DNP3 — Power / Utility Standard
DNP3 (Distributed Network Protocol v3) is the most widely used protocol in utility SCADA systems such as power companies, water, and gas. It is the communication standard between RTUs / IEDs and the SCADA master, and its key features are time-stamped events and reliable reporting (unsolicited responses).
Registration Form Entries
| Field | What to enter | Example |
|---|---|---|
| IP address | IP of the RTU / IED | 192.168.0.120 |
| Port | DNP3 TCP port | 20000 (standard) |
| Master address (master-address) | The gateway's (master) own address | 1 |
| Outstation address (outstation-address) | DNP address of the peer (slave) | 10 |
| Response timeout (request-timeout) | Response wait time (ms) | 5000 |
| Unsolicited (enable-unsolicited) | Enables spontaneous transmission (push) from the RTU — the driver caches it and returns it first on read() | all / 1 / 2 / 3 / 1,2 (empty by default = not used) |
DNP3 requires that both the master address and the outstation address match. On the RTU side (usually the IED configuration tool from ABB / SEL / GE), verify that "Source Address" and "Destination Address" pair correctly with the gateway's master/outstation values.
PLC Address Notation for Tags
DNP3 identifies data points by Group / Variation / Index. Common groups:
| Group | Type | Notes |
|---|---|---|
| 1 | Binary Input (BI) | Breaker/contact status, etc. |
| 10 | Binary Output (BO) | Output status |
| 20 | Counter | Accumulated counters |
| 30 | Analog Input (AI) | Current, voltage, temperature — most common |
| 40 | Analog Output (AO) | Output setpoint |
| 41 | Analog Output Block (write target) | Setpoint writes |
In the gateway, enter it in the g<group>v<variation>.<index> or class<n> format.
| Notation | Meaning |
|---|---|
g30v1.5 | Analog Input, var 1 (32-bit + flag), index 5 |
g30v5.5 | Analog Input, var 5 (Float), index 5 |
g1v2.0 | Binary Input, var 2 (with flag), index 0 |
g20v1.0 | Counter, 32-bit, index 0 |
class0 | Class 0 polling (full scan of static data) |
class1 | Class 1 events (event-driven changes) |
In the early stages of a project, if you just want to "pull everything and see", it is convenient to fetch it all at once with class0, then pick only the points you need and register them precisely with g30v....
Data Type Mapping
| Group | Data type | Type qualifier |
|---|---|---|
| g1 (BI) | Boolean | (empty) |
| g30v1 (AI 32-bit signed) | Integer | DW |
| g30v2 (AI 16-bit signed) | Integer | (empty) |
| g30v5 (AI float) | Float | REAL |
| g30v6 (AI double) | Double | LREAL |
| g20v1 (Counter 32-bit) | Integer | DW |
Write Support
There are generally two kinds of write targets on a DNP3 outstation.
| Notation | Meaning |
|---|---|
g41v1.5 | Analog Output Block 32-bit signed setpoint, index 5 |
g41v3.5 | Analog Output Block float setpoint, index 5 |
g12v1.0 | Control Relay Output Block (CROB) — breaker trip/close, etc. |
g12 (CROB) directly operates breakers / relays. In production environments, always use it only after following the select-before-operate procedure and verifying permissions.
Common Problems and Solutions
| Symptom | Possible cause | Solution |
|---|---|---|
| "No reply" | Address mismatch | Check both the master and outstation addresses |
| All values 0 or stale | Unsolicited messages not received, link layer problem | Try explicit polling with class0 |
| "Object not found" | Wrong group/variation | Check the RTU's "DNP point map" document |
| Time is far off | DNP3 timestamp UTC vs local | The gateway receives UTC. Convert on the display side |
More Detailed Group / Variation Table
The DNP3 data model is structured as several "Variations" within a "Group". Even within Group 30 (AI), there are 32-bit / 16-bit / float / double representations, so you must match whichever variation the RTU exposes.
| Group | Var | Meaning | Size / format |
|---|---|---|---|
| 1 | 1 | Binary Input — packed format (no flag) | 1 bit |
| 1 | 2 | Binary Input with status (includes flag bit) | 1 byte |
| 2 | 1 | Binary Input Change — no time | event |
| 2 | 2 | Binary Input Change — absolute time | event + 6-byte time |
| 10 | 2 | Binary Output Status (with flag) | 1 byte |
| 12 | 1 | CROB (Control Relay Output Block) — write only | 11 byte struct |
| 20 | 1 | Counter — 32-bit | 4 byte |
| 20 | 2 | Counter — 16-bit | 2 byte |
| 30 | 1 | AI 32-bit signed (with flag) | 5 byte |
| 30 | 2 | AI 16-bit signed (with flag) | 3 byte |
| 30 | 3 | AI 32-bit signed (no flag) | 4 byte |
| 30 | 5 | AI single-precision float (with flag) | 5 byte |
| 30 | 6 | AI double-precision float (with flag) | 9 byte |
| 32 | 1 | AI Change — no time | event |
| 32 | 7 | AI Change — single float, abs time | event |
| 40 | 1 | AO Status 32-bit signed (with flag) | 5 byte |
| 41 | 1 | AO Block 32-bit signed (write target) | 5 byte |
| 41 | 3 | AO Block float (write target) | 5 byte |
Common Operational Patterns
Pattern 1. Basic measurements from a substation IED (current, voltage, power)
IEDs such as ABB REC615 / SEL-451 / SEL-735 meters are typically mapped as follows.
| Tag name | Address | Data type | Type qualifier |
|---|---|---|---|
| Phase A current | g30v5.0 | Float | REAL |
| Phase B current | g30v5.1 | Float | REAL |
| Phase C current | g30v5.2 | Float | REAL |
| Total active power | g30v5.10 | Float | REAL |
| Frequency | g30v5.20 | Float | REAL |
| Breaker 1 position | g1v2.0 | Boolean | (empty) |
| Breaker 2 position | g1v2.1 | Boolean | (empty) |
Pattern 2. Accumulated counters (kWh / gas m³, etc.)
Counters (Group 20) are accumulated values. On the display side, take the difference to convert them into "consumption per hour".
| Tag name | Address | Data type |
|---|---|---|
| Accumulated active energy (kWh) | g20v1.0 | Integer |
| Accumulated reactive energy (kvarh) | g20v1.1 | Integer |
Pattern 3. Breaker control via CROB (write)
g12v1.0 = "Pulse-On / Trip / Close" 명령 코드
CROB 1-byte control code:
| Value | Meaning |
|---|---|
0x01 | Pulse-On |
0x02 | Pulse-Off |
0x03 | Latch-On |
0x04 | Latch-Off |
0x41 | Trip (protective operation) |
0x81 | Close |
Many RTUs require the SBO (select → operate) procedure for CROB. Even if PlantPulse issues the command as a single write, the RTU may reject it. In such environments, either enable the non-SBO mode on the RTU side, or perform the two steps with a separate automation script.
References / Next Steps
- The "DNP3 device profile" PDF from the RTU manufacturer (ABB, SEL, GE, Schneider) contains the full group/variation/index mapping.
- The IEEE 1815-2012 standard document (DNP3) is the official spec.
- See the DNP3 automation examples in Advanced — REST API.