PMT Hps Controledge Rtu and PLC dnp3 Outstation Device Profile Rtdoc x346 en e

DNP3
Device Profile
Based on DNP XML Schema version 2.08.00
Document Name: ControlEdge RTU and PLC DNP3 Outstation Device Profile RTDOCX346enE
Document Description: This is a DNP3 device profile for the Honeywell ControlEdge RTU and PLC outstation
device.
Revision History
Date Time Version Reason for change Edited by
20160524 1 Initial revision for firmware version SCUCMX01_120.121.0 of Honeywell with

RTU2020 R120. document ID
RTDOCX346enA
20180404 2 Update product name as ControlEdge RTU; Update hardware version: Honeywell with

SCUCMX01 (ControlEdge 2020 Nonredundant controller): Kernel document ID
Board Version E, App Board Version A; SCUCNN11 (ControlEdge RTDOCX346enB
2020 Redundant controller): Kernel Board Version C Update build name
as ControlEdge Builder; Update build version as RTU_120.121.0 or
later.
20191023 3 Update product name as ControlEdge RTU and PLC; Add hardware Honeywell with

version: SCUCMX02 (ControlEdge 2020 Nonredundant controller): document ID
Kernel Board Version B, App Board Version B; 900CP10200 RTDOCX346enC
(ControlEdge PLC CPM); Update build version as version 140 or later.
20210826 4 Update the maximum number of obejects allowed in a single control Honeywell with

request for CROB, Analog Outputs and Data Sets. document ID
RTDOCX346enD
20221202 5 Updated the section 1.12 Security Parameters (1.12.1 – 1.12.17) Honeywell

International Sàrl
R EFERENCE D EVICE :

1 Device Properties
This document is intended to be used for several purposes, including:
Identifying the capabilities of a DNP3 device (Master Station or Outstation)
Recording the settings of a specific instance of a device (parameter settings for a specific instance of the device in the user's total DNP3 estate)
Matching user requirements to product capabilities when procuring a DNP3 device
The document is therefore structured to show, for each technical feature, the capabilities of the device (or capabilities required by the device when
procuring).
It is also structured to show the current value (or setting) of each of the parameters that describe a specific instance of the device. This "current value"
may also show a functional limitation of the device. For example when implementing secure authentication it is not required that all DNP3 devices
accept aggressive mode requests during critical exchanges (see Device Profile 1.12.4), in which case a vendor would mark this current value as "No
does not accept aggressive mode requests".
Additionally, the current value may sometimes be used to show a value that a device can achieve because of hardware or software dependencies. An
example of this is in section 1.6.8 of the Device Profile (Maximum error in the time that the Master issues freeze requests) where the value may well
depend upon tolerances of hardware components and interactions between software tasks. When the Device Profile current value is used in this way
the corresponding entry in the capabilities column is grayedout. Users should note that if an entry in the capabilities column of the Device Profile is
grayedout then there may be information in the current value column that is pertinent to the device's capabilities.
Unless otherwise noted, multiple boxes in the second column below are selected for each parameter to indicate all capabilities supported or required.
Parameters without checkboxes in the second column do not have capabilities and are included so that the current value may be shown in the third
column.
The items listed in the capabilities column below may be configurable to any of the options selected, or set to a fixed value when the device was
designed. Item 1.1.10 contains a list of abbreviations for the possible ways in which the configurable parameters may be set. Since some parameters
may not be accessible by each of these methods supported, an abbreviation for the configuration method supported by each parameter is shown in the
fourth column of the tables below.
If this document is used to show the current values, the third column should be filled in even if a fixed parameter is selected in the capabilities section
("NA" may be entered for parameters that are Not Applicable).
The items listed in the capabilities column below may be configurable to any of the options selected, or set to a fixed value when the device was
designed. Item 1.1.10 contains a list of abbreviations for the possible ways in which the configurable parameters may be set. Since some parameters
may not be accessible by each of these methods supported, an abbreviation for the configuration method supported by each parameter is shown in the
fourth column of the tables below.
If this document is used to show the current values, the third column should be filled in even if a fixed parameter is selected in the capabilities section
("NA" may be entered for parameters that are Not Applicable).
If the document is used to show the current values of parameters, then column 3 applies to a single connection between a master and an outstation.
If
1.1 D EVICE I DENTIFICATION Capabilities Current Value configurable
list methods
1.1.1 Device Function: Master Master

Outstation Outstation
Masters send DNP requests, while Outstations
send DNP responses. If a single physical device
can perform both functions a separate Device
Profile Document must be provided for each
function.
1.1.2 Vendor Name: Honeywell
The name of the organization producing the
device.
Note: The current value of this outstation
parameter is available remotely using protocol
object Group 0 Variation 252.
1.1.3 Device Name: ControlEdge PLC & RTU.
Model numbers: SC
The model and name of the device, sufficient UCMX01, ControlEdge
to distinguish it from any other device from the 2020 Nonredundant
same organization. controller; SCUCNN11,
ControlEdge 2020
Note: The current value of this outstation Redundant controller; SC
parameter is available remotely using protocol UCMX02, ControlEdge
object Group 0 Variation 250. 2020 Nonredundant
controller; 900CP10200,
ControlEdge 900 CPM
1.1.4 Device manufacturer's hardware version SCUCMX01: Kernel
string: Board Version E, App
Board Version A; SC
Note: The current value of this outstation UCMX02: Kernel Board
parameter is available remotely using protocol Version B, App Board
object Group 0 Variation 243. Version B; SCUCNN11:
Kernel Board Version C;
900CP10200
1.1.5 Device manufacturer's software version PLC/RTU_140 and later
string: for SCUCMX01 and SC
UCNN11; PLC/RTU_160
Note: The current value of this outstation and later for SCUCMX02
parameter is available remotely using protocol and 900CP10200
1.1.6 Device Profile Document Version 3
Number:
Version of the Device Profile Document is
indicated by a whole number incremented with
each new release. This should match the latest
version shown in the Revision History at the
beginning of this document.
1.1.7 DNP Levels Supported for: Outstations Only Level 4

Requests and Responses
Indicate each DNP3 Level to which the device None
conforms fully. For Masters, requests and
responses can be indicated independently. Level 1
Level 2
Level 3
Level 4
1.1.8 Supported Function Blocks: Self Address Support Self Address

Data Sets Secure Authentication
File Transfer
Virtual Terminal
Mapping to IEC 61850 Object Models
defined in a DNP3 XML file
Function code 31, activate configuration
Secure Authentication (if checked then see
1.12)
Level 2
Level 3
Level 4
1.1.8 Supported Function Blocks: Self Address Support Self Address

Data Sets Secure Authentication
File Transfer
Virtual Terminal
Mapping to IEC 61850 Object Models
defined in a DNP3 XML file
Function code 31, activate configuration
Secure Authentication (if checked then see
1.12)
1.1.9 Notable Additions:
A brief description intended to quickly identify
(for the reader) the most obvious features the
device supports in addition to the Highest
DNP Level Supported. The complete list of
features is described in the Implementation
Table.
1.1.10 Methods to set Configurable XML Loaded via DNP3 File Transfer Software

Parameters: XML Loaded via other transport mechanism Vendor software named
ControlEdge Builder
Terminal ASCII Terminal Command Line Version 140 or later
Software Vendor software named Protocol
ControlEdge Builder140 or later
Proprietary file loaded via DNP3 File Transfer
Proprietary file loaded via other transport
mechanism
Direct Keypad on device front panel
Factory Specified when device is ordered
Protocol Set via DNP3 (e.g. assign class)
Other explain:
1.1.11 DNP3 XML files available Online: Rd Wr Filename Description of Contents Rd Wr Filename

dnpDP.xml Complete Device Profile dnpDP.xml
XML configuration file names that can be read
dnpDPCap.xmlDevice Profile Capabilities dnpDPCap.xml
or written through DNP3 File Transfer to a
Device Profile config dnpDPCfg.xml
device. dnpDPCfg.xml
values
A device's currently running configuration is
returned by DNP3 online XML file read from
the device.
DNP3 online XML file write to a device will
update the device's configuration when the
Activate Configuration (function code 31) is
received.
1.1.12 External DNP3 XML files available Off Rd Wr Filename Description of Contents Rd Wr Filename

line: dnpDP.xml Complete Device Profile dnpDP.xml
dnpDPCap.xmlDevice Profile Capabilities dnpDPCap.xml
XML configuration file names that can be read
Device Profile config dnpDPCfg.xml
or written from an external system, typically dnpDPCfg.xml
values
from a system that maintains the outstation
configuration.
External offline XML file read permits an
XML definition of a new configuration to be
supplied from offline configuration tools.
External offline XML file write permits an
XML definition of a new configuration to be
supplied to offline configuration tools.
1.1.13 Connections Supported: Serial (complete section 1.2) IP Networking

IP Networking (complete section 1.3)
Other, explain
If
1.3 IP N ETWORKING Capabilities Current Value configurable
list methods
1.3.1 Port Name: ETH1, ETH2
Name used to reference the communications
port defined in this section.
1.3.2 Type of End Point: TCP Initiating (Master Only) TCP Listening software
TCP Listening (Outstation Only) UDP Datagram ControlEdge
If
1.3 IP N ETWORKING Capabilities Current Value configurable
list methods
1.3.1 Port Name: ETH1, ETH2
Name used to reference the communications
port defined in this section.
1.3.2 Type of End Point: TCP Initiating (Master Only) TCP Listening software
TCP Listening (Outstation Only) UDP Datagram ControlEdge
Builder Vers
TCP Dual (required for Masters) 140 or later
UDP Datagram (required)

1.3.3 IP Address of this Device: *.*.*.* software

ControlEdge
Builder Vers
140 or later

1.3.4 Subnet Mask: *.*.*.* software

ControlEdge
Builder Vers
140 or later

1.3.5 Gateway IP Address: *.*.*.* software

ControlEdge
Builder Vers
140 or later

1.3.6 Accepts TCP Connections or UDP Allows all (show as *.*.*.* in 1.3.7) Allows all

Datagrams from: Limits based on IP address
Limits based on list of IP addresses
Limits based on a wildcard IP address
Limits based on list of wildcard IP addresses
Other, explain
1.3.7 IP Address(es) from which TCP *.*.*.*
Connections or UDP Datagrams are accepted:
1.3.8 TCP Listen Port Number: Not Applicable (Master w/o dual end point) 20000 software
Fixed at 20,000 ControlEdge
If Outstation or dual end point Master, port Builder Vers
number on which to listen for incoming TCP Configurable, range 0 to 65535 140 or later
connect requests. Required to be configureable Configurable, selectable from
for Masters and recommended to be
Configurable, other, describe
configurable for Outstations.
1.3.9 TCP Listen Port Number of remote device: Not Applicable (Outstation w/o dual end Not Applicable

point)
If Master or dual end point Outstation, port
Fixed at 20,000
number on remote device with which to initiate
connection. Required to be configurable for Configurable, range to
Masters and recommended to be configurable Configurable, selectable from
for Outstations. Configurable, other, describe
1.3.10 TCP Keepalive timer: Fixed at ms 5000 ms software

Configurable, range 0 to 2147483647ms ControlEdge
The time period for the keepalive timer on Builder Vers
active TCP connections. Configurable, selectable from ms 140 or later

1.3.11 Local UDP port: Fixed at 20,000 20000 software

Configurable, range 0 to 65535 ControlEdge
Local UDP port for sending and/or receiving Builder Vers
UDP datagrams. Masters may let system Configurable, selectable from 140 or later
choose an available port. Outstations must use Configurable, other, describe
one that is known by the Master.
Let system choose (Master only)
1.3.12 Destination UDP port for DNP3 Fixed at 20,000
Requests (Masters Only): Configurable, range to
Configurable, selectable from
140 or later
choose an available port. Outstations must use Configurable, other, describe
one that is known by the Master.
Let system choose (Master only)
1.3.12 Destination UDP port for DNP3 Fixed at 20,000
Requests (Masters Only): Configurable, range to
1.3.13 Destination UDP port for initial unsolicited None 20000 software

null responses (UDP only Outstations): Fixed at 20,000 ControlEdge
Builder Vers
The destination UDP port for sending initial Configurable, range 0 to 65535 140 or later
unsolicited Null response. Configurable, selectable from
1.3.14 Destination UDP port for responses None 20000 software

(UDP only Outstations): Fixed at 20,000 ControlEdge
Builder Vers
The destination UDP port for sending all Configurable, range 0 to 65535 140 or later
responses other than the initial unsolicited Null Configurable, selectable from
response.
Use source port number
1.3.15 Multiple outstation connections (Masters Supports multiple outstations (Masters only)
only):
Indicates whether multiple outstation
connections are supported.
1.3.16 Multiple master connections (Outstations Supports multiple masters (Outstations only) IP address
only): IP port number
If supported, the following methods may be used:
Indicates whether multiple master connections
Method 1 (based on IP address) required
are supported and the method that can be used
to establish connections. Method 2 (based on IP port number)
recommended
Method 3 (browsing for static data) optional
1.3.17 Time synchronization support: DNP3 LAN procedure (function code 24)
DNP3 Write Time (not recommended over
LAN)
Other, explain
Not Supported
If
1.4 L INK L AYER Capabilities Current Value configurable
list methods
1.4.1 Data Link Address: Fixed at 1 software
Indicates if the link address is configurable over Builder Vers
the entire valid range of 0 to 65,519. Data link Configurable, selectable from 140 or later
addresses 0xFFF0 through 0xFFFF are Configurable, other, describe
reserved for broadcast or other special
purposes.
1.4.2 DNP3 Source Address Validation: Never Never software

Always, one address allowed (shown in 1.4.3) ControlEdge
Indicates whether the Outstation will filter out Builder Vers
requests not from a specific source address. Always, any one of multiple addresses allowed 140 or later
(each selectable as shown in 1.4.3)
Sometimes, explain
1.4.3 DNP3 Source Address(es) expected when Configurable to any 16 bit DNP Data Link 30000 software

Validation is Enabled: Address value ControlEdge
Configurable, range 0 to 65519 Builder Vers
Selects the allowed source address(es) 140 or later
1.4.4 Self Address Support using address Yes (only allowed if configurable) No software

0xFFFC: No ControlEdge
Builder Vers
If an Outstation receives a message with a 140 or later
destination address of 0xFFFC it shall respond
normally with its own source address. It must be
possible to diasble this feature if supported.
1.4.5 Sends Confirmed User Data Frames: Never Never software

Always ControlEdge
A list of conditions under which the device Builder Vers
transmits confirmed link layer services Sometimes, explainMultifragment 140 or later
140 or later
destination address of 0xFFFC it shall respond
normally with its own source address. It must be
possible to diasble this feature if supported.
1.4.5 Sends Confirmed User Data Frames: Never Never software

Always ControlEdge
A list of conditions under which the device Builder Vers
transmits confirmed link layer services Sometimes, explainMultifragment 140 or later
(TEST_LINK_STATES, RESET_LINK_STATES,
CONFIRMED_USER_DATA).
1.4.6 Data Link Layer Confirmation Timeout: None 2000ms software

Fixed at ms ControlEdge
This timeout applies to any secondary data link Builder Vers
message that requires a confirm or response Configurable, range 0 to 2147483647ms 140 or later
(link reset, link status, user data, etc). Configurable, selectable from ms
Variable, explain
1.4.7 Maximum Data Link Retries: None 3 software

Fixed at ControlEdge
The number of times the device will retransmit Builder Vers
a frame that requests Link Layer confirmation. Configurable, range 0 to 255 140 or later
1.4.8 Maximum number of octets Transmitted in Fixed at 292

a Data Link Frame: Configurable, range 28 to 292
This number includes the CRCs. With a length Configurable, selectable from
field of 255, the maximum size would be 292. Configurable, other, describe
1.4.9 Maximum number of octets that can be Fixed at 292

Received in a Data Link Frame: Configurable, range 28 to 292
This number includes the CRCs. With a field Configurable, selectable from
length of 255, the maximum size would be 292. Configurable, other, describe
The device must be able to receive 292 octets to
be compliant.
If
1.5 A PPLICATION L AYER Capabilities Current Value configurable
list methods
an Application Layer Fragment other than File Configurable, range 256 to 65535
Transfer:
This size does not include any transport or Configurable, other, describe
frame octets.
Masters must provide a setting less than or
equal to 249 to be compliant.
Outstations must provide a setting less than or
an Application Layer Fragment containing File Configurable, range 256 to 65535
Transfer:
1.5.3 Maximum number of octets that can be Fixed at 2048

received in an Application Layer Fragment: Configurable, range 256 to 65535
This size does not include any transport or Configurable, selectable from
frame octets. Configurable, other, describe
Masters must provide a setting greater than or
Outstations must provide a setting greater
than or equal to 249 to be compliant.
1.5.4 Timeout waiting for Complete Application None None
Layer Fragment: Fixed at ms
Timeout if all frames of a message fragment are Configurable, range to ms
not received in the specified time. Measured Configurable, selectable from ms
from time first frame of a fragment is received Configurable, other, describe
until the last frame is received.
Variable, explain
1.5.4 Timeout waiting for Complete Application None None
Layer Fragment: Fixed at ms
Timeout if all frames of a message fragment are Configurable, range to ms
not received in the specified time. Measured Configurable, selectable from ms
from time first frame of a fragment is received Configurable, other, describe
until the last frame is received.
Variable, explain
1.5.5 Maximum number of objects allowed in a Fixed at 10(enter 0 if controls are not 10

single control request for CROB (Group 12): supported for CROB)
Configurable, range to
parameter is available remotely using protocol Configurable, selectable from
object Group 0 Variation 216. Configurable, other, describe
Variable, explain

single control request for Analog Outputs (Group supported for Analog Outputs)
41): Configurable, range to
Variable, explain
single control request for Data Sets (Groups 85, supported for Data Sets)
86, 87): Configurable, range to
Variable, explain
1.5.8 Supports mixed object groups (AOBs, Not applicable controls are not supported Yes

CROBs and Data Sets) in the same control Yes
request:
No
1.5.9. User Data:
A user data entry
If
1.7 F ILL O UT T HE F OLLOWING I TEMS F O R
Capabilities Current Value configurable
O UTSTATIONS O NLY
list methods
1.7.1 Timeout waiting for Application Confirm of None 10000ms software
solicited response message: Fixed at ms ControlEdge
Builder Vers
Configurable, range 0 to 2147483647ms 140 or later
Configurable, selectable from ms
Variable, explain
1.7.2 How often is time synchronization required Never needs time Periodically, every 1800 software

from the master: Within seconds after IIN1.4 is set seconds. ControlEdge
Builder Vers
Details of when the master needs to perform a Periodically, fixed at seconds 140 or later
time synchronization to ensure that the Periodically, between 0 and 2147483647
outstation clock does not drift outside of an
seconds
acceptable tolerance. If the option to relate this
to IIN1.4 is used then details of when IIN1.4 is
asserted are in section 1.10.2.
1.7.3 Device Trouble Bit IIN1.6: Never used Never used
Reason for setting
If IIN1.6 device trouble bit is set under certain
conditions, explain the possible causes.
1.7.4 File Handle Timeout: Not applicable, files not supported Not applicable
Fixed at ms
If there is no activity referencing a file handle
for a configurable length of time, the outstation Configurable, range to ms
must do an automatic close on the file. The Configurable, selectable from ms
timeout value must be configurable up to 1 Configurable, other, describe
hour. When this condition occurs the outstation
will send a File Transport Status Object (obj Variable, explain
grp 70 var 6) using a status code value of
handle expired (0x02).
1.7.5 Event Buffer Overflow Behavior: Discard the oldest event Discard oldest software
Discard the newest event ControlEdge
Builder Vers
Other, explain 140 or later

hour. When this condition occurs the outstation
will send a File Transport Status Object (obj Variable, explain
grp 70 var 6) using a status code value of
handle expired (0x02).
1.7.5 Event Buffer Overflow Behavior: Discard the oldest event Discard oldest software
Discard the newest event ControlEdge
Builder Vers
Other, explain 140 or later

1.7.6 Event Buffer Organization: per Object Group per Object Group
Explain how event buffers are arranged (per
Object Group, per Class, single buffer etc) and
provide their sizes.
1.7.7 Sends MultiFragment Responses: Yes Yes
No
Indicates whether an Outstation sends multi
fragment responses (Masters do not send multi
fragment requests).
1.7.8 Last Fragment Confirmation: Always Sometimes
Sometimes, explainOnly when it contains
Indicates whether the Outstation requests
confirmation of the last fragment of a multi events
fragment response. Never
1.7.9 DNP Command Settings preserved Assign Class
through a device restart: Analog Deadbands
If any of these settings are written through the Data Set Prototypes
DNP protocol and they are not preserved Data Set Descriptors
through a restart of the Outstation, the Master Function Code 31 Activate Configuration
will have to write them again after it receives a
response in which the Restart IIN bit is set.
If
1.8 O UTSTATION U NSOLICITED R ESPONSE
S UPPORT
list methods
1.8.1 Supports Unsolicited Reporting: Not Supported On software
Configurable, selectable from On and Off ControlEdge
When the unsolicited response mode is Builder Vers
configured "off", the device is to behave 140 or later
exactly like an equivalent device that has no
support for unsolicited responses. If set to "on",
the Outstation will send a null Unsolicited
Response after it restarts, then wait for an
Enable Unsolicited Response command from
the master before sending additional
Unsolicited Responses containing event data.
1.8.2 Master Data Link Address: Fixed at 30000 software
The destination address of the master device Builder Vers
where the unsolicited responses will be sent. Configurable, selectable from 140 or later

1.8.3 Unsolicited Response Confirmation Fixed at ms 10000 ms software

Timeout: Configurable, range 0 to 2147483647ms ControlEdge
Builder Vers
This is the amount of time that the outstation Configurable, selectable from ms 140 or later
will wait for an Application Layer confirmation Configurable, other, describe
back from the master indicating that the master
Variable, explain
received the unsolicited response message. As a
minimum, the range of configurable values
must include times from one second to one
minute. This parameter may be the same one
that is used for normal, solicited, application
confirmation timeouts, or it may be a separate
parameter.
1.8.4 Number of Unsolicited Retries: None 3 software
This is the number of retries that an outstation Builder Vers
transmits in each unsolicited response series if it Configurable, range 0 to 65535 140 or later
does not receive confirmation back from the Configurable, selectable from
master. The configured value includes identical
and regenerated retry messages. One of the
choices must provide for an indefinite (and Always infinite, never gives up
potentially infinite) number of transmissions.
1.8.5. User Data:
A user data entry
master. The configured value includes identical
and regenerated retry messages. One of the
choices must provide for an indefinite (and Always infinite, never gives up
potentially infinite) number of transmissions.
1.8.5. User Data:
A user data entry
If
1.9 O UTSTATION U NSOLICITED R ESPONSE
TRIGGER C ONDITIONS
list methods
1.9.1 Number of class 1 events: Class 1 not used to trigger Unsolicited 5 software
Responses ControlEdge
Fixed at Builder Vers
140 or later
Configurable, range 1 to 255

140 or later

140 or later
1.9.4 Total number of events from any class: Total Number of Events not used to trigger
Unsolicited Responses
Fixed at
1.9.5 Hold time after class 1 event: Class 1 not used to trigger Unsolicited 5000 ms software

A configurable value of 0 indicates that Builder Vers
Fixed at ms
responses are not delayed due to this parameter. 140 or later
Configurable, range 0 to 2147483647ms

Fixed at ms

Fixed at ms
1.9.8 Hold time after event assigned to any class: Class events not used to trigger Unsolicited
Responses
A configurable value of 0 indicates that
Fixed at ms
responses are not delayed due to this parameter.
Configurable, range to ms
1.9.9 Retrigger Hold Time: Holdtime timer will be retriggered for each Not retriggered

new event detected (may get more changes in next
The holdtime timer may be retriggered for each
response)
new event detected (increased possibility of
Holdtime timer will not be retriggered for each
capturing all the changes in a single response)
or not retriggered (giving the master a new event detected (guaranteed update time)
guaranteed update time).
1.9.10 Other Unsolicited Response Trigger NONE Other, NONE
Conditions:
Configurable, range to ms
1.9.9 Retrigger Hold Time: Holdtime timer will be retriggered for each Not retriggered

new event detected (may get more changes in next
The holdtime timer may be retriggered for each
response)
new event detected (increased possibility of
Holdtime timer will not be retriggered for each
capturing all the changes in a single response)
or not retriggered (giving the master a new event detected (guaranteed update time)
guaranteed update time).
1.9.10 Other Unsolicited Response Trigger NONE Other, NONE
Conditions:
If
1.10 O UTSTATION P ERFORMANCE Capabilities Current Value configurable
list methods
1.10.1 Maximum Time Base Drift (milliseconds Fixed at 0ms 0 ms
per minute): Range to ms
If the device is synchronized by DNP, what is Selectable from ms
the clock drift rate over the full operating Other, describe
temperature range.
1.10.2 When does outstation set IIN1.4: Never software
Asserted at startup until first Time ControlEdge
When does the outstation set the internal Builder Vers
indication IIN1.4 NEED_TIME Synchronization request received 140 or later
Periodically every seconds
Periodically, range to seconds
Periodically, selectable from seconds
seconds after last time sync
Range to seconds after last time sync
Selectable from seconds after last time sync
When time error may have drifted by ms
When time error may have drifted by range to
ms
When time error may have drifted by
selectable from ms
1.10.3 Maximum Internal Time Reference Error Fixed at 0ms 0 ms
when set via DNP (ms): Range to ms
The difference between the time set in DNP Selectable from ms
Write Time message, and the time actually set in Other, describe
the outstation.
1.10.4 Maximum Delay Measurement Error Fixed at 0ms 0 ms
(ms): Range to ms
The difference between the time reported in the Selectable from ms
delay measurement response and the actual Other, describe
time between receipt of the delay measurement
request and issuing the delay measurement
reply.
1.10.5 Maximum Response Time (ms): Fixed at 0ms 0 ms
Range to ms
The amount of time an outstation will take to
respond upon receipt of a valid request. This Selectable from ms
does not include the message transmission time. Other, describe
1.10.6 Maximum time from startup to IIN 1.4 Fixed at 0ms 0 ms

assertion (ms): Range to ms
Selectable from ms
Other, describe
1.10.7 Maximum Event Timetag error for local Fixed at 0ms 0 ms

Binary and Double Bit I/O (ms): Range to ms
The error between the timetag reported and Selectable from ms
the absolute time of the physical event. This Other, describe
error includes the Internal Time Reference
Error.
Note: The current value of this parameter is
available remotely using protocol object Group
0 Variation 217.
I/O other than Binary and Double Bit data types Range to ms
(ms):
Selectable from ms
Other, describe
Error.
Note: The current value of this parameter is
available remotely using protocol object Group
0 Variation 217.
I/O other than Binary and Double Bit data types Range to ms
(ms):
Selectable from ms
Other, describe
If
1.11 I NDIVIDUAL F IELD O UTSTATION P ARAMETERS Value of Current Setting configurable
list methods
1.11.1 Userassigned location name or code string (same as
g0v245):
1.11.2 Userassigned ID code/number string (same as g0v246):
1.11.3 Userassigned name string for the outstation (same as
g0v247):
1.11.4 Device Serial Number string (same as g0v248):
If
1.12 S ECURITY P ARAMETERS Capabilities Current Value configurable
list methods
1.12.1 DNP3 device support for secure Secure Authentication not supported Supports security software
authentication: Version: 5 ControlEdge
If Secure Authentication is supported, what Builder Vers
The support for secure authentication is Version(s) are supported: R171.3 and
optional in DNP3 devices. Indicate here if the primary
Fixed at 5
device supports secure authentication. release post
Configurable, selectable from R172
If the device does not support secure
authentication then ignore the rest of this
section.
If the device does support secure authentication
then specify the version(s) that are supported in
the device. The version number is an integer
value defined in the DNP3 Specification. The
Secure Authentication procedure defined in
IEEE 18152010 is version 2. The Secure
Authentication procedure defined in IEEE
18152012 is version 5.
1.12.2 Maximum number of users: Maximum nunber of users supported: 25 Maximum number of users software
supported: 25 ControlEdge
The secure authentication algorithm provides Builder Vers
support for multiple users. The device must R171.3 and
support details for each user (update keys, primary
session keys, etc). A user is identified by a 16 release post
bit user number, allowing a maximum of 65535 R172
users. Devices are not mandated to support this
number of potential users. Indicate here the
actual limit to the number of simultaneous
users that can be supported.
1.12.3 Security message response timeout: Fixed at ms 2000 ms software
Configurable, range 0 to 4294967295ms ControlEdge
Authentication of critical messages may involve Builder Vers
additional message exchanges (challenges and Configurable, selectable from ms R171.3 and
responses) which can require an extension to Configurable, other, describe primary
the normal DNP3 message response timeout. release post
This timeout specifies an additional time to be R172
used when the extra security transactions are
involved. The maximum allowable timeout
extension should not exceed 120 seconds.
1.12.4 Aggressive mode of operation (receive): Yes, accepts aggressive software

mode requests ControlEdge
DNP3 devices may (optionally) accept
No, does not accept Builder Vers
"aggressive" mode requests, where challenge
data used for authentication is appended to a aggressive mode requests R171.3 and
primary
critical message rather than needing to be
release post
solicited via a separate message exchange.
R172

1.12.5 Aggressive mode of operation (issuing): Yes, issues aggressive software

DNP3 devices must support the issuing of
No, does not issue Builder Vers
"aggressive" mode of operation, where
aggressive mode requests R171.3 and
challenge data used for authentication is
primary
appended to a critical message rather than
release post
needing to be solicited via a separate message
R172
R172

1.12.5 Aggressive mode of operation (issuing): Yes, issues aggressive software

DNP3 devices must support the issuing of
No, does not issue Builder Vers
"aggressive" mode of operation, where
aggressive mode requests R171.3 and
challenge data used for authentication is
primary
appended to a critical message rather than
release post
needing to be solicited via a separate message
R172
exchange. Specific instances of devices may

have the use of aggressive mode switched off.

1.12.6 Session key change interval: Can be disabled Enabled software

900 seconds ControlEdge
To counter an attack that compromises the When enabled Builder Vers
session key, the session key is changed at R171.3 and
Configurable, range 0 to 4294967295seconds
regular intervals. The maximum interval is 2 primary
hours. Outstation devices invalidate the current release post
set of session keys if they have not been R172
changed by the master station after a period of
twice this configured value.
To accommodate systems with infrequent
communications, this change interval can be
disabled and just the session key change
message count used (see 1.12.7)
1.12.7 Session key change message count: Configurable, range 0 to 4294967295 2000 software
ControlEdge
In addition to changing the session key at Builder Vers
regular intervals, the key shall also be changed R171.3 and
after a specified number of messages have been primary
exchanged. The maximum allowable value for release post
this message count is 10,000 R172

1.12.8 Maximum error count: Configurable, range 0 to 4294967295 2 software

ControlEdge
To assist in countering denial of service attacks, Builder Vers
a DNP3 device shall stop replying with error R171.3 and
codes after a number of successive primary
authentication failures. This error count has a release post
maximum value of 10. Setting the error count R172
to zero inhibits all error messages.

1.12.9 MAC algorithm requested in a challenge SHA1 (truncated to the leftmost 4 octets) software

exchange: SHA1 (truncated to the leftmost 8 octets) ControlEdge
Builder Vers
Part of the authentication message is hashed SHA1 (truncated to the leftmost 10 octets) R171.3 and
using an MAC algorithm. Secure Authentication SHA256 (truncated to the leftmost 8 octets) primary
version 2 specifies that DNP3 devices must release post
SHA256 (truncated to the leftmost 16 octets)
support SHA1 and may optionally support R172
SHA256 for this hashing process. Secure AESGMAC

Authentication version 5 specifies that SHA256 Other, explain:
is the default. The output of the MAC algorithm
is truncated (the resulting length dependant on
the media being used).
1.12.10 Keywrap algorithm to encrypt session AES128 software
keys: AES256 ControlEdge
Builder Vers
During the update of a session key, the key is RSAESOAEP1024 / SHA1 R171.3 and
encrypted using AES128 or optionally using RSAESOAEP2048 / SHA256 primary
other algorithms. release post
RSAESOAEP3072 / SHA256
R172
Other, explain:

1.12.11 Cipher Suites used with DNP Not relevant TLS is not used software

implementations using TLS: TLS_RSA encrypted with AES128 ControlEdge
Builder Vers
When TLS is supported, DNP3 Secure TLS_RSA encrypted with RC4_128 R171.3 and
Authentication mandates the support of TLS_RSA encrypted with 3DES_EDE_CBC primary
TLS_RSA_WITH_AES_128_SHA. The release post
TLS_DH, signed with DSS, encrypted with
specification has a number of recommended R172
cipher suite combinations. Indicate the 3DES_EDE_CBC

supported Cipher Suites for implementations TLS_DH, signed with RSA, encrypted with

using TLS. 3DES_EDE_CBC
TLS_DHE, signed with DSS, encrypted with
3DES_EDE_CBC
R172
Other, explain:

1.12.11 Cipher Suites used with DNP Not relevant TLS is not used software

implementations using TLS: TLS_RSA encrypted with AES128 ControlEdge
Builder Vers
When TLS is supported, DNP3 Secure TLS_RSA encrypted with RC4_128 R171.3 and
Authentication mandates the support of TLS_RSA encrypted with 3DES_EDE_CBC primary
TLS_RSA_WITH_AES_128_SHA. The release post
specification has a number of recommended R172
cipher suite combinations. Indicate the 3DES_EDE_CBC

supported Cipher Suites for implementations TLS_DH, signed with RSA, encrypted with

using TLS. 3DES_EDE_CBC
TLS_DHE, signed with DSS, encrypted with
3DES_EDE_CBC
TLS_DHE, signed with RSA, encrypted with
3DES_EDE_CBC
AES128
AES256
TLS_DH encrypted with AES128
TLS_DH encrypted with AES256
Other, explain:
1.12.12 Change cipher request timeout: Not relevant TLS is not used software

Implementations using TLS shall terminate the Builder Vers
connection if a response to a change cipher Configurable, range to R171.3 and
request is not seen within this timeout period. Configurable, selectable from primary
Configurable, other, describe release post
R172

1.12.13 Number of Certificate Authorities software
supported: ControlEdge
Builder Vers
Implementations using TLS shall support at R171.3 and
least 4 Certificate Authorities. Indicate the primary
number supported. release post
R172

1.12.14 Certificate Revocation check time: Not relevant TLS is not used software

Fixed at hours ControlEdge
Implementations using TLS shall evaluate Builder Vers
Certificate Revocation Lists on a periodic basis, Configurable, range to hours R171.3 and
terminating a connection if a certificate is Configurable, selectable from hours primary
revoked. release post
R172

1.12.15 Additional critical function codes: Additional function codes that are to be considered software

as "critical": ControlEdge
The DNP3 specification defines those messages 0 (Confirm) Builder Vers
with specific function codes that are critical and R171.3 and
1 (Read)
must be used as part of a secure authentication primary
message exchange. Messages with other 7 (Immediate freeze) release post
function codes are optional and changes to this 8 (Immediate freeze no ack) R172
list should be noted here.
9 (Freezeandclear)

Note: Secure Authentication version 5 defines 10 (Freezeandclear no ack)
additional functions as critical that were not 11 (Freezeattime)
considered critical in version 2. These are 12 (Freezeattime no ack)
shown in the next column annotated with "V2
22 (Assign Class)
only".
23 (Delay Measurement)
25 (Open File) V2 only
26 (Close File) V2 only
27 (Delete File) V2 only
28 (Get File Info) V2 only
30 (Abort File) V2 only
129 (Response)
130 (Unsolicited Response)
R172

1.12.15 Additional critical function codes: Additional function codes that are to be considered software

as "critical": ControlEdge
The DNP3 specification defines those messages 0 (Confirm) Builder Vers
with specific function codes that are critical and R171.3 and
1 (Read)
must be used as part of a secure authentication primary
message exchange. Messages with other 7 (Immediate freeze) release post
function codes are optional and changes to this 8 (Immediate freeze no ack) R172
list should be noted here.
9 (Freezeandclear)

Note: Secure Authentication version 5 defines 10 (Freezeandclear no ack)
additional functions as critical that were not 11 (Freezeattime)
considered critical in version 2. These are 12 (Freezeattime no ack)
shown in the next column annotated with "V2
22 (Assign Class)
only".
23 (Delay Measurement)
25 (Open File) V2 only
26 (Close File) V2 only
27 (Delete File) V2 only
28 (Get File Info) V2 only
30 (Abort File) V2 only
129 (Response)
130 (Unsolicited Response)
1.12.16 Other critical fragments: software
ControlEdge
Other critical transactions can be defined and Builder Vers
should be detailed here. Examples could be R171.3 and
based on time (for example: the first primary
transaction after a communications session is release post
established). Other examples could be based on R172
specific data objects (for example: the reading
of specific data points).
1.12.17 Support for remote update key changes: Remote update key change by symmetric Using symmetric software

cryptography cryptography ControlEdge
Devices implementing secure authentication Builder Vers
Remote update key change by asymmetric
version 5 of later have the option to support R171.3 and
remote update key changes. If remote update cryptography primary
key change is supported then the procedure release post
using symmetric cryptography is mandatory. R172
Additional support for the procedure using
asymmetric (public key) cryptography is
optional.
If
1.13 B ROADCAST F UNCTIONALITY Capabilities Current Value configurable
list methods
This section indicates which functions are supported by the device when using broadcast addresses. Note that it is mandatory for outstations to be
configurable to enable or disable the support for each function in order to comply with the requirements of the IED conformance tests dated 2012
and later.
Note that this section shows only entries that may have a meaningful purpose when used with broadcast requests.
1.13.1 Support for broadcast functionality: Disabled Enabled
Enabled
Configurable
1.13.2 Write functions (FC = 2) supported with Write clock (g50v1 with qualifier code 07) Write clock: Enabled Clock:

broadcast requests: Disabled Time:
Write last recorded time:
Enabled Enabled Restart:
Configurable, other (described elsewhere) Other:
Clear restart: Enabled
Write last recorded time (g50v3 with qualifier code
07) Write any other: Enabled
Disabled
Enabled
Configurable, other (described elsewhere)
Clear restart (g80v1 with qualifier code 00 and
index = 7, value = 0)
Disabled
Enabled
Write to any other group / variation / qualifier code
1.13.1 Support for broadcast functionality: Disabled Enabled
Enabled
Configurable
1.13.2 Write functions (FC = 2) supported with Write clock (g50v1 with qualifier code 07) Write clock: Enabled Clock:

broadcast requests: Disabled Time:
Write last recorded time:
Enabled Enabled Restart:
Configurable, other (described elsewhere) Other:
Clear restart: Enabled
Write last recorded time (g50v3 with qualifier code
07) Write any other: Enabled
Disabled
Enabled
Clear restart (g80v1 with qualifier code 00 and
index = 7, value = 0)
Disabled
Enabled
Write to any other group / variation / qualifier code
Disabled
Enabled
1.13.3 Direct operate functions (FC = 5) Disabled Enabled
supported with broadcast requests: Enabled
1.13.4 Direct operate, no acknowledgement Disabled Enabled

functions (FC = 6) supported with broadcast Enabled
requests:
1.13.5 Immediate freeze functions (FC = 7) Disabled Enabled

1.13.6 Immediate freeze, no acknowledgement Disabled Enabled

requests:
1.13.7 Freeze and clear functions (FC = 9) Disabled Enabled

1.13.8 Freeze and clear, no acknowledgement Disabled Enabled

requests:
1.13.9 Freeze at time functions (FC = 11) Disabled Enabled

1.13.10 Freeze at time, no acknowledgement Disabled Enabled

requests:
1.13.11 Cold restart functions (FC = 13) Disabled Enabled

1.13.12 Warm restart functions (FC = 14) Disabled Enabled

1.13.13 Initialize data functions (FC = 15) Disabled Enabled

1.13.14 Initialize application functions (FC = 16) Disabled Enabled

1.13.15 Start application functions (FC = 17) Disabled Enabled

1.13.14 Initialize application functions (FC = 16) Disabled Enabled
1.13.15 Start application functions (FC = 17) Disabled Enabled

1.13.16 Stop application functions (FC = 18) Disabled Enabled

1.13.17 Save configuration functions (FC = 19) Disabled Enabled

1.13.18 Enable unsolicited functions (FC = 20) Enable unsolicited by event Class (g60v2, g60v3 By event class: Enabled Class:

supported with broadcast requests: and g60v4 with qualifier code 06) Other:
Disabled By any other: Enabled
Enabled
Enable unsolicited for any other group / variation /
qualifier code
Disabled
Enabled
1.13.19 Disable unsolicited functions (FC = 21) Disable unsolicited by event Class (g60v2, g60v3 By event class: Enabled Class:
supported with broadcast requests: and g60v4 with qualifier code 06) Other:
Disabled By any other: Enabled
Enabled
Disable unsolicited for any other group / variation /
qualifier code
Disabled
Enabled
1.13.20 Assign class functions (FC = 22) Disabled Enabled
1.13.21 Record current time functions (FC = 24) Disabled Enabled

1.13.22 Activate configuration functions (FC = Disabled Enabled

31) supported with broadcast requests: Enabled
2 Mapping between DNP3 and IEC 61850 Objects
This optional section allows each configuration parameter or point in the DNP Data map to be tied to an attribute in the IEC 61850 object models (and
viceversa).
Earlier versions of this section (up to version 2.07) used mappings based on an "access point" (section 2.1.1 and then a series of XPath references
(section 2.1.2). Section 2.1.2 has been superseded in version 2.08 onwards with mappings defined using either predefined rules (section 2.1.3) or
specified as an equation (section 2.1.4). The list of predefined rules is found in the IEEE 18151 document.
The following display has been selected to be in a tabular form.
M APPING BETWEEN DNP3 AND IEC 61850 O BJECTS
3 Capabilities and Current Settings for Device Database (Outstation only)
The following tables identify the capabilities and current settings for each DNP3 data type. Details defining the data points available in the device are
shown in part 5 of this Device Profile.
3.1 S INGLEB IT B INARY I NPUT P OINTS

Static (SteadyState) Object Number: 1
3 Capabilities and Current Settings for Device Database (Outstation only)
The following tables identify the capabilities and current settings for each DNP3 data type. Details defining the data points available in the device are
shown in part 5 of this Device Profile.
3.1 S INGLEB IT B INARY I NPUT P OINTS

Event Object Number: 2
Capabilities If
. (leave tickboxes blank if this data type is not Current Value configurable
supported) list methods
3.1.1 Static Variation reported when variation 0 Variation 1 Singlebit packed format Two software
requested or in response to Class polls: Variation 2 Singlebit with flag Note: Configurable on a ControlEdge
perobject basis. Builder Vers
Based on point index (add column to table in 140 or later
part 5)

3.1.2 Event Variation reported when variation 0 Variation 1 without time Two software

requested or in response to Class polls: Variation 2 with absolute time Note: Configurable on a ControlEdge
Note: The support for binary input events can Variation 3 with relative time 140 or later
be determined remotely using protocol object Based on point index (add column to table in
Group 0 Variation 237.
part 5)
3.1.3 Event reporting mode: Only most recent All events

All events
When responding with event data and more
than one event has occurred for a data point, Based on point index (add column to table in
an Outstation may include all events or only the part 5)
most recent event.
"All events" must be checked to be compliant.
3.1.4 Binary Inputs included in Class 0 response: Always If assigned
Never
Only if point is assigned to a class
Based on point index (add column to table in
part 5)
3.2 D OUBLEBIT I NPUT P OINTS

Capabilities If
3.2.1 Static Variation reported when variation 0 Variation 1 Doublebit packed format Two software
requested or in response to Class polls: Variation 2 Doublebit with flag Note: Configurable on a ControlEdge
Note: The support for doublebit inputs can be Based on point index (add column to table in 140 or later
determined remotely using protocol object part 5)

Variation 3 with relative time 140 or later
part 5)

All events
most recent event.
"All events" must be checked to be compliant.
3.2.4 Double Bit Inputs included in Class 0 Always If assigned
response: Never
part 5)
3.3 B INARY O UTPUT S TATUS AND C ONTROL R ELAY O UTPUT B LOCK

Binary Output Status Object Number: 10
Binary Output Event Object Number: 11
CROB Object Number: 12
Binary Output Command Event Object Number: 13
Capabilities If
part 5)
3.3 B INARY O UTPUT S TATUS AND C ONTROL R ELAY O UTPUT B LOCK

Binary Output Status Object Number: 10
Binary Output Event Object Number: 11
CROB Object Number: 12
Binary Output Command Event Object Number: 13
Capabilities If
3.3.1 Minimum pulse time allowed with Trip, Fixed at 0 ms (hardware may limit this further) Fixed at 0 ms
Close and Pulse On commands: Based on point index (add column to table in
part 5)
3.3.2 Maximum pulse time allowed with Trip, Fixed at 2147483647 ms (hardware may limit Fixed at 2147483647 ms
Close and Pulse On commands: this further
part 5)
3.3.3 Binary Output Status included in Class 0 Always If assigned
response: Never
part 5)
3.3.4 Reports Output Command Event Objects: Never On all attempts
Only upon a successful Control
Upon all control attempts
3.3.5 Static Variation reported when variation 0 Variation 1 Continuous control Two software

requested or in response to Class polls: Variation 2 Continuous control, binary output Note: Configurable on a ControlEdge
status 140 or later
part 5)

Note: The support for binary output events can Based on point index (add column to table in 140 or later
be determined remotely using protocol object part 5)
3.3.7 Command Event Variation reported when Variation 1 without time Two software

variation 0 requested or in response to Class polls: Variation 2 with absolute time Note: Configurable on a ControlEdge
Based on point index (add column to table in 140 or later
part 5)


All events
than one event has occurred for a data point,
an Outstation may include all events or only the
most recent event.
3.3.9 Command Event reporting mode: Only most recent All events
All events
most recent event.
3.3.10 Maximum Time between Select and Not Applicable 5 seconds software
Operate: Fixed at seconds ControlEdge
Builder Vers
Configurable, range 1 to 2147483seconds 140 or later
Configurable, selectable from seconds
Variable, explain Based on point index
(add column to table in part 5)
3.4 C OUNTERS / F ROZEN C OUNTERS

Static Counter Object Number: 20
Static Frozen Counter Object Number: 21
Counter Event Object Number: 22
Frozen Counter Event Object Number: 23
Capabilities If
3.4 C OUNTERS / F ROZEN C OUNTERS

Static Counter Object Number: 20
Static Frozen Counter Object Number: 21
Counter Event Object Number: 22
Frozen Counter Event Object Number: 23
Capabilities If
3.4.1 Static Counter Variation reported when Variation 1 32bit with flag One software
variation 0 requested or in response to Class polls: Variation 2 16bit with flag Note: Configurable on a ControlEdge
Variation 5 32bit without flag 140 or later
Variation 6 16bit without flag
part 5)
3.4.2 Counter Event Variation reported when Variation 1 32bit with flag Five software
variation 0 requested or in response to Class polls: Variation 2 16bit with flag Note: Configurable on a ControlEdge
Note: The support for counter events can be Variation 5 32bit with flag and time 140 or later
determined remotely using protocol object Variation 6 16bit with flag and time
part 5)
3.4.3 Counters included in Class 0 response: Always If assigned
Never
part 5)
3.4.4 Counter Event reporting mode: A: Only most recent (value at time of event) All events
B: Only most recent (value at time of response)
than one event has occurred for a data point, C: All events
an Outstation may include all events or only the Based on point index (add column to table in
most recent event. Only the most recent event is part 5)
typically reported for Counters. When reporting
only the most recent event the counter value
returned in the response may be either the value
at the time that the event is queued or it may be
the value at the time of the response.
3.4.5 Static Frozen Counter Variation reported Variation 1 32bit with flag Five software
when variation 0 requested or in response to Class Variation 2 16bit with flag Note: Configurable on a ControlEdge
polls: perobject basis. Builder Vers
Variation 5 32bit with flag and time 140 or later
Variation 6 16bit with flag and time
part 5)
3.4.6 Frozen Counter Event Variation reported Variation 1 32bit with flag Five software
when variation 0 requested or in response to Class Variation 2 16bit with flag Note: Configurable on a ControlEdge
polls: perobject basis. Builder Vers
Note: The support for frozen counter events can Variation 6 16bit without flag
be determined remotely using protocol object
part 5)
3.4.7 Frozen Counters included in Class 0 Always If assigned
response: Never
part 5)
3.4.8 Frozen Counter Event reporting mode: Only most recent frozen value All events
All frozen values
most recent event. All events are typically
reported for Frozen Counters
3.4.9 Counters Roll Over at: 16 Bits (65,535) 4,294,967,295
32 Bits (4,294,967,295)
Fixed at
reported for Frozen Counters
3.4.9 Counters Roll Over at: 16 Bits (65,535) 4,294,967,295
32 Bits (4,294,967,295)
Fixed at
part 5)
3.4.10 Counters frozen by means of: Master Request Master Request
Freezes itself without concern for time of day
Freezes itself and requires time of day
Other, explain:
3.5 A NALOG I NPUT P OINTS

Deadband Object Number: 34
Capabilities If
3.5.1 Static Variation reported when variation 0 Variation 1 32bit with flag Five software
requested or in response to Class polls: Variation 2 16bit with flag Note: Configurable on a ControlEdge
Variation 5 singleprecision floating point
with flag
Variation 6 doubleprecision floating point
with flag
part 5)
3.5.2 Event Variation reported when variation 0 Variation 1 32bit without time Seven software
requested or in response to Class polls: Variation 2 16bit without time Note: Configurable on a ControlEdge
Note: The support for analog input events can Variation 3 32bit with time 140 or later
be determined remotely using protocol object Variation 4 16bit with time
Variation 5 singleprecision floating point w/o
time
w/o time
with time
with time
part 5)
3.5.3 Event reporting mode: A: Only most recent (value at time of event) All events
B: Only most recent (value at time of response)
than one event has occurred for a data point, C: All events
an Outstation may include all events or only the Based on point index (add column to table in
most recent event. Only the most recent event is part 5)
typically reported for Analog Inputs. When
reporting only the most recent event the analog
value returned in the response may be either the
value at the time that the event is queued or it
may be the value at the time of the response.
3.5.4 Analog Inputs included in Class 0 Always If assigned
response: Never
part 5)
3.5.5 How Deadbands are set: A. Global Fixed Based on point index software
B. Configurable through DNP ControlEdge
Builder Vers
C. Configurable via other means 140 or later
D. Other, explain:

Based on point index column in part 5
part 5)
3.5.5 How Deadbands are set: A. Global Fixed Based on point index software
B. Configurable through DNP ControlEdge
Builder Vers
C. Configurable via other means 140 or later
D. Other, explain:

Based on point index column in part 5
specifies which of the options applies, B, C, or D
3.5.6 Analog Deadband Algorithm: Simple Simple
Integrating
simple just compares the difference from the
previous reported value Other, explain:
integrating keeps track of the accumulated Based on point index (add column to table in

change part 5)
other indicating another algorithm
3.5.7 Static Frozen Analog Input Variation Variation 1 32bit with flag
reported when variation 0 requested or in response Variation 2 16bit with flag
to Class polls:
Variation 3 32bit with timeoffreeze
Variation 4 16bit with timeoffreeze
with flag
with flag
part 5)
3.5.8 Frozen Analog Input Event Variation Variation 1 32bit without time
reported when variation 0 requested or in response Variation 2 16bit without time
to Class polls:
Variation 3 32bit with time
Note: The support for frozen analog input Variation 4 16bit with time
events can be determined remotely using Variation 5 singleprecision floating point w/o
protocol object Group 0 Variation 230.
time
w/o time
with time
with time
part 5)
3.5.9 Frozen Analog Inputs included in Class 0 Always
response: Never
part 5)
3.5.10 Frozen Analog Input Event reporting Only most recent frozen value
mode: All frozen values
When responding with event data and more Based on point index (add column to table in
than one event has occurred for a data point, part 5)
reported for Frozen Analog Inputs.
3.6 A NALOG O UTPUT S TATUS AND A NALOG O UTPUT C ONTROL B LOCK

Analog Output Status Object Number: 40
Analog Output Control Block Object Number: 41
Analog Output Event Object Number: 42
Analog Output Command Event Object Number: 43
Capabilities If
3.6.1 Static Analog Output Status Variation Variation 1 32bit with flag Three software
reported when variation 0 requested or in response Variation 2 16bit with flag Note: Configurable on a ControlEdge
to Class polls: perobject basis. Builder Vers
Variation 3 singleprecision floating point 140 or later
with flag
Capabilities If
3.6.1 Static Analog Output Status Variation Variation 1 32bit with flag Three software
reported when variation 0 requested or in response Variation 2 16bit with flag Note: Configurable on a ControlEdge
to Class polls: perobject basis. Builder Vers
Variation 3 singleprecision floating point 140 or later
with flag
with flag
part 5)
3.6.2 Analog Output Status included in Class 0 Always If assigned
response: Never
part 5)
3.6.3 Reports Output Command Event Objects: Never On all attempts
Only upon a successful Control
Upon all control attempts
3.6.4 Event Variation reported when variation 0 Variation 1 32bit without time Seven software

requested or in response to Class polls: Variation 2 16bit without time Note: Configurable on a ControlEdge
Note: The support for analog output events can Variation 3 32bit with time 140 or later
be determined remotely using protocol object Variation 4 16bit with time
time
w/o time
with time
with time
part 5)
3.6.5 Command Event Variation reported when Variation 1 32bit without time Seven software
variation 0 requested or in response to Class polls: Variation 2 16bit without time Note: Configurable on a ControlEdge
Variation 3 32bit with time 140 or later
Variation 4 16bit with time
time
w/o time
with time
with time
part 5)
All events
most recent event.
3.6.7 Command Event reporting mode: Only most recent All events
All events
most recent event.
3.6.8 Maximum Time between Select and Not Applicable 5 seconds software
Operate: Fixed at seconds ControlEdge
Builder Vers
Configurable, range 1 to 2147483seconds 140 or later
Configurable, selectable from seconds
3.7 S EQUENTIAL F ILE T RANSFER

Object Number: 70
3.7 S EQUENTIAL F ILE T RANSFER

Object Number: 70
If
. Capabilities Current Value configurable
list methods
3.7.1 File Transfer Supported: Yes No
No (set 3.7.6 to "Fixed at 0" and do not
complete other entries in section 3.7)
3.7.2 File Authentication: Always Never
Sometimes, explain
Indicates whether a valid authentication key
must be obtained prior to open and delete
requests. Never
3.7.3 File Append Mode: Always Never

Sometimes, explain
Indicates if a file can be opened and appended
to versus just overwritten.
Never
3.7.4 Permissions Support: Owner Read Allowed: 0x0100
Owner Write Allowed: 0x0080
Indicates the device is capable of using the
indicated permissions. Owner Execute Allowed: 0x0040
Group Read Allowed: 0x0020
Group Write Allowed: 0x0010
Group Execute Allowed: 0x0008
World Read Allowed: 0x0004
World Write Allowed: 0x0002
World Execute Allowed: 0x0001
3.7.5 Multiple Blocks in a Fragment: Yes No

No
File data is transferred in a series of blocks of a
maximum specified size. This indicates whether
only a single block or multiple blocks will be
sent in fragment.
3.7.6 Max number of Files Open at one time: Fixed at 0 0
3.8 O CTET S TRING P OINTS

If
list methods
All events
most recent event.
3.8.2 Octet Strings included in Class 0 response: Always If assigned
Never
part 5)
3.10 D ATA S ET P ROTOTYPE

Object Number: 85
Variation Number: 1
If
list methods
This version of the Device Profile has no requirement for describing Data Set Prototype capabilities and current settings. This page is intentionally left blank, existing as
placeholder for future use.
3.11 D ATA S ET D ESCRIPTOR C ONTENTS AND C HARACTERISTICS

Object Number: 86
Variation Numbers: 1 and 2
This version of the Device Profile has no requirement for describing Data Set Prototype capabilities and current settings. This page is intentionally left blank, existing as
3.11 D ATA S ET D ESCRIPTOR C ONTENTS AND C HARACTERISTICS

Object Number: 86
Variation Numbers: 1 and 2
This version of the Device Profile has no requirement for describing Data Set Descriptor capabilities and current settings. This page is intentionally left blank, existing as
4 Implementation Table
The following implementation table identifies which object groups and variations, function codes and qualifiers the device supports in both requests and
responses. The Request columns identify all requests that may be sent by a Master, or all requests that must be parsed by an Outstation. The Response
columns identify all responses that must be parsed by a Master, or all responses that may be sent by an Outstation.
REQUEST RESPONSE
DNP OBJECT GROUP & VARIATION Master may issue Master must parse
Outstation must parse Outstation may issue
Object
Variation Function Codes Qualifier Codes Function Codes Qualifier Codes
Group Description
Number (dec) (hex) (dec) (hex)
Number
0 211 Device Attributes Identification of support for 1(read) 00 (startstop), 129 (Response) 00 (startstop),
userspecific attributes 01 (startstop), 01 (startstop),
06 (no range, or 17 (index),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 212 Device Attributes Number of masterdefined 1(read) 00 (startstop), 129 (Response) 00 (startstop),
data set prototypes 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 213 Device Attributes Number of outstationdefined 1(read) 00 (startstop), 129 (Response) 00 (startstop),
data set prototypes 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 214 Device Attributes Number of masterdefined 1(read) 00 (startstop), 129 (Response) 00 (startstop),
data sets 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 215 Device Attributes Number of outstationdefined 1(read) 00 (startstop), 129 (Response) 00 (startstop),
data sets 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 216 Device Attributes Maximum number of binary 1(read) 00 (startstop), 129 (Response) 00 (startstop),
output objects per request 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
08 (limited qty),
17,
27,
28 (index)
0 216 Device Attributes Maximum number of binary 1(read) 00 (startstop), 129 (Response) 00 (startstop),
output objects per request 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 217 Device Attributes Local timing accuracy 1(read) 00 (startstop), 129 (Response) 00 (startstop),
01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 218 Device Attributes Duration of time accuracy 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 219 Device Attributes Support for analog output 1(read) 00 (startstop), 129 (Response) 00 (startstop),
events 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 220 Device Attributes Maximum analog output index 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 221 Device Attributes Number of analog outputs 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 222 Device Attributes Support for binary output 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 223 Device Attributes Maximum binary output index 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 224 Device Attributes Number of binary outputs 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 224 Device Attributes Number of binary outputs 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 225 Device Attributes Support for frozen counter 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 226 Device Attributes Support for frozen counters 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 227 Device Attributes Support for counter events 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 228 Device Attributes Maximum counter index 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 229 Device Attributes Number of counter points 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 230 Device Attributes Support for frozen analog 1(read) 00 (startstop), 129 (Response) 00 (startstop),
inputs 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 231 Device Attributes Support for analog input events 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 232 Device Attributes Maximum analog input index 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 232 Device Attributes Maximum analog input index 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 233 Device Attributes Number of analog input points 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 234 Device Attributes Support for doublebit binary 1(read) 00 (startstop), 129 (Response) 00 (startstop),
input events 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 235 Device Attributes Maximum doublebit binary 1(read) 00 (startstop), 129 (Response) 00 (startstop),
index 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 236 Device Attributes Number of doublebit binary 1(read) 00 (startstop), 129 (Response) 00 (startstop),
input points 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 237 Device Attributes Support for binary input events 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 238 Device Attributes Maximum binary input index 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 239 Device Attributes Number of binary input points 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 240 Device Attributes Maximum transmit fragment 1(read) 00 (startstop), 129 (Response) 00 (startstop),
size 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 240 Device Attributes Maximum transmit fragment 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 240 Device Attributes Maximum transmit fragment 2(write) 00 (startstop),
size 01 (startstop)
0 241 Device Attributes Maximum receive fragment 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 242 Device Attributes Device manufacturer's 1(read) 00 (startstop), 129 (Response) 00 (startstop),
software version 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 243 Device Attributes Device manufacturer's 1(read) 00 (startstop), 129 (Response) 00 (startstop),
hardware version 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 245 Device Attributes Userassigned location name 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 245 Device Attributes Userassigned location name 2(write) 00 (startstop),
01 (startstop)
0 246 Device Attributes User assigned ID code/number 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 246 Device Attributes User assigned ID code/number 2(write) 00 (startstop),
01 (startstop)
0 247 Device Attributes Userassigned device name 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 247 Device Attributes Userassigned device name 2(write) 00 (startstop),
01 (startstop)
0 248 Device Attributes Device serial number 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
28 (index)
0 247 Device Attributes Userassigned device name 2(write) 00 (startstop),
01 (startstop)
0 248 Device Attributes Device serial number 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 250 Device Attributes Device manufacturer's product 1(read) 00 (startstop), 129 (Response) 00 (startstop),
name and model 01 (startstop), 01 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 252 Device Attributes Device manufacturer's name 1(read) 00 (startstop), 129 (Response) 00 (startstop),
all), 28 (index)
07,
08 (limited qty),
17,
27,
28 (index)
0 254 Device Attributes Nonspecific all attributes 1(read) 00 (startstop),
request 01 (startstop),
06 (no range, or
all),
07,
08 (limited qty),
17,
27,
28 (index)
0 255 Device Attributes List of attribute variations 1(read) 00 (startstop), 129 (Response) 00 (startstop),
06 (no range, or 5B (free format)
all),
07,
08 (limited qty),
17,
27,
28 (index)
1 0 Binary Input any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
1 0 Binary Input any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
1 1 Binary Input Singlebit packed 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
06 (no range, or 17, 28 (index)
all),
07, 08 (limited
qty),
17, 27,
28 (index)
1 2 Binary Input Singlebit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
07, 08 (limited
qty),
17, 27,
28 (index)
1 2 Binary Input Singlebit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
2 0 Binary Input Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
2 1 Binary Input Change Event without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
2 1 Binary Input Change Event without time 130 (Unsol. Resp.) 17, 28 (index)

2 2 Binary Input Change Event with absolute time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
2 2 Binary Input Change Event with absolute time 130 (Unsol. Resp.) 17, 28 (index)

2 3 Binary Input Change Event with relative time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
2 3 Binary Input Change Event with relative time 130 (Unsol. Resp.) 17, 28 (index)

3 0 Doublebit Input any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
3 0 Doublebit Input any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
3 1 Doublebit Input Doublebit packed 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
3 2 Doublebit Input with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
4 0 Doublebit Input Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
4 1 Doublebit Input Change Event without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
4 1 Doublebit Input Change Event without time 130 (Unsol. Resp.) 17, 28 (index)

4 2 Doublebit Input Change Event with absolute 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
time all),
07, 08 (limited
qty)
4 2 Doublebit Input Change Event with absolute 130 (Unsol. Resp.) 17, 28 (index)

time
4 3 Doublebit Input Change Event with relative time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
4 1 Doublebit Input Change Event without time 130 (Unsol. Resp.) 17, 28 (index)

4 2 Doublebit Input Change Event with absolute 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
time all),
07, 08 (limited
qty)
4 2 Doublebit Input Change Event with absolute 130 (Unsol. Resp.) 17, 28 (index)

time
4 3 Doublebit Input Change Event with relative time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
4 3 Doublebit Input Change Event with relative time 130 (Unsol. Resp.) 17, 28 (index)

10 0 Binary Output any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 28 (index)
10 0 Binary Output any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
10 1 Binary Output packed format 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 28 (index)
10 1 Binary Output packed format 2(write) 00, 01 (startstop)
10 2 Continuous Control output status with flags 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 28 (index)
11 0 Binary Output Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
11 1 Binary Output Change Event status without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
11 1 Binary Output Change Event status without time 130 (Unsol. Resp.) 17, 28 (index)

11 2 Binary Output Change Event status with time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
11 2 Binary Output Change Event status with time 130 (Unsol. Resp.) 17, 28 (index)

12 0 Binary Output Command (CROB) any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
12 1 Binary Output Command (CROB) control relay 3(select) 17, 27, 129 (Response) echo of request
output block 28 (index)
12 1 Binary Output Command (CROB) control relay 4(operate) 17, 27, 129 (Response) echo of request
12 1 Binary Output Command (CROB) control relay 5(direct op.) 17, 27, 129 (Response) echo of request
12 1 Binary Output Command (CROB) control relay 6(direct op, no 17, 27, 129 (Response) echo of request
output block ack) 28 (index)
12 2 Binary Output Command pattern control block 3(select) 129 (Response) echo of request
07 (limited qty =
1)
12 1 Binary Output Command (CROB) control relay 5(direct op.) 17, 27, 129 (Response) echo of request
12 1 Binary Output Command (CROB) control relay 6(direct op, no 17, 27, 129 (Response) echo of request
output block ack) 28 (index)
12 2 Binary Output Command pattern control block 3(select) 129 (Response) echo of request
07 (limited qty =
1)
12 2 Binary Output Command pattern control block 4(operate) 129 (Response) echo of request

07 (limited qty =
1)
12 2 Binary Output Command pattern control block 5(direct op.) 129 (Response) echo of request

07 (limited qty =
1)
12 2 Binary Output Command pattern control block 6(direct op, no 129 (Response) echo of request

ack) 07 (limited qty =
1)
12 3 Binary Output Command pattern mask 3(select) 00, 01 (startstop) 129 (Response) echo of request

12 3 Binary Output Command pattern mask 4(operate) 00, 01 (startstop) 129 (Response) echo of request
12 3 Binary Output Command pattern mask 5(direct op.) 00, 01 (startstop) 129 (Response) echo of request
12 3 Binary Output Command pattern mask 6(direct op, no 00, 01 (startstop) 129 (Response) echo of request
ack)
13 0 Binary Output Command Event any variation 1(read) 06 (no range, or

all),
07, 08 (limited
qty)
13 1 Binary Output Command Event without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
13 1 Binary Output Command Event without time 130 (Unsol. Resp.) 17, 28 (index)

13 2 Binary Output Command Event with time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
13 2 Binary Output Command Event with time 130 (Unsol. Resp.) 17, 28 (index)

20 0 Counter any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
20 0 Counter any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
20 0 Counter any variation 7(freeze) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty)
20 0 Counter any variation 8(freeze, no ack) 00, 01 (start

stop),
06 (no range, or
all),
07, 08 (limited
qty)
20 0 Counter any variation 9(freeze & clear ) 00, 01 (start

stop),
06 (no range, or
all),
07, 08 (limited
qty)
20 0 Counter any variation 10(frz & clr, no 00, 01 (start

ack) stop),
06 (no range, or
all),
07, 08 (limited
qty)
20 1 Counter 32bit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start

stop), stop),
06 (no range, or
all),
07, 08 (limited
qty)
20 0 Counter any variation 10(frz & clr, no 00, 01 (start

ack) stop),
06 (no range, or
all),
07, 08 (limited
qty)

stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
20 5 Counter 32bit with flag and time 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
20 6 Counter 16bit with flag and time 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
21 0 Frozen Counter any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
21 0 Frozen Counter any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
21 1 Frozen Counter 32bit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
21 2 Frozen Counter 16bit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
21 5 Frozen Counter 32bit with flag and time 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
07, 08 (limited
qty),
17, 27,
28 (index)
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
22 0 Counter Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
22 1 Counter Change Event 32bit with flag 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
22 1 Counter Change Event 32bit with flag 130 (Unsol. Resp.) 17, 28 (index)

22 2 Counter Change Event 16bit with flag 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
22 2 Counter Change Event 16bit with flag 130 (Unsol. Resp.) 17, 28 (index)

22 5 Counter Change Event 32bit with flag and time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
22 5 Counter Change Event 32bit with flag and time 130 (Unsol. Resp.) 17, 28 (index)

22 6 Counter Change Event 16bit with flag and time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
22 6 Counter Change Event 16bit with flag and time 130 (Unsol. Resp.) 17, 28 (index)

23 0 Frozen Counter Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
23 1 Frozen Counter Change Event 32bit with flag 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
23 1 Frozen Counter Change Event 32bit with flag 130 (Unsol. Resp.) 17, 28 (index)

all),
07, 08 (limited
qty)

and time all),
07, 08 (limited
qty)
07, 08 (limited
qty)

and time all),
07, 08 (limited
qty)

and time
and time all),
07, 08 (limited
qty)

and time
30 0 Analog Input any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all)
30 0 Analog Input any variation 22(assign class) 00, 01 (start

stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
30 1 Analog Input 32bit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
30 2 Analog Input 16bit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
30 3 Analog Input 32bit without flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
30 4 Analog Input 16bit without flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
30 5 Analog Input singleprecision, floatingpoint with 1(read) 00, 01 (start 129 (Response) 00, 01 (start
flag stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
30 6 Analog Input doubleprecision, floatingpoint 1(read) 00, 01 (start 129 (Response) 00, 01 (start
with flag stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
32 0 Analog Input Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
07, 08 (limited
qty),
17, 27,
28 (index)
32 0 Analog Input Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
32 1 Analog Input Change Event 32bit without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
32 1 Analog Input Event – 32bit without time 130 (Unsol. Resp.) 17, 28 (index)

32 2 Analog Input Change Event 16bit without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
32 2 Analog Input Change Event 16bit without time 130 (Unsol. Resp.) 17, 28 (index)

32 3 Analog Input Change Event 32bit with time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
32 3 Analog Input Change Event 32bit with time 130 (Unsol. Resp.) 17, 28 (index)

32 4 Analog Input Change Event 16bit with time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
32 4 Analog Input Change Event 16bit with time 130 (Unsol. Resp.) 17, 28 (index)

32 5 Analog Input Change Event singleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
floatingpoint without time all),
07, 08 (limited
qty)
32 5 Analog Input Change Event singleprecision, 130 (Unsol. Resp.) 17, 28 (index)

floatingpoint without time
32 6 Analog Input Change Event doubleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
32 6 Analog Input Change Event doubleprecision, 130 (Unsol. Resp.) 17, 28 (index)

32 7 Analog Input Change Event singleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
floatingpoint with time all),
07, 08 (limited
qty)
32 7 Analog Input Change Event singleprecision, 130 (Unsol. Resp.) 17, 28 (index)

floatingpoint with time
32 8 Analog Input Change Event doubleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
32 8 Analog Input Change Event doubleprecision, 130 (Unsol. Resp.) 17, 28 (index)

34 0 Analog Input Deadband any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
34 1 Analog Input Deadband 16bit 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
34 1 Analog Input Deadband 16bit 2(write) 00, 01 (start
stop),
07, 08 (limited
qty),
17, 27,
28 (index)
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
34 2 Analog Input Deadband 32bit 2(write) 00, 01 (start
stop),
07, 08 (limited
qty),
17, 27,
28 (index)
34 3 Analog Input Deadband singleprecision, 1(read) 00, 01 (start 129 (Response) 00, 01 (start
floatingpoint stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
34 3 Analog Input Deadband singleprecision, 2(write) 00, 01 (start
floatingpoint stop),
07, 08 (limited
qty),
17, 27,
28 (index)
40 0 Analog Output Status any variation 1(read) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
40 0 Analog Output Status any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
40 1 Analog Output Status 32bit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
40 2 Analog Output Status 16bit with flag 1(read) 00, 01 (start 129 (Response) 00, 01 (start
stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
40 3 Analog Output Status singleprecision, floating 1(read) 00, 01 (start 129 (Response) 00, 01 (start
point with flag stop), stop),
all),
07, 08 (limited
qty),
17, 27,
28 (index)
40 4 Analog Output Status doubleprecision, floating 1(read) 00, 01 (start 129 (Response) 00, 01 (start
all),
07, 08 (limited
qty),
17, 27,
28 (index)
07, 08 (limited
qty),
17, 27,
28 (index)
40 4 Analog Output Status doubleprecision, floating 1(read) 00, 01 (start 129 (Response) 00, 01 (start
all),
07, 08 (limited
qty),
17, 27,
28 (index)
41 0 Analog Output Block any variation 22(assign class) 00, 01 (start
stop),
06 (no range, or
all),
07, 08 (limited
qty),
17, 27,
28 (index)
41 1 Analog Output Block 32bit 3(select) 17, 27, 129 (Response) echo of request
28 (index)
41 1 Analog Output Block 32bit 4(operate) 17, 27, 129 (Response) echo of request
28 (index)
41 1 Analog Output Block 32bit 5(direct op.) 17, 27, 129 (Response) echo of request
28 (index)
41 1 Analog Output Block 32bit 6(direct op, no 17, 27, 129 (Response) echo of request
ack) 28 (index)
41 2 Analog Output Block 16bit 3(select) 17, 27, 129 (Response) echo of request
28 (index)
41 2 Analog Output Block 16bit 4(operate) 17, 27, 129 (Response) echo of request
28 (index)
41 2 Analog Output Block 16bit 5(direct op.) 17, 27, 129 (Response) echo of request
28 (index)
41 2 Analog Output Block 16bit 6(direct op, no 17, 27, 129 (Response) echo of request
ack) 28 (index)
41 3 Analog Output Block singleprecision, floating 3(select) 17, 27, 129 (Response) echo of request
point 28 (index)
41 3 Analog Output Block singleprecision, floating 4(operate) 17, 27, 129 (Response) echo of request
point 28 (index)
41 3 Analog Output Block singleprecision, floating 5(direct op.) 17, 27, 129 (Response) echo of request
point 28 (index)
41 3 Analog Output Block singleprecision, floating 6(direct op, no 17, 27, 129 (Response) echo of request
point ack) 28 (index)
41 4 Analog Output Block doubleprecision, floating 3(select) 17, 27, 129 (Response) echo of request
point 28 (index)
41 4 Analog Output Block doubleprecision, floating 4(operate) 17, 27, 129 (Response) echo of request
point 28 (index)
41 4 Analog Output Block doubleprecision, floating 5(direct op.) 17, 27, 129 (Response) echo of request
point 28 (index)
41 4 Analog Output Block doubleprecision, floating 6(direct op, no 17, 27, 129 (Response) echo of request
point ack) 28 (index)
42 0 Analog Output Change Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
42 1 Analog Output Change Event 32bit without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

all),
07, 08 (limited
qty)
42 1 Analog Output Change Event 32bit without time 130 (Unsol. Resp.) 17, 28 (index)

42 2 Analog Output Change Event 16bit without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
42 2 Analog Output Change Event 16bit without time 130 (Unsol. Resp.) 17, 28 (index)

42 3 Analog Output Change Event 32bit with time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
42 3 Analog Output Change Event 32bit with time 130 (Unsol. Resp.) 17, 28 (index)

all),
07, 08 (limited
qty)
07, 08 (limited
qty)

all),
07, 08 (limited
qty)

42 5 Analog Output Change Event singleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
42 5 Analog Output Change Event singleprecision, 130 (Unsol. Resp.) 17, 28 (index)

42 6 Analog Output Change Event doubleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
42 6 Analog Output Change Event doubleprecision, 130 (Unsol. Resp.) 17, 28 (index)

42 7 Analog Output Change Event singleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
42 7 Analog Output Change Event singleprecision, 130 (Unsol. Resp.) 17, 28 (index)

42 8 Analog Output Change Event doubleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
42 8 Analog Output Change Event doubleprecision, 130 (Unsol. Resp.) 17, 28 (index)

43 0 Analog Output Command Event any variation 1(read) 06 (no range, or
all),
07, 08 (limited
qty)
43 1 Analog Output Command Event 32bit without 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

time all),
07, 08 (limited
qty)
43 1 Analog Output Command Event 32bit without 130 (Unsol. Resp.) 17, 28 (index)

time
43 2 Analog Output Command Event 16bit without 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
time all),
07, 08 (limited
qty)
43 2 Analog Output Command Event 16bit without 130 (Unsol. Resp.) 17, 28 (index)

time
43 3 Analog Output Command Event 32bit with time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
43 3 Analog Output Command Event 32bit with time 130 (Unsol. Resp.) 17, 28 (index)

43 4 Analog Output Command Event 16bit with time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
all),
07, 08 (limited
qty)
43 4 Analog Output Command Event 16bit with time 130 (Unsol. Resp.) 17, 28 (index)

43 5 Analog Output Command Event singleprecision, 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
07, 08 (limited
qty)
43 5 Analog Output Command Event singleprecision, 130 (Unsol. Resp.) 17, 28 (index)

43 6 Analog Output Command Event double 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
precision, floatingpoint without time all),
07, 08 (limited
qty)
43 6 Analog Output Command Event double 130 (Unsol. Resp.) 17, 28 (index)

precision, floatingpoint without time
07, 08 (limited
qty)

qty)

precision, floatingpoint without time
07, 08 (limited
qty)

43 8 Analog Output Command Event double 1(read) 06 (no range, or 129 (Response) 17, 28 (index)
precision, floatingpoint with time all),
07, 08 (limited
qty)

precision, floatingpoint with time
50 1 Time and Date absolute time 1(read) 129 (Response) 07 (limited qty =
07 (limited qty = 1)
1)
50 1 Time and Date absolute time 2(write)
07 (limited qty =
1)
50 3 Time and Date absolute time at last recorded 2(write)
time 07 (limited qty =
1)
51 1 Time and Date CTO absolute time, synchronized 129 (Response) 07 (limited qty =

1)
51 1 Time and Date CTO absolute time, synchronized 130 (Unsol. Resp.) 07 (limited qty =

1)
51 2 Time and Date CTO absolute time, un 129 (Response) 07 (limited qty =

synchronized 1)
51 2 Time and Date CTO absolute time, un 130 (Unsol. Resp.) 07 (limited qty =

synchronized 1)
52 1 Time Delay coarse 129 (Response) 07 (limited qty =

1)
52 2 Time Delay fine 129 (Response) 07 (limited qty =

1)
60 1 Class Objects class 0 data 1(read) 06 (no range, or

all)
60 1 Class Objects class 0 data 22(assign class) 06 (no range, or

all)

all),
07, 08 (limited
qty)
60 2 Class Objects class 1 data 20(enable unsol.) 06 (no range, or

all)
60 2 Class Objects class 1 data 21(disable unsol.) 06 (no range, or

all)

all)

all),
07, 08 (limited
qty)

all)

all)

all)

all),
07, 08 (limited
qty)

all)

all)

all)
80 1 Internal Indications packed format 1(read) 00, 01 (startstop) 129 (Response) 00, 01 (startstop)

80 1 Internal Indications packed format 2(write) 00 (startstop)
91 1 Status of Requested Operation 129 (Response) 07 (limited qty =
1)
all)
80 1 Internal Indications packed format 1(read) 00, 01 (startstop) 129 (Response) 00, 01 (startstop)

80 1 Internal Indications packed format 2(write) 00 (startstop)
91 1 Status of Requested Operation 129 (Response) 07 (limited qty =
1)
5 Data Points List (outstation only)
This part of the Device Profile shows, for each data type, a table defining the data points available in the device or a description of how this information
can be obtained if the database is configurable.
5.1 Definition of Binary Input Point List: Fixed, list shown in table below
Configurable (current list may be shown in table below)
List of addressable points. Points that do not exist (for example,
because an option is not installed) are omitted from the table. Other, explain:
Note: the number of binary inputs present in the device, and the
maximum binary input index, are available remotely using object
Group 0 Variations 239 and 238.
Binary Input points list:
Event
Class
Point Name for State Name for State
Name Assigned Description
Index when value is 0 when value is 1
(1, 2, 3 or
none)
5.2 Definition of Double Bit Input Point List: Fixed, list shown in table below
Note: the number of doublebit inputs present in the device, and the
maximum doublebit input index, are available remotely using object
Doublebit Input points list:
Event
Class Name for State Name for State Name for State Name for State
Point
Name Assigned when value is 0 when value is 1 when value is 2 when value is 3 Description
Index
(1, 2, 3 or (intermediate) (off) (on) (indeterminate)
none)
5.3 Definition of Binary Output Status / Control Relay Output Fixed, list shown in table below
Block Points List: Configurable (current list may be shown in table below)
List of addressable points. Points that do not exist (for example, Other, explain:
because an option is not installed) are omitted from the table.
Note: the number of binary outputs present in the device, and the
maximum binary output index, are available remotely using object
Binary Output Status and CROB points list:
Event Class
Supported Control Operations Assigned
(1,2,3 or none)
Name Name
Direct Cancel for for
Point Direct Operate Pulse Pulse Latch Latch Count Currently State State
Name Select/Operate Trip Close Change Command Description
Index Operate No On Off On Off > 1 Running when when
Ack Operation value value
is 0 is 1
5.4 Definition of Counter / Frozen Counter Point List: Fixed, list shown in table below
Note: the number of counters present in the device, and the
maximum counter index, are available remotely using object Group 0
Variations 229 and 228.
Counter / Frozen Counter points list:
Event Class
Event Class
Frozen Assigned to
Assigned to
Point Counter Frozen
Name Counter Description
maximum counter index, are available remotely using object Group 0
Variations 229 and 228.
Counter / Frozen Counter points list:
Event Class
Event Class
Frozen Assigned to
Assigned to
Point Counter Frozen
Name Counter Description
Index Exists (Yes or Counter
Events (1, 2,
No) Events (1, 2,
3 or none)
3 or none)
5.5 Definition of Analog Input Point List: Fixed, list shown in table below
Note: the number of analog inputs present in the device, and the
maximum analog input index, are available remotely using object
Analog Input points list:
. Transmitted Value Scaling .
Event
Class
Point Min Max
Name Assigned Multiplier Offset Units Resolution Description
Index int / flt int / flt
(1, 2, 3 or
none)
5.6 Definition of Analog Output Status / Analog Output Block Fixed, list shown in table below
Point List: Configurable (current list may be shown in table below)
List of addressable points. Points that do not exist (for example, Other, explain:
because an option is not installed) are omitted from the table.
Note: the number of analog outputs present in the device, and the
maximum analog output index, are available remotely using object
Analog Output points list:
Event Class
Transmitted
. Supported Control Operations Scaling . Assigned (1, 2, 3 .
Value
or none)
Direct
Point Direct Operate
Name Select/Operate Min Max Min Max Units Resolution Change Command Description
Index Operate No
Ack
5.7 Definition of File Names that may be read or written: Fixed, list shown in table below
Other, explain:
Sequential Files list:
Authentication
. .
Required for:
Event Class
File Name Assigned (1, Read Write Delete Description
2, 3 or none)
5.8 Definition of Octet String Point List: Fixed, list shown in table below
Octet String points list:
Event Class
Point
Name Assigned (1, Description
Index
2, 3 or none)
5.9 Definition of Virtual Terminal Port Numbers: Fixed, list shown in table below
Ports list:
Virtual
Port Event Class
Number Name Assigned (1, Description
(Point 2, 3 or none)
Index)
Ports list:
Virtual
Port Event Class
Number Name Assigned (1, Description
(Point 2, 3 or none)
Index)
5.10 Definition of Data Set Prototypes: Fixed, list shown in table below
List of all data set prototypes. The following table is repeated for
each Data Set Prototype defined. Other, explain:
Note: the number of data set prototypes known to the device are
available remotely using object Group 0 Variations 212 and 213.
5.11 Definition of Data Set Descriptors: Fixed, list shown in table below
List of all data set descriptors. The following table is repeated for
each Data Set Descriptor defined. Other, explain:
Note: the number of data sets known to the device are available
remotely using object Group 0 Variations 214 and 215.
5.12 Data Set Descriptors Point Index Attributes
The following table is optional and correlates data set elements to point indexes of standard DNP3 Data Objects. The element number
below refers to the position in the present value object (object 87) or event (object 88) data set and will not match the element number in
the data set descriptor or data set prototype tables above.
End of Device Profile for Reference Device
End of Complete Device Profile

PMT Hps Controledge Rtu and PLC dnp3 Outstation Device Profile Rtdoc x346 en e

Uploaded by

Copyright:

Available Formats

PMT Hps Controledge Rtu and PLC dnp3 Outstation Device Profile Rtdoc x346 en e

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PMT Hps Controledge Rtu and PLC dnp3 Outstation Device Profile Rtdoc x346 en e

Uploaded by

Copyright:

Available Formats

DNP3

2016­05­24 1 Initial revision for firmware version SC­UCMX01_120.1­21.0 of Honeywell with

2018­04­04 2 Update product name as ControlEdge RTU; Update hardware version: Honeywell with

2019­10­23 3 Update product name as ControlEdge RTU and PLC; Add hardware Honeywell with

2021­08­26 4 Update the maximum number of obejects allowed in a single control Honeywell with

2022­12­02 5 Updated the section 1.12 Security Parameters (1.12.1 – 1.12.17) Honeywell

R EFERENCE D EVICE :

1.1.1 Device Function: Master Master

1.1.7 DNP Levels Supported for: Outstations Only Level 4

1.1.8 Supported Function Blocks: Self Address Support Self Address

1.1.8 Supported Function Blocks: Self Address Support Self Address

1.1.10 Methods to set Configurable XML ­ Loaded via DNP3 File Transfer Software

1.1.11 DNP3 XML files available On­line: Rd Wr Filename Description of Contents Rd Wr Filename

1.1.12 External DNP3 XML files available Off­ Rd Wr Filename Description of Contents Rd Wr Filename

1.1.13 Connections Supported: Serial (complete section 1.2) IP Networking

1.3.3 IP Address of this Device: *.*.*.* software

1.3.4 Subnet Mask: *.*.*.* software

1.3.5 Gateway IP Address: *.*.*.* software

1.3.6 Accepts TCP Connections or UDP Allows all (show as *.*.*.* in 1.3.7) Allows all

1.3.9 TCP Listen Port Number of remote device: Not Applicable (Outstation w/o dual end Not Applicable

1.3.10 TCP Keep­alive timer: Fixed at ms 5000 ms software

1.3.11 Local UDP port: Fixed at 20,000 20000 software

1.3.13 Destination UDP port for initial unsolicited None 20000 software

1.3.14 Destination UDP port for responses None 20000 software

1.4.2 DNP3 Source Address Validation: Never Never software

1.4.3 DNP3 Source Address(es) expected when Configurable to any 16 bit DNP Data Link 30000 software

1.4.4 Self Address Support using address Yes (only allowed if configurable) No software

1.4.5 Sends Confirmed User Data Frames: Never Never software

1.4.5 Sends Confirmed User Data Frames: Never Never software

1.4.6 Data Link Layer Confirmation Timeout: None 2000ms software

1.4.7 Maximum Data Link Retries: None 3 software

1.4.8 Maximum number of octets Transmitted in Fixed at 292

1.4.9 Maximum number of octets that can be Fixed at 292

1.5.3 Maximum number of octets that can be Fixed at 2048

1.5.5 Maximum number of objects allowed in a Fixed at 10(enter 0 if controls are not 10

1.5.6 Maximum number of objects allowed in a Fixed at 10(enter 0 if controls are not 10

1.5.8 Supports mixed object groups (AOBs, Not applicable ­ controls are not supported Yes

1.7.2 How often is time synchronization required Never needs time Periodically, every 1800 software

1.7.6 Event Buffer Organization: per Object Group per Object Group

1.8.3 Unsolicited Response Confirmation Fixed at ms 10000 ms software

1.9.2 Number of class 2 events: Class 2 not used to trigger Unsolicited 5 software

1.9.3 Number of class 3 events: Class 3 not used to trigger Unsolicited 5 software

1.9.5 Hold time after class 1 event: Class 1 not used to trigger Unsolicited 5000 ms software

1.9.6 Hold time after class 2 event: Class 2 not used to trigger Unsolicited 5000 ms software

1.9.7 Hold time after class 3 event: Class 3 not used to trigger Unsolicited 5000 ms software

1.9.9 Retrigger Hold Time: Hold­time timer will be retriggered for each Not retriggered

1.9.9 Retrigger Hold Time: Hold­time timer will be retriggered for each Not retriggered

1.10.6 Maximum time from start­up to IIN 1.4 Fixed at 0ms 0 ms

1.10.7 Maximum Event Time­tag error for local Fixed at 0ms 0 ms

1.12.4 Aggressive mode of operation (receive): Yes, accepts aggressive software

1.12.5 Aggressive mode of operation (issuing): Yes, issues aggressive software

1.12.5 Aggressive mode of operation (issuing): Yes, issues aggressive software

1.12.6 Session key change interval: Can be disabled Enabled software

1.12.8 Maximum error count: Configurable, range 0 to 4294967295 2 software

1.12.9 MAC algorithm requested in a challenge SHA­1 (truncated to the leftmost 4 octets) software

1.12.11 Cipher Suites used with DNP Not relevant ­ TLS is not used software

1.12.11 Cipher Suites used with DNP Not relevant ­ TLS is not used software

1.12.12 Change cipher request timeout: Not relevant ­ TLS is not used software

1.12.14 Certificate Revocation check time: Not relevant ­ TLS is not used software

20160524 1 Initial revision for firmware version SCUCMX01_120.121.0 of Honeywell with

20180404 2 Update product name as ControlEdge RTU; Update hardware version: Honeywell with

20191023 3 Update product name as ControlEdge RTU and PLC; Add hardware Honeywell with

20210826 4 Update the maximum number of obejects allowed in a single control Honeywell with

20221202 5 Updated the section 1.12 Security Parameters (1.12.1 – 1.12.17) Honeywell

1.1.10 Methods to set Configurable XML Loaded via DNP3 File Transfer Software

1.1.11 DNP3 XML files available Online: Rd Wr Filename Description of Contents Rd Wr Filename

1.1.12 External DNP3 XML files available Off Rd Wr Filename Description of Contents Rd Wr Filename

1.3.3 IP Address of this Device: ... software

1.3.4 Subnet Mask: ... software

1.3.5 Gateway IP Address: ... software

1.3.6 Accepts TCP Connections or UDP Allows all (show as ... in 1.3.7) Allows all

1.3.10 TCP Keepalive timer: Fixed at ms 5000 ms software

1.5.8 Supports mixed object groups (AOBs, Not applicable controls are not supported Yes

1.9.9 Retrigger Hold Time: Holdtime timer will be retriggered for each Not retriggered

1.9.9 Retrigger Hold Time: Holdtime timer will be retriggered for each Not retriggered

1.10.6 Maximum time from startup to IIN 1.4 Fixed at 0ms 0 ms

1.10.7 Maximum Event Timetag error for local Fixed at 0ms 0 ms

1.12.9 MAC algorithm requested in a challenge SHA1 (truncated to the leftmost 4 octets) software

1.12.11 Cipher Suites used with DNP Not relevant TLS is not used software

1.12.11 Cipher Suites used with DNP Not relevant TLS is not used software

1.12.12 Change cipher request timeout: Not relevant TLS is not used software

1.12.14 Certificate Revocation check time: Not relevant TLS is not used software

3.1 S INGLEB IT B INARY I NPUT P OINTS

3.1 S INGLEB IT B INARY I NPUT P OINTS

3.1.2 Event Variation reported when variation 0 Variation 1 without time Two software

3.2 D OUBLEBIT I NPUT P OINTS

3.2.2 Event Variation reported when variation 0 Variation 1 without time Two software

3.3.5 Static Variation reported when variation 0 Variation 1 Continuous control Two software

3.3.6 Event Variation reported when variation 0 Variation 1 without time Two software

3.3.7 Command Event Variation reported when Variation 1 without time Two software

integrating keeps track of the accumulated Based on point index (add column to table in

3.6.4 Event Variation reported when variation 0 Variation 1 32bit without time Seven software

2 1 Binary Input Change Event without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

2 1 Binary Input Change Event without time 130 (Unsol. Resp.) 17, 28 (index)

2 2 Binary Input Change Event with absolute time 130 (Unsol. Resp.) 17, 28 (index)

2 3 Binary Input Change Event with relative time 130 (Unsol. Resp.) 17, 28 (index)

4 1 Doublebit Input Change Event without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

4 1 Doublebit Input Change Event without time 130 (Unsol. Resp.) 17, 28 (index)

4 2 Doublebit Input Change Event with absolute 130 (Unsol. Resp.) 17, 28 (index)

4 1 Doublebit Input Change Event without time 130 (Unsol. Resp.) 17, 28 (index)

4 2 Doublebit Input Change Event with absolute 130 (Unsol. Resp.) 17, 28 (index)

4 3 Doublebit Input Change Event with relative time 130 (Unsol. Resp.) 17, 28 (index)

11 1 Binary Output Change Event status without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)

11 1 Binary Output Change Event status without time 130 (Unsol. Resp.) 17, 28 (index)

11 2 Binary Output Change Event status with time 130 (Unsol. Resp.) 17, 28 (index)

12 2 Binary Output Command pattern control block 4(operate) 129 (Response) echo of request

12 2 Binary Output Command pattern control block 5(direct op.) 129 (Response) echo of request

12 2 Binary Output Command pattern control block 6(direct op, no 129 (Response) echo of request

12 3 Binary Output Command pattern mask 3(select) 00, 01 (startstop) 129 (Response) echo of request

13 0 Binary Output Command Event any variation 1(read) 06 (no range, or

13 1 Binary Output Command Event without time 1(read) 06 (no range, or 129 (Response) 17, 28 (index)