Systems Tools Suite

Third Party Protocols Support
ACE3600 System Tools

Suite (STS)
Version
0 19.50
AB
6802979C25-P
MOTOROLA, MOTO, MOTOROLA SOLUTIONS and the Stylized

M Logo are trademarks or registered trademarks of Motorola
Trademark Holdings, LLC and are used under license. All other
product or service names are the property of their respective
owners.
Copyright © 2015 All rights reserved

COMPUTER SOFTWARE COPYRIGHTS
The Motorola products described in this instruction manual may include copyrighted Motorola computer programs stored in
semiconductor memories or other media. Laws in the United States and other countries preserve for Motorola certain
exclusive rights for copyrighted computer programs including the exclusive right to copy or reproduce in any form the
copyrighted computer program. Accordingly, any copyrighted Motorola computer programs contained in the Motorola
products described in this manual may not be copied or reproduced in any manner without the express written permission of
Motorola. Furthermore, the purchase of Motorola products shall not be deemed to grant either directly or by implication,
estoppel, or otherwise, any license under the copyrights, patents or patent applications of Motorola, except for the normal
non-exclusive, royalty free license to use that arises by operation of law in the sale of a product.
This media, software or hardware ("Product") obtained from Motorola Solutions, Inc. ("Motorola Solutions") may include
Motorola Solutions’ Software, Third Party Software (defined below), and/or Open Source Software (defined below).
The object code or source code (collectively, the "Software") included with the Product is the exclusive property of Motorola
Solutions or its licensors, and any use is subject to the terms and conditions of one or more agreements in force between the
purchaser of the Motorola Solutions Product or licensee of the Motorola Solutions Software and Motorola Solutions.
SOFTWARE IS PROTECTED BY U.S. COPYRIGHT LAWS AND INTERNATIONAL LAWS AND TREATIES.
UNAUTHORIZED COPYING, DISTRIBUTION OR OTHER USE OF THIS PRODUCT IS STRICTLY PROHIBITED. ANY
DISTRIBUTION OR USE NOT SPECIFICALLY APPROVED BY MOTOROLA SOLUTIONS IS STRICTLY PROHIBITED.
Motorola Solutions’ Software is subject to the commercial terms and conditions entered into with Motorola Solutions, any
other use is strictly prohibited. Commercial Software licensed for redistribution by Motorola Solutions ("Third Party
Software") is subject to the terms and conditions in force between Motorola Solutions and the licensor of the Third party
Software. The terms and conditions governing the usage of Third Party Software may be part of the agreement entered into
by the purchaser of the Product with Motorola Solutions or separate Third Party Software license agreement(s) included with
the Product.
Software provided by Motorola Solutions which is covered by a publicly available license governed solely under Copyright
law, whereas the complete terms and obligations of such license attach to a licensee solely through the act of copying, using
and/or distribution of the licensed Software, such obligations often include one or more of attribution obligations, distribution
obligations, copyleft obligations, and intellectual property encumbrances is referred to herein as "Open Source Software".
The use of any Open Source Software is subject to the licenses, terms and conditions of the commercial agreement in force
between the purchaser of the Product and Motorola Solutions as well as the terms and conditions of the corresponding
license of each Open Source Software package. If there is a conflict between the terms and conditions of any commercial
agreement and the terms and conditions of the Open Source Software license, the applicable Open Source Software license
will take precedence. Copies of the licenses for the included Open Source Software as well as their attributions,
acknowledgements, and software information details, are listed below. Motorola Solutions is required to reproduce the
software licenses, acknowledgments and copyright notices as provided by the authors and owners, thus, all such information
is provided in its native language form, without modification or translation.
For instructions on how to obtain a copy of any source code made publicly available by Motorola Solutions related to Open
Source Software distributed by Motorola Solutions, you may send your request in writing to:
Motorola Solutions, Inc.

Open Source Software Management
1301 E. Algonquin Road
Schaumburg, IL 60196
USA.
In your request, please include the Motorola Solutions Product name and version, along with the Open Source Software
specifics, such as the Open Source Software name and version.
Note: the source code for the Open Source Software included by Motorola Solutions may be resident on the Product’s
installation media provided with the Product or on supplemental Product media. Please reference and review the entire
Motorola Solutions Open Source Software “Legal Notices” and any corresponding “End User License Agreement” provided
with the Product or the commercial agreement under which the Product was purchased for details on the availability, location
and method for obtaining source code. Further, depending on the license terms of the specific Open Source Software,
source code may not be provided. Please reference and review the entire Motorola Solutions Open Source Software “Legal
Notices” and “End User License Agreement” to identify which Open Source Software packages have source code provided
or available.
To view information regarding licenses, acknowledgments and required copyright notices for Open Source Software used in
this Product, please select “Legal Notices” from the graphical user interface of the Software (if applicable) or as specified in
the “Legal Notices” or End User License Agreement File/README associated with the Product. Use of any Software is
subject to acceptance of the corresponding terms associated with the Software and by using the Software you agree you
have reviewed the terms and agreed to be bound by said terms.
MOTOROLA, MOTOROLA SOLUTIONS and the Stylized M Logo are trademarks or registered trademarks of Motorola
Trademark Holdings, LLC and are used under license. All other trademarks are the property of Motorola Solutions, Inc. or
their respective owners. All rights reserved.
Motorola Solutions, Inc.

1301 E. Algonquin Road,
Schaumburg, IL 60196 U.S.A.
Table of Contents
TABLE OF CONTENTS ........................................................................................................................................... I
MODBUS .......................................................................................................................................................... 1
RTU as PLC ................................................................................................................................................... 1
Local RTU as PLC Master............................................................................................................................. 2
General System .............................................................................................................................................. 3
MODBUS Drivers.......................................................................................................................................... 4
MODBUS Data Types.................................................................................................................................... 4
Floating Point Numbers ................................................................................................................................ 7
RTU Definitions for MODBUS Support ........................................................................................................ 9
Step-by-Step Definitions .............................................................................................................................. 17
RTU as Master – Ladder Diagram Consideration ....................................................................................... 20
RTU as PLC (Slave) – Mapping of SCADA Element to ACE3600 Database .............................................. 25
RTU Supported MODBUS Protocol Exceptions (Negative Acknowledges) ................................................ 31
MODBUS over RS485 Troubleshooting ...................................................................................................... 32
ALLEN BRADLEY PLC-5 PROTOCOL ................................................................................................................. 33
Local RTU as PLC Master........................................................................................................................... 34
Allen Bradley PLC–5 Settings ..................................................................................................................... 34
ALLEN BRADLEY SLC 500 PROTOCOL ............................................................................................................. 48
SLC 500 Drivers .......................................................................................................................................... 48
Static I/O Link for PLC Data Type Columns ............................................................................................... 48
Dynamic I/O Link for PLC Data Type Columns .......................................................................................... 49
Accessing SLC 500 Controllers ................................................................................................................... 49
DISTRIBUTED NETWORK PROTOCOL (DNP) V3.00 ........................................................................................... 50
DNP3 MASTER DRIVER FOR ACE1000 ............................................................................................................ 52
Setting the ACE1000 DNP3 Master............................................................................................................. 53
The User Interface ....................................................................................................................................... 53
Site Configuration Definitions ..................................................................................................................... 53
Assumptions and Restrictions ...................................................................................................................... 54
Defining Port Connection ............................................................................................................................ 54
Setting Time Zone ........................................................................................................................................ 56
Advanced IP Connection Configuration ...................................................................................................... 57
Advanced DNP Master Configuration ......................................................................................................... 57
Advanced Serial Connection Configuration ................................................................................................ 58
Advanced DNP Master Configuration ......................................................................................................... 58
DNP Master Configuration Editor .............................................................................................................. 60
Configuring General Interface .................................................................................................................... 60
Configuring Analog Inputs .......................................................................................................................... 63
Configuring Analog Outputs ........................................................................................................................ 64
Configuring Counters .................................................................................................................................. 65
Downloading DNP Master Configuration to Site ....................................................................................... 66
Getting the DNP3 Master Map .................................................................................................................... 67
DNP3 SLAVE DRIVER FOR ACE1000 ............................................................................................................... 69
Setting the ACE1000 DNP3 Slave ............................................................................................................... 70
The User Interface ....................................................................................................................................... 70
Site Configuration Definitions ..................................................................................................................... 70
Assumptions and Restrictions ...................................................................................................................... 71
i
Defining Port Connection ............................................................................................................................ 73
Setting Time Zone ........................................................................................................................................ 75
Advanced IP Connection Configuration ...................................................................................................... 76
Advanced DNP Slave Configuration ........................................................................................................... 76
Advanced Serial Connection Configuration ................................................................................................ 83
Advanced DNP Slave Configuration ........................................................................................................... 83
Downloading DNP Slave Configuration to Site ......................................................................................... 85
Uploading the DNP3 Slave Map ................................................................................................................. 85
APPENDIX A: CONNECTION TO SCADA / ACE1000 DNP MASTER MAP ......................................................... 87
APPENDIX B: HOW TO OPERATE PULSE BINARY OUTPUT ............................................................................. 99
APPENDIX C: RESTRICTIONS WHEN USING INTOUCH .................................................................................. 100
ii
MODBUS
The MODBUS protocol support is applicable to the following situations:
a) Master Configuration: Polling/modifying the database of existing PLC(s). The RTU is

defined as a master and the PLC – as a slave. The RTU provides the ability to access the
database of a PLC from the application ladder.
b) Slave Configuration: Connecting an RTU as a slave to any SCADA master using the
MODBUS protocol. The SCADA central can control all RTUs, as well as all PLCs.
In addition, the RTU communication may be used as a wide area communication network
between a MODBUS-based central and its PLCs.
The RTU-to-MODBUS connection is described in this chapter according to the following

configurations:
1) RTU as PLC
2) Local RTU as PLC Master
3) General System Configuration
IMPORTANT: The information in this manual is relevant to the ACE3600 RTU. When
configuring an ACE1000 unit (ACE1100 FEP or ACE1000 RTU), use this manual for
background information on the MODBUS protocol only. For guidelines on MODBUS
configuration for ACE1000 units, see the ACE1000 MODBUS Configuration appendix of the
ACE3600 STS User Guide. ACE1000 units do not support Allen Bradley protocol.
RTU as PLC
The RTU as PLC configuration allows the connection of a MODBUS-based central computer
to an MDLC Network, via serial line or TCP/IP media.
The port of this RTU is defined as (Connected to) Master Computer. The central computer can
access the database of this RTU that reflects the databases of all RTUs in the field.
In the RTU as PLC, definition of the PLC Table is required.
1
MODBUS
PLC Table
Ind PLC Connected to via Port (Name)

Address RTU (Name)
0 1 LOCAL RTU AS PLC
RTU
PLC#=1
Serial or
TCP/IP
RTU
AS PLC MDLC NETWORK RTU
MODBUS PORT
TO MASTER
SCADA CENTRAL
(MASTER)
RTU
For a detailed description of the site configuration and application definitions, refer to RTU as
PLC (Connected to Master Computer).
Up to six ACE3600 RTU ports can be defined as third party protocol ports (including serial
and/or TCP/IP MODBUS ports.)
MODBUS over TCP supports the use of MODBUS messaging in an Intranet or Internet
environment using the TCP/IP protocol, where the RTU acts a MODBUS/TCP server (‘pure’
slave). Note that the MODBUS TCP/IP slave works in a ‘listening to master’ manner (i.e. it
opens a listening socket and waits for the MODBUS master incoming requests to connect to
the slave) and does not initiate communication with the master.
Local RTU as PLC Master

This configuration allows polling/modifying the database of the PLC from an MDLC-based
network. The RTU is connected to the PLC via a port defined as Connected to Slave. It
controls the Slave PLC by means of the Ladder Diagram.
The Local RTU as PLC Master configuration is for a serial MODBUS as well as TCP/IP
connection.
2
MODBUS
RTU
MODBUS
RTU Serial or TCP/IP
RTU AS PLC PLC1
MDLC NETWORK PLC
MASTER MODBUS PORT
TO SLAVE
PLC#=1
PLC Table
RTU
Address RTU (Name)
0 1 LOCAL PLC1
For a detailed description of the Site Configuration and Application definitions, refer to
Step-by-Step Definitions below.
General System
MODBUS
RTU 13
MODBUS PORT
TO SLAVE
RTU PLC1
FOX1
MODBUS PORT
TO MASTER RTU
LOCAL
MDLC NETWORK
SCADA CENTRAL RTU
(MASTER)
RTU
MODBUS PORT FOX5
TO SLAVE MODBUS PORT
PLC2 TO SLAVE
PLC1
MODBUS
MODBUS
RTU 15
RTU 14
3
MODBUS
MODBUS Drivers
Six drivers are supplied for MODBUS protocol support. They are:
Driver file name Description

MB.2M_PLC1 MODBUS to Master driver; Port in RTU slave defined as
PLC 1
PLC 2
PLC 3
MB.2S_PLC1 ACE3600 RTU Master; Port in RTU defined as PLC 1.
Note: If the appropriate driver (.fls file) is not downloaded to the RTU, MODBUS protocol
support will not be available.
MODBUS Data Types

The RTU defined as a Master can access the following MODBUS RTU data types/commands:
MODBUS Data Type Command MODBUS RTU Equivalent

Function
Code
Logic Coils Read 1 Discrete Output

Discrete Inputs Read 2 Discrete Input
Holding Registers Read 3 Calculated Internal
Value
Input Registers Read 4 Value Input
Logic Coils Write (single 5 Discrete Output
coil)
Holding Registers Write (single 6 Calculated Internal
register) Value
Logic Coils Write 15 Discrete Output
Holding Registers Write 16 Calculated Internal
Value
4
MODBUS
The RTU defined as a MODBUS slave supports the following data types/commands from the
MODBUS protocol:
Data Type Command MODBUS Function Code
Logic Coils Read 1

Discrete Inputs Read 2
Holding Registers Read 3
Input Registers Read 4
Logic Coil Write (single coil) 5
Holding Register Write (single 6
register)
None Loopback test 8
Logic Coils Write 15
Holding Registers Write 16
– Report Slave ID 17 dec.
By default, ACE3600 uses function code 15 (Multiple Logic Coil Write) and does not use
function code 5 (Single Coil Force command). This is true even when writing to a Single Coil.
By default, ACE3600 uses function code 16 (Write Multiple Registers) and does not use
function code 6 (Single Register Preset command). This is true even when writing to a Single
Register.
In order to enable the Single Coil Force or Single Register Preset command perform the
instruction below for each MODBUS port defined as a port connected to a “Slave”:
1. Run the ACE3600 STS.
2. In the site port configuration, click on Advanced Configuration.
3. Select Driver specific parameter #3. This parameter is actually a mask, or set of bits, each
of which can be set or unset, each with a different meaning. To enable the Single Coil
Force command (function code 5), set the mask to 0x0002 (or decimal value 2).
To enable the Single Register Preset command (function code 6), set the mask to 0x0004
(or decimal value 4).
If you want to enable BOTH commands, set the mask to 0x0006 (or decimal value 6).
Note: when trying to write to more than one Coil, function code 15 (Multiple Coils Write) is
always used, even if the mask 0x0002 is set on.
Note: when trying to write to more than one Register, function code 16 (Multiple register
Write) is always used, even if the mask 0x0004 is set on.
Function code 5 (Single Coil Force command) is used if writing exactly one bit and the
corresponding mask 0x0002 is set on in Driver specific parameter #3.
5
MODBUS
Function code 6 (Single Register Preset command) is used if writing exactly one register and
the corresponding mask 0x0004 is set on in Driver specific parameter #3.
A Report Slave ID command has been added to support the VXL SCADA central. This may be
useful if the SCADA Central has to identify a communication failure (cause and location).
For example, the two RTUs may be defined as MODBUS slaves in the PLC Table. If the
communication to the PLC fails, the SCADA Central may issue the Report Slave ID command
to each of the RTUs.
The RTU’s response to this command for the MODBUS RTU protocol is:
ADDR FUNC BYTE RESERVED FLAGS CRC

COUNT
XX 11 3 BYTE1 BYTE2 BYTE3 XX XX
where:
ADDR: PLC address

FUNC: 11 hexa
BYTE COUNT: 3 bytes of RTU status data follow this field
RESERVED FLAGS: 24 bits for the Reserved Flags Table (one of RTU system tables).
This field consists of the 3 bytes described in the following tables:
BYTE1
Bit Position in Index in Reserved Flag Name
Byte1 Flags Table
0 0 I/O_Fl
1 1 Init
2 2 PwrUp
3 3 AC_Fal
4 4 BatFal
5 5 PushB1
6 6 PushB2
7 7
6
MODBUS
BYTE2
Byte2 Flags Table
0 8 TskPrA
1 9 TskPrB
2 10 TskPrC
3 11 TskPrD
4 12
5 13
6 14
7 15
BYTE3
Byte3 Flags Table
0 16 ErrLog
1 17 TimTag
2 18 DefC_Y
3 19 CntCom
4 20
5 21 IsEvnt
6 22
7 23
Note: Position 7 of a byte is the most significant bit, and position 0 – the least significant bit.
CRC: 2 bytes of CRC.
Floating Point Numbers

To access floating MODBUS registers from ACE3600 ladder applications, columns of data
type PLC_RI and PLC_RO data types (see Data Types below) should be defined in the
application database. The I/O link is the same as for general MODBUS registers or coils,
except for the data type, which should be set to PLCRel.
SCADA Central (Master) can access any floating point data type element in ACE3600 (REAL,
RPRM, PLC_RI, PLC_RO).
The maximum number of floating point numbers per one transaction is limited by the
MODBUS protocol (255 bytes) and is approximately 60.
7
MODBUS
MODBUS protocol does not define floating point data type (4 bytes). To allow floating point
data type transfer, each floating point element is represented by 2 integers (2 bytes each).
To enable correct floating point number transfer between the ACE3600 master and the
MODBUS slave, or between the MODBUS master and the ACE3600 slave, one should define
the format of how the floating point number is transmitted (for each MODBUS port):
1. Run the ACE3600 STS.
2. In the site port configuration, click on Advanced Configuration.
3. Select Driver specific parameter #3. This parameter is actually a mask, or set of bits, each
of which can be set or unset, each with a different meaning.
4. To designate that the low order integer register is sent first, followed by the high order
register, set the mask to 0x0001 (or decimal value 1). To designate that the high order
integer register is sent first, followed by the low order register, unset the mask bit 0x0001
(or decimal value 0). In most cases, the mask 0x0001 should be set on, though the format
depends on the vendor.
Recall that other bits in the parameter #3 mask enable/disable other functions. Therefore,
care should be taken when changing the value of the bits.
8
MODBUS
RTU Definitions for MODBUS Support
Data Types
The following data types may be used when the RTU serves as a master:
• PLC_VI – PLC Value Input. This data type is used to read integer elements from a third
party RTU. Each element in a PLC_VI column is a 2-byte signed integer (value). The
column length must be defined as the number of the registers that are to be read.
• PLC_VO – PLC Value Output. This data type is used to write into the Holding Registers in
a third party RTU.
• PLC_DI – PLC Discrete Input. This data type is used to read 1-bit elements from a third
party RTU, such as discrete inputs.
• PLC_DO – PLC Discrete Output. This data type is used to write 1-bit elements into a third
party RTU, such as logic coils.
• PLC_RI –PLC Real Input. .This data type is used to read real (floating point) elements
from a third party RTU. Each element in PLC_RI is a 4-byte real (floating point) number.
• PLC_RO –PLC Real Output. This data type is used to write real (floating point) elements
to a third party RTU. Each element in PLC_RO is a 4-byte real (floating point) number.
PLC Table
The PLC Table, one of the System Tables, is used to define the connectivity to the third party
PLC units in the system. This table must be defined for:
• The RTU, which is connected to the Master Computer.
• Any RTU, which serves as a PLC master for a PLC connected to one of its ports or
connected to one of the other RTUs in the network.
9
MODBUS
This table has five columns as detailed below:
10
MODBUS
11
MODBUS
• PLC Address – the address of the PLC RTUs (1–255).
• Connected to RTU (name) – the name of the RTU to which the PLC is connected. Click the
arrow to open the list. If the RTU is locally connected to one of the ports of the unit where
the PLC Table is to be defined, choose LOCAL from the choice list.
• via Port (name) – the name of the port for connection. Click the arrow to open the list.
Choose the same name that was used when the port was defined.
• Slave Addr – The IP address of the TCP/IP slave/PLC (type IPAddrPrm). This column is
valid only when the 'Connected to RTU' field is set to ‘Local’ and the ‘via Port’ field is set
to PLC1/2/3 (not RTU as PLC.) Otherwise, N/A is displayed.
• Comm Status (Slave) – the status of the slave/PLC (0 = Inactive, 1 = Active) (type int)
Note: If Comm Status = 1 and the PLCStt variable returns an error, this indicates a problem
with the user application. The status is displayed during the table monitor. The status is
N/A when the communication is not MODBUS master over TCP/IP. For details on the
possible PLCStt returned errors, see the list from the PLC Status Defines table in Scan
from Rungs above.
If the PLC is connected directly via a UART port to the RTU master, then define the
Connected to RTU field as LOCAL and the via Port field as PLC 1, 2 or 3.
If the PLC is connected to a remote unit which acts as a router, then define the Connected to
RTU field as the RTU router Site Name. Assign the name that was used in the Site Table.
If the remote is an RTU which acts as PLC slave, then define the Connected to RTU field as the
RTU’s remote Site Name and the via Port field as RTU AS PLC.
12
MODBUS
PLC TCP/IP Access Control Table

The PLC TCP/IP Access Control Table, one of the System Tables, is used to define the IP
connections to authorized PLC Masters. This table may be defined for the RTU, which is
connected to the Master Computer. This is relevant for MODBUS over IP only.
Additional/existing connections can be added/modified dynamically when a PLC Master

Computer port is configured as a DHCP client and receives its IP address dynamically from the
DHCP server.
13
MODBUS
This table has five columns as detailed below. Only entries with both a valid IP address and a
valid PLC port name are considered valid. All others are ignored.
14
MODBUS
15
MODBUS
• AthrIPaddrs – the authorized IP addresses of up to 16 masters. If all addresses are 0.0.0.0,

the connection is open to all IP addresses.
• PLCportName – the name of the port (PLC1, PLC2, PLC3) on the master for connection to
the slave at the authorized IP address. Click the arrow to open the list. Choose the same
name that was used when the port was defined.
Note: If the PLCportName is undefined, the corresponding IP address is ignored.
• #TotalConnection – the total number of IP connections of the slave with the master,
including active, disconnected and unstable connections. (read-only during monitor)
• #ActiveConnection – the number of active IP connections of the slave with the master
which are connected to the master and have not timed out. (read-only during monitor)
• #UnstableConnection – the number of IP connections of the slave with the master which
are unstable (erratic). (read-only during monitor)
Duplicate IP addresses may appear in the PLC TCP/IP Access Control Table. If a duplicate
row is deleted, the other rows remain.
Note: If the master port is defined as Ethernet Dynamic LAN, the IP address which is returned
by the DHCP server may generate “unauthorized IP address” error messages. In this case, this
IP address can be added to the PLC TCP/IP Access Control table via the Application
Programmer table monitor, ladder rungs or ‘C’ application.
16
MODBUS
Port Configuration and Protocol Downloading

The configuration of an RTU port as a third party protocol port requires two levels of
configuration:
• Physical port configuration
• Third party protocol downloading
Port Configuration
The PI1, SI1, SI2, PI2 serial/plug-in CPU ports may be defined as a serial Third Party Protocol
PLC port. Ports SI1 and SI2 may also be defined as MODBUS ports over TCP/IP (PPP). Ports
PI1 and PI2 may also be defined as MODBUS ports over TCP/IP (Ethernet). Port ETH1 may
only be defined as an IP MODBUS port over TCP/IP (Ethernet).
Port Configuration - Serial MODBUS
• Connected– to Master or to Slave.
• Link Name – the name of the port: PLC 1, PLC 2, or PLC 3.
• Data Speed – This field defines the communication data speed of the selected Connection
Type. The default is 9600 bps.
• (Advanced Configuration->) Format – This field defines the UART's character format for
the communication port. The default is 8 bit, no parity, 1 stop bit. Click the arrow to open a
list that includes all combinations of 7/8 bits, even/odd/no parity, and 1/2 stop bits.
• (Advanced Configuration->) DTR/CTS Support – This field defines the DTR/CTS Support.
Set this option to Yes ONLY if DTR/CTS support is provided by the computer
connected to the ACE3600 RTU.
Port Configuration – for MODBUS over TCP/IP

For MODBUS over TCP/IP, configure the port as depicted in the figures below.
• Protocols – Select MODBUS Slave or MODBUS Master.
• Port Name – Set to PLC1-3. The Port Name must be set to PLC1-3 if Protocols is set to
MODBUS slave/master.
17
MODBUS
Port Configuration – RS232 over PPP
Port Configuration - Ethernet 10/100 Base-T - Static LAN
Port Configuration - Ethernet 10/100 Base-T - Dynamic LAN
• Host Full Name – (DHCP Client only) The full name of the port as provided by the DNS
Server. The DHCP Server will update the DNS Server when allocating or changing the IP
address of that host, keeping it up to date with the recent address of port. If a DHCP
Server/router does not support this option, a warning will be logged. For more information
on DHCP/DNS, see the ACE3600 STS Advanced Features manual.
Note: The MODBUS master should know in advance either the MODBUS slave IP address
or its Host Full Name, so that it can connect to a known IP address/Host Full Name of the
MODBUS slave. In the case of MODBUS over GPRS (PPP port), the GPRS modem
should have a fixed (predefined) IP address and the master should use this IP address to
connect to the slave.
• (Advanced Configuration->)Master communication interval – the maximum time in

seconds during which a request is expected to be received from the Master. If no
communication occurs, the connection is considered unstable. Range 0-86400. Default 0.
• (Advanced Configuration->)Check alive mode – the Check alive mode can be set to Active
or Passive:
Active – TCP is controlled by the TCP stack of the VxWorks operating system. The
MODBUS slave is polled by the master’s connection using the TCP socket’s ‘Check alive’
option. If the idle time on the connection exceeds 60 seconds, a ‘Check alive’ probe is
triggered. After the first Check alive probe, a probe is sent every 75 seconds (up to four
times), unless a probe response is received. If no probe response is received after sending
out four Check alive probes, the TCP connection is dropped.
Passive (Default) – TCP is controlled by the application. In this case, the Check alive
timeout parameter must be set. The application checks whether the server received any
18
MODBUS
communication until the Check alive timer expires. If the Check alive timeout parameter is
set to 0, the check alive mechanism will not be used.
• (Advanced Configuration->)Check alive timeout – the timeout in seconds from the last
communication received from a master. If this parameter is 0, a master will always be
considered as reachable, once a single reception has been received from it. Otherwise the
slave RTU disconnects from the master. Range 0-65535. Default 35. (Relevant only if
Check Alive mode is set to Passive.)
• (Advanced Configuration->)TCP listen port – The TCP port used by the Slave for
MODBUS communications. Default 502. This default value is standard in TCP.
Therefore, it is highly recommended to leave the default as is.
• (Advanced Configuration->Remote TCP port – The TCP port used by the Slave for
MODBUS communications. Default 502. This default value is standard in TCP.
Therefore, it is highly recommended to leave the default as is.
• (Advanced Configuration->)Connection create timeout – The number of milliseconds the

Master will wait after trying to create a connection with the slave. Range 0-65535. Default
500.
• (Advanced Configuration->)Maximum number of connections – The number of entries in

the internal connections table. If a new connection is requested when the table is full, the
oldest existing connection will be closed and the corresponding entry deleted from the
table to make room for the new connection. Range 0-65535. Default 500.
Third Party Protocol Downloading

After the configuration of the RTU physical port, according to the type of connection (to
Master Computer or PLC), STS provides you with the Downloader utility.
Note: The protocol should be loaded only to the RTUs whose ports have been defined as
Connected to Master or Connected to Slave (PLC).
Before downloading the Third Party Protocol file, verify that the required files have been
added to the STS site Add-Ons. To do so, click on the General tab in the site view and add the
required Third Party Protocol (MODBUS) files from the "config" directory under the STS
installation path (e.g. C:\STS1150\Config.)
The Downloader supports downloading to RTUs either locally or remotely via the network.
For instructions on how to operate Downloader, see the ACE3600 STS User Guide.
19
MODBUS
Step-by-Step Definitions
RTU as PLC (Connected to Master Computer) – Serial MODBUS

Site Configuration
1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Master
(or RS485, Async, Third party protocols, (Connected to) Master).
2. Define the Link Name: PLC 1, PLC 2, or PLC 3.
3. Select the appropriate Data Speed.
4. Click on the Advanced Configuration button, and select (if supported by the Master) the
DTR/CTS Support parameter to ‘Yes’.
5. In the Advanced Properties, set the Format parameter to the appropriate format. (The
default is 8 bit, no parity, 1 stop bit.)
6. Save the Advanced Configuration and the port configuration in the site.
1. In the ACE3600 STS Downloader utility, make sure that the ACE3600 STS is connected to
the proper site ID/link ID.
2. Select the site configuration to be downloaded to the RTU.
3. Select the appropriate protocol file as described in Third Party Protocol Downloading
above.
4. Download the selected files to the RTU.
Application Programmer System Tables
1. In the Application Programmer Database tab, open the PLC Table under System Tables
and set the values as follows:
• PLC address as required

• Connected to RTU (Name) LOCAL
• Via Port (Name) RTU AS PLC
2. Define the database tables and process.
Local RTU as PLC Master – Serial MODBUS

Site Configuration
1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Slave
(or RS485, Async, Third party protocols, (Connected to) Master).

20
MODBUS
4. Click on the Advanced Configuration button, and select (if supported by the Slave) the
above.
System Tables
• PLC address: 1
• Connected to RTU (Name): LOCAL
• via Port (Name): PLC1
RTU as PLC (Connected to Master Computer) – MODBUS over TCP/IP

Site Configuration
1. Define one of the ports as one of the following:
Description Port Configuration Settings Additional Configuration
RS232 PPP port - connected RS232 -> Async -> PPP -> User must specify Link ID
to a packet data (PPP) [Null modem | Standard and baud rate of modem.
modem via RS232. modem | TETRA | iDEN]
Ethernet 10/100 Base-T port 10/100 BasetT -> Static LAN User must specify Self IP
configured for static LAN - -> Ethernet LAN address, subnet mask, and
connected to LAN with a default router. User must
10 BasetT -> Static LAN ->
static IP address. specify Link ID of port.
Ethernet LAN
Ethernet 10/100 Base-T port 10/100 BasetT -> DHCP User must specify Link ID.
configured for dynamic Client-> Ethernet ->LAN A host name of port is
LAN - connected to LAN optional but recommended.
10 BasetT -> DHCP Client->
having a DHCP server
Ethernet ->LAN
which allocates IP address.
2. Click on the Protocols button and select the Modbus Slave Protocol.
3. Define the Port Name: PLC 1, PLC 2, or PLC 3.

21
MODBUS
4. Click on the Advanced Configuration button, and set the standard MODBUS advanced
parameters (described in Appendix A: Site Configuration Parameters in the ACE3600 STS
User Guide) and the special MODBUS TCP/IP parameters described in Port Configuration
– for MODBUS over TCP/IP above, as necessary.
Note: In general, no changes to the default values of the advanced parameters are required.
above.
• PLC address as required

• Connected to RTU (Name) LOCAL
• Via Port (Name) RTU AS PLC
2. In the Application Programmer Database tab, open the PLC IP Access Control Table and
create an entry for each authorized master and the corresponding PLC port on the slave to
which master will connect.
3. Define the database tables and process.
Local RTU as PLC Master - MODBUS over TCP/IP

Site Configuration
1. Define one of the ports as one of the following:
Description Port Configuration Settings Additional Configuration
RS232 PPP port - connected RS232 -> Async -> PPP -> User must specify Link ID
to a packet data (PPP) [Null modem | Standard and baud rate of modem.
modem via RS232. modem | TETRA | iDEN]
Ethernet 10/100 Base-T port 10/100 BasetT -> Static LAN User must specify Self IP
configured for static LAN - -> Ethernet LAN address, subnet mask, and
connected to LAN with a default router. User must
10 BasetT -> Static LAN ->
static IP address. specify Link ID of port.
Ethernet LAN
Ethernet 10/100 Base-T port 10/100 BasetT -> DHCP User must specify Link ID.
configured for dynamic Client-> Ethernet ->LAN A host name of port is
22
MODBUS
LAN - connected to LAN 10 BasetT -> DHCP Client-> optional but recommended.
having a DHCP server Ethernet ->LAN
which allocates IP address.
2. Click on the Protocols button and select the Modbus Master Protocol.
3. Define the Port Name: PLC 1, PLC 2, or PLC 3.
above.
System Tables
• PLC address: 1
• via Port (Name): PLC1
• IP address: to IP address of slave
RTU as Master – Ladder Diagram Consideration

The read/write of data from/to MODBUS PLC is done by SCAN operation in rungs. The
SCAN itself is performed on one of the new data type columns: PLC_VI, PLC_VO, PLC_DI,
or PLC_DO.
For each of the above columns, I/O Link should be performed.
When the SCAN operation is performed on one of the above columns, the system accesses the
destination MODBUS PLC by selecting one of the supported commands, according to the data
type of the column and the I/O link.
Note that if the column is of input type, read operation is performed from the PLC, and if the
column is of output type, write operation is performed to the PLC.
23
MODBUS
I/O Link for PLC Data Type Columns

I/O Link for PLC Data Type Column is a procedure of describing the slave database that we
want to access.
There are two options for performing I/O Link for each PLC Data Type Column:
• Static I/O Link – each column is bound to the slave database with the formal I/O Link
(as for I/O)
• Dynamic I/O Link – each column is bound to the slave database by the ladder at
runtime, by programming the PLC Dynamic IOLINK system table before the SCAN
operation.
The ACE3600 RTU selects the method according the value of PlcElmNum in the PLC
Dynamic IOLINK system table. During the SCAN of the PLC column type, the ACE3600
RTU examines the value of PlcElmNum. If it is equal to 0, static I/O is selected. If it is not
equal to zero, the I/O Link parameters are expected to be programmed in the PLC Dynamic
IOLINK system table.
If PlcElmNum == 0, use Static I/O Link.
If PlcElmNum <> 0, use Dynamic I/O Link.
Static I/O Link for PLC Data Type Columns

Before performing the I/O Link, complete the definition of the PLC Table, otherwise you will
not be able to proceed to the I/O Link for PLC data type columns.
In I/O Link, for each PLC data type column you must define the following:
1) PLC Address – the address of destination MODBUS PLC.
2) PLC Data Type – the data type of destination PLC. For MODBUS PLC, only four data
types are relevant:
a) Logic Coils
b) Discrete Inputs
c) Holding Register
d) Input Registers
3) Coord1 – the offset of the element corresponding to the first element of the column, from
the first element of the MODBUS PLC data type.
The elements at MODBUS PLC are referred (numbered) from zero;
(input 10001=zero=10001-10001,
input 10002=one=10002-10001,
input 10003=two=10003-10001,
etc., for 584 PLC).
24
MODBUS
If the first element of the column corresponds to input 10003, the PLC Coord1 must be set
to 2.
4) Coord1 Len – should be set to 2. The length of Coord1 is 2 bytes.
Note: Do not change the last three lines for coordinates. They are reserved for protocols with
more than one coordinate.
Dynamic I/O Link for PLC Data Type Columns

The ACE3600 RTU allows dynamic I/O Link per each PLC data type column.
The advantage of this method is that one can define multiple I/O Links at runtime for the same
PLC type column (not at the same time). Instead of defining the static I/O Link for a PLC
column, it is possible to program the PLC Dynamic IOLINK system table (#232).
The contents of the PLC Dynamic IOLINK table serves as an input for PLC column SCAN
operation and therefore programming this table should be done before the PLC column SCAN.
The programming of the PLC Dynamic IOLINK table is as follows:
• PlcElmNum –should be set to zero if Static I/O Link is used, otherwise it is generally set
to the number of elements (rows in column) in the corresponding PLC_DI, PLC_DO,
PLC_VI, PLC_VO, PLC_RI, PLC_RO data type column being accessed by the SCAN
operation. Note: PlcElmNum should be less than or equal to the number of elements (rows
in column) in the corresponding column accessed by SCAN.
• PLcDstAddr – Destination PLC address
• PlcDataType – 1 for PLC_RI ,PLC_RO (real floating point) column
– 2 for Logic Coils and Holding Registers
– 3 for Discrete Inputs and Input Registers
Special constants have been defined in the PLC Dynamic IOLINK Constants table for setting
the PlcDataType field: These include:
− PLCBit
− PLCVal
− PLCRel
− fc1_Read_Logic_Coil
− fc2_Read_Discrete_Input
− fc3_Read_Holding_Register
− fc4_Read_Input_Register
− fc3_Read_PLCRel
− fc5_fc15_Write_Logic_Coil
− fc6_fc16_Write_Holding_Register
25
MODBUS
− fc16_Write_PLCRel
• PlcCoordNum – Number of coordinates should be set to 1
• PlcCoord1Len – Should be set to 2. The length of Coord1 is 2 bytes
• PlcCoord1 – Should be set the same as described for "Coord1" in the Static I/O Link
section above.
Other fields of the PLC Dynamic IOLINK table are irrelevant for MODBUS protocol and
should be ignored.
26
MODBUS
Scan from Rungs

Before performing a SCAN on a PLC column, check the PLCStt status for communication
busy.
PLCStt column
= ( SCAN )
PLCBsy
PLCStt is an integer status system variable. The purpose of this variable is to give an indication
of the communication with PLCs. The values for this variable are defined in the PLC Status
Defines table (one of the Constants Tables).
Note that if PLCStt=PLCBsy, the new SCAN will not be performed.
If the communication is successfully terminated, the PLCStt variable changes to PLCRdy.

(Ready for a new SCAN after having successfully finished the previous SCAN).
27
MODBUS
If the communication is not successfully terminated, the PLCStt variable is changed to one of
following values:
NO_Buf – No buffers to perform the communication

PLCFal – Failed to perform the communication
PLCIol – I/O Link Error
PLCAdr – The address does not appear in PLC Table
PLCTim – No response from the PLC slave
PLCRpl – Reply error from PLC slave
During the communication, the PLCStt variable is equal to PLCBsy.
RTU as PLC (Slave) – Mapping of SCADA Element to

ACE3600 Database
The ACE3600 RTU defined as a MODBUS slave supports the following data types:
• Logic Coils
• Discrete Inputs
• Holding Registers
• Input Registers
• Real (floating point) Registers
The ACE3600 versatile database enables mapping of various data types to any MODBUS
register/bit address (0-65355). However, some SCADA Centrals address the data types
according to a predefined register mapping scheme such as:
Logic coils (bit output) range: 000001-065535
Discrete Input status (bit input) range: 100001-165535
Input registers range: 300001-365535
Holding (output) registers range: 400001-465535
The ACE3600 user database is accessible (for MODBUS read/write operation) from the
SCADA using the MODBUS protocol.
ACE3600 data is mapped into the MODBUS database by using the following default formula,
where Z (=0-31) is the table number, X (=0-7) is the column number, and Y (=0-249) is the
row number:
MODBUS register/bit address = offset + Z*2048 +X*256+Y.
The offset may vary according for different SCADA software. See Offset Note below.
28
MODBUS
By default, the table number (Z) may vary from 0 to 31. If a higher numbered user table must
be accessed, then do the following:
1) In the ACE3600 STS site configuration, modify the Advanced Physical ‘Register map’
parameter for the PLC port configuration to the “table=64 column=8 row=128” value.
2) Use the following formula where the user table number (Z) may vary from 0-63,
X (=0-7) is the column number, and Y (=0-127) is the row number.
MODBUS register /bit address = offset + Z*1024 +X*128+Y.
Again, the offset may vary for different SCADA software. See Offset Note below.
Offset Note: There are some SCADA systems for which addressing does not depend on the
data type; there is no specific absolute range reference per data type. For such a SCADA, the
offset in the equation should be set to 0. For other SCADA software, the offset = 000001,
100001, 300001, and 400001 for logic coil, input status, input register, and holding register
data type respectively.
In addition, a “PLC Translation file” add-on to the STS enables access to all data available in
ACE3600 database user tables. For information on preparing such a file, see PLC Translation
File below.
PLC Translation File

The register mapping scheme described above is limiting and does not enable access to all data
in the RTU database user tables. An additional mapping on top of the basic register mapping
scheme can be defined, based on PLC addresses, or MODBUS function codes, or both.
The PLC Translation file is a text file, created by the user, which defines the additional
mapping. When the file is configured and downloaded to the ACE3600 RTU, the additional
mapping becomes active.
The following example describes a system for which the PLC Translation File add-on is
applicable.
Four totally identical RTUs are accessed by an ACE36000 concentrator. The

database for the first RTU is mirrored (reflected) in the ACE3600 by tables
(0-31), the second RTU by tables (32-63), the third RTU by tables (64-95) and
the fourth RTU by tables (96-127). The four groups of tables are totally identical
and reflect the database of the corresponding RTU.
The MODBUS SCADA accesses the RTU by accessing the corresponding table
and element in the ACE3600 table.
In addition, on the SCADA, the application engineer would like to define four
copies of each element (tag) (per RTU) having the same MODBUS register/bit
number. Each tag will appear four times (having the same register/bit number),
but with four different MODBUS PLC addresses (1, 2, 3, 4).
A number of problems arise in building such a system:
29
MODBUS
1. The MODBUS to ACE3600 database mapping is limited by the range of tables that can be
accessed, because only the first 32 (0<=Z<=31) or 64 (0<=Z<=63) tables can be mapped.
See RTU as PLC (Slave) – Mapping of SCADA Element to ACE3600 Database above.
2. The MODBUS register/bit number has a unique mapping to the ACE3600 (z, x, y) element
and therefore it cannot be mapped to four different elements on the ACE3600 (representing
different RTUs in different tables) with the same register/bit number on the SCADA, as
described above. If four elements on the SCADA are defined with the same register/bit
number, they will all be mapped to the same (z, x, y) element on the ACE3600.
The solution is to introduce an additional mapping on the top of the register mapping scheme
described above using a PLC Translation File.
The PLC Translation File uses the .ini format and includes three sections (one per PLC port)
and instructions. It is a text file and can be edited by any text file editor. The file can be built
from the example template, Modbus_Example.plc, which is located in the "config" directory
under the STS installation path (e.g. C:\STS1150\Config.) Once the file is configured and
downloaded to the ACE36000, the additional mapping will become active.
The example PLC Translation File looks as follows, and defines a mapping for the port defined
as PLC2:
[MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_NAME_PLC1]
STATION_TABLE(Z)_OFST_BY_ADDR_1 =0
TABLE(Z)_OFST_BY_FUNCTION_CODE_1 =0
TABLE(Z)_OFST_BY_FUNCTION_CODE_15=0
The MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_NAME_PLC1] section

represents instructions which are relevant for access via PLC port PLC1. In this example, no
instructions are defined in this section.
The MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_NAME_PLC2] section

represents instructions which are relevant for access via PLC port PLC2. Four offsets are
defined based on the PLC address, and eight offsets are defined based on MODBUS function
codes.
30
MODBUS
The four keywords above define additional offsets, each of which depends on the PLC address.
The offsets 0, 32, 64, 96 correspond to PLC addresses 1, 2, 3, 4.
Each time a MODBUS packet is received via the port named PLC2, the MODBUS driver first
calculates the (z, x, y) coordinates of the element being accessed (using the register mapping
scheme for the MODBUS register /bit address formula above.) Based on the destination PLC
address (1, 2, 3, 4), the coordinates of the element are then changed to (z+offset,x,y). The table
number is shifted forward by the offset (namely 0 when accessing PLC address 1, 32 when
accessing PLC address 2, 64 when accessing PLC address 3, and 96 when accessing PLC
address 4). In other words, the tables for PLC address 1 start from Z=0, the tables for PLC
address 2 start from Z=32, the tables for PLC address 3 start from Z=64, and the tables for PLC
address 4 start from Z=96.
This increases the range of tables that can be accessed.
Notes: 1. PLC addresses 1, 2, 3, 4 should all be configured in PLC Table as legal PLC
addresses, otherwise the ACE3600 will not respond to accesses to PLC addresses 1, 2, 3, 4. See
the PLC Table description.
2: Any of the optional STATION_TABLE (Z)_OFST_BY_ADDR_* keywords is

legal (0 < * < 255 and represents a legal MODBUS PLC address.)
Z=31
PLC
PLC Table
Table
addr
Addr Offset Z=1
Offset
Z=0
10 1 0 0 Z=63
Z=33
Z=32
20 2 3232
Z=95
Z=65
30 3 6464
Z=64
40 4 9696 Z=127
Z=97
Z=96
31
MODBUS
The above keywords define an additional offset based on the MODBUS function code on the
PLC2 port. In the example file, all offsets are zero, so the final table number (Z) is not
impacted by the keywords. If, however, the TABLE(Z)_OFST_BY_FUNCTION_CODE_1
keyword was set to 5, any access done with MODBUS function code 1 via port PLC2 would
increase the table number (Z) or shift Z forward by five tables.
Notes: 1. Any of the optional TABLE(Z)_OFST_BY_FUNCTION_CODE_* keywords is

legal (*= one of MODBUS function codes 1, 2, 3, 4, 5, 6, 15, 16.)
2: If both types of keywords TABLE(Z)_OFST_BY_FUNCTION_CODE_* and

STATION_TABLE(Z)_OFST_BY_ADDR_* are defined – the table number is advanced
(shifted) forward by the sum of the two offsets.
The [MODBUS_CONNECTED_TO_MASTER_COMPUTER_PORT_NAME_PLC3] section

represents instructions which are relevant for an access done via PLC port PLC3. In this
example, no instructions are defined in this section.
PLC Diagnostics
The PLC Translation File which is downloaded to the ACE3600 can be viewed using the STS
SW Diagnostics utility (DEVICE= PLC1L for port name PLC1, PLC2L for port name PLC2,
PLC3L for port name PLC3, LEVEL=0.) See the example below. For more on the SW
Diagnostics utility, see the ACE3600 STS User Guide. For a description of the diagnostics, see
the TOSCADA (PLC1L, PLC2L, PLC3L) section of the ACE3600 Software Diagnostic
Output and Error Messages Manual.
32
MODBUS
Sun Nov 12 17:55:41 2006 Local DEVICE: PLC2L LEVEL: 0
Port name : PLC2

Connection to : Master Computer
Appl. code area : 67b44a0H
Appl. code len : 11137
Appl RAM area : 688a0f4H
Appl. RAM len : 20000
# of diag errors : 0
Local plc reply timeout: 7000
Remote reply timeout : 30000
Mode of translation : 0
No response timeout : 1000
#of idles timeout : 4
Load module vers : 1
Load module rev : 0
Load module name : MODBUS DRIVER CONNECTED TO MASTER COMPUTER
Load module diag : MODBUS SOFTWARE MODULE CONNECTED TO MASTER
STATION OFFSET TRANSLATION TABLE
PLCAddr TABLE(Z)_OFST
2 32
3 64
4 96
FUNCTION CODE TRANSLATION TABLE
FUNCTION_CODE TABLE(Z)_OFST
DOWNLOADED TRANSLATION FILE
33
MODBUS
RTU Supported MODBUS Protocol Exceptions (Negative

Acknowledges)
In case of a failure, the RTU supported MODBUS protocol sends to the master the following
exceptions (negative acknowledges):
Exception Number Sent when
4 (Device FAIL) An internal buffer overflow occurs in RTU.

The database doesn’t exist.
An internal buffer communication error occurs in RTU.
The number of elements is zero.
The master tries to access an integer data-type by
interrogating a bit data-type or vice versa.
An internal failure occurs in RTU.
1 (Illegal function) The function code is not supported.
6 (BUSY) The access to the RTU database is temporarily shut off
by the system. Try polling again!
2 (Illegal Address) The master tries to access an element which is not
defined in the RTU database, or is out of range. This
error usually occurs when the accessed column is not
defined in the RTU database, or the column is defined,
but the first or the last accessed element is out of range.
(First or last Y of the accessed element is greater than the
number of rows.)
34
MODBUS over RS485 Troubleshooting
If MODBUS communication is not working and the MODBUS RS485 port Tx LED is
constantly OFF, the ACE3600 may not be transmitting over RS485 multidrop. This is due to
bad idle conditions on the line caused by the peer RTU or device.
To solve the problem, do the following:
1. In the Site Configuration, select the RS485 port.
2. Click on the Advanced Configuration button.
3. In the PLC MASTER or PLC SLAVE tab, set Driver specific parameters #4 to 1 (this sets
the mask to 0x0001 - one bit on and the others off.)
4. Click OK to close the Advanced Configuration.
5. Save the changes to the port configuration in the site.
By setting the Driver specific parameters #4 bit mask to 1 (0x0001), the MODBUS driver will
force transmission regardless of the line idle conditions.
35
Allen Bradley PLC-5 Protocol
The PLC–5 protocol support allows the connection of an Allen Bradley PLC–5 controller to an
existing ACE3600 RTU system.
Some of PLC-5 controllers may be directly connected to a RTU, for example, the PLC-5/40
controller.
The RTU can also access PLC-5 controllers that are connected via the Allen Bradley Data
Highway/Data Highway Plus network.
PLC/5
RTU
Allen Bradley
PLC/5 Data Highway/
PLC/5
Data Highway Plus
RTU
RTU MDLC NETWORK AS PLC
MASTER
PLC/5
1770-KF2
RTU
Interface
Module
In this case, the connection of the RTU to one of the PLC-5 controllers (e.g. the PLC-5/15),
must be via the 1770-KF2 RS-232 Interface module.
Note: To simplify the explanations in this chapter, the PLC-5 controller is illustrated, as if it is
directly connected to the RTU. Keep in mind that any PLC-5 controller on Data Highway/Data
Highway Plus is connected to RTU via the 1770-KF2 Interface module.
The PLC–5 protocol support is the solution for polling/modifying the database of existing
PLC(s). In this case, the RTU is defined as a master and the accessed PLC – as a slave. The
RTU provides the ability to access the database of a PLC from the application ladder.
Three drivers are supplied for PLC-5 protocol support. They are:
36
AB.2S_PLC1 Driver for RTU that is PLC master to Allen

Bradley PLC-5, whose Port is defined as PLC 1.


The RTU-to-PLC-5 connection is described in this section according to the following

configuration:
a) Local RTU as PLC master

This configuration allows polling/modifying the database of the PLC from an MDLC-based
network. The RTU is connected to the PLC via a port defined as Connected to Slave. It
controls the PLC by means of the Ladder Diagram.
RTU
RTU Allen Bradley

RTU MDLC NETWORK PLC1
AS PLC PLC
AllenBradley PORT
MASTER
TO SLAVE
PLC#=1
PLC Table
RTU
Address RTU (Name)
0 1 LOCAL PLC1
Allen Bradley PLC–5 Settings

To establish the connection between an RTU and an Allen Bradley PLC–5 controller that is
directly connected to the RTU, you must configure the channel 0 port as follows:
a) In the Channel Overview screen, set channel 0 to SYSTEM (SLAVE).
b) In the Channel Config screen, set the Error Detect parameter to CRC.
c) Set the data speed, stop bits, and parity parameters similar to the RTU master parameters.
37
d) Set the station address of PLC–5 (it must be in the range of 1 to 254).
Note: These parameters may be set either on-line or off-line.
After setting the channel port, you may connect it to the RTU master PLC port.
If you are using the 1770-KF2 Interface module or another interface module, set the following:
a) Communication=Half-duplex.
b) Set the Error Detect parameter to CRC.
c) Set the data speed, stop bits, and parity parameters similar to the RTU master parameters.
Allen Bradley PLC 5/40 Settings

If you are using the 1770-KF2 Interface module, set the following switches:
SW-8 SW-1 SW-2 SW-3 SW-4 SW-5 SW-6 SW-7
OFF ON ON ON OFF ON ON OFF OFF ON ON OFF OFF OFF OFF ON ON OFF ON ON ON ON OFF
1 2 1 2 3 4 5 1 2 1 2 3 1 2 3 1 2 1 2 3 4 1 2
The switch functions are listed below:
Switch Number Function
SW-8 RS-232
SW-1 Half-duplex, CRC, No Parity, Non-Embedded Responses,
Accept All Messages, Use Handshaking
SW-2, SW-3, SW-4 Address 60 Octal, 48 Decimal
SW-5 DH+ at 57600 bps
SW-6 9600 bps
SW-7 DH+
RTU to PLC-5/40 Communication Using Port 2

The pin assignment of the cable to be used for RTU to PLC5/40 communication (using Port 2)
is given below.
38
RTU PLC-5/40
PORT 2
TXD
2 3
RXD
1 2
GND
4 7
RTS
4
CTS
5
DSR
6
DCD
8
20 DTR
RTU to 1770-KF2 Communication

The pin assignment of the cable to be used for RTU to 1770-KF2 communication is given
below.
PLC Address for Allen Bradley Protocol

Allen Bradley protocol uses destination and source addresses for each transmitted packet. The
address given to the RTU master is 0 by default. To change this default, consult the factory.
Data Type Compatibility Between RTU and PLC–5
Bit Type
When PLC–5 bits are accessed, the following adjustment is performed:
39
15 4 3 2 1 0
1st word
PLC_DI, PLC_DO,
. . . . accessed
column
index
0
1
2
3
4
:
:
:
15
15 4 3 2 1 0
2nd word
. . . . accessed
16
17
18
:
:
31
40
Float and Integer Types
RTU
Float, Integer, PLC RI, PLC RO, PLC VI, PLC VO
PLC05 File Data Type Column
element 0 0
1
element 1
.
. .
. .
.
element n
n
Timer File in PLC–5

The timer file in PLC–5 may be mapped to a PLC_VI or PLC_VO data type column in the
RTU. Each element consists of 3 words. The mapping is transparent and is as follows:
PLC-5 File RTU

Timer Element PLC_VI, PLC_VO
Data Type Column
15 14 13 8 7 00
0 EN TT DN not used 0
1 preset value 1
2 accumulated value 2
41
The same applies for counter and control elements.
PLC-5 File RTU

Counter Element PLC_VI, PLC_VO
Data Type Column
15 14 13 12 11 00
0 CU CD DN OV UN 0
1 preset value 1
2 accumulated value 2
PLC-5 File RTU

Counter Element PLC_VI, PLC_VO
Data Type Column
15 8 7 00
0 status 0
1 length 1
2 position 2
If you want to read n elements from a counter/control/timer file, you must define a column of
PLC_VI type with 3×n word elements (last index=3×n–1).
If you want to write to n successive counters/controls/timers in a file, then you must define a
column of PLC_VO type with 3×n word elements (last index=3×n–1).
Accessing PLC-5 Controllers

The following commands of the Allen Bradley protocol are used to access the PLC-5 controller:
Command Function
Word range read 01

Word range write 00
The file types below can be accessed by the ACE3600 implementation for the above commands:
• Integer file
• Floating point file
• Bit file
• Counter, timers, control
The above commands allow accessing most PLC-5 file types. The uniqueness of the above commands is
that it can access any file by referring it as a word (integer) file.
42
RTU Definitions for Allen Bradley PLC–5 Support
Data Types
The following data types have been added to be used when the RTU serves as a master:
• PLC_VI – PLC Value Input. This data type is used to read word elements from a third
party RTU. Each element in a PLC_VI column is a 2-byte signed integer (value). The
column length must be defined as the number of the words that are to be read. The
elements that can be read from PLC–5 are: counters, controls, timers, integers, etc. In the
case of counters, controls, and timers, three successive words are read per one element (in
PLC–5 each counter, control, and timer, consists of three words).
• PLC_VO – PLC Value Output. This data type is used to write into any word element of
Allen Bradley PLC–5 controller. The elements are: counters, controls, timers, integers, etc.
In the case of counters, controls, and timers, three successive words are written to an
element (in PLC–5 each counter, control, and timer, consists of three words).
• PLC_DI – PLC Discrete Input. This data type is used to read 1-bit elements from a third
party RTU, such as bits. The number of bits in a column must be defined as a multiple of
16.
• PLC_DO – PLC Discrete Output. This data type is used to write 1-bit elements into a third
party RTU, such as bits. The number of bits in a column must be defined as a multiple of
16.
• PLC_RI – PLC Real Input. This data type is used to read real (floating point) elements
from a third party RTU. Each element in PLC_RI is a 4-byte real (floating point) number.
• PLC_RO – PLC Real Output. This data type is used to write real (floating point) elements
to a third party RTU. Each element in PLC_RO is a 4-byte real (floating point) number.
PLC Table
The PLC Table, one of the System Tables, is used to define the connectivity to the third party
PLC units in the system. This table must be defined for any RTU which serves as a PLC master
for a PLC connected to one of its ports or connected to one of the other RTUs in the network.
This table has three columns as detailed below:
43
• PLC Address – the address of the PLC RTUs (1–254). Address 0 is the default address for
the Master. Refer to PLC Address for Allen Bradley Protocol to change the RTU’s default
PLC address.
• Connected to RTU (name) – the name of the RTU to which the PLC is connected. Click the
arrow to open the list. If the RTU is locally connected to one of the ports of the unit where
the PLC Table is to be defined, choose LOCAL from the choice list.
• via Port (name) – the name of the port for connection. Click the arrow to open the list.
Choose the same name that was used when the port was defined.
If the PLC is connected directly via a UART port to the Master, then define the Connected to
RTU field as LOCAL and the via Port field as PLC 1, 2 or 3.
If the PLC is connected to an RTU which acts as a router, then define the Connected to RTU
field as the RTU router Site Name. Assign the name that was used in the Site table.
Port Configuration and Protocol Downloading

The configuration of an RTU port as a third party protocol port requires two levels of
configuration:
• Physical port configuration
• Third party protocol downloading
44
Port Configuration
Any of the serial/plug-in (PI1, SI1, SI2, PI2) CPU ports may be defined as a Third Party
Protocol PLC port.
• Port Advanced Configuration ->DTR/CTS Support – this field defines the DTR/CTS
Support. Select this option only if DTR/CTS support is provided by the computer
connected to the ACE3600 RTU.
The default values may be changed according to the following:
• Connected to – Slave.
• Port Name – the name of the port: PLC 1, PLC 2, or PLC 3.
• Data Speed – This field defines the communication data speed of the selected Connection
Type. The default is 9600 bps.
• (Advanced Configuration->)Format – This field defines the UART's character format for
the communication port. The default is 8 bit, no parity, 1 stop bit. Click the arrow to open a
list that includes all combinations of 7/8 bits, even/odd/no parity, and 1/2 stop bits.

After configuring the RTU physical port according to the type of connection (to Master
Computer or PLC), STS provides you with the Downloader utility.
Note: The protocol should be loaded only to the RTUs whose ports have been defined as
Connected to Slave.
Before downloading the Third Party Protocol file, verify that the required files have been
added to the STS site Add-Ons. To do so, click on the General tab in the site view and add the
required Third Party Protocol files from the "config" directory under the STS installation path
(e.g. C:\STS1150\Config.)
The Downloader supports downloading to RTUs either locally or remotely via the network.
For instructions on how to operate Downloader, see the ACE3600 STS User Guide.
45
Step-by-Step Definitions

Site Configuration
1. Define one of the ports as RS232, Async, Third party protocols, (Connected to) Slave.
3. Download the appropriate protocol file as described in above.
• PLC address: 1
• Via Port (Name): PLC1
RTU as Master – Ladder Diagram

The read/write of data from/to Allen Bradley PLC–5 is done by the SCAN operation in the
ladder rungs of the application. The SCAN itself is performed on one of the new data type
columns: PLC_VI, PLC_VO, PLC_DI, PLC_DO, PLC_RI or PLC_RO.
For each of the above columns, I/O Link should be performed.
When the SCAN operation is performed on one of the above columns, the system accesses the
destination Allen Bradley PLC–5 by selecting one of the supported commands, according to
the data type of the column and the I/O link.
Note that if the column is of input type, read operation is performed from the PLC, and if the
column is of output type, write operation is performed to the PLC.
46
I/O Link for PLC Data Type Columns

I/O Link for PLC Data Type Column is a procedure of describing the slave database that we
want to access.
There are two options for performing I/O Link for each PLC Data Type Column:
• Static I/O Link – each column is bound to the slave database with the formal I/O Link
(as for I/O)
• Dynamic I/O Link – each column is bound to the slave database by the ladder at
runtime, by programming the PLC Dynamic IOLINK system table before the SCAN
operation.
The ACE3600 RTU selects the method according the value of PlcElmNum in the PLC
Dynamic IOLINK system table. During the SCAN of the PLC column type, the ACE3600
RTU examines the value of PlcElmNum. If it is equal to 0, static I/O is selected. If it is not
equal to zero, the I/O Link parameters are expected to be programmed in the PLC Dynamic
IOLINK system table.
If PlcElmNum == 0, use Static I/O Link.
If PlcElmNum <> 0, use Dynamic I/O Link.

Before performing the I/O Link, complete the definition of the PLC Table, otherwise you will
not be able to proceed to the I/O Link for PLC data type columns.
In I/O Link, for each PLC data type column you must define the following:
1) PLC Address – the address of destination Allen Bradley PLC–5. The address range is 1–
254. Address 0 is the master address. Refer to PLC Address for Allen Bradley Protocol to
change the default PLC address of the master.
2) PLC Data Type – the data type of destination PLC. For Allen Bradley PLC–5, only three
data types are relevant:
a) PLCBit – Use this data type when the destination file to read or write is a file of bits.
b) PLCVal – Use this data type when the destination file is of the following type:
• integer
• control
• counter
• timer
• any word type file
c) PLCRel – Use this data type when the destination file is a floating point file.
3) Coord1 – the file number to access.
4) Coord1 Length – should be set to 2. The length of Coord1 is 2 bytes.
47
5) PLC Coord2 – the word element number (starting from word 0) in the PLC-5 file which
corresponds to the ACE3600 PLC data type column start.
For integer files, PLC Coord2 = integer element number in file.
For floating point files, PLC Coord2 = (floating point element number in file)*2.
For bit files, PLC Coord2 = (bit element number in file)/16.
For counter, timer and control files, PLC Coord2 = (element number in file)*3.
6) Coord2 Length – should be set to 2. The length of Coord2 is 2 bytes.
7) Coord3 – the address (station number) of the Allen Bradley module that is directly
connected to the RTU. If a 1770-KF2 or other Interface module is connected to the RTU,
then PLC Coord3 should be the address of the interface module. If no interface module is
used (the PLC-5 is directly connected to the RTU), then PLC Coord3 should be the address
of the PLC-5 controller.
8) Coord3 Length – should be set to 1. The length of Coord3 is 1 byte.
Note: Do not change the last lines for coordinates. It is reserved for protocols with more than
one coordinate.

ACE3600 allows dynamic I/O Link per each PLC data type column.
The advantage of this method is that one can define multiple I/O Links at runtime for the same
PLC type column (not at the same time). Instead of defining the static I/O Link for a PLC
column, it is possible to program the PLC Dynamic IOLINK system table (#232).
The contents of the PLC Dynamic IOLINK table serves as an input for PLC column SCAN
operation and therefore programming this table should be done before the PLC column SCAN.
The programming of the PLC Dynamic IOLINK table is as follows:
• PlcElmNum –should be set to zero if Static I/O Link is used, otherwise it is generally set
to the number of elements (rows in column) in the corresponding PLC_DI, PLC_DO,
PLC_VI, PLC_VO, PLC_RI, PLC_RO data type column being accessed by the SCAN
operation. Note: PlcElmNum should be less than or equal to the number of elements (rows
in column) in the corresponding column accessed by SCAN.
• PLcDstAddr – PLC Address – the address of the destination Allen Bradley PLC–5. The
address range is 1–254. Address 0 is the master address. Refer to PLC Address for Allen
Bradley Protocol to change the default PLC address of the master.
• PlcDataType – should be set to 1.
• PlcCoordNum – number of coordinates; should be set to 3.
• PlcCoord1Len – should be set to 2. The length of Coord1 is 2 bytes.
• PlcCoord1 - the file number to access.
48
• PlcCoord2Len – should be set to 2. The length of Coord2 is 2 bytes.
• PlcCoord2- word element number (starting from word 0) in the PLC-5 file which
corresponds to the ACE3600 PLC data type column.start
For integer files, PlcCoord2 = integer element number in file.
For floating point files, PlcCoord2 = (floating point element number in file)*2.
For bit files, PlcCoord2 = (bit element number in file)/16.
For counter, timer and control files, PlcCoord2 = (element number in file)*3.
• PlcCoord3Len –should be set to 1. The length of Coord3 is 1 byte.
• PlcCoord3- the address (station number) of the Allen Bradley module that is directly
connected to the RTU. If a 1770-KF2 or other Interface module is connected to the RTU,
then PLC Coord3 should be the address of the interface module. If no interface module is
used (the PLC-5 is directly connected to the RTU), then PLC Coord3 should be the address
of the PLC-5 controller.
Other fields of the PLC Dynamic IOLINK table are irrelevant for the Allen Bradley PLC-5
protocol and should be ignored.
Scan from Rungs

Before performing SCAN on a PLC column, check the PLCStt status for communication busy.
PLCStt column
= ( SCAN )
PLCBsy
PLCStt is an integer status system variable. The purpose of this variable is to give an indication
on the communication with PLCs. The values for this variable are defined in the PLC Status
Defines table (one of the Constants Tables).
49
Note that if PLCStt=PLCBsy, the new SCAN will not be performed.
If the communication is successfully terminated, the PLCStt variable is changed to PLCRdy.

(Ready for new SCAN after having successfully finished the previous SCAN).
If the communication is not successfully terminated, the PLCStt variable is changed to one of
following values:
NO_Buf – No buffers to perform the communication
PLCFal – Failed to perform the communication
PLCIol – I/O Link Error
PLCAdr – The address does not appear in PLC Table
PLCTim – No respond from the PLC slave
PLCRpl – Reply error from PLC slave
During the communication, the PLCStt variable is equal to PLCBsy.
50
Allen Bradley SLC 500 Protocol
The SLC 500 family protocol support allows the connection of an Allen Bradley SLC
500, SLC5/01, SLC 5/02, SLC 5/03 and SLC 5/04 controller to an existing ACE3600
RTU system.
Most of the documentation for Allen Bradley PLC-5 controller is applicable for the SLC
500 family; please refer to the Allen Bradley PLC-5 Protocol section in this document.
The following are differences which should be noted:
SLC 500 Drivers

Three drivers are supplied for SLC 500 protocol. They are:
SLC.2S_PLC1 Driver for RTU that is PLC master to Allen Bradley

SLC 500, whose Port is defined as PLC 1.



• Coord2 – element number (starting from 0) in the PLC500 file which corresponds
to the ACE3600 PLC data type column start.
For integer files, PLC Coord2 = integer element number in file.
For floating point files, PLC Coord2 = floating point element number in file.
For bit files, PLC Coord2 = bit element number in file.
51
Allen Bradley SLC 500 Protocol

• PlcCoord2 - element number (starting from word 0) in the PLC500 file which
corresponds to the ACE3600 PLC data type column start
For integer files, PlcCoord2 = integer element number in file.
For floating point files, PlcCoord2 = floating point element number in file.
For bit files, PlcCoord2 = bit element number in file.
Accessing SLC 500 Controllers

The following commands of the Allen Bradley protocol are used to access the SLC 500 family of
controllers:
Command Function
Protected typed logical read A2
Protected typed logical write AA
The file types below can be accessed by the ACE3600 implementation for the above commands:
• Integer file
• Floating point file
• Bit file
Access to other SLC 5000 data types (counters, timers) is not supported by the ACE3600 RTU. If
this is required, the SLC 500 application engineer should copy the unsupported data type to an
integer file (which can be accessed by ACE).
52
Distributed Network Protocol (DNP) V3.00
Glossary
ACE1000 Advanced Control Equipment SCADA RTU
BI I/O back indication
DI Discrete (Binary) Input
DNP Distributed Network Protocol
DO Discrete (Binary) Output
IED Intelligent Equipment Device
IIN Internal Indication
IP Internet Protocol
RTU Remote Terminal Unit
SCADA Supervisory Control and Data Acquisition
STS System Tools Suite
TCP Transmission Control Protocol
TCP Dual End Mode In DNP over IP, either the master or slave may initiate a TCP
connection to each other. A single connection exists at a time.
TCP Listen Mode In DNP over IP, the master initiates a TCP connection to the slave.
UTC Time Coordinated Universal Time (GMT).
UDP User Datagram Protocol
UDP Only Mode In DNP over IP, either Master or Slave may communicate over
UDP.
VI Value (Analog) Input
VO Value (Analog) Output
SBO Select-before-Operate
Applicable Documentation
The ACE1000 system includes the following manuals:
53
• ACE3600 STS User Guide, publication number: 6802979C10

• ACE1000 RTU Owner's Manual,
Motorola publication no. 6802988C90
• ACE1000 Easy Configurator User Guide,
• ACE1000 ‘C’ Programming SDK & Migration Guide,
• ACE1000 System Planner,
• ACE1000 License Sheet,
• ACE Warranty Card,
• ACE1000Ex RTU Owner's Manual, Motorola publication no. 6802989C00
References
The following is a list of manuals which are referenced in this document.
Manual Title
IEEE Standard for Electric Power Systems Communications—Distributed Network Protocol

(DNP3)
Terms and Conventions

In the ACE1000 documentation, the terms “RTU” and “site” are interchangeable. The
term “MOSCAD” refers to Motorola SCADA systems, which can include legacy RTUs
and ACE1000 RTUs.
The terms “DNP” and “DNP3” represent the DNP V3.00 protocol.
The term “Floating-point” represent Single-precision Floating-point.
54
DNP3 Master Driver for ACE1000
This chapter describes the Distributed Network Protocol (DNP) V3.00 as implemented
in the DNP3 Master driver for ACE1000 only. The driver conforms to the Level 4
specifications provided in IEEE Standard for Electric Power Systems Communications-
Distributed Network Protocol (DNP3).This chapter covers the DNP implementation for
ACE1000 V2.00 or later, and ACE3600 System Tools Suite Application v19.50 or later.
It explains how the DNP protocol functions in relation to reading from and writing to
the RTU database. The manual is, therefore, intended for ACE1000 system developers.
The driver described in this manual represents an implementation of DNP V3.00

Level 4 for communicating between a master and an Intelligent Equipment Device
(IED), such as RTU. The driver satisfies the requirements of the DNP V3.00 Level 4.
Two modes are supported by the DNP driver: IP mode and serial mode.
The ACE1000 DNP Master driver over IP enhances the standard DNP3 protocol with a
set of features that are currently included only as a part of the MDLC protocol. Some of
these features are: Remote diagnostics of the RTUs, efficient time synchronization,
remote monitoring, and uploading and downloading updated parameters. This allows
the ACE1000 user to communicate via MDLC-coded messages over the physical
channel, with the MDLC-enabled capabilities of the ACE1000. DNP-aware IEDs use
that same physical channel to communicate with other DNP-aware devices. Unique
features such as remote diagnostics of RTUs, remote monitoring of applications, upload
and download of updated parameters, use the MDLC protocol, and these features are
available only for ACE1000 devices.
The ACE1000 DNP Master driver implements the DNP protocol standards in the same
way for IP and serial mode. The two modes differ only in the port declarations.
Unless otherwise indicated, this document applies to both IP and serial mode. The terms
DNP and DNP3 stand for both IP and serial mode; unless an express reference is made
to the specific driver mode.
Synchronizing the ACE1000 date and time updates the DNP driver, and vice versa.
The following action will synchronize the ACE1000 and the driver:
• STS Site Date and Time tool - Set the time in one unit or send the time to other
units.
55
Setting the ACE1000 DNP3 Master
This chapter covers the settings of the DNP3 Master side.
The User Interface

The ACE1000 DNP3 Master settings functionality is incorporated into the ACE1000
application using the ACE3600 System Tools Suite Application. The driver interfaces to
the application via the site configuration parameters.
You will use the ACE3600 System Tools Suite Application V19.50 or later to define the
DNP3 port (in System view) in order to set the functionality with the overall ACE1000
application. Therefore, you can easily incorporate the DNP Master settings into new or
existing ACE1000 configuration, by simply defining a port, adding the DNP3-general data.
The ACE1000 DNP3 Master supports the following data types (“I/O points”):
• Binary Input
• Binary Output
• Analog Input
• Analog Output
• Counter
• Frozen counter
All ACE1000 DNP3 Master I/Os are virtual points which are represented in the ACE1000
database. The ACE1000 DNP3 does not support physical I/Os.
Site Configuration Definitions

RTU port configuration is a two-step process: defining the port and setting its advanced
parameters.
The DNP Master port can be configured as follows:
• ACE1000 ETHERNET 10/100 Base-T port configured for static LAN.

This port should be connected to LAN with a static IP address.
• ACE1000 RS232 port.
56
Assumptions and Restrictions
The ACE1000 might eather be configured as DNP3 Slave or as DNP3 Master - not
as both.
Defining Port Connection

To set up the DNP Master port, perform the following:
1. Use the ACE3600 System Tools Suite / System Designer to open or create a
project (refer to ACE3600 STS User Guide, publication number: 6802979C10).
2. From the System site view, add an ACE1000 V2.00 (or later) site.
3. Double click the site box that is required to be set as DNP Master.
The site definition tabs are displayed.
57
4. In the General tab, set the Site ID and Site Name of the RTU. If required, add a
short description related to the site.
5. Click the Ports tab to set the ports of the RTU, especially the DNP Master port.
If DNP Master is over serial connection, configure the following in SI1, PI1 or PI2
sections:
• Media: RS232
• Connection type: DNP Master
If the DNP Master is over Ethernet connection, configure the following in ETH1
section:
• Media: 10/100 BT
• Address Mode: Static LAN
• Connection type: Ethernet
• Connected to: LAN
• Self IP address
• Default routing IP address
• IP network
6. Click Links and specify the available connection lines between sites.
7. Click Protocols and check Dnp Master.
58
8. To relate the DNP Master configuration to ACE1000 units in the system; from the
main menu of the System Designer screen, select System → DNP File Manager.
The DNP Master dialog is shown.
9. On the left pane of the DNP Master dialog , click to name and add the new
configuration file.
10. On the right pane of the DNP Master dialog , Check the ACE1000 unit(s) to be
related to the current configuration file.
11. Click OK.
12. From the main menu of the System Designer screen, select File → Save Project
to back up changes.
Setting Time Zone
The ACE1000 DNP Master only supports UTC time base. Time zone definition is
essential for proper DNP Master time related operations.
Perform the following steps to set the time zone of the DNP Master:
1. From the System site view, double click the site box that is required to be set as
DNP Master. The site definition tabs are displayed.
2. Click the Advanced tab.
3. Check Time Zone.
4. Click the Time zone parameter.
5. In the Time Zone Offset drop menu, select the required time zone.
6. From the main menu of the System Designer screen, select File → Save Project to
back up changes.
59
Advanced IP Connection Configuration

To implement DNP Master in IP mode, you will set several advanced parameters to the
values provided below.
Advanced DNP Master Configuration

The following DNP Master tab screen shows the DNP Master address in ETH1 (IP) mode.
Perform the following steps to configure the DNP Master address:
1. From the System site view, click Diagram view.

2. Double click the site box that is required to be set as DNP Master. The site
definition tabs are displayed.
3. Click the Ports tab.
4. Click the ETH1 section. The background of section changes from gray to orange.
5. Click the Advanced Configuration button.
6. Click the Dnp Manager tab.
7. In the Value box, set the DNP3 address of the selected DNP Master. The address
can be a number from 0 to 65519.
8. Click the OK button.
back up changes.
60
Advanced Serial Connection Configuration

To implement serial DNP Master, you will set several advanced parameters to the values
provided below.
Advanced DNP Master Configuration

The following screen shows the advanced parameters of the DNP Master in serial (SI1)
mode.
Perform the following steps to configure the advanced DNP Master parameters:
1. From the System view, click Diagram view.

2. Double click the site box that is required to be set as DNP Master. The site
definition tabs are displayed.
4. Click the SI1 section. The background of section changes from gray to orange.
7. In the Value boxes, set the required DNP Master parameters (For parameters
meaning, refer to the following table).
61
9. From the main menu of the System Designer, select File → Save Project to back
up changes.
The following table lists the parameters and their meanings.
Parameter Meaning
DNP Master ID <1-65519> The DNP3 address of the DNP Master (device).
The address can be a number from 0 to 65519.
Number of data bits <5-8> Set the number of data bits in each character.
Parity Use parity for detecting errors in transmission.
Number of stop bits <1-2> Set the number of stop bits to allow the Slave DNP
to detect the end of a character and to
resynchronize with the character stream.
Flow Control Use flow-control service to eliminate the
possibility of the sender overflowing the receiver’s
buffer.
Select RTS (Request To Send) or CTS (Clear To
Send)
62
DNP Master Configuration Editor

This section describes how configure general interface parameters, virtual I/O ports and
counters in the DNP Master for Ethernet (IP) and Serial (RS232) connection.
Configuring General Interface

Perform the following steps to configure the general interface parameters of the DNP
Master:
1. From the System view screen, click once on a Site to select. The Site frame will
show in a green color.
2. From the System Designer menu, select Site → DNP Master Configuration. The
DNP Master Configuration Editor screen will show.
3. Set the required General parameters of the DNP Master (for parameters meaning,
refer to the following table).
4. Click the Add New or Clone or Remove buttons to DNP3 Slaves.
63
Parameter Meaning
Interface Select communication port interface IP or RS232

Class Poll Intervals
Comm. fail interval (sec) The time between periodic Class Polls of DNP3 Slaves that
are in ‘Communication fail’ status. Class Polls will be
requested for all checked classes below. Set 0 for avoid
periodic ….
Comm. Ok interval (sec) The time between periodic Class Polls of DNP3 Slaves that
are in ‘Communication OK’ status. Class Polls will be
requested for all checked classes below. Set 0 for avoid
periodic ….
Periodic poll classes: The classes that should be polled in the periodic Class Polls.
Integrity Poll Intervals
Comm. fail interval (sec) The time between periodic Integrity Polls of DNP3 Slaves
that are in ‘Communication fail’ status. Set 0 for avoid
periodic ….
Comm. Ok interval (sec) The time between periodic Integrity Polls of DNP3 Slaves
that are in ‘Communication OK’ status. Set 0 for avoid
periodic ….
--------------------------------------
General - Slave
DNP Slave ID <0-65519> The DNP3 address of the DNP3 Slave.
(Modify again the RANGE IN the picture: <0-65519>)
Number of Binary Inputs Number of Binary Input points of the DNP3 Slave.
Enable unsolicited events If enabled, the DNP3 master should send an Enable
enable unsolicited events upon Unsolicited events request upon the DNP3 Slave startup or
startup DNP3 Master startup.
Issue event poll when any class If enabled, the DNP3 master should send an Event poll
IIN bit is set request with classes 1, 2 and 3 when class 1, 2 or 3 IIN bit is
set.
IP settings when IP mode is set to TCP Client (Available Ethernet IP configuration only)
IP mode: This parameter should be set to TCP Client.
Destination IP Address: The IP address of the DNP3 Slave to connect to or transmit
to.
Destination port <3-65535>: The port number of the device to connect to or transmit to.
The port can be a number from 3 to 65535.
Response timeout / TCP Specifies two parameters:
connect timeout (sec):
- Absolute response timeout to any request generated to the
DNP3 Slave. This value is the maximum time the DNP3
64
Parameter Meaning
Master will wait for the final response to a request.
- The time to wait for TCP connection to succeed.
Keep alive interval (ms): The time interval in millisecond before sending Get Link
Status requests for checking if a device is connected. This
method is recommended by the DNP3 standard for checking
the device connection status.
IP settings when IP mode is set to Dual end point (Available Ethernet IP configuration only)
IP mode: This parameter should be set to Dual end point.
Destination IP Address: The IP address of the DNP3 Slave to connect to or transmit
to.
Destination port <3-65535>: The port number of the device to transmit to or connect to.
Response timeout / TCP Specifies two parameters:
connect timeout (sec):
- Absolute response timeout to any request generated to the
DNP3 Slave. This value is the maximum amount of time the
DNP3 Master will wait for the final response to a request.
- Number of seconds required for TCP connection to
succeed.
Keep alive interval (ms): The time interval in millisecond before sending Get Link
Status requests for checking if a device is connected. This
the device connection status.
Validate UDP Address Validates source address of received UDP datagram.
Local port <3-65535>: Local port used for sending and receiving UDP datagrams.
IP settings when IP mode is set to UPD only (Available Ethernet IP configuration only)
IP mode: This parameter should be set to UPD only.
Destination IP Address: The IP address of the slave device to connect or transmit.
Destination port <3-65535>: The port number of the device to transmit to or connect with.
Response timeout / TCP Absolute response timeout to any request generated to the
connect timeout (sec) slave device. This value is the maximum amount of time the
master device will wait for the final response to a request.
Keep alive interval (ms): The time interval in milliseconds to check if a device is
connected by sending it Get Link Status requests. This
device connection status.
Validate UDP Address: Whether or not to validate source address of received UDP
datagram.
65
Parameter Meaning
Local port <3-65535>: Local port used for sending and receiving UDP datagram
messages. The port can be a number from 3 to 65535.
5. Click in the DNP3 Master configuration editor screen to save changes.
Configuring Analog Inputs

Perform the following steps to configure the Analog Inputs of the DNP3 Slave.
1. Click the Analog Inputs tab.

2. Click the Add or Remove button to add or remove the required Analog Inputs.
On the opened dialog select: Analog Input (16-bit) points, Analog Input (32-bit)
points and the Analog Input (Floating-point) points.
After adding an input to the “Selected” window, you can directly change the input
type by repeatedly clicking on it.
3. Click in the DNP3 Master configuration editor screen to save changes.
66
Configuring Analog Outputs

Perform the following steps to configure the Analog Outputs of the DNP3 Slave.
1. Click the Analog Outputs tab.

2. Click the Add or Remove button to add or remove the required Analog outputs.
On the opened dialog select: Analog outut (16-bit) points, Analog output (32-bit)
points and the Analog output (Floating-point) points.
After adding an input to the “Selected” window, you can directly change the output
type by repeatedly clicking on it.
3.
4. Click in the DNP3 Master configuration editor to save changes.
67
Configuring Counters
Perform the following steps to configure the Counters and Frozen Counters of the DNP3
Slave.
1. Click the Counters tab.

2. Click the Add or Remove button to add or remove Counters. The counter points of
the DNP3 Slave includ: Counters (16-bit) and Counters (32-bit) points.
3. After adding a counter to the “Selected” window, you can directly change the
counter type by repeatedly clicking on it.
4. Set the number of Frozen Counters points of the DNP3 Slave. The number should
not be more than the number of Counters points of the DNP3 Slave. Each Frozen
Counter type (16-bit or 32-bit) is determined according to the corresponding
Counter.
The frozen counters begin from the most upper counter on the Selected list.
For example; if the number of frozen counters is 2, the most upper two
counters on the Selected list are set to be frozen.
68
Downloading DNP Master
Configuration to Site
This section describes how to download DNP3 Master configuration to a Site.
Perform the following steps to download DNP3 Master configuration to a Site:

2. Double click the Site box that is required to be downloaded.
3. Click Download. The Site Download dialog is shown.
4. On the Block Name of the Site Download dialog, verify that ACE1000 DNP
master and oter modified files are checked.
5. Click the Download button to start downloading the configuration to the Site.
6. Upon completion, click OK to end the download operation.
69
Getting the DNP3 Master Map
This section describes how to upload the DNP3 Master map.
The DNP3 Master Map is generated by the ACE1000 Master driver upon downloading a new
DNP Master configuration. It is required for connecting the DNP Master to SCADA.
For details of connection of ACE1000 DNP Master to SCADA, refer to Appendix A.
The DNP3 Master Map should be uploaded from the ACE1000 only after it had been
configured as a DNP3 Master. For more, refer to ACE1000 Easy Configurator User Guide,
Motorola publication no. 6802988C98 and ACE1000 ‘C’ Programming SDK & Migration
Guide, Motorola publication no. 6802988C94.
Perform the following procedure to upload files from a DNP3 Master site.
1. From the System Designer menu, click Site → Upload. The Upload dialog
appears.
2. To upload via the local connection, check Local. To upload via other link, select
Site ID and Link ID.
70
3. Click OK to upload. The Site Upload dialog appears with a list of all files in the
DNP3 Master.
4. Check the ACE1000 DNP Master Report to be uploaded.

Note that this file contains the DNP3 Master map.
5. Click Upload on the STS dialog to begin uploading.
6. Upon completion, click OK and close the upload dialog.
7. To view the ACE1000 DNP Master Report: from the System Designer menu, click
Site → Open Site Folder. The File Explorer dialog opens showing the Site
directory. Open the irmdnpmtg.csv file using Microsoft Excel or any text editor.
71
DNP3 Slave Driver for ACE1000
This chapter describes the Distributed Network Protocol (DNP) V3.00 as implemented
in the DNP3 Slave driver for ACE1000 only. The driver conforms to the Level 4
specifications provided in IEEE Standard for Electric Power Systems Communications-
Distributed Network Protocol (DNP3). This chapter covers the DNP implementation for
ACE1000 V2.00 or later, and ACE3600 System Tools Suite Application v19.50 or later.
It explains how the DNP protocol functions in relation to reading from and writing to
the RTU database. The manual is, therefore, intended for ACE1000 system developers.
The driver described in this manual represents an implementation of DNP V3.00

Level 4 for communicating between a Slave and an Intelligent Equipment Device
(IED), such as RTU. The driver satisfies the requirements of the DNP V3.00 Level 4.
Two modes are supported by the DNP driver: IP mode and serial mode.
The ACE1000 DNP Slave driver over IP enhances the standard DNP3 protocol with a
set of features that are currently included only as a part of the MDLC protocol. Some of
these features are: Remote diagnostics of the RTUs, efficient time synchronization,
remote monitoring, and uploading and downloading updated parameters. This allows
the ACE1000 user to communicate via MDLC-coded messages over the physical
channel, with the MDLC-enabled capabilities of the ACE1000. DNP-aware IEDs use
that same physical channel to communicate with other DNP-aware devices. Unique
features such as remote diagnostics of RTUs, remote monitoring of applications, upload
and download of updated parameters, use the MDLC protocol, and these features are
available only for ACE1000 devices.
The ACE1000 DNP Slave driver implements the DNP protocol standards in the same
way for IP and serial mode. The two modes differ only in the port declarations.
Unless otherwise indicated, this document applies to both IP and serial mode. The terms
DNP and DNP3 stand for both IP and serial mode; unless an express reference is made
to the specific driver mode.
Synchronizing the ACE1000 date and time updates the DNP driver, and vice versa.
The following action will synchronize the ACE1000 and the driver:
• STS Site Date and Time tool - Set the time in one unit or send the time to other
units.
• DNP driver - Use the DNP synchronization commands.
72
Setting the ACE1000 DNP3 Slave
This chapter covers the settings of the DNP3 Slave side.
The User Interface

The ACE1000 DNP3 Slave settings functionality is incorporated into the ACE1000
application using the ACE3600 System Tools Suite Application. The driver interfaces to
the application via the site configuration parameters.
You will use the ACE3600 System Tools Suite Application V19.50 or later to define the
DNP3 port (in System view) in order to set the functionality with the overall ACE1000
application. Therefore, you can easily incorporate the DNP Slave settings into new or
existing ACE1000 configuration, by simply defining a port, adding the DNP3-general data.
The ACE1000 DNP3 Slave supports the following data types (“I/O points”):
• Binary Input
• Binary Output
• Analog Input
• Analog Output
• Counter
• Frozen counter
The ACE1000 DNP3 Slave supports physical I/Os and virtual I/Os which are represented
in the ACE1000 User Tables.
Site Configuration Definitions

RTU port configuration is a two-step process: defining the port and setting its advanced
parameters.
The DNP Slave port can be configured as follows:
• ACE1000 ETHERNET 10/100 Base-T port configured for static LAN.

This port should be connected to LAN with a static IP address.
• ACE1000 RS232 port.
73
Assumptions and Restrictions
1. All I/O indexes start with the phisical I/Os and then consecutively the virtual I/Os.
2. The following DNP3 Slave quantities are verified only upon saving the RTU configuration.
A notification will appear during the Save operation and the Save operation will fail if any of
the following DNP3 Slave quantities exceed the permitted values:
o The number of physical I/O ports shall not exceed the actual configured I/O ports in
the RTU (Main board and up to two expansion boards).
o The total number of virtual Binary Inputs and virtual Binary Outputs shall not exceed
2000.
o The total number of the virtual Analog Inputs (16-bit), virtual Analog Outputs (16-
bit), virtual Counters (16-bit), and virtual Frozen Counters (16-bit) shall not exceed
6000.
Note: Each physical Binary Input has a built-in physical Counter. Thus, the number
of virtual Frozen Counters (16-bit) includes a virtual Frozen Counter for each
physical Counter.
o The total number of the virtual Analog Inputs (32-bit), virtual Analog Outputs (32-
bit), virtual Counters (32-bit), and virtual Frozen Counters (32-bit) shall not exceed
2000.
o The total number of the virtual Analog Inputs (Floating-point) and virtual Analog
Outputs (Floating-point) shall not exceed 1000.
o If the “Generate Counters and Frozen Counters events upon Freeze/Freeze and Clear
commands” parameter is enabled, the total number of all the Counters shall not
exceed 180. The total number of all the Counters includes physical Counters, virtual
Counters (16-bit), and virtual Counters (32-bit).
The ACE3600 System Tools Suite Application verifies these quantities only when you
save the site.
3. All the point indexes of each I/O data type are zero-bases and consecutive accordig the
following order (e.g. The index of the first Virtual Binary Input is consequtive to the last
Physical Binary Input):
o The physical points (if defined)
o The 16-bit points (if defined)
o The 32-bit points (if defined)
o The Floating-point points (if defined)
74
For the specific map, refer to the DNP Master map
4. The ACE1000 can be configured as DNP3 Slave or DNP3 Master, not as both.
5. Event buffers are allocated per data type.
The event buffers size is fixed as detaild below:
o Binary Input Event buffer size = 500

o Binary Output Event buffer size = 100
o Analog Input Event buffer size = 100
o Analog Output Event buffer size = 100;
o Counter Event buffer size = 30;
o Frozen Counter Event buffer size = Number of Frozen Counters + 3
6. When DNP Master operates a virtual Analog Output/Binary Output, the DNP Slave will not
generate an Analog Output or Binary Output BI event.
When DNP Master operates a physical Binary Output, the Slave will generate a Binary Output
BI event according to the Digital Output configuration in the I/O tab of the System site view.
When Master operates a physical Analog Output, the Slave will always generate an Analog
Output BI event. This feature is not configurable.
The physical Analog Output valid raw values are 0-4095. The slave will NOT return any
indication for out-of-range values since the I/O Micro-controller does not return any fail
indication.
For more information on RAW data conversion, refer to the ACE1000 Easy Configurator
manual.
7. Freeze and clear Counters are implemented only on virtual counters since there is no way to
reset physical counters. Freeze and clear command of physical counters will be rejected by the
Slave.
8. All the events are reported (Sequence of Events (SOE) mode) , with exception of the Counters
events, where only the recent Counter event is stored per point (Most Recent mode). i.e. the
Counters event buffer contains only the last Counter event per point.
9. PULSE_ON and PULSE_OFF are not supported.
10. Select is not supported.
11. If 32-bit Counters are defined, it is recommended to set the Counters and Frozen Counters
default to 32-bit variations. Otherwise, big values might be truncated with not flag indication in
communication and no error logger or diagnostics indication.
12. The total number of Frozen Counters is equal to the total number of Counters, and their data
size is according to the Counters.
13. If the Slave is configured to support unsolicited messages, it will re-send unsolicited responses
to the DNP Master until it receives an ACK from the DNP Master, according the following
fixed parameters:
Initial unsolicited response:
75
o Endless retries every 15 seconds

o Other unsolicited responses:
o Three retries every 15 seconds, then endless retries every 40 seconds
Defining Port Connection

To set up the DNP Slave port, perform the following:
1. Use the ACE3600 System Tools Suite / System Designer to open or create a
project (refer to ACE3600 STS User Guide, publication number: 6802979C10).
2. From the System site view, add an ACE1000 V2.00 (or later) site.
3. Double click the site box that is required to be set as DNP Slave.
The site definition tabs are displayed.
76
4. In the General tab, set the Site ID and Site Name of the RTU. If required, add a
short description related to the site.
5. Click the Ports tab to set the ports of the RTU, especially the DNP Slave port.
If DNP Slave is over serial connection, configure the following in SI1, PI1 or PI2
sections:
• Media: RS232
• Connection type: DNP Slave

If the DNP Slave is over Ethernet connection, configure the following in ETH1
section:
77
• Media: 10/100 BT
• Address Mode: Static LAN
• Connection type: Ethernet
• Connected to: LAN
• Self IP address
• Default routing IP address
• IP network
6. Click Links and specify the available connection lines between sites.
7. Click Protocols and check Dnp Slave.
8. From the main menu of the System Designer screen, select File → Save Project
As to back up changes.
Setting Time Zone
The ACE1000 DNP Slave only supports UTC time base. Time zone definition is
essential for proper DNP Slave time related operations.
Perform the following steps to set the time zone of the DNP Slave:
1. From the System site view, double click the site box that is required to be set as
DNP Slave. The site definition tabs are displayed.
2. Click the Advanced tab.
3. Check Time Zone.
4. Click the Time zone parameter.
5. In the Time Zone Offset drop menu, select the required time zone.
back up changes.
78
Advanced IP Connection Configuration

To implement DNP Slave in IP mode, you will set several advanced parameters to the
values provided below.
Advanced DNP Slave Configuration

The following DNP Slave tab screen shows the DNP Slave address in ETH1 (IP) mode.
Perform the following steps to configure the DNP Slave address:

2. Double click the site box that is required to be set as DNP Slave. The site definition
tabs are displayed.
4. Click the ETH1 section. The background of section changes from gray to orange.
6. Click the Dnp Slave tab.
79
7. In the Value boxes, set the required DNP Slave parameters (For parameters
meaning, refer to the following table).
Parameter Meaning
DNP Slave ID <1-65519> The DNP3 address of the Slave. The
address can be a number from 1 to 65519.
DNP Master ID <1-65519> The DNP3 address of the Master. The

address can be a number from 1 to 65519.
IP mode The TCP mode
Master IP address The IP address of the DNP Master device.
Local UDP port <3-65535> Local port for sending and receiving UDP
datagram messages. This port should be
configured to match the UDP port that the
DNP Master sends datagram messages to.
TCP connect timeout (sec): <0-65535> Number of seconds to wait for TCP
connection to succeed or fail
Keep alive interval (ms): <0-65535> The time (in milliseconds) required to
verify the connection of a device by
sending it Get Link Status requests. This
method is recommended by the DNP3
80
Parameter Meaning
standard for checking the device
connection status.
Local TCP port <3-65535> Local TCP port for listening. In Dual end
point mode, this port is used for listening.
The connection requests are sent to
‘Destination TCP port’ port. The port can
be a number from 3 to 65535.
Only applicable in TCP Client and Dual

end point modes.
Destination UDP port <3-65535> Destination UDP port to send responses to.
Only applicable in UDP Only mode.
Destination TCP port <3-65535> The destination TCP port recieving

connect request from the Slave when
connection is initiated. In Dual end point
mode, listening is done on the ‘Local TCP
port’ port and the connection requests are
sent to this port when required.
Only applicable in Dual end point mode.
Destination UDP port for initial The Destination UDP port receiving the
Unsolicited response <3-65535> initial Unsolicited Null response. The port
can be a number from 3 to 65535. After
receiving a UDP request from the DNP
Master, ‘Destination UDP port’ is used for
all responses.
Only applicable in UDP Only mode.
Number of Physical Binary Inputs <0- Number of Binary Input points linked to
27> physical Digital Inputs and physical
Counters (16-bit), starting from the first
physical Digital Input.
Number of Virtual Binary Inputs <0- Number of virtual Binary Input points
2000> linked to General purpose bits (user) table.
For details on how this parameter affects

other parameters, refer to DNP3 Slave
assumptions and restriction section.
Number of Physical Binary Outputs Number of Binary Output points linked to

<0-17> physical Digital Outputs, starting from the
first physical Digital Output.
81
Parameter Meaning
Number of Virtual Binary Outputs <0- Number of virtual Binary Output points
2000> linked to General purpose bits (user) table.

Number of Physical Analog Inputs <0- Number of Analog Input points linked to
16> physical Analog Inputs, starting from the
first physical Analog Input. All the
physical Analog Inputs are Analog Input
16-bit points and their value is limited
according to the ACE1000 Analog Input
limitations.
Number of Virtual Analog Inputs (16- Number of virtual Analog Input (16-bit)
bit) <0-6000> points linked to General purpose
values/user values (user) tables.

Number of Virtual Analog Inputs (32- Number of virtual Analog Input (32-bit)
bit) <0-2000> points linked to General purpose longs
(user) table.

other parameters, refer to the DNP3 Slave
Number of Virtual Analog Inputs ( Number of virtual Analog Input (Floating-

Floating-point) <0-1000> point) points linked to General purpose
floats (user) table.

Number of Physical Analog Outputs Number of Analog Output points linked to

<0-4> physical Analog Outputs, starting from the
first physical Analog Output. All the
physical Analog Outputs are Analog
Output 16-bit points and their value is
limited according the ACE1000 Analog
Output limitations.
Number of Virtual Analog Outputs Number of virtual Analog Output (16-bit)

(16-bit) <0-6000> points linked to General purpose
values/user values (user) tables.
82
Parameter Meaning
Number of Virtual Analog Outputs Number of virtual Analog Output (32-bit)

(32-bit) <0-2000> points linked to General purpose longs
(user) table.

Number of Virtual Analog Outputs ( Number of virtual Analog Output

Floating-point) <0-1000> (Floating-point) points linked to General
purpose floats (user) table.

Number of Virtual Counters (16-bit) Number of virtual Counters (16-bit) points

<0-3000> linked to General purpose values/user
values (user) tables.
Notes:
1. A physical Counter (16-bit) is defined

for each physical Digital Input, thus the
number of physical counters is equal to the
number of physical Binary Inputs.
2. The number of Frozen Counter (16-bit)

is equal to the number of physical counters
(16-bit) plus to the number of virtual
counters (16-bit)

Number of Virtual Counters (32-bit) Number of virtual Counters (32-bit) points

<0-1000> linked to General purpose longs (user)
table, and the number of Frozen Counters
points (32-bit) linked to General purpose
longs (user) table.

Assumptions and Restriction section.
Unsolicited responses are allowed This parameters determines if unsolicited

responses are allowed. When set to
‘Disable’, no unsolicited responses are
83
Parameter Meaning
generated. In such case, requests to enable
or disable unsolicited responses will fail.
Generate Counters and Frozen This parameters determines if Counters and

Counters events upon Freeze/Freeze Frozen Counters events will be generated
and Clear commands upon receiving a Freeze or Freeze and clear
request.

Binary Inputs are reported in the Class Specifies if the response to a Class 0 Read
0 response request contains Binary Inputs static data
(Object 1).
Binary Outputs are reported in the Specifies if the response to a Class 0 Read
Class 0 response request contains Binary Outputs static data
(Object 10).
Analog Inputs are reported in the Class Specifies if the response to a Class 0 Read
0 response request contains Analog Inputs static data
(Object 30).
Analog Outputs are reported in the Specifies if the response to a Class 0 Read
Class 0 response request contains Analog Outputs static data
(Object 40).
Counters are reported in the Class 0 Specifies if the response to a Class 0 Read
response request contains Counters static data
(Object 20).
Frozen Counters are reported in the Specifies if the response to a Class 0 Read
Class 0 response request contains Frozen Counters static
data (Object 21).
The following parameters are the default variations to be used in responses when the
Master does not specify a reporting variation in its request. If the a default variation
doesnot contain flags/statuses and the Slave has flags/status information to report for a
specific point, it will response this point with the respective variation that contains the
flags/status information:
Object 01 default variation Binary Input default variation, to which the Slave
(Binary Input) should respond on a request with variation 0.
Object 02 default variation Binary Input Events default variation, to which

(Binary Input Events) the Slave should respond on a request with
variation 0.
84
Parameter Meaning
Object 10 default variation Binary Output default variation, to which the
(Binary Output) Slave should respond on a request with variation
0.
Object 11 default variation Binary Output Events default variation, to which

(Binary Output Events) the Slave should respond on a request with
variation 0
Object 20 default variation Counters default variation, to which the slave

(Counters) should respond on a request with variation 0.
Object 21 default variation Frozen Counters default variation, to which the

(Frozen Counters) Slave should respond on a request with variation
0.
Object 22 default variation Counters Events default variation, to which the

(Counters Events) Slave should respond on a request with variation
0.
Object 23 default variation Frozen Counters Events default variation, to

(Frozen Counters Events) which the Slave should respond on a request with
variation 0
Object 30 default variation Analog Input default variation, to which the

(Analog Input) Slave should respond on a request with variation
0.
Object 32 default variation Analog Input Events default variation, to which

(Analog Input Events) the Slave should respond on a request with
variation 0. The last two options set the default
variation per point, according the Analog Input
type (16-bit, 32-bit or Floating-point).
Object 40 default variation Analog Output default variation, to which the

(Analog Output) Slave should respond on a request with variation
0.
Object 42 default variation Analog Output Events default variation, to which

(Analog Output Events) the slave should respond on a request with
variation 0. The last two options set the default
variation per point, according the Analog Output
type (16-bit, 32-bit or Floating-point).
Binary Input Events classes DNP3 event classes affiliation of the Binary
Inputs. None indicates that no Binary Inputs are
stored.
Binary Output Events classes DNP3 event classes affiliation of the Binary
Outputs. None indicates that no Binary Outputs
85
Parameter Meaning
are stored.
Analog Input Events classes DNP3 event classes affiliation of the Analog
Inputs. None indicates that no Analog Inputs are
stored.
Analog Output Events classes DNP3 event classes affiliation of the Analog
Outputs. None indicates that no Analog Outputs
are stored.
Counters Events classes DNP3 event classes affiliation of the Counters.

None indicates that no Counters are stored.
Frozen Counters Events classes DNP3 event classes affiliation of the Frozen
Counters. None indicates that no Frozen Counters
are stored.

back up changes.
Advanced Serial Connection Configuration

To implement serial DNP Slave, you will set several advanced parameters to the values
provided below.
Advanced DNP Slave Configuration

The following screen shows the advanced parameters of the DNP Slave in serial (SI1)
mode.
Perform the following steps to configure the advanced DNP Slave parameters:
1. From the System view, click Diagram view.

2. Double click the site box that is required to be set as DNP Slave. The site definition
tabs are displayed.
4. Click the SI1 section. The background of section changes from gray to orange.
7. In the Value boxes, set the required DNP Slave parameters (For RS232
communication parameters meaning, refer to the following table. For the rest of the
parameters meaning, refer to the table in the Advanced IP Connection
Configuration section).
86
9. From the main menu of the System Designer, select File → Save Project to back
up changes.
The following table lists the parameters and their meanings.
Parameter Meaning
Number of data bits <5-8> Set the number of data bits in each character.
Parity Use parity for detecting errors in transmission.
Number of stop bits <1-2> Set the number of stop bits to allow the Slave DNP
to detect the end of a character and to
resynchronize with the character stream.
Flow Control Use flow-control service to eliminate the
possibility of the sender overflowing the receiver’s
buffer.
Select RTS (Request To Send) or CTS (Clear To
Send)
87
Downloading DNP Slave

Configuration to Site
This section describes how to download DNP3 Slave configuration to a Site.
Perform the following steps to download DNP3 Slave configuration to a Site:

2. Double click the Site box that is required to be downloaded.
3. Click Download. The Site Download dialog is shown.
On the Block Name of the Site Download dialog, verify that ACE1000 DNP Slave
and oter modified files are checked.
4. Click the Download button to start downloading the configuration to the Site.
5. Upon completion, click OK to end the download operation.
Uploading the DNP3 Slave Map

This section describes how to upload the DNP3 Slave map.
The DNP3 Slave Map is generated by the ACE1000 Slave driver upon downloading a new DNP
Slave configuration. It is required for connecting the DNP Slave to the user app consecutive locations
in C application or IEC…..
88
For details of connection of ACE1000 DNP Master to SCADA, refer to Appendix A.
The DNP3 Slave Map should be uploaded from the ACE1000 only after it had been configured as a
DNP3 Slave. For more, refer to ACE1000 Easy Configurator User Guide, Motorola publication no.
6802988C98 and ACE1000 ‘C’ Programming SDK & Migration Guide, Motorola publication no.
6802988C94.
Perform the following procedure to upload files from a DNP3 Slave site.
1. From the System Designer menu, click Site → Upload. The Upload dialog
appears.
2. To upload via the local connection, check Local. To upload via other link, select
Site ID and Link ID.
3. Click OK to upload. The Site Upload dialog appears with a list of all files in the
DNP3 Slave.
4. Check the ACE1000 DNP Slave Report to be uploaded.
5. Click Upload on the STS dialog to begin uploading.
6. Upon completion, click OK and close the upload dialog.
To view the ACE1000 DNP Slave Report: from the System Designer menu, click Site
→ Open Site Folder. The File Explorer dialog opens showing the Site directory.
Open the irmdnpmtg.csv file using Microsoft Excel or any text editor.
89
Appendix A: Connection to SCADA /
ACE1000 DNP Master Map
The Appendix A describes the tables used for connecting the ACE1000 DNP Master to SCADA.
The following structured tables should be uploaded from the ACE1000, as described in Getting the
DNP3 Master map section of this guide.
Each row in the following table shows the communication status for remote DNP Slave.
Table 1 Communication Status of Remote DNP Slaves
Type Column #5 (2 bytes) Column #6 (2 bytes)
Remote Data N/A 0- Communication fail
1- Communication ok
Each row in the following table shows the required information for a Binary Input in Remote DNP
Slaves.
Table 2 Binary Input of Remote DNP Slaves
Remote Point status. Point data (1/0 -ON/OFF) -

Binary Input received from the DNP Slave.
Low byte Status that was
received from the DNP Slave,
according to DNP3 standards.
0x01 – Online
0x02 – Restart
0x04 – Communication Lost
0x08 – Remote force data
0x10 – Local force data
0x20 – Chatter filter
Each row in the following table shows the required information for a 16-bit Counter.
90
Appendix A: Connection to SCADA / ACE1000 DNP Master Map
Table 3 Remote DNP Slaves Counter (16-bit)
Remote Point status. Point data (16 bits) - received

Counters (16- from the DNP Slave.
bit) Low byte Status that was
received from the DNP
Slave, according to DNP3
standards.
0x01 – Online
0x02 – Restart
0x04 – Communication
Lost
0x20 – Rollover
0x40 – Reference check
High byte application

layer
0x80 – Overflow
Each row in the following table shows the required information for a 32-bit Counter.
Table 4 Remote DNP Slaves Counter (32-bit)
Remote Counters Point status. Point data (32-bit) - received

(32-bit). from the DNP Slave.
Low byte Status that
was received from the
DNP Slave, according
DNP3 standards.
0x01 – Online
0x02 – Restart
Lost
91
0x10 – local force data
0x20 – Rollover

layer
0x80 – Overflow
Each row in the following table shows the required information for a 16-bit Frozen Counter.
Table 5 Remote DNP Slaves - Frozen Counter (16-bit)
Remote Frozen Point status. Point data (16 bits) - received

bit) Low byte Status that was
standards.
0x01 – Online
0x02 – Restart
0x20 – Rollover

layer
0x80 – Overflow
92
Each row in the following table shows the required information for a 32-bit Frozen Counter.
Table 6 Remote DNP Slaves - Frozen Counter (32-bit)
Remote Frozen Point status. Point data (32-bit) - received

bit). Low byte Status that was
Slave, according the DNP3
standards.
0x01 – Online
0x02 – Restart
0x20 – Rollover

layer
0x80 – Overflow
Each row in the following table shows the required information for a Binary Output.
The information includes the back indication.
Table 7 Remote DNP Slaves - Binary Output
Type Column #5 Column #6 (2 Column #7 (4 bytes)

bytes)
Remote Point status. Point data (1/0 User operations:

Binary -ON/OFF) -
Output Low byte Status received from Note: The term “SBO”, used
that was received the DNP Slave below, stands for Select Before
from the DNP Operate
Slave, according to
DNP3 standards. Byte#0/LSB:
0x01 – Online 0=LATCH_OFF
0x02 – Restart 1=LATCH_ON
0x04 –
93
Communication 2= SBO NUL + LATCH_OFF

Lost
3= SBO TRIP + LATCH_OFF
0x08 – Remote
force data 4= SBO CLOSE
+LATCH_OFF
0x10 – Local force
data 5= SBO NUL + LATCH_ON
6= SBO TRIP + LATCH_ON
7= SBO CLOSE +LATCH_ON
8=PULSE_OFF
9=PULSE_ON
Byte#1 (for pulse Binary

Output only):
N/A
Byte#2 (for pulse Binary

Output only):
Long table row# where

parameters of pulse Binary
Output are stored. (i.e. 0)
Byte#3/MSB: (for pulse

Binary Output only):
Long table# where parameters

of pulse Binary Output are
stored. (i.e. 11)
* For more on how to operate

pulse Binary Output, refer to
Appendix B
*For Intouch SCADA, refer to

Appendix C
94
Each row in the following table shows the required information for a 16-bit Analog Input.
Table 8 Remote DNP Slaves - Analog Input (16 –bit)
Remote Point status Point data (16-bit) – received

Analog Input from the DNP Slave.
(16-bit) Low byte Status that was
received from the DNP Slave,
according DNP3 standards.
0x01 – Online
0x02 – Restart
0x20 – Over range

layer
0x80 – Overflow
Each row in the following table shows the required information for a 32-bit Analog Input.
Table 9 Remote DNP Slaves - Analog Input (32-bit)
Remote Analog Point status. Point data (32-bit) - received

Input (32-bit) from the DNP Slave.
Low byte Status that was
Slave, according the DNP3
standards.
0x01 – Online
0x02 – Restart
Lost
95
0x20 – Over range

layer
0x80 – Overflow
Each rows in the following table shows the required information for a Floating-point Analog Input.
Table 10 Remote DNP Slaves - Floating-point Analog Input
Remote Analog Point status. Point data (Floating-point) -

Input (Floating- received from the DNP Slave.
point) Low byte Status that was
standards.
0x01 – Online
0x02 – Restart
0x20 – Over range

layer
0x80 – Overflow
96
Each row in the following table shows the required information for a 16-bit Analog Output, including
the back indication
Table 11 Remote DNP Slaves - Analog Output (16-bit)
Type Column #5 (2 bytes) Column #6 Column #7 (2 bytes)

(2 bytes)
Remote Point status. Point data User operations:

Analog (16 bits) -
Output Low byte Status that received Analog Input (16-bit) value set
(16-bit) was received from the from the by the user.
DNP Slave, according to DNP Slave.
DNP3 standards.
protocol
0x01 – Online
0x02 – Restart
Lost
0x08 – Remote force

data
0x20 – Over range
High byte
application layer
0x80 – Overflow
Each row in the following table shows the required information for a 32-bit Analog Output.
The information includs the back indication.
Table 12 Remote DNP Slaves - Analog Output (32-bit)
Type Column #5 (2 bytes) Column #6 Column #7 (4 bytes)

(4 bytes)

Analog (32 bits) -
Output Low byte Status that was received Analog Output (32-
received from the DNP Slave, from the bit) value set by the
97
(32-bit) according to DNP3 standards. DNP Slave. user.
0x01 – Online
0x02 – Restart
0x20 – Over range
High byte application layer
0x80 – Overflow
Each row in the following table shows the required information for a Floating-point Analog Output.
The information includes the back indication.
Table 13 Remote DNP Slaves - Floating-point Analog Output
Type Column #5 (2 bytes) Column #6 (4 Column #7 (4 bytes)

bytes)

Analog (Floating-point)
Output Low byte Status that - received from Analog Output (Floating-
(Floating was received from the the DNP Slave. point) value set by the user.
-point) the DNP Slave,
according the DNP3
standards.
0x01 – Online
0x02 – Restart
Lost
0x08 – Remote force

data
0x20 – Over range
98

layer
0x80 – Overflow
Each row in the following table shows the required DNP3 parameters for controling a DNP Slave.
The control data must be set in column #6 before column #7 is set.

The values in column #6 can be used as control data only after data is set
in column #7.
Table 14 DNP Slave Controls
Set date and N/A User operation:

Time
Set 1 to operate
Cold Restart N/A User operation:

(function 0xD)
Set “1” to operate
Warm start N/A User operation:

(function 0xE)
Integrity Poll N/A User operation:
Freeze User pre-operation data: User operation:

Counters
0 – For Immediate freeze Set “1” to operate
(function 0x07)
1 – For Freeze and Clear

(function 0x09)
Class Poll User pre-operation data: User operation:
0x01 – Class 0 Set “1” to operate
0x02 – Class 1
0x04 – Class 2
99
0x08 – Class 3
*Bits can be masked. i.e:
0x05 – For class 0&2 etc….
Enable User pre-operation data: User operation:

Unsolicited
(function 0x02 – Class 1 Set “1” to operate
0x14)
0x04 – Class 2
0x08 – Class 3
Disable User pre-operation data: User operation:

Unsolicited
(function 0x02 – Class 1 Set “1” to operate
0x15)
0x04 – Class 2
0x08 – Class 3
100
Each row in the following table shows the required DNP3 parameters for controling to all DNP Slave.
Each control parameter is designate to be sent to all DNP Slaves, one after the other.
The control data must be set in column #6 before column #7 is set.

The values in column #6 can be used as control data only after data is set
in column #7.
Table 15 DNP Master Controls
Type Column #6 (4 Column #7 (4 bytes)

bytes)
Set Date N/A User operation:

Time to
all slaves Set “1” to operate
Set log N/A 0x00000000 Do not log any information

level
Log levels Database layer:
0x40000000 - Log errors information

0x20000000 - Log init information
0x10000000 - Log running information
0x08000000 - Log periodic polls information
0x04000000 - Log reserved (future)
0x02000000 - Log application-protocol interface
information
Log levels DNP3 layer:
0x00000001 Log Physical level information

0x00000002 Log Link level information
0x00000004 Log Transport level information
0x00000008 Log Application level information
0x00000010 Log User information
0x00000020 Log MMI information
0x00000080 Log static data information
0x00000100 Log static data headers information
0x00000200 Log events data information
0x00000400 Log events headers information
0x00020000 Display extra time-stamp with ms
0x00010000 Log received data information
0x00040000 Log DNP3 level errors
0x00080000 Log target information (such as TCP/IP
target)
101
APPENDIX B: How to Operate Pulse Binary Output
APPENDIX B: How to Operate Pulse Binary

Output
Perform the following procedure to operate pulse Binary Output:

1. Set pulse Binary Output parameters in the General Purpose Longs user table as follows:
• In column #0  set the ON time
• In column #1  set the OFF time
• In column #2  set the COUNT
2. In column #7 of the Remote Binary Output table set the long value as follows:
MSB LSB
Long table# where Long table row# N/A 8 for PULSE_OFF

pulse Binary Output where pulse Binary
parameters are stored. Output parameters are 9 for PULSE_ON
(i.e. 11) stored. (i.e. 0)
For Example: Operating PULSE_ON, On time = 90 ms, Off time = 80 ms, and Count = 5:
1. Set table #11 (General Purpose Longs user table) as follows:

• Set row #2 column #0 to 90,
• Set row #2 column #1 to 80,
• Set row #2 column #2 to 5.
2. In the Remote Binary Output table, set Row # in column #7 of the relevant Binary Output to
0x0b020009.
102
APPENDIX C: Restrictions When Using Intouch
APPENDIX C: Restrictions When Using

Intouch
Since Intouch does not support long variable, working with Intouch limits the ACE1000
DNP3 Master functionality as described below.
The following DNP Slave long values are not supported:
• Analog Inputs (32-bit)
• Analog Outputs (32-bit)
• Counters (32-bit)
• Frozen counters (32-bit)
• Operate Pulse Binary Output
• Master controls: Set date & time to all DNP Slaves, Set log level
To operate Binary Output, Intouch should define a Floating-point value for Binary Output
table column #7.
The following values should be used for this operation:
1.0000000 - Direct operate LATCH_OFF

1.0000001 - Direct operate LATCH_ON
1.0000002 - SBO NUL + LATCH_OFF
1.0000004 - SBO TRIP + LATCH_OFF
1.0000005 - SBO CLOSE +LATCH_OFF
1.0000006 - SBO NUL + LATCH_ON
1.0000007 - SBO TRIP + LATCH_ON
1.0000008 - SBO CLOSE +LATCH_ON
103

Systems Tools Suite

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Systems Tools Suite

Uploaded by

Copyright:

Available Formats

Third Party Protocols Support

ACE3600 System Tools

MOTOROLA, MOTO, MOTOROLA SOLUTIONS and the Stylized

Copyright © 2015 All rights reserved

Motorola Solutions, Inc.

Motorola Solutions, Inc.

The MODBUS protocol support is applicable to the following situations:

a) Master Configuration: Polling/modifying the database of existing PLC(s). The RTU is

The RTU-to-MODBUS connection is described in this chapter according to the following

2) Local RTU as PLC Master

3) General System Configuration

In the RTU as PLC, definition of the PLC Table is required.

Ind PLC Connected to via Port (Name)

Local RTU as PLC Master

Driver file name Description

MODBUS Data Types

MODBUS Data Type Command MODBUS RTU Equivalent

Logic Coils Read 1 Discrete Output

Data Type Command MODBUS Function Code

Logic Coils Read 1

1. Run the ACE3600 STS.

2. In the site port configuration, click on Advanced Configuration.

ADDR FUNC BYTE RESERVED FLAGS CRC

XX 11 3 BYTE1 BYTE2 BYTE3 XX XX

ADDR: PLC address

CRC: 2 bytes of CRC.

Floating Point Numbers

1. Run the ACE3600 STS.

2. In the site port configuration, click on Advanced Configuration.

RTU Definitions for MODBUS Support

• The RTU, which is connected to the Master Computer.

This table has five columns as detailed below:

• PLC Address – the address of the PLC RTUs (1–255).

PLC TCP/IP Access Control Table

Additional/existing connections can be added/modified dynamically when a PLC Master

• AthrIPaddrs – the authorized IP addresses of up to 16 masters. If all addresses are 0.0.0.0,

Port Configuration and Protocol Downloading

• Physical port configuration

• Third party protocol downloading

Port Configuration - Serial MODBUS

• Connected– to Master or to Slave.

• Link Name – the name of the port: PLC 1, PLC 2, or PLC 3.

Port Configuration – for MODBUS over TCP/IP

• Protocols – Select MODBUS Slave or MODBUS Master.

Port Configuration – RS232 over PPP

Port Configuration - Ethernet 10/100 Base-T - Static LAN

Port Configuration - Ethernet 10/100 Base-T - Dynamic LAN

• (Advanced Configuration->)Master communication interval – the maximum time in

• (Advanced Configuration->)Connection create timeout – The number of milliseconds the

• (Advanced Configuration->)Maximum number of connections – The number of entries in

Third Party Protocol Downloading

RTU as PLC (Connected to Master Computer) – Serial MODBUS

2. Define the Link Name: PLC 1, PLC 2, or PLC 3.

3. Select the appropriate Data Speed.

Third Party Protocol Downloading

2. Select the site configuration to be downloaded to the RTU.

4. Download the selected files to the RTU.

Application Programmer System Tables

• PLC address as required

2. Define the database tables and process.

Local RTU as PLC Master – Serial MODBUS

2. Define the Link Name: PLC 1, PLC 2, or PLC 3.

3. Select the appropriate Data Speed.

Third Party Protocol Downloading

MODBUS register/bit address = offset + Z2048 +X256+Y.

MODBUS register /bit address = offset + Z1024 +X128+Y.