Reading room · Case study · 21 October 2026

Why a DNP3 SELECT/OPERATE fails: timeout, unsupported point and local control

Select-before-operate (SBO) is DNP3's two-step control: the master SELECTs a point, the outstation echoes the request with a status, and the master sends an identical OPERATE within the select timeout. When a command "does not work", the reason is almost always in the status byte of the echo. This case follows twelve commands to outstation 70 on 10.0.7.70:20000, three of which fail.

Finding the commands

Packets and messages view filtered on the function column for OPERATE — Filtering the decoded messages on OPERATE shows every command in the capture, with the outstation and the time.

Each control here is a Control Relay Output Block (group 12 variation 1) for breaker CB-70, a double-bit input that follows the breaker after 120 ms of travel. Two closes and a trip go through cleanly: SELECT, echo with status SUCCESS, OPERATE, echo with SUCCESS, then the double-bit input changes in the next event poll.

Failure 1: OPERATE after the select timeout

The outstation keeps a selection for 5 seconds. One OPERATE leaves the master 8 seconds after the SELECT's echo. The outstation answers the OPERATE with status TIMEOUT (1) and nothing moves. On site this is usually an operator confirmation dialog in the SCADA, or a master that queues the OPERATE behind slow polls on the same channel.

Failure 2: a point that does not exist

A CLOSE is sent to CROB index 9; the outstation has two. The echo carries NOT_SUPPORTED (4). A point list copied from another device, or an index offset between the SCADA database and the outstation's profile, are the usual causes.

Failure 3: local control

Protocol view of a response from outstation 70 with IIN Local Control highlighted — The response to a SELECT at 09:12:00: IIN1.5 LOCAL_CONTROL is set, and the command is refused.

For three minutes someone has the device in local. Every response carries IIN1.5 LOCAL_CONTROL (110 of them over the capture) and the command's echo carries status LOCAL (7). This one is not a configuration problem at all: it is a switch on the panel, and the IIN bit is the remote evidence of it.

Analysis of outstation 70: 3 of 12 commands failed, 1 SBO expired before the operate, local control 110 times — The outstation analysis summarises it: 3 of 12 commands failed, one SELECT expired before its OPERATE, and LOCAL_CONTROL was reported 110 times.

Quick reference: CROB status codes

Code	Status	Usual cause
0	SUCCESS	Accepted.
1	TIMEOUT	OPERATE arrived after the select timeout.
2	NO_SELECT	OPERATE without a matching SELECT (different index, code or count).
3	FORMAT_ERROR	Malformed request or unsupported control code combination.
4	NOT_SUPPORTED	The point or the operation does not exist on this device.
5	ALREADY_ACTIVE	An operation on that point is still in progress.
6	HARDWARE_ERROR	The output hardware reported a fault.
7	LOCAL	The device is in local control.

Try it on your own capture

ComputingSphere DNP3 decodes a pcap once, splits it per channel and per outstation, and ranks the outstations worst first with the same numbers used here. It only reads what already went over the wire. Command and SBO attempts and failures are counted per outstation. This capture is among the examples of every free account, to reproduce every number in this post; or upload your own: the Free plan covers 1,000 messages a month.