Chipkin Automation Systems - Articles » cpascu

Benefits of Subnets

cpascu — Mon, 08 Mar 2010 08:00:03 +0000

This article only explains some of the benefits of subnets, not how to implement a subnet.

1. It provides security.

In larger companies, employees must be able to communicate with other employees from that department. Subnetting allows for the department to have its own subnetwork. Depending on how many departments the company has, each one can have its own private and secure subnetwork, independent from the other networks.

2. It allows organization of resources.

A company has several departments or types of resources: sales, customer care, IT, executive, research. With subnetting, these resources can be organized within the larger network. For example:

192.168.130.x - Executive 192.168.131.x - Research 192.168.132.x - IT 192.168.133.x - Sales 192.168.134.x - Customer Care

3. It speeds up the network.

Using subnets will decrease the size of the broadcast domain, allowing data to reach its destination much faster. For example, a network without subnetting:

192.168.x.y - There are 255 possible values for x, and for each x there are 255 possible values for y. This means that there are 255*255 possible recipients in the network broadcast domain.

Having such a large network broadcast domain means the signal must go through each possible recipient until it finds the correct one. To decrease the number of possible recipients, we use subnets. For example:

192.168.132.y - Here, there are 255 possible values for y within the 132 subnet. The network broadcast domain only contains 255 possible recipients, thus making the network much faster.

Useful tools and applications for Modbus

cpascu — Mon, 01 Mar 2010 08:00:47 +0000

Here’s a useful list of tools to use with Modbus devices:

CAS Modbus Scanner (download)
- Allows us to retrieve coils, inputs, holding registers, and input registers from a Modbus enabled device.
Modbus RTU Parser (download)
- Allows us to analyze an RTU message and see what type of message it is, if there are any errors, what device the message came from, etc…
Modbus TCP Parser (download)
- Allows us to analyze an TCP message and see what type of message it is, if there are any errors, what device the message came from, etc…
Wireshark (homepage)
- Used for capturing Modbus TCP messages coming through the ethernet port.
- A full list of the captured data can be found here.
Modbus Specification (pdf)
- Official specification of the Modbus Application Protocol
Nerds In Control (homepage)
- Very useful community website for automation professionals.
- An excellent place to ask for Modbus help or help others with their Modbus problems.
Modbus Simulator (download)
- Used for simulating a Modbus server for testing and learning purposes.
Simply Modbus (download)
- Good Modbus TCP and RTU software, an alternative to our CAS Modbus Explorer and Scanner.
- Website provides good tutorials on Modbus.
Capturing with serial connections (tutorial)
- How to capture Modbus messages with a serial connection using free tools like PuTTY.
Modhopper (info)
- Allows connecting up to 128 Modbus devices through wifi to any Modbus network.

Feel free to suggest other tools that you find useful and I will add them to the list.

Broadcast traffic is being blocked on my network, Can I still use CAS BACnet Explorer?

cpascu — Tue, 23 Feb 2010 23:34:53 +0000

Question: Broadcast traffic is being blocked on my network, Can I still use CAS BACnet Explorer?

Answer:

Yes, but with some restrictions.

The BACnet discovery uses two services – called ‘Who-Is’ and ‘I-Am’ these messages rely on the use of broadcasts. Without the ability to send broadcast messages on a network, CAS BACnet Explorer will not be able to do the initial discovery of objects.

Once a device or objects has been added to CAS BACnet Explorer it no longer uses broadcasts messages to communicate with it. You should be able to poll a device for its object list and read/write its objects properties.

You can add BACnet objects and devices to CAS BACnet Explorer manually from the discover dialog. You will need to know some of the devices settings. Network type, IP/MAC address, network, Device instance, Object type, Object identifier.

SQLite vs mySQL (short summary)

cpascu — Mon, 22 Feb 2010 08:00:07 +0000

If you’re trying to decide between SQLite and mySQL (which one to use as your DBMS), you must first figure out what you need. These few simple questions should point you in the right direction:

Do you have a storage space limit?
- The SQLite library is a mere 250kb, which is perfect for most embeded devices that don’t come with very much storage space.
Do you need the database to be portable?
- SQLite stores the database directly into a single file, which can be simply copied or moved.
- mySQL has an export feature which lets you back the database into a single file. mySQL uses its own format for storing data so the content can’t be moved or viewed by other DMBSs. Only after the database is exported will it be portable. Depending on how large the database is, this could be time consuming.
Do you need security or authentication for your database?
- SQLite does not provide an authentication system. You can add one within your application, however the database file itself can be updated/read by anyone.
- mySQL requires a username and password to make any kind of changes to the database.
How large will your database get in the future?
- SQLite requires too much memory to run if the database is over 1GB in size (256 bytes of RAM for each MB of database space).
- mySQL can have a maximum database size of 4GB.
Will the database be accessed multiple times simultaneously?
- SQLite does not handle multiple simultaneous queries well. All read operations have priority over the write operations. There is a small delay caused by this since the operations must wait their turn, which could become a problem if there are large numbers of simultaneous queries.
- mySQL has a query mechanism which handles mutiple query operations very well.

Hopefully your basic doubts about SQLite and mySQL have now been answered.

Same Windows (XP) license on both the host machine and virtual machine

cpascu — Tue, 16 Feb 2010 23:55:25 +0000

Can we use the same Windows license used with our machine’s installation to install Windows on a virtual machine (VM), which is running on top of the original installation? What is the legal method for achieving this?

Unfortunately, you cannot have a VM running Windows using the same license used on your host machine, because the VM is treated as a separate computer. The Microsoft EULA is very ambiguous when referring to virtualization:

“The term ‘COMPUTER’ as used herein shall mean the
HARDWARE, if the HARDWARE is a single
computer system, or shall mean the computer system with
which the HARDWARE operates, if the
HARDWARE is a computer system component.”

1.1 Installation and use. You may install, use, access,
display and run one copy of the SOFTWARE on the
COMPUTER. The SOFTWARE may not be used by more than
two (2) processors at any one time on the COMPUTER,
unless a higher number is indicated on the COA.”

“1.2 SOFTWARE as a Component of the COMPUTER – Transfer.
This license may not be shared, transferred to or used
concurrently on different computers. The SOFTWARE
is licensed with the COMPUTER as a single integrated
product and may only be used with the COMPUTER.”

After various forums responses from several Microsoft representatives its clear that Microsoft expects you to purchase a new license for every Windows installation.

Some legal solutions to this problem:

The obvious one: Buy another Windows license to use with your VM. Not very desirable, seeing as Vista and Windows 7 are each over $70. Windows XP is not even sold anymore (according to Microsoft).
Use Linux as the host OS, using your Windows license only on the VM (Linux has excellent VM capabilities)
Get Vista Ultimate along with Software Assurance from Microsoft. This allows up to 4 VM uses of the same license key.
See if running Linux on the VM instead of Windows suits your needs (simulate Windows using Wine, etc…), and keep the Windows installation on the host machine.

CAS Modbus Scanner v1.02aB

cpascu — Wed, 03 Feb 2010 20:43:18 +0000

CAS Modbus Scanner is a utility to retrieve coils, inputs, holding registers, and input registers from a Modbus enabled device. Values retrieved from the device can be viewed in many different formats including Binary, HEX, Uint16, Int16, Uint32, Int32, and Float32.

Features:

Can read; coil status (0xxxx), input status(2xxxx), input registers (3xxxx), and holding registers (4xxxx)
Data is viewable in Binary, HEX, Uint16, Int16,Uint32, Int32, and Float32
Multiple connections
Works with RS232 and RS485, TCP
Easy to use interface
100% Free to use, no registration required.

New

Works with Modbus TCP
Works on Windows Vista and Windows 7 (32bit and 64bit)

Monitor any port using any protocol with Wireshark

cpascu — Tue, 12 Jan 2010 19:59:38 +0000

Changing the protocol associated with a port while monitoring it with Wireshark can be very useful.

For example if you were trying to monitor some web traffic but your web proxy is on port 9191, how would you get Wireshark to treat port 9191 as HTTP (or as port 80)?

To change the protocol associated with a port:

Open wireshark
Go to Edit -> Preferences -> Protocols
Search for your protocol and click it
On the right hand side you should find a list of ports considered to be using the protocol
To add your own port, simply add a comma “,” after the last port listed and enter your own

Simply restart Wireshark and restart your capture for the changed to take effect.

Chipkin BACnet Explorer set the max master

cpascu — Thu, 10 Dec 2009 19:35:43 +0000

To change the CAS BACnet explorer MSTP MaxMaster.

1) Open the settings file with notepad. The settings file is stored in of two places

C:\Users\<username>\Documents\CAS BACnet Explorer\Settings.xml
C:\Users\<username>\Documents\CAS BACnet Explorer (beta)\Settings.xml

2) Find the iMSTPNmaxMaster value

iMSTPNmaxMaster” value=”127“/>

3) Change the value to a number between 1-254. Note: 255 (OxFF) is reserved for broadcasts.

From the BACnet Spec:

This parameter represents the value of the Max_Master property of the node’s Device object. The value of Max_Master specifies the highest allowable address for master nodes. The value of Max_Master shall be less than or equal to 127. If Max_Master is not writable in a node, its value shall be 127.

Fix Drupal “Fatal error: Allowed memory size of…” error.

cpascu — Fri, 20 Nov 2009 22:56:23 +0000

This error can occur for multiple reasons. In my case, it occured when trying to edit an already existing drupal page. I would attempt to edit the page, and Drupal would respond with this:

Fatal error: Allowed memory size of 18874368 bytes exhausted (tried to allocate 1481725 bytes) in __/public_html/includes/database.inc on line 224

Fix 1:

What we need to do is increase the allowed memory size for php scripts. This is easy assuming that you know the location of your php.ini file (if you don’t, read Fix 2).

Inside this file, find the following line and make the following changes:

memory_limit = xxM; (xx – your current value)

memory_limit = 50M;

Note: You might have to increase the number depending on how many modules your Drupal installation is using.

Fix 2:

If you cannot find your php.ini file, either it does not exist yet, or your host won’t allow you to access it. We will assume that the file does not exist yet, so lets create it.

Save the following code into a file named php.ini:

[PHP]
memory_limit = 40M;

upload_max_filesize = 20M;

post_max_size 20M;

max_execution_time = 200;

max_input_time = 200;

Put this file in your Drupal website root folder, …/public_html/.

Your memory error should no longer occur after this fix, however considering there are many reasons for this error to occur it might also not work.

Modbus/TCP to BACnet/IP Configuration Sample

cpascu — Wed, 05 Aug 2009 20:36:29 +0000

This example FieldServer configuration illustrates a config which reads data from a Modbus/TCP device and makes the data available as BACnet data. A remote BACnet client can read and write points.

Relationship between a connection, node and Map Descriptor for a client

The name of the connection/adapter is used to form the relationship between the connection and the node. Here the name ‘N1’ is used in common. This means that when messages are sent to the node called PLC_01 (Node Address=1) they will be sent using connection N1.

As the FieldServer processes each task (Map Descriptor) it needs to know which device or node to send the message to. The name of the Node is used to form the relationship. For example, the task to read address 40001 is defined for Node=’PLC_01’. Now the FieldServer looks for a node with the same name. When it finds it, it then known which connection to send the message on. In this example, it also finds the IP address of the node. So now it knows to send a read holding register message to the device with device address = 1 at IP Adrdess 192.168.1.82 using Network connection N1.

Relationship between a connection, node and Map Descriptor for a Server

For a server, it is not necessary to form a relationship between the connection and the node. What does it mean when a node is not related to a connection? Let’s say you define the same protocol on two connections (eg N1 and N2 – not all FieldServer’s have both) but you want to use the same server node to respond to messages that arrive on connection N1 or N2. By leaving the relationship between a connection and a node undefined (like this example), this becomes possible.

For a server, Map Descriptors may be thought of as server data object definitions. They must be related to a node. When a request for data from node 11 (like this example) is received, the driver must find a matching server node in the config. Once a matching node is found, the FieldServer must find a data object definition that matches the request. Thus, a relationship between the node and the Map Descriptor must be established. This is done by using a common Node_Name as illustrated by the green line.

What connects two protocols together?

The Data Arrays connect protocols. The client reads data and stores it in a data array. The server serves data, extracting it from the Data Array and serving the data using a different protocol. Some data scaling or rearrangement may be required. FieldServer provides tools to move, reorganize, do arithmetic and scale Data Array data. In this example the relationship is direct.

In this diagram the pink and purple lines show how client side data read using Modbus is served as BACnet Data.

The Client read 20 data items from register 30001 and stores the data in DA_Ana_Inputs starting at offset zero.

This means DA_Ana_Inputs[0] contains the value of register 30001. DA_Ana_Inputs[1] contains the value of register 30002. DA_Ana_Inputs[2] contains the value of register 30003.

The server Map Descriptor named ‘AnaInput01’ serves data extracted from the Data Array named ‘DA_Ana_Inputs’ offset 0. Thus the data it serves correlates to register 30001.

The server Map Descriptor named ‘AnaInput02’ serves data extracted from the Data Array named ‘DA_Ana_Inputs’ offset 1. Thus the data it serves correlates to register 30002.

The server Map Descriptor named ‘AnaInput03’ serves data extracted from the Data Array named ‘DA_Ana_Inputs’ offset 2. Thus the data it serves correlates to register 30003

A similar discussion applies to the other data.

If the client goes offline or the data cannot be read because of some error then the age of the data increases. At some point the data becomes too old to serve in which case the FieldServer marks the data as unreliable.

Data Arrays

Data Arrays are used to store data. Select Data_Formats that are suitable for the data. FieldServers can store 1,8,16 and 32 bit data, signed and unsigned as will as floating point data. A few other formats such as packed_bits and packed_bytes allow binary data to be easily packed/unpacked. In addition using special functions data can be moved from one location to another. During the move, data formats can be changed and arithmetic can be performed.

Data arrays use FieldServer memory but the length does not affect the point count.

Scaling

A value can be scaled before it is served. In this example, the value served will be 100 times smaller than the value found in the Data Array. Read the config as follows; When a value of 0-10,000 is extracted from the Data Array it will be served to the remote node as a value between 0-100.

Modbus Client

No more than once per second (Scan_Interval) read (Function=RDBC which means read continuously) 20 (Length) input registers starting at address 30001 (Address) and store the returned data in DA_Ana_Inputs[0..19]. For this protocol the Map_Descriptor_Name serves only a descriptive purpose – it is not used by the protocol.

There are three other similar tasks. Each reads a different data type and stores it in a different location.

BACnet Server

The BACnet device instance has been set to 11. (Node_ID).

12 Data objects have been defined. Each is defined by a single map descriptor. The unstated length of each map descriptor is 1 (default value for this protocol.). That means each map descriptor defines a single BACnet data object. The object type and instance numbers are defined by Data_Type and Object_ID. They do not have to be sequential.

The MapDescriptor name is used as the BACnet Object Name. When a remote client reads from this server it will find objects named ‘AnaInput01’, ‘AnaInput02’, etc…

The Virtual BACNet device will be allocated to the Local Network. (Network zero). There are methods to change this default allocation.

A parameter called ‘Relinqush_Default’ tells the driver what value to set the object to if it is not being commanded by a remote device and if it is not being read from a remote device. It is required for output types and the typical value is zero.

The function is set to server meaning that these map descriptors are capabilities as opposed to tasks. The FieldServer does no active work based on these Map Descriptors. The server side waits passively until it receives a message from a remote BACnet device. When a message is received, the Fieldserver matches it against a server side node and then against the server side map descriptors. If there is a match data can be extracted and served. If there is no match then an error response is sent.

Engineering Units are a property of a BACnet data object. You can set them to any supported unit using the ‘Units’ parameter. The manual provides a full list of units. You can see the analog data is scaled before it is served.

How to Write/Command Data

When you send a BACnet comamd to change the value of an object (typically an output object) then a message is sent to the FieldSever with the new value. If a matching device and object are found the Data Array is updated. Normally the data is read by the client side and shared with the server side. These two operations seem to contradict each other. Here is how it works:

1. Normally client side (Modbus) reads the data and server side serves that data.

2. BACnet Scada System sends a command to write a data object.

3. This causes the FieldServer to store the data in the Data Array location being used by the corresponding Server Map Descriptor.

4. This in turn triggers a once off operation. Instead of reading the data from the Modbus Device, a single write to the Modbus device is performed with the new data. FieldServers call this a ‘write-though-read’. That is why we get away with having no ‘write’ map descriptors to the Modbus device but we are still able to send commands to the Modbus Device.

Lets say a remote controller sends a new setpoint to Analog Output #2. In this case the new setpoint is stored in DA_Ana_Outputs[1] (offset 1).

You can deduce that DA_Ana_Outputs[1] corresponds to Modbus register 40002. ( Basis for deduction – follow the data array name from the server map descriptor – find which client Map Descrptor uses the same Data Array. In this case it is the one called ‘Read_Holding_Regs’. Now you can see that 40001 corresponds to DA_Ana_Outputs[0] and hence 40002 corresponds DA_Ana_Outputs[1].

Now the FieldServer knows where to send the new setpoint and hence a message to set 40002 in device #1 using Modbus/TCP is sent.

Modbus and Floating Point Numbers

Modbus does not naturally have a way of transporting floating point numbers. Commonly, two 16bit integers are used to store a representation of a floating point number. Commonly the representation method is IEEE754. FieldServer have a method of doing the conversion.

The following table shows the FieldServer function moves that copy two adjacent 16-bit registers to a 32-bit floating point value:

In these examples, 32 16-bit values are combined to form 16 floating point numbers.

In the 1st example DA_SYN_REG[502] and DA_SYN_REG[503] are combined and stored in DA_SYN_ FLOAT500[0]. This is repeated 15 more times. Eg DA_SYN_REG[504] and DA_SYN_REG[505] are combined and stored in DA_SYN_FLOAT500[1].

Complete Configuration File