3 DNP3

3.1 Protocol Characteristics 126

3.2 Settings and Properties 136
3.1 Protocol Characteristics

3.1 Protocol Characteristics

3.1.1 Protocol Structure

3.1.1.1 Description
DNP3 has a graded architecture. Instead of the OSI model, however, a simplified 3-layer model suggested by
the IEC is used. This model was named Enhanced Performance Architecture (EPA) by the IEC. However,
DNP3 adds a 4th layer, a pseudo transport layer, with which messages can be segmented. The graphics were
taken from the DNP3-Spec-V1-Introduction-20071215.pdf standard.

[dw_epadia, 1, en_US]

Figure 3-1 EPA Diagram

The SIPROTEC 5 device supports the DNP3, level 2 version.

You can find additional information in the standard IEEE 1815 at http://standards.ieee.org/.

3.1.1.2 Physical Layer

The physical layer mainly deals with the physical media through which the protocol is transferred. The physical
layer deals with, for example, the condition of the media (free or occupied) and the synchronization through
the media (start and stop).
DNP3 most frequently uses a simple, asynchronous serial transmission like RS232 or RS485 with physical
media like pilot wires and optical fiber. Moreover, the transmission can take place through Ethernet.
 [dw_dalila, 1, --_--]

Figure 3-2 Physical Layer

3.1.1.3 Data-Link Layer

The data link layer manages the logical connection between the transmitter and the receiver of the informa-
tion and improves the fault tolerance of the physical line. This is achieved with DNP3 by starting every data
transmission package with a data head, and a 16 bit CRC (cyclic redundancy check) is executed for every
16 bytes of the package.
A package is a part of the complete message transferred through the physical layer. The maximum size of a
data package is 256 bytes. Each package has a 16-bit source address and a 16-bit target address, which can also
be a general address (0xFFFF).
The 10-byte data link layer head contains:
• Address information

• 16-bit start code

 • Frame length

• Data link control byte

The data link control byte displays the cause of the data transmission and the status of the logical connection.
The data link control byte can have the following values:

• ACK (data link confirmation)

• NACK (negative confirmation)
• Connection needs to be reset
• Connection is reset

• Data link confirmation from the package required

If a data link confirmation is needed, the receiver must respond with an ACK data package if the package was
received and the CRC checks were successful. If no data link confirmation is requested, no response is
required.

3.1.1.4 Pseudo Transport Layer

The pseudo transport layer segments application messages in multiple data transmission packages.
The pseudo transport layer implements an individual byte function code for every package. The byte function
code displays what the data transmission package is:

• The 1st package of a message

• The last package of a message

• Both (for individual message packages)

The function code delivers a running package number. This subsequent package number is increased with
each package and allows the receiver's transport layer to analyze the package.

[dw_trfnct, 1, --_--]

Figure 3-3 Pseudo Transport Layer

3.1.1.5 Application Layer

The application layer responds to received messages and creates messages based on the necessity and availa-
bility of the user data. As soon as messages are available, they are sent to the pseudo transport layer. The
messages are segmented here, sent to the data link layer and transferred through the physical layer.
If the data that is to be sent is too large for an individual application message, a number of application
messages can be created and sent in a sequential manner. Each message is an independent application
message. Their only connection with each other is the label in all messages that says that more messages will
follow. Only the last message does not contain this label. Each application message refers to a fragment due
to the fact that the user data may be fragmented. A message can thus be a single fragment message or a
multi-fragment message.
Application packages from DNP3 slaves are normally responses to queries. A DNP3 slave can also send a
message without a request, thus, an unsolicited response.
As in the data link layer, application fragments can be sent with a confirmation request. An application confir-
mation indicates that a message was not only received, but rather it was also syntactically analyzed without
any errors. A data transmission confirmation or an ACK indicate only that the transmission package was
received and that the CRC checks were error-free.
Each application package begins with an application layer header, followed by one or more object heads/
object data. The application layer header contains an application control code and an application function
code.
If one of the following conditions is fulfilled, then the application control code contains labels:

• The package is a multi-package message.

• An application layer acknowledgment is requested for the package.

• The package is not requested.

The application control code contains a continual application layer number. With this application layer
number, the receiving application layer can recognize alien packages or lost packages.
The application function code in the header of the application layer indicates the cause or the requested func-
tion in the message. While DNP3 allows a number of data types in a single message, it also allows only an
individual query for a data type within the message.
Examples for application function codes include:
• Acknowledgments for confirmation on the application layer
• Read and write
• Select and execute (SBO (select before operate), controls)
• Direct control (for switching objects without SBO)
• Save and delete (for counters)
• Restart (both cold and warm)
• Enable and disable non-requested messages

• Selection of the classes

The application function code in the header of the application layer applies for all object headers. Thus, the
application function code applies for all data within the message package.
[dw_aplay_1, 1, --_--]

Figure 3-4 Application Layer – Part 1

 [dw_aplay_2, 1, --_--]

Figure 3-5 Application Layer – Part 2

3.1.2 Transfer through Ethernet

3.1.2.1 Requirements for the Physical, Transport, and Application Layers

The transmission through Ethernet takes place according to the same specifications as transmission through
serial connections. Only the method for the time synchronization through the network must be changed. All
requirements in the other protocol layers can be applied. Connection packages are transported in an
unchanged manner through the Ethernet protocol suite under the control of the data link layer.

3.1.2.2 Acknowledgments
If the SIPROTEC devices communicate through Ethernet, they must not work with confirmations from the
physical layer (CONFIRMED_USER_DATE). If necessary, the confirmations must be used by the application
layer. For confirmations of the application layer, there is no difference between IP networks (IP = Internet
protocol) and serial channels.
3.1.2.3 Message Transmission
As soon as the data-link layer has established a TCP connection (TCP = Transmission Control Protocol), the
physical layer of DNP3 can transmit packages as needed. The type of query (requested or not requested) does
not depend on the type of connection.
The SIPROTEC 5 devices support dual DNP3 Ethernet masters on the same Ethernet module.
A typical case for each DNP3 master is as follows:

• TCP connection is established with a device

• Class 1, 2, 3, 0 request is executed once
The data integrity is checked.

• Non-requested transmission is made possible

• Work is continued in this mode.

3.1.3 Functional Scope

The DNP3 interface of the SIPROTEC 5 device supports the following functions:
Function Description
Binary inputs with status Remote Terminal Unit (RTU)
Object 01 and variation 02 describe the state of a digital input channel or internal
software information.
They are also used during the general interrogation by an RTU to synchronize the
database. The general interrogations are conducted after the run or cyclically
during the runtime.
Binary inputs with Object 02 and variation 02 describe the changes of a digital input channel or of
changed time internal software information with the associated change time. The binary inputs
are used for spontaneous process events.
Binary outputs with status Object 10 and variation 02 describe the current status of a binary output channel.
The control relay output block controls the binary output channels. See also
object 12.
Control relay output block Object 12 and variation 01 are used for commands for the process or for the
setting-up of internal functions.
32-bit binary meter with Object 20 and variation 01 are used for the display of metered values for active
marking and reactive power.
32-bit binary change Object 22 and variation 01 are used for the display of changed meter data for
meter without time active and reactive power.
32 bit analog inputs Object 30 and variation 01 describe signed 32-bit values for the digitalized analog
(measured values) signals or their calculated values.
16 bit analog inputs Object 30 and variation 02 describe signed 16-bit values for the digitalized analog
(measured values) signals or their calculated values. They are used for the general interrogation
during start-up. A measured value snapshot is also possible.
32-bit analog change Object 32 and variation 01 are used for the display of a changed analog value.
values without time
16-bit analog change Object 32 and variation 02 are used for the display of a changed analog value.
values without time
Time and date Object 50, variation 01
Write function The time and date object are used for time synchronization.
Time and date Read the system time of the device.
Read function Date and time are displayed in milliseconds.
Here midnight on January 1, 1970 is 00:00 hours, 00:00 minutes, 00:00 seconds
and 00:00 milliseconds.
 Function Description
Data class Object 60, variation 01, 02, 03, 04
These objects indicate different classes of information elements:

• Class 0 contains all information objects that are not distinguished in terms of
class 1 to 3
• Classes 1 to 3 contain groups of events from information elements
• The data from class 1 has the highest priority, followed by class 2, class 3,
and the static data
• Class 1 always means class 0 + 1, class 2 means class 0 + 2
File transfer Object 70, variation 01, 02, 03, 04, 05, 06, 07
Transfer of a fault record possible
Internal displays Object 80, variation 01
Writing the value 00 on index 7 leads to reset of the bit Restart in the flag byte
for all data objects.
Writing to Index 4 resets the Need Time Bit.

NOTE
These variations are set. You cannot change the variations in DIGSI.

3.1.4 Fault Record Transfer

The file transfer can be used to transfer a fault record (Object 70). The Rcd Made message is used to query the
availability of the fault record. When the message is mapped and there is a new fault in the device the
message is transferred. Cyclical reading of the directory is also possible. If there are files in the directory then
there are also fault records. Specifically, the transfer takes place as follows:
The following steps are required to read the directory:
• Reading of the directory with File Transport Object (obj 70 var 7)
• Waiting for the response
• If the read operation was successful, the master station increases the block number and reads the next
block.

• If the status indicator Last is set in the response, the master station closes the file with File Operation
Status Object (obj 70 var 4).

Every fault record is identified by an existing file. The following information is transferred for this:
• File Name Offset
• File Name Size
• File Type
• File Size
• Time Of Creation
• Permissions
• Request ID

• File Name
The master station can now select the required fault. The transfer takes place in the same manner as with
reading the directory.
3.1 Protocol Characteristics

3.1.5 Amount of Mappable Information

The following information can be mapped:

Information Maximum Mappable Amount
Indications + Controllables at Tx 500
Controllables at Rx 50
Settings at Tx Not supported
Measurements at Tx 100
Counters at Tx 20

3.1.6 Additional Information

The mapping of the commands occurs like the mapping of messages. Here, object group 12 is preset.

Scaling Measured Values

The measured values between the SIPROTEC 5 device and the DNP3 master are transferred as integer values in
16-bit or 32-bit format. 16 bits correspond with a range from 0 to 65 535; 32 bits correspond with a range
from 0 to 4 294 967 295.
You can find more detailed information on this in chapter 1.7.4 Mapping Selection.
The measured values are available in the SIPROTEC 5 device in floating-point format, related to the parameter-
ized rated variables of the primary system in percentage.

Converting Measured Values

Before the transfer of a measured value through DNP3, the measured values must be converted in the
SIPROTEC 5 device. The measured values are scaled.
The scaling of a measured value determines the form of transmission. These forms of transmission are:
• Value type

• Scaling factor

Scaling Factor
The measured value is multiplied in the SIPROTEC 5 device by the scaling factor. The measured values are then
changed into integer measured values (for DNP3) in the floating-point procedure.
Through multiplication with a multiple of 10, decimal places can also be transferred into integer measured
values.

Calculation Formula for Integer Measured Values

The following conditions must be met for the calculation:

• The floating-point number (measured value Float ) is available in the corresponding value type (primary or
secondary value).
• The floating-point number (measured value Float) is available as a percent value.
The integer measured value (measured value Integer) for the transmission through DNP3 is calculated according
to the following formula:

[fomwintr-230310-01.tif, 2, en_US]

Mapping on the Object Status

The following table shows mapping on the object status.
 Table 3-1 Mapping on the Object Status

IEC 61850 Implementation Preferred DNP3 Implementation

Attribute Name Attribute Type Value/Value Point Type Point Count or Comment
Range Note
PACKED LIST – – – –
validity CODED ENUM Good – ONLINE set if –
good
Questionable – COMM_LOST –
detailQual PACKED LIST – – – –
overflow BOOLEAN DEFAULT – ROLLOVER –
FALSE
outOfRange BOOLEAN DEFAULT – OVER_RANGE –
FALSE
badReference BOOLEAN DEFAULT – REFERENCE_ERR –
FALSE
oscillatory BOOLEAN DEFAULT – CHATTER_FILTER –
FALSE
failure BOOLEAN DEFAULT – OFFLINE –
FALSE
oldData BOOLEAN DEFAULT – COMM_LOST –
FALSE
inconsistent BOOLEAN DEFAULT – DISCONTINUITY –
FALSE
inaccurate BOOLEAN DEFAULT – – –
FALSE
source CODED ENUM Process – – –
Substituted – LOCAL_FORCED –
test BOOLEAN DEFAULT – LOCAL_FORCED –
FALSE
operatorBlocked BOOLEAN DEFAULT – LOCAL_FORCED –
FALSE

Number Representation Depending on the Parameterization

If you determine the scaling of a measured value, then you first set the number format and the unit. The
number format contains the number of relevant decimal places.

Percent Values
For percent values, Siemens recommends a scaling factor of 100. This results in an interpretation of the
integer measured value (measured value Integer) through DNP3 with a measured value from ± 32 767. This
corresponds with a percentage value of ± 327.67%.

Secondary Values
If, for example, the values from the transducer inputs are specified in mA, then the transmission of a meas-
ured value as a secondary value makes sense.
The number of significant decimal points depends on the system and transducer data.

Primary Values
The position of the decimal point and the respective unit are determined for primary values based on the para-
meterized rated variables of the primary system.
3.2 Settings and Properties

3.2.1 Settings for the Serial Connection

During the parameterization, make the following settings for the serial communication between the DNP3
master and the SIPROTEC 5 device via DNP3:

[sc_DNP3 serial communication, 1, en_US]

Figure 3-6 DNP3 Serial Connection Settings – When the Setting Enable unsolicited trans. Is off

Parameter Name Description Settings

Slave address Link address of the SIPROTEC 5 device Setting range = 1 to 61 439
Default setting = 1
Master address Address of the DNP3 master Setting range = 1 to 61 439
Default setting = 10
Baud rate The DNP3 communication module supports baud Default setting = 9600 Bd
rates in the range from 2400 Bd to 57 600 Bd.
Data bit 7 data bits or 8 data bits can be set on the communi- 8 data bits must be set for the DNP3
cation module. protocol.
Stop bit The DNP3 communication module supports 1 stop bit Default setting = 1 stop bit
and 2 stop bits.
Parity You set the parity with this parameter. No parity (default setting)
Even parity
Odd parity
Light idle You determine the communication medium with this Not active: Communication via RS485
state (on/off) parameter. If the communication takes place via an On: Communication via optical fiber; rest
optical fiber, the rest position is specified at the same position light on
time. Off: Communication via optical fiber; rest
The light idle state is relevant only for optical position light off (default setting)
modules.
Parameter Name Description Settings
Time zone Time zone of the DNP3 device (must be the same as UTC (default setting )
the time zone of the SIPROTEC 5 device) Local
Superv.time If no communication with a master occurs in the para- Setting range = 0 ms to 3 600 000 ms
com.failure meterized time, an error message is issued. Default setting = 30 000 ms
Link retries The number of transmission attempts (LinkRetries) Setting: Sending with confirmation
If the receiver did not send a confirmation, a data Default setting = 2
package is transmitted again.
Link confirm. The receiver is asked to send a confirmation of the Not for any frame (default setting)
required required packages. Multiframe fragment
All frames
Link confirm. The parameter Link confirm. time-out speci- Default setting = 3000 ms
time-out fies a time interval. During this time interval (in ms),
the receiver waits for a confirmation from the oppo-
site end until the last telegram is repeated. This only
happens, if the information has been sent with confir-
mation. The time starts after the last byte has been
sent.
Appl. confirm. This parameter specifies when a confirmation of the Event-data messages:
required application layer is required. If messages contain event data, then a
confirmation of the application layer is
required.
Non-final fragments:
If telegrams are divided into different frag-
ments, a confirmation of the application
layer is required except for the last frag-
ment, then a confirmation of the applica-
tion layer is required (default setting).
Appl. confirm. The receiver waits during a desired period of time (in Default setting = 9000 ms
time-out ms) until the previous response is confirmed.
If the confirmation of the application layer is used
together with the link confirmation, then make sure
that the time-out of the application layer (AppCon-
Time-out) is long enough to end all transmissions.
The following formula describes this requirement:

Time sync. Time interval (in ms) until the internal display Time 0 = The internal display is never set.
required required is set. This time interval is included in every Default setting = 60 000 ms
response message. The time interval signals to the
master to start a new time synchronization with the
device.
Time betw. sel. A command must be selected and executed in this Default setting = 10 000 ms
& switch. time (in ms).
Enable unsoli- With this parameter, you determine whether unsoli- Off = The unsolicited transmission is not
cited trans. cited transmission is configured. configured and can never be switched on
from a connected master (default setting).
On = The unsolicited transmission is
configured and must be made possible
after the 1st unsolicited response from the
master.
Min. time Minimum time of the telegram repetition following a Setting range = 0 ms to 100 ms
telegr. repet. collision Default setting = 50 ms
Parameter Name Description Settings
Max. time Maximum time of the telegram repetition following a Setting range = 0 ms to 50 ms
telegr. repet. collision Default setting = 50 ms
Max. telegr. Maximum number of the telegram repetitions Setting range = 1 to 200
retries following a collision Default setting = 5

[sc_DNP3SerialConectionSettings_On, 1, en_US]

Figure 3-7 DNP3 Serial Connection Settings – When the Setting Enable unsolicited trans. Is on

The following parameters only make sense if the parameter Enable unsolicited trans. is set to on:
Parameter Name Description Settings
Unsolicited This parameter regulates a condition of the non- Default setting = 10
events class requested transmission for every class of changed
1/2/3 events (class 1, class 2, and class 3).
If the number of events per class equals or exceeds
this value, then an unsolicited response is sent.
Unsolicited This parameter regulates a condition of the non- Default setting = 15 000 ms
time class requested transmission for every class of changed
1/2/3 events (class 1, class 2, and class 3).
If the time (in ms) after an event equals or exceeds
this value, an unsolicited response is transmitted. The
unsolicited message is also sent if only 1 event
occurred.
Unsolicited If no unsolicited response was sent within the time Default setting = 5
retry set under the Unsolicited confirm. time-out
parameter, then this parameter regulates how many
times a different unsolicited response is sent.
Unsolic. Time (in ms) for waiting for the receiver to confirm Default setting = 6000 ms
confirm. time- the non-requested response. If a query to read is
out received in the meantime, the read query is answered
first, and then the unsolicited response is not trans-
mitted.

3.2.2 Settings for Communication through Ethernet

During parameterization, make the following settings for the Ethernet communication on the Ethernet
module between the DNP3 master and the SIPROTEC 5 device via DNP3.
The SIPROTEC 5 device supports 2 DNP3 Ethernet masters on the same Ethernet module. You can click Add
new master to add a new master in DIGSI.

[sc_DNP3EthernetSettings, 1, en_US]

Figure 3-8 DNP3 Ethernet Settings

 [sc_DNP3EthernetSettingsMaster2Added, 1, en_US]

Figure 3-9 DNP3 Ethernet Settings with 2nd Master

Parameter Name Description Settings

Slave address Link address of the SIPROTEC 5 device Setting range = 1 to 61 439
Default setting = 1
Connection Time monitoring setting Setting range: 0 s to 61 439 s
superv. time Default setting = 30 s
Time zone Time zone of the DNP3 device (must be the same as UTC (default setting)
the time zone of the SIPROTEC 5 device) Local
Superv. time If no communication with a master occurs in the para- Setting range = 0 ms to 3 600 000 ms
com.failure meterized time, an error message is issued. Default setting = 30 000 ms
Link retries The number of transmission attempts (LinkRetries) Setting: Sending with confirmation
If the receiver did not send a confirmation, a data Default setting = 2
package is transmitted again.
Link confirm. The receiver is asked to send a confirmation of the Not for any frame (default setting)
required required packages. Multiframe fragment
All frames
Parameter Name Description Settings
Link confirm. The parameter Link confirm. time-out speci- Default setting = 3000 ms
time-out fies a time interval. During this time interval (in ms),
the receiver waits for a confirmation from the oppo-
site end until the last telegram is repeated. This only
happens, if the information has been sent with confir-
mation. The time starts after the last byte has been
sent.
Appl. confirm. This parameter specifies when a confirmation of the Event-data messages: If messages contain
required application layer is required. event data, then a confirmation of the
application layer is required.
Non-final fragments: If telegrams are
divided into different fragments, a confir-
mation of the application layer is required
except for the last fragment, then a confir-
mation of the application layer is required
(default setting).
Appl. confirm. The receiver waits during a desired period of time (in Default setting = 9000 ms
time-out ms) until the previous response is confirmed.
If the confirmation of the application layer is used
together with the link confirmation, then make sure
that the time-out of the application layer (AppCon-
Time-out) is long enough to end all transmissions.
The following formula describes this requirement:

Time sync. Time interval (in ms) until the internal display Time 0 = The internal display is never set.
required required is set. This time interval is included in every Default setting = 60 000 ms
response message. The time interval signals to the
master to start a new time synchronization with the
device.
Time betw. sel. A command must be selected and executed in this Default setting = 10 000 ms
& switch. time (in ms).
Enable unsoli- With this parameter, you specify whether unsolicited Off = The unsolicited transmission is not
cited trans. transmission is configured. configured and can never be switched on
from a connected master (default setting).
On = The unsolicited transmission is
configured and must be made possible
after the 1st unsolicited response from the
master.
Master address Address of the DNP3 master Setting range = 1 to 61 439
Default setting = 10
Master IP IP address of the DNP3 master Setting range = 0.0.0.0 to
address IPv4 address 0.0.0.0 means that the slave can listen to 255.255.255.255
and contact every IP address. Default setting = 0.0.0.0
Port Port number in the range of 1 to 61 439 Default setting = 20 000
 [sc_DNP3EthernetSettings_On, 1, en_US]

Figure 3-10 DNP3 Ethernet Settings - When the Setting Enable unsolicited trans. Is on

NOTE

The Master address of each DNP3 master must be unique.

The combination of Port and Master address must be unique.
When either of the DNP3 master IP addresses is 0.0.0.0, the Port must be unique.

The following parameters only make sense if the parameter Enable unsolicited trans. is set to on:
Parameter Name Description Settings
Unsolicited This parameter regulates a condition of the non- Default setting = 10
events class requested transmission for every class of changed
1/2/3 events (class 1, class 2, and class 3).
If the number of events per class equals or exceeds
this value, then an unsolicited response is sent.
Unsolicited This parameter regulates a condition of the non- Default setting = 15 000 ms
time class requested transmission for every class of changed
1/2/3 events (class 1, class 2, and class 3).
If the time (in ms) after an event equals or exceeds
this value, an unsolicited response is transmitted. The
unsolicited message is also sent if only 1 event
occurred.
Unsolicited If no unsolicited response was sent within the Unso- Default setting = 5
retry licited confirm. time-out parameter, then
this parameter regulates how many times a different
unsolicited response should be sent.
Parameter Name Description Settings
Unsolic. Time (in ms) for waiting for the receiver to confirm Default setting = 6000 ms
confirm. time- the non-requested response. If a query to read is
out received in the meantime, the read query is answered
first, and then the unsolicited response is not trans-
mitted.

The other required IP settings are taken from the module setting.

[sc_ethset, 1, en_US]

Figure 3-11 IP Settings in the Module Setting