An outstation that restarts quietly: IIN1.7 DEVICE_RESTART and events an hour in the past
When a DNP3 outstation restarts it sets IIN1.7 DEVICE_RESTART in every response until the master clears it, and usually IIN1.4 NEED_TIME until the master writes its clock. A good master does both within milliseconds and moves on. That is exactly why restarts go unnoticed: the flags are cleared before anyone looks, and what remains are a gap in the data and a few events with the wrong time.
The setup
RTU-21 at a substation, 8 breakers, 6 analogs and 2 counters, polled continuously for 30 minutes. It cold-restarts at minute 10 and again at minute 20. After the second restart its real-time clock comes back one hour behind.
What the capture shows
| When | What the master sees | What the master does |
|---|---|---|
| 00:00 (start) | IIN1.7 and IIN1.4 on the first responses | writes the time (g50v1), clears IIN1.7 (g80v1), enables unsolicited |
| 10:00 | IIN1.7 and IIN1.4 again | clears IIN1.7, writes the time, enables unsolicited |
| 20:00 | IIN1.7 and IIN1.4 again, plus 8 events stamped 10:20:00 at 11:20:00 | same, 19 ms later |
- Over 30 minutes, 7 responses carry DEVICE_RESTART and 6 carry NEED_TIME. A restart flag in the middle of a session, with no reconnection around it, is a restart nobody asked for.
- The master is quick: the time write after each restart comes 19 ms after the flag. But the first response after the second restart was already on the wire, carrying 8 events stamped with the outstation's clock as it came back: exactly one hour in the past. Those 8 rows land in the SOE an hour before they happened.
- Every restart also re-arms unsolicited reporting and loses whatever the outstation had in its event buffer and did not send.
What to check
- Count the DEVICE_RESTART flags in a long capture. More than the restarts you know about means the device is restarting on its own: power supply, watchdog or firmware.
- Check the timestamps of the events in the first response after each restart. Events stamped before the time write carry the outstation's clock as it came back, which after a cold restart may be anything.
- If the clock comes back wrong after a restart, the RTC backup (battery, supercapacitor) is the first suspect.
Try it on your own capture
ComputingSphere DNP3 counts DEVICE_RESTART and NEED_TIME per outstation, checks every timestamp against the capture time, and puts both in the report. It only reads what already went over the wire. This capture is among the examples of every free account, to reproduce every number here; or upload your own: the Free plan covers 1,000 messages a month.