workbench io configuration manual rev 3 13

CGAS Workbench

Base Apps and I/O Configuration Guide

Version 3.13

BASE Apps and I/O Configuration Manual

of 89

© CG Automation Ireland Limited 2010

This document contains proprietary information of CG Automation Ireland Limited. The information and designs in the document are covered by international copyright and a number of international patents existing and pending. CG Automation Ireland Limited, and its legally appointed licensees, reserves the right to seek full redress in the case of any infringement.

The information in this document is subject to change without prior notice. CG Automation Ireland Limited does not assume responsibility for any errors in fact or design in this publication. Specifications can and do vary in different applications. The publication is provided for general information only and shall not form part of any contract.


of 89

Contents

1 Reference Documents.................................................................................... 5

2 Introduction .................................................................................................... 6

3 RTU Types ....................................................................................................... 7

3.1 RTU ..................................................................................................................... 7

3.2 Bay ...................................................................................................................... 7

3.3 Cabinet................................................................................................................ 8

3.4 Rack .................................................................................................................... 8

3.5 Unit ...................................................................................................................... 8 3.5.1 Unit Status ..................................................................................................... 9 3.5.2 Unit Reset Command .................................................................................... 9 3.5.3 Unit Configuration Parameters ....................................................................... 9

3.6 IED ......................................................................................................................10

3.7 Virtual Unit .........................................................................................................10

3.8 Virtual IED ..........................................................................................................10

3.9 Block ..................................................................................................................10

3.10 Firmware.........................................................................................................10

3.11 Module ............................................................................................................10

3.12 Dual Network Status ......................................................................................13

3.13 Remote Reboot and Reset ............................................................................14

4 TCP/IP Configuration ................................................................................... 15

4.1 General Configuration ......................................................................................15

4.2 Static Address Mode .........................................................................................15

4.3 BOOTP Address mode .....................................................................................15

4.4 DHCP Address ..................................................................................................15

4.5 Redundant IP Address ......................................................................................15

4.6 TCP/IP Parameters ............................................................................................16

5 Channel Numbers ......................................................................................... 17

5.1 I/O Card Channels .............................................................................................17

5.2 Points Grouped By Type Only .........................................................................18

5.3 Points Grouped By Module ..............................................................................19

6 Single Digital Inputs (SDI) ............................................................................ 20

6.1 Configuration Table ..........................................................................................20

6.2 SDI Debounce ....................................................................................................22

6.3 SDI Time Filter ...................................................................................................22


of 89

7 Double Digital Inputs (DDI) .......................................................................... 24

7.1 Operation ...........................................................................................................26

7.2 DDI Debounce ...................................................................................................26

7.3 DDI Time Filter ...................................................................................................26

8 Automatic Suppression ............................................................................... 27

9 Digital Outputs (DOT) ................................................................................... 29

9.1 Configuration ....................................................................................................29

9.2 DOT table rev. 012 .............................................................................................31

9.3 Control Security ................................................................................................32

9.4 Output Mode ......................................................................................................32

9.5 Single Output Operation ...................................................................................33

9.6 Multiple Master Stations ...................................................................................34

10 Analog Inputs Table (AIN) ......................................................................... 35

10.1 Configuration .................................................................................................35

10.2 Analog Input Scaling .....................................................................................37

10.3 Limit Alarm Processing .................................................................................37

10.4 Database Update ............................................................................................37

10.5 Sample Configuration ....................................................................................39

11 Analog Outputs ......................................................................................... 40

12 Optional Tables ......................................................................................... 41

12.1 Raise-Lower Pairs ..........................................................................................42

12.2 Pulse Train Outputs From eXpress ..............................................................45

12.3 Sequenced DO ...............................................................................................49

12.4 Network Time Protocol Client (NTP) Configuration .....................................51

12.5 HAI Card Config .............................................................................................53

12.6 Accumulators .................................................................................................55 12.6.1 Configuration .............................................................................................55 12.6.2 Input Types ...............................................................................................57 12.6.3 Running Value Change Messages ............................................................57 12.6.4 Digital Input Time Stamping.......................................................................58

12.7 Binary Coded Decimal Component (BCD) ...................................................59

12.8 TAP Position Component (TAP) ...................................................................62

12.9 Tap AI .............................................................................................................65 12.9.1 Configuration .............................................................................................65 12.9.2 Example ....................................................................................................66

12.10 Pseudo Points ................................................................................................67 12.10.1 Pseudo Digital Inputs.................................................................................67 12.10.2 Pseudo Digital Outputs ..............................................................................67 12.10.3 Pseudo Analog Inputs ...............................................................................68 12.10.4 Pseudo Analog Outputs .............................................................................68 12.10.5 Pseudo Accum ..........................................................................................68


of 89

12.11 Remote Connect Points ................................................................................70 12.11.1 Remote Connect DI ...................................................................................70 12.11.2 Remote Connect DO .................................................................................71

12.12 Serial Port Pass Through ..............................................................................72 12.12.1 XCell View .................................................................................................72 12.12.2 TCP/IP ......................................................................................................72 12.12.3 Serial Port Pass Through Configuration Table ...........................................72 12.12.4 Serial Port Pass Through Control ..............................................................74

12.13 SNMP Client ...................................................................................................75 12.13.1 SNMP Client Configuration ........................................................................75 12.13.2 XCell SNMP Notes ....................................................................................76 12.13.3 XCell SNMP Standard MIBs ......................................................................78

12.14 NetBridge Client .............................................................................................79 12.14.1 Netbridge Client Configuration ...................................................................80 12.14.2 Netbridge Table Parameters......................................................................80

13 Secure Tunnel Interface ............................................................................ 82

13.1 AES .................................................................................................................83

13.2 MSES ..............................................................................................................84

13.3 PC MSES srv.cfg file ......................................................................................85

13.4 Workbench MSES configuration table .........................................................86

13.5 Connection Examples ...................................................................................87 13.5.1 Workbench RTU Live TCP/IP ....................................................................87 13.5.2 Telnet to XCell View ..................................................................................88 13.5.3 Secure Pass Through ................................................................................88

1 Reference Documents

The following documents should be used in conjunction with this document to provide complete information for the configuration and use of the XCell product.

1. Workbench User Manual CG Automation Ireland Limited.

2. XCell User Manual CG Automation Ireland Limited.

3. eXpress Users Guide CG Automation Ireland Limited.


of 89

2 Introduction

This Manual describes the configuration of the various I/O point types and Base applications using Workbench configuration tool. It describes the steps necessary for the configuration and the parameters associated with each configuration table.

All configuration elements must be associated with a specific processor unit or module so the RTU and Unit structure must first be created in the Project Hierarchy. This is done by dragging and dropping the Project Elements (RTU, Bay and Unit nodes) to the Project Hierarchy window; refer to Workbench User Manual for further details. The user then has the option to include a number of modules with each unit. For further information regarding the function and use of modules, refer to the Workbench User Manual.

Once the relevant unit nodes exist in the Project Hierarchy simply select the required I/O components from the Point tab in the Elements window in Workbench. Then drag the configuration element icon onto the required unit or module in the Project Hierarchy. The first table created for a project will prompt you to enable automatic tag generation. You are then presented with a prompt for the number of records to create. These prompts are similar to those shown in Figure 1.

Figure 1 Specify the number of records to create

Workbench uses the information given to create the specified number of entries and display them in the Data Window where the default parameters may be edited.


of 89

3 RTU Types

The user has a number of Icons to use to organize the Workbench Project Configuration and provide additional information concerning the system. Each of the Icon Name, Description and Data field can be changed by selecting, right click to the menu and select properties.

Figure 2 Firmware (Application) Organizing Icon

Figure 3 Project Organizing Icon

3.1 RTU

The RTU node is the top level node, to which all other nodes are attached. It has no configuration parameters.

3.2 Bay

The Bay node is the next level node, to which all other nodes are attached. It has no configuration parameters.


of 89

3.3 Cabinet

The Cabinet element may only be attached to an RTU node. It allows Racks to be grouped. It has no configuration parameters.

3.4 Rack

The Rack node allows Units to be organized into groups. It has no configuration parameters.

3.5 Unit

The Unit node is used to group tables and address points to the processor to which they belong.

Figure 4 Unit Configuration


of 89

3.5.1 Unit Status

The unit Tag may be mapped as a digital input point. In this case, the point represents the health status of the processor. It is ON when the processor is present and functioning, and OFF if the processor is removed or malfunctioning.

3.5.2 Unit Reset Command

The unit Tag may also be mapped as a digital output point. In this case, when a latch ON or Pulse command is sent to the point, the processor will reboot.

3.5.3 Unit Configuration Parameters

The Unit node has three configuration parameters.

Field Name Value Comments

TAG 40 Characters The Tag field is used to uniquely identify the unit in the Workbench Project. It may also be mapped to slave protocols.

Description 40 Characters

This is a brief description of the point for configuration purposes only.

Unit Number 1 to 250 The Unit Number specifies the network address of the processor.

This address is set and displayed from the processor‟s front panel. Once the processor has had an address set, it may be used for configuration download by Workbench.

Table 1 Unit Parameter Definitions


of 89

3.6 IED

An IED node is used for grouping the points of a master protocol application. It is attached to a unit node.

Several IEDs may belong to the same unit node. Different IED nodes may have the same type of table attached.

3.7 Virtual Unit

A Virtual Unit node is used for testing and can only be placed under the top RTU Icon. The tables under a virtual unit are not downloaded but are used to provide pseudo reference tags for other protocol tables.

3.8 Virtual IED

A Virtual IED node is used for grouping the map point elements for a master protocol (e.g. DNP3 master). It is attached to a unit node. This allows the user to have only the point mapping table for that device separate from the other devices. The user can also place additional information on the Icon naming the

device, location etc.

Several IEDs may belong to the same unit node. When the configuration is downloaded Workbench combines all of the point maps under these Icons and creates a single download point map for the Master application. All the other master tables are placed under a firmware Icon.

3.9 Block

The Block node can only be placed under the top RTU Icon. It can be used for added project information or used to create firmware templates in which the Firmware Icon can be place under the Block Icon.

3.10 Firmware

The firmware node is useful for grouping tables which are not associated with hardware. The tables of a slave application or a utility may be attached here.

3.11 Module

The Module element is attached to Unit nodes to hold other point type tables. The Module element allows tables that configure individual point types to be organized by their parent IO module. This allows for a simplified channel numbering scheme, restarting channel numbers for each module.


of 89

Figure 5 Module Configuration

The Module element may be mapped to slave protocols as a digital input that is OFF while the I/O module is present and functioning correctly, and ON when failed or removed.


of 89

There are a number of module parameters that can be configured.


TAG 40 Characters The Tag is a unique identifier for the module in the Workbench project. It may be used to map the module‟s current status to slave protocols.

Description 40 Characters This is a brief description of the point for configuration purposes only.

Module – Order

0 to 7 Each Module on a unit must have its slot position specified by this field, beginning with 0 for the first slot position. This parameter is used to correctly address the channels of each I/O module.

Module – Type DIN-01X, HDI-04X, HDI-05X, DOT-01X,

HDO-03X, HDO-01X, HDO-04X, HAI-03X, AOT-02X, AOT-03X,

HSC-02X, Empty Card

Every IO module has a type specified with this field. The Type allows the correct number of channels to be configured.

Module – Connector

Default D-16, D-32

This field is for descriptive purposes.

Termination Block – Type

None Generic 16, IPC-16, TAI-L90, TAI-R90,

TAI-L91, TAI-R91, HAI-CDC, IPC-16 (P&B 1X), IPC-16 (P&B 2FA), IPC-16 (P&B 2FC), IPC-16-A (P&B 1X), IPC-16-A (P&B

2FA), IPC-16-A (P&B 2FC), Generic 32, TDI-040,

TDI-050, TDI-L90, TDI-R90, TDA-L91, TDA-R91, TDO-040, TDO-050, TDO-L90, TDO-R90, TDO-LDB, TDO-RDB, TAI-040,

TAI-050, HDI-CDC, TDI-RACKTERM,

Generic 64, TDI-051

This field is for descriptive purposes.

Termination Block – Name

40 Characters This field is for descriptive purposes.

Table 2 Module Parameter Definitions


of 89

3.12 Dual Network Status

Figure 6 Dual Network Status Table

The Dual Network Status table provides three status points for each unit‟s FieldNet connection. The XCell FieldNet is a Redundant LAN connection between units via the backplane. It allows the units to share database points and relay control requests.

The definitions for each point are as follows.

Record Description

0 This point is ON when the primary network is OK.

The point is OFF when no activity or corrupted messages are detected.

1 This point is ON when the secondary network is OK.

The point is OFF when no activity or corrupted messages are detected.

2 This point is ON to indicate the secondary network is in use.

The point is OFF to indicate that the primary network is selected.

Table 3 Dual Network Status Points


of 89

3.13 Remote Reboot and Reset

Figure 7 Remote Reboot Table

The Remote Reboot table provides 2 pseudo points to enable the unit under which it is defined, to be remotely rebooted (with and without erasing configuration). These points can be driven like any other output points – real or pseudo, using workbench or any protocol, but they can only be driven by 3-stage commands for security reasons. To drive it from a protocol, these 2 points have to be defined under each unit and mapped into the protocol as an output point.

The definitions for each point are as follows.

Record Description

0 This point if driven will only reboot the unit. The configuration will remain intact.

1 This point if driven will erase the configuration files from flash and reboot the unit. So when the unit boots up, the original configuration files will not be present

in memory.

Table 4 Remote Reboot Pseudo Points


of 89

4 TCP/IP Configuration

4.1 General Configuration

The TCPIP component allows you to configure the Ethernet port associated with the CPR041 card. Only one entry is allowed per unit and this limit is enforced by Workbench.

The TCPIP component is contained in the Elements window under the Projects tab and the Network sub group.

Figure 8 TCP/IP Configuration

Not all fields require an entry if BOOTP or DHCP modes are in use, or if DNS is not required.

Table 5 gives the field definition parameters for the TCP/IP Configuration component.

4.2 Static Address Mode

If the user configures IP Address Mode as Static Address, the CPR041 will use the IP Address, Net Mask and Gateway entries for its network information.

4.3 BOOTP Address mode

The BOOTP Address mode requires a BOOTP server on the network to supply the CPR041 with an IP address, network address mask and gateway information. Most DHCP servers can be configured to supply BOOTP addresses.

4.4 DHCP Address

The DHCP Address mode requires a DHCP server on the network to supply the CPR041 with an IP address. The CPR041 supports the renewal of an assigned IP address after a duration of time, but does not support changing the IP address once assigned.

4.5 Redundant IP Address

The Redundant IP Address mode is an XCell method for sharing the same IP address between two CPR041s, for master stations which do not support redundant Ethernet connections with independent IP address information.

In this mode, two CPR041s are configured with identical IP address information. Only one CPR041 operates active IP communications at a time, while the second CPR041 waits on standby in case of a failure.

At start up, each of the redundant pair arbitrate for the configured IP address. The lowest unit number will then proceed to use the IP address for normal communications, while continuing to periodically update the standby unit. For as long as the standby unit receives updates from the active unit, the standby unit does not begin IP communications.

If the active unit fails, or a cable is removed, the address information updates are no longer received by the standby unit, and it will begin communications.


of 89

Note that if a cable is removed and replaced, both units may begin communicating using the same IP address. When this is detected, both units will automatically reboot after displaying the TCP-001 error on the front panel.

Redundant IP address mode requires that broadcast UDP packets are allowed between CPR041 units on port 1009. A gateway device should not forward these packets.

Redundant IP address mode requires application support. Currently, this is provided by:

iecsnb V7xx firmware for the IEC 60870-5-104 slave protocol

dnpsnb V4xx firmware for the DNP3 slave firmware

dnp3mnb V7xx firmware for the DNP 3 master protocol

Please contact CG Automation Ireland Limited for further support information.

4.6 TCP/IP Parameters

Table 5 TCPIP Parameter Definitions


IP Address Mode Static Address,

BOOTP Address,

Redundant IP Address,

DHCP Address

How to acquire an IP address.

A static or redundant IP address is configured with the IP Address entry.

A BOOTP or DHCP address requires a suitable address server on the network.

IP Address 16 Character IP Address

If BOOTP or DHCP are not enabled, this entry is used to configure the IP address as format ddd.ddd.ddd.ddd .

Net Mask 16 Character IP Address

The sub-network mask in the format ddd.ddd.ddd.ddd . Only used if BOOTP/DHCP are not in use.

Host Name 40 Characters Optional host name for the unit when the DNS protocol is in use.

Gateway 16 Character IP Address

IP Address of the network gateway, if BOOTP or DHCP are not in use.

Domain Name 40 Characters Optional domain name for the DNS protocol.

Log Host 16 Character IP Address

Optional IP Address of remote machine to receive log messages.

Name Server 16 Character IP Address

Optional IP Address of DNS Server.

Net Time Server 16 Character IP Address

Optional IP Address of SNTP Server. Refer to section Error! Reference source not found..


of 89

5 Channel Numbers

5.1 I/O Card Channels

I/O cards installed in a unit each occupy a number of „channels‟ on that unit, by which each point on the card may be addressed. Every I/O card provides a certain number of channels.

Card Name Number Of Channels

HDI-05x Digital Input Card 64

HDI-04x Digital Input Card 32

HAI-03x Analog Input Card 32

HDO-04x Digital Output Card 32

HDO-05x Digital Output Card 32

AOT-21 Analog Output Card 8

Empty Slot 16

Table 6 Channel Number Assignment

The I/O configuration may be organized by I/O Module Type or by the Point Types configured. Each scheme is discussed in the following sections.


of 89

5.2 Points Grouped By Type Only

If an I/O Point table (e.g. SDI) is attached directly to the „Unit‟ node then the channel numbers should be relative to the first hardware channel on the unit beginning at the 0 and continuing across cards to the last hardware channel on the unit.

For example, consider a unit which is configured with an HDI-050 (64 channel card) in the first slot and an HAI-030 (32 channel card) in the second slot:

- The first digital input point is channel 0

- The last digital input point is channel 63

- The first analog input point is channel 64

- The last analog input point is channel 95

Figure 9 Unit Channel Assignment


of 89

5.3 Points Grouped By Module

If an I/O Point table (e.g. SDI) is attached directly to the „Unit‟ node then the channel numbers should be relative to the first hardware channel on the unit beginning at the 0 and continuing across cards to the last hardware channel on the unit.

It is generally more convenient to configure the I/O Module elements for each unit first defining what modules are physically installed in the unit. The configuration of the Module element is described in section 3.11. The I/O Point Tables (e.g. SDI) can then be attached to the relevant modules. In this case the channel numbers always begin at 0 for the first hardware channel on each module.

Figure 10 Module Channel Assignment

Each point is uniquely identified by a combination of both Module slot position and channel number.


of 89

6 Single Digital Inputs (SDI)

6.1 Configuration Table

The Single Digital Input (SDI) component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 11. The SDI component is used to configure single digital input points.

Simply drag the SDI icon from the Elements window onto the required unit or card in the Project Hierarchy. As you drop it you will be prompted for the number of records to create. Once the required number of entries is created they will be displayed in the Data Window where the default parameters may be edited as shown in Figure 11.

Figure 11 SDI Record creation

SDI points are configured with filters to report only valid changes in value. These filters are discussed in sections 6.2 and 6.3 .

SDI points are mapped to slave protocols as a 1-bit data field.

Table 7 gives the field definitions for the Single Digital Input (SDI) component.


of 89


TAG 40 Characters This is a unique identifier for the point.


Channel 0 to 255 The channel number is the point‟s position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point.

On Time (ms)

0 to 60,000 This is the time, in milliseconds, that the digital input must be in its active state before the change of state (from OFF to ON) is recognised. See section 6.3 .

Off Time (ms)

0 to 60,000 This is the time, in milliseconds, that the digital input must be in its inactive state before the change of state (from ON to OFF) is recognised. See section 6.3 .

Invert Yes/No This drop down selector allows you to invert the reported value of the digital input.

Inhibit Auto Suppression,

Manual Suppression,

No Suppression

Auto Suppression means that the point can be automatically suppressed if the frequency of transitions exceeds a configured limit within a limited time. Refer to section on auto suppression for further details

Manual Suppression inhibits the operation of the point until it is reconfigured with this option removed.

No Suppression will allow normal processing of the point with no suppression allowed.

Debounce Time (ms)

4 to 255 Before a digital input change is reported, it must have a stable value for the Debounce Time. See section 6.2 .

Table 7 SDI Parameter Definitions


of 89

6.2 SDI Debounce

SDI points are configured with three values for filtering the input value before report. The most commonly used filter parameter is the Debounce Time.

The Debounce Time in the SDI configuration table is used to filter short duration contact bounce on inputs. Any input change shorter than the Debounce Time is discarded.

In operation, the first change to occur for a point is recorded with a time stamp. Any further changes are then discarded. Once the input has stabilised to a new value, it is reported using the first recorded time stamp. The Debounce Time configures the duration the input must be stable for before the new value is reported.

An example of the debounce filter in operation is given in figure 12.

Figure 12 Debounce Filter Operation

In figure 12, at the point in time marked 1 the input value changes for the first time. The timestamp is recorded for this change.

The time durations between the points marked 1 and 2, points 2 and 3, points 3 and 4 and points 4 and 5 are all of a shorter duration than the debounce time. These changes are not reported and the time stored is dumped.

The time between points 5 and 6 is greater than the configured debounce time, and the input is now stable as a value of 1. At point 6, the new value is reported, using the timestamp recorded a point 5.

At point 7, the input value changes again. Because a new value has been reported, the filter is restarted and a timestamp is recorded for this change.

The time durations between points 7 and 8, points 8 and 9, points 9 and 10 and points 10 and 11 are all of a shorter duration than the debounce time. These changes are not reported and the time stored is reset every time.

The time between points 11 and 12 is greater than the configured debounce time, and the input is now stable as a value of 0. At point 12, the new value is reported, using the timestamp recorded at point 11.

6.3 SDI Time Filter

SDI points may be filtered so that a state must be of a minimum duration before being reported. Changes of a short duration are not reported. The minimum ON time and


of 89

minimum OFF time may be configured separately.

This filter causes the report of a change of state to be delayed. Once the duration of the input value change is greater than the configured time, it is reported using the timestamp of the last change.

The On Time filter and the Off Time filters are applied after debounce time filtering. Only input value changes which have first satisfied the debounce time are subsequently checked by the time filters.

An example of an ON Time filter is shown in figure 13.

Figure 13 SDI ON Time Filter

As per the earlier section, the time between points 5 and 6 is greater than the configured debounce time, and the input is now stable as a value of 1. At point 6, the new value was reported, using the timestamp recorded a point 5.

But if there is a SDI On Filter time configured, then the point will not be reported till the ON-time is exceeded in the same state. So at 7 the point will be reported with the time from 5.

A similar procedure works for the OFF filter time.


of 89

7 Double Digital Inputs (DDI)

The Double Digital Input (DDI) component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 14.

The DDI table configures pairs of consecutive digital input channels to operate as double digital inputs. Double digital inputs produce an integer value between 0 and 3.

Figure 14 DDI Record definition

DDI points are mapped to slave protocols using the 2-bit data field type.

Table 8 gives the field definitions for the Double Digital Input (DDI) component including limits.


TAG 40 Characters

This is a unique identifier for the point.


of 89



Channel 0 to 254 This defines the first of 2 digital input channels on a unit. These are the channels used to calculate the Double Digital Input (DDI) value.

Valid (10/01) time (ms)

0 to 60,000 This field defines the time, in milliseconds, that the two digital inputs must remain in the VALID state before being reported as a valid input. Refer to section 7.3 .

Invalid (00/11) time

(ms)

0 to 60,000 This field defines the time, in milliseconds, that the two digital inputs must remain in the INVALID state before being reported as an invalid input. Refer to section 7.3 .

Invert Yes/No This is a drop down selector field that allows you to swap the significance of each input channel. If set to „No‟, the first channel is the least significant. If set to „Yes‟, the first channel is the most significant.

Inhibit Auto Suppression

Manual Suppression

No Suppression

This drop down selector allows you to select the type of suppression that is applied.

Auto Suppression means that the point can be automatically suppressed if the frequency of transitions exceeds a configured limit within a certain time. Refer to the section on Auto Suppression for further details.

Manual Suppression inhibits the operation of the point until it is reconfigured with this option removed.

No Suppression will allow normal processing of the point with no suppression applied at any time.

Debounce Time (ms)

4 to 255 Before a digital input change from either input channel is used, it must have had a stable value for this Debounce Time. Refer to section 7.2 .

Timestamp as

First Change

Last Change

This drop down selector allows you to select how the DDI change event will be time stamped. Default is „Last change‟.

First change means that the timestamp used for the DDI event will be the timestamp of the first digital input change of state for that DDI, before the time filter is applied.

Last change means that the timestamp for the DDI event will be the timestamp of the last of the digital inputs changing state for that DDI.

Refer to section 7.3 .

Table 8 DDI Parameter Definitions


of 89

7.1 Operation

DDI points can have values of 0, 1, 2 or 3. A Value of 1 or 2 is considered „valid‟, since a single input signal is active. The calculation of the DDI value from the input channels is illustrated in table 9.

First Channel Second Channel

DDI Value

Invert = No Invert = Yes

Decimal Binary Decimal Binary

OFF OFF 0 00 0 00

ON OFF 1 01 2 10

OFF ON 2 10 1 01

ON ON 3 11 3 11

Table 9 DDI Value

7.2 DDI Debounce

The Debounce Time is intended to filter short duration spikes and contact bounce on inputs. Before either of the input signals is used to calculate a DDI value, the input must be stable for greater than the Debounce Time. Changes due to contact „bounce‟ are filtered out.

For further details, please refer to the discussion of SDI Debounce in section 6.2 .

7.3 DDI Time Filter

To prevent the report of 00 transitions between valid DDI states, the DDI point may be configured to filter changes that last for only a short duration. Typically, the Invalid Time is configured to allow the connected equipment to change between two „Valid‟ states without an unnecessary „Invalid‟ report.

The time filter is applied after the debounce filter has been applied to any input transition. Only transitions which first satisfy the „debounce‟ criteria may be reported.

If the Timestamp As field is set to First Change, then DDI events will report using the timestamp of when the initial state changed (e.g. 10 -> 00). This change may have resulted in a DDI state that was not reported (e.g. 00), because of the time filter.

If the Timestamp As field is set to Last Change, then DDI events will report using the timestamp of the last input change, the change at which the new state occurred.

Valid


of 89

8 Automatic Suppression

The Automatic Suppression component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 15.

The automatic suppression function prevents digital inputs from producing excessive change reports due to a failure. These reports may otherwise consume processing resources and communications throughput. The Auto Suppression table configures the maximum number of changes per period that any input may report.

The suppression of a point is based on a configurable number of changes, the Threshold, in a configurable time period, the Suppression Window. Once the threshold has been exceeded within the suppression window, the point is marked with a Suppressed quality flag and further changes are not reported.

The suppression is removed after the configurable period, the „Release Window‟, has elapsed without any changes.

Only one record is required per unit. Refer to Figure 15 as an example of Auto Suppression Configuration. In this table, a digital input will be marked as suppressed on the 33rd change in value if occurs within 1 second of the first change. The input must not change state for 1 second for the suppression status to be removed.

Figure 15 Automatic Suppress Record Configuration

This table is required for each unit where Automatic Suppression is used. The values in this table will apply to all SDI and DDI points in that unit which are configured to use automatic suppression.


of 89

The table below gives the field definitions for the Automatic Suppression component including limits where applicable.




Threshold 1 to 64 The number of valid changes a point may make without activating suppression. Once the „Threshold‟ number of changes has been reported, a further change will show the point as suppressed. No more changes are then reported.

Suppress Time

Window

(s)

1 to 60 seconds Suppression period in seconds. Suppression is activated for a point if the „Threshold‟ number of changes is exceeded within the „Suppress Time Window‟.

Release Time

Window

(s)

1 to 30 seconds Suppression is removed after this period has elapsed without any changes in a point‟s state. If a change is detected the timer is restarted.

Enabled Yes/No Allows the table to be downloaded with or without activation.

Table 10 Auto Suppression Parameter Definitions


of 89

9 Digital Outputs (DOT)

9.1 Configuration

The Digital Output (DOT) component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 16. The DOT component is used to configure the digital outputs / control outputs.

Figure 16 Digital Output (DOT) Record Configuration

The DOT table configures digital output points that may be mapped to a slave protocol using the 1 bit data field type.


of 89

The table below gives the field definitions for the Digital Output component, including limits where applicable.





Stages One Stage/ Three Stage

This is a drop down selection field that defines command security for the individual DOT point. In Single Stage operation, the output is operated with a single command message.

In Three Stage operation, the output requires a secure sequence of three XCell messages for operation.

Output Mode Pulse Only / Allow Steady

State

This is a drop-down selector field that defines the permitted output modes of the DOT point.

Points which are configured as Allow Steady State accept commands to latch ON for an indefinite period. They also accept commands to pulse ON with a duration supplied by the command‟s source.

If a point is configured as Pulse Only, then commands to latch ON the point will execute a pulse command with a duration set by Pulse Time.

Pulse Time (ms)

10 to 10,000 milliseconds

This is the period, in milliseconds, for which a Pulse Only DOT is active for latch ON commands.

If the DOT is set to Allow Steady-State this field is ignored.

Table 11 DOT Parameter Definitions


of 89

9.2 DOT table rev. 012

The rev 012 table has some additional configuration fields which allow the user to add a local/remote tag which will enable and disable control operation depending on its state. Additional parameters are:

Output Enable – Use: Yes or No

Output Enable – Enable Tag: User puts the reference tag in this field to be used to enable or disable that control.

Output Enable – Disable State: On or Off - This is the state of the referenced tag that will disable the control.


of 89

9.3 Control Security

Controls may be configured as One Stage or Three Stage outputs. In three stage operation, an output requires a secure sequence of three XCell messages for operation.

Typically, a slave protocol will transparently forward a master station‟s select/execute, or select-before-operate, control sequences as three stage operations. This ensures that only the correct output point operates as desired.

The XCell will only allow a single three stage output to a DO card on any unit. If a three stage DOT output is ON, then further select operations to the unit will fail and no other three stage output will be allowed.

Three stage controls will not operate in response to one stage commands. One stage controls will not operate in response to three stage commands.

9.4 Output Mode

In Pulse Only mode, DOT points execute commands to latch ON as pulse outputs of a duration specified by the Pulse Time in the DOT table. This configuration supports Master Station protocols which do not provide information on how a point is to be operated, and prevents an output from remaining in the ON state indefinitely.

If a point is Allow Steady State, then the master station protocol provides the information on how to operate the point. In this configuration, the point may be latched to the ON state if requested.


of 89

9.5 Single Output Operation

The product software will prevent more than one three stage command from being executed on a unit at any one time. When a three stage select is received, a failure response is returned if another point has not yet completed its requested operation.

In addition, HDO cards implement a configurable hardware safety setting. If it is set with the hardware jumper, then the card may be in „1-Up Operation Mode‟. In this mode, the card will read back the state of all outputs whenever a point is selected for three stage or single stage operation. The card will not operate any further controls if a point is already operating.

This prevents the card operating a point incorrectly due to a failed output driver, by detecting the failure before the output contacts are energised at the execute stage.

Figure 17 Single Output Operation

Selected Control Output and point selection

verification

HDO-040 Execute Control Relay

Switch PWR Output that energizes only while the selected control point is executed. Can be used for additional external relay control security

logic.


of 89

9.6 Multiple Master Stations

Multiple Master stations may be connected to the RTU at one time.

To prevent multiple points from operating, the IOServer firmware will fail a second master station‟s select command if a three stage control is already selected, or operating, from another master station.

While a three-stage point is in the select stage, all other master stations are locked out from three-stage operation on a unit. The first master station to begin a sequence may continue without interruption, as commands from other sources have no effect.

Should a master station control sequence be interrupted, the point‟s select status will time out and control is then allowed from other sources.

This scheme prevents an incorrect control point from operating, since only a single command source is allowed to issue each stage of a secure control sequence.


of 89

10 Analog Inputs Table (AIN)

10.1 Configuration

The AIN component is used to configure scaled DC analog inputs. Either voltage or current inputs may be measured and reported as an integer value, suitable for transmission to a master station. The table configures the range of this value, as well as the operation of its associated status information.

Analog measurements are 16 bit unsigned quantities. Internally, 0 counts represent negative full scale and 65535 counts represent positive full scale for a particular card.

The AIN component is contained in the Elements window under the Points tab and the Analog sub-group as shown in Figure 18.

Figure 18 Analog Input (AIN) Configuration


of 89

The analog input points configured by the AIN table may be mapped to a slave protocol using the 16 bit unsigned data field type.

The following table gives the field definitions for the Analog Input component (AIN).


TAG 40 Characters



This is an optional brief description of the point.


Delta (0.01%)

0 to 10,000

(0 - 100 %)

This is the amount the input must change by to generate a new change event. It is specified as a percentage of the valid measurement range, and is entered as % x 100 (e.g. 8% = 800).

Polarity Unipolar / Bipolar

This is a drop-down selection field that determines if this particular AIN reports values as Unipolar or Bipolar.

Typically, a protocol will scale unipolar analogs to fit it‟s range of positive values. Bipolar analogs are scaled to fit the entire range of values supported by the protocol.

Max +100.00 to -100.00

This value specifies the maximum valid input value that should be reported by this AIN channel. This quantity has the same units as configured for the Hardware Max field.

Min +100.00 to -100.00

This value specifies the minimum valid input value that should be reported by this AIN channel. This quantity has the same units as configured for the Hardware Max field.

High Limit Less than or equal to 'Max' value

This value is used to set the high limit alarm on this AIN point. The high limit alarm is a status associated with the analog value, which may be transmitted to a master station if supported by the protocol.

Low Limit Greater than or equal to

'Min' value

This value is used to set the low limit alarm on this AIN point. The low limit alarm is a status associated with the analog value, which may be transmitted to a master station if supported by the protocol.

Alarm Delta (0.01%)

0 to 10,000 (100%)

This is the amount by which the analog value must change before an alarm state is reset. It is specified as a percentage of the valid measurement range, and is entered as % x 100.

Hardware Max

0 to100.00 This field specifies the maximum analog input value that the channel can measure, not including the over range percentage. The value and units for this field are determined by the I/O card in use, e.g. 20 for +/- 20mA card.

Hardware Over Range

(%)

0 to 100% The analog input channel‟s over range before scaling is specified by this field. This is typically a value of 5, determined by the I/O card in use.


of 89

Output Over

Range (%)

0 to 10% The output measurement may allow for values outside the valid measurement range. This is the over range amount, specified as a percentage of the valid range.

Hysteresis (0.1%)

0 to 99 (9.9%)

This band operates outside the normal range at both ends for the setting of the „out of configured‟ bit in the status. The band is divided into 2 halves. Within the outer half, the bit will remain set only if it was already set.

Table 12 AIN Point Parameter Definitions

10.2 Analog Input Scaling

There are a number of configurable options in the AIN table that determine how the analog input values are scaled.

The input range of the hardware channel (before scaling) is specified in the fields Hardware Max and Hardware Over Range (%). The Hardware Max value, plus the Hardware Over Range (%), is the maximum measurement that the input channel can make. For the HAI-030 card, these values would typically be entered as 20.00 for 20mA and 5 for 5 % respectively. The input channels in this case can measure values from -21mA to 21mA.

The Max and the Min values specify the user range for this input channel. The Max and Min must lie within +/- (Hardware Max + Hardware Over Range). For example, a Min of 0 and a Max of 10 would specify that the signal should be scaled so that the valid range represented 0 to 10mA rather than the hardware range 0 to 20mA.

The final scaled value is represented in the XCell product as 0-65535 with a Unipolar/Bipolar flag.

If a point is configured as Unipolar then 0 corresponds to the Min value and 65535 corresponds to the Max value plus the Output Over Range (%). If the Output Over Range (%) is set to 0 then 65535 represents Max value. If the Output Over Range (%) is set to 5% then 62415 represents the Max value.

If a point is configured as Bipolar then 0 corresponds to the Min value minus Output Over Range (%) and 65535 corresponds to the Max value plus the Output Over Range (%). If the Output Over Range (%) is set to 0 then 0 represents Min value and 65535 represents Max value. If the Output Over Range (%) is set to 5% then 1560 counts represents Min value and 63975 represents the Max value.

10.3 Limit Alarm Processing

Some of the status flags associated with an analog input indicate to a protocol that the point‟s value has exceeded a high or low limit.

The low limit alarm is set ON when the input is less than the value specified by Low Limit.

The high limit alarm is set ON when the input is greater than the value specified by High Limit.

Before the alarms are reset, the point‟s value must return to within range by the Alarm Delta amount. The alarm delta is specified as a percentage of the valid measurement range.

10.4 Database Update

Analog input changes are only processed if the input changes by more than the Raw Delta counts (input range is 0-65535) configured in the HAI Card Config table. They are


of 89

then scaled and according to the configuration in the AIN Table and if the scaled value has changed by more than the Delta value in the AIN Table then it will be reported. The analog value will also be reported if any of the status flags have changed.


of 89

10.5 Sample Configuration

Figure 19 Example AIN Configuration (1)

Figure 20 Example AIN Configuration (2)

In the sample configuration above, an analog input is configured on channel 32 of the unit (i.e. the first channel on the second I/O card). The point TAG is „U1AIN_0‟ and this reference Tag is used in any protocol map table to configure the protocol specific address for the point.

The analog module is calibrated to +/-20mA +5% over range so in the sample configuration the Hardware Max value is set to 20, with a 5% Hardware Over Range.

The range of the connected instrument is from 0 to 20mA, i.e. the minimum input will be 0mA, and the maximum input will be 20mA. These are configured in the Instrument Range Max & Min and setting the Polarity to Unipolar. The Output Over Range is set to 0% which specifies that the full 0 to 65535 count range will represent the instrument range of 0 to 20mA.

Note: The unipolar setting also indicates to protocols that there are the measurement is entirely positive and should be transferred, by default, to the positive range of the protocol. For a protocol such as DNP3, which has a range from –32768 to 32767, the input would be scaled into the range of 0 to 32767 if not otherwise specified.

The Delta (0.01%) is set to 800 which corresponds to an actual delta of 8% (i.e. 800 x 0.01%). This means that the value must change by greater than 8% of the 20mA range (i.e. 1.6mA) before the new value will be reported.

The Low and High Limit alarms are generally unused and set to Min & Max respectively. They set low/high alarm indicators associated with the point if the limits are transgressed. However, unless the protocol supports these flags they are not mapped back to the Control Centre.

In this case, the Low Limit alarm will be set once the input falls below 4mA. This alarm will not be reset until the input value is increased by 0.1% Alarm Delta (10 x 0.01%) of 20mA, to 4.02mA. The high limit alarm will be set for an input greater than High Limit of 18mA, and reset once the input falls below 17.98mA.


of 89

11 Analog Outputs

The Analog Output AOT component is contained in the Elements window under the Points tab and the Analog sub-group. The AOT component is used to configure the analog outputs for a unit.

The table below gives the field definitions for the Analog Output component.


TAG 40 Characters



This is an optional brief description of the point.

Channel 0 to 255 The channel number is the point‟s position on the unit. It is used for addressing the point.

Table 13 AOT Point Parameter Definitions

Analog output modules have a maximum of 8 channels each and two modules can be fitted on an IOCB (carrier board) that occupies one card position in a rack. This IOCB carrier card always occupies 16 channels regardless of whether two AOT modules are fitted or whether the AOT modules are 4 or 8 channels each. The following table gives the hardware channels corresponding to the AOT cards fitted in an IOCB carrier board.

Hardware Channel

8 Channel AOTs 4 Channel AOTs

0 Channel 1 on AOT Card 1 Channel 1 on AOT Card 1




4 Channel 5 on AOT Card 1 Unused












Table 14 AOT Hardware Channels

Analog outputs are mapped as 16 bit unsigned quantities from slave protocols. A value of 0 counts will result in the minimum output current, and 65535 represents full scale output.


of 89

12 Optional Tables

These tables are only supplied on specific projects where the functionality is required.


of 89

12.1 Raise-Lower Pairs

The Raise-Lower Pairs table allows single digital output points to be paired together. The two channels will not operate simultaneously, providing output security for single stage controls such as transformer tap change outputs or pulse width modulation controls, often used for frequency control.

Raise-Lower Pairs points do not support three-stage operation.

Raise-Lower Pairs support eXpress with the use of the Raise-Lower Xprs Map and Raise-Lower Xprs Points tables, described in section 12.2 . These tables allow eXpress to output accurate pulse width modulated outputs.

Figure 21 Raise-Lower Pairs


of 89

Each pair has one Raise channel and one Lower channel. This is the channel‟s Type.

If the Raise channel receives an output command, then the Type of the following table entry is checked. If the following entry is a Lower type, then the two channels are a pair.

Similarly, if the Lower channel receives an output command, then the Type of the previous table entry is checked. If the previous entry is a Raise type, then the two channels are a pair.

In either case, an output command for either channel of a pair will cancel any command in progress for that pair. A raise command will immediately cancel any in-progress command on its own channel or on the Lower channel. A lower command will immediately cancel any in-progress command for its own channel or the Raise channel.

A third Type is a Single output channel. These channels are not paired. This type is provided for situations in which DOT points are required to cancel any in-progress commands on a channel and begin execution of a new command. The normal behaviour for DOT points is to ignore pulse commands received while executing a previous command.

A Single type output channel also allows eXpress to execute accurate pulse train commands for a single channel.


of 89

The table below gives the field definition parameters for the Raise-Lower Pairs table.




Channel 0 - 255 The channel number is the digital output point‟s position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point.

Type Raise/Lower/Single Used to pair together channels that should not execute controls simultaneously into Raise/Lower pairs.

RL Xprs Map 40 Characters References a Raise-Lower Xprs Map table entry that defines the pulse train parameters that are used to execute express commands.

Table 15 Raise-Lower Pairs Parameter Definitions


of 89

12.2 Pulse Train Outputs From eXpress

eXpress may generate pulse trains by switching DOT points on and off within the user program at the required rate, but the accuracy of these outputs is limited to the period at which the eXpress program is running. A typical figure might be 100ms.

To output an accurate pulse train, the eXpress program can supply a Raise-Lower point with the exact pulse train parameters and allow it to control the channel switching.

This requires two additional tables to the points of the Raise-Lower Pairs table.

The Raise-Lower Xprs Map table configures sets of values that are used to output a particular pulse train configuration. The points of the Raise-Lower Xprs Points table hold the individual values.




Pulse Count Reference Tag The Tag name of the point used to hold the value for the number of pulses that should be executed by the Raise-Lower Point. The pulse count value is valid from 0 to 255.

Pulse On Time

Reference Tag The Tag name of the point used to hold the value for the duration of the pulses, in milliseconds. The valid range is 0 to 65535.

Pulse Off Time

Reference Tag The Tag name of the point used to hold the value for the delay between pulses, in milliseconds. The valid range is 0 to 65535.

Table 16 Raise-Lower Xprs Map Definitions




Table 17 Raise-Lower Xprs Points Parameter Definitions

To execute a pulse train, the eXpress program should first drive a set of the Raise-Lower Xprs Points to the desired pulse train parameter values.

The Raise-Lower Xprs Points are mapped to a particular Raise-Lower Pairs digital output point using an entry of the Raise-Lower Xprs Map.

The pulse train then begins execution when the Raise-Lower Pairs digital output point is operated.


of 89

For example, a simple configuration of one Raise-Lower Pair may use six Raise-Lower Xprs Points, as shown below.

Figure 22 Raise-Lower Xprs Points

Each of these six points is mapped to eXpress, which drives them to the desired values. Each point is then mapped in the Raise-Lower Xprs Map, as shown below.


of 89

Figure 23 Raise-Lower Xprs Map

Each Raise-Lower channel is associated with a parameter set using the RL Xprs Map field of the Raise-Lower pairs table, as shown below.


of 89

Figure 24 Raise-Lower Pairs Example

The Raise-Lower Pairs points are digital outputs within eXpress. When these points are turned ON, the point cancels any in-progress command and begins the execution of a new pulse train. This pulse train has a count, on time and off time determined by the values of the points mapped by the associated RL Xprs Map entry.

In this example, when eXpress drives „RAISE_1‟ ON, a pulse train output is executed for channel 0. The pulse train has a pulse count equal to the current value of „RAISE_1_COUNT‟. It has a pulse duration of „RAISE_1_ON_TIME‟, and a delay between pulses of „RAISE_1_OFF_TIME‟.


of 89

12.3 Sequenced DO

The Sequenced DO table is used to configure DOT points so that a single master station command may generate a series of up to three simultaneous pulse outputs.

The three outputs each have configured durations, and are configured to begin their operation after a configured delay. This provides for output schemes which use a „select‟ output for a particular piece of equipment, and „Trigger‟ and „Heavy Duty‟ outputs to complete the operation. For example, the „Trigger‟ output may go to circuit breaker synchronization device, and the „Heavy Duty‟ output may drive a relay capable of switching a high current.

Each Sequenced DO control has a Select Channel. This digital output channel operates in response to a master station command with a pulse of Select Duration milliseconds.

If a Trigger Point is configured, then Trigger Delay milliseconds after the Select Channel begins operation, the Trigger Point DOT point operates with a pulse of Trigger Duration milliseconds.

After a further delay of Heavy Duty Delay milliseconds, the Heavy Duty Output is operated with a pulse duration of Heavy Duty Duration milliseconds.

Figure 25 Sequenced DO Example


of 89




Select Channel

0 - 255 The channel number of the „select‟ output point.

Select Duration

0 - 600000 ms The duration of the Select Channel pulse.

Trigger Point Reference Tag A DOT point configured as „Single Stage‟ Type. The point may be local or remote to the unit. If empty, no trigger point is operated.

Trigger Delay 0 - 600000 ms The delay after the select channel begins operation before the trigger point is operated.

Trigger Duration

0 - 600000 ms The duration of the Trigger Point pulse.

Heavy Duty Output

Reference Tag A DOT point configured as „Single Stage‟ Type. The point may be local or remote to the unit.

Heavy Duty Delay

0 - 600000 ms If a Trigger Point is configured, the delay after the Trigger Point begins operation before the Heavy Duty Output is operated.

If no Trigger Point is configured, the delay after the select channel begins operation before the Heavy Duty Output is operated.

Heavy Duty Duration

0 - 600000 ms The duration of the Heavy Duty Output pulse.

Table 18 Sequenced DO Definitions


of 89

12.4 Network Time Protocol Client (NTP) Configuration

The NTP component allows you to enable the operation of an NTP client on a processor. Only one entry is allowed per cell and this limit is enforced by Workbench.

The NTP client will periodically query an NTP Server via Ethernet for the current time and then update the RTU‟s system time.

The IP address of the server can be specified in the TCP/IP table, or may be supplied by a BOOTP server. NTP uses UDP format packets on source and destination ports 123, which must be passed by any network firewalls in place.

The TAG may be used to map the status of the NTP client to a slave protocol. It is a digital input that is OFF when the time has been updated successfully, and ON when the last operation failed.

The NTP component is contained in the Elements window under the Projects tab and the Network sub-group as shown.

Figure 26 NTP Configuration

The table below gives the field definition parameters for the NTP Configuration component.


of 89

Table 19 NTP Parameter Definitions


TAG 40 Characters The Tag is a unique identifier for the table in the Workbench project. The TAG may be used to map the status of the NTP client to a slave protocol. It is a digital input that is OFF when the time has been updated successfully, and ON when the last operation failed.

NTP Sync Enabled / Disabled Enables or disables the NTP client.

Time Zone – Hour Offset

-12 to 12 hours The number of hours by which to adjust the GMT time received from the server.

Time Zone – Minute Offset

-59 to 59 minutes The number of minutes by which to adjust the GMT time received from the server.

Sync Period 6 to 600000 seconds,

default 60

How often to update the RTU system time from the NTP server, in seconds.

Priority 2 to 100,

default 95

The relative priority of this time source. High priority time sources are used in preference to low priorities. Other time sources may include GPS clocks with a priority of 100, or slave protocols with a typical priority of 40.


of 89

12.5 HAI Card Config

The “HAI Card Config” component is used to configure the general operation of all analog input cards on a cell.

The component is contained in the Elements window under the Points tab and the Analog sub-group as shown below.

Figure 27 Analog Input Card Operation Configuration


of 89

The table below gives the field definitions for the component including limits.

Field Name

Value Comments

Scan Rate Normal / Fast

The „Scan Rate‟ is the frequency with which each point on the analog input card is updated.

The „Normal‟ rate updates the values every 2.35 seconds.

The „Fast‟ rate updates the values every 1.18 seconds.

Raw Delta 5 to 255 Counts

This is the minimum change in input counts required for any analog point to report a change in value. 1 count is 1/65535 of the card‟s full measurement range, before scaling.

Table 20 HAI Card Parameter Definitions


of 89

12.6 Accumulators

12.6.1 Configuration

Accumulator points maintain a count of input changes over a period of time. The input may be a single or double digital input channel, a high speed counter card channel or an AC analog input card channel.

The accumulator component is contained in the Elements window under the Points tab and the General sub-group as shown below.

Figure 28 Accumulator Table

The current count of changes is kept in the accumulator point‟s running value field. This running value is copied to the frozen value when a command from the master station is received, or automatically, with a configured period. The frozen value is useful for obtaining a system wide snapshot of the accumulator values, synchronized in time.

To map an accumulator to a slave protocol, the 32 Bit Data field should be selected.

To map the running value of an accumulator to a slave protocol which requires separate entries, use the Running Value field. This is not the case for the DNP 3 slave protocol.

Both quantities are 32 bit values, for a maximum count value of 4,294,967,295.


of 89

The table below gives the field definitions for the Accumulator component.





Input Type Single DI Channel ON

Single DI Channel OFF

Single DI Channel ON Or OFF

Double DI Channel Valid

Double DI Channel ON,OFF

Double DI Channel OFF,ON

High Speed Counter

ACI-030

The input type determines the type and configuration of the input point to be counted.

Described in section 12.6.2 .

Period Minutes

1 to 10000

If not set to 0, the accumulator will automatically update the frozen value from the running value with this period. The period is synchronized to begin at midnight each day.

Phase Minutes

0 to 10000

If configured to automatically freeze, the phase determines how many minutes into each period at which to do it.

Auto Reset Yes, No If „Yes‟, the running value is set to „0‟ when an automatic freeze takes place.

Rollover 0 to 4,294,967,295

This is the maximum value the accumulator values can reach. Once the Roll over value has been reached, the next input count will have a value of 0.

Save Save Values

Save Running

Save Frozen

Don't Save

This option determines if one or both of the counter's values are saved to NVRAM to be preserved over reboot.


of 89

Delta 1 to 1000 This is the minimum amount by which the running value must change for an update to be sent.

The running value is updated every minute if it has changed, even if the delta has not been exceeded.

Table 21 Accumulator Configuration

12.6.2 Input Types

The accumulator point can count changes in three different I/O card types.

The card may be the high speed counter or the AC analog input type. These two cards supply input channels which are responsible for the decision on when to increment the count.

The accumulator point can also count changes in digital input channels. In this case, the accumulator point requires further configuration to specify when the count value should increment.

If the input type is configured as Single DI Channel ON, the accumulator will increment when the digital input of the configured Channel turns ON. Changes to OFF will be ignored.

A Single DI Channel OFF input type configures the accumulator to increment only when the digital input channel turns OFF.

Single DI Channel ON or OFF configures the accumulator to increment whenever the digital input changes value.

A Double DI Channel Valid input type specifies that the accumulator has two digital input channels. The Channel entry defines the first, and the second is the next consecutive channel. The accumulator will increment whenever the two input channels change to a new valid state. The valid states are ON/OFF and OFF/ON. Changes from a valid state to an invalid state, and then to the original valid state are not counted.

The Double DI Channel ON,OFF input type also configures the accumulator to count the changes in a pair of digital input channels. In this case, the count is incremented when the configured channel is ON and the next consecutive channel is OFF.

The Double DI Channel OFF,ON input type configures the accumulator to increment when the configured channel is OFF and the next channel is ON.

12.6.3 Running Value Change Messages

Because the input point may be changing frequently, the accumulator running value may produce a large number of change messages.

To reduce the number of change messages, the running value may be configured with a Delta. The running value is only updated when it has been incremented by the Delta amount.

The running value is also limited to a maximum of 250 changes in any minute. Input changes in excess of this will increment the value, but will not produce an update.

If changed, the running value is updated every minute, on the minute. This occurs even if the value has not exceeded the delta value, or if the point is producing more than the 250 change limit. This means that the maximum amount of time for which the value is inaccurate at the master station is limited to 1 minute.

The running value is also updated prior to a freeze operation.


of 89

12.6.4 Digital Input Time Stamping

Digital input channels configured as accumulator inputs are processed by the Debounce Filter as described in section 6.2 - SDI Debounce and 7.2 - DDI Debounce. The Debounce Time is determined by the DDI or SDI configuration if present. Otherwise, the default time of 10 milliseconds is used.

The debounce filter may introduce a delay in incrementing the count. The count value is accurate to within the Debounce Time of the time of any update.


of 89

12.7 Binary Coded Decimal Component (BCD)

Binary Coded Decimal (BCD) input components allow configuration of digital-inputs to be processed as a BCD value. BCD values with between 1 and 4 digits are supported i.e. 0-9999. Each digit is derived from 4 consecutive physical digital input channels. The order of the channel allocation is shown below:

Chan: 16-15-14-13 12-11-10-09 08-07-06-05 04-03-02-01

State: 0 1 0 0 0 0 1 1 0 0 1 0 0 0 0 1

BCD Digit: 4 3 2 1

BCD Value = 4321

The BCD component is contained in the Elements window under the Points tab and the General sub-group as shown below.

Figure 29 BCD Configuration


of 89

The table below gives the field definitions for the Binary Coded Decimal (BCD) component including limits where applicable.


TAG 40 Characters




Start Channel Number

0 to 252 This value is the start channel number of the least significant bit of the least significant digit of the BCD number being configured, in the example at the start of this section it would be 0 with the next 16 channels allocated to the four BCD digits 0-3. BCD numbers are ALWAYS allocated contiguous channels, in the sample case channels 0-15 would be allocated for the four-digit BCD number.

Note: the highest channel usable on a Unit is 252 as FOUR contiguous digital channels are needed for each BCD digit.

BCD Digits 1 to 4 This value is the number of contiguous BCD digits in the configured BCD number, the BCD number will use 4 x BCD Digits contiguous channels from the channel specified in the Start Channel Number field.

Validity Channel

0 to 255 This field contains the physical channel number of a digital input that may be used to validate the BCD input channels. The BCD input channels will not be latched into the BCD number until this channel goes to the required state set in the Validity State field below. This field and the Validity State field below may be used instead of the On Time and Off Time fields.

If set to 0, a validity channel is not used.

Validity State On/Off This field contains the state that the Validity Channel must achieve to validate the BCD input channels to allow the number to be latched into the XCell RTU.

ON Time

(ms)

0 to 65,000 This field contains the time, in milliseconds, that the BCD input channels must be stable (not oscillating) when changing from the OFF state to the ON state, in order that the BCD number presented on the channels can be latched into the XCell RTU. This field and the Off Time field below are used as an alternate validation mechanism to the Validity Channel and Validity State fields above.

OFF Time

(ms)

0 to 65,000 This field contains the time, in milliseconds, that the BCD input channels must be stable (not oscillating) when changing from the OFF state to the ON state, in order that the BCD number presented on the channels can be latched into the XCell RTU. This field and the On Time field above are used as an alternate validation mechanism to the Validity Channel and Validity State fields above.


of 89

Invert Yes/No This is a drop-down selector field that allows the state of all of the BCD input channels (except the Validity channel) to be inverted.

Table 22 BCD Point Parameter Definitions


of 89

12.8 TAP Position Component (TAP)

The Tap Position Component (TAP) is used to configure inputs from transformer tap changers. It reports either an analog input value or a sequence of digital inputs as an eight bit integer value for the tap position. CG Automation Ireland Limited only uses this element for status tap indication which changes the group of status inputs (one per tap, only one ON at a time) into an analog tag defined by the user in the table. This element should be under the HDI module Icon.

Conversion from an analog input to a Tap value should use the TAP AI element.

The TAP component is contained in the Elements window under the Points tab and the General sub-group as shown below.

Figure 30 Transformer TAP Configuration

Transformer Tap Changers provide an indication of the current tap position. This is generally provided in one of two methods (but this table should only be used for Digital Tap Position, for Analog Taps see next section).

1. Digital Tap Position: A number of digital contacts – each one representing one tap position. At any tap position the corresponding contact is energized thus providing an indication of the current tap position.

2. Analog Tap Position: One analog signal is provided which is proportional to the actual transformer tap position. Each consecutive tap position causes a corresponding increase in the analog value.

The minimum and the maximum tap position values are defined through the First Tap and Last Tap fields respectively.

Tap position points are mapped to slave protocols as 8 bit unsigned data field types.


of 89

The table below gives the field definitions for the TAP component including limits where applicable.




Channel 0 to 255 This defines the input channel number for analog input tap indications, and the first of a sequence of channel numbers for digital indications. The digital input channels used are consecutive, one for each of the tap positions (('First Tap' – 'Last Tap') + 1 channels).

Deadband 0 to 100 This field is used for analog input types only. Each tap position is represented by an analog input value. The deadband is a percentage of the range between input values that are considered a valid measurement. A value of 100% will cause the tap position closest to the current value to be used. For a smaller deadband, invalid measurements result in a status of “Out Of Configured Range”.

Signal Type Digital/Analog This is a drop-down selection field that determines the type of tap position indication being monitored and this in turn defines the configuration of the component.

Transformer Double/Auto This is a drop-down selection field that defines the transformer winding type.

The double wound tap positions begin use the value of „First Tap‟ for the minimum analog input value or for the first digital input channel number. The auto wound tap positions begin with the value of „Last Tap‟ for the minimum input current or the first digital input channel.

First Tap 0 to 254 This defines the lowest value of tap position.

Last Tap 0 to 254 This defines the greatest value of tap position.

Inverted Yes/No This is a drop-down selection field that allows the inputs from Digital TAP positions to be inverted if required.

Normally, the digital input channel indicating the tap‟s current position is on and all other channels must be off.

If Inverted, the digital input channel indicating tap position must be off, and all other channels on.


of 89

Timestamp as

First Change

Last Change

This drop down selector allows you to select how the TAP change event will be time stamped. Default is „Last change‟.

First change means that the timestamp for the TAP event will be the timestamp of the first of the digital inputs changing state for that TAP.

Last change means that the timestamp for the TAP will be the timestamp of the last of the digital inputs changing state for that TAP, plus the ON Time.

Min / Off Time (ms)

0 to 32000000 This is a dual use field. For analog inputs, this field configures the minimum input value that represents a tap position, not including deadband.

For digital indications, this field configures the length of time for which a tap indication is allowed to transition between valid input states without report after an input channel has switched off.

Max / On Time

(ms)

0 to 32000000 This is a dual use field. For analog inputs, this field configures the maximum input value that represents a tap position, not including deadband.

For digital indications, this field configures the length of time for which a tap indication is allowed to transition between valid input states without report, after an input channel has switched on.

Hardware Max

-100 to 100

This field is only used for analog input types. It specifies the maximum valid analog input value that the channel can measure, not including the over range percentage. The I/O card in use determines it.

Hardware Over Range

(%)

0 to 100 This field is only used for analog input types. This is the percentage of the maximum valid input range that is used to measure over range values. It is determined by the I/O card in use, and typically has a value of 5.

Table 23 Tap Parameter Definitions


of 89

12.9 Tap AI

12.9.1 Configuration

The Tap AI table defines transformer tap position indications derived from analogue inputs. The analogue input may take any range of values supported by the I/O card, and this range is mapped to a range of tap positions. The space between valid tap position input values may include invalid regions, which result in the tap position having a bad status.

Figure 31 Tap AI Table




Channel 0 to 255 The channel number is the analogue input point‟s position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point.

First Tap 0 to 65535 The First Tap is the tap position value corresponding to the minimum input current.

Last Tap 0 to 65535 The Last Tap is the tap position value corresponding to the maximum input current. It may have a value less than the First Tap position if required.

Valid Range % 0 to 100 The valid range is a percentage of the region between nominal analogue input values. A setting of 100% means that the tap indication is always valid.

Min -100 to 100 The Instrument Range Min is the minimum analogue input value, corresponding to the first tap position.

Max -100 to 100 The Instrument Range Min is the maximum analogue input value, corresponding to the last tap position.

Hardware Max 100 The Hardware Max is the maximum input value that the analogue input card can measure, excluding the over range. For a standard HAI-030 fitted with 50ohm termination resistors this is 20 mA.

Hardware Over Range %

0 to 100 The Hardware Over Range is the percentage of the analogue input cards valid range which may be measured above the maximum. It has a value of 5% for the HAI-030.

Table 24 Tap AI Parameters


of 89

12.9.2 Example

A standard HAI-050 fitted with 50 ohm termination resistors measures a 4mA to 20mA input signal. An input of 4mA represents a tap position of 0 and an input of 20mA represents a tap position of 4. The configuration settings are:

First Tap 0

Last Tap 4

Valid Range 50

Min 4

Max 20

Hardware Max 20

Hardware Over Range 5

The output values for a given current are:

Nominal Input Current Current Range (mA) Tap AI Value

4 mA

Less than 3 mA 0, Bad

3 to 5 0

5 to 6 0, Bad

8 mA

6 to 7 1, Bad

7 to 9 1

9 to 10 1, Bad

12 mA

10 to 11 2, Bad

11 to 13 2

13 to 14 2, Bad

16 mA

14 to 15 3, Bad

15 to 17 3

17 to 18 3, Bad

20 mA

18 to 19 4, Bad

19 to 21 4

More than 21 mA 4, Bad

Table 25 Tap AI Example


of 89

12.10 Pseudo Points

12.10.1 Pseudo Digital Inputs

Pseudo DI points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded. Pseudo DIs support a „Force‟ command to change the database value of the point. The table below gives the field definition parameters for the Pseudo DI entry.




Table 26 Pseudo DI Parameter Definitions

12.10.2 Pseudo Digital Outputs

Pseudo DO points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded. Drive commands sent to a Pseudo DO point will update its current database value. The commands may pulse ON the point, or latch it to a value. The table below gives the field definition parameters for the Pseudo DO entry.




Table 27 Pseudo DO Parameter Definitions


of 89

12.10.3 Pseudo Analog Inputs

Pseudo AI points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded.

Pseudo AIs support a „Force‟ command to change the database value of the point, from 0 to 65535 counts.

The table below gives the field definition parameters for the Pseudo AI entry.




Table 28 Pseudo AI Parameter Definitions

12.10.4 Pseudo Analog Outputs

Pseudo AO points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded.

Drive commands sent to a Pseudo AO point will update it‟s current database value. The commands may drive the point to a value from 0 to 65535.

The table below gives the field definition parameters for the Pseudo AO entry.




Table 29 Pseudo AO Parameter Definitions

12.10.5 Pseudo Accum

Pseudo ACCUM points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded.

Drive commands sent to a Pseudo ACCUM point will update its current database value. The commands may drive the point to a value from 0 to 4,294,967,295.

The table below gives the field definition parameters for the Pseudo AO entry.


of 89




Table 30 Pseudo AO Parameter Definitions


of 89

12.11 Remote Connect Points

12.11.1 Remote Connect DI

Remote connect DI points provide status information for a unit on what users are currently logged in with XCellView or Workbench. Each point may be mapped to a slave protocol as a digital input.

Figure 32 Remote Connect DI Table

The points have the following definitions.

Record Purpose

0 ON when a user has logged into the unit using XCellView on a serial port or telnet connection.

1 Momentary ON when a user has attempted to log into the unit using XCellView and has not supplied the correct username and password for three attempts.

2 ON when users may attempt to log in with XCellView or Workbench.

OFF when user log in has been permanently disabled from within XCellView, or temporarily disabled with a Remote Connect DO point.

3 ON when a user has logged into the XCellView network.

4 Momentary ON when a user has attempted to log on to the network using Workbench and has supplied an incorrect username / password.

Table 31 Remote Connect DI Definitions


of 89

12.11.2 Remote Connect DO

Remote Connect DO points allow a master station to prevent a user from logging into an XCell unit.

Figure 33 Remote Connect DO Table

The points have the following definitions.

Record Purpose

0 Drive ON to prevent users from logging into the unit with XCellView or Workbench.

1 Drive ON to enable users to log into the unit with XCellView or Workbench.

Table 32 Remote Connect DI Definitions


of 89

12.12 Serial Port Pass Through

The Serial Port Pass Through configuration tables allow users to connect to devices on XCell serial ports using the XCell Ethernet.

The serial port allows a connection with one of two methods.

12.12.1 XCell View

The first method uses XCell View. A user must log into XCell View and use the menus Utilities->Pass Through to see the available configurations. When the user selects an XCell View enabled pass-through serial port, the terminal display is cleared and the user is connected to the device serial port. The user's key strokes are sent to the serial port and characters received on the port are sent back to the user's terminal. Use Ctrl-F or 2 quick escapes to end the session.

The XCell View connection method is suitable for devices which provide a text-mode (terminal) interface. It provides the password protected dial-up and dial-back access of XCell View, as well as telnet. User-rights access control may be applied to restrict access to selected XCell View users.

The XCell View connection method is not useful when a transparent connection method is required, perhaps for binary data. Some characters have a special meaning for the XCell View connection.

Use Ctrl-D to log out from XCell View

Use Ctrl-F to end the pass-through session

The XCell View connection method requires the user to log into the XCell unit which provides the serial port connected to the device.

12.12.2 TCP/IP

The TCP/IP connection method starts a TCP/IP server on the XCell, on a user configured network port. Any characters sent to the TCP/IP port are forwarded to the serial port, and while a client is connected it receives any characters from the serial port. The IP address of the connecting client can be restricted to a configured address.

This method may be useful for attaching IEDs which only have serial ports to a network. IEDs which use the DNP 3.0 protocol may be suitable for this.

12.12.3 Serial Port Pass Through Configuration Table

Figure 34 Serial Port Pass Through Configuration Table

A Serial Port Pass-Thru configuration table entry is required for each serial port which requires pass through access. More than one entry may be made if access must be restricted to clients with different IP addresses.

The parameters of the configuration are detailed in table 33.


of 89


TAG 40 Characters This is a unique identifier for the point. This TAG may be mapped as a digital input point, which is ON when a TCP/IP or XCell View client is connected to the serial port.

Description 40 Characters This is a brief description of the serial port. It is displayed within XCell View.

Start Up Enabled,

Disabled

Whether the serial port is available for pass through operation after restart. If disabled, the port must be enabled by protocol command.

Connection TCP/IP,

XCell View,

Any

Determines which methods may be used to connect to the serial device. XCell View means only an XCell View login may connect to the device. TCP/IP allows a connection to the configured TCP/IP port to communicate with the serial device. Any allows either a TCP/IP or XCell View connection, but not both simultaneously

XCell TCP/IP Port

1050 to 65000 The TCP/IP network port address on the XCell for the client to connect to.

Client Address Check

Yes, No If Yes, the IP address of the connecting client is checked.

Client Address IP

IP Address of 4 values, 0 to

255

If Client Address Check is Yes, the IP address of the connecting client is checked. Only the configured IP address may communicate with the serial port.

Com Port XCell Com 1,

XCell Com 2,

XCell Com 3,

XCell Com 4

The XCell serial port to be used.

Baud 9600, 19200, 38400, 57600,

115200

The serial port baud rate to be used.

Data Bits 7, 8 The serial port data bits format to be used.

Parity Odd, Even, None

The serial port parity format to be used.

Table 33 Serial Port Pass-Thru Table


of 89

12.12.4 Serial Port Pass Through Control

To restrict access, a serial port pass through function may be configured as normally disabled. Pass Through Operation is then enabled when needed by a master station command.

To configure access by master station command, select the Disabled setting under Start Up in the Serial Port Pass Through table. The master station enable and disable commands are available in the Serial Port Pass Through Control table. There are two entries in Serial Port Pass Through Control for each Serial Port Pass Through table entry. The first of the two consecutive entries is used to disable the port after it has been used. The second entry enables the port for use.

Feedback for the controls is provided by the Serial Port Pass Through Enable Status table, with an entry for each Serial Port Pass Through configuration. Each of these entries may be used as a digital input. The digital input point is ON when the port is enabled for pass through operation.

Figure 35 Serial Port Pass Through Control

Figure 36 Serial Port Pass Through Enable Status


of 89

12.13 SNMP Client

12.13.1 SNMP Client Configuration

The simple network management protocol is used to administer remote IP network devices. The SNMP client table can configure SNMP-enabled base firmware to report system operation status information to a management application. An SNMP Base can only be identified by the ram file name containing “SNMP”. Once downloaded the SNMP is stripped from the name, only showing the Base version.

Figure 37 SNMP Client Table

The parameters for the SNMP client table are user entered strings.

Parameter Comments

Location These parameters are supplied to the management application for identification purposes. The user may supply strings as appropriate for their SNMP system. Contact

System Name

Description

Community Name

The trap community name. Used to authenticate SNMP traps or informs from the server.

Trap 1 IP A destination IP for XCell traps (only SNMP Version 2).

Trap 2 IP A destination IP for XCell traps (only SNMP Version 2).

Inform 1 IP A destination IP for XCell informs (SNMP Version 2).

Inform 2 IP A destination IP for XCell informs (SNMP Version 2).

Read Only Community

The read only community name used to request parameters from the SNMP agent.

Read Write Community

The read-write community name used to request or change parameters from the SNMP agent.

Table 34 SNMP Client Table Parameters


of 89

12.13.2 XCell SNMP Notes

The following is a capture from a SNMP MIB Browser for the Private MIBs only:

Enterprise Number is: 25041. Enterprise specific parameters:

SNMPv2-SMI::enterprises.25041.1.1.0 = STRING: "00:12:76:00:00:01"

SNMPv2-SMI::enterprises.25041.1.2.0.1.2.0 = STRING: "BASE"

SNMPv2-SMI::enterprises.25041.1.2.0.1.2.1 = STRING: "EXPRESS "

SNMPv2-SMI::enterprises.25041.1.2.0.1.3.0 = STRING: "V05.Test"

SNMPv2-SMI::enterprises.25041.1.2.0.1.3.1 = STRING: "V08.01"

SNMPv2-SMI::enterprises.25041.1.2.0.1.4.0 = STRING: "0x0801008C"

SNMPv2-SMI::enterprises.25041.1.2.0.1.4.1 = STRING: "0x0820008C"

SNMPv2-SMI::enterprises.25041.1.3.0 = INTEGER: 1





SNMPv2-SMI::enterprises.25041.1.8.0 = STRING: "10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"

SNMPv2-SMI::enterprises.25041.1.9.0 = STRING: "NO CONFIG BACKUP"





The following defines the information which was returned above:

1.3.6.1.4.1.25041.1.1.0 = MAC Address (OCTET_STRING)

1.3.6.1.4.1.25041.1.2.0 = Firmware Information

1.3.6.1.4.1.25041.1.1.2 = Firmware Name

1.3.6.1.4.1.25041.1.1.3 = Version Number

1.3.6.1.4.1.25041.1.1.4 = Code Start Address

1.3.6.1.4.1.25041.1.3.0 =* XCell View Login Active Count (INT)

1.3.6.1.4.1.25041.1.4.0 =* Workbench Login Active Count (INT)

1.3.6.1.4.1.25041.1.5.0 =* XCell View Failed Login Count (INT) - only counts up

1.3.6.1.4.1.25041.1.6.0 = CPU Idle Percentage (INT) - 0 to 1000(100%) idle time

1.3.6.1.4.1.25041.1.7.0 = SDRAM Heap Usage in percentage (INT)

1.3.6.1.4.1.25041.1.8.0 = Online Unit list (OCTET_STRING) - 1 for online, 0 for offline for each unit


of 89

1.3.6.1.4.1.25041.1.9.0 = Workbench Configuration Backup Filename

1.3.6.1.4.1.25041.1.10.0 =* State of XCell View & Workbench Access Enable (1 for enabled, 0 for disabled)

1.3.6.1.4.1.25041.1.11.0 = Workbench Configuration Download count since last reboot

1.3.6.1.4.1.25041.1.12.0 = Express Program Download count since last reboot

1.3.6.1.4.1.25041.1.13.0 =* RTU Live Failed Login Count (INT) - only counts up

* Indicates that this parameter has an associated Trap/Inform that goes with it when

the value changes.

Cold Start Trap:

2006-01-27 18:56:06 192.168.2.97 [UDP: [192.168.2.97]:1024]:

DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (63) 0:00:00.63 SNMPv2-M

IB::snmpTrapOID.0 = OID: SNMPv2-MIB::coldStart SNMPv2-MIB::snmpTrapEnterprise.0

= OID: NET-SNMP-MIB::netSnmpAgentOIDs.15

Cold Start Inform:

2006-01-27 18:56:06 192.168.2.97 [UDP: [192.168.2.97]:1025]:


IB::snmpTrapOID.0 = OID: SNMPv2-MIB::coldStart SNMPv2-MIB::snmpTrapEnterprise.0

= OID: NET-SNMP-MIB::netSnmpAgentOIDs.15

XCell View Login Trap and Inform:

2006-01-27 18:57:18 192.168.2.97 [UDP: [192.168.2.97]:1024]:


IB::snmpTrapOID.0 = OID: SNMPv2-SMI::zeroDotZero.0 SNMPv2-SMI::enterprises.

25041.1.3.0 = INTEGER: 1

2006-01-27 18:57:18 192.168.2.97 [UDP: [192.168.2.97]:1025]:


IB::snmpTrapOID.0 = OID: SNMPv2-SMI::zeroDotZero.0 SNMPv2-SMI::enterprises.

25041.1.3.0 = INTEGER: 1


of 89

12.13.3 XCell SNMP Standard MIBs

The following is a partial capture from a SNMP MIB Browser for the standard MIBs. There are a total of 242 standard MIBs. Notice the user entries for Location, Contact, System Name and Description will appear back to the polling browser in a standard MIB poll:

RFC1213-MIB 1.3.6.1.2.1.1.1.0 sysDescr.0 TABLE RACK 1 DEMO U2

RFC1213-MIB 1.3.6.1.2.1.1.2.0 sysObjectID.0 1.3.6.1.4.1.8072.3.2.15

RFC1213-MIB 1.3.6.1.2.1.1.3.0 sysUpTime.0 8355289

RFC1213-MIB 1.3.6.1.2.1.1.4.0 sysContact.0 ADMIN ENGR EX333

RFC1213-MIB 1.3.6.1.2.1.1.5.0 sysName.0 DISTRIBUTECH 09

RFC1213-MIB 1.3.6.1.2.1.1.6.0 sysLocation.0 CG AUTOMATION IRELAND LIMITED BOOTH

SNMPv2-MIB 1.3.6.1.2.1.1.8.0 sysORLastChange.0 24

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.2.1 sysORID.1 1.3.6.1.2.1.31





SNMPv2-MIB 1.3.6.1.2.1.1.9.1.2.6 sysORID.6 1.3.6.1.6.3.16.2.2.1

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.1 sysORDescr.1 The MIB module to describe generic objects for network interface sub-layers

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.2 sysORDescr.2 The MIB module for SNMPv2 entities

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.3 sysORDescr.3 The MIB module for managing TCP implementations

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.4 sysORDescr.4 The MIB module for managing IP and ICMP implementations

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.5 sysORDescr.5 The MIB module for managing UDP implementations

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.6 sysORDescr.6 View-based Access Control Model for SNMP.

SNMPv2-MIB 1.3.6.1.2.1.1.9.1.4.1 sysORUpTime.1 5






IF-MIB 1.3.6.1.2.1.2.1.0 ifNumber.0 2

IF-MIB 1.3.6.1.2.1.2.2.1.1.1 ifIndex.1 1

IF-MIB 1.3.6.1.2.1.2.2.1.1.2 ifIndex.2 2

IF-MIB 1.3.6.1.2.1.2.2.1.2.1 ifDescr.1 smc1

IF-MIB 1.3.6.1.2.1.2.2.1.2.2 ifDescr.2 lo0

IF-MIB 1.3.6.1.2.1.2.2.1.3.1 ifType.1 6

IF-MIB 1.3.6.1.2.1.2.2.1.3.2 ifType.2 24

IF-MIB 1.3.6.1.2.1.2.2.1.4.1 ifMtu.1 1500

IF-MIB 1.3.6.1.2.1.2.2.1.4.2 ifMtu.2 16384

IF-MIB 1.3.6.1.2.1.2.2.1.5.1 ifSpeed.1 100000000


of 89

12.14 NetBridge Client

The NetBridge allows limited fieldnet-over-ethernet TCP/IP. The application does not require a separate firmware SREC file to be loaded into the CPR-041 processor. This feature is already built into the Base versions 500 and higher. Based on a hierarchal organization, this feature allows the user to bring events up from remote XCell systems to a master XCell system which has no Fieldnet connection to allow the processors in each system to share tag data. We will refer to the top hierarchal master XCell as the client and the lower XCell systems as the servers. Only the servers require a configuration table to identify the Client. We refer to the lower XCell‟s as servers because they serve up the event data to the single client. Events do not pass down from the client to the server. The main benefit in using Netbridge is there's no protocol configuration to transfer events up from remote XCell systems. There's just a single config table at the server end, which contains two server IPs. The server will connect to one or the other of these IPs, using the first available IP. It does allow multiple connections so as to provide for redundancy at the server RTU level. This will allow two servers units to run on separate Ethernet switches. The workbench project for such a system would include all of the Units connected via a physical FieldNet LAN and the Ethernet TCP/IP LAN. The user can use the Project ICONs to separate the various XCell systems for easy identification. In the figure below Unit 1 is configured as the server, serving it‟s events up to the Gateway Rack 2 XCell system over an Ethernet TCP/IP connection. Unit 1 will first try to connect to Unit 3 then Unit 4. All of the tags in Unit 1 are available to both Units 3 & 4s applications. Control commands generated in an application in the Gateway Rack 2 XCell system to a Unit 1DO tag will be sent to Unit 1 for execution.

Figure 38 NetBridge System Configuration Overview


of 89

There are currently two caveats. There can only be one client unit. This means that there isn‟t a redundant connection to the server. Also, this isn‟t a full duplex communication path, the status changes are forwarded to the server XCell, but the server XCell status changes aren‟t returned to the client XCell. However, directed messages (ie controls) will work in either direction, from anywhere in the system.

12.14.1 Netbridge Client Configuration

The Netbridge Client is located in the Elements, CPR-041 Firmware, I/O server, Optional Tables. This table needs to be in the server XCell configuration in order for Netbridge to work correctly. This table identifies the IP address for the Client. There is no setup on the server Xcell CPR-041.

Figure 39 NetBridge Client Table

12.14.2 Netbridge Table Parameters

Once the table is in the client configuration, you need to specify the Tag. This tag is an internal tag and does not change state or indicate any communication status. Specify the description. Input the respective IP addresses of one or two CPR041s that are connected to the server XCell systems physical Fieldnet LAN. The connection will be established by the IP that is first polled when the configuration is downloaded to the client RTU.

Figure 40 NetBridge Client Table Fields

The parameters for the Netbridge client table are user entered strings.


of 89

Parameter Comments

Tag Unique Identifier for Netbridge Status

Description Tag Description

Server IP 1

Server IP Number 1

Server IP 2 Server IP Number 2

Table 35 NetBridge Table Parameters


of 89

13 Secure Tunnel Interface

This interface is only available in Base ver. 6.11 and higher. With the user running the Microsol Secure Encryption Service (MSES) on their PC, they can connect both RTU Live and Telnet to the XCell processor through an AES encrypted tunnel. This Tunnel involves the transparent mapping in the computer of unencrypted network data into an encrypted link using the MSES service and the corresponding un-mapping of that encrypted data on the RTU side using a similar service and vice versa.


of 89

13.1 AES

The AES encryption algorithm has been chosen because it is widely used in SSHv2 and has it‟s origins in a competitive selection process sponsored by DARPA in the United States – to select a replacement for DES and 3DES.

AES is a symmetric key algorithm – meaning that the same basic encryption key is used to generate an encrypt and decrypt key schedule – as opposed to an asymmetric encryption algorithm such as a public key encryption system – which uses both a public and a private key for the same encrypt/decrypt key scheduling respectively.

CG Automation Ireland Limited has chosen 256-bit encryption – thus providing the highest level of cryptographic delivery available to an AES encrypted stream. AES is also an extremely fast encryption algorithm – since it does a series of bit-shifting and logical XOR operations based on key schedules known as S-boxes.


of 89

13.2 MSES

The Microsol Simple Encryption Service needs to run on the user‟s PC (linux or windows) in order to redirect TCP traffic from the normal Workbench RTU Live and Telnet sessions through the encrypted session with the XCell.

The MSES (Microsol Simple Encryption Service) tunnelling server is a service residing in the host computer or a laptop, which can be configured to map multiple unencrypted regular TCP services (TELNET, Workbench etc.) through an encrypted tunnel to any given TCP port at a given IP address (the RTU in this case).

The user simply copies the “MSEC.exe” to a folder, configures the “srv.cfg” file to match the XCell MSES configuration table and starts the service using the following command line “msec –I”. The service can be stopped by the following command line “msec –u”. Once started, it will be automatically restarted after a reboot.


of 89

13.3 PC MSES srv.cfg file

The srv.cfg must be configured to match the MSES Workbench configuration table for the connecting XCell. The user will always address the localhost or IP address 127.0.0.1 to access the ports configured for the AES connection. The SRCPORT=XXXX setting is the local port number that the user will enter when starting ether the Workbench RTU Live connection or the telnet connection. The DSTPORT=XXXX setting is the Port number set in the MSES XCell table “Source Port” setting in Workbench. This is the port that will be opened on the XCell to connect the AES. Both the AES= and TXKEY= in the srv.cfg and MSES XCell table must match. The AES= is the number of bits the AES will use for encryption, with 256 bits representing the highest level of security. The TXKEY= is the fixed key, for each service mapped, the MSES server and client (RTU) share an encryption key. The key length is 256 bits to provide maximum security.

A given 256 bit key – is read by both server and RTU. This key is used to generate an encrypt-key schedule on the server (PC) side and a decrypt-key schedule on the RTU side. This encrypt/decrypt pair represents the encryption used to send data from server to client (RTU). Similarly the server and client take the original source key – reverse all of the bytes – and then generate another encrypt/decrypt key schedule – which allows for sending encrypted data from the RTU to the server.

For 128 bit AES encryption, the key must have 32 HEX characters (0-F), 192 bit has 48 HEX characters and 256 bit must have 64 HEX characters.

The CONNECTTIMEOUT= parameters is in seconds and will automatically close the connection if there is no traffic during this time period. The IPADDR= is the IP address of the XCell Unit that you want to connection to.

Example of a srv.cfg file configuration:

//Workbench connection to unit IP192.168.0.1 via IP 127.0.0.1 port 3001

SRCPORT=3001

DSTPORT=4001

AES=256

TXKEY=0102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F11

CONNECTTIMEOUT=15

IPADDR=192.168.0.1

//XCell View Telnet connection to unit IP192.168.0.1 via IP 127.0.0.1 port 3002

SRCPORT=3002

DSTPORT=4002

AES=256


CONNECTTIMEOUT=15

IPADDR=192.168.0.1

//Pass Through connection to unit IP192.168.0.1 Port4 via IP 127.0.0.1 port 3003

SRCPORT=3003

DSTPORT=4003

AES=256


CONNECTTIMEOUT=15

IPADDR=192.168.0.1


of 89

13.4 Workbench MSES configuration table

The Workbench MSES configuration table has most of the same configuration parameters as the MSES srv.cfg file. The Source Port must match the DSTPORT in the srv.cfg file. The Destination Port is always 2011 for Workbench and 23 for Telnet. Similarly the AES keysize, Transmit Key and Connect Timeout must match the srv.cfg file. The IP ADDR at Dst Port will always be 127.0.0.1 for the XCell to connect to the MSES service running on the PC.

Figure 41 Workbench MSES Table


of 89

13.5 Connection Examples

In the figure below, RTU #1 and Client #1 are conducting two simultaneous telnet sessions.

Using both the srv.cfg and Workbench configuration table shown in the previous sections we will run through some examples on how to connect to the XCell. In all examples the user would have the PC MSES program in a folder on their PC with the srv.cfg file configured for a select XCell IP address.

The user would start the service by typing the following command line, “msec –i”. The user can stop the service by typing, “msec –u”. In order to connect to the XCell using the AES server the MSES must be started and running.

13.5.1 Workbench RTU Live TCP/IP

Launch Workbench, go to the RTU Live Window, and select the “Connect to the RTU using TCP” icon. The pop up window is displayed that allows the user to enter the IP address. The localhost IP of 127.0.0.1 should be entered. When this is done the port field will now allow the user to change the value which in this example should be 3001. Now connect and the user should see no difference in operation from a normal connection. The RTU Live TCP/IP traffic is now encrypted using 256 bit AES.


of 89

13.5.2 Telnet to XCell View

Open a telnet terminal program. The localhost IP of 127.0.0.1 and port 3002 should be entered. Now connect and the user should see no difference in operation from a normal connection. The Telnet TCP/IP traffic is now encrypted using 256 bit AES.

13.5.3 Secure Pass Through

Using the XCell serial port pass through option the user can connect to this IP port using the AES encryption. In the XCell pass through configuration table serial port 4 is connection to the XCell‟s IP port number 3000. Open a telnet terminal program. The localhost IP of 127.0.0.1 and port 3003 should be entered. Now connect and the user should see no difference in operation from a normal connection. The Telnet terminal TCP/IP traffic is now encrypted using 256 bit AES and is passed through to the configured XCell port 4.

of 89

CG Automation Systems Ireland

Herbert House,

Harmony Row,

Dublin 2

Ireland

T: +353 1 415 3700 F: +353 1 6787913

W: www.cgglobal.com

CG Automation Systems UK Limited Unit F Network Centre,

Jarrow,

Tyne & Wear,

NE31 1SF

United Kingdom T: +44 (0) 191 425 5200 F: +44 (0) 191 425 5202

W: www.cgglobal.com

E: [email protected]

CG Automation Systems USA Inc 92 Cogwheel Lane

Seymour,

CT 06483

USA

T: +1 203 888 3002 F: +1 203 888 7640

W: www.cgglobal.com

E: [email protected]

Workbench IO Configuration Manual Contact Information

http://www.cgglobal.com/


mailto:[email protected]


mailto:[email protected]