DNP3/DISTRIBUTED NETWORK CONTROL

PROTOCOL 3

Eng George Mugala

THE COPPERBELT UNIVERSITY SCHOOL OF ENGINEERING

April 21, 2023

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 1 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 2 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 3 / 26
 DNP3
What is Distributed Network Protocol 3(DNP3)?
communications protocols used between components in process
automation systems
Its main use is in utilities such as electric and water companies
It was developed for communications between various types of data
acquisition and control equipment
its a competing standard to the lagacy modbus protocol

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 4 / 26
 DNP3 protocol has significant features that make it more robust,
efficient, and interoperable than older protocols such as Modbus, at
the cost of higher complexity
DNP3 was developed in 1993 by a Canadian Company called
GE-Harris Canada (formerly known as Westronic)
DNP3 is an open protocol meaning non propriatory

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 5 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 6 / 26
 DNP3 terminologies and concepts

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 7 / 26
 DNP3 layer explanations
Link Layer-makes the physical link reliable
provides error detection and dublicate frame detection
Link layer sends and receives packets which are called frames in this case
DNP3 Frames
I Frames consists of a header and data section

I
I the header specifies the frame size,contains datalink control
information(DLCI)
I it identifies DNP3 source and destination address
I every frame begins with 2 sync bytes that help the receiver determine where
the frame is starting from
I the length specifies the number of octects in the remainder of the frame
excluding CRC check
I Link control octect is used for the sending and receiving link layers to
coordinate their activities

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 8 / 26
 addressing
I destination address specifies which DNP3 device should process the
data
I the source address identifies which DNP3 device sent the message
I Having both destination and source addresses satisfies at least one
requirement for peer-to-peer communications because the receiver
knows where to direct its responses
I 65520 individual addresses are available
I Every DNP3 device must have a unique address within the collection
of devices sending and receiving messages to and from each other
CRC Checks
I the data payload in the link frame contains a pair of CRC octets for
every 16 data octets
I This provides a high degree of assurance that communication errors
can be detected
I The maximum number of octets in the data payload is 250, not
including CRC octets
I The maximum length link layer frame is 292 octets if all the CRC
and header octets are counted

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3 April 21, 2023 9 / 26
 Link layer confirmation
Link Layer Confirmation
I A feature of DNP3’s link layer is the ability for the transmitter of
the frame to request the receiver to confirm that the frame arrived
I Using this feature is optional, and it is often not employed because
there are other methods for confirming receipt of data
I It provides an extra degree of assurance of reliable communications
I If a confirmation is not received, the link layer may retry the
transmission
I Some disadvantages to using link layer confirmation are the extra
time required for confirmation messages and waiting for multiple
timeouts when retries are configured.

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 10 / 26
 Transport Layer
I The transport layer has the responsibility of breaking long
application layer messages into smaller packets sized for the link
layer to transmit, and, when receiving, to reassemble frames into
longer application layer messages
I In DNP3 the transport layer is incorporated into the application layer
I The transport layer requires only a single octet overhead to do its job
I Therefore, since the link layer can handle only 250 data octets, and
one of those is used for the transport function, each link layer frame
can hold as many as 249 application layer octets

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 11 / 26
 Application Layer Fragments
I Application layer messages are broken into fragments
I Maximum fragment size is determined by the size of the receiving
device’s buffer
I The normal range is 2048 to 4096 bytes
I A message that is larger than a one fragment requires multiple
fragments. Fragmenting messages is the responsibility of the
application layer.
I Note that an application layer fragment of size 2048 must be broken
into 9 frames by the transport layer
I and a fragment size of 4096 needs 17 frames

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 12 / 26
 Static and Event Data
The application layer works together with the transport and link layers to enable
reliable communications
It provides standardized functions and data formatting with which the user layer
above can interact
In DNP3, the term static is used with data and refers to the present value
Thus static binary input data refers to the present on or off state of a bi-state device
Static analog input data contains the value of an analog at the instant it is
transmitted
One possibility DNP3 allows is requesting some or all of the static data in an
outstation devices
DNP3 events are associated with something significant happening
Examples are state changes, values exceeding some threshold, snapshots of varying
data, transient data and newly available information
An event occurs when a binary input changes from an on to an off state or when an
analog value changes by more than its configured deadband limit
DNP3 provides the ability to report events with and without time stamps so that if
desired

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 13 / 26
 Variations
I DNP3 has provisions for representing data in different formats
1 A 32-bit integer value with flag
2 A 16-bit integer value with flag
3 A 32-bit integer value
4 A 16-bit integer value
5 A 32-bit floating point value with flag
6 A 64-bit floating point value with flag
I The flag referred to is a single octet with bit fields indicating whether the source is
on-line, the data source restarted, communications are lost with a downstream source,
the data is forced and the value is over range.
Event analog data can be represented by these variations
1 A 32-bit integer value with flag
2 A 16-bit integer value with flag
3 A 32-bit integer value with flag and event time
4 A 16-bit integer with flag and eventtime
5 A 32-bit floating point value with flag
6 A 64-bit floating point value with flag
7 A 32-bit floating point value with flag and event
8 A 64-bit floating point value with flag and event

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 14 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 15 / 26
 OSI/EPA MODEL

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 16 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 17 / 26
 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 18 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 19 / 26
 Summary of the message structure
User application data-data above Application layer,comming from
HMI and application programmes
The application layer initially forms the data into manageable sized
blocks these are called Application Service Data Units(ASDU)
The application layer then creates the application protocol data
unit APDU by combining a header with the ASDU data
the header is called Application Control inforation(APCI)its either
2bytes or 4bytes long
incase of a command or other request there is only the header and
no ASDU
depending on the size of ASDU, one or more APDU are formed
these are each termed fragments
while the number fragments are not limited
the maximum size of each fragment is 2048 bytes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 20 / 26
 transport layer
I APDU from Application layer within transport layer is called
transport Service Data Unit(TSDU)
I it is purely treated as data to be transported
I its further broken down into Transport Protocol data units(TPDUs)
I TPDUs are made up of one byte header followed by a maximum of
249 bytes
I the overall size of TPDUs was determined to fit into the maximum
size of the Link Protocol Data Units(LPDUs) or one frame with a
total of 250 bytes
Data Link layer
I the layer adds a 10 byte header to form LPDU
I As the data link layer is also responsible for providing error detection
and correction Functions, error checking codes are introduced here
I A 16-bit cyclic redundancy code (CRC) is used
I Each TPDU is converted to a frame of up to 292 bytes in length
The physical layer
I The physical layer converts each frame into a bit stream over the
physical media. In the

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 21 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 22 / 26
 Examples of DNP3 Message structures

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 23 / 26
 Data Link Layer zooming on control byte

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 24 / 26
 OUTLINE

1 INTRODUCTION TO DNP3

2 DNP3 terminologies and concepts

3 OSI/EPA MODEL

4 DNP3 GENERIC MESSAGE STRUCTURE AND SIZES

5 Summary of the message structure

6 Examples of DNP3 Message structures

7 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 25 / 26
 Control Codes

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 26 / 26
 Examples of DNP3 exchange Messages

Eng George Mugala ( THE COPPERBELT UNIVERSITY

DNP3/DISTRIBUTED
SCHOOL NETWORK
OF ENGINEERING)
CONTROL PROTOCOL 3April 21, 2023 27 / 26