Print version

Protocol DNP 3 for MORSE

Distributed Network Protocol version 3

verze 8.01


1. Introduction

DNP3 (Distributed Network Protocol) is a set of communications protocols used between components in process automation systems. Its main use is in utilities such as electric and water companies. Specifically, it was developed to facilitate communications between various types of data acquisition and control equipment. It plays a crucial role in SCADA systems, where it is used by SCADA Master Stations, Remote Terminal Units (RTUs), and Intelligent Electronic Devices (IEDs). It is used only for communications between a master station and RTUs or IEDs. ICCP, the Inter-Control Centre Protocol, is used for inter-master station communications.

This DNP3 MORSE interface support DNP3 message carry only over RS232/422 or RS485 standart, TCP/IP transport should be carried via IP-MORSE – IP mode.

DNP3 is based on the standards of the International Electrotechnical Commission (IEC) Technical Committee 57, Working Group 03 who have been working on an OSI 3 layer “Enhanced Performance Architecture” (EPA) protocol standard for telecontrol applications.

2. Data format

An FT3 frame is defined as a fixed length header block followed by optional data blocks. Each block has a 16-bit CRC appended to it. The IEC specifies that the header fields consist of 2 start bytes, 1 byte length, 1 byte control, a destination address and an optional fixed length user data field. In this implementation the fixed length user data field is defined as a source address.

DNP3 frame

Fig. 1: DNP3 frame

DNP3 Header description:

SYNC [0x0564]

0x0564The Start field is 2 bytes in length. The first byte is a 05 hexadecimal and the second byte is a 64 hexadecimal too.


The length field is 1 byte in length and specifies the count of user bytes in the frame. The CONTROL,DESTINATION and SOURCE field sizes are included in this count. The minimum value for this field is 5 and the maximum value is 255.


The control field contains the direction of the frame, type of frame and flow control information. Figure 2 defines the fields of the control byte. Station A is defined as the designated master station. Station B is not a master station. The primary station is the originator of the message, the source of the message. The secondary station is the destination station.




Physical transmission direction

  • 1 = station A to station B

  • 0 = station B to station A


Primary Message

  • 1 = frame from primary (initiating station)

  • 0 = frame from secondary (responding station)


Frame count bit


Frame count bit valid

  • 1 = Frame count bit is valid

  • 0 = ignore frame count bit


Data flow control bit


Reserved = 0


The function code identifies the type of frame. The definition of the values placed in this field are different between primary and secondary stations. The following tables define the implemented codes and associated FCV.

PRM = 1

Function CodeFrame TypeService FunctionFCV Bit
0SEND – CONFIRM expectedRESET of remote link0
1SEND – CONFIRM expectedReset of user process0
2SEND – CONFIRM expectedTEST function for link1
3SEND – CONFIRM expectedUser Data1
4SEND – NO REPLY expectedUnconfirmed User Data0

PRM = 0

Function CodeFrame TypeService Function
0CONFIRMACK – positive acknowledgement
1CONFIRMNACK – Message not accepted, Link busy
11RESPONDStatus of Link (DFC = 0 or DFC = 1)
Destination address

The Destination address field is 2 bytes in size and specifies the address of the station that the frame is directed to. The first byte of the address is the low order byte and the second byte is the high order. The address 0xffff is defined as an all stations address.

Source address

The source address field is 2 bytes in size and specifies the address of the station that the frame originated from. The first byte of the address is the low order byte and the second byte is the high order.


A two byte cyclic redundancy check is appended to each block in a frame.


The blocks following the header may contain from 1 to 16 bytes of user data. If more than 16 user data bytes follow the header (block 0), each block must contain 16 bytes of data except for the last block. The last block will contain the leftover. Each data block has a CRC appended to it.

3. Comunication example

Terminology used:

Primary station — CU ... CU — Secondary station 

Both radiomodems (CU) work in the same way.

Primary station transmiting:

0564 0BC4 0400 0300 E42B E5C0 0102 0006 985C
05 64

– 2 bytes – DNP3 frame start


– 1 byte – Length field


– 1 byte – Control field – primary station transmit


– 2 bytes – Destination address – 0004 decimal


– 2 bytes – Source address – 0003 decimal


– 2 bytes – DNP3 header CRC

E5C0 0102 0006

– 8 bytes – DNP3 data payload


– 2 bytes – CRC of data payload

Response (Secondary station):

18:33:26.058 tx     17 | S01
0564 0A44 0300 0400 7CAE E0C0 8100 00C1 F0
05 64

– 2 bytes – DNP3 frame start


– 1 byte – Length field


– 1 byte – Control field – secondary station transmit


– 2 bytes – Destination address – 0003 decimal


– 2 bytes – Source address – 0004 decimal


– 2 bytes – DNP3 header CRC

E0C0 8100 00

– 7 bytes – DNP3 data payload


– 2 bytes – CRC of data payload

4. Configuration parameters, example of parameters

DNP3 parameters:

mode don’t any sense, the destination address is always create by destination addres of datagrams, set e. g. the value M

5. History

  • release 778 – 10/2006 – protocol created

  • – 12/2009 – repair of packet closing – more on

©  2024 RACOM s.r.o. All Rights Reserved.