The integrity poll hides lost DNP3 events: current values right, history wrong
DNP3 gives the master two views of an outstation. Static data (class 0) is the value of each point right now. Events (classes 1, 2 and 3) are the changes, each with its own timestamp, kept by the outstation until the master collects them. An integrity poll reads class 0 together with all event classes, and a master is expected to run one after a restart or an event buffer overflow. It is a good mechanism. It also hides a loss that is easy to miss.
The setup
A substation RTU with a class 1 buffer of 50 events. The master polls events every 60 seconds and runs an integrity poll every 10 minutes. At 10:01 a fault on the busbar makes 70 points change within 4 seconds, among them breaker CB-3, which opens, recloses, opens again and finally closes.
What happens
| Breaker CB-3 | In the field | In the SCADA history |
|---|---|---|
| 10:01:12 open | yes | yes |
| 10:01:13 close | yes | missing |
| 10:01:15 open | yes | missing |
| 10:01:16 close | yes | yes |
| 10:10:00 integrity poll (class 0) | closed | closed |
- The 70 changes do not fit in 50 slots. The outstation discards events and sets IIN2.3 EVENT_BUFFER_OVERFLOW on its next response.
- The master reacts correctly and runs an integrity poll. Every value on the display is right: CB-3 is closed.
- The SOE holds two of the four CB-3 operations. The reclose cycle that tells a protection engineer what happened is gone, and nothing on the operator's screen says so.
How to recognise it
- IIN2.3 in the traffic, even once. Every overflow is a gap in the history, whatever the display shows afterwards.
- A static value that disagrees with the last event for that point: the integrity poll reports a state the event stream never moved to. Some masters log this as an "unreported change"; most stay silent.
- Event counts that are suspiciously round right before an overflow: the buffer size, every time.
What to change
- Size the event buffer for the worst disturbance, not the average rate, and give protection-relevant points their own class.
- Collect events faster during disturbances: unsolicited reporting, or a shorter event poll.
- Have the master flag the SOE as incomplete for the period of an overflow, so nobody analyses a fault on partial data without knowing it.
Try it on your own capture
ComputingSphere DNP3 decodes a pcap per outstation and reports how many responses carried an overflow, next to the event delay, so you know which period of the history to distrust. It only reads what already went over the wire. The Free plan covers 1,000 messages a month.