dnp3 tutorial

5/22/2018 Dnp3 Tutorial

1/12

DPS TelecoYour Partners in Network Alarm Monitoring

DNP3 Tutorial:

Learn the Industry-Standard SCADA Protocol

Version 1.0

Released August 21, 2012

www.dpstelecom.com 1-800-622-3314

We protect your network like your business depends on itTM

This guide will teach you...

-The fundamentals of DNP3

-How to understand DNP3 communication

-8 Important Considerations in DNP3 SCADA Systems

Read this guide to learn how to get started with DNP3

today...

DNP3 packet structure


2/122

Copyright 2012 DPS Telecom

All rights reserved, including the right to reproduce this white paper or portions thereof in any form without wri

permission from DPS Telecom. For information, please write to DPS Telecom 4955 E. Yale Ave., Fresno, CA 93727-1

1-800-622-3314 [email protected]

Printed in the U.S.A


3/12

DNP3 DPS Telecom 4955 East Yale Avenue, Fresno, CA 93727 (800) 622-3314 Fax (559) 454-1688 www.dpstelecom.com

How This White Paper Will Help You

This DNP3 reference guide was written for you, the professional who needs to monitor SCADA equipment w

DNP3. Most DNP3 books go way too deep and just arent practical. Who has time for all that?

Ive written this DNP3 tutorial to give you the information you need to successfully implement and maint

DNP3 monitoring in your SCADA system. Its an introduction to SCADA from your own perspective, and

has the fast, specific answers you need to make DNP3 work for you...

Contents

Part 1: An Introduction to DNP3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

DNP3 Uses a Master/Remote Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Part 2: How DNP3 Elements Communicate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Part 3: Understanding the DNP3 Object Library . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Part 4: Understanding the DNP3 Message Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Part 5: Understanding Layered Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A Critical Tool for Troubleshooting Communication Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Traversing the Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Part 6: 8 Important Considerations in DNP3 SCADA Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

DPS Telecom Guarantees Your Success - or Your Money Back . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

What to Do Next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

About the Author . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

3



4/124


DNP3 uses a Master/Remote Model

DNP3 is typically used between centrally located

masters and distributed remotes. The master pro-

vides the interface between the human network

manager and the monitoring system. The remote

provides the interface between the master and the

physical device(s) being monitored and/or con-

trolled. The master and remote both use a library

of common objects to exchange information. TheDNP3 protocol contains carefully designed capa-

bilities that enable it to be used reliably even ove

media that may be subject to noisy interference.

Part 1: An Introduction to DNP3

Since its introduction in 1993 as an immediately

deployable solution for monitoring critical infra-

structure status and allowing reliable remote con-

trol, Distributed Network Protocol (DNP or DNP3)

has achieved widespread acceptance. GE-Harris

Canada (formerly Westronic, Inc.) is generally cred-ited with the seminal work on the protocol but it is

now implemented by an extensive range of manu-

facturers in a variety of industrial applications.

DNP3 is based on an object model that greatly

reduces the bit mapping of data that is traditionally

required by other less object oriented protocols. It

also reduces the wide disparity of status monitoring

and control paradigms generally found in proto-

cols that provide virtually no pre-defined objects.

Purists of these alternate protocols would insist thatany required object can be built from existing

objects. Having some pre-defined objects though,

makes DNP3 a somewhat more comfortable design

and deployment framework for SCADA engineers

and technicians.

DNP3 Gear

T/Mon LNX

T/Mon SLIM SCADA Guardian

When seeking out DNP3 equipment, it is im-

portant to find a unit that will give you the most

functionality for your money. DNP3 gear typical-

ly pays for itself several times over by preventing

lost revenues from outages by maximizing your

network uptime. Deploy a DNP3 RTU today,

and get superior visibility and control over your

network.

A typical DNP3 master/remote

monitoring system architecture.

Visit www.dpstele.com/rtus or call 1-800-693-0351 for

more SNP3/SCADA equipment


5/125


Part 2: How DNP3 Elements Communicate

DNP3 uses 27 basic function codes to exchange information

between Masters (think Control Center) and Remotes (think

pump yard). Some of those function codes enable a Master

to request and receive status information from a Remote.

Other function codes enable a Master to determine or adjust

the configuration of a Remote.

Several function codes are defined for a DNP3 Master to

control the Remote itself or equipment co-located with

the Remote. One function code is provided to enable the

Remote to respond autonomously with an Unsolicited

Message to particular events that occur in its installation

space.

As you can see, most of the messages are issued by the

DNP3 manager to the DNP3 remote. However, because

the Unsolicited Message is capable of being initiated by aRemote, it is typically used to report alarms. This notifies

the DNP3 Master as soon as an alarm condition occurs,

instead of waiting for the next request.

Part 3: Understanding the DNP3 Object Library

The DNP3 framework includes a library of objects that are

typically used in SCADA systems. This library is available

for downloading to members of the DNP Users Group; visit

www.dnp.org for more information. These objects include

such things as Binary Inputs that are used to report equip-

ment characteristics that have two states; power is on or off,

an access panel is open or closed. Another common object

is an Analog Input that is used to report characteristics that

have a range of values; exhaust fan speed can be anywhere

from 40 to 400 RPM, main power can vary from 110 to 128

VAC.

This library makes it easy for the manufacturer to design

the DNP3 Remote responder to use these common objects

to report to upstream Masters. It also makes it easier forMasters to integrate the data collected from Remotes and

present it for decision making.

Without this framework of common objects, manufactur-

ers must develop their own model for reporting status and

providing control capability. These models, frequently quite

different one from another, must then be compiled into the

Masters and usually converted into some kind of common

objects for efficient management. Another tool often found

in these more open frameworks is a proprietary interface

Questions to Ask: Your

SCADA Site Survey

RTU Capacity and Function

1. How many sites do you need to moni

tor?

2. Do you want video surveillance at thos

sites?

3. Do you want a building access contro

system to manage entry to those sites?

4. How many alarm points do you need t

monitor at each site?

5. How much growth, in sites and alarms a

each site, do you anticipate over the nex

5 years?

6. Do you need any analog sensors (e.g

voltage, temperature, humidity, signastrength)?

Installation

1. How do you currently connect to you

remote sites? (LAN, overhead, digita

or analog circuit, terminal server, micro

wave?)

2. Do any of your sites support an alternat

path communications link?

3. What type of power do you have at th

master and remote sites? (48 VDC, 11

VAC, other?)

4. How do you want to mount your RTUs

(23 rack, 19 rack, wall, tabletop?)

5. Who will install your RTUs?

This is just a small sample of the DPS Telecom

SCADA Site Survey. The full SCADA Sit

Survey is a complete 5-page guide to evaluating your network alarm monitoring needs

For your copy of the Remote Site Survey

call DPS Telecom at 1-800-622-3314.


6/12


6

or translation module to access and control the Remote.

Objects in the DNP3 library are divided into Groups and

Variations. For example, the Analog Input group has six

variations to provide 16 or 32 bit integer or floating poin

values with or without a status bitmap. The Analog Eve

group has eight variations to provide 16 or 32 bit integer

floating point values with a status bitmap and with or wit

out a timestamp. Note that the Analog Event group does

not include variations without a status bitmap.

Part 4: Understanding DNP3 Message

Structure

Lets examine the structure of the messages exchanged

between masters and remotes. Basic serial telemetry pro-

tocols, like TBOS, are byte-oriented, with a single byte

exchanged to communicate. Expanded serial telemetry

protocols, like TABS, are packet oriented with packets

of bytes exchanged to communicate. The packets containheader, data and checksum bytes. DNP3 is also packet or

ented and uses the packet structure (element sizes in bits)

shown in the illustrated figure below.

The Master sends a Read request for an object or objects

and the Remotes response contains the requested infor-

mation if available. The Master sends an Operate com-

mand to produce the output actions associated with the

selected object reference. The Remote sends an Unsolici

Message when a specific event occurs.

The following figure shows the message packet format.

The DNP3 application service data unit (ASDU) is worth

of special note for the clever content adjustment that is

controlled by the qualifier and indexSize fields. This des

makes application data available in an impressively flexi

number of configurations or omitted all together if desire

Perfect-Fit Solutions DPS -

Without the NRE Fees

When choosing your DNP3 SCADA equip-

ment, shouldnt you only pay for the things

you need? Many monitoring and SCADA

solutions come pre-packaged as a generic

one-size-fits-all solution, but your networkisnt like everyone elses.

Thats why perfect-fit and fully customizable

engineering such a valuable tool. Instead

of overspending on equipment to get all of

the functionality you need, you can have

tailor-made devices designed to tackle your

specific SCADA challenges.

What can perfect-fit engineering do for

you?

Spend less on equipment by having gear

that gives you all of the features you

need, without forcing you to pay for the

ones you dont.

Youll know that a device is going to fit

right into your network.

Get guaranteed results with a 30 day

money-back guarantee.

http://www.dpstele.com/rtus

DNP3 packet structure illustrated.

Link

Transport

Application

D

N

P3

L

a

y

e

r

s


7/127


3 Advanced RTUs

The NetGuardian RTU family scales to f

your needs

NetGuardian 832A G5:

32 discretes, 32 pings, 8 analogs and

controls

SNMPv1, v2c and v3 compatible

8 terminal server serial ports

Dial-up backup

Web browser interface

Pager and email notification

Dual -48 VDC, -24 VDC or 110 AC

1 RU for 19 or 23 rack

DNP3 RTU NetMediator 864A

64 discretes, 8 controls

Reports alarms via DNP3 or SNMP ove

LAN

1 RU for 19 or 23 rack

Economical NetGuardian 216

16 discretes, 2 analogs, 2 controls

1 terminal server serial port

Single or dual -48VDC or 110 VAC

2 compact form factors for rack or wa

mount

http://www.dpstele.com/rtus

Part 5: Understanding Layered Communication

A Critical Tool for Troubleshooting Communication

Problems

We continue to examine the Distributed Network Protocol

(DNP3) focusing specifically on the layered communica-

tion model used to exchange information. The last section

focused on the structure of DNP3 messages and illustrated

the first few layers of the message.

The application layer combines an application service data

unit (ASDU), a packaged object in itself, with an applica-

tion protocol control info (APCI) block to make an applica-

tion protocol data unit (APDU).

The transport layer breaks the APDU into segments with a

maximum size of 16 bytes and packages them with an 8-bit

transport control header and 16-bit segment CRC separa-

tors into a transportFrame.

The link layer adds a header the control and addressing

information to prepare the packet for delivery to a specific

destination.

These layers can be mapped to the four-layer model devel-

oped by the Department of Defense (you may recall the

DoD origins of the Internet) with the DoD Internet Layer

omitted.

If the serial transport is used, the packet assembly is com-pleted and placed on the transport media for delivery.

If the packet will be sent over a LAN/WAN, the three

DNP3 layers are rolled up into the application layer. The

assembled packet is wrapped in the Transport Control

Protocol (TCP) by the transport layer, which in turn is

wrapped in the Internet Protocol (IP) by the (somewhat

obvious) internet layer. The User Datagram Protocol (UDP)

can also be used but presents some additional issues related

to reliable delivery in congested networks

The fourth layer is the Network Interface layer where the

assembled packet is actually interfaced to some kind of

transport media (for example, twisted pair copper, RG58

co-axial or fiber). While this multi-layer model may seem a

bit confusing, it effectively isolates the tasks of communi-

cation and ultimately assists in designing and implementing

a network.


8/12


8

Traversing the Layers

To illustrate the function of this layered model, lets look

at a single DNP3 Read request over a LAN. The DNP3

Master wants to know the current status of the Remotes

power and prepares a Read request message for the appr

priate object. After passing through all three DNP3 layer

the message is passed to the TCP/UDP transport layer.

The transport layer adds a data block that identifies the

Master port from which the request is sent and the port owhich it expects the Remote DNP3 process to be listen-

ing for messages. The packet thus formed is then passed

to the IP layer. Here a data block containing the IP and

Media Access addresses of the Master and the Remote is

added before the entire assembled packet gets passed to t

Network Interface layer. The Network Interface layer ve

fies media access and availability and places the packet o

the media for transmission.

After working its way across bridges and through rout-ers (the modern equivalent of over the rivers and through

the woods) based on the IP information, the packet finall

arrives at the Remote. Here it passes through the same fo

layers in exactly the opposite order as it did at the Maste

First, it is pulled off the media by the Network Interface

layer. After confirming that the packet is intact and valid

the Network Interface layer simply passes it to the IP lay

The IP layer verifies the Media Access and IP address an

passes it on to the TCP/UDP layer where the target port

is checked for connected applications. If an application

is listening at the target port, the packet is passed to theApplication layer. If the listening application is the Remo

DNP3 process, the Read request is passed through its thr

layers to validate the request and identify what informati

needs to be collected. The Remote response then follows

the identical path in reverse to reach the Master.

An DNP3 message passes through the protocol layers at

both the manager and the agent. Each layer addresses a

specific communication task.

SCADA Guardian

Superior monitoring and control with

this DNP3 RTU

A SCADA environment relies heavily on

accurate information on a wide range of

variables to ensure that each part of a con-

trolled process happens when it should and

to the right degree. The SCADA Guardian

reports alarms via DNP3 or SNMP - making

for an easy integration into your SCADA

network.

This new RTU is densely packed, capable

of monitoring 24 external analog sensors,

so you can monitor temperature, flow, pres-

sure, and any other number of variables to

keep your SCADA controlled environment

running smoothly. Of the analog inputs, 16

are based on DPS Telecoms convenient

D-Wire technology, in which the sen-

sors power and monitoring data are both

carried through the same cable.

To take control of your SCADA environ-

ment.

Call 1-800-693-0351

Email [email protected]

Use the DPS website to submit a fast

information request

Dont leave your network vulnerable any

longer - call the network monitoring spe-

cialists today at 1-800-693-0351.


9/129


Part 6: 8 Important Considerations in DNP3

SCADA Systems

Using DNP3 in a contemporary SCADA system is an easy

decision. DNP3 is a standard protocol that has wide accep-

tance in the industry and is flexible enough for almost any

application. DNP3 certainly has its place in an effective

monitoring solution, but this doesnt mean that any off-the-

shelf DNP3 Master or Remote will be a best fit for you.

Before you commit to an SCADA monitoring solution for

either your operating center or your remote sites, you need

to consider a multitude of factors.

Before you buy check for these 8 important features:

1. Masters should provide concise alarm information

Masters sometimes present data in such an attractive,graphical interface that you cant see the forest for the

trees. Make sure that you have access to a list view that

provides a good presentation of event and alarm detail for

more than a single site or region. Sometimes, summary

graphical presentation can make detail an inconvenient

click or two away when a decision needs to be made.

2. Masters should be able to identify cleared alarms

If you will be relying on Unsolicited Messages in your

system, make sure there is a clear event for each alarm.

Creating this association can involve expensive custom

development on your Master system.

3. Masters should maintain a history of standing alarms

Avoid the allure of maintaining only an event log of

newly reported Unsolicited Messages and a history log

of acknowledged Unsolicited Messages. If an Unsolicited

Message represents an alarm condition, there should be

continuing visibility to the alarm even if the UnsolicitedMessage is acknowledged. Imagine what might happen to

your network if a system operator acknowledges an alarm

message, and then, for whatever reason, fails to correct the

alarm condition. Who would know the alarm is still stand-

ing?

4. Masters should sort and filter alarms

Masters should support organizing alarms by a wide variety

of characteristics. Location, equipment type and severity

Let DPS Help You

Survey Your SCADA and

Monitoring Needs

A Free Consultation at No Obligatio

to You

Determining yourSCADA and alarm

monitoring needs

can be tough. If

youve got a busy

job with a lot of

responsibilities, you

dont have a lot of

time to evaluate

gear and survey

your remote sites.

So why not get help

from experts you can trust? DPS wi

help you survey your remote sites step

by step, making sure you dont mis

any opportunities to make your net

work monitoring project successful

and easier on your budget.

A DPS expert consultant can help yo

figure out what DNP3, SCADA, anmonitoring products will most effec

tively meet your needs without over

loading your budget. Our goal is to giv

you the tools you need to help kee

your network up and running. Wit

an emphasis on maximizing ROI, w

dont pressure you to buy a particula

system.

Theres no hard-sell sales tactics. Nharassing sales calls. No pressure t

buy. We wont discuss specific equip

ment options until weve helped yo

plan the right monitoring strategy fo

your network.

[email protected] 1-800-693-035

Eric Storm

President

DPS Telecom


10/12


10

are just a few possibilities that may make sense for orga-

nizing your alarms. The same alarm should be able to be

posted to multiple categories. The presentation of sorted

and filtered alarms should depend on the user logged on;

the team responsible for generator maintenance doesnt

need to wade through lists looking for generator events a

alarms.

5. Masters should support flexible and powerful noti

cation

Make sure your master support the advanced features ne

essary for premium status monitoring, such as notificatio

escalation, nuisance alarm silencing, automatic control

relay operation, and automatic notifications by e-mail, te

or pager.

6. Masters should not be limited to DNP3

If youre like most companies, you have a variety of

equipment of different ages and technologies. Integratin

this diversity into a SCADA Master can sometimes invol

surprisingly expensive customization or additional mod-

ules.

It is always difficult and uncomfortable to justify sig-

nificant development costs after purchasing an already

expensive SCADA Master. Why take the time, trouble, a

expense to recreate capabilities that are already present i

high-quality, multi-protocol Master that is DNP3-capable

7. Remotes should support redundant power.

If your remote is powered from a single source, then you

critical monitoring is vulnerable to a single event. Losin

that single source of power effectively compromises the

continuous monitoring of your revenue generating equip

ment. If your installation does not have dual power sour

es, make sure the equipment is compatible with an extern

uninterruptable power supply. Also insure that the prima

power is one of the points monitored at each location.

8. Remotes should provide local SCADA.

If a network failure compromises the collection of data,

your remote equipment should provide for local visibility

Turn the worst case of having to dispatch techs to critica

remote sites into a much better case by insuring that they

will be able to browse to your remote units and have loc

SCADA until the network is restored.

Alarm Master Choice:

T/Mon LNX

T/Mon LNX has many features to make

your alarms more meaningful, including:

1. Multi-protocol support, which

allows you to integrate many types ofequipment under a single monitoring

umbrella.

2. Immediate notification of COS

alarms, including new alarms and

alarms that have cleared.

3. Standing alarm list is continuously

updated.

4. Text message windows displaying

specific instructions for the appropri-

ate action for an alarm.

5. Nuisance alarm filtering, allowing

your staff to focus its attention on seri-

ous threats.

6. Pager and email notifications sent

directly to maintenance personnel,

even if theyre away from the NOC.

7. Derived alarms and controls that

combine and correlate data from mul-

tiple alarm inputs and automatically

control remote site equipment to cor-

rect complex threats.

For more information, check out T/Mon

on the Web at

http://www.dpstele.com/products/em/

tmon_lnx/


11/1211


DPS Telecom Guarantees Your Success or

Your Money Back

When youre choosing a network monitoring vendor, dont

take chances. Be skeptical. Ask the hard questions. Above

all, look for experience. Dont take a sales reps word that

his company can do custom development. Ask how many

systems theyve worked with, how many protocols they

can integrate with DNP3, and check for client testimonials.

DPS Telecom has created hundreds of successful monitor-

ing implementations for telecoms, utility telecoms, and

transportation companies. (Check out http://www.dpstele-

com.com/dpsnews/success_stories for some examples.)

DPS Telecom monitoring solutions are proven performers

under real-world conditions. Youre never taking any risk

when you work with DPS Telecom. Your SCADA moni-

toring solution is backed by a 30-day, no-risk, money-back

guarantee. Test your DPS monitoring solution at your site

for 30 days. If youre dissatisfied for any reason, just sendit back for a full refund.

What to Do Next

Before you make a decision about your SCADA DNP3

monitoring, theres a lot more you need to know. There are

dangers you want to avoid and there are also opportuni-

ties to improve your remote site maintenance that you dont

want to miss.

Get the information you need. Send an e-mail to support@

dpstelecom.com for A Practical, Step-by-Step Guide on

how to implement SCADA monitoring in your network.

You can also call us today at 1-800-622-3314 to schedule

your free Web demo of SCADA monitoring solutions, or

register on the Web at www.dpstelecom.com/tmon-web-

demo.

7x24 Tech Support

(No Credit Card Required)

First-class tech support assists yo

whenever you need

Every single prod-

uct offered by DPS

includes comprehen-

sive technical sup-

port. If youve pur-

chased DPS products

to implement in you

existing network

and have questions,

contact DPS Tech

Support today at

559-454-1600 or at support@dpstelecom.

At DPS Telecom, the representa-

tive who answers your call isnt an

intern reading from a script. DPS

Tech Support representatives are

engineerswho contribute to produc

development. And, if your problem

requires additional expertise, the

DPS Engineering Department thatdesigned your product is right down

the hall.

Now matter how tough or techni-

cal your question is, youll always

have the support you need from DPS

Telecom - even outside of standard

business hours. At no extra cost to

you, DPS offers 24/7 emergency

technical support. Just because

you have a network emergency at3 in the morning doesnt mean you

shouldnt get the assistance you

need.

Chris Hower

Tech Support

DPS Telecom

We had no doubt that whatever DPStold us that they could do, theyd do it,

and they have. Theyre very reliable

and we knew that the product was go-

ing to be reliable.-Bill Young,

Consolidated Communications


12/12


12

We protect your network like your business depends on itTM

US $36.95

Marshall DenHartog has over ten years experience working with remote mon-

itoring and SCADA equipment, including designing network monitoring devic-

es, creating SNMP systems for multiple platforms, and developing SCADA

solutions for several nationwide networks.

DenHartogs experience with both the theoretical and practical sides of

SCADA and alarm monitoring have equipped him to write a straightforward

guide to the DNP3 protocol.

Marshall DenHartog is also the author of the widely downloaded SNMP

Tutorial.

The DPS Promise from Eric Storm, President

I dont think you should have to take any risks to get the monitoring and control capabili-

ties you need. If you decide to work with me, I wont let you fail.

If my solution doesnt solve your problems 100%, I dont want you to have it. I have

three goals: I want to sell my product, I want you to use my product, and I want you to be

completely satisfied with my product.

If my product doesnt fulfill those goals, I will fix it, improve it, or give you your money

back. If my stuff doesnt wow you, I dont want your business.

So heres my guarantee to you: if you buy a DPS Telecom solution, you can test at your

site, under real-world conditions, for 30 days. If youre dissatisfied with it, for any reason,

just send it back and youll get a full refund, no questions asked.

So please if youre interested in any of our products, do yourself a favor and call us

today at 1-800-622-3314. Your networks needs cant wait. I promise you well deliver

a solution to your problems, at no risk to you.

Sincerely,

Eric Storm,

President

Eric Storm

President

DPS Telecom

About the Author

dnp3 tutorial

Documents

dnp3 communication

dnp3 work

dnp3 books

fundamentals of dnp3

dnp3 elements

dnp3 scada systemsread

dnp3 message structurepart

dnp3 object library