DNP3 events stamped in the future: an RTU clock that jumped between two syncs
An event's DNP3 timestamp is set by the outstation's clock when the change happens. It reaches the master some time later: milliseconds on a LAN, seconds behind a slow link or an unsolicited hold. The delay can be long, but it cannot be negative. An event that arrives before the time printed on it says the outstation's clock is ahead.
The setup
RTU 51 is synced by the master every 30 minutes with a time write. 70 minutes into a 3-hour capture its clock jumps 2 minutes ahead, as a faulty RTC or a bad time source can do. The next scheduled sync, at 90 minutes, puts it right.
What the capture shows
| 3 hours | Value |
|---|---|
| Events reported | 102 |
| Events stamped after they arrived | 11 |
| Furthest ahead | 119.7 s |
| Median delay of the other events | 0.8 s |
| Time writes by the master | 6, every one accepted |
- All 11 future events fall between the jump and the next sync. Before and after, every delay is positive and below about 2 s.
- The jump itself is invisible: no IIN flag, no NEED_TIME, nothing in the master's logs. The only trace is in the event timestamps.
- A 30-minute sync limited the damage to 20 minutes. With a daily sync, a jump like this would have stamped a whole day of events 2 minutes off.
What to check
- Compute the delay of every event (arrival minus timestamp) and look for negative values. Any event more than the measurement uncertainty in the future is a clock fault.
- Look at when they start: a step from normal to negative points at a jump; a slow slide points at drift.
- If the clock jumps, find what set it: a GPS or IRIG-B input, an NTP server on the RTU's other port, or a firmware that reloads its clock on a watchdog restart.
Try it on your own capture
ComputingSphere DNP3 checks every event timestamp against the moment it arrived, anchored on the master's own time writes, and counts the events stamped in the future per outstation. It only reads what already went over the wire. This capture is among the examples of every free account, to reproduce every number here; or upload your own: the Free plan covers 1,000 messages a month.