DNP3 Events Not Arriving on Class Polls: Fixes
The symptom: integrity polls return correct current values, the link is healthy, but class 1, 2, and 3 polls come back empty even though points in the field are clearly changing. Operators see values update only on the slow integrity poll and change-of-state history is missing. Because DNP3 splits static data from event data, this failure is almost always configuration on the outstation or master rather than a communications fault, and it has a short list of causes worth checking in order.
DNP3 events not arriving in one line: When DNP3 events are not arriving on class polls, the outstation is usually not generating events in the first place. DNP3 only creates an event for a point that is assigned to event class 1, 2, or 3; unassigned points produce static data only, visible in integrity polls but never in event polls. The next causes in line are analog deadbands set so wide that changes never qualify, an event buffer that overflowed and lost history, missing application-layer confirms preventing the outstation from clearing and sending fresh events, and unsolicited reporting assumed to be on when it was never enabled at both ends.
First Checks: Class Assignment and Deadbands
Start at the outstation's point configuration, because the most common cause is points that were never assigned to an event class. In DNP3, class 0 represents static data - the current value of everything - while classes 1, 2, and 3 hold events. A point assigned to no event class generates no events, ever. The tell for this cause is exactly the symptom described: integrity polls, which include class 0, show correct changing values, while event polls stay empty. RTU and gateway defaults differ, and some ship with every point unassigned, so a fresh installation showing this symptom almost always lands here.
For analog points the second gate is the deadband. An analog input only generates an event when it moves by more than its configured deadband since the last reported value, which is how DNP3 avoids flooding the link with noise. Set the deadband too wide, whether by unit confusion in scaled engineering values or a copy-paste from a different point type, and a normally moving signal never qualifies. Compare the deadband against the signal's real operating range: a deadband larger than the signal's normal excursion means silence by design. Binary points have no deadband, so binary events missing while analog events flow points back at class assignment instead.
Buffers, Confirms, and Where Events Go to Die
Events that are generated must survive until delivery, and the outstation's event buffer is where they wait. Buffers are finite; when one fills, the outstation sets the buffer overflow internal indication and, depending on configuration, discards oldest or newest events. A master that polls rarely, or a link that was down for a long stretch, can therefore lose event history even though live polling later looks fine. If your events go missing in bursts that line up with outages or slow polling schedules, check the overflow indication bit in the outstation's responses and the buffer sizing per class.
Delivery also depends on the application-layer confirm handshake. When an outstation sends events, it asks the master to confirm receipt; only a confirmed event can be safely cleared from the buffer. A master that fails to send application confirms leaves the outstation unable to clear delivered events, which leads to retransmission of the same events, buffers that never drain, and eventually overflow. Symptoms of a confirm problem look strange: duplicate events, the same events repeating on every poll, or event delivery that degrades over time. A protocol analyzer or the communication log on either end shows quickly whether confirms are flowing.
Unsolicited Reporting: Enabled at Both Ends or Not at All
If the design intent was for events to arrive on their own, without waiting for a class poll, the mechanism is unsolicited responses, and it must be enabled coherently at both ends. The outstation must have unsolicited reporting enabled for the relevant classes, and the master must permit it, typically by sending an enable-unsolicited request after connecting. A mismatch produces exactly the confusing half-working state that generates support calls: events arrive only when a class poll happens to run, because the unsolicited path everyone assumed was working was never actually enabled.
There is also a startup subtlety: outstations commonly announce their presence with a null unsolicited response after restart and hold back event data until the master re-enables unsolicited reporting. A master that does not respond correctly to that startup sequence leaves the outstation waiting politely forever. If events stop specifically after outstation restarts and resume after a manual poll or master restart, this handshake is the place to look.
When to Escalate
If class assignments are confirmed, deadbands are sane, confirms are flowing, and unsolicited is coherently configured, capture the actual traffic before calling the vendor. DNP3 is observable: a capture showing your class poll and the outstation's empty response, alongside the outstation's point configuration export, lets a vendor or integrator resolve in minutes what description-based tickets take days to circle. Note the internal indication bits in every response - restart, buffer overflow, and parameter error bits each point at a specific unglamorous cause.
The reason this failure mode matters operationally is that event data is what gives a SCADA history its resolution between polls. A platform such as Merobix consuming DNP3 events records the actual time-tagged changes from the field, so when the events dry up, trends quietly degrade into slow snapshots. Watching for that degradation, and alarming on buffer overflow indications, turns a silent data-quality loss into a maintenance item you catch the week it starts.
Frequently Asked Questions
Why do integrity polls work while class polls return nothing?
Because they read different data. An integrity poll includes class 0, the static current value of every point, which exists regardless of configuration. Class 1, 2, and 3 polls return only events, and events only exist for points explicitly assigned to an event class whose changes exceed any configured deadband. Static data flowing while event polls stay empty is the signature of points not assigned to event classes or deadbands set too wide.
Do I need unsolicited responses for DNP3 events to work?
No. Events accumulate in the outstation's buffer and a plain class poll retrieves them, which is a perfectly valid polled-events design. Unsolicited responses add spontaneous delivery so the master hears about changes without polling, which suits low-bandwidth or high-latency links. What breaks installations is assuming unsolicited is active when only one end was configured for it, so events sit in the buffer until some poll happens to collect them.
What happens when a DNP3 event buffer overflows?
The outstation sets the event buffer overflow internal indication bit in its responses and discards events per its configuration, so history is lost even though current values remain correct. Overflow usually means events are generated faster than they are collected: polling too rare, a link outage, deadbands too tight generating chatter, or confirms not flowing so delivered events are never cleared. The overflow bit is the diagnostic - masters should surface it rather than ignore it.
Sources and verification
This page references the protocol specifications published by the organizations below. Editions, product capabilities, and documentation change over time - confirm current requirements and specifications directly with the source.
- Overview of DNP3 (IEEE Std 1815) - DNP Users Group
Merobix is not affiliated with, endorsed by, or sponsored by these organizations; their names are used only to identify the standards and products discussed.
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.