Introduction

Filename DNPMaster.DLL
Manufacturer Protocol DNP 3.0
Device
Protocol DNP 3.0
Version 4.0.39
Last Update 23/04/2019
Platform Win32
Dependency IOKit 2.0
Superblock Reading No
Level 31201

Introduction
This Driver implements protocol DNP 3.0 in Master mode, according to level two and some level three
functionality.

DNP (Distributed Network Protocol) is an open and non-proprietary communication protocol, based on IEC
(International Eletrotechnical Commission) specifications, adapted for usage on highly secure applications,
with moderated speed and amount of data. It is extremely flexible and can be used in any hardware platform.

The model specified by ISO OSI (International Standards Organization - Open System Interconnection)
establishes seven layers for a network protocol. IEC, on the other hand, specifies a simplified model, which
consists only on physical, data link, and application layers. Such model is called EPA (Enhanced Performance
Architecture). The next figure shows an EPA structure and its communication system.

DNP Driver v4.0.39

 EPA architecture

A User Layer can be defined as a location where users manipulate data, after all communication. In software
by Elipse, it is represented by a user application. The User Layer uses the Driver's Application Layer to send
and receive full messages to or from a station.

An Application Layer is responsible for specifying in details the requests from the User Layer, and back to it
when the message comes from the Data Link Layer. In other words, it assembles messages from User Layer,
called fragments, into a multiple-fragment message with full information to be processed and sent to a
station using the Data Link Layer.

A Data Link Layer is used to pass messages between primary (origin) and secondary (destination) stations. It
also packs data, checks transmission errors, and sends them to the TCP/IP network.

DNP protocol can be configured to switch messages via polling (constant communication) or via Integrity -
Changes (more efficient). Sending changes, also known as RBE (Report by Exception), can occur
spontaneously (Unsolicited) or non-spontaneously by an explicit request from a master for these changes.

It is recommended to use the following configurations:

· Enable Class 0 (zero) during startup and at regular intervals: This way all Tags have a value when
starting the application

· Use unsolicited messages or event scanning at regular intervals: Data updates (as changes occur)
can be sent in an unsolicited way by the slave or using event requests (Classes 1, 2, and 3)
automatically by the Driver

· Configure Tags using event objects instead of static objects: Tags configured as static objects
generate communication by polling (constant exchange of messages), which generates unnecessary
traffic. Tags configured as events do not perform communication and are updated automatically as
integrity or change messages arrive, as exposed previously

DNP Driver v4.0.39

Function Codes
A function code identifies a message's purpose. There are two groups of functions, one for request and
another one for responses. There are several types of functions for requests, as shown on the next table.
Response functions are used internally and not open to users.
Function Codes
CODE FUNCTION DESCRIPTION
1 Read Requests objects specified by the
remote station and responds with
the requested objects that are
available.
2 Write Stores the objects specified by the
remote station and responds with
an operation status.
3 Select Selects or operates output points
but does not configure or produce
any action (controls, SetPoints, or
analog outputs) and responds with
an operation status. The Operate
function must be used to activate
these outputs.
4 Operate Configures or produces actions on
outputs or points previously
selected with the Select function.
5 Direct Operate Selects and operates the specified
outputs and responds with the
status of control points.
6 Direct Operate NO ACK Selects and operates the specified
outputs but does not send a
response (but takes less time).
7 Immediate Freeze Copies the specified objects to a
freezing buffer.
9 Freeze and Clear Copies the specified objects to a
freezing buffer and then zeroes
these objects.
10 Freeze and Clear No ACK Copies the specified objects to a
freezing buffer and then zeroes
these objects, but does not send a
confirmation response.
11 Freeze with Time Copies the selected objects to a
freezing buffer at the specified
moment, responding with an
operation status.
13 Cold Restart Performs a reset sequence.
14 Warm Restart Performs a partial reset sequence.
20 Enable Unsolicited Messages Enables a spontaneous notification
of the specified objects.

DNP Driver v4.0.39

 CODE FUNCTION DESCRIPTION
21 Disable Unsolicited Messages Disables a spontaneous
notification of the specified
objects.
22 Assign Classes Links the specified objects to a
class.
23 Delay Measurement Allows an application to calculate
a delay (propagation time) to a
specific station.

After the message's purpose specification (APCI), there is the second part of the message (if needed), called
ASDU. Every ASDU consists of one or more data identifier (DUI), object headers, object information, or data
fields.

Object Headers
An object header of a message identifies data objects inside this message or the ones that are used in the
response for this message. It is composed basically by the elements shown on the next figure.

Object header

Objects
Smart devices that use the Application Layer of DNP protocol can monitor, control, or produce a large amount
of data. This data, called information elements, is processed and stored as an information object, which is
standardized to produce ways to describe it and represent it in a unique way.

There are four types of categories for data objects:

· Static Objects: These are objects that reflect the current value of a field or internal variable

· Event Objects: These are objects generated as a result of a value change or other trigger. These are
historical objects, that is, they reflect a data value at an instant in the past

· Frozen Static Objects: Reflect a current frozen value of a field or internal variable. Data is frozen as a
result of a data-freezing request

· Frozen Event Objects: These objects are the result of a change in a frozen value or other trigger. These
are historical objects, that is, they reflect a data value at an instant in the past

Every category is represented by a different object, as described on the next table.

Categories of objects
OBJECT DESCRIPTION
Digital Inputs A group of digital inputs contains all objects that
represent binary inputs (status or Boolean
attributes). Ranges from 1 to 9.

DNP Driver v4.0.39

 OBJECT DESCRIPTION
Digital Outputs A group of digital outputs contains all objects that
represent binary outputs or control information on
relays. Ranges from 10 to 19.
Counters This group contains all counter objects. Ranges from
20 to 29.
Analog Inputs Contains all analog inputs. Ranges from 30 to 39.
Analog Outputs Contains all analog outputs. Ranges from 40 to 49.
Time Contains all objects that represent time in an
absolute or relative form. Ranges from 50 to 59.
Classes This group contains all objects that represent data
classes or data priorities. Ranges from 60 to 69.
Files Files or file system. Ranges from 70 to 79.
Devices Ranges from 80 to 89.
Applications Objects that represent operating system applications
or processes. Ranges from 90 to 99.
Alternative numbers Custom number representations. Ranges from 100 to
109.

It is important to notice that a static object, when suffers a variation, is capable of generating an event object
indicating that change. However, both represent the same object.

Variation
These are changes or sub-types that may occur on objects. As an example, a digital input can be represented
by a single bit (0 or 1), by a status word (one byte), or yet contain or not a time information (timestamp).
Thus, a combination of an object plus a variation completely describes an information. Examples:

· Object 01 - Variation 01: Represents a digital input without status (a single bit)

· Object 01 - Variation 02: Represents a digital input with status (one byte)

· Object 02 - Variation 01: Represents a digital input change without time information

· Object 02 - Variation 02: Represents a digital input change with time information

Although both objects are related to the same digital input, this information can be symbolized in different
ways.

Qualifier
Specifies the meaning of the Range field.

Range
Indicates the amount of objects, starting and ending indexes, or identifiers for the objects.

DNP Driver v4.0.39

Classes
Objects declared in a system or device that implements DNP protocol in Slave mode can be grouped into
classes. DNP protocol defines four classes:

· Class 0: Means all objects, that is, when starting the Driver (master side) can perform a class 0 (zero)
request, and as a response the slave side sends the current value of all declared objects

· Classes 1 to 3: These are entities that store temporarily lists of events (changes) in objects. Each object
must be configured in the slave side to generate events when changes occur, and usually there is a
pattern among DPN users to reserve class 1 for digital events, class 2 for analog events, and class 3 for
counters

Driver Configuration
This section contains information about the configuration of DNP Driver.

P Configuration Parameters
P1 Not used, keep its value in zero
P2 Not used, keep its value in zero
P3 Not used, keep its value in zero
P4 Keep its value in zero. When using a Toshiba Regulator device, configure it as one

Extra Configurations
Displays the Driver's configuration window with DNP, Other, and Private Objects tabs, described on the next
topics.

DNP Driver v4.0.39

DNP Tab

Available options on DNP tab

OPTION DESCRIPTION
App Timeout (ms) This is the maximum time the application layer waits
for a full response from Data Link layer. If receiving a
request is ongoing by the Data Link layer, this time is
automatically extended up to the end of the
reception from the Data Link layer. The default value
of this option depends on the communication rate
used, but it is recommended that this value be equal
or greater than IOKit time-out (Setup tab). This value
represents a byte-to-byte time-out of the message,
while the App Timeout option represents one or
more full Data Link messages.
App Read Retries Number of communication retries performed by the
application layer in case of a reading error. Default
value of this option is 0 (zero).
App Write Retries Number of communication retries performed by the
application layer in case of a reading error. Default
value of this option is 0 (zero).
Master Address This is the address of the master station (PC).
Control Relay Off-Time When relay commands are sent (Control Relay
Commands) with individual Tags, this field indicates
a normal turned off time for Pulse On/Off or Latch
On/Off commands.

DNP Driver v4.0.39

 OPTION DESCRIPTION
Control Relay On-Time When relay commands are sent (Control Relay
Commands) with individual Tags, this field indicates
a normal turned on time for Pulse On/Off or Latch
On/Off commands.
Default Slave Address Device's default DNP address, to use when the N1
field of each Tag is in 0 (zero).
Delay Between Messages Delay time to apply between each message sent by
the Driver, in milliseconds.
Error Count for Inactive State Indicates how many consecutive errors the Driver
must consider to switch the device to Inactive status.
The Driver tries to communicate with this device at
the next scan of any Tag on the same address or only
at the time informed in the Demotion Time property,
if this resource is used.
Extra Sync Offset Additional time, positive or negative, to add to
syncing commands.
Control Block Qualifier When performing a writing command of a control
block (digital output command such as Direct
Operate, Select, Operate, etc.), users must send a
qualifier, which may vary from device to device.
Possible values for this field are 39 (or 27h) for the
Range field with a byte and a prefixed object with
two bytes, or 40 (or 28h) for the Range field with two
bytes and a prefixed object with two bytes. Please
check the equipment's device profile for a correct
qualifier.
IIN Qualifier When a slave device informs a restart, the Driver
performs a writing to an internal indications object
informing the acknowledgment of this event. Use this
field to inform a qualifier (which is on the Slave
Device Profile document of the slave device). Most
common values are 0 (zero, one starting and ending
index byte) and 1 (one, two starting and ending index
byte).
Auto LinkStatus (ms) Interval in milisecondsto send a LinkStatus Request
message, that shall be anwsered with a LinkStatus
Response. The lack of reception puts this address in
Inactive state. To disable this option, let the value in
0 (zero).
Perform Class 0 Integrity On Startup Performs a Class 0 (zero) request when starting the
Driver, which gets the whole device's database,
which updates all Tags. Event Tags, in this case,
have the TimeStamp property as the time of data
reception and the Quality property as 216.
Enable Unsolicited on Startup Indicates whether the Driver must send a command
to enable unsolicited messages when starting
communication.

DNP Driver v4.0.39

 OPTION DESCRIPTION
Initialize Upon Receiving Device Restart Indicates whether the Driver must send a command
to start the device (reset link, Class 0, and enable
unsolicited, if enabled) when receiving a message
that this device was restarted.
Scan for Events Every X ms Sends a Class 1, 2, or 3 reading command to check if
there are events on the device. Indicate a time
interval that this command must be repeated.
Min InterScan ms If after some communication, or even
after an event scan, there are pending
events at outstation yet (verified by IIN
bits), the driver will request the new
events of the pending class(es). To limit
this communication in order to avoid
happening continuously, it is possible to
define a minimum interscan interval
through this parameter. The default value
is 0 (zero), so if there are still pending
events, they will be requested
immediately, keeping the behavior of
previous versions .
Perform Class 0 Integrity every X ms Performs a Class 0 (zero) request cyclically, only to
check if the Driver's database is equal to device's
database. The default time is 10 or 15 minutes.
Block Unknown Slaves Blocks the creation of new slaves upon receiving
unsolicited messages from undeclared tag addresses
(not existent at the application).
Scan After Cmd If the option "Scan for Events" is enabled, through
this option it is possible to request a new scan
immediately after a command, in order to obtain the
state change faster.

DNP Driver v4.0.39

Other Tab

Other tab

Available options on Other tab

OPTION DESCRIPTION
Counter DeadBand (units) Dead band in units, to verify when checking new
events for counters.
Analog DeadBand (units) Dead band in units, to verify when checking new
events for analog points.
Select/Operate Timeout (s) Maximum time for blocking other messages, except
the Operate command, right after a Select
command.
Use Auto Demotion Enables the auto-demotion system, which
automatically removes and inserts from
communication the slaves in an Inactive status, that
is, with communication errors. This procedure is used
when two or more slaves use the same channel, thus
avoiding that a slave in this status takes over the
channel.
Demotion Time Time in seconds that the Driver tries to communicate
with every slave in an Inactive status, to check if
communication is correct, setting it back to an Active
status.
Command Max Age (s) Verifies if the command timestamp is greater than
local timestamp minus the number of seconds
defined here, in order to avoid processing old
commands that for any reason remained pending.

DNP Driver v4.0.39

 OPTION DESCRIPTION
Use Callbacks Driver must be configured to use callbacks or
asynchronous calls to Elipse E3, which immediately
receives values from objects arriving on the
communication, and in this case the scan rate is not
used. If this option is disabled, Tags take more time
to update, more than the defined scan time in
average.
Check Select/Operate Message Sequence Allows using Operate commands controlling
message's sequence number, so that it is
immediately subsequent to a Select command. When
selecting this options, the Driver does not send a
command, except an Operate command, until a
maximum time for this operation is exceeded.
Use Local Time Zone as Sync/Event Time Offset Informs the Driver to consider the difference between
Windows official time and UTC/GMT time for all
events and time-syncing requests. This function is
useful when a DNP Server is configured as UTC but
users want to inform a local time to the application.
Discard Events out of Order (by TimeStamp Info) For objects with timestamp information, this option
forces events whose timestamp is older than the last
one processed to be discarded.
Scan for Files Indicates that the Driver must try to perform file
transfers from the device. Users must select a collect
profile, and in this version the only supported profile
is Pextron.
Wait for Unsolicited Messages after Startup (ms) Indicates how much time the Driver must wait for
unsolicited messages after connecting, to get recent
events before performing an integrity request (Class
0). This way, points with events get a quality of 192
and a correct timestamp, as in integrity responses
objects do not have timestamp.
R/W Last TimeStamp Sync Files With this option, the last timestamp of each Tag is
saved to a file in pre-defined intervals, starting when
a new event is received. When starting, the Driver
tries to read this file to initialize timestamps and
discard older events. The generated file can be
copied among redundant stations. File name and
extension can be changed by users, and its content is
in ASCII format.
Use Single Block Evt Read By using this option, all events sent by a device are
reported in a single Block Tag. This option is useful
to concentrate all events and generate specific event
logs, for example. NOTE: Users must create a Block
as described on topic Single Block Events to remove
received events.
Driver in Listen Mode In this mode, the Driver does not send anything, but
it may interpret responses, received from a
communication sniffer between other masters and a
slave.

DNP Driver v4.0.39

 OPTION DESCRIPTION
Accept Msgs After Timeout Indicates if a response to a solicited message shall
be accepted after App Timeout. The default value is
false to keep compatibility with previous versions.
Accept Msgs Out of Sequence Indicates if a response to a solicited message shall
be accepted if the application sequence number is
different from expected.

Private Objects Tab

Private Objects tab

Private objects are declarations that can be created by every vendor, and that reflect composed data
structures of basic data types of DNP protocol.

The window on the previous figure displays two lists: on the left users declare objects, composed by an index
(Number), a code with up to four characters for the manufacturer (Vendor), an object's identification number
for the manufacturer (Object ID), and the object's size in bytes (Length). This list can be edited using the
Add, Update, and Del options.

By clicking list rows, users can insert DNP objects that are part of each PROs (Private Registration Objects) on
the list on the right. Users must inform an object's code (Object), a variation (Variation), and an amount
(Quantity). The order in which these objects appear is also important. This can be changed by using the
arrow keys or using the Add, Update, and Del options.

When using a declaration of time objects (type 50), this declaration is used as a timestamp for the PRO
object.

The Return all PRO instances as one indexed block tag option forces all PRO objects to be sent to the same
Block Tag, as long as it has the same DNP address. In this case, the Block must be created with one more

DNP Driver v4.0.39

Element than the PRO object declaration, because the first Element contains the object's index, followed by
the other Elements, each one with one of the variables declared in the PRO object.

N Addressing Parameters of PLC Tags

N1 Slave address or 0 (zero) to use Default Slave Address
N2 Code of a function to perform (please check table Supported Function Codes)
N3 Code of object and variation (please check table Supported Objects)
N4 Variable address or number

NOTES:
· N3 must be informed as a parameter, with the formula Object Code * 100 + Variation. Object Code is
the type of object (for example, Binary Inputs) and Variation is a sub-type. Please check the table
Supported Objects for information about supported objects and variations
· N4 is a variable address or number, regardless if this is a physical or logical point

Function Codes
Supported function codes
N2 READING OR WRITING OPERATION
-34 Writing Data for analog channels of a
COMTRADE file (Pextron profile).
N3 indicates the channel, from 0 to
7. Users must use a Block with up to
eight Elements:
· 0: Channel's name
· 1: A Constant
· 2: B Constant
· 3: Maximum Channel's Value
· 4: Minimum Channel's Value
· 5: RPV Constant
· 6: RSV Constant
· 7: Primary or Secondary Circuit
(can be p, P, s, or S)
-33 Reading and Writing Data for Pextron profile transfer.
· N3 = 0: Indicates that a file has
just been recorded (pulse in one)
· N3 = 1: Number of files left for
transmission
· N3 = 2 (Writing): Requests a
collecting on the Pextron file
(instantaneous)
· N3 = 3 (Writing): Requests the
start of a random counting to
collect a Pextron file (counts the
time to request the collecting)
-32 Reading and Writing Base name of the COMTRADE file.
-31 Reading and Writing Circuit name for COMTRADE files.
DNP Driver v4.0.39
 N2 READING OR WRITING OPERATION
-30 Reading and Writing Directory to store files.
-22 Reading Returns a WORD containing Internal
Indications, IIN1 on LOW byte, and
IIN2 on HIGH byte:
· Bit 0: All station messages
received
· Bit 1: Class 1 data available
· Bit 2: Class 2 data available
· Bit 3: Class 3 data available
· Bit 4: Time sync required
· Bit 5: Points in local status
· Bit 6: Device trouble
· Bit 7: Device restart
· Bit 8: Not implemented
· Bit 9: Requested objects unknown
· Bit 10: Parameters not valid
· Bit 11: Buffer overflow
· Bit 12: Operation already
executing
· Bit 13: Configuration corrupted
· Bit 14: Not used
· Bit 15: Not used
-21 Reading Address indicated in N1 active or
inactive (0: Inactive and 1: Active).
-20 Reading and Writing On or Off of the address indicated in
N1 (0: Off and 1: On).
-14 Writing Requests a restart (Reset Link, Class
0, etc.).
-13 Reading and Writing Communication statistics:
· N4 = 0 (Read-only): Clears
statistics
· N4 = 1: Frames sent
· N4 = 2: Frames without response
· N4 = 3: CRC errors in response
format
· N4 = 4: Sending errors
· N4 = 5: Transmission retries
· N4 = 6: Frames received
· N4 = 7: Bytes sent
· N4 = 8: Bytes received
-11 Reading and Writing Requests Class 0 (Integrity).
-10 Reading Link Status.
-7 Writing Time syncing (Ethernet procedure).
-6 Writing Time syncing (writes computer's
time to the remote station).

DNP Driver v4.0.39

 N2 READING OR WRITING OPERATION
0 Reading Read from Cache: Removes all
events available for the Tag, leaving
the last event as the current Tag's
value. For static objects, performs a
reading communication before (the
Read function).
1 Reading Read Events: Returns all events
available for the Tag. For static
objects, performs a reading
communication before (the Read
function).
2 Writing Write
3 Writing Select
4 Writing Operate
5 Writing Direct Operate
6 Writing Direct Operate No ACK
7 Writing Immediate Freeze
9 Writing Freeze and Clear
10 Writing Freeze and Clear No ACK
11 Writing Freeze with Time
13 Writing Cold Restart
14 Writing Warm Restart
20 Writing Enable Unsolicited Messages
21 Writing Disable Unsolicited Messages
22 Writing Assign Classes
23 Reading Delay Measurement
50 Reading Single Block Event
51 Reading Auto Zero Bad Read: Function used
when a Tag receives a ramp up-only
change event (from 0 to 1) and
never a ramp down (from 1 to 0). In
this case, the Driver inserts an event
with value 0 (zero) before returning
each event in 1 (one).
101 Reading Read (Integrity): Performs an
integrity operation, requesting all
points with object type * 100 +
Variation declared in N3. Users can
also use variation as 0 (zero),
corresponding to any informed
object, regardless of the variation.
This function performs a
communication (integrity) each time
a Tag is read.

DNP Driver v4.0.39

Supported Objects
Supported objects, variations, qualifiers, or functions
OBJECT VARIATION OBJECT'S NAME FUNCTION CODE ON
REQUEST (N2)
1 (Static) 1 Binary Input without 0, 1
Status
1 (Static) 2 Binary Input with Status 0, 1
2 (Event) 1 Binary Input Change 1
without Time
2 (Event) 2 Binary Input Change with 1
Time
2 (Event) 3 Binary Input Change with 1
Relative Time
3 (Static) 1 Double bit binary Input 0, 1
without Status
3 (Static) 2 Double bit binary Input 0, 1
with Status
4 (Event) 1 Double bit binary Input 1
Change without Time
4 (Event) 2 Double bit binary Input 1
Change with Time
10 (Static) 1 Binary Output 0, 1
10 (Static) 2 Binary Output Status 0, 1
11 (Event) 1 Binary Output Event 1
without Time
11 (Event) 2 Binary Output Event with 1
Time
12 1 Control Relay Output 3, 4, 5, 6
Block
20 (Static) 1 32-bit Counter 1, 7, 9, 10, 11
20 (Static) 2 16-bit Binary Counter 1, 7, 9, 10, 11
20 (Static) 3 32-bit Delta Counter 1, 7, 9, 10, 11
20 (Static) 4 16-bit Delta Counter 1, 7, 9, 10, 11
20 (Static) 5 32-bit Counter without 1, 7, 9, 10, 11
Flag
20 (Static) 6 16-bit Counter without 1, 7, 9, 10, 11
Flag
20 (Static) 7 32-bit Delta Counter 1, 7, 9, 10, 11
without Flag
20 (Static) 8 16-bit Delta Counter 1, 7, 9, 10, 11
without Flag
21 (Static) 1 32-bit Frozen Counter 1, 7, 9, 10, 11
21 (Static) 2 16-bit Frozen Counter 1, 7, 9, 10, 11
21 (Static) 3 32-bit Frozen Delta 1, 7, 9, 10, 11
Counter

DNP Driver v4.0.39

 OBJECT VARIATION OBJECT'S NAME FUNCTION CODE ON
REQUEST (N2)
21 (Static) 4 16-bit Frozen Delta 1, 7, 9, 10, 11
Counter
21 (Static) 5 32-bit Frozen Counter with 1, 7, 9, 10, 11
Time Of Freeze
21 (Static) 6 16-bit Frozen Counter with 1, 7, 9, 10, 11
Time Of Freeze
21 (Static) 7 32-bit Frozen Delta 1, 7, 9, 10, 11
Counter with Time Of
Freeze
21 (Static) 8 16-bit Frozen Delta 1, 7, 9, 10, 11
Counter with Time Of
Freeze
21 (Static) 9 32-bit Frozen Counter 1, 7, 9, 10, 11
without Flag
21 (Static) 10 16-bit Frozen Counter 1, 7, 9, 10, 11
without Flag
21 (Static) 11 32-bit Frozen Delta 1, 7, 9, 10, 11
Counter without Flag
21 (Static) 12 16-bit Frozen Delta 1, 7, 9, 10, 11
Counter without Flag
22 (Event) 1 32-bit Counter Change 1
Event without Time
22 (Event) 2 16-bit Counter Change 1
Event without Time
22 (Event) 3 32-bit Delta Counter 1
Change Event without
Time
22 (Event) 4 16-bit Delta Counter 1
Change Event without
Time
22 (Event) 5 32-bit Counter Change 1
Event with Time
22 (Event) 6 16-bit Counter Change 1
Event with Time
22 (Event) 7 32-bit Delta Counter 1
Change Event with Time
22 (Event) 8 16-bit Delta Counter 1
Change Event with Time
23 (Event) 1 32-bit Counter Change 1
Event without Time
23 (Event) 2 16-bit Frozen Counter 1
Event without Time
23 (Event) 3 32-bit Frozen Delta 1
Counter Event without
Time

DNP Driver v4.0.39

 OBJECT VARIATION OBJECT'S NAME FUNCTION CODE ON
REQUEST (N2)
23 (Event) 4 16-bit Frozen Delta 1
Counter without Time
23 (Event) 5 32-bit Frozen Counter 1
Event with Time
23 (Event) 6 16-bit Frozen Counter 1
Event with Time
23 (Event) 7 32-bit Frozen Delta 1
Counter Event with Time
23 (Event) 8 16-bit Frozen Delta 1
Counter Event with Time
30 (Static) 1 32-bit Analog Input 0, 1
30 (Static) 2 16-bit Analog Input 0, 1
30 (Static) 3 32-bit Analog Input 0, 1
without Flag
30 (Static) 4 16-bit Analog Input 0, 1
without Flag
30 (Static) 5 32-bit Analog Input 0, 1
Floating Point
31 (Static) 1 32-bit Frozen Analog Input 0, 1
31 (Static) 2 16-bit Frozen Analog Input 0, 1
31 (Static) 3 32-bit Frozen Analog Input 0, 1
with Time Of Freeze
31 (Static) 4 16-bit Frozen Analog Input 0, 1
with Time Of Freeze
31 (Static) 5 32-bit Frozen Analog Input 0, 1
without Flag
31 (Static) 6 16-bit Frozen Analog Input 0, 1
without Flag
31 (Static) 7 32-bit Frozen Analog Input 0, 1
Floating Point
32 (Event) 1 32-bit Change Event 1
without Time
32 (Event) 2 16-bit Change Event 1
without Time
32 (Event) 3 32-bit Analog Change 1
with Time
32 (Event) 4 16-bit Analog Change 1
Event with Time
32 (Event) 5 32-bit Analog Change 1
Floating Point without
Time
32 (Event) 7 32-bit Analog Change 1
Floating Point with Time
33 (Event) 1 32-bit Frozen Analog 1
Event without Time

DNP Driver v4.0.39

 OBJECT VARIATION OBJECT'S NAME FUNCTION CODE ON
REQUEST (N2)
33 (Event) 2 16-bit Frozen Analog 1
Event without Time
33 (Event) 3 32-bit Frozen Analog 1
Event with Time
33 (Event) 4 16-bit Frozen Analog 1
Event with Time
33 (Event) 5 32-bit Frozen Analog 1
Floating Point without
Time
33 (Event) 7 32-bit Frozen Analog 1
Floating Point with Time
34 (Static) 1 16-bit Analog Input Dead 1
Band
34 (Static) 2 32-bit Analog Input Dead 1
Band
34 (Static) 3 32-bit Analog Input 1
Floating Point Dead Band
40 (Static) 1 32-bit Analog Output 1
Status
40 (Static) 2 16-bit Analog Output 1
Status
40 (Static) 3 32-bit Analog Output 1
Status Floating Point
41 1 32-bit Analog Output 2, 3, 4, 5, 6
Block
41 2 16-bit Analog Output 2, 3, 4, 5, 6
Block
41 3 32-bit Floating Point 2, 3, 4, 5, 6
Analog Output Block
42 (Event) 1 32-bit Analog Output 1
Event without Time
42 (Event) 2 16-bit Analog Output 1
Event without Time
42 (Event) 3 32-bit Analog Output 1
Event with Time
42 (Event) 4 16-bit Analog Output 1
Event with Time
42 (Event) 5 32-bit Floating Point 1
Analog Output Event
without Time
42 (Event) 7 32-bit Floating Point 1
Analog Output Event with
Time
50 (Static) 1 Time and Date 1, 2

DNP Driver v4.0.39

 OBJECT VARIATION OBJECT'S NAME FUNCTION CODE ON
REQUEST (N2)
51 (Static) 1 Time and Date CTO 1
(Common Time of
Occurrence)
51 (Static) 2 Not synced Time and CTO 1
(Common Time of
Occurrence)
52 (Static) 2 Time Delay Fine 1
60 (Static) 1 Class 0 Data 1
60 (Event) 2 Class 1 Data 1
60 (Event) 3 Class 2 Data 1
60 (Event) 4 Class 3 Data 1
80 1 Internal Indications 1, 2
83 (Event) 1 Pro 1
110 (Static) X Octet String 1
111 (Event) X Octet String Event 1

Supported Qualifiers
Supported Qualifiers
OBJECT OR VARIATION SENDING QUALIFIER RECEPTION QUALIFIER
Static objects in general 1 0, 1, 7, 8, 17, 18, 27, 28, 47, 58
(Reading)
Object 34 (Writing) 1 0, 1, 7, 8, 17, 18, 27, 28, 47, 58
Object 60 (Classes) or General 6 0, 1, 7, 8, 17, 18, 27, 28, 47, 58
Integrity Requests (Reading)
Object 50 (Writing) 7 0, 1, 7, 8, 17, 18, 27, 28, 47, 58
Object 80 (Writing) User-defined 0, 1, 7, 8, 17, 18, 27, 28, 47, 58
Object 12, Object 41 (SELECT, User-defined 0, 1, 7, 8, 17, 18, 27, 28, 47, 58
OPERATE, etc.)

B Addressing Parameters of Block Tags

B1 Slave address
B2 Code of the function to perform (please check table Function Codes)
B3 Code of the object and variation (Object * 100 + Variation)
B4 Initial address of the variable or number

Using Blocks to read events is not allowed, because all Block Elements share a single timestamp, which
cannot be accepted as each event has its own occurrence time. Therefore, for reading the B2 parameter must
be equal to 0 (zero, Read from cache). Exception is when using Single Block Events because, in this case,
the timestamp of each event is reported in a fixed Element of the Block.

Examples of Tag Configuration

Supposing a device configured with a DNP address = 3, these are examples of parameters N1, N2, N3, and
N4 in the format "N1.N2.N3.N4":

DNP Driver v4.0.39

Digital Input 100, Object 1 Variation 2: 3.1.102.100 (configured as a static
object)
Digital Input 100, Object 2 Variation 2: 3.1.202.100 (configured as an event)

In the previous example, both Tags reference the same variable (Digital input 100), but the first Tag remains
continually requesting the current value (polling), while the second one only receives notifications when the
point changes its value. In addition, as an Event the timestamp of the change from the device is kept. In the
Static mode, in the other hand (as there is no timestamp), it is generated with the computer's time at event's
arrival.

General Comments
This section contains additional information about DNP Driver.

Data and Event Integrity

The integrity command performs a request of all data configured in the slave, for all objects (Class 0) or for
specific objects.

Due to a peculiarity of DNP protocol sending together with integrity the current value of variables (therefore
as static objects) and not as events, the Elipse DNP Driver must process this information to unify the static
value with the event's value, so that the application has a single Tag for the point.

This way, if the application uses Tags as events (as recommended in this document), then during start up,
when receiving an integrity (Class 0) with a point's static value, a temporary event is generated with the
Quality property equal to 216, indicating that the timestamp used was not generated by the device, but
rather by the computer's local time, due to the lack of this information in the integrity.

As soon as there is a reception of an event for this Tag, then its quality changes to 192 and the Timestamp
property reflects the timestamp received from the event, if the object contains it.

NOTE: Quality values exposed previously assume that object statuses are informing a normal situation,
otherwise quality values reflect point's bad status, as exposed on topic Quality Information.

Event Reading
Receiving events by the Driver is fundamental for Tags configured as events receive their values. The Driver
only discovers that there is data available for one of the classes of events (1, 2, or 3) if the application uses
at least one of the following options:

· The Scan for Events Every X ms option on Driver configuration is enabled. This informs the Driver to
request Classes 1, 2, or 3 at fixed intervals, receiving an indication of events.

· The device sends events spontaneously through unsolicited messages.

· The application has at least one Tag configured for reading any static variable. For example, digital or
analog input or output, counter, etc.

DNP Driver v4.0.39

Commands
When using the object Control Relay Output Block (Object 12, Variation 1) a series of data is sent by the
Driver, as described next.

Byte 0: Control Code

The Tag value attributed on the Elipse application is copied to this byte, which specifies details about the
operation of the command. This field is subdivided as follows:

Bit 7 6 5 4 3 2 1 0
Meaning Trip or Close Clear Queue Code

· Trip or Close: This field determines which control relay is activated in a system where a pair of Trip and
Close relays is used to energize and de-energize points in the field. Possible values are, in binary
format, 00: NUL, 01: Close, and 10: Trip. The NUL value can be used to activate the selection relay
without activating the Trip or Close relays. In a system without selection relays, the NUL value does not
perform any operation. In a system without Trip or Close relays, on the other hand, this field must be
always NUL to indicate a normal operation of digital control, where the exact control point is implicit or
fully known. This field does not support Trip and Close commands simultaneously, which is considered
an illegal operation.

· Clear: If the command has this field set as 1 (on), all control operations are removed from the queue,
including the command currently executing, and this control operation is performed.

· Queue: Indicates placing a command in a command queue in the device. If this field is 0 (zero, NUL)
then no operation is added to the queue and this queue is cleared from all controls, including the
command that is executing if the Clear field is turned on. When the control function is executed and
completed, it is removed from the queue. If this command has the Queue attribute turned on, then this
operation returns to the queue (at the end) for that point.

· Code: This field specifies the operation type. This command can be used with devices that support
queuing commands, point-to-point, or other control mechanisms. In the first type, any control command
must be queued for the point. In the second type, each control is performed until completed before the
next command be accepted for that point.

Possible values for Code (in binary format)

VALUE OPERATION DESCRIPTION
0000 NUL No operation is performed.
0001 PULSE ON Points are connected by the time specified in On Time, turned off by the time
specified in Off Time, and kept in the status OFF.
0010 PULSE OFF Points are disconnected by the time specified in Off Time, turned on by the time
specified in On Time, and kept in the status ON.
0011 LATCH ON Keeps the points in the status ON.
0100 LATCH OFF Keeps the points in the status OFF.

Other values outside this table are not defined.

DNP Driver v4.0.39

Byte 1: Count

This byte indicates how many times the operation is executed. This value is kept fixed in 1 (one) by the
Driver.

Bytes 2 a 5: On-Time

On-time, in milliseconds. It is defined on Driver's extra configurations window and it is fixed for all
commands.

Bytes 6 a 9: Off-Time

Off-time, in milliseconds. It is defined on Driver's extra configurations window and it is fixed for all
commands.

Byte 10: Status

Status of the operation returned by the Driver if the operation was successful. Status is only interpreted in the
response, and it can be used by the application to check if the command was performed successfully. The
available codes are the following:

· 0: Command correctly executed, including Select and Operate operations

· 1: Operate command sent after a maximum Select time defined by the slave

· 2: Operate command was sent without a previous Select command

· 3: Formatting errors in the message

· 4: Operation not supported for this point

· 5: Queue is full or point is already active

· 6: Hardware problems

· Others: Non-standard error codes

The value of the Status field can be obtained in Elipse E3 using the WStatus parameter of the WriteEx
method of Tags or Blocks (check the next examples).

To send commands, users can use a PLC Tag (IOTag) as well as a Block Tag. When using a PLC Tag, it must
be set with a number between 0 (zero) and 255, which corresponds to the Control Code (message's byte
zero). Remaining bytes are retrieved from Driver's default configuration, defined on extra configurations
window.

For a Block Tag users must use a script that executes Block's Write method. To do so, this Block must have
only four Elements, which must have their individual writing property disabled, with the following Elements:

· Element 0: Control Code

DNP Driver v4.0.39

 · Element 1: Count

· Element 2: Relay On-Time

· Element 3: Relay Off-Time

This feature can be used if individual command programming is needed for each point, ignoring default On-
Time and Off-Time timings.

Example of a script in Elipse SCADA using a Block with four Elements

//Configurations: B2=5 (DIRECT OPERATE), B3 = 1201
Block1.Element0 = 65 // Operation Code
Block1.Element1 = 1 // Count
Block1.Element2 = 500 // On Time
Block1.Element3 = 500 // Off Time
Block1.Write()

Example of a script in Elipse E3 using a simple command Tag

Value = 65 // Operation Code
msg = MsgBox("Send this command?", 292, "Command")
If msg = 7 Then
MsgBox "Command aborted", 48, "Quit"
ElseIf msg = 6 Then
If MsgBox("Confirm sending the command?", 292, "Warning") = 6 Then
Set Tag = Application.GetObject("DNPDriver.TagName")
If Tag.WriteEx(Value, , , WStatus) = False Then
MsgBox "Error sending the command", 48, "Error"
Else
If WStatus <> 0 Then
MsgTrack = "Command not executed,"
EndText = ""
Select Case WStatus
Case 1
EndText = " Operate received after a Selection time-out"
Case 2
EndText = " No previous Selection message"
Case 3
EndText = " Formatting error in the Command"
Case 4
EndText = " Operation not supported for this point"
Case 5
EndText = " Queue is full or point is already active"
Case 6
EndText = " Hardware problems"
Case Else
EndText = " Undefined problem"
End Select
MsgBox "MsgTrack & EndText", 48, "Error"
End If
End If
DNP Driver v4.0.39
End If

Single Block Events

If the Use Single Block Read for All Events option is enabled, users can use a Block to receive all events at
once. This Block has the following configuration:

· N1: DNP address

· N2: 50

· N3 and N4: Not used

· Size: Can have up to seven Elements:

· Element 0: Object

· Element 1: Variation

· Element 2: Index

· Element 3: Status

· Element 4: Value

· Element 5: Timestamp

· Element 6: Quality

NOTE: A Single Block Event cannot be used together with event Tags in an application.

Quality Information
For objects with a status indication (most objects), the Driver performs a mapping of the status to OPC
standard used in Elipse E3, as explained next.
For objects 1, 2, and 10
Bit 7 6 5 4 3 2 1 0
Meaning XX XX CF LF RF CL RS OL

· OL (Online): In zero, Q = 12 (Bad, device failure)

· CL (Comm lost): In one, Q = 12 (Bad, device failure)

· RS (Restart): In one, Q = 68 (Uncertain)

· CF (Chatter filter): In one, Q = 80 (Uncertain)

· RF (Remote forced): In one, Q = 216 (Good, local override)

· LF (Local forced): In one, Q = 216 (Good, local override)

DNP Driver v4.0.39

 For object 40
Bit 7 6 5 4 3 2 1 0
Meaning 0 RE OR LF RF CL RS OL

· OL (Online): In zero, Q = 12 (Bad, device failure)

· CL (Comm lost): In one, Q = 12 (Bad, device failure)

· RS (Restart): In one, Q = 68 (Uncertain)

· RE (Reference error): In one, Q = 80 (Uncertain)

· OR (Over range): In one, Q = 66 (Uncertain)

· RF (Remote forced): In one, Q = 216 (Good, local override)

· LF (Local forced): In one, Q = 216 (Good, local override)

Other objects
Bit 7 6 5 4 3 2 1 0
Meaning 0 XX XX LF RF CL RS OL

· OL (Online): In zero, Q = 12 (Bad, device failure)

· CL (Comm lost): In one, Q = 12 (Bad, device failure)

· RS (Restart): In one, Q = 68 (Uncertain)

· Bits 5 or 6: In one, Q = 80 (Uncertain)

· RF (Remote forced): In one, Q = 216 (Good, local override)

· LF (Local forced): In one, Q = 216 (Good, local override)

NOTE: Notice that, according to OPC standard, a quality greater or equal to 192 is considered Good.

Collecting and Storing Files in COMTRADE Standard

If the process of collecting files is enabled in Pextron profile, the Driver follows these steps:

1. When starting the Driver, a random time between 0 (zero) and 13 minutes is counted, and after that a
collect process try is performed. If this collect process is successful, this file is saved and its existence is
indicated by the Tag DNPADD.-33.0.X. The number of files left for transfer is indicated by the Tag
DNPADD.-33.1.X.

2. The application can write to the Tag DNPADD.-33.2.X to request a new immediate collect process or to
Tag DNPADD.-33.3.X to request a new collect process after a random time. In both cases the collect

DNP Driver v4.0.39

 process is performed regardless if the Tag DNPADD.-33.1.X indicates 0 (zero) or more collect processes to
transfer.

3. If no Tag is written, the Driver does not perform a new collect process.

4. Configuration of channels, directory, and file name must be performed before starting the collect process.

DNP Driver v4.0.39

Driver Revision History
VERSION DATE AUTHOR COMMENTS
4.0.39 04/23/2019 M. Salvador · Support to objects 4003
and 4103 (Case 15232).
· Migration to Visual Studio
2013 (Case 16392).
· Migration to IOKit 2.0
(Case 13516).
· Allowed negative values
in the Extra Sync Offset
field.
· Fixed timers for checking
events and Class 0 when
computer's time moves
back in time (does not
use etGetTimeDouble()
anymore).
· Generation of syncing
files of the last
timestamp (Case 13528).
· Fixed a vulnerability from
ICS-CERT VU-028282
notification, according to
tests with an emulator for
formatting errors in DNP
Aegis Fuzzer messages
(Case 16590).
· Performance
improvements when
using thousands of
simultaneous Drivers
(Case 13117).
· Fixed when the Driver
only has event Tags with
the callback option
enabled (Cases 14040
and 16088).
· Support for String-type
objects 110 and 111
(Case 16920).
· Bypass Reset of Remote
Link on first unsolicited
communication from a
slave (Case 15233).

DNP Driver v4.0.39

 VERSION DATE AUTHOR COMMENTS
3.02 05/31/2012 M. Salvador · Beta 1: Fixed Single Block
Events.
· Beta 2: Support for
reading object 50
variation 01; Fixed
qualifiers 7 and 8; When
connecting, event request
is performed before Class
0.
· Beta 3: Fixed a check for
out-of-order events.
· Beta 4: Delay time for
unsolicited messages, in
milliseconds.
· Beta 5: Checking out-of-
order events is individual
by Tag.
· Beta 6: Fixed a log
message when there is a
CRC error.
· Beta 7: Fixed the quality
information of Single
Block Events.
· Betas 8 e 9: Fixed the
expected sequence
number on the
application layer.
· Beta 10: Fixed double
points on objects 3 and 4.
· Beta 11: Tag indicating
the number of frames
received.
· Beta 12: Writing
command on object 10
variation 1.
· Beta 13: Decreasing on
the delay time of
transmission when not
connected.
· Beta 14: Tag N2=-21 only
informs Active after
receiving a response from
a slave's Reset of
Remote Link.
· Beta 15: Handling a
duplicated "05" at the
beginning of the frame
(for example, "05 05 64").

DNP Driver v4.0.39

 VERSION DATE AUTHOR COMMENTS
· Beta 16: Separated
processes for sending,
receiving, and checking.
· Beta 17: Sending process
now is synchronous with
application layer.
· Beta 18: Option to apply
a Local Time Zone to
events and syncing.
· Beta 19: Option to
discard out-of-order
events was applied
always.
· Beta 20: Statistics of
bytes sent and received.
· Beta 21: Performance
improvements when
using many Tags with
callbacks.
· Beta 22: Fixed the
handling of object 10
variation 1.
· Beta 23: Released
confirmation of
application messages
even without a Reset of
Remote Link, to allow
processing unsolicited
messages received right
after a connection.
· Beta 24: Added a Tag for
IIN indication (-22).
3.01 12/14/2009 M. Salvador · Fixed case 11020.
Connection was
considered inactive as
soon as it entered an
active state, due to an
internal error.
· Changed the DLL name to
DNPMaster.dll.
3.00 11/30/2009 M. Salvador · Implemented the Read
from Cache and Read
Events options, which
turns this Driver's
behavior similar to Driver
IEC 60870-101/104.
· Revised documentation.

DNP Driver v4.0.39

 VERSION DATE AUTHOR COMMENTS
2.29 11/30/2008 M. Salvador · Fixed syncing for more
than one slave on the
same link.
· Fixed the re-validation of
points after a connection
shut down.
· Fixed Block readings with
Float type.
· Fixed the message for
checking events (the
same class requested
more than once in the
same message).
· Fixed a race condition
among processes when in
Select.
· Starting option on Device
Restart.
· File collecting.
2.28 10/29/2006 M. Salvador · Independent reading and
writing retries.
· Single Block Events.
· Enabled unsolicited
messages when starting.
2.20 12/20/2005 M. Salvador · On or Off control for each
address.
· Active or Inactive control
for each address.
· Automatic Demotion
control.
2.19 10/11/2005 M. Salvador · Improvements in the
database update process.
· Event reading based on
class requests instead of
a clock-reading
command.
2.18 09/30/2005 M.Salvador · Internal integrity and
polling system.
· Fixed a freezing on
values.
2.17 06/24/2005 M.Salvador · Added support to device
Toshiba Regulator (Case
5768).
1.00 08/03/2004 M.Salvador · All publications previous
to revision control.

DNP Driver v4.0.39

Headquarters Taiwan
Rua 24 de Outubro, 353 - 10º andar 9F., No.12, Beiping 2nd St., Sanmin Dist.
90510-002 Porto Alegre 807 Kaohsiung City - Taiwan
Phone: (+55 51) 3346-4699 Phone: (+886 7) 323-8468
Fax: (+55 51) 3222-6226 Fax: (+886 7) 323-9656
E-mail: [email protected] E-mail: [email protected]

Check our website for information about a representative in your country.

www.elipse.com.br
kb.elipse.com.br
forum.elipse.com.br
www.youtube.com/elipsesoftware
[email protected]

Gartner, Cool Vendors in Brazil 2014, April 2014.

Gartner does not endorse any vendor, product or service depicted in its research
publications, and does not advise technology users to select only those vendors
with the highest ratings. Gartner research publications consist of the opinions of
Gartner’s research organization and should not be construed as statements of fact.
Gartner disclaims all warranties, expressed or implied, with respect to this research,
including any warranties of merchantability of fitness for a particular purpose.

Copyright © 1997-2019 Elipse Software Ltda. All rights reserved.