12. the device can report the previous state of the input applied in step 4 followed by a value representing the current state of the input applied in step 11. 8.18. It can be a 16-bit or 32-bit value. 15.1 Desired Behavior • • • The device must respond with all of its analog input data when polled with Object 30 Variation 0 and the all data qualifier 0x06. Note #5. Verify that the device responds with Object 22 Variation 1 or 2.2. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 16. the device can respond with an Error Response with IIN2-1 set. 10. Verify that the device correctly reports that value for various analog inputs. Wait for a period of time exceeding several of the Application Layer retry delays. Issue a request for Object 30 Variation 0 using the all data qualifier 0x06. Optionally. 8. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. If the device does not support analog inputs it must respond with a null response and no further testing in this section is necessary. 8. 17.18.18. It will only be reported if the current value and the last reported value differ by a deadband value.18 Analog Input This is an object used to represent a hardware or software analog input.2 Test Procedure 8.2. 14.4. Generate additional Binary Counter Change Events including some on points not previously stimulated if possible. Optionally.3 – 29-Sept-03 . Device does not have Analog Inputs Issue a request for Object 30 Variation 0 using the all data qualifier 0x06. § Any device that generates more than one link layer frame in response to a Class 0 Poll must support report-by-exception on all points. Verify that the device has not retransmitted the previous Application Layer fragment. with a value representing the current state of the input(s) applied in step 11.2 1. When no events are pending the device responds with the Null Response. if one exists. 8. Verify that the device responds with a Null Response. 2. or 0x01 along with a value representing the analog input applied in step 1. 20. 18. It is highly recommended that devices perform report by exception processing internally and respond to class polls with event data as defined in section 3. Device has Analog Inputs Input analog data.1 1. 3. For all the tests in this section the analog deadband shall be set to a reasonable value. 8. Verify that the device responds with Object 30 Variation 1-4. 3. Issue a request for Object 22 Variation 0 using the all data qualifier 0x06. Verify that it responds with a null response. This allows efficient use of bandwidth. § Verify that the device requests an application layer confirm. No further testing is required in this section. 2. Verify that flag behavior complies with Section 2. using the all data qualifier 0x06. 13. 8. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). using the all data qualifier 0x06. 4. Optionally. the device can report the previous state of the input applied in step 1 followed by a value representing the current state of the input applied in step 9. using the all data qualifier 0x06. Issue a request for Object 32 Variation 0.3 – 29-Sept-03 . § Analog Input Change. The device must respond with Object 32 Variation 1 or 2 only if an event has occurred. with the value representing the input applied in step 1. using the all data qualifier 0x06. Verify that flag behavior complies with Section 2. § Verify that the device requests an application layer confirm. Verify that the device responds with Object 32 Variation 1 or 2. If the current and previous reported values do not differ within the defined deadband. 11. Analog Input Change Issue a request for Object 32 Variation 0. Issue a request for Object 32 Variation 0. Wait for a period of time exceeding several of the Application Layer retry delays.2 Test Procedure 8. 13. If the device does not support Analog Input Change Events it must respond to a request with a null response. § Verify that if the DUT does have analog inputs and it responds to a Class 0 poll with more than one link layer frame it also performs report-by exception processing.19. if one exists. using the all data qualifier 0x06. 14. Verify that the data is reported using 8 bit indexing (qualifier 0x17) or 16 bit indexing (qualifier 0x28). 7. 9. using the all data qualifier. 14. with the value representing the new input from step 12. Issue a request for Object 32 Variation 0.2. Verify that flag behavior complies with Section 2. Note #5. 5. Increase or decrease the analog input applied in step 1. 5.2. Verify that the device has not retransmitted the previous Application Layer fragment. 12. Verify that the device responds with a null response. The device must clear all of its analog change events only when an application confirm is received from the master. Verify that the device responds with Object 32 Variation 1 or 2. Generate a stable analog input to the device.g. 3. the device must respond with a null response. Issue a request for Object 32 Variation 0. 3. 4. 11. 10. If the device does not support analog inputs verify that the device responds with a null response. 10.1 Desired Behavior • • • • • • The device must respond with all of its Analog Input Change Events when polled with the all data qualifier 0x06. 8. Issue an application layer confirm. Verify that the device responds with a null response. Without Confirm Generate a stable analog input to the device that exceeds the current input value by the configured deadband value (e. 7. Increase or decrease the analog input applied in step 4 greater than the configured deadband. 6.19.1 1. Issue a request for Object 32 Variation 0. 6. Note #5. DNP3-2003 IED Certification Procedure Subset Level 2 Page 69 Rev 2.19. 15.19. 8. All event requests in this section are to be followed by a confirm message to the device unless otherwise indicated. 8. 16. No further testing is required in this section. 2. using the all data qualifier 0x06. cause an event to be generated). Issue a request for Object 32 Variation 0. § Verify that the device requests an application layer confirm. with the value representing the input applied in step 4.8. with a value representing the current state of the input applied in step 9. Verify that the device responds with Object 32 Variation 1 or 2.2 1. Verify that the device requests an application layer confirm. 9. Verify that the device responds with Object 32 Variation 1 or 2. 12. 2. Issue the event requests before the requests for static objects. Note that the DUT may not return event objects if they are not present. 2. 4.20.20 Multiple Read Requests 8. Verify that the DUT response has none of IIN2-x set. DNP3-2003 IED Certification Procedure Subset Level 2 Page 70 Rev 2.20.8. Verify the validity of the returned object type data.3 – 29-Sept-03 . Verify data objects are returned in the order requested.2 Test Procedure 1. 3.1 Desired Behavior • The DUT must respond to read requests for multiple object types 8. Issue a request containing one of each supported object type listed in the implementation table within a single frame. 9 Appendix A – DNP3 Reference Sheets QUICK REFERENCE FOR DNP DATA LINK CONTROL FIELD Definitions: MSB 1 DIR PRM 0 0 7 DIR PRM FCB FCV DFC Function Codes: Primary Frames (PRM=1) Fn Code 0 1 2 3 4 9 Function RESET link Reset User Process TEST link User Data User Data Request Link Status Frame Type SEND/CONFIRM SEND/CONFIRM SEND/CONFIRM SEND/CONFIRM SEND/NO REPLY REQUEST/RESPOND FCV 0 0 1 1 0 0 6 5 DFC 4 3 2 1 0 Secondary FCB FCV FUNCTION CODE LSB Primary 1 = Master. 1 = no buffers left Secondary Frames (PRM = 0) Fn Code 0 1 11 Function ACK NACK Link Status Frame Type CONFIRM CONFIRM RESPOND DNP3-2003 IED Certification Procedure Subset Level 2 Page 71 Rev 2. 0 = Data Link Response Frame Count Bit.3 – 29-Sept-03 . alternates 1 and 0 Frame Count Valid. 0 = Remote 1 = Data Link Request. 0 = invalid Data Flow Control. 1 = valid. most common in bold: From Remote 00 01 0B 10 11 1B 40 41 44 49 52 53 60 61 64 69 72 73 From Master 80 81 8B 90 91 9B C0 C1 C4 C9 D2 D3 E0 E1 E4 E9 F2 F3 Function ACK NACK Link Status Reply ACK NACK Link Status Reply RESET LINK Reset User Process Unconfirmed User Data Link Status Request Test Link Confirmed User Data RESET LINK Reset User Process Unconfirmed User Data Link Status Request Test Link Confirmed User Data Other Failed transaction No flow Control Frame accepted. no more buffers left Frame not accepted.3 – 29-Sept-03 . Bit 6 = FIRST DNP3-2003 IED Certification Procedure Subset Level 2 Page 72 Rev 2.QUICK REFERENCE FOR DNP DATA LINK CONTROL FIELD List of Valid Control Field values by hex value. no buffers available No buffers available FCB = 0 FCB = 0 FCB = 1 ignored FCB = 1 ignored FCB = 1 ignored FCB = 1 ignored FCB = 1 FCB = 1 Frame Header: Byte Name 1 05 2 64 3 LEN 4 CTRL 5 DEST 6 7 8 9 CRC 10 11 TH SOURCE Transport Header(TH): Bit 7 = FINAL. No Further Indexing 1 – 1 Octet Index or Identifier Size 2 – 2 Octet Index or Identifier Size 3 – 4 Octet Index or Identifier Size DUI IO = = DNP3-2003 IED Certification Procedure Subset Level 2 Page 73 Rev 2. Packed 1 – 1 Octet Index 2 – 2 Octet Index 3 – 4 Octet Index 4 – 1 Octet Object Size 5 – 2 Octet Object Size 6 – 4 Octet Object Size QUALIFIER CODE 0 – 8-Bit Start and Stop Indices 1 – 16-Bit Start and Stop Indices 2 – 32-Bit Start and Stop Indices 3 – 8-Bit Absolute Address Identifers 4 – 16-Bit Absolute Address Identifiers 5 – 32-Bit Absolute Address Identifers 6 – No Range Field (all) 7 – 8-Bit Quantity 8 – 16-Bit Quantity 9 – 32-Bit Quantity 11 – (0xB) Variable Array DNP = Distributed Network Protocol Application Protocol Data Unit Application Protocol Control Information Data Unit Identifier Information Object APDU = SECOND OCTET 7 6 5 4 3 2 1 0 APCI = BUFFER OVERFLOW OBJECT UNKNOWN BAD CONFIG RESERVED RESERVED ALREADY EXEC OUT OF RANGE BAD FUNCTION INDEX SIZE (QUAL CODE = 11) 0 – Dataless Object. TROUBLE ALL STATIONS NEED TIME CLASS 3 CLASS 2 RESTART CLASS 1 INDEX SIZE 0 – No Index.3 – 29-Sept-03 .DNP APDU APCI Message Header DUI Object Header IO Data DUI Object Header IO Data Request Header Appl. No Ack 0x07 Immediate Freeze 0x08 Immediate Freeze No Ack 0x09 Freeze and Clear 0x0A Freeze and Clear No Ack 0x0B Freeze with Time 0x0C Freeze with Time No Ack 0x0D Cold Restart 0x0E Warm Restart 0x0F Init Data to Defaults 0x10 Initialize Application 0x11 Start Application 0x12 Stop Application 0x13 Save Configuration 0x14 Enable Unsolicited Msgs 0x15 Disable Unsolicited Msgs 0x16 Assign Class 0x17 Delay Measurement 0x18 Record Current Time Confirm Response Unsolicited Response 6 5 4 3 2 1 0 Depends on Qualifier Code FIRST OCTET 7 6 5 4 3 2 1 0 CONFIRM FIRST FINAL UNSOLICITED SEQUENCE LOCAL DEV. Ctrl Func Code Response Header Appl. Ctrl Func Code Internal Indication Object Group Object Variation Qualifier Range See Data Object Library 7 7 6 5 4 3 2 1 0 0x00 Confirm 0x00 0x01 Read 0x81 0x02 Write 0x82 0x03 Select 0x04 Operate 0x05 Direct Operate 0x06 Direct Op. Ctrl Func Code Response Header Appl. Packed 1 – 1 Octet Index 2 – 2 Octet Index 3 – 4 Octet Index 4 – 1 Octet Object Size 5 – 2 Octet Object Size 6 – 4 Octet Object Size QUALIFIER CODE 0 – 8-Bit Start and Stop Indices 1 – 16-Bit Start and Stop Indices 2 – 32-Bit Start and Stop Indices 3 – 8-Bit Absolute Address Identifers 4 – 16-Bit Absolute Address Identifiers 5 – 32-Bit Absolute Address Identifers 6 – No Range Field (all) 7 – 8-Bit Quantity 8 – 16-Bit Quantity 9 – 32-Bit Quantity 11 – (0xB) Variable Array DNP = Distributed Network Protocol Application Protocol Data Unit Application Protocol Control Information Data Unit Identifier Information Object APDU = SECOND OCTET 7 6 5 4 3 2 1 0 APCI = OUT OF RANGE OBJECT UNKNOWN BAD CONFIG ALREADY EXEC BUFFER OVERFLOW BAD FUNCTION RESERVED RESERVED INDEX SIZE (QUAL CODE = 11) 0 – Dataless Object. Ctrl Func Code Internal Indication Object Group Object Variation Qualifier Range See Data Object Library 7 7 6 5 4 3 2 1 0 0x00 Confirm 0x00 0x01 Read 0x81 0x02 Write 0x82 0x03 Select 0x04 Operate 0x05 Direct Operate 0x06 Direct Op.1 – 5-July-01 DNP3-2001 IED Certification Procedure Subset Level 2 . No Ack 0x07 Immediate Freeze 0x08 Immediate Freeze No Ack 0x09 Freeze and Clear 0x0A Freeze and Clear No Ack 0x0B Freeze with Time 0x0C Freeze with Time No Ack 0x0D Cold Restart 0x0E Warm Restart 0x0F Init Data to Defaults 0x10 Initialize Application 0x11 Start Application 0x12 Stop Application 0x13 Save Configuration 0x14 Enable Unsolicited Msgs 0x15 Disable Unsolicited Msgs 0x16 Assign Class 0x17 Delay Measurement Confirm Response Unsolicited Response 6 5 4 3 2 1 0 Depends on Qualifier Code FIRST OCTET 7 6 5 4 3 2 1 0 CONFIRM UNSOLICITED FIRST FINAL SEQUENCE DEV.DNP APDU APCI Message Header DUI Object Header IO Data DUI Object Header IO Data Request Header Appl. No Further Indexing 1 – 1 Octet Index or Identifier Size 2 – 2 Octet Index or Identifier Size 3 – 4 Octet Index or Identifier Size DUI = IO = Page 74 Rev 2. TROUBLE LOCAL ALL STATIONS NEED TIME CLASS 3 CLASS 2 RESTART CLASS 1 INDEX SIZE 0 – No Index.