DNP3 Data Object Mapping
Original instructions
About us
Introduction
To facilitate communications with the BMENOR2200H module, create data points for the DNP3 communication protocol in the DATA MAPPINGS tab in the DTM.
Access the Configuration Tab
Access the configuration parameters on the DATA MAPPINGS tab in Control Expert:
Step
Action
1
Access the DTM configuration for your module.
2
Confirm that you already created client or server channels.
3
In the CONFIGURATION menu, expand (+) the Channels sub-menu.
4
Make a selection in the Channels sub-menu:
  • DNP3 NET Server
  • DNP3 NET Client
5
Select a specific channel in the sub-menu.
6
Select the DATA MAPPINGS tab for the channel.
7
Configure the data mapping parameters.
8
  • Select Apply to implement your configuration changes.
  • Select OK to implement your changes and close the dialog box.
DNP3 Client Data Mappings
A newly applied data point configuration is added to the X80 master DTM. It appears in the Control Expert variable manager.
DNP3 Data Mappings
Using a Binary Input as an example, edit the data point configuration on the DATA MAPPINGS tab:
Step
Action
1
At Select Type Id, select a type ID.
NOTE: For this example, select Binary Input.
2
Click Add to see the name of the binary input (DNP3_SERVER_BINARY_INPUT) in the Type Identification column.
3
Select the table row that corresponds to the new binary input to see the BINARY INPUT configuration options.
4
Modify the parameters.
NOTE: When the Control Expert window is active, you can hover the cursor over any field to see a description of the functionality and the available range of values.
5
  • Select Apply to implement your configuration changes.
  • Select OK to implement your changes and close the dialog box.
NOTE: A newly applied data point configuration is added to the X80 master DTM. It appears in the Control Expert variable manager.
Exchangeable CPU Data Object
WARNING
UNINTENDED EQUIPMENT OPERATION
Do not create an instance of redundant data access.
Failure to follow these instructions can result in death, serious injury, or equipment damage.
Implement the data dictionary in Control Expert:
Step
Action
1
Open the Project Settings (Tools → Project Settings).
2
Expand (+) the menu: Project Settings → General
3
Select the PLC Embedded Data setting to see the Property label and Property value columns.
4
In the Data label column, find the Data Dictionary row and check the corresponding box in the Property value column.
NOTE: Check this box when you program the PLC application. Otherwise, unlocated variables may not be mapped to RTU data points. However, a compiled application consumes more memory when the data dictionary is included, which can have an impact on unlocated variables that are implemented in RTU solutions.
5
  • Select Apply to implement your configuration changes.
  • Select OK to implement your changes and close the dialog box.
Unlocated variables can be exchanged between the CPU and the BMENOR2200H RTU module after you define and manage the memory map of the CPU to exchange data with the module.
The CPU data objects are mapped and only linked for the BMENOR2200H module’s purpose.
Data Exchange
To sustain a high rate of data exchange, we recommend that you define the BMENOR2200H module’s RTU memory for data objects in a sequential ARRAY data type to group points with the same settings.
Use consecutive point numbers (0, 1, 2, 3...) in DNP3 request fragments.
Predefined Command List
The required input fields are requested to define a predefined command item for DNP3 master/DNP3 NET client.
Static Variation Name of DNP3
Data object type
Static variation
Binary Input
g1v1 Binary In
g1v2 Binary In Flag
Double Input
g3v1 Double In
g3v2 Double In Flag
Binary Output
g10v1 Binary Out
g10v2 Binary Out Flag
Binary Counter
g20v1 32bit Counter
g20v2 16bit Counter
g20v5 32bit Ctr No Flag
g20v6 16bit Ctr No Flag
Frozen Counter
g21v1 32bit Frozen Ctr Flag
g21v2 16bit Frozen Ctr Flag
g21v5 32bit Frozen Ctr Flag Time
g21v6 16bit Frozen Ctr Flag Time
g21v9 32bit Frozen Counter
g21v10 32bit Frozen Counter
Analog Input
g30v1 32bit Analog In
g30v2 16bit Analog In
g30v3 32bit AI No Flag
g30v4 16bit AI No Flag
g30v5 Short Float AI
Analog Input Deadband
g34v1 16bit AI Deadband
g34v2 32bit AI Deadband
g34v3 Short Float AI Deadband
Analog Input Dband_Ctrl
g34v1 16bit AI Deadband
g34v2 32bit AI Deadband
g34v3 Short Float AI Deadband
Analog Output
g40v1 32bit Analog Output
g40v2 16bit Analog Output
g40v3 Short Float AO
Read_Group
—
Read_Class
—
Write_Octet_String
—
Freeze_Counter
—
Unsolicited_Class
—
Time_Sync
—
Restart
—
Octet String
g110 Octet Strings
Integrity_Poll
—
Gen_Events
—
Clear_Events
—
Mapping Tables
Depending on the data object type and the selected protocol profile, different configuration fields are required to define a data object mapping item. The tables below describe the available parameters for each selection in the Select Type Id pull-down menu on the client and server DATA MAPPINGS tabs.
NOTE: These tables include brief descriptions of each data mapping parameter. When the Control Expert window is active, hover the cursor over any parameter field to see a description of the functionality and the available range of values.
Binary Input
This table describes the DNP3 net client parameters that appear on the DATA MAPPINGS tab when you select a Binary Input in the DATA MAPPINGS tab:
Client Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: Confirm that the DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not applied, the nonconsecutive points cannot work normally.
Point Count
Indicates the number of points.
Store to CPU
Choose a source for the event time stamp and flag:
  • Value only: module time
  • Value with time: CPU register time
  • Value with flag: point flag information from the CPU registers
  • Value with flag and time: flag and time from the CPU registers
Point Name
Name of the unlocated register
Static Variation
Select the static variation for the data point.
Event Routing
Route Channel
  • Disable: Disable routing for the channel.
  • Enable: Enable routing for the channel.
Route Point
Point number to route. (This point number appears in the server side but cannot be modified on the server side.)
Event Class Mask
Defines the event class of points. Unsolicited is not allowed with class 0 only. In client, Channel is 0.
Default Event Variation
Indicates the default event variation for data point.
Routing Offline
Specify the flag when the routing channel is offline:
  • Valid Quality: Use any available routing channel connection.
  • Invalid Quality: Set the flag to offline when the routing channel is offline.
This table describes the DNP3 net server parameters that appear on the DATA MAPPINGS tab when you select a Binary Input in the DATA MAPPINGS tab:
Server Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: The DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not the case, the nonconsecutive points do not work normally.
Point Count
indicates the number of points.
CPU Reg Mapping
Choose a source for the event time stamp and flag:
  • Value only: module time
  • Value with time: CPU register time
  • Value with flag: point flag information from the CPU registers
  • Value with flag and time: flag and time from the CPU registers
NOTE: Select one of these values to implement SOE for time stamping.
Point Name
Name of the unlocated register
Default Static Variation
Select the default static variation for the data point.
Default Event Variation
Select the default event variation for the data point.
Event Class Mask
Defines the event class of points. Unsolicited is not allowed with class 0 only. In client, Channel is 0.
PLC State
Specify the flag when the routing channel is offline:
  • No Impact Quality: The quality is valid when the PLC runs.
  • Impact Quality: If the PLC is stopped or removed from the rack, the quality is invalid.
Analog Input
This table describes the client data mapping parameters for analog input types:
Client Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: Confirm that the DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not applied, the nonconsecutive points cannot work normally.
Point Count
Indicates the number of points.
Store to CPU
Choose a source for the event time stamp and flag:
  • Value only: module time
  • Value with time: CPU register time
  • Value with flag: point flag information from the CPU registers
  • Value with flag and time: flag and time from the CPU registers
Static Variation
Select the static variation for the data point.,
Point Name
Name of the unlocated register
Display Deadband In Variable
Specify a deadband variable name.
Point Name
Name of the unlocated register when Display Deadband In Variable is selected (checked)
Event Routing
Channel
Enable or disable the routing of the channel number.
Route Point
Define the point number to route.
Event Class Mask
Defines the event class of points. Unsolicited is not allowed with class 0 only. In client, confirm that Channel is at 0.
Default Event Variation
Indicates the default event variation for data point.
Routing Offline
Specify the flag when the routing channel is offline:
  • Valid Quality: Use any available routing channel connection.
  • Invalid Quality: Set the flag to offline when the routing channel is offline.
This table describes the server data mapping parameters for analog input types:
Server Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: Confirm that the DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not applied, the nonconsecutive points cannot work normally.
Point Count
Indicates the number of points.
Event Class Mask
Defines the event class of points. Unsolicited is not allowed with class 0 only. In client, Channel is at 0 for normal operations.
Default Static Variation
Select the default static variation for the data point.
Default Event Variation
Select the default event variation for the data point.
CPU Reg Mapping
Choose a source for the event time stamp and flag:
  • Value only: module time
  • Value with time: CPU register time
  • Value with flag: point flag information from the CPU registers
  • Value with flag and time: flag and time from the CPU registers
NOTE: Select one of these values to implement SOE for time stamping.
Deadband
Deadband value of the analog input
Use Percent Data
Use low and high range for the percentage of deadband calculation when the check box is selected.
Low Range
Lowest value in the range when the Use Percent Data check box is selected.
High Range
Highest value in the range when the Use Percent Data check box is selected.
Point Name
Name of the unlocated register
PLC State
Specify the flag when the routing channel is offline:
  • No Impact Quality: The quality is valid when the PLC runs.
  • Impact Quality: If the PLC is stopped or removed from the rack, the quality is invalid.
Display Deadband In Variable
Specify a deadband variable name.
Point Name
Name of the unlocated register when the Display Deadband In Variable check box is selected.
Binary Output
This table describes the client data mapping parameters for binary output types:
Client Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: Confirm that the DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not applied, the nonconsecutive points cannot work normally.
Point Count
Indicates the number of points.
Operation Mode
The selected operation mode
Control Code Type
Specify the control code used by the CROB:
  • Latch_On_Off: Trigger the CROB.
  • Pulse_Trip_Close: Trigger the CROB.
  • Pulse_On: Change the value.
NOTE: Refer to the description of binary output behavior.
Default Static Variation
Select the default static variation for the data point.
Pulse Duration
Specify the width of the pulse (ms).
Point Name
Name of the unlocated register
Add CMD_STATUS
Specify the CMD_STATUS variable name.
Server data mapping parameters for binary output types:
Server Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: Confirm that the DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not applied, the nonconsecutive points cannot work normally.
Point Count
Indicates the number of points.
TCC
When Trip_Close is enabled, the odd point in this configuration is a closed output, and the following point is a trip out when an outstation receives a close or trip command. Use an even number for the point count value when enabled.
Default Static Variation
Select the default static variation for the data point.
Default Event Variation
Select the default event variation for the data point.
Add Flag Variable
Specify the flag variable name.
Point Name
Name of the unlocated register when the Add Flag Variable check box is selected.
PLC State
Specify the flag when the routing channel is offline:
  • No Impact Quality: The quality is valid when the PLC runs.
  • Impact Quality: If the PLC is stopped or removed from the rack, the quality is invalid.
Prefix
This prefix for the variable name is followed with an underscore (_). Configure the prefix in the server advanced parameters.
Example: RTU001_Point1.
CPU Register Type
The only available option for the binary output is %MW.
CPU Register Address
This is the start %MW address in the CPU. This field applies only to located variables.
To create a variable without a %MW address, use the value -1.
Considerations:
  • The binary output value (0 or 1) is bit 0 the %MW (INT) in the global variable list. The binary output flag data remains in the Device DDT.
  • The %MW range depends on the CPU %MW register range (default 2048).
NOTE:
  • The Binary_Output_Status is applied in the master, which saves the latest value, state (flag), and time stamp.
  • Floating point values (scientific notation) can be entered for the deadband.
Analog Output
This table describes the client data mapping parameters for analog output types:
Client Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: Confirm that the DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not applied, the nonconsecutive points cannot work normally.
Point Count
Indicates the number of points.
Operation Mode
Selected operation mode
Default Static Variation
Select the default static variation for the data point.
Point Name
Name of the unlocated register
Add CMD_STATUS
Specify the CMD_STATUS variable name.
This table describes the server data mapping parameters for analog output types:
Server Parameter
Description
Point Number
Indicates the start number of the point.
NOTE: Confirm that the DNP3 point number starts at 0 and is contiguous in slave/server mode. If this is not applied, the nonconsecutive points cannot work normally.
Point Count
Indicates the number of points.
Event Class Mask
Defines the event class of points. Unsolicited is not allowed with class 0 only. In client, confirm that Channel is at 0.
Default Static Variation
Select the default static variation for the data point.
Default Event Variation
Select the default event variation for the data point.
Deadband
Deadband value of the analog point
Point Name
Name of the unlocated register
Add Flag Variable
Specify the flag variable name.
Point Name
Name of the unlocated register when the Add Flag Variable check box is selected.
PLC State
Specify the flag when the routing channel is offline:
  • No Impact Quality: The quality is valid when the PLC runs.
  • Impact Quality: If the PLC is stopped or removed from the rack, the quality is invalid.
Prefix
This prefix for the variable name is followed with an underscore (_). Configure the prefix in the server advanced parameters.
The final variable name follows this format:
Prefix_VariableName.Pointx.value
Example: RTU001_AO01.Point[10].value
CPU Register Type
The only available option for the analog output is %MW.
CPU Register Address
This is the start %MW address in the CPU. This field applies only to located variables.
To create a variable without a %MW address, use a start address of the type float/32 bit. A valid analog output type value is an even number. Use address -1.
Considerations:
  • The analog output value is in the global variable list. The binary output flag data remains in the Device DDT.
  • The %MW range depends on the CPU %MW register range (default 2048).
NOTE:
  • The Analog_Output_Status is applied in the master, which saves the latest value, state (flag), and time stamp.
  • Floating point values (scientific notation) can be entered for the deadband.
Behavior of a Binary Output
This configuration depends on the selection you made in the Control Code Type field in the binary output client parameters.
The configuration applies latch on/off, pulse on, and close/trip pulse on:
TCC (Trip-Close Code)
Operation type field
Control code
Point model in outstation
None
pulse on
01 hex
activation
latch on
03 hex
latch complement
latch off
04 hex
Close
pulse on
41 hex
two’s complement
Trip
81 hex
NOTE:
  • The DNP3 master provides only on-time configuration data but does not provide configured off-time and count. The DNP3 outstation also only applies pulse on which the count is 1 and the off-time value is 0.
  • Two’s complement trip and close are provided for a single index in the DNP3 master, but two separately physical outputs in the DNP3 outstation. For example, a close/pulse on request for a specific DNP3 index is mapped to a specific relay output, whereas a trip/pulse on request for the same DNP3 index is mapped to another different relay output which follows the specific relay output (close) in the BMENOR2200H RTU module.
CROB sent in DNP3 master
Point number in DNP3 master
Point number in DNP3 outstation
Pulse on
0
0
Trip/Pulse on
0
1
Close/Pulse on
2
2
Trip/Pulse on
2
3
Close/Pulse on
n+2
n+2
Trip/Pulse on
n+2
n+2+1
In the DNP3 outstation, it is decided by configuration whether the point index applies trip/close request. As the trip/close need to bind a couple of points, the point count is even in the configuration.
This configuration depends on the selection you made in the TCC field in the binary output server parameters.
The selection of the Trip_Close mode depends on the Trip-Close Mode parameter setting (Channel → Session → Advanced Parameter).
When Trip-Close Mode is in Even Mode, the behavior is as follows: the close command controls the even point and the trip command controls the odd point.
When Trip-Close Mode is in Consecutive Mode, the behavior is as follows: the binary output occupies two registers in the CPU memory. The low register is for the close command and the high register is for the trip command.
Op type field
Trigger mechanism
Description
Close/Pulse_on
any value change (0...65535)
pulse on if value change
Latch_on
0 to 1
latch on
Latch off
1 to 0
latch off
Close/Pulse_on
0 to 1
pulse on for close output
Trip/Pulse_on
1 to 0
pulse on for trip output
Long and Short Pulses of Binary Outputs
This configuration depends on the selection you made for these parameters in the binary output client parameters:
NOTE: The outstation uses the entered Pulse Duration. The value 0 indicates that the device uses a pre-configured value.
DNP3 Net Server Parameters
The tables below describe the DNP3 net server parameters that appear on the SERVER MAPPINGS tab.
NOTE: When the Control Expert window is active, you can hover the cursor over any field to see a description of the functionality and the available range of values.
PARAMETERS:
Parameter
Description
Local Address
This field contains the source address for this session.
Master Address
This field contains the remote master (destination) address for this session.
ADVANCED PARAMETERS:
Parameter
Description
Link Status Periodic
Configure the frequency (ms) for the transmission of status requests when no DNP3 frames are received during this session.
Validate Source Address
Check this box to validate the source address in received frames.
Enable Self Address
Check this box to have the slave respond to address 0xfffc as if it received a request at its configured address. The slave responds with its own address so that the master can automatically discover the slave address.
Multi Frag Resp Allowed
Check this box to allow the application to send multi-fragment responses.
Multi Frag Confirm
Check this box to request application layer confirmations for non-final fragments of a multi-fragment response. (Application layer confirmations are always requested for responses that contain events.)
Respond Need Time
Check this box to tell the device to set the Need Time IIN bit in response to this session at start-up after the clock valid period elapses.
Clock Valid Period
Configure the length of time (ms) that the local clock remains valid after it receives a time synchronization.
Application Confirm Timeout
Configure the length of time (ms) that the slave DNP3 device waits for an application layer confirmation from the master for a solicited response.
Select Before Operation (SBO) Timeout
Configure the maximum amount of time (ms) that a selection remains valid before the corresponding operate is received.
Warm Restart Delay
Configure the length of time that the master waits after it receives a response to a warm restart request. This value is encoded in a time delay fine object in the response of a warm restart request.
Cold Restart Delay
Configure the length of time (ms) that the master waits after it receives a response to a cold restart request. This value is encoded in a time delay fine object in the response of a cold restart request.
Allow Multi CROB Requests
Check this box to allow multiple control relay block objects (CROBs) in a single request.
Max Control Requests
Configure the maximum number of binary (CROB) or analog control outputs that are allowed in a single request.
Unsol Allowed
Check this box to allow unsolicited responses.
Send Unsol When Online
Check this box to send unsolicited null responses when the session comes online.
Unsol Class 1 Max Events
When unsolicited responses are enabled, configure this value to specify the maximum number of events in the corresponding class (1, 2, or 3) that are allowed before an unsolicited response is generated.
Unsol Class 2 Max Events
Unsol Class 3 Max Events
Unsol Class 1 Max Delay
Configure the maximum amount of time (ms) after an event in the corresponding class (1, 2, or 3) is received before an unsolicited response is generated.
Unsol Class 2 Max Delay
Unsol Class 3 Max Delay
Unsol Max Retries
Configure the maximum number of unsolicited retries before changing to the offline retries value.
Unsol Retry Delay
Configure the length of the delay (ms) after an unsolicited response.
Unsol Offline Retry Delay
Configure the length of the delay (ms) after an unsolicited timeout before retrying the unsolicited response after the configured number of Unsol Max Retries.
Delete Oldest Event
Configure the behavior for an event queue that is full:
  • checked: Delete the oldest event.
  • unchecked: Delete the newest event.
Counts to Class0 Poll
Configure the type of value that is returned in a poll of class 0 data:
  • Count Value: Return a static binary counter value.
  • Frozen Value: Return a static frozen counter value.
SBO Mode
Select a mode for a before-and-after operation:
  • Interference Mode: The outstation cancels the selection if the next received request is not an operate request. (Only read requests are processed.)
  • Noninterference Mode: The outstation does not cancel the selection even if the next received request is not an operate request by following the selection. The DNP3 group recommends this selection.
Unsol Confirm Timeout
Configure the value for an unsolicited confirm timeout.
Data Synch Mode
Select a data synchronization mode:
  • Cyclic Synch: Use the default (cyclic) synchronization.
  • Synch On Demand: Allow the PLC application to implement local changes on the binary or analog output.
    NOTE: Enabling a Synch On Demand point changes the variable structure (out of the Device DDT).
Prefix
This string is part of the variable name for analog or binary output points when you select Synch On Demand as the Data Synch Mode (range: 1 ... 6).
Considerations:
  • Use Prefix names that are unique for each BMENOR2200H module. Duplicate names cause the overwriting of variables.
  • In the Synch On Demand mode, client-side routing points for the analog or binary output status do not support server-side mapping.
  • Do not use an underscore (_) as the last character in the Prefix.
  • In the Synch On Demand mode, the Prefix consumes 7 characters. The remaining available length of the variable name is therefore reduced to 23 characters.
Set Measured Value
Apply analog input deadband (obj34) to set deadband of measured value. The parameters of the measured points are activated immediately after the DNP3 outstation receives the request from the DNP3 master.
For DNP3 obj34, there is no qualifier to set as it only applies the parameter deadband. Set the static variation and point number at the same setting of the analog input. Analog input deadband is applied both on the DNP3 master and the DNP3 outstation. The DNP3 server uses it to store the current value which is reported in the response of read requests, the DNP3 client uses it to display the current deadband value which can be controlled by the server through the analog input deadband control block.
This configuration depends on the deadband settings you made in these fields:
NOTE: Refer to the description of the analog input client and server parameters.
Generating Events in Outstation
A DNP3 outstation can determine if the user it is communicating with is authorized to access the services of outstation. This standard addresses the following security threats as defined in IEC/TC 62351-2:
In the Outstation DTM configuration tab, the device DDT structure (unlocated variable) looks like this:
where (as shown in the following illustration:
Clearing Events in Outstation
Clear_Events supports a new point type which clears the event buffer in the DNP3 Server/Slave. It enables the user to clear the events buffer in a local or remote SCADA through mapping memory.
Clear_Events can be created only for DNP3 Slave/Server; select Data Mapping.
When the value of the Clear_Events register changes, the BMENOR2200H module clears the events of the object group in the configuration.
Parameter
Value Scope
Definition
Object Group
All Objects
Binary Input
Double Input
Binary Counter
Analog Input
Binary Output
Analog Output
Specifies the object group whose event is cleared o. demand
Variable Name
—
Indicates the name of the located register.
Octet String Mapping for DNP3
In DNP3, Octet String applies to group 110. It supports read, write, and response function codes.
For the BMENOR2200H module, the octet string splits into two types of points, input points and output points.
The master uses a Read_Group command to read the Octet String.
This is the interpretation of the Octet String from the perspective of the master:
This is the interpretation of the Octet String from the perspective of the outstation:
Octet String lengths:
maximum
255 characters
default
16 characters