Technical Note

DNP3 & Control Relay Output

Block Command

www.kepware.com 1 ©2011-2018 PTC, Inc. All Rights Reserved.

Table of Contents

1. DNP3 Object Group 12 for Binary Output Points ..............................................................3

1.1 Output Models ...............................................................................................................3
1.2 Vendors' Roles ...............................................................................................................3
1.3 Device Properties ..........................................................................................................3
1.3.1 Direct Operate .................................................................................................3
1.3.2 Select then Operate .......................................................................................4
2. CROB Operate Command Example .......................................................................................5
2.1.1 TX and RX Parsing Example.........................................................................5
2.1.2 Tag Addressing Examples ............................................................................8
3. Slave-Performed Actions for Interoperable Commands .............................................. 10
4. Control-Related Event Log Messages ................................................................................ 10
5. Control-Related Status Codes ............................................................................................. 12

www.kepware.com 2 ©2011-2018 PTC, Inc. All Rights Reserved.

1. DNP3 Object Group 12 for Binary Output Points
DNP3 Object Group 12 for Binary Output Points is used to provide a digital on-off drive
signal or a pulsed drive signal for controlling a real or pseudo output device.
To perform digital control operations (such as electro-mechanical relays) at binary output
points, use tags addressed with Object Group 10. An operation on an Object Group 10 Tag
issues the CROB command using Object Group 12, variation 1.

1.1 Output Models

There are three output models that apply to binary outputs:
 Activation: This output type initiates an actions, such as Initiate Test,
Acknowledge Alarm, and Trip Breaker.
 Complementary Latch: This output type remains latched in an active or non-
active state, depending on which command is received. For example,
Illumination On-Off, Enable-Disable, and Auto-Manual.
 Complementary Two-Output: This output type sets either a close or trip
output momentarily active, depending on which command is received. For
example, Run-Stop Motor, Trip-Close Breaker, Raise-Lower Transformer Tap,
and Open-Close Valve.

1.2 Vendor Roles

Device vendors are expected to assign the device appropriate control codes. For
example, a manufacturer may assign "CLOSE -- PULSE_ON" and "TRIP -- PULSE_ON" to a
breaker and "NUL -- LATCH_ON" and "NUL -- LATCH_OFF" to a pseudo point.
When performing On-Off and Close-Trip controls, it is recommended that users utilize
the Direct Operate or the Select then Operate function codes with Group 12 objects.
For more information, refer to Direct Operate and Select then Operate.

1.3 Device Properties

Descriptions of the Device Properties are as follows:
 Operate Mode: This parameter specifies whether the writable I/O points
(Object Group 10 - Binary Outputs and Object Group 40 - Analog Outputs) will
use the Direct Operate or the Select then Operate sequence. The default setting
is Direct Operate.
Note: Individual tag write behavior can override this setting by writing a
Boolean True to the output's corresponding .DO or .SO sub-type tags.
 Feedback Poll after Operate: When enabled, a feedback poll occurs after an
operation. The default setting is Enable.

1.3.1 Direct Operate

DIRECT_OPERATE do not require a preceding select command. A Direct Operate
function code is used for outputting Control Relay Output Blocks, Pattern Control

www.kepware.com 3 ©2011-2018 PTC, Inc. All Rights Reserved.

 Blocks, and Analog Outputs when the extra security provided by a two-step control
command is not necessary. It also optimizes bandwidth utilization in a closed-loop
control when other feedback is present.
 Direct Operate request messages look like SELECT and OPERATE request
messages except for the function code. They contain one or more objects
that describe the desired output state or level.
 Direct Operate responses contain an identical set of object headers and
objects in the same order as they appear in the master’s request (unless an
error condition exists). The response to a DIRECT_OPERATE command does
not guarantee that the execution occurred: it indicates that the request was
received. For this reason, systems employing a DIRECT_OPERATE function
code are encouraged to provide another way to detect whether the
execution occurred.
Notes:
 In the case of an error, the slave sets a status code within an object that may
omit objects and/or sets IIN bits.
 When the value written during a CROB command is not understood by the DNP
slave, the following error message is displayed in the Event Log: "Unable to write
to '<address>' on device '<device>'. Control-Related Status Code ' <status
code>'".
For more information, refer to Control-Related Status Codes.

1.3.2 Select then Operate

The SELECT function code is used with the OPERATE function code as part of the
two-step Select-before-Operate method for issuing control requests. This procedure
is used for controlling binary and analog outputs. In the general Select then Operate
procedure, the master first sends a select request containing all of the necessary
parameters (such as indexes, timings and values). The master then compares the
Select response with the request. If they match, the master issues an Operate
command with the identical object set of headers and objects that it sent in the
select message. This approach assures that the slave understands which control the
master intended.
A slave’s Select then Operate response contains an identical set of object headers
and objects in the same order as they appear in the master’s request (unless an
error condition exists).
Notes:
 In the case of an error, the slave sets a status code within an object that may
omit objects and/or sets IIN bits from the response.
 When the DNP slave does not understand the value written during a CROB
command, the following error message is displayed in the Event Log: "Unable to
write to '<address>' on device '<device>'. Control-Related Status Code '<status
code>'".
For information on the status codes, refer to Control-Related Status Codes.

www.kepware.com 4 ©2011-2018 PTC, Inc. All Rights Reserved.

 The Select then Operate procedure is completed with two verifications:
1. The master must receive a Select response that matches the
request. That response must indicate no errors; otherwise, the
master aborts the control.
2. The slave is obligated to compare the Operate request with the
Select request. If the two match and there are no errors detected in
the request, the slave activates the outputs.

2. CROB Operate Command Example

The following example shows how to issue a Select then Operate request for Binary Output
point 8 that closes the point one time for 250 milliseconds.
1. Configure the point's Operate Mode for the entire device or on an individual
point basis.
a) To configure it for the entire device, click Device Properties | Advanced,
then, set the Operate Mode to Select Then Operate.
b) To configure it for an individual point (if the device Operate Mode is Direct
Operate), create a tag with the address "10.0.8.SO" then write "1" to the .SO
Tag. This sets the point's Operate Mode point at index 8 to Select Then
Operate.
2. Click Device Properties | Advanced and enable Feedback Poll after Operate
to specify the desired behavior.
3. Create a tag with the address "10.0.8.Operate.Optype".
4. Write "1" to the .Operate.Optype Tag. This sets the Control Code's Operation
Type field to Pulse On.
5. Create a tag with the address "10.0.8.Operate.Tripclosecode".
6. Write "1" to the .Operate.Tripclosecode Tag. This sets the Control Code's Trip-
Close Code field to Close.
7. Create a tag with the address "10.0.8.Operate.Ontime".
8. Write "250" to the .Operate.Ontime Tag. This specifies the duration in
milliseconds that the output drive remains active.
9. Create a tag with the address "10.0.8.Operate.Set".
10. Write "1" to .Operate.Set Tag. This triggers the master to send the Object Group
12, variation 1 request that performs the digital control operation.
Note: Channel Diagnostics should display the following three transactions:
a) TX: The master sends a request using function code 0x03 to select the
output point. RX: The slave responds echoing the request if everything is
okay.
b) TX: The master then sends the Operate request using function code 0x04.
RX: The slave responds echoing the request if everything is okay.
c) TX: The master then sends the feedback poll. RX: The slave responds with
the current static value for all binary outputs.

2.1.1 TX and RX Parsing Example

The following example displays an attempt to transmit a Direct Operate that closes
the binary output point index 100 one time for 800 milliseconds. The response

www.kepware.com 5 ©2011-2018 PTC, Inc. All Rights Reserved.

 indicates that the slave has an issue with accepting the control operation to set
binary output point 100 to active.
For more information, refer to the color-coordinated subtopic.
TX 05 | 64 | 18 | C4 | 0A | 00 | 00 | 00 | 73 | 91 | D8 | C9 | 05 | 0C | 01 |17 | 01 | 64 | 41
| 01 | 20 | 03 | 00 | 00 | 00 | 00 |A3 | 92 | 00 | 00 | 00 | FF | FF |

RX 05 | 64 | 1A | 44 | 00 | 00 | 0A | 00 | 47 | 9F | F9 | C9 | 81 | 00 | 00 | 0C | 01 | 17 | 01
| 64 | 41 | 01 | 20 | 03 | 00 | 00 | 08 | 09 | 00 | 00 | 00 | 00 | 04 | 87 | 26 |

Transmit Packet - Data Link Layer Header Block

Hex Bytes Description
05 64 Starts message.
18 Length of request - indicates 24 bytes.
Data link layer control byte. The binary representation is 11000100. The bits are
defined as:
7 DIR - 1 indicates direction from master.
C4 6 PRM - 1 indicates primary request.
5 FCB - frame count bit.
4 FCV - frame count valid, 0 indicates ignore frame count bit.
3-0 function code - 4 for unconfirmed user data.
0A 00 Destination address - 0x000A.
00 00 Source address - 0x0000.
73 91 Check sum - 0x9173.

Transmit Packet - Transport Header

Hex Bytes Description
Transport control byte. The binary representation is 11011000. The bits are defined
as:
D8 7 FIN - 1 indicates final transport segment.
6 FIR - 1 indicates first transport segment.
5-0 sequence number - 24 used to verify correct order.

Transmit Packet - Application Header

Hex Bytes Description
Application control byte. The binary representation is 11001001. The bits are
defined as:
7 FIR - 1 indicates first fragment of message.
C9 6 FIN - 1 indicates final fragment of message.
5 CON - 0 indicates a confirmation message is not returned.
4 UNS - 0 indicates the sequence number is associated with a solicited request.
3-0 sequence number - 9 used to verify correct order.
05 Function code - 5 direct operate.
0C Object Group: 12.
01 Variation: 1.
Qualifier Field. The binary representation is 00010111. The bits are defined as:
7 always 0.
17
6-4 object prefix code 1 indicates objects prefixed with 1-octet index.
3-0 range specifier code 7 indicates 1-octet count of objects.
01 Range field 1 indicates count of 1 object.

www.kepware.com 6 ©2011-2018 PTC, Inc. All Rights Reserved.

 Hex Bytes Description
64 Data point index 100.

Transmit Packet - Data Object

Hex Bytes Description
Control Code. The binary representation is 01000001. The bits are defined as:
7-6 TCC - Trip Close Code - 01 - close.
41 5 CR - Clear - 0.
4 QU - Queue always 0.
3-0 Op Type - 1 - pulse on.
01 Count - number of times to execute.
20 03 00 00 On Time - 800 ms (0x0000320).
00 00 First part of off time.
A3 92 Check sum - 0x92A3.
00 00 Second part of off time.
00 Always 0 in request.
FF FF Check sum - 0xFFFF.

Receive Packet - Data Link Layer Header Block

Hex Bytes Description
05 64 Starts message.
1A Length of request - indicates 26 bytes.
Data link layer control byte. The binary representation is 01000100. The bits are
defined as:
7 DIR - 0 indicates direction from slave.
44 6 PRM - 1 indicates primary request.
5 FCB - frame count bit.
4 FCV - frame count valid, 0 indicates ignore frame count bit.
3-0 function code - 4 for unconfirmed user data.
00 00 Source address - 0x0000.
0A 00 Destination address - 0x000A.
47 9F Check sum - 0x9F47.

Receive Packet - Transport Header

Hex Bytes Description
Transport control byte. The binary representation is 11111001. The bits are defined
as:
F9 7 FIN - 1 indicates final transport segment.
6 FIR - 1 indicates first transport segment.
5-0 sequence number - 57 used to verify correct order.

Receive Packet - Application Header

Hex Bytes Description
Application control byte. The binary representation is 11001001. The bits are
defined as:
C9 7 FIR - 1 indicates first fragment of message.
6 FIN - 1 indicates final fragment of message.
5 CON - 0 indicates a confirmation message is not returned.

www.kepware.com 7 ©2011-2018 PTC, Inc. All Rights Reserved.

 Hex Bytes Description
4 UNS - 0 indicates the sequence number is associated with a solicited request.
3-0 sequence number - 9 used to verify correct order.
81 Function code - 129 Response.
00 00 Internal Indication bits, none set.
0C Object group: 12.
01 Variation: 1.
Qualifier Field. The binary representation is 00010111. The bits are defined as:
7 always 0.
17
6-4 object prefix code 1 indicates objects prefixed with 1-octet index.
3-0 range specifier code 7 indicates 1-octet count of objects.
01 Range Field 1 indicates count of 1 object.
64 Data point index 100.

Receive Packet - Data Object

Hex Bytes Description
Control Code. The binary representation is 01000001. The bits are defined as:
7-6 TCC - Trip Close Code - 01 - close.
41 5 CR - Clear - 0.
4 QU - Queue always 0.
3-0 Op Type - 1 - pulse on.
01 Count - number of times to execute.
20 03 00 00 On Time - 800 ms (0x00000320).
08 09 Check sum - 0x0908.
00 00 00 00 Off time.
04 Status code 4.
87 26 Check sum - 0x2687.

2.1.2 Tag Addressing Examples

Tag Address Definition Description
Boolean value
Writing to this tag will not cause an explicit write
indicating if operations
to the device. It also will not change the overall
on binary output point
10.0.2.DO device property for Operate Mode: it only
2 should be Direct
changes it for Binary Output point 2.
Operate or Select then
The variation of the tag does not matter. *
Operate.
Boolean value
Writing to this tag will not cause an explicit write
indicating if operations
to the device. It also will not change the overall
on binary output point
10.0.2.SO device property for Operate Mode: it only
2 should be Direct
changes it for Binary Output point 2.
Operate or Select then
The variation of the tag does not matter.*
Operate.
This Boolean tag will display a 0 or 1, depending
on the last update from the client.
Value of the CROB
10.0.2.Operate.Clear The variation of the tag does not matter.
control code bit 5.
Writing to this tag will not cause an explicit write
to the device. It will be used in building the CROB

www.kepware.com 8 ©2011-2018 PTC, Inc. All Rights Reserved.

 Tag Address Definition Description
control code that will be written to the object
group 12 point 2 with the Operate.Set tag.
This Byte tag will display the operation type,
depending on the last update from the client.
Operation types are as follows:
Nul (0)
Value of the CROB
10.0.2.Operate.OpType Pulse_On (1)
control code bits 0-3.
Pulse_Off (2)
Latch_On (3)
Latch_Off (4)
The variation of the tag does not matter. **
This byte tag will display the Trip-Close Field,
depending on the last update from the client.
Trip-close fields are as follows:
10.0.2.Operate.TripClos Value of the CROB
Nul (0)
eCode control code bits 6 & 7.
Paired_Close (1)
Paired_Trip (2)
The variation of the tag does not matter. **
Value in milliseconds
This DWord tag will display the on time last
that the operation on
10.0.2.Operate.OnTime updated from the client.
the binary output point
The variation of the tag does not matter.***
2 will remain active.
Value in milliseconds
that the operation on This DWord tag will display the off time last
10.0.2.Operate.OffTime the binary output point updated from the client.
2 will remain non- The variation of the tag does not matter.***
active.
This DWord tag will display the feedback delay
last updated from the client.
Value in milliseconds to The variation of the tag does not matter.
10.0.2.Operate.Feedbac delay after receiving the Writing to this tag will not cause an explicit write
kDelay response before issuing to the device. It will be used to delay before
feedback poll. issuing a feedback poll after receiving a response
to an Object Group 12 control operation on
binary output point 2.
The variation of the tag does not matter.
Writing a 1 to this tag causes an Object Group 12
control operation on binary output point 2.
Always displays a The CROB control code is built from the values of
10.0.2.Operate.Set Boolean value of 0 with the Operate.Clear, Operate.OpType, and
Good quality. Operate.TripCloseCode tags.
The Values of the Operate.OnTime,
Operate.OffTime, and Operate.FeedbackDelay
tags are used in the operation as well.
*The value of this tag will be used when an operation is performed on binary output
point 2 when using the Operate sub-type commands or a synchronous /
asynchronous write to a 10.x.2.Value or 10.x.2.Explicit Tag.
**Writing to this tag will not cause an explicit write to the device. It will be used in
building the CROB control code that will be written to the Object Group 12 point 2
with the Operate.Set Tag.

www.kepware.com 9 ©2011-2018 PTC, Inc. All Rights Reserved.

 ***Writing to this tag does not cause an explicit write to the device. It will be used in
an Object Group 12 control operation on binary output point 2 when the
Operate.Set Tag is toggled to 1.

3. Slave-Performed Actions for Interoperable Commands

Control TCC OP Type Clear
Row Action
Code Field Field Field
Does not initiate an action or change an in-progress or pending
1 0x00 NUL NUL 0
command. Values in On-time and Off-time fields are ignored.
Cancel in-progress and pending commands. Values in On-time
2 0x20 NUL NUL 1
and Off-time fields are ignored.
For activation model, set output to active for the duration of the
3 0x01 NUL PULSE_ON 0 On-time. For both complementary models, return
NOT_SUPPORTED status.
For activation model, cancel in-progress and pending
commands and then set output to active for the duration of the
4 0x21 NUL PULSE_ON 1
On-time. For both complementary models, return
NOT_SUPPORTED status.
For activation model, set output to active for the duration of the
On-time. For complementary latch model, set the output to
5 0x03 NUL LATCH_ON 0
active. For complementary two-output model, set the close
output to active for the duration of the On-time.
Cancel in-progress and pending commands. Afterwards, initiate
6 0x23 NUL LATCH_ON 1
the action specified in row 5.
For activation model, set output to active for the duration of the
On-time. For complementary latch model, set the output to
7 0x04 NUL LATCH_OFF 0
inactive. For complementary two-output model, set the trip
output to active for the duration of the On-time.
Cancel in-progress and pending commands. Afterwards, initiate
8 0x24 NUL LATCH_OFF 1
the action specified in row 7.
For activation model, set output to active for the duration of the
On-time. For complementary latch model, set the output to
9 0x41 CLOSE PULSE_ON 0
active. For complementary two-output model, set the close
output to active for the duration of the On-time.
Cancel in-progress and pending commands. Afterwards, initiate
10 0x61 CLOSE PULSE_ON 1
the action specified in row 9.
For activation model, set output to active for the duration of the
On-time. For complementary latch model, set the output to
11 0x81 TRIP PULSE_ON 0
inactive. For complementary two-output model, set the trip
output to active for the duration of the On-time.
Cancel in-progress and pending commands. Afterwards, initiate
12 0xA1 TRIP PULSE_ON 1
the action specified in row 11.

4. Control-Related Event Log Messages

www.kepware.com 10 ©2011-2018 PTC, Inc. All Rights Reserved.

 Error
Message Possible Cause Solution
Type
The value written to the
Unable to write to '<address>' on For information on a specific code
.Operate sub-type was not
device '<device>'. Control-Related Warning number, refer to Control-Related
understood by the DNP
Status Code ' <status code>' Status Codes.
slave.
Unable to write to '<address>' on The device does not
device '<device>'. Device does not support the requested Verify that the slave supports the
Warning
support requested operation for operation for the objects requested operation.
objects in the request (IIN2.1) in the request.
The device does not
Unable to write to '<address>' on
support the function code For more information, refer to the
device '<device>'. Device does not Warning
on the objects in the device's documentation.
support the function code (IIN2.0)
request.
Unable to write to '<address>' on Correct the mode in the slave's
device '<device>'. Device reports Some output points are in configuration. For more
Warning
that some output points are in local local mode. information, refer to the device's
mode (IIN1.5) documentation.*
The device did not return
Unable to write to '<address>' on
an acceptable response to Verify that the slave is configured
device '<device>'. Select Operate Warning
a Select then Operate to operate on the point.
response invalid
request.

*This bit must be set whenever one of the slave’s output points is in local operation mode.
This indication is not intended to inhibit or prevent controls from the master: it is a
warning that controls might not succeed. The system implementer must provide suitable
lockouts that disable control operation from the master when points are in local mode. If
the master directs a control command to a point in local mode, the slave shall return a
status code indicating failure due to the point being in local mode. Masters may send
control requests to slaves that set IIN1.5 because this bit does not necessarily mean that all
points are disabled for operation from the master. For example, in a data concentrator
application, only one IED may be in the local mode. This requires the data concentrator to
set IIN1.5; however, control commands to the other IEDs should succeed. Slaves that have
a local-remote switch or logic are responsible for preventing control actions on those
points that it places in local mode.

www.kepware.com 11 ©2011-2018 PTC, Inc. All Rights Reserved.

5. Control-Related Status Codes
Code # Identifier Description
0 Success Request accepted, initiated, or queued.
Request not accepted because the operate message was received after
1 Timeout the arm timer timed out. The arm timer was started when the select
operation for the same point was received.
Request not accepted because no previous matching select request
2 No_Select exists. An operate message was sent to activate an output that was not
previously armed with a matching select message.
Request not accepted because there were formatting errors in the
3 Format_Error
control request (select, operate, or direct operate).
Request not accepted because a control operation is not supported for
4 Not_Supported
this point.
Request not accepted because the control queue is full (or the point is
5 Already_Active
already active).
6 Hardware_Error Request not accepted because of control hardware problems.
Request not accepted because the Local/Remote switch is in the Local
7 Local
position.
Request not accepted because too many objects appeared in the same
8 Too_Many_Objs
request.
9 Not_Authorized Request not accepted because of insufficient authorization.
Request not accepted because it was prevented or inhibited by a local
10 Automation_Inhibit
automation process.
Request not accepted because the device cannot process any more
11 Processing_Limited
activities than are presently in progress.
Request not accepted because the value is outside the acceptable
12 Out_Of_Range
range permitted for this point.
13 to 125 Reserved Reserved for future use.
Sent in request messages indicating that the outstation will neither
126 Non_Participating
issue nor perform the control operation.
127 Undefined Request not accepted due to an undefined reason.

www.kepware.com 12 ©2011-2018 PTC, Inc. All Rights Reserved.