DNP3 (Power / Utility)
DNP3 (Distributed Network Protocol v3) is the most widely used protocol in utility SCADA systems for power, water, and gas. It is the communication standard between RTUs/IEDs and the SCADA master, with time-stamped events and reliable unsolicited responses as its core features.
Registration Form Input Values
| Input Field | What to Enter | Example |
|---|---|---|
| IP Address | IP of the RTU / IED | 192.168.0.120 |
| Port | DNP3 TCP port | 20000 (standard) |
| Master Address (master-address) | Gateway's (master's) own address | 1 |
| Outstation Address (outstation-address) | Peer's (slave's) DNP address | 10 |
| Request Timeout (request-timeout) | Response wait time (ms) | 5000 |
| Unsolicited (enable-unsolicited) | Enable RTU's spontaneous transmission (push) — driver caches and returns it first on read() | all / 1 / 2 / 3 / 1,2 (default blank = unused) |
In DNP3, the master address and outstation address must match on both sides. Check that the “Source Address” and “Destination Address” in the RTU settings (usually in ABB / SEL / GE IED configuration tools) pair with the gateway's master/outstation addresses.
PLC Address Notation for Tags
DNP3 identifies data points by Group / Variation / Index. Common groups:
| Group | Type | Notes |
|---|---|---|
| 1 | Binary Input (BI) | Breaker/contact status, etc. |
| 10 | Binary Output (BO) | Output status |
| 20 | Counter | Cumulative counters |
| 30 | Analog Input (AI) | Current, voltage, temperature — most common |
| 40 | Analog Output (AO) | Output setpoint |
| 41 | Analog Output Block (write target) | Setpoint writing |
On the gateway, enter them in the g<group>v<variation>.<index> or class<n> format.
| Notation | Meaning |
|---|---|
g30v1.5 | Analog Input, var 1 (32-bit + flag), index 5 |
g30v5.5 | Analog Input, var 5 (Float), index 5 |
g1v2.0 | Binary Input, var 2 (with flag), index 0 |
g20v1.0 | Counter, 32-bit, index 0 |
class0 | Class 0 polling (full scan of static data) |
class1 | Class 1 events (event-driven changes) |
In the early stages of a project, if you “just want to get everything first,” it's convenient to issue class0 to receive it all at once, then select only the needed points and register them precisely with g30v....
Data Format Matching
| Group | Data Type | Format Supplementary |
|---|---|---|
| g1 (BI) | Boolean | (blank) |
| g30v1 (AI 32-bit signed) | Integer | DW |
| g30v2 (AI 16-bit signed) | Integer | (blank) |
| g30v5 (AI float) | Float | REAL |
| g30v6 (AI double) | Double | LREAL |
| g20v1 (Counter 32-bit) | Integer | DW |
Write Support
DNP3 outstation write targets are usually of two types.
| Notation | Meaning |
|---|---|
g41v1.5 | Analog Output Block 32-bit signed setpoint, index 5 |
g41v3.5 | Analog Output Block float setpoint, index 5 |
g12v1.0 | Control Relay Output Block (CROB) — breaker trip/close, etc. |
g12 (CROB) directly operates breakers/relays. In operational environments, always follow the select-before-operate procedure and verify permissions before use.
Common Issues and Solutions
| Symptom | Possible Cause | Solution |
|---|---|---|
| “No reply” | Address mismatch | Check both master/outstation addresses |
| All values 0 or stale | Unsolicited not received, link layer issue | Try explicit polling with class0 |
| “Object not found” | Wrong group/variation | Check the RTU's “DNP point map” document |
| Large time discrepancy | DNP3 timestamp UTC vs local | Gateway receives in UTC. Convert at the display layer |
More Detailed Group / Variation Table
The DNP3 data model has a structure where each “Group” contains multiple “Variations.” Even within Group 30 (AI), there are multiple representations (32-bit / 16-bit / float / double), and you need to match whichever variation the RTU exposes.
| Group | Var | Meaning | Size / Format |
|---|---|---|---|
| 1 | 1 | Binary Input — packed format (no flag) | 1 bit |
| 1 | 2 | Binary Input with status (includes flag bit) | 1 byte |
| 2 | 1 | Binary Input Change — no time | event |
| 2 | 2 | Binary Input Change — absolute time | event + 6-byte time |
| 10 | 2 | Binary Output Status (with flag) | 1 byte |
| 12 | 1 | CROB (Control Relay Output Block) — write only | 11-byte struct |
| 20 | 1 | Counter — 32-bit | 4 bytes |
| 20 | 2 | Counter — 16-bit | 2 bytes |
| 30 | 1 | AI 32-bit signed (with flag) | 5 bytes |
| 30 | 2 | AI 16-bit signed (with flag) | 3 bytes |
| 30 | 3 | AI 32-bit signed (no flag) | 4 bytes |
| 30 | 5 | AI single-precision float (with flag) | 5 bytes |
| 30 | 6 | AI double-precision float (with flag) | 9 bytes |
| 32 | 1 | AI Change — no time | event |
| 32 | 7 | AI Change — single float, abs time | event |
| 40 | 1 | AO Status 32-bit signed (with flag) | 5 bytes |
| 41 | 1 | AO Block 32-bit signed (write target) | 5 bytes |
| 41 | 3 | AO Block float (write target) | 5 bytes |
Frequently Used Operational Patterns
Pattern 1. Basic Measurements from Substation IEDs (Current, Voltage, Power)
IEDs such as ABB REC615 / SEL-451 / SEL-735 meters are typically mapped as follows:
| Tag Name | Address | Data Type | Format Supplementary |
|---|---|---|---|
| Phase A Current | g30v5.0 | Float | REAL |
| Phase B Current | g30v5.1 | Float | REAL |
| Phase C Current | g30v5.2 | Float | REAL |
| Total Active Power | g30v5.10 | Float | REAL |
| Frequency | g30v5.20 | Float | REAL |
| Breaker 1 Position | g1v2.0 | Boolean | (blank) |
| Breaker 2 Position | g1v2.1 | Boolean | (blank) |
Pattern 2. Accumulated Counters (kWh / gas m³, etc.)
Counters (Group 20) are cumulative values. The display layer calculates the difference to convert to “usage per hour.”
| Tag Name | Address | Data Type |
|---|---|---|
| Accumulated Active Energy (kWh) | g20v1.0 | Integer |
| Accumulated Reactive Energy (kvarh) | g20v1.1 | Integer |
Pattern 3. Breaker Control via CROB (write)
g12v1.0 = "Pulse-On / Trip / Close" 명령 코드
CROB 1-byte control code:
| Value | Meaning |
|---|---|
0x01 | Pulse-On |
0x02 | Pulse-Off |
0x03 | Latch-On |
0x04 | Latch-Off |
0x41 | Trip (protection operation) |
0x81 | Close |
Many RTUs require the SBO (select → operate) procedure for CROBs. Even if PlantPulse sends a single write command, the RTU may reject it. In such environments, enable the no-SBO mode on the RTU side, or perform the two steps via a separate automation script.
References / Next Steps
- The “DNP3 device profile” PDF from RTU manufacturers (ABB, SEL, GE, Schneider) contains all the group/variation/index mappings.
- The IEEE 1815-2012 standard document (DNP3) is the official spec.
- Refer to the DNP3 automation examples in Advanced — REST API.