Workbench IO Configuration Manual - Rev - 3.13

CGAS Workbench
Base Apps and I/O Configuration Guide
Version 3.13
BASE Apps and I/O Configuration Manual
CG Automation Ireland Limited 2010 This document contains proprietary information of CG Automation Ireland Limited. The information and designs in the document are covered by international copyright and a number of international patents existing and pending. CG Automation Ireland Limited, and its legally appointed licensees, reserves the right to seek full redress in the case of any infringement. The information in this document is subject to change without prior notice. CG Automation Ireland Limited does not assume responsibility for any errors in fact or design in this publication. Specifications can and do vary in different applications. The publication is provided for general information only and shall not form part of any contract.
Page 2 of 89
Contents
1 2 3 Reference Documents.................................................................................... 5 Introduction .................................................................................................... 6 RTU Types ....................................................................................................... 7
3.1 3.2 3.3 3.4 RTU ..................................................................................................................... 7 Bay ...................................................................................................................... 7 Cabinet................................................................................................................ 8 Rack .................................................................................................................... 8
3.5 Unit...................................................................................................................... 8 3.5.1 Unit Status ..................................................................................................... 9 3.5.2 Unit Reset Command .................................................................................... 9 3.5.3 Unit Configuration Parameters....................................................................... 9 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 IED......................................................................................................................10 Virtual Unit .........................................................................................................10 Virtual IED..........................................................................................................10 Block ..................................................................................................................10 Firmware.........................................................................................................10 Module ............................................................................................................10 Dual Network Status ......................................................................................13 Remote Reboot and Reset ............................................................................14
TCP/IP Configuration ................................................................................... 15

4.1 4.2 4.3 4.4 4.5 4.6 General Configuration ......................................................................................15 Static Address Mode.........................................................................................15 BOOTP Address mode .....................................................................................15 DHCP Address ..................................................................................................15 Redundant IP Address ......................................................................................15 TCP/IP Parameters ............................................................................................16
Channel Numbers ......................................................................................... 17

5.1 5.2 5.3 I/O Card Channels .............................................................................................17 Points Grouped By Type Only .........................................................................18 Points Grouped By Module ..............................................................................19
Single Digital Inputs (SDI)............................................................................ 20

6.1 6.2 6.3 Configuration Table ..........................................................................................20 SDI Debounce....................................................................................................22 SDI Time Filter ...................................................................................................22
Page 3 of 89
BASE Apps and I/O Configuration Manual 7 Double Digital Inputs (DDI) .......................................................................... 24
7.1 7.2 7.3 Operation ...........................................................................................................26 DDI Debounce ...................................................................................................26 DDI Time Filter...................................................................................................26
8 9
Automatic Suppression ............................................................................... 27 Digital Outputs (DOT) ................................................................................... 29

9.1 9.2 9.3 9.4 9.5 9.6 Configuration ....................................................................................................29 DOT table rev. 012 .............................................................................................31 Control Security ................................................................................................32 Output Mode ......................................................................................................32 Single Output Operation ...................................................................................33 Multiple Master Stations ...................................................................................34
10
Analog Inputs Table (AIN)......................................................................... 35

Configuration .................................................................................................35 Analog Input Scaling .....................................................................................37 Limit Alarm Processing .................................................................................37 Database Update............................................................................................37 Sample Configuration....................................................................................39
10.1 10.2 10.3 10.4 10.5
11 12
Analog Outputs ......................................................................................... 40 Optional Tables ......................................................................................... 41

Raise-Lower Pairs..........................................................................................42 Pulse Train Outputs From eXpress ..............................................................45 Sequenced DO ...............................................................................................49 Network Time Protocol Client (NTP) Configuration.....................................51 HAI Card Config .............................................................................................53
12.1 12.2 12.3 12.4 12.5
12.6 Accumulators .................................................................................................55 12.6.1 Configuration .............................................................................................55 12.6.2 Input Types ...............................................................................................57 12.6.3 Running Value Change Messages ............................................................57 12.6.4 Digital Input Time Stamping.......................................................................58 12.7 12.8 Binary Coded Decimal Component (BCD) ...................................................59 TAP Position Component (TAP) ...................................................................62
12.9 Tap AI .............................................................................................................65 12.9.1 Configuration .............................................................................................65 12.9.2 Example ....................................................................................................66 12.10 Pseudo Points ................................................................................................67 12.10.1 Pseudo Digital Inputs.................................................................................67 12.10.2 Pseudo Digital Outputs ..............................................................................67 12.10.3 Pseudo Analog Inputs ...............................................................................68 12.10.4 Pseudo Analog Outputs.............................................................................68 12.10.5 Pseudo Accum ..........................................................................................68
Page 4 of 89

12.11 Remote Connect Points ................................................................................70 12.11.1 Remote Connect DI ...................................................................................70 12.11.2 Remote Connect DO .................................................................................71 12.12 Serial Port Pass Through ..............................................................................72 12.12.1 XCell View .................................................................................................72 12.12.2 TCP/IP ......................................................................................................72 12.12.3 Serial Port Pass Through Configuration Table ...........................................72 12.12.4 Serial Port Pass Through Control ..............................................................74 12.13 SNMP Client ...................................................................................................75 12.13.1 SNMP Client Configuration ........................................................................75 12.13.2 XCell SNMP Notes ....................................................................................76 12.13.3 XCell SNMP Standard MIBs ......................................................................78 12.14 NetBridge Client.............................................................................................79 12.14.1 Netbridge Client Configuration...................................................................80 12.14.2 Netbridge Table Parameters......................................................................80
13
Secure Tunnel Interface ............................................................................ 82

AES .................................................................................................................83 MSES ..............................................................................................................84 PC MSES srv.cfg file ......................................................................................85 Workbench MSES configuration table .........................................................86
13.1 13.2 13.3 13.4
13.5 Connection Examples ...................................................................................87 13.5.1 Workbench RTU Live TCP/IP ....................................................................87 13.5.2 Telnet to XCell View ..................................................................................88 13.5.3 Secure Pass Through ................................................................................88
Reference Documents
The following documents should be used in conjunction with this document to provide complete information for the configuration and use of the XCell product. 1. Workbench User Manual 2. XCell User Manual 3. eXpress Users Guide CG Automation Ireland Limited. CG Automation Ireland Limited. CG Automation Ireland Limited.
Page 5 of 89
Introduction
This Manual describes the configuration of the various I/O point types and Base applications using Workbench configuration tool. It describes the steps necessary for the configuration and the parameters associated with each configuration table. All configuration elements must be associated with a specific processor unit or module so the RTU and Unit structure must first be created in the Project Hierarchy. This is done by dragging and dropping the Project Elements (RTU, Bay and Unit nodes) to the Project Hierarchy window; refer to Workbench User Manual for further details. The user then has the option to include a number of modules with each unit. For further information regarding the function and use of modules, refer to the Workbench User Manual. Once the relevant unit nodes exist in the Project Hierarchy simply select the required I/O components from the Point tab in the Elements window in Workbench. Then drag the configuration element icon onto the required unit or module in the Project Hierarchy. The first table created for a project will prompt you to enable automatic tag generation. You are then presented with a prompt for the number of records to create. These prompts are similar to those shown in Figure 1.
Figure 1
Specify the number of records to create
Workbench uses the information given to create the specified number of entries and display them in the Data Window where the default parameters may be edited.
Page 6 of 89
RTU Types
The user has a number of Icons to use to organize the Workbench Project Configuration and provide additional information concerning the system. Each of the Icon Name, Description and Data field can be changed by selecting, right click to the menu and select properties.
Figure 2
Firmware (Application) Organizing Icon
Figure 3
Project Organizing Icon
3.1
RTU The RTU node is the top level node, to which all other nodes are attached. It has no configuration parameters.
3.2
Bay The Bay node is the next level node, to which all other nodes are attached. It has no configuration parameters.
Page 7 of 89

3.3 Cabinet The Cabinet element may only be attached to an RTU node. It allows Racks to be grouped. It has no configuration parameters.
3.4
Rack The Rack node allows Units to be organized into groups. It has no configuration parameters.
3.5
Unit The Unit node is used to group tables and address points to the processor to which they belong.
Figure 4
Unit Configuration
Page 8 of 89

3.5.1 Unit Status
The unit Tag may be mapped as a digital input point. In this case, the point represents the health status of the processor. It is ON when the processor is present and functioning, and OFF if the processor is removed or malfunctioning. 3.5.2 Unit Reset Command
The unit Tag may also be mapped as a digital output point. In this case, when a latch ON or Pulse command is sent to the point, the processor will reboot. 3.5.3 Unit Configuration Parameters
The Unit node has three configuration parameters.
Field Name
Value
Comments
TAG
40 Characters
The Tag field is used to uniquely identify the unit in the Workbench Project. It may also be mapped to slave protocols. This is a brief description of the point for configuration purposes only. The Unit Number specifies the network address of the processor. This address is set and displayed from the processors front panel. Once the processor has had an address set, it may be used for configuration download by Workbench.
Description Unit Number
40 Characters 1 to 250
Table 1
Unit Parameter Definitions
Page 9 of 89
3.6
IED An IED node is used for grouping the points of a master protocol application. It is attached to a unit node. Several IEDs may belong to the same unit node. Different IED nodes may have the same type of table attached.
3.7
Virtual Unit A Virtual Unit node is used for testing and can only be placed under the top RTU Icon. The tables under a virtual unit are not downloaded but are used to provide pseudo reference tags for other protocol tables.
3.8
Virtual IED
A Virtual IED node is used for grouping the map point elements for a master protocol (e.g. DNP3 master). It is attached to a unit node. This allows the user to have only the point mapping table for that device separate from the other devices. The user can also place additional information on the Icon naming the device, location etc. Several IEDs may belong to the same unit node. When the configuration is downloaded Workbench combines all of the point maps under these Icons and creates a single download point map for the Master application. All the other master tables are placed under a firmware Icon.
3.9
Block The Block node can only be placed under the top RTU Icon. It can be used for added project information or used to create firmware templates in which the Firmware Icon can be place under the Block Icon.
3.10 Firmware The firmware node is useful for grouping tables which are not associated with hardware. The tables of a slave application or a utility may be attached here.
3.11 Module The Module element is attached to Unit nodes to hold other point type tables. The Module element allows tables that configure individual point types to be organized by their parent IO module. This allows for a simplified channel numbering scheme, restarting channel numbers for each module.
Page 10 of 89
Figure 5
Module Configuration
The Module element may be mapped to slave protocols as a digital input that is OFF while the I/O module is present and functioning correctly, and ON when failed or removed.
Page 11 of 89

There are a number of module parameters that can be configured.
Field Name Value Comments
TAG
40 Characters
The Tag is a unique identifier for the module in the Workbench project. It may be used to map the modules current status to slave protocols. This is a brief description of the point for configuration purposes only. Each Module on a unit must have its slot position specified by this field, beginning with 0 for the first slot position. This parameter is used to correctly address the channels of each I/O module. Every IO module has a type specified with this field. The Type allows the correct number of channels to be configured.
Description
40 Characters
Module Order
0 to 7
Module Type
DIN-01X, HDI-04X, HDI-05X, DOT-01X, HDO-03X, HDO-01X, HDO-04X, HAI-03X, AOT-02X, AOT-03X, HSC-02X, Empty Card Default D-16, D-32 None Generic 16, IPC-16, TAI-L90, TAI-R90, TAI-L91, TAI-R91, HAI-CDC, IPC-16 (P&B 1X), IPC-16 (P&B 2FA), IPC-16 (P&B 2FC), IPC16-A (P&B 1X), IPC-16-A (P&B 2FA), IPC-16-A (P&B 2FC), Generic 32, TDI-040, TDI-050, TDI-L90, TDI-R90, TDA-L91, TDA-R91, TDO-040, TDO-050, TDO-L90, TDO-R90, TDO-LDB, TDO-RDB, TAI-040, TAI-050, HDI-CDC, TDIRACKTERM, Generic 64, TDI-051 40 Characters
Module Connector Termination Block Type
This field purposes. This field purposes.
is is
for for
descriptive descriptive
Termination Block Name
This field purposes.
is
for
descriptive
Table 2
Module Parameter Definitions
Page 12 of 89
3.12 Dual Network Status
Figure 6
Dual Network Status Table
The Dual Network Status table provides three status points for each units FieldNet connection. The XCell FieldNet is a Redundant LAN connection between units via the backplane. It allows the units to share database points and relay control requests. The definitions for each point are as follows.
Record
Description
This point is ON when the primary network is OK. The point is OFF when no activity or corrupted messages are detected. This point is ON when the secondary network is OK. The point is OFF when no activity or corrupted messages are detected.
This point is ON to indicate the secondary network is in use. The point is OFF to indicate that the primary network is selected.
Table 3 Dual Network Status Points
Page 13 of 89
3.13 Remote Reboot and Reset
Figure 7
Remote Reboot Table
The Remote Reboot table provides 2 pseudo points to enable the unit under which it is defined, to be remotely rebooted (with and without erasing configuration). These points can be driven like any other output points real or pseudo, using workbench or any protocol, but they can only be driven by 3-stage commands for security reasons. To drive it from a protocol, these 2 points have to be defined under each unit and mapped into the protocol as an output point. The definitions for each point are as follows.
Record
Description
0 1
This point if driven will only reboot the unit. The configuration will remain intact. This point if driven will erase the configuration files from flash and reboot the unit. So when the unit boots up, the original configuration files will not be present in memory.
Table 4 Remote Reboot Pseudo Points
Page 14 of 89
4
4.1
TCP/IP Configuration
General Configuration
The TCPIP component allows you to configure the Ethernet port associated with the CPR041 card. Only one entry is allowed per unit and this limit is enforced by Workbench. The TCPIP component is contained in the Elements window under the Projects tab and the Network sub group.
Figure 8
TCP/IP Configuration
Not all fields require an entry if BOOTP or DHCP modes are in use, or if DNS is not required. Table 5 gives the field definition parameters for the TCP/IP Configuration component. 4.2 Static Address Mode
If the user configures IP Address Mode as Static Address, the CPR041 will use the IP Address, Net Mask and Gateway entries for its network information. 4.3 BOOTP Address mode
The BOOTP Address mode requires a BOOTP server on the network to supply the CPR041 with an IP address, network address mask and gateway information. Most DHCP servers can be configured to supply BOOTP addresses. 4.4 DHCP Address
The DHCP Address mode requires a DHCP server on the network to supply the CPR041 with an IP address. The CPR041 supports the renewal of an assigned IP address after a duration of time, but does not support changing the IP address once assigned. 4.5 Redundant IP Address
The Redundant IP Address mode is an XCell method for sharing the same IP address between two CPR041s, for master stations which do not support redundant Ethernet connections with independent IP address information. In this mode, two CPR041s are configured with identical IP address information. Only one CPR041 operates active IP communications at a time, while the second CPR041 waits on standby in case of a failure. At start up, each of the redundant pair arbitrate for the configured IP address. The lowest unit number will then proceed to use the IP address for normal communications, while continuing to periodically update the standby unit. For as long as the standby unit receives updates from the active unit, the standby unit does not begin IP communications. If the active unit fails, or a cable is removed, the address information updates are no longer received by the standby unit, and it will begin communications.
Page 15 of 89

Note that if a cable is removed and replaced, both units may begin communicating using the same IP address. When this is detected, both units will automatically reboot after displaying the TCP-001 error on the front panel. Redundant IP address mode requires that broadcast UDP packets are allowed between CPR041 units on port 1009. A gateway device should not forward these packets. Redundant IP address mode requires application support. Currently, this is provided by:

iecsnb V7xx firmware for the IEC 60870-5-104 slave protocol dnpsnb V4xx firmware for the DNP3 slave firmware dnp3mnb V7xx firmware for the DNP 3 master protocol
Please contact CG Automation Ireland Limited for further support information. 4.6 TCP/IP Parameters
IP Address Mode
Static Address, BOOTP Address, Redundant IP Address, DHCP Address
How to acquire an IP address. A static or redundant IP address is configured with the IP Address entry. A BOOTP or DHCP address requires a suitable address server on the network. If BOOTP or DHCP are not enabled, this entry is used to configure the IP address as format ddd.ddd.ddd.ddd . The sub-network mask in the format ddd.ddd.ddd.ddd . Only used if BOOTP/DHCP are not in use. Optional host name for the unit when the DNS protocol is in use. IP Address of the network gateway, if BOOTP or DHCP are not in use. Optional domain name for the DNS protocol. Optional IP Address of remote machine to receive log messages. Optional IP Address of DNS Server. Optional IP Address of SNTP Server. Refer to section Error! Reference source not found..
IP Address
16 Character IP Address 16 Character IP Address 40 Characters 16 Character IP Address 40 Characters 16 Character IP Address 16 Character IP Address 16 Character IP Address
Net Mask
Host Name Gateway Domain Name Log Host Name Server Net Time Server
Table 5
TCPIP Parameter Definitions
Page 16 of 89
5
5.1
Channel Numbers
I/O Card Channels
I/O cards installed in a unit each occupy a number of channels on that unit, by which each point on the card may be addressed. Every I/O card provides a certain number of channels.
Card Name
Number Of Channels
HDI-05x Digital Input Card HDI-04x Digital Input Card HAI-03x Analog Input Card HDO-04x Digital Output Card HDO-05x Digital Output Card AOT-21 Analog Output Card Empty Slot
Table 6
64 32 32 32 32 8 16
Channel Number Assignment
The I/O configuration may be organized by I/O Module Type or by the Point Types configured. Each scheme is discussed in the following sections.
Page 17 of 89
5.2
Points Grouped By Type Only
If an I/O Point table (e.g. SDI) is attached directly to the Unit node then the channel numbers should be relative to the first hardware channel on the unit beginning at the 0 and continuing across cards to the last hardware channel on the unit. For example, consider a unit which is configured with an HDI-050 (64 channel card) in the first slot and an HAI-030 (32 channel card) in the second slot: The first digital input point is channel 0 The last digital input point is channel 63 The first analog input point is channel 64 The last analog input point is channel 95
Figure 9
Unit Channel Assignment
Page 18 of 89
5.3
Points Grouped By Module
If an I/O Point table (e.g. SDI) is attached directly to the Unit node then the channel numbers should be relative to the first hardware channel on the unit beginning at the 0 and continuing across cards to the last hardware channel on the unit. It is generally more convenient to configure the I/O Module elements for each unit first defining what modules are physically installed in the unit. The configuration of the Module element is described in section 3.11. The I/O Point Tables (e.g. SDI) can then be attached to the relevant modules. In this case the channel numbers always begin at 0 for the first hardware channel on each module.
Figure 10
Module Channel Assignment
Each point is uniquely identified by a combination of both Module slot position and channel number.
Page 19 of 89
6
6.1
Single Digital Inputs (SDI)

Configuration Table
The Single Digital Input (SDI) component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 11. The SDI component is used to configure single digital input points. Simply drag the SDI icon from the Elements window onto the required unit or card in the Project Hierarchy. As you drop it you will be prompted for the number of records to create. Once the required number of entries is created they will be displayed in the Data Window where the default parameters may be edited as shown in Figure 11.
Figure 11
SDI Record creation
SDI points are configured with filters to report only valid changes in value. These filters are discussed in sections 6.2 and 6.3 . SDI points are mapped to slave protocols as a 1-bit data field. Table 7 gives the field definitions for the Single Digital Input (SDI) component.
Page 20 of 89
Field Name
Value
Comments
TAG Description Channel
40 Characters 40 Characters 0 to 255
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The channel number is the points position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point. This is the time, in milliseconds, that the digital input must be in its active state before the change of state (from OFF to ON) is recognised. See section 6.3 . This is the time, in milliseconds, that the digital input must be in its inactive state before the change of state (from ON to OFF) is recognised. See section 6.3 . This drop down selector allows you to invert the reported value of the digital input. Auto Suppression means that the point can be automatically suppressed if the frequency of transitions exceeds a configured limit within a limited time. Refer to section on auto suppression for further details Manual Suppression inhibits the operation of the point until it is reconfigured with this option removed. No Suppression will allow normal processing of the point with no suppression allowed.
On Time (ms)
0 to 60,000
Off Time (ms)
0 to 60,000
Invert Inhibit
Yes/No Auto Suppression, Manual Suppression, No Suppression
Debounce Time (ms)
4 to 255
Before a digital input change is reported, it must have a stable value for the Debounce Time. See section 6.2 .
SDI Parameter Definitions
Table 7
Page 21 of 89
6.2
SDI Debounce
SDI points are configured with three values for filtering the input value before report. The most commonly used filter parameter is the Debounce Time. The Debounce Time in the SDI configuration table is used to filter short duration contact bounce on inputs. Any input change shorter than the Debounce Time is discarded. In operation, the first change to occur for a point is recorded with a time stamp. Any further changes are then discarded. Once the input has stabilised to a new value, it is reported using the first recorded time stamp. The Debounce Time configures the duration the input must be stable for before the new value is reported. An example of the debounce filter in operation is given in figure 12.
Figure 12
Debounce Filter Operation
In figure 12, at the point in time marked 1 the input value changes for the first time. The timestamp is recorded for this change. The time durations between the points marked 1 and 2, points 2 and 3, points 3 and 4 and points 4 and 5 are all of a shorter duration than the debounce time. These changes are not reported and the time stored is dumped. The time between points 5 and 6 is greater than the configured debounce time, and the input is now stable as a value of 1. At point 6, the new value is reported, using the timestamp recorded a point 5. At point 7, the input value changes again. Because a new value has been reported, the filter is restarted and a timestamp is recorded for this change. The time durations between points 7 and 8, points 8 and 9, points 9 and 10 and points 10 and 11 are all of a shorter duration than the debounce time. These changes are not reported and the time stored is reset every time. The time between points 11 and 12 is greater than the configured debounce time, and the input is now stable as a value of 0. At point 12, the new value is reported, using the timestamp recorded at point 11.
6.3
SDI Time Filter
SDI points may be filtered so that a state must be of a minimum duration before being reported. Changes of a short duration are not reported. The minimum ON time and
Page 22 of 89

minimum OFF time may be configured separately. This filter causes the report of a change of state to be delayed. Once the duration of the input value change is greater than the configured time, it is reported using the timestamp of the last change. The On Time filter and the Off Time filters are applied after debounce time filtering. Only input value changes which have first satisfied the debounce time are subsequently checked by the time filters. An example of an ON Time filter is shown in figure 13.
Figure 13
SDI ON Time Filter
As per the earlier section, the time between points 5 and 6 is greater than the configured debounce time, and the input is now stable as a value of 1. At point 6, the new value was reported, using the timestamp recorded a point 5. But if there is a SDI On Filter time configured, then the point will not be reported till the ON-time is exceeded in the same state. So at 7 the point will be reported with the time from 5. A similar procedure works for the OFF filter time.
Page 23 of 89
Double Digital Inputs (DDI)
The Double Digital Input (DDI) component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 14. The DDI table configures pairs of consecutive digital input channels to operate as double digital inputs. Double digital inputs produce an integer value between 0 and 3.
Figure 14
DDI Record definition
DDI points are mapped to slave protocols using the 2-bit data field type. Table 8 gives the field definitions for the Double Digital Input (DDI) component including limits.
Field Name
Value
Comments
TAG
40 Characters
This is a unique identifier for the point.
Page 24 of 89

Description Channel 40 Characters 0 to 254 This is a brief description of the point for configuration purposes only. This defines the first of 2 digital input channels on a unit. These are the channels used to calculate the Double Digital Input (DDI) value. This field defines the time, in milliseconds, that the two digital inputs must remain in the VALID state before being reported as a valid input. Refer to section 7.3 . This field defines the time, in milliseconds, that the two digital inputs must remain in the INVALID state before being reported as an invalid input. Refer to section 7.3 . This is a drop down selector field that allows you to swap the significance of each input channel. If set to No, the first channel is the least significant. If set to Yes, the first channel is the most significant. This drop down selector allows you to select the type of suppression that is applied. Auto Suppression means that the point can be automatically suppressed if the frequency of transitions exceeds a configured limit within a certain time. Refer to the section on Auto Suppression for further details. Manual Suppression inhibits the operation of the point until it is reconfigured with this option removed. No Suppression will allow normal processing of the point with no suppression applied at any time. Debounce Time (ms) Timestamp as 4 to 255 Before a digital input change from either input channel is used, it must have had a stable value for this Debounce Time. Refer to section 7.2 . This drop down selector allows you to select how the DDI change event will be time stamped. Default is Last change. First change means that the timestamp used for the DDI event will be the timestamp of the first digital input change of state for that DDI, before the time filter is applied. Last change means that the timestamp for the DDI event will be the timestamp of the last of the digital inputs changing state for that DDI. Refer to section 7.3 .
Table 8 DDI Parameter Definitions
Valid (10/01) time (ms)
0 to 60,000
Invalid (00/11) time (ms) Invert
0 to 60,000
Yes/No
Inhibit
Auto Suppression Manual Suppression No Suppression
First Change Last Change
Page 25 of 89
7.1
Operation
DDI points can have values of 0, 1, 2 or 3. A Value of 1 or 2 is considered valid, since a single input signal is active. The calculation of the DDI value from the input channels is illustrated in table 9.
DDI Value First Channel Second Channel Invert = No Decimal Binary Invert = Yes Decimal Binary
OFF ON OFF ON
OFF OFF ON ON
Table 9
0 1 2 3
00 01 10 11
DDI Value
0 2 1 3
00 10 01 11 Valid
7.2
DDI Debounce
The Debounce Time is intended to filter short duration spikes and contact bounce on inputs. Before either of the input signals is used to calculate a DDI value, the input must be stable for greater than the Debounce Time. Changes due to contact bounce are filtered out. For further details, please refer to the discussion of SDI Debounce in section 6.2 . 7.3 DDI Time Filter
To prevent the report of 00 transitions between valid DDI states, the DDI point may be configured to filter changes that last for only a short duration. Typically, the Invalid Time is configured to allow the connected equipment to change between two Valid states without an unnecessary Invalid report. The time filter is applied after the debounce filter has been applied to any input transition. Only transitions which first satisfy the debounce criteria may be reported. If the Timestamp As field is set to First Change, then DDI events will report using the timestamp of when the initial state changed (e.g. 10 -> 00). This change may have resulted in a DDI state that was not reported (e.g. 00), because of the time filter. If the Timestamp As field is set to Last Change, then DDI events will report using the timestamp of the last input change, the change at which the new state occurred.
Page 26 of 89
Automatic Suppression
The Automatic Suppression component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 15. The automatic suppression function prevents digital inputs from producing excessive change reports due to a failure. These reports may otherwise consume processing resources and communications throughput. The Auto Suppression table configures the maximum number of changes per period that any input may report. The suppression of a point is based on a configurable number of changes, the Threshold, in a configurable time period, the Suppression Window. Once the threshold has been exceeded within the suppression window, the point is marked with a Suppressed quality flag and further changes are not reported. The suppression is removed after the configurable period, the Release Window, has elapsed without any changes. Only one record is required per unit. Refer to Figure 15 as an example of Auto Suppression Configuration. In this table, a digital input will be marked as suppressed on the 33rd change in value if occurs within 1 second of the first change. The input must not change state for 1 second for the suppression status to be removed.
Figure 15
Automatic Suppress Record Configuration
This table is required for each unit where Automatic Suppression is used. The values in this table will apply to all SDI and DDI points in that unit which are configured to use automatic suppression.
Page 27 of 89

The table below gives the field definitions for the Automatic Suppression component including limits where applicable.
Field Name
Value
Comments
TAG Description Threshold
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The number of valid changes a point may make without activating suppression. Once the Threshold number of changes has been reported, a further change will show the point as suppressed. No more changes are then reported. Suppression period in seconds. Suppression is activated for a point if the Threshold number of changes is exceeded within the Suppress Time Window. Suppression is removed after this period has elapsed without any changes in a points state. If a change is detected the timer is restarted.
Suppress Time Window (s) Release Time Window (s) Enabled
1 to 60 seconds
1 to 30 seconds
Yes/No
Allows the table to be downloaded with or without activation.

Auto Suppression Parameter Definitions
Table 10
Page 28 of 89
BASE Apps and I/O Configuration Manual 9

9.1
Digital Outputs (DOT)

Configuration
The Digital Output (DOT) component is contained in the Elements window under the Points tab and the Digital sub-group as shown in Figure 16. The DOT component is used to configure the digital outputs / control outputs.
Figure 16
Digital Output (DOT) Record Configuration
The DOT table configures digital output points that may be mapped to a slave protocol using the 1 bit data field type.
Page 29 of 89

The table below gives the field definitions for the Digital Output component, including limits where applicable.
Field Name
Value
Comments
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The channel number is the points position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point. This is a drop down selection field that defines command security for the individual DOT point. In Single Stage operation, the output is operated with a single command message. In Three Stage operation, the output requires a secure sequence of three XCell messages for operation.
Stages
One Stage/ Three Stage
Output Mode
Pulse Only / Allow Steady State
This is a drop-down selector field that defines the permitted output modes of the DOT point. Points which are configured as Allow Steady State accept commands to latch ON for an indefinite period. They also accept commands to pulse ON with a duration supplied by the commands source. If a point is configured as Pulse Only, then commands to latch ON the point will execute a pulse command with a duration set by Pulse Time.
Pulse Time (ms)
10 to 10,000 milliseconds
This is the period, in milliseconds, for which a Pulse Only DOT is active for latch ON commands. If the DOT is set to Allow Steady-State this field is ignored.
DOT Parameter Definitions
Table 11
Page 30 of 89
9.2
DOT table rev. 012
The rev 012 table has some additional configuration fields which allow the user to add a local/remote tag which will enable and disable control operation depending on its state. Additional parameters are: Output Enable Use: Yes or No Output Enable Enable Tag: User puts the reference tag in this field to be used to enable or disable that control. Output Enable Disable State: On or Off - This is the state of the referenced tag that will disable the control.
Page 31 of 89
9.3
Control Security
Controls may be configured as One Stage or Three Stage outputs. In three stage operation, an output requires a secure sequence of three XCell messages for operation. Typically, a slave protocol will transparently forward a master stations select/execute, or select-before-operate, control sequences as three stage operations. This ensures that only the correct output point operates as desired. The XCell will only allow a single three stage output to a DO card on any unit. If a three stage DOT output is ON, then further select operations to the unit will fail and no other three stage output will be allowed. Three stage controls will not operate in response to one stage commands. One stage controls will not operate in response to three stage commands. 9.4 Output Mode
In Pulse Only mode, DOT points execute commands to latch ON as pulse outputs of a duration specified by the Pulse Time in the DOT table. This configuration supports Master Station protocols which do not provide information on how a point is to be operated, and prevents an output from remaining in the ON state indefinitely. If a point is Allow Steady State, then the master station protocol provides the information on how to operate the point. In this configuration, the point may be latched to the ON state if requested.
Page 32 of 89
9.5
Single Output Operation
The product software will prevent more than one three stage command from being executed on a unit at any one time. When a three stage select is received, a failure response is returned if another point has not yet completed its requested operation. In addition, HDO cards implement a configurable hardware safety setting. If it is set with the hardware jumper, then the card may be in 1-Up Operation Mode. In this mode, the card will read back the state of all outputs whenever a point is selected for three stage or single stage operation. The card will not operate any further controls if a point is already operating. This prevents the card operating a point incorrectly due to a failed output driver, by detecting the failure before the output contacts are energised at the execute stage.
Selected Control Output and point selection verification
HDO-040 Execute Control Relay
Switch PWR Output that energizes only while the selected control point is executed. Can be used for additional external relay control security logic.
Figure 17 Single Output Operation
Page 33 of 89
9.6
Multiple Master Stations
Multiple Master stations may be connected to the RTU at one time. To prevent multiple points from operating, the IOServer firmware will fail a second master stations select command if a three stage control is already selected, or operating, from another master station. While a three-stage point is in the select stage, all other master stations are locked out from three-stage operation on a unit. The first master station to begin a sequence may continue without interruption, as commands from other sources have no effect. Should a master station control sequence be interrupted, the points select status will time out and control is then allowed from other sources. This scheme prevents an incorrect control point from operating, since only a single command source is allowed to issue each stage of a secure control sequence.
Page 34 of 89
10 Analog Inputs Table (AIN)

10.1 Configuration The AIN component is used to configure scaled DC analog inputs. Either voltage or current inputs may be measured and reported as an integer value, suitable for transmission to a master station. The table configures the range of this value, as well as the operation of its associated status information. Analog measurements are 16 bit unsigned quantities. Internally, 0 counts represent negative full scale and 65535 counts represent positive full scale for a particular card. The AIN component is contained in the Elements window under the Points tab and the Analog sub-group as shown in Figure 18.
Figure 18
Analog Input (AIN) Configuration
Page 35 of 89
The analog input points configured by the AIN table may be mapped to a slave protocol using the 16 bit unsigned data field type. The following table gives the field definitions for the Analog Input component (AIN).
This is a unique identifier for the point. This is an optional brief description of the point. The channel number is the points position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point. This is the amount the input must change by to generate a new change event. It is specified as a percentage of the valid measurement range, and is entered as % x 100 (e.g. 8% = 800). This is a drop-down selection field that determines if this particular AIN reports values as Unipolar or Bipolar. Typically, a protocol will scale unipolar analogs to fit its range of positive values. Bipolar analogs are scaled to fit the entire range of values supported by the protocol. This value specifies the maximum valid input value that should be reported by this AIN channel. This quantity has the same units as configured for the Hardware Max field. This value specifies the minimum valid input value that should be reported by this AIN channel. This quantity has the same units as configured for the Hardware Max field. This value is used to set the high limit alarm on this AIN point. The high limit alarm is a status associated with the analog value, which may be transmitted to a master station if supported by the protocol. This value is used to set the low limit alarm on this AIN point. The low limit alarm is a status associated with the analog value, which may be transmitted to a master station if supported by the protocol. This is the amount by which the analog value must change before an alarm state is reset. It is specified as a percentage of the valid measurement range, and is entered as % x 100. This field specifies the maximum analog input value that the channel can measure, not including the over range percentage. The value and units for this field are determined by the I/O card in use, e.g. 20 for +/- 20mA card. The analog input channels over range before scaling is specified by this field. This is typically a value of 5, determined by the I/O card in use.
Delta (0.01%)
0 to 10,000 (0 - 100 %)
Polarity
Unipolar / Bipolar
Max
+100.00 to -100.00 +100.00 to -100.00 Less than or equal to 'Max' value Greater than or equal to 'Min' value 0 to 10,000 (100%)
Min
High Limit
Low Limit
Alarm Delta (0.01%)
Hardware Max
0 to100.00
Hardware Over Range (%)
0 to 100%
Page 36 of 89

Output Over Range (%) Hysteresis (0.1%) 0 to 10% The output measurement may allow for values outside the valid measurement range. This is the over range amount, specified as a percentage of the valid range. This band operates outside the normal range at both ends for the setting of the out of configured bit in the status. The band is divided into 2 halves. Within the outer half, the bit will remain set only if it was already set.
AIN Point Parameter Definitions
0 to 99 (9.9%)
Table 12
10.2 Analog Input Scaling There are a number of configurable options in the AIN table that determine how the analog input values are scaled. The input range of the hardware channel (before scaling) is specified in the fields Hardware Max and Hardware Over Range (%). The Hardware Max value, plus the Hardware Over Range (%), is the maximum measurement that the input channel can make. For the HAI-030 card, these values would typically be entered as 20.00 for 20mA and 5 for 5 % respectively. The input channels in this case can measure values from 21mA to 21mA. The Max and the Min values specify the user range for this input channel. The Max and Min must lie within +/- (Hardware Max + Hardware Over Range). For example, a Min of 0 and a Max of 10 would specify that the signal should be scaled so that the valid range represented 0 to 10mA rather than the hardware range 0 to 20mA. The final scaled value is represented in the XCell product as 0-65535 with a Unipolar/Bipolar flag. If a point is configured as Unipolar then 0 corresponds to the Min value and 65535 corresponds to the Max value plus the Output Over Range (%). If the Output Over Range (%) is set to 0 then 65535 represents Max value. If the Output Over Range (%) is set to 5% then 62415 represents the Max value. If a point is configured as Bipolar then 0 corresponds to the Min value minus Output Over Range (%) and 65535 corresponds to the Max value plus the Output Over Range (%). If the Output Over Range (%) is set to 0 then 0 represents Min value and 65535 represents Max value. If the Output Over Range (%) is set to 5% then 1560 counts represents Min value and 63975 represents the Max value. 10.3 Limit Alarm Processing Some of the status flags associated with an analog input indicate to a protocol that the points value has exceeded a high or low limit. The low limit alarm is set ON when the input is less than the value specified by Low Limit. The high limit alarm is set ON when the input is greater than the value specified by High Limit. Before the alarms are reset, the points value must return to within range by the Alarm Delta amount. The alarm delta is specified as a percentage of the valid measurement range. 10.4 Database Update Analog input changes are only processed if the input changes by more than the Raw Delta counts (input range is 0-65535) configured in the HAI Card Config table. They are
Page 37 of 89

then scaled and according to the configuration in the AIN Table and if the scaled value has changed by more than the Delta value in the AIN Table then it will be reported. The analog value will also be reported if any of the status flags have changed.
Page 38 of 89
10.5 Sample Configuration
Figure 19
Example AIN Configuration (1)
Figure 20
Example AIN Configuration (2)
In the sample configuration above, an analog input is configured on channel 32 of the unit (i.e. the first channel on the second I/O card). The point TAG is U1AIN_0 and this reference Tag is used in any protocol map table to configure the protocol specific address for the point. The analog module is calibrated to +/-20mA +5% over range so in the sample configuration the Hardware Max value is set to 20, with a 5% Hardware Over Range. The range of the connected instrument is from 0 to 20mA, i.e. the minimum input will be 0mA, and the maximum input will be 20mA. These are configured in the Instrument Range Max & Min and setting the Polarity to Unipolar. The Output Over Range is set to 0% which specifies that the full 0 to 65535 count range will represent the instrument range of 0 to 20mA. Note: The unipolar setting also indicates to protocols that there are the measurement is entirely positive and should be transferred, by default, to the positive range of the protocol. For a protocol such as DNP3, which has a range from 32768 to 32767, the input would be scaled into the range of 0 to 32767 if not otherwise specified. The Delta (0.01%) is set to 800 which corresponds to an actual delta of 8% (i.e. 800 x 0.01%). This means that the value must change by greater than 8% of the 20mA range (i.e. 1.6mA) before the new value will be reported. The Low and High Limit alarms are generally unused and set to Min & Max respectively. They set low/high alarm indicators associated with the point if the limits are transgressed. However, unless the protocol supports these flags they are not mapped back to the Control Centre. In this case, the Low Limit alarm will be set once the input falls below 4mA. This alarm will not be reset until the input value is increased by 0.1% Alarm Delta (10 x 0.01%) of 20mA, to 4.02mA. The high limit alarm will be set for an input greater than High Limit of 18mA, and reset once the input falls below 17.98mA.
Page 39 of 89
11 Analog Outputs
The Analog Output AOT component is contained in the Elements window under the Points tab and the Analog sub-group. The AOT component is used to configure the analog outputs for a unit. The table below gives the field definitions for the Analog Output component.
Field Name
Value
Comments
This is a unique identifier for the point. This is an optional brief description of the point. The channel number is the points position on the unit. It is used for addressing the point.
AOT Point Parameter Definitions
Table 13
Analog output modules have a maximum of 8 channels each and two modules can be fitted on an IOCB (carrier board) that occupies one card position in a rack. This IOCB carrier card always occupies 16 channels regardless of whether two AOT modules are fitted or whether the AOT modules are 4 or 8 channels each. The following table gives the hardware channels corresponding to the AOT cards fitted in an IOCB carrier board.
Hardware Channel
8 Channel AOTs
4 Channel AOTs
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
Channel 1 on AOT Card 1 Channel 2 on AOT Card 1 Channel 3 on AOT Card 1 Channel 4 on AOT Card 1 Channel 5 on AOT Card 1 Channel 6 on AOT Card 1 Channel 7 on AOT Card 1 Channel 8 on AOT Card 1 Channel 1 on AOT Card 2 Channel 2 on AOT Card 2 Channel 3 on AOT Card 2 Channel 4 on AOT Card 2 Channel 5 on AOT Card 2 Channel 6 on AOT Card 2 Channel 7 on AOT Card 2 Channel 8 on AOT Card 2
Table 14
Channel 1 on AOT Card 1 Channel 2 on AOT Card 1 Channel 3 on AOT Card 1 Channel 4 on AOT Card 1 Unused Unused Unused Unused Channel 1 on AOT Card 2 Channel 2 on AOT Card 2 Channel 3 on AOT Card 2 Channel 4 on AOT Card 2 Unused Unused Unused Unused
AOT Hardware Channels
Analog outputs are mapped as 16 bit unsigned quantities from slave protocols. A value of 0 counts will result in the minimum output current, and 65535 represents full scale output.
Page 40 of 89
BASE Apps and I/O Configuration Manual 12 Optional Tables

These tables are only supplied on specific projects where the functionality is required.
Page 41 of 89
12.1 Raise-Lower Pairs The Raise-Lower Pairs table allows single digital output points to be paired together. The two channels will not operate simultaneously, providing output security for single stage controls such as transformer tap change outputs or pulse width modulation controls, often used for frequency control. Raise-Lower Pairs points do not support three-stage operation. Raise-Lower Pairs support eXpress with the use of the Raise-Lower Xprs Map and RaiseLower Xprs Points tables, described in section 12.2 . These tables allow eXpress to output accurate pulse width modulated outputs.
Figure 21
Raise-Lower Pairs
Page 42 of 89

Each pair has one Raise channel and one Lower channel. This is the channels Type. If the Raise channel receives an output command, then the Type of the following table entry is checked. If the following entry is a Lower type, then the two channels are a pair. Similarly, if the Lower channel receives an output command, then the Type of the previous table entry is checked. If the previous entry is a Raise type, then the two channels are a pair. In either case, an output command for either channel of a pair will cancel any command in progress for that pair. A raise command will immediately cancel any in-progress command on its own channel or on the Lower channel. A lower command will immediately cancel any in-progress command for its own channel or the Raise channel. A third Type is a Single output channel. These channels are not paired. This type is provided for situations in which DOT points are required to cancel any in-progress commands on a channel and begin execution of a new command. The normal behaviour for DOT points is to ignore pulse commands received while executing a previous command. A Single type output channel also allows eXpress to execute accurate pulse train commands for a single channel.
Page 43 of 89

The table below gives the field definition parameters for the Raise-Lower Pairs table.
Field Name
Value
Comments
40 Characters 40 Characters 0 - 255
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The channel number is the digital output points position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point. Used to pair together channels that should not execute controls simultaneously into Raise/Lower pairs. References a Raise-Lower Xprs Map table entry that defines the pulse train parameters that are used to execute express commands.
Type
Raise/Lower/Single
RL Xprs Map
40 Characters
Table 15
Raise-Lower Pairs Parameter Definitions
Page 44 of 89
12.2 Pulse Train Outputs From eXpress eXpress may generate pulse trains by switching DOT points on and off within the user program at the required rate, but the accuracy of these outputs is limited to the period at which the eXpress program is running. A typical figure might be 100ms. To output an accurate pulse train, the eXpress program can supply a Raise-Lower point with the exact pulse train parameters and allow it to control the channel switching. This requires two additional tables to the points of the Raise-Lower Pairs table. The Raise-Lower Xprs Map table configures sets of values that are used to output a particular pulse train configuration. The points of the Raise-Lower Xprs Points table hold the individual values.
Field Name
Value
Comments
TAG Description Pulse Count
40 Characters 40 Characters Reference Tag
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The Tag name of the point used to hold the value for the number of pulses that should be executed by the Raise-Lower Point. The pulse count value is valid from 0 to 255. The Tag name of the point used to hold the value for the duration of the pulses, in milliseconds. The valid range is 0 to 65535. The Tag name of the point used to hold the value for the delay between pulses, in milliseconds. The valid range is 0 to 65535.
Pulse On Time Pulse Off Time
Reference Tag
Reference Tag
Table 16
Raise-Lower Xprs Map Definitions
Field Name
Value
Comments
TAG Description
40 Characters 40 Characters
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only.
Table 17
Raise-Lower Xprs Points Parameter Definitions
To execute a pulse train, the eXpress program should first drive a set of the Raise-Lower Xprs Points to the desired pulse train parameter values. The Raise-Lower Xprs Points are mapped to a particular Raise-Lower Pairs digital output point using an entry of the Raise-Lower Xprs Map. The pulse train then begins execution when the Raise-Lower Pairs digital output point is operated.
Page 45 of 89

For example, a simple configuration of one Raise-Lower Pair may use six Raise-Lower Xprs Points, as shown below.
Figure 22
Raise-Lower Xprs Points
Each of these six points is mapped to eXpress, which drives them to the desired values. Each point is then mapped in the Raise-Lower Xprs Map, as shown below.
Page 46 of 89
Figure 23
Raise-Lower Xprs Map
Each Raise-Lower channel is associated with a parameter set using the RL Xprs Map field of the Raise-Lower pairs table, as shown below.
Page 47 of 89

Figure 24 Raise-Lower Pairs Example
The Raise-Lower Pairs points are digital outputs within eXpress. When these points are turned ON, the point cancels any in-progress command and begins the execution of a new pulse train. This pulse train has a count, on time and off time determined by the values of the points mapped by the associated RL Xprs Map entry. In this example, when eXpress drives RAISE_1 ON, a pulse train output is executed for channel 0. The pulse train has a pulse count equal to the current value of RAISE_1_COUNT. It has a pulse duration of RAISE_1_ON_TIME, and a delay between pulses of RAISE_1_OFF_TIME.
Page 48 of 89
12.3 Sequenced DO The Sequenced DO table is used to configure DOT points so that a single master station command may generate a series of up to three simultaneous pulse outputs. The three outputs each have configured durations, and are configured to begin their operation after a configured delay. This provides for output schemes which use a select output for a particular piece of equipment, and Trigger and Heavy Duty outputs to complete the operation. For example, the Trigger output may go to circuit breaker synchronization device, and the Heavy Duty output may drive a relay capable of switching a high current. Each Sequenced DO control has a Select Channel. This digital output channel operates in response to a master station command with a pulse of Select Duration milliseconds. If a Trigger Point is configured, then Trigger Delay milliseconds after the Select Channel begins operation, the Trigger Point DOT point operates with a pulse of Trigger Duration milliseconds. After a further delay of Heavy Duty Delay milliseconds, the Heavy Duty Output is operated with a pulse duration of Heavy Duty Duration milliseconds.
Figure 25
Sequenced DO Example
Page 49 of 89
Field Name
Value
Comments
TAG Description Select Channel Select Duration Trigger Point
40 Characters 40 Characters 0 - 255 0 - 600000 ms Reference Tag
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The channel number of the select output point. The duration of the Select Channel pulse. A DOT point configured as Single Stage Type. The point may be local or remote to the unit. If empty, no trigger point is operated. The delay after the select channel begins operation before the trigger point is operated. The duration of the Trigger Point pulse. A DOT point configured as Single Stage Type. The point may be local or remote to the unit. If a Trigger Point is configured, the delay after the Trigger Point begins operation before the Heavy Duty Output is operated. If no Trigger Point is configured, the delay after the select channel begins operation before the Heavy Duty Output is operated.
Trigger Delay
0 - 600000 ms
Trigger Duration Heavy Duty Output Heavy Duty Delay
0 - 600000 ms Reference Tag
0 - 600000 ms
Heavy Duty Duration
0 - 600000 ms
The duration of the Heavy Duty Output pulse.

Sequenced DO Definitions
Table 18
Page 50 of 89
12.4 Network Time Protocol Client (NTP) Configuration The NTP component allows you to enable the operation of an NTP client on a processor. Only one entry is allowed per cell and this limit is enforced by Workbench. The NTP client will periodically query an NTP Server via Ethernet for the current time and then update the RTUs system time. The IP address of the server can be specified in the TCP/IP table, or may be supplied by a BOOTP server. NTP uses UDP format packets on source and destination ports 123, which must be passed by any network firewalls in place. The TAG may be used to map the status of the NTP client to a slave protocol. It is a digital input that is OFF when the time has been updated successfully, and ON when the last operation failed. The NTP component is contained in the Elements window under the Projects tab and the Network sub-group as shown.
Figure 26
NTP Configuration
The table below gives the field definition parameters for the NTP Configuration component.
Page 51 of 89
Field Name
Value
Comments
TAG
40 Characters
The Tag is a unique identifier for the table in the Workbench project. The TAG may be used to map the status of the NTP client to a slave protocol. It is a digital input that is OFF when the time has been updated successfully, and ON when the last operation failed. Enables or disables the NTP client. The number of hours by which to adjust the GMT time received from the server. The number of minutes by which to adjust the GMT time received from the server. How often to update the RTU system time from the NTP server, in seconds. The relative priority of this time source. High priority time sources are used in preference to low priorities. Other time sources may include GPS clocks with a priority of 100, or slave protocols with a typical priority of 40.
NTP Sync Time Zone Hour Offset Time Zone Minute Offset Sync Period
Enabled / Disabled -12 to 12 hours
-59 to 59 minutes
6 to 600000 seconds, default 60
Priority
2 to 100, default 95
Table 19
NTP Parameter Definitions
Page 52 of 89
12.5 HAI Card Config The HAI Card Config component is used to configure the general operation of all analog input cards on a cell. The component is contained in the Elements window under the Points tab and the Analog sub-group as shown below.
Figure 27
Analog Input Card Operation Configuration
Page 53 of 89

The table below gives the field definitions for the component including limits.
Field Name Scan Rate
Value Normal / Fast
Comments The Scan Rate is the frequency with which each point on the analog input card is updated. The Normal rate updates the values every 2.35 seconds. The Fast rate updates the values every 1.18 seconds.
Raw Delta
5 to 255 Counts
This is the minimum change in input counts required for any analog point to report a change in value. 1 count is 1/65535 of the cards full measurement range, before scaling.
HAI Card Parameter Definitions
Table 20
Page 54 of 89
12.6 Accumulators 12.6.1 Configuration Accumulator points maintain a count of input changes over a period of time. The input may be a single or double digital input channel, a high speed counter card channel or an AC analog input card channel. The accumulator component is contained in the Elements window under the Points tab and the General sub-group as shown below.
Figure 28
Accumulator Table
The current count of changes is kept in the accumulator points running value field. This running value is copied to the frozen value when a command from the master station is received, or automatically, with a configured period. The frozen value is useful for obtaining a system wide snapshot of the accumulator values, synchronized in time. To map an accumulator to a slave protocol, the 32 Bit Data field should be selected. To map the running value of an accumulator to a slave protocol which requires separate entries, use the Running Value field. This is not the case for the DNP 3 slave protocol. Both quantities are 32 bit values, for a maximum count value of 4,294,967,295.
Page 55 of 89

The table below gives the field definitions for the Accumulator component.
Field Name
Value
Comments
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The channel number is the points position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point. The input type determines the type and configuration of the input point to be counted. Described in section 12.6.2 .
Input Type
Single DI Channel ON Single DI Channel OFF Single DI Channel ON Or OFF Double DI Channel Valid Double DI Channel ON,OFF Double DI Channel OFF,ON High Speed Counter ACI-030
Period
Minutes 1 to 10000
If not set to 0, the accumulator will automatically update the frozen value from the running value with this period. The period is synchronized to begin at midnight each day. If configured to automatically freeze, the phase determines how many minutes into each period at which to do it. If Yes, the running value is set to 0 when an automatic freeze takes place. This is the maximum value the accumulator values can reach. Once the Roll over value has been reached, the next input count will have a value of 0. This option determines if one or both of the counter's values are saved to NVRAM to be preserved over reboot.
Phase
Minutes 0 to 10000
Auto Reset Rollover
Yes, No 0 to 4,294,967,295
Save
Save Values Save Running Save Frozen Don't Save
Page 56 of 89

Delta 1 to 1000 This is the minimum amount by which the running value must change for an update to be sent. The running value is updated every minute if it has changed, even if the delta has not been exceeded.
Table 21 Accumulator Configuration
12.6.2 Input Types The accumulator point can count changes in three different I/O card types. The card may be the high speed counter or the AC analog input type. These two cards supply input channels which are responsible for the decision on when to increment the count. The accumulator point can also count changes in digital input channels. In this case, the accumulator point requires further configuration to specify when the count value should increment. If the input type is configured as Single DI Channel ON, the accumulator will increment when the digital input of the configured Channel turns ON. Changes to OFF will be ignored. A Single DI Channel OFF input type configures the accumulator to increment only when the digital input channel turns OFF. Single DI Channel ON or OFF configures the accumulator to increment whenever the digital input changes value. A Double DI Channel Valid input type specifies that the accumulator has two digital input channels. The Channel entry defines the first, and the second is the next consecutive channel. The accumulator will increment whenever the two input channels change to a new valid state. The valid states are ON/OFF and OFF/ON. Changes from a valid state to an invalid state, and then to the original valid state are not counted. The Double DI Channel ON,OFF input type also configures the accumulator to count the changes in a pair of digital input channels. In this case, the count is incremented when the configured channel is ON and the next consecutive channel is OFF. The Double DI Channel OFF,ON input type configures the accumulator to increment when the configured channel is OFF and the next channel is ON. 12.6.3 Running Value Change Messages Because the input point may be changing frequently, the accumulator running value may produce a large number of change messages. To reduce the number of change messages, the running value may be configured with a Delta. The running value is only updated when it has been incremented by the Delta amount. The running value is also limited to a maximum of 250 changes in any minute. Input changes in excess of this will increment the value, but will not produce an update. If changed, the running value is updated every minute, on the minute. This occurs even if the value has not exceeded the delta value, or if the point is producing more than the 250 change limit. This means that the maximum amount of time for which the value is inaccurate at the master station is limited to 1 minute. The running value is also updated prior to a freeze operation.
Page 57 of 89

12.6.4 Digital Input Time Stamping Digital input channels configured as accumulator inputs are processed by the Debounce Filter as described in section 6.2 - SDI Debounce and 7.2 - DDI Debounce. The Debounce Time is determined by the DDI or SDI configuration if present. Otherwise, the default time of 10 milliseconds is used. The debounce filter may introduce a delay in incrementing the count. The count value is accurate to within the Debounce Time of the time of any update.
Page 58 of 89
12.7 Binary Coded Decimal Component (BCD) Binary Coded Decimal (BCD) input components allow configuration of digital-inputs to be processed as a BCD value. BCD values with between 1 and 4 digits are supported i.e. 09999. Each digit is derived from 4 consecutive physical digital input channels. The order of the channel allocation is shown below: Chan: State: BCD Digit: 16-15-14-13 0 1 0 0 4 12-11-10-09 0 0 1 1 3 08-07-06-05 0 0 1 0 2 04-03-02-01 0 0 0 1 1
BCD Value = 4321 The BCD component is contained in the Elements window under the Points tab and the General sub-group as shown below.
Figure 29
BCD Configuration
Page 59 of 89

The table below gives the field definitions for the Binary Coded Decimal (BCD) component including limits where applicable.
TAG Description Start Channel Number
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. This value is the start channel number of the least significant bit of the least significant digit of the BCD number being configured, in the example at the start of this section it would be 0 with the next 16 channels allocated to the four BCD digits 0-3. BCD numbers are ALWAYS allocated contiguous channels, in the sample case channels 0-15 would be allocated for the four-digit BCD number. Note: the highest channel usable on a Unit is 252 as FOUR contiguous digital channels are needed for each BCD digit.
BCD Digits
1 to 4
This value is the number of contiguous BCD digits in the configured BCD number, the BCD number will use 4 x BCD Digits contiguous channels from the channel specified in the Start Channel Number field. This field contains the physical channel number of a digital input that may be used to validate the BCD input channels. The BCD input channels will not be latched into the BCD number until this channel goes to the required state set in the Validity State field below. This field and the Validity State field below may be used instead of the On Time and Off Time fields. If set to 0, a validity channel is not used. This field contains the state that the Validity Channel must achieve to validate the BCD input channels to allow the number to be latched into the XCell RTU. This field contains the time, in milliseconds, that the BCD input channels must be stable (not oscillating) when changing from the OFF state to the ON state, in order that the BCD number presented on the channels can be latched into the XCell RTU. This field and the Off Time field below are used as an alternate validation mechanism to the Validity Channel and Validity State fields above. This field contains the time, in milliseconds, that the BCD input channels must be stable (not oscillating) when changing from the OFF state to the ON state, in order that the BCD number presented on the channels can be latched into the XCell RTU. This field and the On Time field above are used as an alternate validation mechanism to the Validity Channel and Validity State fields above.
Validity Channel
0 to 255
Validity State
On/Off
ON Time (ms)
0 to 65,000
OFF Time (ms)
0 to 65,000
Page 60 of 89

Invert Yes/No This is a drop-down selector field that allows the state of all of the BCD input channels (except the Validity channel) to be inverted.
BCD Point Parameter Definitions
Table 22
Page 61 of 89
12.8 TAP Position Component (TAP) The Tap Position Component (TAP) is used to configure inputs from transformer tap changers. It reports either an analog input value or a sequence of digital inputs as an eight bit integer value for the tap position. CG Automation Ireland Limited only uses this element for status tap indication which changes the group of status inputs (one per tap, only one ON at a time) into an analog tag defined by the user in the table. This element should be under the HDI module Icon. Conversion from an analog input to a Tap value should use the TAP AI element. The TAP component is contained in the Elements window under the Points tab and the General sub-group as shown below.
Figure 30
Transformer TAP Configuration
Transformer Tap Changers provide an indication of the current tap position. This is generally provided in one of two methods (but this table should only be used for Digital Tap Position, for Analog Taps see next section). 1. Digital Tap Position: A number of digital contacts each one representing one tap position. At any tap position the corresponding contact is energized thus providing an indication of the current tap position. 2. Analog Tap Position: One analog signal is provided which is proportional to the actual transformer tap position. Each consecutive tap position causes a corresponding increase in the analog value. The minimum and the maximum tap position values are defined through the First Tap and Last Tap fields respectively. Tap position points are mapped to slave protocols as 8 bit unsigned data field types.
Page 62 of 89

The table below gives the field definitions for the TAP component including limits where applicable.
Field Name
Value
Comments
This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. This defines the input channel number for analog input tap indications, and the first of a sequence of channel numbers for digital indications. The digital input channels used are consecutive, one for each of the tap positions (('First Tap' 'Last Tap') + 1 channels). This field is used for analog input types only. Each tap position is represented by an analog input value. The deadband is a percentage of the range between input values that are considered a valid measurement. A value of 100% will cause the tap position closest to the current value to be used. For a smaller deadband, invalid measurements result in a status of Out Of Configured Range. This is a drop-down selection field that determines the type of tap position indication being monitored and this in turn defines the configuration of the component. This is a drop-down selection field that defines the transformer winding type. The double wound tap positions begin use the value of First Tap for the minimum analog input value or for the first digital input channel number. The auto wound tap positions begin with the value of Last Tap for the minimum input current or the first digital input channel.
Deadband
0 to 100
Signal Type
Digital/Analog
Transformer
Double/Auto
First Tap Last Tap Inverted
0 to 254 0 to 254 Yes/No
This defines the lowest value of tap position. This defines the greatest value of tap position. This is a drop-down selection field that allows the inputs from Digital TAP positions to be inverted if required. Normally, the digital input channel indicating the taps current position is on and all other channels must be off. If Inverted, the digital input channel indicating tap position must be off, and all other channels on.
Page 63 of 89

Timestamp as First Change Last Change This drop down selector allows you to select how the TAP change event will be time stamped. Default is Last change. First change means that the timestamp for the TAP event will be the timestamp of the first of the digital inputs changing state for that TAP. Last change means that the timestamp for the TAP will be the timestamp of the last of the digital inputs changing state for that TAP, plus the ON Time. Min / Off Time (ms) 0 to 32000000 This is a dual use field. For analog inputs, this field configures the minimum input value that represents a tap position, not including deadband. For digital indications, this field configures the length of time for which a tap indication is allowed to transition between valid input states without report after an input channel has switched off. Max / On Time (ms) 0 to 32000000 This is a dual use field. For analog inputs, this field configures the maximum input value that represents a tap position, not including deadband. For digital indications, this field configures the length of time for which a tap indication is allowed to transition between valid input states without report, after an input channel has switched on. This field is only used for analog input types. It specifies the maximum valid analog input value that the channel can measure, not including the over range percentage. The I/O card in use determines it. This field is only used for analog input types. This is the percentage of the maximum valid input range that is used to measure over range values. It is determined by the I/O card in use, and typically has a value of 5.
Tap Parameter Definitions
Hardware Max
-100 to 100
Hardware Over Range (%)
0 to 100
Table 23
Page 64 of 89
12.9 Tap AI 12.9.1 Configuration The Tap AI table defines transformer tap position indications derived from analogue inputs. The analogue input may take any range of values supported by the I/O card, and this range is mapped to a range of tap positions. The space between valid tap position input values may include invalid regions, which result in the tap position having a bad status.
Figure 31
Tap AI Table
Field Name TAG Description Channel
Value 40 Characters 40 Characters 0 to 255
Comments This is a unique identifier for the point. This is a brief description of the point for configuration purposes only. The channel number is the analogue input points position on the unit or I/O module, as described in section 5.1 . It is used for addressing the point. The First Tap is the tap position value corresponding to the minimum input current. The Last Tap is the tap position value corresponding to the maximum input current. It may have a value less than the First Tap position if required. The valid range is a percentage of the region between nominal analogue input values. A setting of 100% means that the tap indication is always valid. The Instrument Range Min is the minimum analogue input value, corresponding to the first tap position. The Instrument Range Min is the maximum analogue input value, corresponding to the last tap position. The Hardware Max is the maximum input value that the analogue input card can measure, excluding the over range. For a standard HAI-030 fitted with 50ohm termination resistors this is 20 mA. The Hardware Over Range is the percentage of the analogue input cards valid range which may be measured above the maximum. It has a value of 5% for the HAI-030.
Table 24 Tap AI Parameters
First Tap Last Tap
0 to 65535 0 to 65535
Valid Range %
0 to 100
Min Max Hardware Max
-100 to 100 -100 to 100 100
Hardware Over Range %
0 to 100
Page 65 of 89

12.9.2 Example A standard HAI-050 fitted with 50 ohm termination resistors measures a 4mA to 20mA input signal. An input of 4mA represents a tap position of 0 and an input of 20mA represents a tap position of 4. The configuration settings are: First Tap Last Tap Valid Range Min Max Hardware Max Hardware Over Range 0 4 50 4 20 20 5
The output values for a given current are:
Nominal Input Current
Current Range (mA)
Tap AI Value
Less than 3 mA 4 mA 3 to 5 5 to 6 6 to 7 8 mA 7 to 9 9 to 10 10 to 11 12 mA 11 to 13 13 to 14 14 to 15 16 mA 15 to 17 17 to 18 18 to 19 20 mA 19 to 21 More than 21 mA

Table 25
0, Bad 0 0, Bad 1, Bad 1 1, Bad 2, Bad 2 2, Bad 3, Bad 3 3, Bad 4, Bad 4 4, Bad
Tap AI Example
Page 66 of 89
12.10 12.10.1
Pseudo Points Pseudo Digital Inputs
Pseudo DI points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded. Pseudo DIs support a Force command to change the database value of the point. The table below gives the field definition parameters for the Pseudo DI entry.
Field Name
Value
Comments
TAG Description
Table 26
Pseudo DI Parameter Definitions
12.10.2
Pseudo Digital Outputs
Pseudo DO points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded. Drive commands sent to a Pseudo DO point will update its current database value. The commands may pulse ON the point, or latch it to a value. The table below gives the field definition parameters for the Pseudo DO entry.
Field Name
Value
Comments
TAG Description
Table 27
Pseudo DO Parameter Definitions
Page 67 of 89
12.10.3
Pseudo Analog Inputs
Pseudo AI points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded. Pseudo AIs support a Force command to change the database value of the point, from 0 to 65535 counts. The table below gives the field definition parameters for the Pseudo AI entry.
Field Name
Value
Comments
TAG Description
Pseudo AI Parameter Definitions
Table 28
12.10.4
Pseudo Analog Outputs
Pseudo AO points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded. Drive commands sent to a Pseudo AO point will update its current database value. The commands may drive the point to a value from 0 to 65535. The table below gives the field definition parameters for the Pseudo AO entry.
Field Name
Value
Comments
TAG Description
Table 29
Pseudo AO Parameter Definitions
12.10.5
Pseudo Accum
Pseudo ACCUM points have no function within the RTU, but allow a mapping to be made that will store a tag name where future points may be required or where obsolete signals may be recorded. Drive commands sent to a Pseudo ACCUM point will update its current database value. The commands may drive the point to a value from 0 to 4,294,967,295. The table below gives the field definition parameters for the Pseudo AO entry.
Page 68 of 89
Field Name
Value
Comments
TAG Description
Table 30
Pseudo AO Parameter Definitions
Page 69 of 89
12.11 12.11.1
Remote Connect Points Remote Connect DI
Remote connect DI points provide status information for a unit on what users are currently logged in with XCellView or Workbench. Each point may be mapped to a slave protocol as a digital input.
Figure 32
Remote Connect DI Table
The points have the following definitions.
Record
Purpose
0 1
ON when a user has logged into the unit using XCellView on a serial port or telnet connection. Momentary ON when a user has attempted to log into the unit using XCellView and has not supplied the correct username and password for three attempts. ON when users may attempt to log in with XCellView or Workbench. OFF when user log in has been permanently disabled from within XCellView, or temporarily disabled with a Remote Connect DO point.
3 4
ON when a user has logged into the XCellView network. Momentary ON when a user has attempted to log on to the network using Workbench and has supplied an incorrect username / password.
Table 31 Remote Connect DI Definitions
Page 70 of 89
12.11.2
Remote Connect DO
Remote Connect DO points allow a master station to prevent a user from logging into an XCell unit.
Figure 33
Remote Connect DO Table
The points have the following definitions.
Record
Purpose
0 1
Drive ON to prevent users from logging into the unit with XCellView or Workbench. Drive ON to enable users to log into the unit with XCellView or Workbench.
Table 32 Remote Connect DI Definitions
Page 71 of 89
12.12
Serial Port Pass Through
The Serial Port Pass Through configuration tables allow users to connect to devices on XCell serial ports using the XCell Ethernet. The serial port allows a connection with one of two methods. 12.12.1 XCell View
The first method uses XCell View. A user must log into XCell View and use the menus Utilities->Pass Through to see the available configurations. When the user selects an XCell View enabled pass-through serial port, the terminal display is cleared and the user is connected to the device serial port. The user's key strokes are sent to the serial port and characters received on the port are sent back to the user's terminal. Use Ctrl-F or 2 quick escapes to end the session. The XCell View connection method is suitable for devices which provide a text-mode (terminal) interface. It provides the password protected dial-up and dial-back access of XCell View, as well as telnet. User-rights access control may be applied to restrict access to selected XCell View users. The XCell View connection method is not useful when a transparent connection method is required, perhaps for binary data. Some characters have a special meaning for the XCell View connection.

Use Ctrl-D to log out from XCell View Use Ctrl-F to end the pass-through session
The XCell View connection method requires the user to log into the XCell unit which provides the serial port connected to the device. 12.12.2 TCP/IP
The TCP/IP connection method starts a TCP/IP server on the XCell, on a user configured network port. Any characters sent to the TCP/IP port are forwarded to the serial port, and while a client is connected it receives any characters from the serial port. The IP address of the connecting client can be restricted to a configured address. This method may be useful for attaching IEDs which only have serial ports to a network. IEDs which use the DNP 3.0 protocol may be suitable for this. 12.12.3 Serial Port Pass Through Configuration Table
Figure 34
Serial Port Pass Through Configuration Table
A Serial Port Pass-Thru configuration table entry is required for each serial port which requires pass through access. More than one entry may be made if access must be restricted to clients with different IP addresses. The parameters of the configuration are detailed in table 33.
Page 72 of 89
Field Name
Value
Comments
TAG
40 Characters
This is a unique identifier for the point. This TAG may be mapped as a digital input point, which is ON when a TCP/IP or XCell View client is connected to the serial port. This is a brief description of the serial port. It is displayed within XCell View. Whether the serial port is available for pass through operation after restart. If disabled, the port must be enabled by protocol command. Determines which methods may be used to connect to the serial device. XCell View means only an XCell View login may connect to the device. TCP/IP allows a connection to the configured TCP/IP port to communicate with the serial device. Any allows either a TCP/IP or XCell View connection, but not both simultaneously The TCP/IP network port address on the XCell for the client to connect to. If Yes, the IP address of the connecting client is checked. If Client Address Check is Yes, the IP address of the connecting client is checked. Only the configured IP address may communicate with the serial port. The XCell serial port to be used.
Description Start Up
40 Characters Enabled, Disabled
Connection
TCP/IP, XCell View, Any
XCell TCP/IP Port Client Address Check Client Address IP
1050 to 65000 Yes, No IP Address of 4 values, 0 to 255 XCell Com 1, XCell Com 2, XCell Com 3, XCell Com 4
Com Port
Baud
9600, 19200, 38400, 57600, 115200 7, 8 Odd, Even, None

Table 33
The serial port baud rate to be used.
Data Bits Parity
The serial port data bits format to be used. The serial port parity format to be used.
Serial Port Pass-Thru Table
Page 73 of 89
12.12.4
Serial Port Pass Through Control
To restrict access, a serial port pass through function may be configured as normally disabled. Pass Through Operation is then enabled when needed by a master station command. To configure access by master station command, select the Disabled setting under Start Up in the Serial Port Pass Through table. The master station enable and disable commands are available in the Serial Port Pass Through Control table. There are two entries in Serial Port Pass Through Control for each Serial Port Pass Through table entry. The first of the two consecutive entries is used to disable the port after it has been used. The second entry enables the port for use. Feedback for the controls is provided by the Serial Port Pass Through Enable Status table, with an entry for each Serial Port Pass Through configuration. Each of these entries may be used as a digital input. The digital input point is ON when the port is enabled for pass through operation.
Figure 35
Serial Port Pass Through Control
Figure 36
Serial Port Pass Through Enable Status
Page 74 of 89
12.13 12.13.1
SNMP Client SNMP Client Configuration
The simple network management protocol is used to administer remote IP network devices. The SNMP client table can configure SNMP-enabled base firmware to report system operation status information to a management application. An SNMP Base can only be identified by the ram file name containing SNMP. Once downloaded the SNMP is stripped from the name, only showing the Base version.
Figure 37
SNMP Client Table
The parameters for the SNMP client table are user entered strings.
Parameter
Comments
Location Contact System Name Description Community Name Trap 1 IP Trap 2 IP Inform 1 IP Inform 2 IP Read Only Community Read Write Community
These parameters are supplied to the management application for identification purposes. The user may supply strings as appropriate for their SNMP system.
The trap community name. Used to authenticate SNMP traps or informs from the server. A destination IP for XCell traps (only SNMP Version 2). A destination IP for XCell traps (only SNMP Version 2). A destination IP for XCell informs (SNMP Version 2). A destination IP for XCell informs (SNMP Version 2). The read only community name used to request parameters from the SNMP agent. The read-write community name used to request or change parameters from the SNMP agent.
Table 34 SNMP Client Table Parameters
Page 75 of 89
12.13.2
XCell SNMP Notes
The following is a capture from a SNMP MIB Browser for the Private MIBs only: Enterprise Number is: 25041. Enterprise specific parameters: SNMPv2-SMI::enterprises.25041.1.1.0 = STRING: "00:12:76:00:00:01" SNMPv2-SMI::enterprises.25041.1.2.0.1.2.0 = STRING: "BASE" SNMPv2-SMI::enterprises.25041.1.2.0.1.2.1 = STRING: "EXPRESS " SNMPv2-SMI::enterprises.25041.1.2.0.1.3.0 = STRING: "V05.Test" SNMPv2-SMI::enterprises.25041.1.2.0.1.3.1 = STRING: "V08.01" SNMPv2-SMI::enterprises.25041.1.2.0.1.4.0 = STRING: "0x0801008C" SNMPv2-SMI::enterprises.25041.1.2.0.1.4.1 = STRING: "0x0820008C" SNMPv2-SMI::enterprises.25041.1.3.0 = INTEGER: 1 SNMPv2-SMI::enterprises.25041.1.4.0 = INTEGER: 1 SNMPv2-SMI::enterprises.25041.1.5.0 = INTEGER: 1 SNMPv2-SMI::enterprises.25041.1.6.0 = INTEGER: 885 SNMPv2-SMI::enterprises.25041.1.7.0 = INTEGER: 52 SNMPv2-SMI::enterprises.25041.1.8.0 = STRING: "10000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000" SNMPv2-SMI::enterprises.25041.1.9.0 = STRING: "NO CONFIG BACKUP" SNMPv2-SMI::enterprises.25041.1.10.0 = INTEGER: 1 SNMPv2-SMI::enterprises.25041.1.11.0 = INTEGER: 0 SNMPv2-SMI::enterprises.25041.1.12.0 = INTEGER: 0 SNMPv2-SMI::enterprises.25041.1.13.0 = INTEGER: 1 The following defines the information which was returned above: 1.3.6.1.4.1.25041.1.1.0 = MAC Address (OCTET_STRING) 1.3.6.1.4.1.25041.1.2.0 = Firmware Information 1.3.6.1.4.1.25041.1.1.2 = Firmware Name 1.3.6.1.4.1.25041.1.1.3 = Version Number 1.3.6.1.4.1.25041.1.1.4 = Code Start Address 1.3.6.1.4.1.25041.1.3.0 =* XCell View Login Active Count (INT) 1.3.6.1.4.1.25041.1.4.0 =* Workbench Login Active Count (INT) 1.3.6.1.4.1.25041.1.5.0 =* XCell View Failed Login Count (INT) - only counts up 1.3.6.1.4.1.25041.1.6.0 = CPU Idle Percentage (INT) - 0 to 1000(100%) idle time 1.3.6.1.4.1.25041.1.7.0 = SDRAM Heap Usage in percentage (INT) 1.3.6.1.4.1.25041.1.8.0 = Online Unit list (OCTET_STRING) - 1 for online, 0 for offline for each unit
Page 76 of 89

1.3.6.1.4.1.25041.1.9.0 = Workbench Configuration Backup Filename 1.3.6.1.4.1.25041.1.10.0 =* State of XCell View & Workbench Access Enable (1 for enabled, 0 for disabled) 1.3.6.1.4.1.25041.1.11.0 = Workbench Configuration Download count since last reboot 1.3.6.1.4.1.25041.1.12.0 = Express Program Download count since last reboot 1.3.6.1.4.1.25041.1.13.0 =* RTU Live Failed Login Count (INT) - only counts up * Indicates that this parameter has an associated Trap/Inform that goes with it when the value changes. Cold Start Trap: 2006-01-27 18:56:06 192.168.2.97 [UDP: [192.168.2.97]:1024]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (63) 0:00:00.63 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.15 Cold Start Inform: 2006-01-27 18:56:06 192.168.2.97 [UDP: [192.168.2.97]:1025]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (63) 0:00:00.63 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.15 XCell View Login Trap and Inform: 2006-01-27 18:57:18 192.168.2.97 [UDP: [192.168.2.97]:1024]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (7263) 0:01:12.63 SNMPv2-M IB::snmpTrapOID.0 = OID: SNMPv2-SMI::zeroDotZero.0 SNMPv2-SMI::enterprises. 25041.1.3.0 = INTEGER: 1 2006-01-27 18:57:18 192.168.2.97 [UDP: [192.168.2.97]:1025]: DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (7263) 0:01:12.63 IB::snmpTrapOID.0 = OID: SNMPv2-SMI::zeroDotZero.0 25041.1.3.0 = INTEGER: 1 SNMPv2-M SNMPv2-SMI::enterprises. SNMPv2-M IB::snmpTrapOID.0 = OID: SNMPv2-MIB::coldStart SNMPv2-MIB::snmpTrapEnterprise.0
SNMPv2-M
IB::snmpTrapOID.0 = OID: SNMPv2-MIB::coldStart SNMPv2-MIB::snmpTrapEnterprise.0
Page 77 of 89
12.13.3
XCell SNMP Standard MIBs
The following is a partial capture from a SNMP MIB Browser for the standard MIBs. There are a total of 242 standard MIBs. Notice the user entries for Location, Contact, System Name and Description will appear back to the polling browser in a standard MIB poll:
RFC1213-MIB RFC1213-MIB RFC1213-MIB RFC1213-MIB RFC1213-MIB RFC1213-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB 1.3.6.1.2.1.1.1.0 1.3.6.1.2.1.1.2.0 1.3.6.1.2.1.1.3.0 1.3.6.1.2.1.1.4.0 1.3.6.1.2.1.1.5.0 1.3.6.1.2.1.1.6.0 1.3.6.1.2.1.1.8.0 1.3.6.1.2.1.1.9.1.2.1 1.3.6.1.2.1.1.9.1.2.2 1.3.6.1.2.1.1.9.1.2.3 1.3.6.1.2.1.1.9.1.2.4 1.3.6.1.2.1.1.9.1.2.5 1.3.6.1.2.1.1.9.1.2.6 sysDescr.0 sysObjectID.0 sysUpTime.0 sysContact.0 sysName.0 sysLocation.0 sysORID.1 sysORID.2 sysORID.3 sysORID.4 sysORID.5 sysORID.6 sysORDescr.1 sysORDescr.2 sysORDescr.3 sysORDescr.4 sysORDescr.5 sysORDescr.6 TABLE RACK 1 DEMO U2 1.3.6.1.4.1.8072.3.2.15 8355289 ADMIN ENGR EX333 DISTRIBUTECH 09 CG AUTOMATION IRELAND LIMITED BOOTH 24 1.3.6.1.2.1.31 1.3.6.1.6.3.1 1.3.6.1.2.1.49 1.3.6.1.2.1.4 1.3.6.1.2.1.50 1.3.6.1.6.3.16.2.2.1 The MIB module to describe generic objects for The MIB module for SNMPv2 entities The MIB module for managing TCP implementations The MIB module for managing IP and ICMP The MIB module for managing UDP implementations View-based Access Control Model for SNMP.
sysORLastChange.0
SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.1 network interface sub-layers SNMPv2-MIB SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.2 1.3.6.1.2.1.1.9.1.3.3
SNMPv2-MIB 1.3.6.1.2.1.1.9.1.3.4 implementations SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB SNMPv2-MIB IF-MIB IF-MIB IF-MIB IF-MIB IF-MIB IF-MIB IF-MIB IF-MIB IF-MIB IF-MIB 1.3.6.1.2.1.1.9.1.3.5 1.3.6.1.2.1.1.9.1.3.6 1.3.6.1.2.1.1.9.1.4.1 1.3.6.1.2.1.1.9.1.4.2 1.3.6.1.2.1.1.9.1.4.3 1.3.6.1.2.1.1.9.1.4.4 1.3.6.1.2.1.1.9.1.4.5 1.3.6.1.2.1.1.9.1.4.6 1.3.6.1.2.1.2.1.0 ifNumber.0 1.3.6.1.2.1.2.2.1.1.1 1.3.6.1.2.1.2.2.1.1.2 1.3.6.1.2.1.2.2.1.2.1 1.3.6.1.2.1.2.2.1.2.2 1.3.6.1.2.1.2.2.1.3.1 1.3.6.1.2.1.2.2.1.3.2 1.3.6.1.2.1.2.2.1.4.1 1.3.6.1.2.1.2.2.1.4.2 1.3.6.1.2.1.2.2.1.5.1
sysORUpTime.1 5 sysORUpTime.2 9 sysORUpTime.3 11 sysORUpTime.4 20 sysORUpTime.5 21 sysORUpTime.6 24 2 ifIndex.1 ifIndex.2 ifDescr.1 ifDescr.2 ifType.1 ifType.2 ifMtu.1 ifMtu.2 ifSpeed.1 1 2 smc1 lo0 6 24 1500 16384 100000000
Page 78 of 89
12.14
NetBridge Client
The NetBridge allows limited fieldnet-over-ethernet TCP/IP. The application does not require a separate firmware SREC file to be loaded into the CPR-041 processor. This feature is already built into the Base versions 500 and higher. Based on a hierarchal organization, this feature allows the user to bring events up from remote XCell systems to a master XCell system which has no Fieldnet connection to allow the processors in each system to share tag data. We will refer to the top hierarchal master XCell as the client and the lower XCell systems as the servers. Only the servers require a configuration table to identify the Client. We refer to the lower XCells as servers because they serve up the event data to the single client. Events do not pass down from the client to the server. The main benefit in using Netbridge is there's no protocol configuration to transfer events up from remote XCell systems. There's just a single config table at the server end, which contains two server IPs. The server will connect to one or the other of these IPs, using the first available IP. It does allow multiple connections so as to provide for redundancy at the server RTU level. This will allow two servers units to run on separate Ethernet switches. The workbench project for such a system would include all of the Units connected via a physical FieldNet LAN and the Ethernet TCP/IP LAN. The user can use the Project ICONs to separate the various XCell systems for easy identification. In the figure below Unit 1 is configured as the server, serving its events up to the Gateway Rack 2 XCell system over an Ethernet TCP/IP connection. Unit 1 will first try to connect to Unit 3 then Unit 4. All of the tags in Unit 1 are available to both Units 3 & 4s applications. Control commands generated in an application in the Gateway Rack 2 XCell system to a Unit 1DO tag will be sent to Unit 1 for execution.
Figure 38
NetBridge System Configuration Overview
Page 79 of 89

There are currently two caveats. There can only be one client unit. This means that there isnt a redundant connection to the server. Also, this isnt a full duplex communication path, the status changes are forwarded to the server XCell, but the server XCell status changes arent returned to the client XCell. However, directed messages (ie controls) will work in either direction, from anywhere in the system. 12.14.1 Netbridge Client Configuration
The Netbridge Client is located in the Elements, CPR-041 Firmware, I/O server, Optional Tables. This table needs to be in the server XCell configuration in order for Netbridge to work correctly. This table identifies the IP address for the Client. There is no setup on the server Xcell CPR-041.
Figure 39
NetBridge Client Table
12.14.2
Netbridge Table Parameters
Once the table is in the client configuration, you need to specify the Tag. This tag is an internal tag and does not change state or indicate any communication status. Specify the description. Input the respective IP addresses of one or two CPR041s that are connected to the server XCell systems physical Fieldnet LAN. The connection will be established by the IP that is first polled when the configuration is downloaded to the client RTU.
Figure 40
NetBridge Client Table Fields
The parameters for the Netbridge client table are user entered strings.
Page 80 of 89
Parameter
Comments
Tag Description Server IP 1 Server IP 2
Unique Identifier for Netbridge Status Tag Description Server IP Number 1 Server IP Number 2
Table 35
NetBridge Table Parameters
Page 81 of 89
13 Secure Tunnel Interface

This interface is only available in Base ver. 6.11 and higher. With the user running the Microsol Secure Encryption Service (MSES) on their PC, they can connect both RTU Live and Telnet to the XCell processor through an AES encrypted tunnel. This Tunnel involves the transparent mapping in the computer of unencrypted network data into an encrypted link using the MSES service and the corresponding un-mapping of that encrypted data on the RTU side using a similar service and vice versa.
Page 82 of 89
13.1 AES The AES encryption algorithm has been chosen because it is widely used in SSHv2 and has its origins in a competitive selection process sponsored by DARPA in the United States to select a replacement for DES and 3DES. AES is a symmetric key algorithm meaning that the same basic encryption key is used to generate an encrypt and decrypt key schedule as opposed to an asymmetric encryption algorithm such as a public key encryption system which uses both a public and a private key for the same encrypt/decrypt key scheduling respectively. CG Automation Ireland Limited has chosen 256-bit encryption thus providing the highest level of cryptographic delivery available to an AES encrypted stream. AES is also an extremely fast encryption algorithm since it does a series of bit-shifting and logical XOR operations based on key schedules known as S-boxes.
Page 83 of 89
13.2 MSES The Microsol Simple Encryption Service needs to run on the users PC (linux or windows) in order to redirect TCP traffic from the normal Workbench RTU Live and Telnet sessions through the encrypted session with the XCell. The MSES (Microsol Simple Encryption Service) tunnelling server is a service residing in the host computer or a laptop, which can be configured to map multiple unencrypted regular TCP services (TELNET, Workbench etc.) through an encrypted tunnel to any given TCP port at a given IP address (the RTU in this case). The user simply copies the MSEC.exe to a folder, configures the srv.cfg file to match the XCell MSES configuration table and starts the service using the following command line msec I. The service can be stopped by the following command line msec u. Once started, it will be automatically restarted after a reboot.
Page 84 of 89
13.3 PC MSES srv.cfg file The srv.cfg must be configured to match the MSES Workbench configuration table for the connecting XCell. The user will always address the localhost or IP address 127.0.0.1 to access the ports configured for the AES connection. The SRCPORT=XXXX setting is the local port number that the user will enter when starting ether the Workbench RTU Live connection or the telnet connection. The DSTPORT=XXXX setting is the Port number set in the MSES XCell table Source Port setting in Workbench. This is the port that will be opened on the XCell to connect the AES. Both the AES= and TXKEY= in the srv.cfg and MSES XCell table must match. The AES= is the number of bits the AES will use for encryption, with 256 bits representing the highest level of security. The TXKEY= is the fixed key, for each service mapped, the MSES server and client (RTU) share an encryption key. The key length is 256 bits to provide maximum security. A given 256 bit key is read by both server and RTU. This key is used to generate an encrypt-key schedule on the server (PC) side and a decrypt-key schedule on the RTU side. This encrypt/decrypt pair represents the encryption used to send data from server to client (RTU). Similarly the server and client take the original source key reverse all of the bytes and then generate another encrypt/decrypt key schedule which allows for sending encrypted data from the RTU to the server. For 128 bit AES encryption, the key must have 32 HEX characters (0-F), 192 bit has 48 HEX characters and 256 bit must have 64 HEX characters. The CONNECTTIMEOUT= parameters is in seconds and will automatically close the connection if there is no traffic during this time period. The IPADDR= is the IP address of the XCell Unit that you want to connection to. Example of a srv.cfg file configuration: //Workbench connection to unit IP192.168.0.1 via IP 127.0.0.1 port 3001 SRCPORT=3001 DSTPORT=4001 AES=256 TXKEY=0102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F11 CONNECTTIMEOUT=15 IPADDR=192.168.0.1 //XCell View Telnet connection to unit IP192.168.0.1 via IP 127.0.0.1 port 3002 SRCPORT=3002 DSTPORT=4002 AES=256 TXKEY=0102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F12 CONNECTTIMEOUT=15 IPADDR=192.168.0.1 //Pass Through connection to unit IP192.168.0.1 Port4 via IP 127.0.0.1 port 3003 SRCPORT=3003 DSTPORT=4003 AES=256 TXKEY=0102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F13 CONNECTTIMEOUT=15 IPADDR=192.168.0.1
Page 85 of 89
13.4 Workbench MSES configuration table The Workbench MSES configuration table has most of the same configuration parameters as the MSES srv.cfg file. The Source Port must match the DSTPORT in the srv.cfg file. The Destination Port is always 2011 for Workbench and 23 for Telnet. Similarly the AES keysize, Transmit Key and Connect Timeout must match the srv.cfg file. The IP ADDR at Dst Port will always be 127.0.0.1 for the XCell to connect to the MSES service running on the PC.
Figure 41
Workbench MSES Table
Page 86 of 89
13.5 Connection Examples In the figure below, RTU #1 and Client #1 are conducting two simultaneous telnet sessions.
Using both the srv.cfg and Workbench configuration table shown in the previous sections we will run through some examples on how to connect to the XCell. In all examples the user would have the PC MSES program in a folder on their PC with the srv.cfg file configured for a select XCell IP address. The user would start the service by typing the following command line, msec i. The user can stop the service by typing, msec u. In order to connect to the XCell using the AES server the MSES must be started and running.
13.5.1 Workbench RTU Live TCP/IP Launch Workbench, go to the RTU Live Window, and select the Connect to the RTU using TCP icon. The pop up window is displayed that allows the user to enter the IP address. The localhost IP of 127.0.0.1 should be entered. When this is done the port field will now allow the user to change the value which in this example should be 3001. Now connect and the user should see no difference in operation from a normal connection. The RTU Live TCP/IP traffic is now encrypted using 256 bit AES.
Page 87 of 89

13.5.2 Telnet to XCell View Open a telnet terminal program. The localhost IP of 127.0.0.1 and port 3002 should be entered. Now connect and the user should see no difference in operation from a normal connection. The Telnet TCP/IP traffic is now encrypted using 256 bit AES.
13.5.3 Secure Pass Through Using the XCell serial port pass through option the user can connect to this IP port using the AES encryption. In the XCell pass through configuration table serial port 4 is connection to the XCells IP port number 3000. Open a telnet terminal program. The localhost IP of 127.0.0.1 and port 3003 should be entered. Now connect and the user should see no difference in operation from a normal connection. The Telnet terminal TCP/IP traffic is now encrypted using 256 bit AES and is passed through to the configured XCell port 4.
Page 88 of 89
Workbench IO Configuration Manual
Contact Information
CG Automation Systems Ireland Herbert House, Harmony Row, Dublin 2 Ireland T: +353 1 415 3700 F: +353 1 6787913
W: www.cgglobal.com
CG Automation Systems UK Limited Unit F Network Centre, Jarrow, Tyne & Wear, NE31 1SF United Kingdom T: +44 (0) 191 425 5200 F: +44 (0) 191 425 5202
W: www.cgglobal.com E: sales.as.uk@cgglobal.com
CG Automation Systems USA Inc 92 Cogwheel Lane Seymour, CT 06483 USA T: +1 203 888 3002 F: +1 203 888 7640 W: www.cgglobal.com
E: sales.as.us@cgglobal.com
Page 89 of 89

Workbench IO Configuration Manual - Rev - 3.13

Încărcat de

Informații document

Descriere originală:

Titlu original

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

Workbench IO Configuration Manual - Rev - 3.13

Încărcat de

Drepturi de autor:

Formate disponibile

CGAS Workbench

Base Apps and I/O Configuration Guide

BASE Apps and I/O Configuration Manual

BASE Apps and I/O Configuration Manual

TCP/IP Configuration ................................................................................... 15

Channel Numbers ......................................................................................... 17

Single Digital Inputs (SDI)............................................................................ 20

Automatic Suppression ............................................................................... 27 Digital Outputs (DOT) ................................................................................... 29

Analog Inputs Table (AIN)......................................................................... 35

10.1 10.2 10.3 10.4 10.5

Analog Outputs ......................................................................................... 40 Optional Tables ......................................................................................... 41

12.1 12.2 12.3 12.4 12.5

BASE Apps and I/O Configuration Manual

Secure Tunnel Interface ............................................................................ 82

13.1 13.2 13.3 13.4

BASE Apps and I/O Configuration Manual

Specify the number of records to create

BASE Apps and I/O Configuration Manual

Firmware (Application) Organizing Icon

Project Organizing Icon

BASE Apps and I/O Configuration Manual

BASE Apps and I/O Configuration Manual

The Unit node has three configuration parameters.

Description Unit Number

Unit Parameter Definitions

BASE Apps and I/O Configuration Manual

BASE Apps and I/O Configuration Manual

BASE Apps and I/O Configuration Manual

Module Connector Termination Block Type

This field purposes. This field purposes.

Termination Block Name

This field purposes.

Module Parameter Definitions

BASE Apps and I/O Configuration Manual

3.12 Dual Network Status

Dual Network Status Table

BASE Apps and I/O Configuration Manual

3.13 Remote Reboot and Reset

Remote Reboot Table

BASE Apps and I/O Configuration Manual

BASE Apps and I/O Configuration Manual

Static Address, BOOTP Address, Redundant IP Address, DHCP Address

TCPIP Parameter Definitions

BASE Apps and I/O Configuration Manual

Channel Number Assignment

BASE Apps and I/O Configuration Manual

Points Grouped By Type Only

Unit Channel Assignment

BASE Apps and I/O Configuration Manual

Points Grouped By Module

Module Channel Assignment

BASE Apps and I/O Configuration Manual

Single Digital Inputs (SDI)

SDI Record creation

BASE Apps and I/O Configuration Manual

TAG Description Channel

40 Characters 40 Characters 0 to 255

Off Time (ms)

Yes/No Auto Suppression, Manual Suppression, No Suppression

Debounce Time (ms)

BASE Apps and I/O Configuration Manual

Debounce Filter Operation