Reading room
Case studies
Faults found in DNP3 captures, step by step, most with the capture ready to open in a free account and reproduce them.
- A 1% threshold froze the 138 kV bus on the SCADA: same rule, wrong voltage levelA SCADA applied a 1% threshold to every analog voltage. On the 13.8 kV bus that is 138 V; on the 138 kV bus it suppressed swings of more than 1 kV, and the screen showed one value in two hours. How the capture proved it, with raw counts and scale factors.
- DNP3 events stamped in the future: an RTU clock that jumped between two syncsAn outstation clock jumped 2 minutes ahead and stayed there until the next scheduled sync. Eleven events arrived at the master before the time stamped on them. How to find future events in a capture and what they say about the clock.
- DNP3 over 4G: high latency, jitter and dropped sessions in one hour of captureA pumping station RTU on a cellular link: 300 ms round trips, slow responses that pass a 2-second timeout and become retries, and two dropped TCP sessions. What each one costs and how to set timeouts from the capture.
- An event avalanche on a protection trip: 200 changes, a buffer of 100 and one overflow flagA protection trip flips 200 binary points in 0.8 seconds on an outstation with a class 1 buffer of 100 and a 2-second unsolicited hold. The overflow is flagged once, in one response. How to see it and how to size the buffer.
- NEED_TIME never clears: 9,705 DNP3 time writes in 10 minutesAn outstation keeps IIN1.4 NEED_TIME set whatever the master writes, and the master writes the time again on every response. A write storm that drowns the polls. How to recognise it and what to change on each side.
- A stopped DNP3 outstation clock: 54 events, one timestampAn outstation clock stops for 20 minutes. Its events keep arriving with correct values and the same timestamp, so the sequence of events loses its order. How the capture proves a stopped clock even with no time sync to compare against.
- Clock drift you can measure from DNP3 events: 1 second an hour on an RTU nobody syncsTwo outstations on one connection, one synced every 30 minutes and one never. The second drifts 300 ppm, about one second an hour, and it shows in how its events age rather than in any clock read. How to measure drift from a capture.
- DNP3 events three hours off and nothing wrong: a master on local timeA master writes local time (UTC-3) to an outstation. Every event is stamped three hours from the capture, yet master and outstation agree and the sequence of events is correct. How to tell a time zone convention from a clock fault.
- Thirteen RTUs behind one gateway: four clock and function findings on one DNP3 outstationA substation gateway puts 13 DNP3 outstations behind one IP and port. One of them fails on four counts: a time sync that never took, a stopped clock, drift between syncs and requests it rejects. What each finding means and how it is proven from the traffic.
- 75 link requests, no answer: a removed DNP3 outstation the master still pollsAn outstation was taken out in the field but stayed in the master configuration. Every 36 seconds the master asks for its link status three times and waits. How the capture shows it, why it is not harmless and what to change.
- Who closed the DNP3 connection? FIN, RST and silence on a primary and backup pathThree drops in an hour on an outstation with a primary and a backup path. The TCP side of the capture says who ended each connection and how: an abort, an orderly close or a path that never answered. What each one points at.
- An outstation that restarts quietly: IIN1.7 DEVICE_RESTART and events an hour in the pastAn outstation cold-restarts twice in 30 minutes. The master clears the restart flag and writes the time each time, but the first response after the second restart already carried 8 events stamped an hour in the past. How to find restarts and their damage in a capture.
- IIN2.0 Function Not Supported: a DNP3 master and outstation configured from different documentsThe master enables unsolicited reporting and writes the time every hour; the outstation supports neither and rejects all four requests with IIN2.0. Why nothing looks broken, what it costs and how to align the two.
- DELAY_MEASURE 30 times higher than at the FAT: the DNP3 outstation, not the networkAn RTU reported a 6 ms processing delay at the factory acceptance test and 180 ms in the field. Why the DELAY_MEASURE answer points at the outstation itself, what it does to time sync and what to compare with the FAT capture.
- Link-layer confirms over TCP: twice the DNP3 frames and retries for nothingCONFIRMED_USER_DATA on a DNP3 link over TCP doubles the frames, and a link timeout shorter than the network round trip turns delay into retries, link resets and duplicate requests. How to see it and what to set.
- The integrity poll hides lost DNP3 events: current values right, history wrongAfter an event buffer overflow the master runs an integrity poll and every value on the display is right again, but the discarded events are gone for good. How to recognise it and how to keep the sequence of events complete.
- One trip, four rows: DNP3 unsolicited responses that are never confirmedAn outstation repeats the same unsolicited response every 5 seconds because the master confirms it without the UNS bit. Why the event shows up several times in the SOE, how it looks on the wire and what to fix.
- The substation GPS that overwrote the master: DNP3 events an hour in the futureThe master synced an outstation every 30 minutes and the SCADA still flagged its events as suspect. A substation GPS set an hour ahead was putting the clock back minutes after each sync. How the capture shows it.
- Self-healing on stale data: three DNP3 problems a FLISR scheme should not meetRepeated unsolicited events from a recloser, an outstation silent when the fault happens and a switch left in local control: how each one misleads fault location, isolation and restoration, and how to find them in a capture first.
- 204 SYN retransmissions and no DNP3: an unreachable outstation in a captureA master tries an outstation 68 times in 30 minutes and never gets an answer. Why no DNP3 tool shows it, and how the TCP layer of the same capture does.
- Tuning a chatter filter from a DNP3 capture: 26 updates down to 6A breaker input chatters in bursts of 12 transitions, and a feeder current with a tight deadband quietly sends 178 updates in 30 minutes into an ADMS. Replaying the real updates through a chatter filter and a deadband shows how many still reach the SCADA.
- DNP3 event buffer overflow: losing events between pollsAn outstation with a 20-event buffer and bursts of 60 changes: IIN2.3 EVENT_BUFFER_OVERFLOW, events 28 seconds late and what to change in the poll plan.
- Why a DNP3 SELECT/OPERATE fails: timeout, unsupported point and local controlTwelve commands to one outstation, three failures: an OPERATE sent too late, a command to a point that does not exist and one refused in local control. How each looks on the wire.
- NEED_TIME on 904 responses: a DNP3 outstation the master never syncsAn outstation sets IIN1.4 NEED_TIME on every response for 30 minutes while its neighbours get their clock written. How to spot it, why it matters and what to check in the master.
- One silent outstation on a multidrop line: finding it in a DNP3 captureA DNP3 outstation on a shared channel stops answering for 90 seconds, twice. How unanswered requests, retries and late events give it away, and why its neighbours look fine.