An event avalanche on a protection trip: 200 changes, a buffer of 100 and one overflow flag
An event buffer overflow is usually explained with a busy day. The worst one comes in two seconds: a protection trip, a busbar fault, a station going dark, when hundreds of points change at once and the history of those seconds is exactly what the engineers will need afterwards.
The setup
A protection RTU with 204 points reports class 1 events unsolicited, holding them up to 2 seconds to send them in batches, with a class 1 buffer of 100 events. The master polls events once a minute as a backstop. At 18:30 a trip changes 200 binary points within 0.8 seconds.
What the capture shows
| 1 hour | Value |
|---|---|
| Points changed at 18:30 | 200 in 0.8 s |
| Class 1 event buffer | 100 events |
| Unsolicited responses in the hour | 614 |
| Responses with IIN2.3 EVENT_BUFFER_OVERFLOW | 1, at 18:30:02.013 |
| Median event delay | 2.0 s (the unsolicited hold) |
- The outstation fills its buffer within the first fraction of a second of the trip. Everything after the hundredth change is discarded, and the overflow is flagged on the next response, which is the first unsolicited response after the 2-second hold.
- The flag appears once. The master clears it, the next responses are normal, and in a list of 614 unsolicited responses the one that matters is easy to miss.
- At least 100 of the 200 changes never reached the master. Which 100 depends on the RTU, and it may well be the end of the sequence, the part that says how the trip finished.
What to change
- Size the class 1 buffer for the worst event burst the site can produce, which is roughly the number of points that can change on one trip, not for the hourly average.
- Shorten the unsolicited hold for protection points, or give them a class with its own buffer.
- Treat a single IIN2.3 as an alarm: the sequence of events for that period is incomplete, whatever the display shows afterwards.
Try it on your own capture
ComputingSphere DNP3 counts every IIN2.3 per outstation with the time it appeared, next to the unsolicited traffic and the event delay, so a single overflow in a long capture is not missed. It only reads what already went over the wire. This capture is among the examples of every free account, to reproduce every number here; or upload your own: the Free plan covers 1,000 messages a month.