Interoperability

Introduction

The purpose of this information is to describe the specific implementation of the Distributed Network Protocol (DNP3) within the BMENOR2200H module as master and slave.

This information, in conjunction with the DNP3 Basic 4 Document Set and the DNP3 Subset Definitions Document, provides detailed information on how to communicate with the BMENOR2200H module as master via the DNP3 protocol.

This implementation of DNP3 is fully compliant with DNP3 Subset Definition Level 3.

DNP3 Device Profile - Master

This table provides a Device Profile Document in the standard format defined in the DNP3 Subset Definitions Document. While it is referred to in the DNP3 Subset Definitions as a Document, it is only a component of a total interoperability guide. This table uses a BMENOR2200H module as a master as an example. (Your module may be different.)

Parameter	Capabilities	Value
Device Identification
Device Function	Master	Master
Vendor Name	–	Schneider Electric Industries SAS
Device Name	Device Name	BMENOR2200H
Device Manufacturer hardware version	Device Manufacturer hardware version	N/A
Device Manufacturer software version	Device Manufacturer software version	1,0 IR14
Device Profile Document Version Number	Device Profile Document Version Number	1
DNP3 Levels Supported	For both requests and responses: None, Levels 1...5	For requests: Level 3
DNP3 Levels Supported	For both requests and responses: None, Levels 1...5	For responses: Level 3
Supported Function Blocks	Self Address Support	Secure Authentication
Supported Function Blocks	Secure Authentication	Secure Authentication
Notable Additions	Refer to Implementation Table
Methods to set Configurable Parameters	Software	Software (EcoStruxure Control Expert)
Methods to set Configurable Parameters	Proprietary file loaded via other transport mechanism	Software (EcoStruxure Control Expert)
DNP3 XML files available On-line	dnpDP.xml	–
	dnpDPC.xml
	dnpDPCfg.xml
External DNP3 XML files available Off-line	dnpDP.xml (read)	dnpDP.xml (read)
Connections Supported	IP Networking	IP Networking
Conformance Testing	N/A	–
Serial Connections
Not Supported	–	–
IP Networking
Port Name	–	Ethernet
Type of End Point	TCP Initiating	TCP Initiating
Type of End Point	TCP Datagram	TCP Initiating
IP Address of this device	–	0.0.0.0
Subnet Mask	–	255.255.255.255
Gateway IP Address	–	0.0.0.0
Accepts TCP Connections or UDP Datagrams from	Limits based on IP address	IP address
IP Addresses from which TCP Connections or UDP Datagrams are accepted	–	192.168.0.1
TCP Listen Port Number	N/A	N/A
TCP Listen Port Number of remote device	Configurable range 1...65536	20000
TCP Keep-alive timer	Fixed at 75000 ms	75000 ms
Local UDP Port	Configurable range 1...65536	20000
Destination UDP Port for DNP3 Requests	Configurable range 1...65536	20000
Destination UDP Port for initial unsolicited null responses	None	None
Destination UDP Port for DNP3 Responses	Configurable range 1...65536	20000
Multiple outstation connections	Supports multiple outstations	TRUE
Multiple master connections	Not supported	Not supported
Time synchronization support	DNP3 LAN procedure (function code 24)	LAN procedure
	DNP3 Write Time
	Other
Link Layer
Data Link Address	Configurable range 0...65519	4
DNP3 Source Address Validation	Always, single address	Always, single address
DNP3 Source Addresses expected when Validation is Enabled	Configurable range 0...65519	3
Self Address Support using address 0xFFFC	Yes	No
Self Address Support using address 0xFFFC	No	No
Sends Confirmed User Data Frames	Never	Never
	Always
	Sometimes
Data Link Layer Confirmation Timeout	Configurable range 0...2147483647 ms	2000 ms
Maximum Data Link Retries	Configurable range 0...255	3
Maximum number of octets Transmitted in a Data Link Frame	Configurable range 24...292	292
Maximum number of octets that can be Received in a Data Link Frame	Configurable range 24...292	292
Application Layer
Maximum number of octets Transmitted in an Application Layer Fragment other than File Transfer	Configurable range 0...2048	2048
Maximum number of octets Transmitted in an Application Layer Fragment containing File Transfer	Fixed at 0	0
Maximum number of octets that can be received in an Application Layer Fragment	Configurable range 0...2048	2048
Timeout waiting for Complete Application Layer Fragment	None	None
Maximum number of objects allowed in a single control request for CROB (Group 12)	Fixed at 10	10
Maximum number of objects allowed in a single control request for Analog Outputs (Group 31)	Configurable range 1...512	10
Maximum number of objects allowed in a single control request for Data Sets (Groups 85, 86, 87)	Configurable range 1...128	8
Supports mixed object groups (AOBs, CROBs and Data Sets) in the same control request	Yes	Yes
	No	Yes
Control Status Codes Supported	4 NOT_SUPPORTED	–
Control Status Codes Supported	8 TOO_MANY_OBJS	–
Master-Only Properties
Timeout waiting for Complete Application Layer Responses (ms)	–	–
Maximum Application Layer Retries for Request Messages	–	–
Timeout waiting for First or Next Fragment of an Application Layer Response	–	–
Issuing controls to Off-line devices	–	–
Issuing controls to off-scan devices	–	–
Maximum Application Layer Retries for Control Select Messages (same sequence number)	–	–
Maximum Application Layer Retries for Control Select Messages (new sequence number)	–	–
Security Parameters
DNP3 device support for secure authentication	Version 2 (IEEE 1815-2010)	–
DNP3 device support for secure authentication	Version 5 (IEEE 1815-2012)	–
Maximum number of users	Configurable range 1...300	Maximum number of user supported: 0
Security message response timeout	Configurable range 1...640 ms	2 ms
Aggressive mode of operation (receive)	Yes	Yes
Aggressive mode of operation (receive)	No	Yes
Aggressive mode of operation (issuing)	Yes	No
Aggressive mode of operation (issuing)	No	No
Session key change interval	Configurable range 60...604800 seconds (when enabled	Enabled at 900 seconds
Session key change message count	Configurable range 0...65535	1000
Maximum error count (SAv2 only)	Configurable range 0...255	2
MAC algorithm requested in a challenge exchange	SHA-1 (truncated to the leftmost 4 octets)	SHA-256 (16)
	SHA-1 (truncated to the leftmost 8 octets)
	SHA-1 (truncated to the leftmost 10 octets)
	SHA-256 (truncated to the leftmost 8 octets)
	SHA-256 (truncated to the leftmost 16 octets)
Key-wrap algorithm to encrypt session keys	AES-128	AES-128
Key-wrap algorithm to encrypt session keys	AES-256	AES-128
Cipher Suites used with DNP implementations using TLS	Not relevant TLS is not used	Not relevant
Change cipher request timeout	Not relevant TLS is not used	Not relevant
Number of Certificate Authorities supported	–	–
Certificate Revocation check time	Not relevant TLS is not used	Not relevant
Additional critical function codes	None	None
Other critical fragments	None	None
Support for remote update key changes	None	None
Default user credentials are permitted to expire	Yes	No
Default user credentials are permitted to expire	No	No
Secure Authentication enabled	Configurable: On or Off	Off
Length of the challenge data	Configurable range 4...60 octets	4 octets
Maximum statistic counts (SAv5):
Max Authentication Failures	Configurable range 4...60	4
Max Reply Timeouts	Configurable range 1...65535	3
Max Authentication Rekeys	Configurable range 1...65535	3
Max Error Messages Sent	Configurable range 1...65535	3
Broadcast Functionality
Disabled Not configurable	–	–

DNP3 Device Profile - Outstation

Parameter	Capabilities	Value
Device Identification
Device Function	Outstation	Outstation
Vendor Name	–	Schneider Electric Industries SAS
Device Name	Device Name	BMENOR2200H
Device Manufacturer hardware version	Device Manufacturer hardware version	N/A
Device Manufacturer software version	Device Manufacturer software version	1,0 IR14
Device Profile Document Version Number	Device Profile Document Version Number	1
DNP3 Levels Supported	For both requests and responses: None, Levels 1...5	For requests: Level 3
DNP3 Levels Supported	For both requests and responses: None, Levels 1...5	For responses: Level 3
Supported Function Blocks	Self Address Support	Secure Authentication
Supported Function Blocks	Secure Authentication	Secure Authentication
Notable Additions	Refer to Implementation Table
Methods to set Configurable Parameters	Software	Software (EcoStruxure Control Expert)
Methods to set Configurable Parameters	Proprietary file loaded via other transport mechanism	Software (EcoStruxure Control Expert)
DNP3 XML files available On-line	dnpDP.xml	–
	dnpDPC.xml
	dnpDPCfg.xml
External DNP3 XML files available Off-line	dnpDP.xml (read)	dnpDP.xml (read)
Connections Supported	IP Networking	IP Networking
Conformance Testing	Independently tested	Independently tested
Serial Connections
Not Supported	–	–
IP Networking
Port Name	–	Ethernet
Type of End Point	TCP Listening	TCP Listening
Type of End Point	TCP Datagram	TCP Listening
IP Address of this device	–	0.0.0.0
Subnet Mask	–	255.255.255.255
Gateway IP Address	–	0.0.0.0
Accepts TCP Connections or UDP Datagrams from	Allows All (...)	Allows All
	Limits based on IP address
	Limits based on list of IP addresses
IP Addresses from which TCP Connections or UDP Datagrams are accepted	–	...
TCP Listen Port Number	Configurable range 1...65536	20000
TCP Listen Port Number of remote device	N/A	N/A
TCP Keep-alive timer	Fixed at 75000 ms	75000 ms
Local UDP Port	Configurable range 1...65536	20000
Destination UDP Port for DNP3 Requests	Configurable range 1...65536	20000
Destination UDP Port for initial unsolicited null responses	None	None
Destination UDP Port for DNP3 Responses	Configurable range 1...65536	20000
Multiple outstation connections	N/A	N/A
Multiple master connections	Supports multiple masters	IP Address
Multiple master connections	Method 1 (based on IP address)	IP Address
Time synchronization support	DNP3 LAN procedure (function code 24)	LAN procedure
	DNP3 Write Time
	Other
Link Layer
Data Link Address	Configurable range 0...65519	4
DNP3 Source Address Validation	Never	Never
DNP3 Source Address Validation	Always, single address	Never
DNP3 Source Addresses expected when Validation is Enabled	Configurable range 0...65519	3
Self Address Support using address 0xFFFC	Yes	No
Self Address Support using address 0xFFFC	No	No
Sends Confirmed User Data Frames	Never	Never
	Always
	Sometimes
Data Link Layer Confirmation Timeout	Configurable range 0...4294977295 ms	2000 ms
Maximum Data Link Retries	Configurable range 0...255	3
Maximum number of octets Transmitted in a Data Link Frame	Configurable range 24...292	292
Maximum number of octets that can be Received in a Data Link Frame	Configurable range 24...292	292
Application Layer
Maximum number of octets Transmitted in an Application Layer Fragment other than File Transfer	Configurable range 0...2048	2048
Maximum number of octets Transmitted in an Application Layer Fragment containing File Transfer	–	–
Maximum number of octets that can be received in an Application Layer Fragment	Configurable range 0...2048	2048
Timeout waiting for Complete Application Layer Fragment	Configurable range 0...2147483647	15000 ms
Maximum number of objects allowed in a single control request for CROB (Group 12)	Configurable range1...10	10
Maximum number of objects allowed in a single control request for Analog Outputs (Group 31)	Configurable range1...10	10
Maximum number of objects allowed in a single control request for Data Sets (Groups 85, 86, 87)	–	–
Supports mixed object groups (AOBs, CROBs and Data Sets) in the same control request	Yes	Yes
	No	Yes
Control Status Codes Supported	1 TIMEOUT	–
	2 NO_SELECT
	3 FORMAT_ERROR
	4 NOT_SUPPORTED
	5 ALREADY_ACTIVE
	6 HARDWARE_ERROR
	7 LOCAL
	8 TOO_MANY_OBJS
	9 NOT_AUTHORIZED
	10 AUTOMATION_INHIBIT
	11 PROCESSING_LIMITED
	12 OUT_OF_RANGE
	13 DOWNSTREAM_LOCAL
	14 ALREADY_COMPLETE
	15 BLOCKED
	16 CANCELLED
	17 BLOCKED_OTHER_MASTER
	18 DOWNSTREAM_FAIL
	19 UNDEFINED
Outstation Only Properties
Timeout waiting for Application Confirm of solicited response message	Configurable, range 0...2147483647ms	10000 ms
How often is time synchronization required from the master	Never needs time	Periodically, fixed at 1800seconds
How often is time synchronization required from the master	Periodically, fixed at 1800seconds	Periodically, fixed at 1800seconds
Device Trouble Bit IIN1.6	Never used	Never used
File Handle Timeout	Not applicable	Not applicable
Event Buffer Overflow Behavior	Discard the oldest event	Discard the newest event
Event Buffer Overflow Behavior	Discard the newest event	Discard the newest event
Event Buffer Organization	Per object group	Per object group
Semds Multi-Fragment Responses	Yes	Yes
Semds Multi-Fragment Responses	No	Yes
Last Fragment Confirmation	Sometimes	Sometimes
DNP Command Settings preserved through a device restart	–	–
Supports configuration signature	Not supported	Not supported
Requests application confirmation	For event responses: Yes	Yes
Requests application confirmation	For non-final fragments: Configurable (Yes/No)	Yes
Supports DNP3 Clock Management	–	–
Outstation Unsolicited Response Support Properties
Supports unsolicited reporting	Comfigurable (On/Off)	On
Master Data Link Address	Comfigurable range 0...65519	3
Unsolicited Response Confirmation Timeout	Comfigurable range 0...2147483647	5000 ms
Number of Unsolicited Retries	Comfigurable range 0...65535	3
Outstation Unsolicited Response Trigger Conditions
Number of class 1 events	Comfigurable range 1...512	5
Number of class 2 events	Comfigurable range 1...512	5
Number of class 3 events	Comfigurable range 1...512	5
Total nuber of events from any class	Total Number of Events not used to trigger Unsolicited Responses	–
Hold time after class 1 event	Configurable range 0...2147483647ms	5000 ms
Hold time after class 2 event	Configurable range 0...2147483647ms	5000 ms
Hold time after class 3 event	Configurable range 0...2147483647ms	5000 ms
Hold time after event assigned to any class	Fixed at 0 ms	0 ms
Retrigger Hold Time	Hold-time timer will not be retriggered for each new event detected (guaranteed update time)	Not retriggered
Other Unsolicited Response Trigger Conditions	–	–
Outstation Performance Properties
Maximum Time Base Drift	–	–
When does outstation set IIN1.4	Never	Never
	Asserted at startup until first Time Synchronization request received
	Range 1 to 2147483 seconds after last time sync
Maximum Internal Time Reference Error when set via DNP	–	–
Maximum Delay Measurement Error	–	–
Maximum Response Time	–	–
Maximum time from start-up to IIN 1.4 assertion	–	–
Maximum Event Time-tag error for local Binary and Double Bit I/O	–	–
Maximum Event Time-tag error for local I/O other than Binary and Double Bit data types	–	–
Individual Field Outstation Parameters
User-assigned location name or code string (same as g0v245)	–	–
User-assigned ID code/number string (same as g0v246)	–	–
User-assigned name string for the outstation (same as g0v247)	–	–
Device serial number string (same as g0v248)	–	–
Secondary operator name (same as g0v206)	–	–
Primary operator name (same as g0v207)	–	–
System name (same as g0v208)	–	–
Owner name (same as g0v244)	–	–
Security Parameters
DNP3 device support for secure authentication	Version 2 (IEEE 1815-2010)	–
DNP3 device support for secure authentication	Version 5 (IEEE 1815-2012)	–
Maximum number of users	Configurable range 1...300	Maximum number of user supported: 0
Security message response timeout	Configurable range 1...640 ms	2 ms
Aggressive mode of operation (receive)	Yes	Yes
Aggressive mode of operation (receive)	No	Yes
Aggressive mode of operation (issuing)	Yes	No
Aggressive mode of operation (issuing)	No	No
Session key change interval	Configurable range 60...604800 seconds (when enabled	Enabled at 900 seconds
Session key change message count	Configurable range 0...65535	1000
Maximum error count (SAv2 only)	Configurable range 0...255	2
MAC algorithm requested in a challenge exchange	SHA-1 (truncated to the leftmost 4 octets)	SHA-256 (16)
	SHA-1 (truncated to the leftmost 8 octets)
	SHA-1 (truncated to the leftmost 10 octets)
	SHA-256 (truncated to the leftmost 8 octets)
	SHA-256 (truncated to the leftmost 16 octets)
Key-wrap algorithm to encrypt session keys	AES-128	AES-128
Key-wrap algorithm to encrypt session keys	AES-256	AES-128
Cipher Suites used with DNP implementations using TLS	Not relevant TLS is not used	Not relevant
Change cipher request timeout	Not relevant TLS is not used	Not relevant
Number of Certificate Authorities supported	–	–
Certificate Revocation check time	Not relevant TLS is not used	Not relevant
Additional critical function codes	None	None
Other critical fragments	None	None
Support for remote update key changes	None	None
Default user credentials are permitted to expire	Yes	No
Default user credentials are permitted to expire	No	No
Secure Authentication enabled	Configurable: On or Off	Off
Length of the challenge data	Configurable range 4...60 octets	4 octets
Maximum statistic counts (SAv5):
Max Authentication Failures	Configurable range 4...60	4
Max Reply Timeouts	Configurable range 1...65535	3
Max Authentication Rekeys	Configurable range 1...65535	3
Max Error Messages Sent	Configurable range 1...65535	3
Broadcast Functionality
Disabled Not configurable	–	–

DNP3 Implementation Table

The following table identifies the object groups, variations, function codes, and qualifiers that the BMENOR2200H module supports in both requests and responses. The Request columns identify all requests that may be sent by a master or all requests that are parsed by an outstation. The Response columns identify all responses that are parsed by a master or all responses that may be sent by an outstation

DNP OBJECT GROUP & VARIATION			REQUEST Master may issue Outstation parses		RESPONSE Master parses Outstation may issue
Object Group Number	Variation Number	Description	Function Codes (dec)	Qualifier Codes (hex)	Function Codes (dec)	Qualifier Codes (hex)
1	0	Binary Input - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
1	0	Binary Input - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
1	1	Binary Input - Single-bit packed	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
1	2	Binary Input - Single-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
2	0	Binary Input Change Event - any variation	1(read)	06 (no range, or all), 07, 08 (limited qty)
2	1	Binary Input Change Event - without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
2	1	Binary Input Change Event - without time			(Unsol. Resp.)	17, 28 (index)
2	2	Binary Input Change Event - with absolute time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
2	2	Binary Input Change Event - with absolute time			(Unsol. Resp.)	17, 28 (index)
2	3	Binary Input Change Event - with relative time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
2	3	Binary Input Change Event - with relative time			(Unsol. Resp.)	17, 28 (index)
3	0	Double-bit Input - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
3	0	Double-bit Input - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
3	1	Double-bit Input - Double-bit packed	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
3	2	Double-bit Input - with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
4	0	Double-bit Input Change Event - any variation	1(read)	06 (no range, or all), 07, 08 (limited qty)
4	1	Double-bit Input Change Event - without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
4	1	Double-bit Input Change Event - without time			(Unsol. Resp.)	17, 28 (index)
4	2	Double-bit Input Change Event - with absolute time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
4	2	Double-bit Input Change Event - with absolute time			(Unsol. Resp.)	17, 28 (index)
4	3	Double-bit Input Change Event - with relative time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
4	3	Double-bit Input Change Event - with relative time			(Unsol. Resp.)	17, 28 (index)
10	0	Binary Output - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 28 (index)
10	0	Binary Output - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
10	1	Binary Output - packed format	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
10	1	Binary Output - packed format	2(write)	00, 01 (start-stop)
10	2	Continuous Control - output status with flags	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
11	0	Binary Output Change Event - any variation	1(read)	06 (no range, or all), 07, 08 (limited qty)
11	1	Binary Output Change Event - status without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
11	1	Binary Output Change Event - status without time			(Unsol. Resp.)	17, 28 (index)
11	2	Binary Output Change Event - status with time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
11	2	Binary Output Change Event - status with time			(Unsol. Resp.)	17, 28 (index)
12	0	Binary Output Command (CROB) - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
12	1	Binary Output Command (CROB) - control relay output block	3(select)	17, 27, 28 (index)	(Response)	echo of request
12	1	Binary Output Command (CROB) - control relay output block	4(operate)	17, 27, 28 (index)	(Response)	echo of request
12	1	Binary Output Command (CROB) - control relay output block	5(direct op.)	17, 27, 28 (index)	(Response)	echo of request
12	1	Binary Output Command (CROB) - control relay output block	6(direct op, no ack)	17, 27, 28 (index)	(Response)	echo of request
12	2	Binary Output Command - pattern control block	3(select)	07 (limited qty = 1)	(Response)	echo of request
12	2	Binary Output Command - pattern control block	4(operate)	07 (limited qty = 1)	(Response)	echo of request
12	2	Binary Output Command - pattern control block	5(direct op.)	07 (limited qty = 1)	(Response)	echo of request
12	2	Binary Output Command - pattern control block	6(direct op, no ack)	07 (limited qty = 1)	(Response)	echo of request
12	3	Binary Output Command - pattern mask	3(select)	00, 01 (start-stop)	(Response)	echo of request
12	3	Binary Output Command - pattern mask	4(operate)	00, 01 (start-stop)	(Response)	echo of request
12	3	Binary Output Command - pattern mask	5(direct op.)	00, 01 (start-stop)	(Response)	echo of request
12	3	Binary Output Command - pattern mask	6(direct op, no ack)	00, 01 (start-stop)	(Response)	echo of request
20	0	Counter - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
20	0	Counter - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
20	0	Counter - any variation	7(freeze)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty)
20	0	Counter - any variation	8(freeze, no ack)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty)
20	0	Counter - any variation	9(freeze & clear)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty)
20	0	Counter - any variation	10(frz & clr, no ack)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty)
20	1	Counter - 32-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
20	2	Counter - 16-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
20	5	Counter - 32-bit without flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
20	6	Counter - 16-bit without flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
21	0	Frozen Counter - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
21	0	Frozen Counter - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
21	1	Frozen Counter - 32-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
21	2	Frozen Counter - 16-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
21	5	Frozen Counter - 32-bit with flag and time	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
21	6	Frozen Counter - 16-bit with flag and time	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
21	9	Frozen Counter - 32-bit without flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
21	10	Frozen Counter - 16-bit without flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
22	0	Counter Change Event - any variation	1(read)	06 (no range, or all), 07, 08 (limited qty)
22	1	Counter Change Event - 32-bit with flag	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
22	1	Counter Change Event - 32-bit with flag			(Unsol. Resp.)	17, 28 (index)
22	2	Counter Change Event - 16-bit with flag	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
22	2	Counter Change Event - 16-bit with flag			(Unsol. Resp.)	17, 28 (index)
22	5	Counter Change Event - 32-bit with flag and time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
22	5	Counter Change Event - 32-bit with flag and time			(Unsol. Resp.)	17, 28 (index)
22	6	Counter Change Event - 16-bit with flag and time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
22	6	Counter Change Event - 16-bit with flag and time			(Unsol. Resp.)	17, 28 (index)
23	0	Frozen Counter Change Event - any variation	1(read)	06 (no range, or all), 07, 08 (limited qty)
23	1	Frozen Counter Change Event - 32-bit with flag	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
23	1	Frozen Counter Change Event - 32-bit with flag			(Unsol. Resp.)	17, 28 (index)
23	2	Frozen Counter Change Event - 16-bit with flag	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
23	2	Frozen Counter Change Event - 16-bit with flag			(Unsol. Resp.)	17, 28 (index)
23	5	Frozen Counter Change Event - 32-bit with flag and time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
23	5	Frozen Counter Change Event - 32-bit with flag and time			(Unsol. Resp.)	17, 28 (index)
23	6	Frozen Counter Change Event - 16-bit with flag and time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
23	6	Frozen Counter Change Event - 16-bit with flag and time			(Unsol. Resp.)	17, 28 (index)
30	0	Analog Input - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all)
30	0	Analog Input - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
30	1	Analog Input - 32-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
30	2	Analog Input - 16-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
30	3	Analog Input - 32-bit without flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
30	4	Analog Input - 16-bit without flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
30	5	Analog Input - single-precision, floating-point with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
32	0	Analog Input Change Event - any variation	1(read)	06 (no range, or all), 07, 08 (limited qty)
32	1	Analog Input Change Event - 32-bit without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
32	1	Analog Input Event 32-bit without time			(Unsol. Resp.)	17, 28 (index)
32	2	Analog Input Change Event - 16-bit without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
32	2	Analog Input Change Event - 16-bit without time			(Unsol. Resp.)	17, 28 (index)
32	3	Analog Input Change Event - 32-bit with time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
32	3	Analog Input Change Event - 32-bit with time			(Unsol. Resp.)	17, 28 (index)
32	4	Analog Input Change Event - 16-bit with time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
32	4	Analog Input Change Event - 16-bit with time			(Unsol. Resp.)	17, 28 (index)
32	5	Analog Input Change Event - single-precision, floating-point without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
32	5	Analog Input Change Event - single-precision, floating-point without time			(Unsol. Resp.)	17, 28 (index)
32	7	Analog Input Change Event - single-precision, floating-point with time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
32	7	Analog Input Change Event - single-precision, floating-point with time			(Unsol. Resp.)	17, 28 (index)
34	0	Analog Input Deadband - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
34	1	Analog Input Deadband - 16-bit	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
34	1	Analog Input Deadband - 16-bit	2(write)	00, 01 (start-stop), 07, 08 (limited qty), 17, 27, 28 (index)
34	2	Analog Input Deadband - 32-bit	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
34	2	Analog Input Deadband - 32-bit	2(write)	00, 01 (start-stop), 07, 08 (limited qty), 17, 27, 28 (index)
34	3	Analog Input Deadband - single-precision, floating-point	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
34	3	Analog Input Deadband - single-precision, floating-point	2(write)	00, 01 (start-stop), 07, 08 (limited qty), 17, 27, 28 (index)
40	0	Analog Output Status - any variation	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
40	0	Analog Output Status - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
40	1	Analog Output Status - 32-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
40	2	Analog Output Status - 16-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
40	3	Analog Output Status - single-precision, floating-point with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
41	0	Analog Output Block - any variation	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 27, 28 (index)
41	1	Analog Output Block - 32-bit	3(select)	17, 27, 28 (index)	(Response)	echo of request
41	1	Analog Output Block - 32-bit	4(operate)	17, 27, 28 (index)	(Response)	echo of request
41	1	Analog Output Block - 32-bit	5(direct op.)	17, 27, 28 (index)	(Response)	echo of request
41	1	Analog Output Block - 32-bit	6(direct op, no ack)	17, 27, 28 (index)	(Response)	echo of request
41	2	Analog Output Block - 16-bit	3(select)	17, 27, 28 (index)	(Response)	echo of request
41	2	Analog Output Block - 16-bit	4(operate)	17, 27, 28 (index)	(Response)	echo of request
41	2	Analog Output Block - 16-bit	5(direct op.)	17, 27, 28 (index)	(Response)	echo of request
41	2	Analog Output Block - 16-bit	6(direct op, no ack)	17, 27, 28 (index)	(Response)	echo of request
41	3	Analog Output Block - single-precision, floating-point	3(select)	17, 27, 28 (index)	(Response)	echo of request
41	3	Analog Output Block - single-precision, floating-point	4(operate)	17, 27, 28 (index)	(Response)	echo of request
41	3	Analog Output Block - single-precision, floating-point	5(direct op.)	17, 27, 28 (index)	(Response)	echo of request
41	3	Analog Output Block - single-precision, floating-point	6(direct op, no ack)	17, 27, 28 (index)	(Response)	echo of request
42	0	Analog Output Change Event - any variation	1(read)	06 (no range, or all), 07, 08 (limited qty)
42	1	Analog Output Change Event - 32-bit without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
42	1	Analog Output Change Event - 32-bit without time			(Unsol. Resp.)	17, 28 (index)
42	2	Analog Output Change Event - 16-bit without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
42	2	Analog Output Change Event - 16-bit without time			(Unsol. Resp.)	17, 28 (index)
42	3	Analog Output Change Event - 32-bit with time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
42	3	Analog Output Change Event - 32-bit with time			(Unsol. Resp.)	17, 28 (index)
42	4	Analog Output Change Event - 16-bit with time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
42	4	Analog Output Change Event - 16-bit with time			(Unsol. Resp.)	17, 28 (index)
42	5	Analog Output Change Event - single-precision, floating-point without time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
42	5	Analog Output Change Event - single-precision, floating-point without time			(Unsol. Resp.)	17, 28 (index)
42	7	Analog Output Change Event - single-precision, floating-point with time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
42	7	Analog Output Change Event - single-precision, floating-point with time			(Unsol. Resp.)	17, 28 (index)
50	1	Time and Date - absolute time	1(read)	07 (limited qty = 1)	(Response)	07 (limited qty = 1)
50	1	Time and Date - absolute time	2(write)	07 (limited qty = 1)
50	3	Time and Date - absolute time at last recorded time	2(write)	07 (limited qty = 1)
51	1	Time and Date CTO - absolute time, synchronized			(Response)	07 (limited qty = 1)
51	1	Time and Date CTO - absolute time, synchronized			(Unsol. Resp.)	07 (limited qty = 1)
51	2	Time and Date CTO - absolute time, un-synchronized			(Response)	07 (limited qty = 1)
51	2	Time and Date CTO - absolute time, un-synchronized			(Unsol. Resp.)	07 (limited qty = 1)
52	1	Time Delay - coarse			(Response)	07 (limited qty = 1)
52	2	Time Delay - fine			(Response)	07 (limited qty = 1)
60	1	Class Objects - class 0 data	1(read)	06 (no range, or all)
60	1	Class Objects - class 0 data	22(assign class)	06 (no range, or all)
60	2	Class Objects - class 1 data	1(read)	06 (no range, or all), 07, 08 (limited qty)
60	2	Class Objects - class 1 data	20(enable unsol.)	06 (no range, or all)
60	2	Class Objects - class 1 data	21(disable unsol.)	06 (no range, or all)
60	2	Class Objects - class 1 data	22(assign class)	06 (no range, or all)
60	3	Class Objects - class 2 data	1(read)	06 (no range, or all), 07, 08 (limited qty)
60	3	Class Objects - class 2 data	20(enable unsol.)	06 (no range, or all)
60	3	Class Objects - class 2 data	21(disable unsol.)	06 (no range, or all)
60	3	Class Objects - class 2 data	22(assign class)	06 (no range, or all)
60	4	Class Objects - class 3 data	1(read)	06 (no range, or all), 07, 08 (limited qty)
60	4	Class Objects - class 3 data	20(enable unsol.)	06 (no range, or all)
60	4	Class Objects - class 3 data	21(disable unsol.)	06 (no range, or all)
60	4	Class Objects - class 3 data	22(assign class)	06 (no range, or all)
80	1	Internal Indications - packed format	1(read)	00, 01 (start-stop)	(Response)	00, 01 (start-stop)
80	1	Internal Indications - packed format	2(write)
91	1	Status of Requested Operation			(Response)	07 (limited qty = 1)
91	1	Status of Requested Operation			(Response)	5B
110	string length	Octet String	1(read)	00, 01 (start-stop), 06 (no range, or all), 07, 08 (limited qty), 17, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
110	string length	Octet String	2(write)	00, 01 (start-stop), 07, 08 (limited qty), 17, 28 (index)
110	string length	Octet String	31(activate config)	5B
120	0	Authentication - Assign Class	22(assign class)	06 (no range, or all)
120	1	Authentication - Challenge	32(auth req)	5B	(Auth. Resp.)	5B
120	2	Authentication - Reply	32(auth req)	5B	(Auth. Resp.)	5B
120	3	Authentication - Aggressive Mode	any of 1 to 31	07 (limited qty = 1)	(Response)	07 (limited qty = 1)
120	3	Authentication - Aggressive Mode			(Unsol. Resp.)	07 (limited qty = 1)
120	4	Authentication - Session Key Status Request	32(auth req)	07 (limited qty = 1)
120	5	Authentication - Session Key Status			(Auth. Resp.)	5B
120	6	Authentication - Session Key Change	32(auth req)	5B
120	7	Authentication - Error	33(auth req, no ack)	5B	(Auth. Resp.)	5B
120	8	Authentication - User Certificate	32(auth req)	5B
120	9	Authentication - MAC	any of 1 to 31	5B	(Response)	5B
120	9	Authentication - MAC			(Unsol. Resp.)	5B
120	10	Authentication - User Status Change	32(auth req)	5B
120	11	Authentication - Update Key Change Request	32(auth req)	5B
120	12	Authentication - Update Key Change Reply			(Auth. Resp.)	5B
120	13	Authentication - Update Key Change	32(auth req)	5B
120	14	Authentication - Update Key Change Signature	32(auth req)	5B
120	15	Authentication - Update Key Change Confirmation	32(auth req)	5B	(Auth. Resp.)	5B
121	0	Security Statistic	1(read)	00, 01 (start-stop), 06 (no range, or all), 17, 28 (index)
121	0	Security Statistic - Assign Class	22(assign class)	00, 01 (start-stop), 06 (no range, or all), 17, 28 (index)
121	1	Security Statistic	1(read)	00, 01 (start-stop), 06 (no range, or all), 17, 28 (index)	(Response)	00, 01 (start-stop), 17, 28 (index)
122	0	Security Statistic Event - 32-bit with flag	1(read)	00, 01 (start-stop), 06 (no range, or all), 17, 28 (index)
122	1	Security Statistic Event - 32-bit with flag	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
122	1	Security Statistic Event - 32-bit with flag and time			(Unsol. Resp.)	17, 28 (index)
122	2	Security Statistic Event - 32-bit with flag and time	1(read)	06 (no range, or all), 07, 08 (limited qty)	(Response)	17, 28 (index)
122	2	Security Statistic Event - 32-bit with flag and time			(Unsol. Resp.)	17, 28 (index)