DRIVER DNP

DRIVER ELIPSE DNP 3.0 - Master

Technical Facts

Filename DNPMaster.DLL

Vendor Protocol DNP 3.0

Protocol DNP 3.0

Plataform Win32

Current Version V3.02

Dependencies IOKit v1.15

1 Overview about DNP 3.0 Protocol

The DNP (Distributed Network Protocol) is an open, non-proprietary protocol, based on specifications of IEC
(International Eletrotechnical Commission), suitable for use in highly secure, moderate speed and moderate
throughput applications. The protocol is highly flexible and open-ended, without any specific target hardware.
The ISO OSI (International Standards Organization Open System Interconnection) model specifies seven layers
for a network protocol. The IEC specifies a simplified model consisting of the physical, data link and application
layers only. This is termed the Enhanced Performance Architecture (EPA).

User Layer

Application Layer

Data Link Layer

Physical Layer

Communication Media

The figure above shows the EPA structure and how it fits into the entire communication system.
The User Layer can be defined as the place the user will handle data, after all communications. In a SCADA
system it is represented by the user application. It makes use of the Application Layer to send/receive complete
messages to/from a outstation.
The Application Layer is responsible to specify in details the requests from the User Layer, and back to it when
the message comes from the Data Link Layer. In simple words, it joins the messages from User Layer, referred as
a fragment, into a multiple fragment message with complete information to be processed and sent to an
outstation by Data Link Layer.
The Data Link Layer is used to pass messages between primary (originating) stations and secondary (receiving)
2014 Enter your company name DRIVER DNP v4.0.21
 stations. It also packs data and checks it against transmission errors, and controls the needs of each media, as
RS232, RS485, modems, fibre transceivers, etc.
DNP protocol can be configured to Exchange data using polling (Constant communication), or through an
Integrity-Change schema (more efficient). The data change messages are also known as RBE (Report by
Exception) and can happen spontaneously (unsolicited) or non-spontaneously through explicit request from
Master side.

Function Codes

The function code identifies the purpose of the message. There are two groups of function codes; one for
requests and the other for responses. There are several types of request functions, as shown below. The
response functions are used only internally by the driver to control the messages and are not open for the user.

Code Request Function Description

1 Read Request specified objects from Outstation; respond with objects requested
that are available.
2 Write Store specified objects in Outstation; responds with the status of operation.
3 Select Select or arm output points but do not set or produce any output action
(controls, setpoints, analog outputs); respond with the status of the control
points selected. The Operate function code is required to activate these
outputs.
4 Operate Set or produce the output actions on the points previously selected with the
Select function.
5 Direct Operate Select and set or operate the specified outputs; respond with the status of
the control points.
6 Direct Operate NO ACK Select and set or operate the specified outputs but do not send a response to
the request. (It takes less time)
7 Immediate Freeze Copy the specified objects to a freeze buffer.
9 Freeze and Clear Copy the specified objects to a freeze buffer, then clear the objects.
10 Freeze and Clear No ACK Copy the specified objects to a freeze buffer, then clear the objects, but do
not respond.
11 Freeze with Time Copy the specified objects to a freeze buffer at the specified time and
intervals, respond with the status of the operation.
13 Cold Restart Perform the desired reset sequence.
14 Warm Restart Perform the desired partial reset sequence.
20 Enable Unsolicited Messages Enable spontaneous reporting of the specified data objects.
21 Disable Unsolicited Messages Disable spontaneous reporting of the specified data objects.
22 Assign Classes Assign specified data objects to a particular class.
23 Delay Measurement Allows the application to calculate the path delay (or propagation delay)
for a particular outstation.

Object Headers

2014 Enter your company name DRIVER DNP v4.0.21

 The message object header identifies the data types inside a message. It is composed by:

Object + Variation Qualifer Range

Objects

The intelligent devices that use the DNP Application Layer are capable of monitor, control and/or produce a great
amount of data. These data are processed and stored as information objects, and are standardized in such a way
to produce an unique way to describe and represent them.
There are four data objects categories:
Static Objects: Reflect the actual value of a field or internal variable.
Event Objects: These objects are generated as a result of a change in a value or any other stimulant. They are
historical objects, i.e., reflect the data value at some moment in the past.
Frozen Static Objects: Reflect the frozen value of a field or internal variable. Data are frozen as a result of a data
freeze request.
Frozen Event Objects: These are the objects obtained by the change of a frozen data or any other stimulant. They
are historical objects, i.e., reflect the data value at some moment in the past.
Each category is represented with a different object, shown below:

Object Description
Digital Inputs The binary input grouping contains all objects that represent binary (status or Boolean)
input information. The objects 1 - 9 are reserved for these objects.
Digital Outputs The binary output grouping contains all objects that represent binary output or relay control
information. The objects 10 - 19 are reserved for these objects.
Counters The counter grouping contains all objects that represent counters. The objects 20 - 29 are
reserved for these objects.
Analog Inputs The analog input grouping contains all objects that represent analog input information. The
objects 30 - 39 are reserved for these objects.
Analog Outputs The analog output grouping contains all objects that represent analog output information.
The objects 40 - 49 are reserved for these objects.
Time The time grouping contains all objects that represent time in absolute or relative form in any
resolution. The objects 50 - 59 are reserved for these objects.
Classes The class grouping contains all objects that represent data classes or data priority. The
objects 60 - 69 are reserved for these objects.
Files The files grouping contains all objects that represent files or a file system. The objects 70 -
79 are reserved for these objects.
Devices The devices grouping contains all objects that represent device (rather than point)
information. The objects 80 - 89 are reserved for these objects.
Applications The applications grouping contains all objects that represent software applications or
operating system processes. The objects 90 - 99 are reserved for these objects.
Alternate Numeric The alternate numeric grouping contains all objects that represent alternate or custom
numeric representations. The objects 100 - 109 are reserved for these objects.

Variation

Variations represent changes or object sub-types. As an example, a digital input can be represented by a single bit
(0 or 1), by a status byte or contain or not the time information (timestamp). In this way, the combination of object
and variation describe completely an information. Examples:

2014 Enter your company name DRIVER DNP v4.0.21

Object 01 Variation 01 represents a digital input without status (single bit);
Object 01 Variation 02 represents a digital input with status (one byte);
Object 02 Variation 01 represents a digital input change without timestamp;
Object 02 Variation 02 represents a digital input change with timestamp;
Altough all objects can be related to the same digital input, the information can be represented in different ways.

Qualifier

Specifies the meaning of Range field.

Range

Indicates the object amount, initial and final indexes or identifiers for the objects.

Classes

Objects declared in a system or device that implements DNP protocol in a Slave mode can be grouped into classes.
The protocol defines 4 standard classes, like below:
Class 0: It means ALL objects. This is, the master side (this driver for example) at startup can request class 0, and at
the answer the slave side will send the current value of all declared objects.
Class 1 to 3: These are entities that store temporarily event lists(changes) at the objects. Each object needs to be
configured at the slave side to generate events upon data changes, and generally there is a standard between DNP
users to reserve class 1 for digital events, class 2 for analog events and class 3 for counter events.

Introduction to Elipse Driver DNPMaster

Elipse DNP Driver implements the Master behavior of DNP protocol, according to Level 2 specification and some
of the Level 3. We recommend the usage of the configurations below:
- Enable Class 0 Upon Startup and at Regular Intervals (see next Page): In this way all tags will have a value at
application startup;
- Use of Unsolicited Messages OR Event Scans at Regular Intervals: Data updates (as changes happen) can be sent
spontaneously by the slave side OR through automatic event requests (Classes 1,2 and 3) by the driver.
- Tag configuration using Event Objects instead of Static Objects: Tags configured as static objects generate
polling communication (Constant message Exchange), thus generating unecessary network traffic. On the other
hand, tags configured as events dont make communication and are updated automatically as integrity or data
change messages arrive.

Driver Configuration

This section offers information about DNP driver configuration.

Configuration - P Parameters

2014 Enter your company name DRIVER DNP v4.0.21

 P1 Not used (keep it zero).
P2 Not used (Keep it zero).
P3 Not used (Keep it zero).
P4 Keep it zero. If you are using the device Toshiba Regulator, set to 1.

Extra Configurations

Shows the driver config window.

DNP

Figure 1: DNP Config

App Timeout (ms): This is the maximum amount of time the App Layer will wait for a complete response of the
request by DataLink layer. If a communication is in course, this time is extended automatically until the finish of
reception. Standard Value: depends on communication speed.
App Read Retries: Number of communication retries done at application layer in case of transaction failure at
read operations. Standard Value: 0.
App Write Retries: Number of communication retries done at application layer in case of transaction failure at
write operations. Standard Value: 0.
Master Address: This is address of the Master station (PC). It must be different from any slave.
Control Relay On-Time: When Sending Control Relay Commands using PLC tags, this field specifies the normal
on-time for Pulse On/Off or Latch On/Off commands.
Control Relay Off-Time: When Sending Control Relay Commands using PLC tags, this field specifies the normal
off-time for Pulse On/Off or Latch On/Off commands.
Default Slave Address: If you use N1=0 in any tag (N1 is the slave DNP address), the 0 will be replaced by the
Default Slave Address defined in this field.
Delay Between Messages: Delay time applied between each message sent by the driver, in miliseconds.
Error Count for Inactive State: Indicates how many consecutive erros the driver will consider to put the device
into INACTIVE state. The driver will retry communication with the device at next Class message or Polling, or only
at the interval informed at the property Demotion Time, is this option is being used.

2014 Enter your company name DRIVER DNP v4.0.21

 Extra Sync Offset: Additional time (positive or negative) to be added to synchronization commands.
Control Block Qualifier: When performing a control block command (Digital Output command, as Direct Operate,
Select, Operate, etc..) it is necessary to send a qualifier that can vary from equipament to equipament. The
possible values in this field are 39 (or 27h) to range field with 1 byte and object prefixed with 2 bytes, or 40 (or
28h) to range field with 2 bytes and object prefixed with 2 bytes. Please consult the equipment device profile to
check the correct qualifier.
IIN Qualifier: When the slave device informs a device restart, the driver performs a write request to a Internal
Indications Object, informing the acknowledge of the event. Use this field to inform the qualifier (informed at
the Slave Device Profile Document). Most common values are 0 (1 byte start and stop indices) and 1 (2 bytes start
and stop indices).
Data Link Retries: Number of retries at Datalink layer in case of comm failure.
Perform Class 0 Integrity On Startup: Performs a Class 0 request when starting the driver, that receives the whole
equipment database, making all tags to be updated at startup. The event tags, in this case, will have the property
TimeStamp set to the local computer time, and the proprerty quality will be 216.
Enable Unsolicited on Startup: Indicates if the driver should send a message to enable spontaneous messages at
slave device at communication startup. The slave needs to be configured to handle Classes (1, 2 or 3) and support
unsolicited messages as well.
Initialize Upon Receiving Device Restart: Indicates if the driver should send initialization commands (RESET OF
REMOTE LINK, CLASS 0 request and ENABLE UNSOLICITED (if enabled) upon receiving a device restart indication.
Scan for Events Every X ms: Sends a classe 1, 2 and 3 reading request to check for events. Set the time interval the
command will be repeated (Ex: 1000 ms).
Perform Class 0 Integrity every X ms: Performs a Class 0 request cyclically, just to check drivers database against
data losses. The standard time for this is 10 or 15 minutes.

Other

Figure 2: Other DNP Configurations

Counter DeadBand (units): DeadBand amount to check in counters to check if new events are received.
Analog DeadBand (units): DeadBand amount to check in analog points to check if new events are received.
Select/Operate Message Timeout: This is the timeout used to block other driver messages expect operate, right

2014 Enter your company name DRIVER DNP v4.0.21

 after a select command, as explained below.
Use Auto Demotion: Enables the auto-demotion system that takes out and in scan the slaves that are
INACTIVES, i.e., with comm errors. This procedure is used when 2 or more slaves share a channel, avoiding that a
slave with comm errors keep the line busy most of the time.
Demotion Time: Time in seconds that the driver will try to communicate with each INACTIVE slave, verifying if
communication is ok, putting it back on ACTIVE state.
Use Local Time Zone as Sync/Event Time Offset: Instruct the driver to consider the computer Local Time Zone
Offset for all events and sync requests. This option is useful when DNP Server side is at UTC time but you want to
receive events at the relative local time.
Use Callbacks: If you are using IOKIT version 1.15 or higher, the driver can be configured to use callbacks or async
calls to Elipse E3, making it receive immediately the object values as soon as they arrive from communication (in
this case the SCAN property value is not used). If this option is disabled or if you are using an IOKIT version older
than 1.15, tags will respect the scan time to get values.
Use Single Block Read for All Events: Through this option, all events that might have been sent by the device are
reported in a single Block Tag. This option helps to concentrate all events in order to generate single event logs
or connections to other systems, for example. Note: Must be used a block as described at item 4.4 of this
document to remove the incoming events.
Check Select/Operate Message Sequence: Some equipament only permit an operate command if the message
frame number is the very next one (last + 1). By checking this option the driver will not send any command
(except the operate command) until a timeout happens.
Driver in Listen Mode: In this mode, the driver will transmit nothing, but can interpret responses, received from a
sniffer of the communication between other master and a slave.
Scan for Files: Indicates the driver should try to perform file transfers from the device. You need to choose the
transfer profile, actually supporting only Pextron (a protection relay). Other profiles can be added upon
request to Elipse Software.
Wait for Unsolicited Messages after Startup (ms): Indicates how much time the driver shall wait for unsolicited
messages after connection, in order to obtain new events before the integrity request (Class 0). Doing this, the
points with events will receive correct timestamp and corresponding quality, due to the lack of timestamp
information at Class 0 responses..
Discard Events out of Order (by TimeStamp Info): For the event objects with Timestamp information, this option
instructs the driver to discard events which timestamp is older than the most recent processed. This is verified
per each individual tag.
R/W Last TimeStamp Sync Files: By using this option the last timestamp of each tag is saved to a file at pre-
defined intervals, starting at the reception of a new event. On startup, the driver will try to read the same file to
initialize the timestamps and discard old ones, if received. The file can be copied (or sync) between redundant
stations. The name and extension can be informed by the user.

Private Objects

2014 Enter your company name DRIVER DNP v4.0.21

 Picture 3: Extra settings Private Objects

The private objects are declarations that can be generated by each manufacturer, and reflect data structures
composed by basic DNP data types.
The window above represents two lists: The right one has the objects, composed of an index, a fanufacturer code
(4 characters) , an object id number and the total object bytes. The list can be edited through Add, Update and
Del buttons.
Clicking over each object line, you can insert the DNP objects that will take part of each PRO (Private Registration
Objects). Should be informed the object code, variation and amount. The order is also important, and you can
chage it through arrow, Add, Update e Del buttons.
If you use the time objects (code 50), it will be used as PRO TimeStamp.
The option Return All PRO Instances as one indexed block tag makes all PROs to be sent to the same block tag,
since they have the same DNP address. In this case, the block needs one more element, since the first element
will contain the PRO index, and then the other elements, as declared.

Tag N Parameters

N1 Slave address or 0 to use default slave address

N2 Function code to perform (see table 1)
N3 Object code and variation (see table 2)
N4 Variable address or number
N3 must be informed as one parameter according the following formula: ObjectCode * 100 + Variation. Object
Code specifies the type of object (i. e. Binary Inputs) and Variation specifies a sub-type. See table 2 for supported
object codes and variations.
N4 is the address or number of variable, no matter if it is a physical or logical point.

Function Codes

Table 1 Supported code functions

N2 R/W Operation

2014 Enter your company name DRIVER DNP v4.0.21

 -32 R/W Base name for Comtrade File
-31 R/W Circuit Name for Comtrade File
-30 R/W Folder for comtrade files
-22 R Returns a WORD containing Slave Internal Indications IIN1 at LOW byte and
IIN2 at HIGH byte
Bit 0: All stations message received
Bit 1: Class 1 data available
Bit2: Class 2 data available
Bit3: Class 3 data available
Bit 4: Time sync required
Bit 5: Points in local state
Bit 6:Device Trouble
Bit 7:Device Restart
Bit 8:Not implemented
Bit 9:Requested objects unknown
Bit 10:Parameters not valid
Bit 11:Buffer overflow
Bit 12:operation already executing
Bit 13:Configuration Corrupted
Bit 14:Not used
Bit 15:Not used
-21 R State of the address indicated at (0=INACTIVE,1=ACTIVE)
-20 R/W On/Off of the address indicated at N1 (0=OFF,1=ON)
-14 W Request initialization restart (Reset link, Class 0, etc...)
-13 R/w Comm Statistics
N4=0 (Write Only) Clear Statistics
N4=1 Sent Frames
N4=2 No Reply Frames
N4=3 CRC or Format Error Frames
N4=4 Send Errors
N4=5 Transmission Retries
N4=6 Frames Received
N4=7 Frames Sent
N4=8 Frames Received
-11 W Request Class 0
-10 R LinkStatus
-7 W Time Synchronization (Ethernet)
-6 W Time Synchronization (Serial)
0 R READ FROM CACHE: Removes all events that are available for the Tag leaving
the last event as the actual value. For static objects it makes a READ request
before returning the value (polling).
1 R READ EVENTS: Returns all events available for the tag. For static objects it
makes a READ request before returning the value (polling).
2 W Write
3 W Select
4 W Operate
5 W Direct Operate
6 W Direct Operate No ACK
7 W Immediate Freeze
9 W Freeze and Clear
10 W Freeze and Clear No ACK
11 W Freeze with Time
13 W Cold Restart
14 W Warm Restart
20 W Enable Unsolicited Messages

2014 Enter your company name DRIVER DNP v4.0.21

 21 W Disable Unsolicited Messages
22 W Assign Classes
23 R Delay Measurement
50 R Single Block Event
51 R AutoZero Bad Read: Function used when the tag receives only events of
transitions to state 1. In this case the driver inserts a 0 value before sending
each event.
101 R READ (INTEGRITY) Performs an integrity requesting all points declared at N3
field (object*100 + variation). Variation 0 can also be used, corresponding to
any object informed no matter the variation. The integrity is performed every
time the tag is read (Tag Scan).

Supported Objects

Table 2 Objects/Variations/Qualifiers/Supported Functions

Obj Var Description Function Request

(N2 Parameter)

1 1 Bi na ry Input w/o Sta tus 0,1

1 2 Bi na ry Input w/ Sta tus 0,1
2 1 Bi na ry Input Cha nge w/o Ti me 1
2 2 Bi na ry Input Cha nge w/ Ti me 1
2 3 Bi na ry Input Cha nge w/ Rel a ti ve Ti me 1
3 1 Doubl e bi t bi na ry Input w/o Sta tus 0,1
3 2 Doubl e bi t bi na ry Input w/ Sta tus 0,1
4 1 Doubl e bi t bi na ry Input Cha nge w/o Ti me 1
4 2 Doubl e bi t bi na ry Input Cha nge w Ti me 1
10 1 Bi na ry Output 0,1
10 2 Bi na ry Output Sta tus 0,1
11 1 Bi na ry Output Event w/o Ti me 1
11 2 Bi na ry Output Event wi th Ti me 1
12 1 Control Rel a y Output Bl ock 3,4,5,6
20 1 32-bi t Counter 1,7,9,10,11
20 2 16-bi t Bi na ry Counter 1,7,9,10,11
20 3 32-bi t Del ta Counter 1,7,9,10,11
20 4 16-bi t Del ta Counter 1,7,9,10,11
20 5 32-bi t Counter w/o Fl a g 1,7,9,10,11
20 6 16-bi t Counter w/o Fl a g 1,7,9,10,11
20 7 32-bi t Del ta Counter w/o Fl a g 1,7,9,10,11
20 8 16-bi t Del ta Counter w/o Fl a g 1,7,9,10,11
21 1 32-bi t Frozen Counter 1,7,9,10,11
21 2 16-bi t Frozen Counter 1,7,9,10,11
21 3 32-bi t Frozen Del ta Counter 1,7,9,10,11
21 4 16-bi t Frozen Del ta Counter 1,7,9,10,11
21 5 32-bi t Frozen Counter w/ Ti me Of Freeze 1,7,9,10,11
21 6 16-bi t Frozen Counter w/ Ti me Of Freeze 1,7,9,10,11
21 7 32-bi t Frozen Del ta Counter w/ Ti me Of 1,7,9,10,11
Freeze

2014 Enter your company name DRIVER DNP v4.0.21

 Obj Var Description Function Request
(N2 Parameter)

21 8 16-bi t Frozen Del ta Counter w/ Ti me Of 1,7,9,10,11

Freeze
21 9 32-bi t Frozen Counter w/o Fl a g 1,7,9,10,11
21 10 16-bi t Frozen Counter w/o Fl a g 1,7,9,10,11
21 11 32-bi t Frozen Del ta Counter w/o Fl a g 1,7,9,10,11
21 12 16-bi t Frozen Del ta Counter w/o Fl a g 1,7,9,10,11
22 1 32-bi t Counter Cha nge Event w/o Ti me 1
22 2 16-bi t Counter Cha nge Event w/o Ti me 1
22 3 32-bi t Del ta Counter Cha nge Event w/o 1
Ti me
22 4 16-bi t Del ta Counter Cha nge Event w/o 1
Ti me
22 5 32-bi t Counter Cha nge Event w/ Ti me 1
22 6 16-bi t Counter Cha nge Event w/ Ti me 1
22 7 32-bi t Del ta Counter Cha nge Event w/ Ti me 1
22 8 16-bi t Del ta Counter Cha nge Event w/ Ti me 1
23 1 32-bi t Counter Cha nge Event w/o Ti me 1
23 2 16-bi t Frozen Counter Event w/o Ti me 1
23 3 32-bi t Frozen Del ta Counter Event w/o 1
Ti me
23 4 16-bi t Frozen Del ta Counter w/o Ti me 1
23 5 32-bi t Frozen Counter Event w/ Ti me 1
23 6 16-bi t Frozen Counter Event w/ Ti me 1
23 7 32-bi t Frozen Del ta Counter Event w/ Ti me 1
23 8 16-bi t Frozen Del ta Counter Event w/ Ti me 1
30 1 32-bi t Ana l og Input 0,1
30 2 16-bi t Ana l og Input 0,1
30 3 32-bi t Ana l og Input w/o Fl a g 0,1
30 4 16-bi t Ana l og Input w/o Fl a g 0,1
30 5 32-bi t Ana l og Input Fl oa ti ng Poi nt 0,1
31 1 32-bi t Frozen Ana l og Input 0,1
31 2 16-bi t Frozen Ana l og Input 0,1
31 3 32-bi t Frozen Ana l og Input w/ Ti me Of 0,1
Freeze
31 4 16-bi t Frozen Ana l og Input w/ Ti me Of 0,1
Freeze
31 5 32-bi t Frozen Ana l og Input w/o Fl a g 0,1
31 6 16-bi t Frozen Ana l og Input w/o Fl a g 0,1
31 7 32-bi t Frozen Ana l og Input Fl oa ti ng Poi nt 0,1
32 1 32-bi t Cha nge Event w/o Ti me 1
32 2 16-bi t Cha nge Event w/o Ti me 1
32 3 32-bi t Ana l og Cha nge w/ Ti me 1
32 4 16-bi t Ana l og Cha nge Event w/ Ti me 1
32 5 32-bi t Ana l og Cha nge Fl oa ti ng Poi nt w/o 1
Ti me
32 7 32-bi t Ana l og Cha nge Fl oa ti ng Poi nt wi th 1
Ti me
33 1 32-bi t Frozen Ana l og Event w/o Ti me 1

2014 Enter your company name DRIVER DNP v4.0.21

 Obj Var Description Function Request
(N2 Parameter)

33 2 16-bi t Frozen Ana l og Event w/o Ti me 1

33 3 32-bi t Frozen Ana l og Event w/ Ti me 1
33 4 16-bi t Frozen Ana l og Event w/ Ti me 1
33 5 32-bi t Frozen Ana l og Fl oa ti ng Poi nt w/o 1
Ti me
33 7 32-bi t Frozen Ana l og Fl oa ti ng Poi nt wi th 1
Ti me
34 1 16-bi t Ana l og Input Dea dba nd 1
34 2 32-bi t Ana l og Input Dea dba nd 1
34 3 32-bi t Ana l og Input Fl oa ti ng Poi nt 1
Dea dBa nd
40 1 32-bi t Ana l og Output Sta tus 1
40 2 16-bi t Ana l og Output Sta tus 1
40 3 32-bi t Ana l og Output Sta tus Fl oa ti ng Poi nt 1
41 1 32-bi t Ana l og Output Bl ock 2,3,4,5,6
41 2 16-bi t Ana l og Output Bl ock 2,3,4,5,6
41 3 32-bi t Fl oa ti ng Poi nt Ana l og Output Bl ock 2,3,4,5,6
42 1 32-bi t Ana l og Output Event w/o Ti me 1
42 2 16-bi t Ana l og Output Event w/o Ti me 1
42 3 32-bi t Ana l og Output Event wi th Ti me 1
42 4 16-bi t Ana l og Output Event wi th Ti me 1
42 5 32-bi t Fl oa ti ng Poi nt Ana l og Output Event 1
w/o Ti me
42 7 32-bi t Fl oa ti ng Poi nt Ana l og Output Event 1
wi th Ti me
50 1 Ti me a nd Da te 1,2
51 1 Ti me a nd Da te CTO 1
51 2 Uns ynchroni zed Ti me a nd CTO 1
52 2 Ti me Del a y Fi ne 1
60 1 Cl a s s 0 Da ta 1
60 2 Cl a s s 1 Da ta 1
60 3 Cl a s s 2 Da ta 1
60 4 Cl a s s 3 Da ta 1
80 1 Interna l Indi ca ti ons 1, 2
83 1 Pro 1
110 X Octet Stri ng 1
111 X Octet Stri ng Event 1
Obj = Object Code; Var = Variation; CTO = Common Time of Occurrence

OBS: STATIC OBJECTS IN RED, EVENTS IN BLUE

Supported Qualifiers

Table 3 Qualifiers Used

Object / Variation Send Qualifier Reception Qualifier

2014 Enter your company name DRIVER DNP v4.0.21

 Sta ti c Objects i n Genera l (READ) 1 0, 1, 7, 8, 17, 18, 27, 28, 47, 58

Object 34 (WRITE) 1 0, 1, 7, 8, 17, 18, 27, 28, 47, 58

Obj 60 (Cl a s s es ) or Genera l Integri ty 6 0, 1, 7, 8, 17, 18, 27, 28, 47, 58

Reques ts (READ)

Obj 50 (WRITE) 7 0, 1, 7, 8, 17, 18, 27, 28, 47, 58

Obj 80 (WRITE) Us er Defi ned 0, 1, 7, 8, 17, 18, 27, 28, 47, 58

Obj 12, Obj 41 (SELECT,OPERATE, etc.) Us er Defi ned 0, 1, 7, 8, 17, 18, 27, 28, 47, 58

Block B Parameters

B1 Slave address or 0 to use default slave address

B2 Function code to perform (see table 1)
B3 Object code and variation (see table 2)
B4 Initial Variable address or number. The block size will indicate how many
variables should be read.

Block usage for reading events is NOT permitted as all block elements share a single timestamp, what cant be
accepted due to the uniqueness of each event with its own timestamp. So if you want to use blocks, they will work
only with pollings (B2 parameter = 0 READ FROM CACHE). The exception is the SINGLE BLOCK EVENT, as in this case
the timestamp of each event will be reported in a single fixed block element.

Tag Configuration Examples

Taking as example a device with DNP Address=3, here we have some examples of N1, N2, N3 and N4 parameters at
format N1.N2.N3.N4:
Digital Input 100, Object 1 Variation 2: 3.1.102.100 (configured as static object)
Digital Input 100, Object 2 Variation 2: 3.1.202.100 (configured as event)

At example above, both tags reference the same variable (digital input 100). However, the first tag keeps asking
continuously its value (polling) while the second only receives notifications when the point changes de value.
Beyond that, at the event form the timestamp of the change originated at the device is kept and reported at the tag
timestamp property, while in static mode (as there is no timestamp) the timestamp is the computer local time.

General Comments
General comments and driver specific functions.

Events and Data Integrity

The Integrity Command performs a READ request of all data configured at the salve side, for all objects (Class 0) or
for specific objects.
Due to the particularity of DNP protocol to send at integrity the current variable values (therefore as static objects
and not as events), its necessary for the driver to process the information in order to unify the static values with
the event values, in a way that the application will need a single tag for the point.
If the application uses tags as events (as recommended) during initialization, upon receiving an integrity (class 0)
with the static value of a point, a provisory event will be generated with tag Quality property equal to 216

2014 Enter your company name DRIVER DNP v4.0.21

(GOOD, LOCAL OVERRIDE). This indicates that the timestamp was not originated by the device, but by the local
computer, due to the absence of timestamp information at integrity.
As soon as an event for the tag arrives, the quality property will reflect the event quality (generally 192 = GOOD)
and the timestamp property will reflect the event timestamp (if exists).
Obs: For quality values and mappings from DNP status, please check section 4.5.

Event Collection

A correct Driver Event reception is fundamental for the event tags to receive their values. The driver will only
discover that there are events for one of the event classes (1,2 or 3) is the system uses at least one of the options
below:
The option Scan for Events Every X ms at driver configuration is enabled. This will instruct the driver
to request the classes at fixed intervals, receiving the events.
The device sends events spontaneously using unsolicited messages.
The application has at least one tag configured for a static object read. (Ex: digital input/output,
analog input/output, etc..)

Commands

When using relay commands (Object 12, Variation 1) a sequence of information fields is sent, as defined below:

Byte 0: Control Code

The control code field indicates the control function to perform. The applicability of this code will depend on the
type of hardware used in the end device. This byte is divided as follows:

Bit 7 6 5 4 3 2 1 0

Description Trip/Close Clear Queue Code

Trip/Close: This field determines which control relay to activate in a system where a trip and close relay pair is used
to energize and de-energize the field points. The possible values are (in binary): 00 = NUL; 01 = Close; 10 = Trip. The
NUL value in this field can be used to activate the field point select relay only without activating the trip or close
relays. In a system without field point select relays, the NUL value would not perform any control operation. In a
system without trip/close relays, this field should always be NUL to indicate a normal digital control operation
where the exact control point is inherently known. This field does not support having both the trip and close
attributes simultaneously, as this is an illegal operation for the system.
Clear: If the control operation has the Clear attribute set, all control operations are removed from the queue
including the presently running control and this control operation is performed.
Queue: If the control code is NUL then no control operation is queued, and the queue is cleared of all controls
including the presently running control if the Clear attribute is set.
When the control function is executed and completed, it is removed from the queue. If the control block for that
operation had the Queue attribute set, the control operation is re-queued (to the back of the queue) for that point.
Code: The control block can be used with devices which support control queuing on a point per point basis or
devices which have other control mechanisms. In the former, any control command should be queued for the
particular point in question. In the latter, each control is performed until completion before the next control is
accepted for that point.

Possible values for CODE (in binary)

Value Operation Description
2014 Enter your company name DRIVER DNP v4.0.21
 0000 NUL No operation specified. Only the R attribute is processed.
0001 PULSE ON The point(s) is turned on for the specified on-time, turned off for the specified
off-time and left in the off state.
0010 PULSE OFF The point(s) is turned off for the specified off-time, then turned on for the
specified on-time and left in the on state.
0011 LATCH ON This latches the point(s) on.
0100 LATCH OFF This latches the point(s) off.

Other values out of this table are undefined.

Byte 1: Count
The Count field determines how many times the control is executed. If the count is 0, do not execute the control.
When the count reaches 0, the control is complete.

Bytes 2 to 5: On Time
The on-time field specifies the amount of time the digital output is to be turned on (may not apply to all control
types).

Bytes 6 to 9: Off Time

The off-time field specifies the amount of time the digital output is to be turned off (may not apply to all control
types).

Bytes 10: Status

Operation status, present only at response message and used by the driver to check if the operation was concluded
successfully. The codes are:
0 : Command executed correctly (including Select and Operate commands)
1: Operate sent after the maximum Select timeout, defined at the slave device
2:Operate was sent without a prior select
3:Message Format errors
4:Operation not supported for the point
5:Queue Full or point already active
6:Hardware Problems
Other: Non-standard error codes.

The Status Field can be obtained at Elipse E3 through the parameter WStatus of WriteEx method (See example
below).
To send this command, you can use single tags (PLC or IOTags) and/or block tags. To use a PLC tag, you have to set a
number from 0 to 255 (corresponding to Control Code byte) as the tag value. The remaining bytes will be obtained
from the Extra dialog definitions.
For the block tag you have to use a script calling the Write() function. To perform this, the block should have four
elements, with individual write properties disabled. The elements are:
Element 0 = Control Code
Element 1 = Count
Element 2 = Relay OnTime
Element 3 = Relay OffTime
This feature can be used if different command settings have to be used for each point, not using the default
OnTime and OffTime settings.

2014 Enter your company name DRIVER DNP v4.0.21

Script Example (Elipse E3) using a single command tag

Val ue = 65 / / Oper at i on Code

msg = MsgBox( " Do you want t o send a command?" , 292, " Command" )
I f msg = 7 Then
MsgBox " Command abor t ed" , 48, " Gi ve Up"
El seI f msg = 6 Then
I f MsgBox( " Conf i r m Command Send?" , 292, " At t ent i on" ) = 6 Then
Set Tag = Appl i cat i on. Get Obj ect ( " Dr i ver DNP. TagName" )
I F Tag. Wr i t eEx( Val or , , , WSt at us) = f al se Then
MsgBox " Command Er r or " , 48, " Er r or "
El se
I f WSt at us <> 0 Then
MsgTr ack = " Command not Execut ed, "
EndText = " "
sel ect case WSt at us
case 1
Endt ext = " Oper at e r ecei ved af t er Ar m t i meout "
case 2
Endt ext = " No pr evi ous Sel ect message"
case 3
Endt ext = " Command For mat Er r or s"
case 4
Endt ext = " Oper at i on not suppor t ed f or t hi s poi nt "
case 5
Endt ext = " Queue Ful l or Poi nt al r eady act i ve"
case 6
Endt ext = " Har dwar e Pr obl ems"
case el se
Endt ext = " Undef i ned Pr obl em"
end sel ect
MsgBox " MsgTr ack & EndText " 48, " Er r or "
End I f
End I f
End I f

Script Example (Elipse SCADA) using a Block with 4 elements:

Configurations: B2=5 (DIRECT OPERATE), B3 = 1201

Bl ock1. El ement 0 = 65 / / oper at i on code

Bl ock1. El ement 1 = 1 // count
Bl ock1. El ement 2 = 500 / / on t i me
Bl ock1. El ement 3 = 500 / / of f t i me
Bl ock1. Wr i t e( )

Single Block Events

If the option Use Single Block Read for All Events is set, you can use a block to receive all events. The block has the
following configuration:
N1 = DNP Address
N2 = 50
N3,N4 = not used
Size: Until 7 elements, as below:
Element 0: Object Code

2014 Enter your company name DRIVER DNP v4.0.21

Element 1: Variation Code
Element 2: Object Index
Element 3: Status
Element 4: Value
Element 5: TimeStamp
Element 6: Quality
OBS: The Single Block Event CANNOT be used in conjunction with other event tags in na application.

Quality Information

For the objects with status indications (most of them), this driver performs a mapping to OPC standard used in
Elipse E3, as explained here:

For objects 1,2 and 10:

Bit 7 6 5 4 3 2 1 0

Meaning XX XX CF LF RF CL RS OL

OL (ONLINE): at 0, Q = 12 (BAD, DEVICE FAILURE)

CL (COMM LOST): at 1, Q = 12 (BAD, DEVICE FAILURE)
RS (RESTART): at 1, Q = 68 (UNCERTAIN)
CF (CHATTER FILTER) at 1, Q = 80 (UNCERTAIN)
RF (REMOTE FORCED): at 1, Q = 216 (GOOD, LOCAL OVERRIDE)
LF (LOCAL FORCED): at 1, Q = 216 (GOOD, LOCAL OVERRIDE)

For object 40:

Bit 7 6 5 4 3 2 1 0

Meaning 0 RE OR LF RF CL RS OL

OL (ONLINE): em 0, Q = 12 (BAD, DEVICE FAILURE)

CL (COMM LOST): em 1, Q = 12 (BAD, DEVICE FAILURE)
RS (RESTART): em 1, Q = 68 (UNCERTAIN)
RE (REFERENCE ERROR): em 1, Q = 80 (UNCERTAIN)
OR (OVER RANGE): em 1, Q = 66 (UNCERTAIN)
RF (REMOTE FORCED): em 1, Q = 216 (GOOD, LOCAL OVERRIDE)
LF (LOCAL FORCED): em 1, Q = 216 (GOOD, LOCAL OVERRIDE)

For other objects:

Bit 7 6 5 4 3 2 1 0

2014 Enter your company name DRIVER DNP v4.0.21

 Meaning 0 XX XX LF RF CL RS OL

OL (ONLINE): em 0, Q = 12 (BAD, DEVICE FAILURE)

CL (COMM LOST): em 1, Q = 12 (BAD, DEVICE FAILURE)
RS (RESTART): em 1, Q = 68 (UNCERTAIN)
Bits 5 ou 6 em 1, Q = 80 (UNCERTAIN)
RF (REMOTE FORCED): em 1, Q = 216 (GOOD, LOCAL OVERRIDE)
LF (LOCAL FORCED): em 1, Q = 216 (GOOD, LOCAL OVERRIDE)

Obs: Remembering that according to OPC standard, if quality is greater or equal to 192 it is considered GOOD.

History Revision

Version Date Author Com m ents

4.0.21 10/27/2014 M. Salvador Includes the changes available in beta versions:

- Support to objects 4003, 4103 (Case 15232)
- Migration to VS 2013 (Case 16392)
- Migration to IOKIT 2.0 (Case 13516)
- Allows negative values at Extra Sync Offset
- Correction of check event and class 0 timers when the computer clock
goes back in time (does not use etGetTimeDouble() method)
- Generation of files to sync last timestamp (Case 13528)
- Fixed vulnerability as notified by ICS-CERT VU-028282, obtained by
testing against DNP emulator Aegis Fuzzer. (Case 16590)
- Performance improvement when thousands of drivers are used
simultaneously (Case 13117)
- Fixed problem when the driver has only event tags with callback option
enabled (cases 14040, 16088)
- Support to Octet String objects 110 and 111 (Case 16920)
- Bypass Reset of Remote Link request if first message message from
slave is unsolicited (Case 15233)
3.02 2012-02-01 M. Salvador Includes the changes available in Beta versions:
Beta 1: Fix at Single Block Event
Beta 2: Support to READ object 50 Var 01
Fix qualifiers 7 and 8
Upon connection, Event request is sent before Class 0
Beta 3: Fixed check of events out of order
Beta 4: Time to wait for unsolicited message in ms
Beta 5: Check of events out of order is per tag
Beta 6: Fixed log message for CRC errors
Beta 7: Fixed quality information at Single Block Event
Beta 8,9: Fixed sequence number expected at Application Layer
Beta 10: Fixed Double points 3 and 4
Beta 11: Tag indicating Received Frames
Beta 12: Write Command for Object 10 Var 1
Beta 13: Optimization of transmission wait time when not connected
Beta 14: Tag N2=-21 now informs ACTIVE only after reception of a
RESET OF REMOTE LINK response
Beta 15: Treatment of 05 duplicated at the frame beginning (ex: 05 05 64)
Beta 16: Separated the Send, Receive and Check Processes
Beta 17: Send Process is now synchronous with Application Layer
Beta 18: Option to apply Local Time Zone to events and Sync
Beta 19: Option to discard old events was always being applied
Beta 20: Bytes Sent and Received at Statistics
Beta 21: Performance improvements with several tags using callbacks
Beta 22: Correction on treatment of object 10 variation 1
Beta 23: Implemented confirmation of application messages without a
reset of remote link, in order to permit unsolicited message processing,
received right after connection

2014 Enter your company name DRIVER DNP v4.0.21

 Beta 24: Added Internal Indications monitoring Tag IIN (-22)
3.01 2009-12-14 M. Salvador - Fixed Case 11020. The connection was considered INACTIVE as soon
as it entered in ACTIVE state, due to an internal typing mistake.
- Driver dll renamed to DNPMaster.dll
3.00 2009-11-30 M. Salvador - Options Read from Cache and Read Events, making this driver similar
to IEC 60870-101/104 behavior.
- Documentation Revision
2.29 2008-11-30 M. Salvador - Several Small adjustements.
- Device Restart Reinitialization
2.28 2006-10-29 M. Salvador - Independent Read/Write Retries
- Single Event Block option
- Unsolicited Msg Enable at startup
2.20 2005-12-20 M. Salvador - On/Off Control
- Active/Inactive Control
- Auto-Demotion
2.19 2005-10-11 M. Salvador - Upgrades in Data Access
- Check of events based on Class readings instead of clock readings
V2.18 2005.09.30 M. Salvador - Integrities and Internal Pollings.
v2.17 2005.06.24 M.Salvador - Add support to Toshiba Regulator device (case 5768)
v1.00 2004.08.03 M.Salvador - All previous versions until then.

2014 Enter your company name DRIVER DNP v4.0.21

Headquarters Branch SP
Rua 24 de Outubro, 353 - 10 andar Rua dos Pinheiros, 870 - Conj. 141/142
90510-002 Porto Alegre RS 05422-001 So Paulo - SP
Phone: (51) 3346-4699 Phone: (11) 3061-2828
Fax: (51) 3222-6226 Fax: (11) 3061-2828
E-mail: elipse@elipse.com.br E-mail: elipse-sp@elipse.com.br

Branch PR Branch MG
Av. Sete de Setembro, 4698/1705 Rua Antnio de Albuquerque, 156
80240-000 Curitiba - PR 7 andar Sala 705
Phone: (41) 3342-0120 30112-010 Belo Horizonte - MG
Fax: (41) 3342-0120 Phone: (31) 2511-2121
E-mail: elipse-pr@elipse.com.br E-mail: elipse-mg@elipse.com.br

Branch RJ USA
Av. Praia de Botafogo, 300/525 2501 Blue Ridge Road, Suite 250
22250-044 Rio de Janeiro - RJ Raleigh - NC - 27607 USA
Phone: (21) 2158-1015 Phone: +1 (252) 995-6885
Fax: (21) 2158-1099 Fax: +1 (252) 995-5686
E-mail: elipse-rj@elipse.com.br E-mail: info@elipse-software.com

Taiwan
9F., No.12, Beiping 2nd St., Sanmin Dist.
807 Kaohsiung City - Taiwan
Phone: +886 (7) 323-8468
Fax: +886 (7) 323-9656
E-mail: evan@elipse.com.br

Check our website for information about a representative in your country.

www.elipse.com.br
kb.elipse.com.br
elipse@elipse.com.br