Scada-systemsHow-ToBeginner · 3 min read

How DNP3 Protocol Works: Simple Explanation and Example

The DNP3 protocol is a communication standard used in SCADA systems to exchange data between control centers and remote devices. It works by sending structured messages with time-stamped data over serial or IP networks, ensuring reliable and secure data transfer.

📐

Syntax

The DNP3 protocol uses a layered message structure with these main parts:

Start Frame: Marks the beginning of a message.
Control Field: Defines message type and direction.
Address Field: Identifies source and destination devices.
Function Code: Specifies the action (e.g., read, write).
Data Field: Contains the actual data or commands.
CRC: Error-checking code to ensure message integrity.

This structure allows devices to communicate commands and data reliably.

scada_systems

Start Frame | Control Field | Address Field | Function Code | Data Field | CRC

💻

Example

This example shows a simple DNP3 message frame to read data from a remote device. The message requests the current status of inputs.

scada_systems

0x05 0x64 0xC4 0x01 0x00 0xC0 0x01 0x3C 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
# Breakdown:
# 0x05 0x64 — Start bytes
# 0xC4      — Length field
# 0x01      — Control field
# 0x00 0xC0 — Destination address
# 0x01 0x3C — Source address
# 0x00      — Function code (Read)
# Remaining bytes — Data + CRC

⚠️

Common Pitfalls

Common mistakes when working with DNP3 include:

Not validating CRC, leading to accepting corrupted messages.
Ignoring time synchronization, causing timestamp mismatches in logged data.
Misconfiguring device addresses, causing messages to reach wrong devices.

📊

Quick Reference

Field	Description
Start Frame	0x05 0x64 — marks start of DNP3 message
Control Field	Message direction and type
Address Field	Source and destination device IDs
Function Code	Action: read (0x01), write (0x02), etc.
Data Field	Actual payload or command data
CRC	16-bit error check for each block

✅

Key Takeaways

DNP3 is a reliable protocol for SCADA communication between control centers and field devices.

Messages use a structured frame with start bytes, address, function code, data, and CRC.

Always validate CRC to ensure message integrity.

Time synchronization is critical to accurate event logging in DNP3.

Device addresses must be configured correctly to avoid misdirected messages.