DNP3 Guide: Serveron® TM8 and TM3 On-Line Transformer Monitors 810-1651-09 Rev A

DNP3 Guide
TM TM
Serveron® TM8 and TM3
On-line Transformer Monitors
810-1651-09 rev A
September 2015
Serveron
20325 NW Von Neumann Dr Ste 120
Hillsboro OR 97006-0018
USA
Office: +1 800 880 2552

Fax: +1 503 924 3290
Technical Support: +1 866 273 7763, E-mail: support@serveron.com
http://www.serveron.com
Copyright © 2011-2015 Serveron Corporation, a Qualitrol company

All rights reserved
The following is a non-exclusive list of registered trademarks, registered service marks, or trademarks or service
marks of Serveron Corporation, a Qualitrol company, in the United States and/or other countries or jurisdictions:
LoadGuide, Serveron, TM8, TM3, TM View, and TrueGas.
All other trademarks, registered trademarks, service marks, and trade names are the property of their respective
owners.
810-1651-09 rev A DNP3 Guide
Table of Contents
Introduction .................................................................................................................................................. 5
DNP V3.0 Device Profile ................................................................................................................................ 6
DNP V3.0 Implementation Table ................................................................................................................... 9
Data Points List ............................................................................................................................................ 18
Binary Input Points .................................................................................................................................. 18
Double Bit Input Points ........................................................................................................................... 20
Binary Output Status Points and Control Relay Output Blocks ............................................................... 20
Counters .................................................................................................................................................. 20
Analog Inputs .......................................................................................................................................... 20
Analog Output Status Points and Analog Output Control Blocks ............................................................ 31
Octet Strings ............................................................................................................................................ 31
Virtual Terminal....................................................................................................................................... 31
Additional Information about File Transfer ............................................................................................. 32
Configuring DNP Communications .............................................................................................................. 33
DNP over Ethernet .................................................................................................................................. 34
DNP over TMCOM1 Direct Serial ............................................................................................................ 35
DNP over TMCOM1 with External Modem ............................................................................................. 36
DNP over TMCOM2 ................................................................................................................................. 37
DNP over Internal Modem ...................................................................................................................... 38
Other DNP Configuration ............................................................................................................................ 40
DNP Deadband Configuration Items ....................................................................................................... 40
DNP Default Variation 0 Modes .............................................................................................................. 41
Octet String Event Class........................................................................................................................... 41
Time Synchronization.............................................................................................................................. 42
Table of Tables
Table 1: DNP3 Device Profile ......................................................................................................................... 8
Table 2: DNP3 Implementation Table.......................................................................................................... 16
Table 5: Service Required Conditions Bit Map ............................................................................................ 25
Table 6: Run Abort Codes ............................................................................................................................ 26
Table 7: Run Record Status Fields ............................................................................................................... 27
Table 8: ppm Value Status Fields................................................................................................................. 28
Table 9: ROC Value Status Fields ................................................................................................................. 29
Table 10: ppm and ROC Alarm Status Fields ............................................................................................... 30
Table 11: Sensor Value Status Fields ........................................................................................................... 30
Table 12: Protocol Support by Interface...................................................................................................... 33
Table 13: DNP over Ethernet Configuration ................................................................................................ 35
Table 14: DNP over TMCOM1 Direct Serial Configuration .......................................................................... 36
Table 15: DNP over TMCOM1 with External Modem Configuration........................................................... 37
Table 16: DNP over TMCOM2 Configuration .............................................................................................. 38
© 2011-2015 Serveron Corporation, a Qualitrol company 3

Table 17: DNP over Internal Modem Configuration .................................................................................... 39

Table 18: DNP Deadband Configuration Items............................................................................................ 41

Introduction
This document describes specific configuration and interoperability information for the On-line
Transformer Monitor’s implementation of the Distributed Network Protocol (DNP), Version 3.0.
The monitor is fully compliant with DNP 3.0 Subset Definition Level 3.
The monitor must be configured for DNP operation. The Configuration chapter in this document provides
more details. Configuration is done using the Command Line Interface (CLI). The Firmware Command Set
document [810-1689] describes how to use the CLI.

DNP V3.0 Device Profile

The following table is the “Device Profile Document” as prescribed by the DNP 3.0 standard.
DNP V3.0
DEVICE PROFILE DOCUMENT
(Also see the DNP 3.0 Implementation Table beginning on page 9.)
Vendor Name: Serveron Corporation
Device Name: On-Line Transformer Monitor Model TMx
Highest DNP Level Supported: Device Function:
For Requests: Level 3  Master

For Responses: Level 3  Slave
Notable objects, functions, and/or qualifiers supported in addition to the Highest DNP Levels
Supported (the complete list is described in the attached table):
For static (non-change-event) object requests, request qualifier codes 07 and 08 (limited quantity),
and 17 and 28 (index) are supported. Static object requests sent with qualifiers 07, or 08, will be
responded with qualifiers 00 or 01.
16-bit, 32-bit and Floating Point Analog Change Events with Time may be requested.
Analog Input Deadbands, Object 34, variations 1 through 3, are supported.
Floating Point Analog Output Status and Output Block Objects 40 and 41 are supported.
Sequential file transfer, Object 70, variations 2 through 7, are supported.
Octet String and String Event Objects 110 and 111 are supported.
Virtual Terminal Output and Event Objects 112 and 113 are supported.
Device Attribute Object 0 is supported.
Data Set Objects 85-88 are supported.
Maximum Data Link Frame Size (octets): Maximum Application Fragment Size (octets):
Transmitted: 292 Transmitted: 2048

Received 292 Received 2048
Maximum Data Link Re-tries: Maximum Application Layer Re-tries:
 None  None
Fixed at 3  Configurable
 Configurable
Requires Data Link Layer Confirmation:
 Never
 Always
 Sometimes
 Configurable

Requires Application Layer Confirmation:
 Never
 Always
 When reporting Event Data (Slave devices only)
 When sending multi-fragment responses (Slave devices only)
 Sometimes
 Configurable
Timeouts while waiting for:
Data Link Confirm:  None  Fixed at 2 s  Variable  Configurable.

Complete Appl. Fragment:  None  Fixed at ____  Variable  Configurable
Application Confirm:  None  Fixed at 10 s  Variable  Configurable.
Complete Appl. Response:  None  Fixed at ____  Variable  Configurable
Others: Transmission Delay, 0 ms

Select/Operate Arm Timeout, 5 s
Need Time Interval, 30 minutes
Application File Timeout, 30 s
Unsolicited Notification Delay, 5 s
Unsolicited Response Retry Delay, 5 s
Unsolicited Offline Interval, 30 s
Binary Change Event Scan Period, 1 s
Double Bit Change Event Scan Period, never
Analog Change Event Scan Period, 1 s
Counter Change Event Scan Period, never
Frozen Counter Change Event Scan Period, never
String Change Event Scan Period, 1 s
Virtual Terminal Event Scan Period, 1 s
Sends/Executes Control Operations:
WRITE Binary Outputs  Never  Always  Sometimes  Configurable

SELECT/OPERATE  Never  Always  Sometimes  Configurable
DIRECT OPERATE  Never  Always  Sometimes  Configurable
DIRECT OPERATE – NO ACK  Never  Always  Sometimes  Configurable
Count > 1  Never  Always  Sometimes  Configurable

Pulse On  Never  Always  Sometimes  Configurable
Pulse Off  Never  Always  Sometimes  Configurable
Latch On  Never  Always  Sometimes  Configurable
Latch Off  Never  Always  Sometimes  Configurable
Queue  Never  Always  Sometimes  Configurable

Clear Queue  Never  Always  Sometimes  Configurable
Attach explanation if 'Sometimes' or 'Configurable' was checked for any operation.

Reports Binary Input Change Events when no Reports time-tagged Binary Input Change Events
specific variation requested: when no specific variation requested:
 Never  Never
 Only time-tagged  Binary Input Change With Time
 Only non-time-tagged  Binary Input Change With Relative
 Configurable Time
 Configurable
Sends Unsolicited Responses: Sends Static Data in Unsolicited Responses:
 Never  Never
 Configurable  When Device Restarts
 Only certain objects  When Status Flags Change
 Sometimes (attach explanation)
 ENABLE/DISABLE UNSOLICITED No other options are permitted.
Function codes supported
Default Counter Object/Variation: Counters Roll Over at:
 No Counters Reported  No Counters Reported

 Configurable  Configurable (attach explanation)
 Default Object  16 Bits
Default Variation:  32 Bits
 Point-by-point list attached  Other Value: _____
 Point-by-point list attached
Sends Multi-Fragment Responses:
Yes
 No
 Configurable
Sequential File Transfer Support:
Append File Mode  Yes No

Custom Status Code Strings Yes  No
Permissions Field  Yes No
File Events Assigned to Class  Yes No
File Events Send Immediately  Yes No
Multiple Blocks in a Fragment Yes  No
Max Number of Files Open 1
Table 1: DNP3 Device Profile

DNP V3.0 Implementation Table

The following table identifies which object variations, function codes, and qualifiers the monitor
supports in both request messages and in response messages. For static (non-change-event) objects,
requests sent with qualifiers 00, 01, 06, 07, or 08, will be responded with qualifiers 00 or 01. Requests
sent with qualifiers 17 or 28 will be responded with qualifiers 17 or 28. For change-event objects,
qualifiers 17 or 28 are always responded.
In the table below, shaded text indicates features beyond Subset Level 3.
REQUEST RESPONSE
OBJECT
(Library will parse) (Library will respond with)
Group Variation Function Codes Qualifier Codes Function Codes Qualifier Codes
Description
Number Number (dec) (hex) (dec) (hex)
0 1-253 Device Attribute Specific 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
06 (no range, or all) 17, 28 (index –
07, 08 (limited qty) see note 1)
17, 27, 28 (index)
2 (write) 00, 01 (start-stop)
0 254 Device Attribute - Non- 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Specific All Attributes 06 (no range, or all) 17, 28 (index –
Request 07, 08 (limited qty) see note 1)
17, 27, 28 (index)
0 255 Device Attribute – List of 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Attribute Variations 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
1 0 Binary Input – Any Variation 1 (read) 00, 01 (start-stop)
22 (assign class) 06 (no range, or all)
07, 08 (limited qty)
17, 27, 28 (index)
1 1 Binary Input 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
(default – 06 (no range, or all) 17, 28 (index –
see note 1) 07, 08 (limited qty) see note 2)
17, 27, 28 (index)
1 2 Binary Input with Status 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
2 0 Binary Input Change – Any 1 (read) 06 (no range, or all)
Variation 07, 08 (limited qty)
2 1 Binary Input Change 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
without Time 07, 08 (limited qty) 130 (unsol. resp)
2 2 Binary Input Change with 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
Time 07, 08 (limited qty) 130 (unsol. resp)
2 3 Binary Input Change with 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
(default – Relative Time 07, 08 (limited qty) 130 (unsol. resp)
see note 1)

REQUEST RESPONSE
OBJECT
Description
3 0 Double Bit Input – Any 1 (read) 00, 01 (start-stop)
Variation 22 (assign class 06 (no range, or all)
17, 27, 28 (index)
3 1 Double Bit Input 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
3 2 Double Bit Input with Status 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
4 0 Double Bit Input Change – 1 (read) 06 (no range, or all)
Any Variation 07, 08 (limited qty)
4 1 Double Bit Input Change 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index )
with Time 07, 08 (limited qty) 130 (unsol. resp)
(default – with Relative Time 07, 08 (limited qty) 130 (unsol. resp)
see note 1)
10 0 Binary Output Status – Any 1 (read) 00, 01 (start-stop)
Variation 06 (no range, or all)
17, 27, 28 (index)
10 1 Binary Output 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
10 2 Binary Output Status 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
12 1 Control Relay Output Block 3 (select) 17, 28 (index) 129 (response) echo of request
4 (operate)
5 (direct op)
6 (dir. op, noack)
12 2 Pattern Control Block 3 (select) 7 (limited qty) 129 (response) echo of request
4 (operate)
5 (direct op)
6 (dir. op, noack)
12 3 Pattern Mask 3 (select) 00, 01 (start-stop) 129 (response) echo of request
4 (operate)
5 (direct op)
6 (dir. op, noack)

REQUEST RESPONSE
OBJECT
Description
20 0 Binary Counter – Any 1 (read) 00, 01 (start-stop)
Variation 22 (assign class) 06 (no range, or all)
17, 27, 28 (index)
7 (freeze) 00, 01 (start-stop)
8 (freeze noack) 06 (no range, or all)
9 (freeze clear) 07, 08 (limited qty)
10 (frz. cl. noack)
20 1 32-Bit Binary Counter (with 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Flag) 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
20 2 16-Bit Binary Counter (with 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
20 5 32-Bit Binary Counter 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
(default – without Flag 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
20 6 16-Bit Binary Counter 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
without Flag 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
21 0 Frozen Counter – Any 1 (read) 00, 01 (start-stop)
17, 27, 28 (index)
21 1 32-Bit Frozen Counter (with 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
21 2 16-Bit Frozen Counter (with 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
21 5 32-Bit Frozen Counter with 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Time Of Freeze 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
21 6 16-Bit Frozen Counter with 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Time Of Freeze 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
21 9 32-Bit Frozen Counter 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
(default – without Flag 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
21 10 16-Bit Frozen Counter 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
without Flag 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)

REQUEST RESPONSE
OBJECT
Description
22 0 Counter Change Event – Any 1 (read) 06 (no range, or all)
22 1 32-Bit Counter Change 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
(default – Event without Time 07, 08 (limited qty) 130 (unsol. resp)
see note 1)
Event without Time 07, 08 (limited qty) 130 (unsol. resp)
Event with Time 07, 08 (limited qty) 130 (unsol. resp)
Event with Time 07, 08 (limited qty) 130 (unsol. resp)
23 0 Frozen Counter Event 1 (read) 06 (no range, or all)
(Variation 0 is used to 07, 08 (limited qty)
request default variation)
23 1 32-Bit Frozen Counter Event 1 (read) 06 (no range, or all) 129 (response) 17,28 (index)
(default – 07, 08 (limited qty) 130 (unsol. resp)
see note 1)
23 2 16-Bit Frozen Counter Event 1 (read) 06 (no range, or all) 129 (response) 17,28 (index)
07, 08 (limited qty) 130 (unsol. resp)
23 5 32-Bit Frozen Counter Event 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
23 6 16-Bit Frozen Counter Event 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
30 0 Analog Input - Any 1 (read) 00, 01 (start-stop)
17, 27, 28 (index)
30 1 32-Bit Analog Input 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
30 2 16-Bit Analog Input 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
30 3 32-Bit Analog Input without 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
(default – Flag 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
30 4 16-Bit Analog Input without 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Flag 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
30 5 short floating point 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
30 6 long floating point 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)

REQUEST RESPONSE
OBJECT
Description
32 0 Analog Change Event – Any 1 (read) 06 (no range, or all)
32 1 32-Bit Analog Change Event 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
(default – without Time 07, 08 (limited qty) 130 (unsol. resp)
see note 1)
32 5 short floating point Analog 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
Change Event without Time 07, 08 (limited qty) 130 (unsol. resp)
32 6 long floating point Analog 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
Change Event without Time 07, 08 (limited qty) 130 (unsol. resp)
32 7 short floating point Analog 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
Change Event with Time 07, 08 (limited qty) 130 (unsol. resp)
32 8 long floating point Analog 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
Change Event with Time 07, 08 (limited qty) 130 (unsol. resp)
34 0 Analog Input Deadband 1 (read) 00, 01 (start-stop)
(Variation 0 is used to 06 (no range, or all)
request default variation) 07, 08 (limited qty)
17, 27, 28 (index)
34 1 16 bit Analog Input 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Deadband 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
17, 27, 28 (index)
34 2 32 bit Analog Input 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
(default – Deadband 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
17, 27, 28 (index)
34 3 Short Floating Point Analog 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Input Deadband 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
17, 27, 28 (index)

REQUEST RESPONSE
OBJECT
Description
40 0 Analog Output Status 1 (read) 00, 01 (start-stop)
(Variation 0 is used to 06 (no range, or all)
request default variation) 07, 08 (limited qty)
17, 27, 28 (index)
40 1 32-Bit Analog Output Status 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
40 2 16-Bit Analog Output Status 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
17, 27, 28 (index)
40 3 short floating point Analog 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Output Status 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
40 4 long floating point Analog 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Output Status 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index)
41 1 32-Bit Analog Output Block 3 (select) 17, 28 (index) 129 (response) echo of request
4 (operate) 27 (index)
5 (direct op)
6 (dir. op, noack)
41 2 16-Bit Analog Output Block 3 (select) 17, 28 (index) 129 (response) echo of request
4 (operate) 27 (index)
5 (direct op)
6 (dir. op, noack)
41 3 short floating point Analog 3 (select) 17, 27, 28 (index) 129 (response) echo of request
Output Block 4 (operate)
5 (direct op)
6 (dir. op, noack)
41 4 long floating point Analog 3 (select) 17, 27, 28 (index) 129 (response) echo of request
Output Block 4 (operate)
5 (direct op)
6 (dir. op, noack)
50 0 Time and Date
50 1 Time and Date 1 (read) 07, (limited qty = 129 (response) 07 (limited qty =
(default – 1) 1)
see note 1) 2 (write) 07 (limited qty = 1)
50 3 Time and Date Last 2 (write) 07 (limited qty)
Recorded Time
51 1 Time and Date CTO 129 (response) 07 (limited qty)
130 (unsol. resp) (qty = 1)
51 2 Unsynchronized Time and 129 (response) 07 (limited qty)
Date CTO 130 (unsol. resp) (qty = 1)
52 1 Time Delay Coarse 129 (response) 07 (limited qty)
(qty = 1)
52 2 Time Delay Fine 129 (response) 07 (limited qty)
(qty = 1)

REQUEST RESPONSE
OBJECT
Description
60 0 Not Defined
60 1 Class 0 Data 1 (read) 06 (no range, or all)
20 (enbl. unsol.) 06 (no range, or all)
21 (dab. unsol.)
22 (assign class)
21 (dab. unsol.)
22 (assign class)
21 (dab. unsol.)
22 (assign class)
70 0 File Event – Any Variation 1 (read) 06 (no range, or all)
22 (assign class) 06 (no range, or all)
70 2 File Authentication 29 (authenticate) 5b (free-format) 129 (response) 5B (free-format)

70 3 File Command 25 (open) 5b (free-format)
27 (delete)
70 4 File Command Status 26 (close) 5b (free-format) 129 (response) 5B (free-format)
30 (abort) 130 (unsol. resp)
70 5 File Transfer 1 (read) 5b (free-format) 129 (response) 5B (free-format)
2 (write) 130 (unsol. resp)
70 6 File Transfer Status 129 (response) 5B (free-format)
130 (unsol. resp)
70 7 File Descriptor 28 (get file info) 5b (free-format) 129 (response) 5B (free-format)
130 (unsol. resp)
80 1 Internal Indications 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
2 (write) 00 (start-stop)
(see note 3) index=7
85 0 Data Set Prototype 1 (read) 00, 01 (start-stop)
06 (no range, or all)
17, 27, 28 (index
85 1 Data Set Prototype 1 (read) 00, 01 (start-stop) 129 (response) 5B (free-format)
17, 27, 28 (index
2 (write) 5b (free-format)

REQUEST RESPONSE
OBJECT
Description
86 0 Data Set Descriptor 22 (assign class) 00, 01 (start-stop)
17, 27, 28 (index
86 1 Data Set Descriptor - 1 (read) 00, 01 (start-stop) 129 (response) 5B (free-format)
Contents 06 (no range, or all)
17, 27, 28 (index
86 2 Data Set Descriptor – 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
Characteristics 06 (no range, or all) 17, 28 (index –
17, 27, 28 (index
86 3 Data Set Descriptor – Point 1 (read) 00, 01 (start-stop) 129 (response) 5B (free-format)
Index Attributes 06 (no range, or all)
17, 27, 28 (index
87 0 Data Set – Present Value 1 (read) 00, 01 (start-stop)
17, 27, 28 (index
87 1 Data Set – Present Value 1 (read) 00, 01 (start-stop) 129 (response) 5B (free-format)
17, 27, 28 (index
88 0 Data Set Event 1 (read) 06 (no range, or all)
88 1 Data Set Event - Snapshot 1 (read) 06 (no range, or all) 129 (response) 5B (free-format)
07, 08 (limited qty) 130 (unsol. resp)
110 string Octet String Object 1 (read) 00, 01 (start-stop) 129 (response) 00, 01 (start-stop)
length 22 (assign class) 06 (no range, or all)
17, 27, 28 (index
17, 27, 28 (index)
111 string Octet String Event Object 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
length 07, 08 (limited qty) 130 (unsol. resp)
112 string Virtual Terminal Output 2 (write) 00, 01 (start-stop)
length Block 07, 08 (limited qty)
17, 27, 28 (index)
113 string Virtual Terminal Event Data 1 (read) 06 (no range, or all) 129 (response) 17, 28 (index)
length 07, 08 (limited qty) 130 (unsol. resp)
No Object (function code only) 13 (cold restart)
No Object (function code only) 14 (warm restart)
No Object (function code only) 23 (delay meas.)
No Object (function code only) 24 (record current
time)
Table 2: DNP3 Implementation Table

Note 1: A Default variation refers to the variation responded when variation 0 is requested – this
includes class 0, 1, 2, or 3 scans. Default variations are configurable; however, default settings for the
configuration parameters are indicated in the table above.
Note 2: For static (non-change-event) objects, qualifiers 17 or 28 are only responded when a request is
sent with qualifiers 17 or 28, respectively. Otherwise, static object requests sent with qualifiers 00, 01,
06, 07, or 08, will be responded with qualifiers 00 or 01. (For change-event objects, qualifiers 17 or 28
are always responded.)
Note 3: Writes of Internal Indications are only supported for index 7 (Restart IIN1-7)

Data Points List

The tables below identify all data points provided by the monitor.
Binary Input Points

The default binary input event buffer size is set to allow 10 events.
NOTE: Only point 0 was supported in firmware versions previous to 3.8.
Binary Input Points
Static (Steady-State) Object Number: 1
Change Event Object Number: 2
Static Variation reported when variation 0 requested: 1 (Binary Input 2 without status)
Change Event Variation reported when variation 0 requested: 3 (Binary Input Change with Relative
Time)
Default Class
Assigned to
Point
Name/Description Events
Index
(1, 2, 3 or
none)
0 general service required indicator 2
1 service required, persistent communication failure 2
2 service required, persistent analysis run failure 2
3 service required, helium tank empty 2
4 service required, calibration tank empty 2
5 service required, extractor oil-side shutdown 2
6 service required, rotary valve fault 2
7 service required, heater shutdown 2
8 service required, helium low pressure switch active 2
9 service required, calibration gas certification date expired 2
10 service required, enclosure fan stalled 2
11 service required, system board ADC voltage reference out of range 2
12 service required, analog board ADC voltage reference out of range 2
13 service required, 24 Volt supply out of range 2
14 service required, 5 Volt Supply out of range 2
15 service required, system board analog 5 Volt out of range 2
16 service required, 6.8 Volt supply out of range 2
18 service required, analog board analog 5 Volt out of range 2
20 service required, system board DAC output voltage out of range 2
21 service required, analog board DAC output voltage out of range 2
22 service required, sample schedule disabled 2
23 service required, persistent oil over/under temperature 2
24 service required, persistent oil over pressure 2
25 service required, persistent oil sampling failure 2

Binary Input Points

Time)
Default Class
Assigned to
Point
Index
(1, 2, 3 or
none)
26 service required, gases not calibrated 2
27 service required, extractor gas-side shutdown 2
28 service required, persistent oil path restriction 2
29 service required, extractor oil purge over pressure 2
30 service required, extractor gas blowout stopped, EPC pressure low 2
31 reserved
32 CO2 (carbon dioxide) alarm 2
33 C2H4 (ethylene) alarm 2
34 C2H2 (acetylene) alarm 2
35 C2H6 (ethane) alarm 2
36 H2 (hydrogen) alarm 2
37 O2 (oxygen) alarm 2
38 CH4 (methane) alarm 2
39 CO (carbon monoxide) alarm 2
40 reserved 2
41 TDCG (total dissolved combustible gas) alarm 2
42 CO2 (carbon dioxide) rate-of-change alarm 2
43 C2H4 (ethylene) rate-of-change alarm 2
44 C2H2 (acetylene) rate-of-change alarm 2
45 C2H6 (ethane) rate-of-change alarm 2
46 H2 (hydrogen) rate-of-change alarm 2
47 O2 (oxygen) rate-of-change alarm 2
48 CH4 (methane) rate-of-change alarm 2
49 CO (carbon monoxide) rate-of-change alarm 2
50 reserved 2
51 TDCG (total dissolved combustible gas) rate-of-change alarm 2
52 CO2 (carbon dioxide) caution 2
53 C2H4 (ethylene) caution 2
54 C2H2 (acetylene) caution 2
55 C2H6 (ethane) caution 2
56 H2 (hydrogen) caution 2
57 O2 (oxygen) caution 2
58 CH4 (methane) caution 2
59 CO (carbon monoxide) caution 2

Binary Input Points

Time)
Default Class
Assigned to
Point
Index
(1, 2, 3 or
none)
60 reserved 2
61 TDCG (total dissolved combustible gas) caution 2
62 CO2 (carbon dioxide) rate-of-change caution 2
63 C2H4 (ethylene) rate-of-change caution 2
64 C2H2 (acetylene) rate-of-change caution 2
65 C2H6 (ethane) rate-of-change caution 2
66 H2 (hydrogen) rate-of-change caution 2
67 O2 (oxygen) rate-of-change caution 2
68 CH4 (methane) rate-of-change caution 2
69 CO (carbon monoxide) rate-of-change caution 2
70 reserved 2
71 TDCG (total dissolved combustible gas) rate-of-change caution 2
Table 3: Binary Input Points
Double Bit Input Points

None
Binary Output Status Points and Control Relay Output Blocks

None
Counters
None
Analog Inputs
The following table lists Analog Inputs (Object 30). It is important to note that 16-bit and 32-bit
variations of Analog Inputs, Analog Output Control Blocks, and Analog Output Statuses are transmitted
through DNP as signed numbers.
The “Default Deadband,” and the “Default Change Event Assigned Class” columns are used to represent
the absolute amount by which the point must change before an analog change event will be generated,
and once generated in which class poll (1, 2, 3, or none) will the change event be reported.
The default analog input event buffer size is set 30.

Analog Inputs
1
Static Variation reported when variation 0 requested : 3 (32-bit without flag) or a mix of 3 and 5
(single-precision floating-point with flag)
1
Change Event Variation reported when variation 0 requested : 1 (32-Bit without time) or a mix of 1
and 5 (single-precision floating-point without time)
Default
Point Change Event
Name/Description Default
Index Assigned Class
Deadband
(1, 2, 3 or none)
0 Service codes if service required indicator is on 0 3
1 CO2 ppm 0 3
2 C2H4 ppm 0 3
3 C2H2 ppm 0 3
4 C2H6 ppm 0 3
5 H2 ppm 0 3
6 O2 ppm 0 3
7 CH4 ppm 0 3
8 CO ppm 0 3
9 reserved 0 3
10 Total Dissolved Combustible Gas ppm 0 3
11 nitrogen ppm 0 3
12 CO2 verification gas ppm 0 3
13 C2H4 verification gas ppm 0 3
16 H2 verification gas ppm 0 3
17 O2 verification gas ppm 0 3
18 CH4 verification gas ppm 0 3
19 CO verification gas ppm 0 3
20 reserved 0 3
21 ambient temperature, °C 2 1 3
22 LoadGuide percent 2 1 3
23 auxiliary 4-20 mA channel 1 2 1 3
2
24 auxiliary 4-20 mA channel 2 1 3
25 auxiliary 4-20 mA channel 3 2 1 3
26 moisture ppm 2 1 3
27 load current 2 1 3
28 reserved 0 3
29 reserved 0 3
30 reserved 0 3
31 reserved 0 3
32 reserved 0 3
33 CO2 ROC 0 3
34 C2H4 ROC 0 3
1
Configuration item dnp.defvar changes the mode of operation. See section DNP Default Variation 0 Modes on page 43.
2
Analog input point is updated frequently. Point has associated deadband configuration item.

35 C2H2 ROC 0 3
36 C2H6 ROC 0 3
37 H2 ROC 0 3
38 O2 ROC 0 3
39 CH4 ROC 0 3
40 CO ROC 0 3
41 reserved 0 3
42 Total Dissolved Combustible Gas ROC 0 3
43 CO2 ROC GOF 0 3
44 C2H4 ROC GOF 0 3
45 C2H2 ROC GOF 0 3
46 C2H6 ROC GOF 0 3
47 H2 ROC GOF 0 3
48 O2 ROC GOF 0 3
49 CH4 ROC GOF 0 3
50 CO ROC GOF 0 3
51 reserved 0 3
52 Total Dissolved Combustible Gas ROC GOF 0 3
53 CO2 Alarm ppm 0 3
54 C2H4 Alarm ppm 0 3
57 H2 Alarm ppm 0 3
58 O2 Alarm ppm 0 3
59 CH4 Alarm ppm 0 3
60 CO Alarm ppm 0 3
61 reserved 0 3
62 Total Dissolved Combustible Gas Alarm ppm 0 3
63 CO2 ROC Alarm ppm/day 0 3
64 C2H4 ROC Alarm ppm/day 0 3
67 H2 ROC Alarm ppm/day 0 3
68 O2 ROC Alarm ppm/day 0 3
69 CH4 ROC Alarm ppm/day 0 3
70 CO ROC Alarm ppm/day 0 3
71 reserved 0 3
72 Total Dissolved Combustible Gas ROC Alarm ppm/day 0 3
73 CO2 Caution ppm 0 3
74 C2H4 Caution ppm 0 3
77 H2 Caution ppm 0 3
78 O2 Caution ppm 0 3
79 CH4 Caution ppm 0 3
80 CO Caution ppm 0 3
81 reserved 0 3
82 Total Dissolved Combustible Gas Caution ppm 0 3
83 CO2 ROC Caution ppm/day 0 3

84 C2H4 ROC Caution ppm/day 0 3

87 H2 ROC Caution ppm/day 0 3
88 O2 ROC Caution ppm/day 0 3
89 CH4 ROC Caution ppm/day 0 3
90 CO ROC Caution ppm/day 0 3
91 reserved 0 3
92 Total Dissolved Combustible Gas ROC Caution ppm/day 0 3
93 reserved 0 3
94 Sample run ID 0 3
95 Sample run timestamp 0 3
96 Sample run abort code 0 3
97 Sample run record status 0 3
98 Sample ppm value status 0 3
99 Sample ROC value status 0 3
100 Sample ppm alarm status 0 3
101 Sample ROC alarm status 0 3
102 Verification run ID 0 3
103 Verification run timestamp 0 3
104 Verification run abort code 0 3
105 Verification run record status 0 3
106 Verification run ppm value status 0 3
107 Sample run, sensor value status 0 3
108 Sample run, ambient temperature, °C 0 3
109 Sample run, LoadGuide percent 0 3
110 Sample run, auxiliary 4-20 mA channel 1 0 3
113 Sample run, moisture ppm 0 3
114 Sample run, load current 0 3
115 reserved 0 3
116 reserved 0 3
117 reserved 0 3
118 Sample run, winding temperature 1, °C 0 3
126 winding temperature 1, °C 2 1 3


2
132 winding temperature 7, °C 1 3
Table 4: Analog Inputs

The values for some gases may not be reported depending upon the specific monitor model.
Analog input registers 1 - 11 will be set to all 0s with “offline” flag turned on if a sample run is aborted.
These registers will also read all 0s with “offline” flag turned on following a system restart and no sample
run has completed successfully in the latest 24 hours. Analog input registers 12 – 19 will be set to all 0s
with “offline” flag turned on if a verification/calibration run is aborted. These registers will also read all
0s with “offline” flag turned on following a system restart, until a successful verification/calibration run is
completed. Analog input registers 33 – 40, 42 – 50, and 52 will be set to all 0s with “offline” flag turned
on until sufficient sample runs have been completed to allow “Rate of Change (ROC)” calculations.
Analog input registers 53 – 60, 62 – 70, 72 – 80, 82 – 90, and 92 will be set to 0s with “offline” flag turned
on if neither the caution or alarm values are configured.
The bits in the Service LED code input register 0, correspond to service required conditions. The service
required conditions are also available as Binary Input Points. When a bit is 1, the corresponding
condition is active; when a bit is 0 the condition is inactive. (Unused bits in the input registers have the
value 0.) Multiple service required conditions can be active at the same time.
Point 0 Service Required Condition
(Hexadecimal)
00000001h reserved, the bit value is always 0

00000002h persistent communication failure
00000004h persistent analysis run failure
00000008h helium tank empty
00000010h calibration tank empty
00000020h extractor oil-side shutdown
00000040h rotary valve fault
00000080h heater shutdown
00000100h helium low pressure switch active
00000200h calibration gas certification date expired
00000400h enclosure fan stalled
00000800h system board ADC voltage reference out of range
00001000h analog board ADC voltage reference out of range
00002000h 24 Volt supply out of range
00008000h system board analog 5 Volt out of range
00010000h 6.8 Volt supply out of range
00040000h analog board analog 5 Volt out of range


00100000h system board DAC output voltage out of range
00200000h analog board DAC output voltage out of range
00400000h sample schedule disabled
00800000h persistent oil over/under temperature
01000000h persistent oil over pressure
02000000h persistent oil sampling failure
04000000h gases not calibrated
08000000h extractor gas-side shutdown
10000000h persistent oil path restriction
20000000h extractor oil purge over pressure
40000000h extractor gas blowout stopped, EPC pressure low
Table 5: Service Required Conditions Bit Map

Points 1-11, 33-52, 94-101 and 107-125 are updated with each sample GC analysis run. When a sample
GC analysis run completes, all of these points are updated. The sample run ID, point 94, is the last item
to be updated. So if a change in run ID is seen then the other points are known to be synchronized for
that run. (This assumes the DNP master is polling fast enough. For normal cases when runs are not
aborted, the minimum time between runs is 1 hour. For some atypical error situations, the time between
one update and the next could be about 15 minutes.)
Points 12-20 and 102-106 are updated with each verification GC analysis run. When a verification GC
analysis run completes, all of these points are updated. The verification run ID, point 102, is the last item
to be updated. So if a change in run ID is seen then the other points are known to be synchronized for
that run.
The run timestamps, point 95 and point 103, indicate the number of seconds since midnight January 1,
1970 UTC. The two run timestamps are also presented as octet strings — point 3 and point 4.
Points 97 and 105 are the sample run record status and verification run record status respectively. Each
point’s value contains multiple fields indicating various status for the newest completed run.
Each external sensor is associated with two analog input points – one from each of two sets of analog
input points. The first set is points { 21-27, 126-133 } and points in this set are updated frequently –
approximately every 10 seconds. The second set is points { 108-114, 118-125 } and points in this set are
updated only at the start of each sample GC analysis run.
The abort reason code field in the run record status, point 97 and point 105, is a 4-bit truncated abort
reason code. There are also full-width abort reason codes which can be read in points 96 and 104 for
sample and verification run types respectively. If the full-width abort reason code is greater than 15, the
truncated reason code field will contain the value 15; so checking either the full-width or truncated abort
codes being non-zero are both valid methods to test if a run was aborted.

abort code description
0 run not aborted
1 monitor not ready to start run
2 run stopped by operator
3 rotary value fault
4 helium carrier gas pressure low
5 calibration gas pressure low
6 gas extraction subsystem fault
7 carrier gas pressure control fault
8 hot zone temperature unstable when run was started
9 TCD unstable or too noisy
10 run aborted for “other” reason
11 hot zone temperature drifted too far after run was started
12 oil sampling failure due to oil temperature outside operation range
13 oil sampling failure due to oil over-pressure
14 oil sampling failure, gas extraction time was too short
15 abort code expansion indication, abort reason code is greater than 15, (this will only be
seen in the truncated abort reason code field in the Run Record Status)
16 oil path restriction
17 gas extraction not yet equilibrated
18 sample gas over pressure
19+ other abort reason codes
Table 6: Run Abort Codes

field indicator
(hexadecimal) field description
0xE0000000h 3-bit run record type; (value should be ignored)
0x18000000h 2-bit type code; 0 = sample run, 1 = verification run, 2 = calibration run
0x04000000h boolean; 0 = run not aborted, 1 = run was aborted
0x03C00000h 4-bit abort code; 0 = run not aborted, non-zero values indicate specific abort reasons
0x00300000h 2-bit helium pressure status; 0 = normal, 1= pressure low, 2 = pressure high
0x000C0000h 2-bit code calibration gas pressure status; 0 = normal, 1 = pressure low, 2 = pressure high
0x00020000h boolean; 0 = EPC2 pressure normal, 1 = EPC2 pressure out-of-range
0x00010000h boolean; 0 = EPC1 pressure normal, 1 = EPC1 pressure out-of-range
0x00008000h boolean; 0 = extractor information is valid, 1 = extractor information is invalid
0x00004000h boolean; 0 = gas pressure equilibration normal, 1 = gas pressure not equilibrated (gas
sample invalid); this is 0 for verification and calibration runs
0x00003000h 2-bit oil temperature status; 0 = normal, 1 = oil below minimum temperature, 2 = oil
above maximum temperature; this is 0 for verification and calibration runs
0x00000800h boolean; 0 = oil pressure not above maximum, 1 = oil pressure above maximum;
this is 0 for verification and calibration runs
0x000007FCh reserved
0x00000002h boolean; 0 = TCD noise information invalid, 1 = TCD noise information is valid
0x00000001h boolean; 0 = not first sample run since start-up, 1 = first sample run since start-up
0x07C07800h run exception status indicators; for successful non-exceptional runs these bits are all zero;
if any of these bits are non-zero then the run did not complete and/or the results should be
treated with suspicion
Table 7: Run Record Status Fields

ppm Value Status Fields

field indicator
(hexadecimal) gas 2-bit field code
0xC0000000h carbon dioxide, CO2
0x30000000h ethylene, C2H4
0x0C000000h acetylene, C2H2
0x03000000h ethane, C2H6
0x00C00000h hydrogen, H2 0 = ppm value status normal
0x00300000h oxygen, O2 2 = marginal gas detection at a ppm level below

the monitor’s lower detection limit; reported value
0x000C0000h methane, CH4 is 0 ppm
0x00030000h carbon monoxide, CO 3 = gas is undetectable by monitor type
0x0000C000h propane, C3H8
0x00003000h reserved (ignore)
0x00000C00h nitrogen, N2
0x000003FFh reserved (ignore)
Table 8: ppm Value Status Fields

ROC (rate-of-change) Value Status Fields
field indicator
(hexadecimal) gas encoding
0x80000000h carbon dioxide, CO2
0x20000000h acetylene, C2H2
0x08000000h hydrogen, H2 0 = ROC value valid
0x04000000h oxygen, O2 1 = ROC value invalid
0x02000000h methane, CH4
0x01000000h carbon monoxide, CO
0x00800000h propane, C3H8
0x00400000h TDCG
0x003F0000h reserved
0x00008000h carbon dioxide, CO2
0x00000800h hydrogen, H2 0 = ROC detection enabled
0x00000400h oxygen, O2 1 = ROC detection disabled
0x00000080h propane, C3H8
0x00000040h TDCG
0x0000003Fh reserved
Table 9: ROC Value Status Fields

ppm and ROC Alarm Status Fields
field indicator gas 3-bit alarm status code

(hexadecimal)
0xE0000000h carbon dioxide, CO2
0x1C000000h ethylene, C2H4

0 = undetermined
1 = OK, not caution and not alarm
0x000E0000h hydrogen, H2 2 = caution
0x0001C000h oxygen, O2 3 = alarm
6 = gas undetectable by monitor type

7 = alarm check administratively disabled
0x000000E0h propane, C3H8
0x0000001Ch TDCG
0x00000003h reserved
Table 10: ppm and ROC Alarm Status Fields
field indicator Sensor Value Status Fields

(hexadecimal)
0xFFF00000h reserved
0x00080000h boolean; 1 = Point 108 ambient temperature invalid, 0 = valid
0x00040000h boolean; 1 = Point 109 LoadGuide percent invalid, 0 = valid
0x00020000h boolean; 1 = Point 110 auxiliary 4-20 mA channel 3 invalid, 0 = valid
0x00004000h reserved
0x00002000h boolean; 1 = Point 113 moisture ppm invalid, 0 = valid
0x00001FFFh reserved
Table 11: Sensor Value Status Fields

Analog Output Status Points and Analog Output Control Blocks

None
Octet Strings
The default string event buffer size is set to allow 10 events.
Octet Strings
Static Variation reported when variation 0 requested: all (variation specifies length of string)
Change Event Variation reported when variation 0 requested: all (variation specifies length of
string)
Default
Change Event
Point Assigned
Name/Description
Index Class
(1, 2, 3 or
none)
0 Analyzer serial number (TM3 and TM8) configurable3
1 Firmware boot-kernel version (TM3 and TM8) configurable3
2 Firmware application version (TM3 and TM8) configurable3
3 Sample run timestamp text configurable3
4 Verification run timestamp text configurable3
The run timestamps, point 3 and point 4, are the timestamps for the latest completed sample and
verification GC analysis runs respectively. The timestamp form is “yyyy-mm-dd HH:MM:SS” and the time
zone is UTC. An example timestamp octet string is
“2011-06-21 17:00:00”.
Virtual Terminal
The default virtual terminal buffer size is set to allow 10 events.
Virtual Terminal
Static Variation reported when variation 0 requested: all (variation specifies length of user data)
Change Event Variation reported when variation 0 requested: all (variation specifies length of user
data)
Default
Change Event
Point Assigned
Name/Description
Index Class
(1, 2, 3 or
none)
0 Virtual Terminal Session 3
3
Determined by the configuration item dnp.octetstring_class. See section Octet String Event Class on page 42.

Additional Information about File Transfer

Starting from version 2.2.1 of the firmware, the monitor supports file write for firmware update only. In
version 3.8, this was enhanced to allow general file read, writes, and directory listings. File names are
case sensitive. Authentication is required in order to transfer files. The user name can be any non-
empty string except “Serveron”. The password defaults to “Password”, but can be changed from the
Command Line Interface. The password is case sensitive. See the document Firmware Command Set
[810-1689-04] for more information about upgrading the firmware.

Configuring DNP Communications

The monitor has many physical communication interfaces. The DNP protocol can be used over most but
not all of these interfaces. The monitor must be configured to operate the DNP protocol over any of the
interfaces.
Configuration is done using the Command Line Interface. The Firmware Command Set document
describes how to use this interface. The commands used for configuration are: config, nc and reboot.
Refer to the command set document on how to use the command line interface and these commands.
Interface Supported Protocols Comments
any combination of:

none or one of DNP or Modbus or IEC 61850
Ethernet
and Serveron SMS protocol
and CLI
one of:
TMCOM1 direct DNP
serial or Modbus
or CLI
one of:
Configuring
TMCOM1 with DNP
DNP3 or Modbus
external modem or Modbus
or IEC 61850 for
or Serveron SMS protocol and CLI
use over an
one of: interface
DNP excludes DNP3
TMCOM2 RS-232
or Modbus and Modbus and
or CLI IEC 61850 use
over any other
one of:
interface
DNP
TMCOM2 RS-485
or Modbus
or CLI (not multiplexed)
one of:
DNP
Internal modem
or Modbus
or Serveron SMS protocol and CLI
Service serial
CLI only
port
Table 12: Protocol Support by Interface

Note that the “or” conditions in the table above are exclusive. In these cases, at any one time only one of
the protocols is supported based upon configuration. So, in some cases, using the DNP3 protocol on an
interface will prevent the use of other protocols on that interface. For example, if the DNP3 protocol is
configured for use over the internal modem then neither the Serveron SMS protocol nor CLI can be used
over the internal modem.
Note: the Serveron SMS protocol is used for communication between the monitor and the Serveron
Monitoring Service (SMS) servers. If you are an SMS subscriber and also using DNP, you may need to use
separate interfaces for each protocol.
Below are configuration tables describing how to set-up the monitor for running DNP over the various
interfaces. Many of the communication related configuration items require that the monitor be restarted
before changes to the items are recognized. These items are marked with an [R] in the configuration
tables.
DNP over Ethernet

The Command Line Interface’s NC command can be used to view and change the IP configuration. See
the Firmware Command Set document on how to use the NC command to configure the IP interface.
Both TCP and UDP are supported for DNP, but not simultaneously. There is no support of TCP Dual End
Point. The table below shows the configuration for running DNP over IP/Ethernet networks.
configuration item settings
[R]
scada.protocol “DNP”
[R]
scada.interface “TCPIP” or “UDP”
This parameter specifies the IP address of the DNP master.
When this parameter is set to an IP address other than 0.0.0.0,
only the master with the specified IP address can access the
scada.master_ip
slave. If this is 0.0.0.0, the master’s IP address is not restricted.
Also, when DNP is is run over UDP, this parameter is used to
send the initial unsolicited null response. Default value: 0.0.0.0.
Number of seconds after which the slave will close the TCP
connection if no input was received from the master. The value
0 disables this timeout. Default value is 0. Range: 0 to 86400
scada.tcp_timeout seconds.
NOTE: if timeouts are disabled and an established TCP
connection is broken without properly closing the connection,
the monitor must be rebooted to re-establish a connection.
[R] DNP destination address for unsolicited messages sent by the
dnp.dst_addr
analyzer. Default value is 3. Range: 0 to 65534.
[R] Monitor’s DNP slave address. Default value is 4. Range: 0 to
dnp.src_addr
65534.

If “true” then unsolicited messages can be sent by the monitor.

Default value is “false”. Allowed values: “true” or “false”.
[R]
dnp.unsol_enabled Note that even if this parameter is set to “true”, the DNP
master can still use function code 21 to disable unsolicited
messages.
If dnp.dest_udp_use_src is set to false, this is the
destination UDP port for all DNP responses. If
dnp.dest_udp_port dnp.dest_udp_use_src is set to true, this is the destination
UDP port for the initial unsolicited null response. Default value
is 20000. Range: 1 to 65535.
If set to true, the slave will use the source UDP port number
from DNP requests as the destination UDP port number in all
DNP responses, except for the initial unsolicited null response,
dnp.dest_udp_use_src where the destination UDP port number will be set to
dnp.dest_udp_port. If this parameter is set to false, the
slave will always set the destination UDP port number to
dnp.dest_udp_port in all responses. Default value is false.
UDP port number used by the monitor to listen for incoming

[R]
dnp.local_udp_port datagrams. This parameter is used only if scada.interface
is set to “UDP”. Default value is 20000. Range: 1 to 65535.
TCP port number for DNP over TCP/IP. This parameter is used
[R]
dnp.tcp_port only if scada.interface is set to “TCPIP”. Default value is
20000. Range: 1 to 65535.
Table 13: DNP over Ethernet Configuration
DNP over TMCOM1 Direct Serial

The table below shows the configuration items related to running DNP directly over a serial line attached
to TMCOM1. Directly means there is no modem.
[R]
[R]
scada.interface * “TMCOM1”
[R]
EXTERNAL_MODEM.ENABLE * “false”
[R]
CLI_OVER_TMCOM1.ENABLE * “false”
[R]
WINDING_TEMP.PORT * “none” (or any other allowed value that is not “TMCOM1”)
dnp.dst_addr


dnp.src_addr
65534.
[R]
messages.
TMCOM1.BAUD_RATE
[R] TMCOM1 port baud. Default value is 115200. Allowed values
are: 115200, 57600, 38400, 19200, 9600, 4800, 2400 and 1200.
[R] TMCOM1 port data bit count. Default value is 8. Range: 7 or 8
TMCOM1.DATA_BITS
bits.
[R] TMCOM1 flow control mode. Default value is “HARDWARE”.

TMCOM1.FLOW_CTRL
Allowed values are: “HARDWARE” or “NONE”.
[R] TMCOM1 parity bit mode. Default value is “NONE”. Allowed
TMCOM1.PARITY
values are: “NONE”, “ODD” or “EVEN”.
[R] TMCOM1 stop bit count. Default value is 1. Allowed values are:
TMCOM1.STOP_BITS
1 or 2 bits.
Table 14: DNP over TMCOM1 Direct Serial Configuration

The four configuration items marked with an asterisk (*) define which protocol is enabled on the
TMCOM1 interface. Only one of them can be set to a value that gives the protocol it refers to control
over the TMCOM1 interface
DNP over TMCOM1 with External Modem

The table below shows the configuration items related to running DNP over the TMCOM1 port with an
external modem connected to the port. In this case, the monitor will accept incoming calls and run the
DNP protocol as a slave. The monitor will not dial out for DNP.
[R]
[R]
scada.interface * “EXTERNAL_MODEM”
[R]
EXTERNAL_MODEM.ENABLE * “true”
[R]
[R]
WINDING_TEMP.PORT * “NONE” (or any other allowed value that is not “TMCOM1”)
dnp.dst_addr
dnp.src_addr
65534.


[R]
messages.
TMCOM1 port baud rate. Default value is 115200. Allowed
[R]
TMCOM1.BAUD_RATE values: 115200, 57600, 38400, 19200, 9600, 4800, 2400 and
1200.
TMCOM1.DATA_BITS
bits.
[R] TMCOM1 flow control mode. Default value is “HARDWARE”.

TMCOM1.FLOW_CTRL
Allowed values: “HARDWARE” or “NONE”.
TMCOM1.PARITY
values: “NONE”, “ODD” or “EVEN”.
[R]
TMCOM1.STOP_BITS TMCOM1 stop bit count. Default value is 1. Range: 1 or 2 bits.
First AT command string to be sent to the external modem at
EXTERNAL_MODEM.INITSTRING0 system startup to initialize the modem. One to three strings can
[R]
be sent. The first string, string 0, cannot be empty. At minimum,
“AT” should be specified. Default value: “ATZ”.
Second AT command string to be sent to the external modem at
EXTERNAL_MODEM.INITSTRING1
[R] system startup to initialize the modem. This string can be
empty. Default value: “ATS0=1”.
Third AT command string to be sent to the external modem at
EXTERNAL_MODEM.INITSTRING2
empty. Default value: “” (empty string.)
Table 15: DNP over TMCOM1 with External Modem Configuration

The four configuration items marked with an asterisk (*) define which protocol is enabled on the
over the TMCOM1 interface. To run DNP, use one of the following combinations:
DNP over TMCOM2

The TMCOM2 port can be configured for full duplex or half duplex operation in RS-485 mode. Full duplex
operation is essentially RS-422.
The table below shows the configuration items related to running DNP over the TMCOM2 port.
[R]
[R]
scada.interface * “TMCOM2”

[R]
[R]
WINDING_TEMP.PORT * “none” (or any other allowed value that is not “TMCOM2”)
dnp.dst_addr
dnp.src_addr
65534.
[R]
messages.
[R] TMCOM2 port baud rate. Default value is 9600. Allowed values:
TMCOM2.BAUD_RATE
115200, 57600, 38400, 19200, 9600, 4800, 2400 and 1200.
TMCOM2.DATA_BITS
bits.
Selects full duplex or half duplex mode for the TMCOM2 port
when it is configured as RS-485. This parameter is not used
[R] when the port is configured as RS-232. Full duplex means it is
TMCOM2.DUPLEX
really an RS-422 interface. Half duplex is true RS-485 and is
typically used in multi-drop configurations. Default value is
“HALF”. Allowed value: “FULL” or “HALF”.
TMCOM2.PARITY
value: “NONE”, “ODD” or “EVEN”.
[R]
TMCOM2.STOP_BITS TMCOM2 stop bit count. Default value is 1. Range: 1 or 2 bits.
Configures the TMCOM2 port as either an RS-232 port or an
[R] RS-485(/RS-422) port. Default value is “RS485”. Allowed values
TMCOM2.MODE
are: “RS232” or “RS485”. The system board’s RS-232/RS-485
jumper must be set to match this configuration.
Table 16: DNP over TMCOM2 Configuration

The three configuration items marked with an asterisk (*) define which protocol is enabled on the
over the TMCOM2 interface.
DNP over Internal Modem

The internal modem can be used to run the DNP protocol. The table below shows the configuration
items related to running DNP over the internal mode.
Note: the internal modem’s serial port baud rate is not configurable with release 3.7 and later monitor
firmware. The baud rate to the internal modem’s serial port is fixed at 57600.


[R]
[R]
scada.interface “INTERNAL_MODEM”
internal modem baud rate is not
fixed at 57600
configurable
dnp.dst_addr
dnp.src_addr
65534.
[R]
messages.
INTERNAL_MODEM_PORT.DATA_BI Internal modem serial port data bit count. Default value is 8.
[R]
TS Range: 7 or 8 bits.
INTERNAL_MODEM_PORT.FLOW_CT Internal modem serial port flow control mode. Default value is
[R]
RL “HARDWARE”. Allowed values: “HARDWARE” or “NONE”.
INTERNAL_MODEM_PORT.PARITY Internal modem serial port parity bit mode. Default value is
[R]
“NONE”. Allowed values: “NONE”, “ODD” or “EVEN”.
INTERNAL_MODEM_PORT.STOP_BI Internal modem serial port stop bit count. Default value is 1.
[R]
TS Range: 1 or 2 bits.
First AT command string to be sent to the internal modem at
INTERNAL_MODEM.INITSTRING0 system startup to initialize the modem. One to three strings can
[R]
be sent. The first string, string 0, cannot be empty. At minimum,
“AT” should be specified. Default value: “ATZ”.
Second AT command string to be sent to the internal modem at
INTERNAL_MODEM.INITSTRING1
empty. Default value: “ATS0=1”.
Third AT command string to be sent to the internal modem at
INTERNAL_MODEM.INITSTRING2
empty. Default value: “AT&C1&D2&K3&S0”.
Table 17: DNP over Internal Modem Configuration

Other DNP Configuration

DNP Deadband Configuration Items
DNP Deadband configuration items can be accessed using the monitor’s CLI or through DNP.
configuration item name DNP access description

object 34, Dead band for the analog input change event (object
dnp.ambt_deadband point 11 32) point 11 – ambient temperature. Default value is
1.0. Range: 0.0 to 110.0 °C.
dnp.lg_deadband point 12 32) point 12 – load guide. Default value is 1.0. Range:
0.0 to 200.0.
point 14 32) point 14 – auxiliary channel 1. Default value is 1.0.
dnp.aux1_deadband
Range is configurable by the parameters AUX1.4mA and
AUX1.20mA.
object 34, Dead band for analog input change event (object 32)
point 15 point 15 – auxiliary channel 2. Default value is 1.0.
dnp.aux2_deadband
AUX2.20mA.
point 13 32) point 13 – auxiliary channel 3. Default value is 1.0.
dnp.aux3_deadband
AUX3.20mA.
dnp.moist_ppm_-
deadband point 16 32) point 16 – moisture ppm. Default value is 1.0.
Range: 0.0 to 1000.0 ppm.
dnp.wt1_deadband point 126 32) point 126 – winding temperature 1. Default value is
1.0. Range: 0.0 to 230.0 °C.
1.0. Range: 0.0 to 230.0 °C.
1.0. Range: 0.0 to 230.0 °C.

1.0. Range: 0.0 to 230.0 °C.
1.0. Range: 0.0 to 230.0 °C.
1.0. Range: 0.0 to 230.0 °C.
1.0. Range: 0.0 to 230.0 °C.
1.0. Range: 0.0 to 230.0 °C.
Table 18: DNP Deadband Configuration Items
DNP Default Variation 0 Modes
The monitor has multiple modes for the data types presented for analog input points when the points
are accessed using variation 0. The mode is controlled by the configuration item dnp.defvar. The
configuration item can be set to either 3 or 5. Mode 3 is the default. The dnp.defvar configuration
item was not supported in firmware previous to release 3.14; for the older firmware the effective mode
is 3.
When dnp.defvar is 3 then all analog input points are presented as 32-bit integers for variation 0.
When dnp.defvar is 5, then many of the analog input points are presented as 32-bit floating-point
values instead of as 32-bit integers when accessed using variation 0. For each point, the best
representation format is used. For example, analog input point 0 is the service codes bit-map and it is
best represented as an integer; analog input point 1 is the CO2 ppm value and it is best represented as a
floating-point value.
The data types for the analog change event and analog input deadband objects for variation 0 are also
affected by the dnp.defvar setting.
Octet String Event Class
The Octet String Event object group’s default assigned class is configurable. The configuration item is
dnp.octetstring_class. If the configured value is 0 then there is no class assignment. The values 1,

2 and 3 indicate the assigned class is class 1, class 2 and class 3 respectively. The default configuration
value is 0 which prevents Octet String Events appearing in any responses to class polls.
Note that if the Assign Class function is used to set the Octet String Event class, this will override the
effects of the dnp.octetstring_class configuration. However the effects of the Assign Class
function do not persist through monitor restarts.
Note in firmware previous to release 4.5, the Octet String Event assigned class was not configurable. The
default assignment was class 3.
Time Synchronization
When DNP is enabled, the monitor assumes that the DNP master is the external time reference. Other
external time references, e.g. NTP servers when SNTP is enabled, are ignored. Internally the monitor
always tracks time in Universal Coordinated Time (UTC). But, at the DNP interface the representative
time zone can be different and it is configurable. This is controlled by the dnp.time.utc configuration
item and the monitor’s tz configuration.
DNP
time synchronization
time zone dnp.time.utc value tz configuration
UTC true ignored
local false local time zone encoding
example: “PST8PDT7,M3.2.0/2,M11.1.0/2”
Table 19: DNP Time Synchronization Time Zone

Use of UTC for DNP time synchronization is recommended. This corresponds with the DNP 3.0
specification for 2008 and later. (For historical reasons, the default value for dnp.time.utc is false.
Some established systems require this default value.)
By default, the monitor will synchronize to the DNP master's time whenever DNP is enabled. However,
this synchronization can be disabled by setting dnp.time.sync to false.

DNP3 Guide: Serveron® TM8 and TM3 On-Line Transformer Monitors 810-1651-09 Rev A

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

DNP3 Guide: Serveron® TM8 and TM3 On-Line Transformer Monitors 810-1651-09 Rev A

Uploaded by

Copyright:

Available Formats

DNP3 Guide

Office: +1 800 880 2552

Copyright © 2011-2015 Serveron Corporation, a Qualitrol company

© 2011-2015 Serveron Corporation, a Qualitrol company 3

Table 17: DNP over Internal Modem Configuration .................................................................................... 39

© 2011-2015 Serveron Corporation, a Qualitrol company 4

© 2011-2015 Serveron Corporation, a Qualitrol company 5

DNP V3.0 Device Profile

For Requests: Level 3  Master

Transmitted: 292 Transmitted: 2048

© 2011-2015 Serveron Corporation, a Qualitrol company 6

Requires Application Layer Confirmation:

Timeouts while waiting for:

Data Link Confirm:  None  Fixed at 2 s  Variable  Configurable.

Others: Transmission Delay, 0 ms

WRITE Binary Outputs  Never  Always  Sometimes  Configurable

Count > 1  Never  Always  Sometimes  Configurable

Queue  Never  Always  Sometimes  Configurable

Attach explanation if 'Sometimes' or 'Configurable' was checked for any operation.

© 2011-2015 Serveron Corporation, a Qualitrol company 7

 No Counters Reported  No Counters Reported

Sequential File Transfer Support:

Append File Mode  Yes No

Table 1: DNP3 Device Profile

© 2011-2015 Serveron Corporation, a Qualitrol company 8

DNP V3.0 Implementation Table

© 2011-2015 Serveron Corporation, a Qualitrol company 9

© 2011-2015 Serveron Corporation, a Qualitrol company 10

© 2011-2015 Serveron Corporation, a Qualitrol company 11

© 2011-2015 Serveron Corporation, a Qualitrol company 12

© 2011-2015 Serveron Corporation, a Qualitrol company 13

© 2011-2015 Serveron Corporation, a Qualitrol company 14

70 2 File Authentication 29 (authenticate) 5b (free-format) 129 (response) 5B (free-format)

© 2011-2015 Serveron Corporation, a Qualitrol company 15

Table 2: DNP3 Implementation Table

© 2011-2015 Serveron Corporation, a Qualitrol company 16

© 2011-2015 Serveron Corporation, a Qualitrol company 17

Data Points List

Binary Input Points

© 2011-2015 Serveron Corporation, a Qualitrol company 18

Binary Input Points

© 2011-2015 Serveron Corporation, a Qualitrol company 19

Binary Input Points

Table 3: Binary Input Points

Double Bit Input Points

Binary Output Status Points and Control Relay Output Blocks

© 2011-2015 Serveron Corporation, a Qualitrol company 20

© 2011-2015 Serveron Corporation, a Qualitrol company 21

© 2011-2015 Serveron Corporation, a Qualitrol company 22

84 C2H4 ROC Caution ppm/day 0 3

© 2011-2015 Serveron Corporation, a Qualitrol company 23

131 winding temperature 6, °C 2 1 3

Table 4: Analog Inputs

00000001h reserved, the bit value is always 0

© 2011-2015 Serveron Corporation, a Qualitrol company 24

00080000h 12 Volt supply out of range

Table 5: Service Required Conditions Bit Map

© 2011-2015 Serveron Corporation, a Qualitrol company 25

abort code description

0 run not aborted

1 monitor not ready to start run

2 run stopped by operator

3 rotary value fault