ToolboxPLUS+ 3.8.4 User Manual PDF

For CP-30 and G30 RTUs
Toolbox PLUS User Manual 3.8.4 www.cse-semaphore.com/mykingfisher Page 2

Document Information

Document Control
Copyright
Copyright CSE-Semaphore (Australia) Pty Ltd. ABN 35 006 805 910
www.cse-semaphore.com/mykingfisher, info.kingfisher@cse-semaphore.com
Intellectual
Property
CSE-Semaphore asserts ownership of the intellectual property contained herein and claims
copyright and authorship. CSE-Semaphore has and retains all rights of ownership and use of the
material herein in its on-going business.
Licence
This document is provided to the intended recipient(s) under a non-exclusive licence. This licence
permits Fair Use of the document for operational requirements, without payment of further royalty
or licence fee. Fair Use includes making copies of the document for operational, backup and
archive purposes. Fair Use includes distributing copies of the document to other entities for the
purposes of their performing related works for the intended recipient(s). Fair Use does not include
creating, selling or distributing copies of the document for other purposes. All copies must retain
this statement of Intellectual Property and Copyright.

Revision History
Ver.* Date Firmware Required Summary
3.0.0 26/4/2007 CP-30/G30 MC-30 First release.
3.8.0 14/1/2010 2242+ 232+ Multiple Kingfisher Floating Point variables can now be automatically
created. AO-3 support added. MC-30 firmware version now displayed in
Status window. MC-30 now supports HART and spread spectrum radio
option boards. Updated information about mapping IO variables to Modbus
variables. Added variables for G30 IO cards. Updated Event Log function
block for DNP3. Updates to DNP3 configuration. DNP3 variables no longer
need to be consecutive. Can now map remote DNP3 objects as local
objects. DNP3 messages can now be forwarded to another RTU. New DNP
Master function block DNPM_READ_GROUP. Added and updated a
number of port settings. Message Timeout and Retry parameters moved
from Port settings to Route settings. Added topic Ports USB (allows
connection of USB storage devices). Network image capture now
supported. Added Kingfisher Get Route and Set Route function blocks.
Added Network Time Protocol (NTP). Can now automaticall y detect RTUs
connected to the local Ethernet network or PC serial port (Discovery).
3.8.3 29/4/2010 2363+ DNP3 minor updates. IEC 60870-5 protocol added. Firmware patches can
now be downloaded and viewed from Status window. MC-31 now
supported (a CP-30 can be changed into an MC-31 by downloading MC-31
firmware). Reviewed and updated Quick Start.
3.8.4 2/9/2010 2468+ Added topic ISaGRAF Defined Words (can be used instead of constants).
Updated Redundancy appendix. Revised Quick Start. Added ISaGRAF -
Logic Examples topic. Added appendix - Creating Variables Using Excel.
Can now send unsolicited reports to multiple DNP3 devices. HART and 2/4
Wire Line option cards now configurable for G30. Logic programs and
function blocks can now be imported from other RTU configurations and
projects. Added notes about Modbus extended addressing. IEC protocol
temporarily unavailable. Added information for downloading firmware to an
MC-31 (similar to a CP-30).
* Manual version corresponds to Toolbox PLUS version.
Please ensure correct firmware is used with each version of Toolbox PLUS as listed above.
Minor updates to Toolbox PLUS are denoted by a change in the last revision digit. These changes do not require projects to be
upgraded or new firmware to be downloaded.
Major updates to Toolbox PLUS are denoted by a change in the middle revision digit. These changes require projects to be
manually upgraded and new firmware to be downloaded.


Contents
1. Quick Start .................................................................................................................4
2. Software Installation ............................................................................................... 10
3. Navigation................................................................................................................12
Navigation - Software Layout ................................................................................................................ 13
Navigation - Menu Bar........................................................................................................................... 14
Navigation - Multiple Ways To Select A Menu...................................................................................... 18
Navigation - Workspace ........................................................................................................................ 19
Navigation - Tabs .................................................................................................................................. 21
4. RTU Introduction.....................................................................................................22
5. RTU Configuration...................................................................................................23
RTU Configuration - Projects, Groups, RTUs ....................................................................................... 24
RTU Configuration - Project Properties................................................................................................. 25
RTU Configuration - Add Modules ........................................................................................................ 26
RTU Configuration - RTU Properties..................................................................................................... 28
RTU Configuration - Protocols .............................................................................................................. 29
RTU Configuration - Ports ..................................................................................................................... 36
RTU Configuration - Routes.................................................................................................................. 45
RTU Configuration - Phone................................................................................................................... 49
RTU Configuration - Programs.............................................................................................................. 50
RTU Configuration - Module Properties ................................................................................................ 52
6. Dictionary.................................................................................................................60
Dictionary - Variables ............................................................................................................................ 61
Dictionary - New Variables .................................................................................................................... 62
Dictionary - Edit Variables ..................................................................................................................... 64
7. ISaGRAF
TM
...............................................................................................................72
ISaGRAF
TM
- Overview......................................................................................................................... 73
ISaGRAF
TM
- Editing Tips..................................................................................................................... 74
ISaGRAF
TM
- Variable Types................................................................................................................ 76
ISaGRAF
TM
- Defined Words................................................................................................................ 77
ISaGRAF
TM
- Custom Function Blocks................................................................................................. 78
ISaGRAF
TM
- Logic Examples ............................................................................................................ 113
ISaGRAF
TM
- Reserved Variable Names ........................................................................................... 129
8. Download...............................................................................................................130
Download - Overview .......................................................................................................................... 131
Download - Connecting To An RTU.................................................................................................... 132
Download - Configuration.................................................................................................................... 137
Download - Logic................................................................................................................................. 137
Download - Firmware .......................................................................................................................... 138
9. Viewing Data..........................................................................................................139
View - Status ....................................................................................................................................... 140
View - Event Logs................................................................................................................................ 142
View - Communications....................................................................................................................... 144
10. Appendices............................................................................................................147
Appendix - Glossary ............................................................................................................................ 148
Appendix - Kingfisher PLUS+.............................................................................................................. 149
Appendix - Semaphore MIB ................................................................................................................ 152
Appendix - Redundancy...................................................................................................................... 159
Appendix - Creating Variables Using Excel......................................................................................... 167
Appendix - RTU Data .......................................................................................................................... 171


1. Quick Start
This chapter explains how to create and download a basic configuration for a CP-30 or G30 RTU.
To review the differences between CP-30/G30 and other Kingfisher PLUS+ processor modules please
see the appendix - Kingfisher PLUS+.
1. Assemble and power up the
RTU.
Wiring details are contained in
the power supply section of the
Hardware Manual available from
www.cse-
semaphore.com/mykingfisher

1
2
3
OPTIONAL
LOCKING
SCREW
PRESS INTO SOCKET
HOOK MOUNTING TAB
ONTO BACKPLANE SLOT

CONNECT MAINS POWER FOR PS-11
OR DC SUPPLY FOR PS-21
Plug the PS-xx power
supply into the left
backplane slot, followed by
the CP-30 and the MC-30
(if applicable) and any IO
modules.
Supply power to the PS-xx
and switch ON the RTU.
CP-30 PS-xx MC-30 AI-10 DI-10
ON/OFF
SWITCH

2. Connect the Ethernet port of
the CP-30 or G30 to the Ethernet
port of the PC using the red
Ethernet crossover cable (as
supplied with Toolbox PLUS).

If the PC does not have a spare
Ethernet port, a USB to Ethernet
Adapter can be used to provide
an additional Ethernet port.

CP-30 PS-xx
Ethernet
Crossover
Cable
AI-10 DI-10
G30
MC-30
SUPPLY POWER
ETHERNET
PORT
ETHERNET
PORT


3. Start Toolbox PLUS.
For help to install Toolbox PLUS
please see the topic Software
Installation

4. Select Tools, Status. When
the Connection to RTU window
appears, select Use the
following IP address
information and then select the
OK button.
The default IP address of the
RTU Ethernet port is
192.168.0.1.

If Toolbox cannot communicate
with the RTU, please see the
topic Download LAN Port
Setup.

5. When communications are
successful, the RTU Status will
be displayed.
Select the Modules tab to view
the modules that have been
detected by the RTU.
Select the module of interest and
then click the Details button.
IO module Inputs can be viewed
and outputs can be set.


6. RTU configurations are kept
in a project.
To create a new project, select
New, Project.

7. RTU Configurations can be
kept in groups within a project.
Groups are optional.
To create a new group, first
select the project name in the
navigation pane. Then select
New, Group.

8. RTUs can be added into a
group or straight into the project.
To add an RTU, select the group
or project name in the navigation
pane. Then select New, RTU.
Specify the Type as CP-30 or
G30.

9. A CP-30 RTU is comprised of
two or more modules installed on
a backplane. A G30 RTU is
comprised of two or more cards
installed in the G30 case.
To add modules or cards, Select
the RTU name in the navigation
pane. Then select New, Module.
For more information about
backplane slot numbers, please
see the topic RTU Configuration
- Add Modules.


10. Each RTU, Module or Card
has properties that can be
changed.
To edit properties, Select the
RTU name in the navigation
pane or Select the module or
card in the workspace. Then
select Edit, Properties.
For more information please see
the topics RTU Configuration -
RTU Properties or RTU
Configuration - Module
Properties.

11. Various communication
protocols (eg. Modbus, DNP3)
can be used by the RTU if
required.
Kingfisher protocol is always
enabled.
the topic RTU Configuration -
Protocols.

12. A CP-30, MC-30/31 or G30
can have up to 3 communication
ports per module. A CP-30 RTU
can have up to 16 ports in total.
Select the RTU name in the
navigation pane. Select Edit,
Properties. Then select the
Ports tab to Add or Edit ports.
There are a number of port
settings that can be edited once
the port is added.
Select the port to edit from the
Ports list and then select Edit.
Ports.


13. The communication path
between two or more RTUs is
called a route.
If this RTU needs to
communicate with another RTU
or device, please see the topic
RTU Configuration - Routes.

14. If the RTU has a PSTN port
or an external PSTN modem and
will dial other RTUs, a phone
number needs to be configured
for each remote RTU.
navigation pane. Select Edit,
Properties. Then select the
Phone tab to Add or Edit phone
numbers.
Phone.

15. Logic programs are used to
add intelligence to the RTU.
Logic programs access RTU
data and module IO points by
using variables. Variables are
configured in the Dictionary.
For more information about
variables please see the chapter
- Dictionary.
To configure programs, please
see the topic RTU Configuration,
Programs.
For example logic programs,
please see the topic ISaGRAF
Logic Examples


16. The project, group and
RTU can be renamed.
Select the project, group or RTU
to rename in the navigation
pane. Then select Edit,
Rename.

17. The entire project can be
saved at any time and should be
saved before downloading.
Select File, Save.
The first time the project is
saved, Toolbox PLUS requests
the folder to save the project in.

18. To download select the
RTU name in the navigation
pane. Then select Download,
Configuration and Logic.
the chapter Download.

19. The Kingfisher PLUS+ RTU is now configured!


2. Software Installation
Latest versions of software can be downloaded from MyKingfisher - www.cse-semaphore.com/mykingfisher

Note: the PC does not have to be restarted until all the programs have been installed. Installation of Toolbox
PLUS is not supported on network servers.

1. Insert the Toolbox PLUS
installation CD in the PC.
If the installer does not
automatically start then run:
Autorun.exe
Minimum PC Requirements:
Pentium 166 MHz
128 MB RAM
Microsoft Windows
NT4.0 SP6A (service pack 6A),
2000 or XP SP1.

2. Install Toolbox PLUS by
selecting the Toolbox PLUS
button.
(If a previous version is installed
on the PC, it will first need to be
removed using Add or Remove
Programs from the Windows
Control Panel).


3. Install ISaGRAF
TM
by
selecting the ISaGRAF button.
Once ISaGRAF
TM
is installed,
upgrade to the latest version by
selecting the ISaGRAF update
button.
Note: to use ISaGRAF
TM
, the
ISaGRAF
TM
dongle must be
connected to the PC.

4. Install Sentinel USB driver by
selecting the Sentinel USB
Driver button.

This driver provides support for
the ISaGRAF
TM
USB dongle.

5. Install Wireshark by selecting
the Wireshark button.
Wireshark provides diagnostics
of Ethernet communications.

6. Installation Complete!
The PC now needs to be restarted.


3. Navigation

Topic Description
Software Layout Overview of the Toolbox PLUS software layout
Menu Bar Describes the Menu Bar commands
Multiple Ways To
Select A Menu
Different ways to access RTU configuration settings
Workspace The different types of information that can be viewed in the workspace
Tabs How to access layered configuration settings


Navigation - Software Layout
Toolbox PLUS uses a layout similar to many Microsoft applications. There are a number of ways to access
each menu option and the information displayed varies according to what is currently selected.

Title Bar: displays the name of the active project (if open) and the Toolbox PLUS program version.
Menu Bar: allows access to all the Toolbox PLUS commands. Note: some commands are only available
when an RTU is selected in the navigation pane.
Tool Bar: has icons that allow quick access to some commands that are also in the Menu Bar. Note: some
icons are only available when an RTU is selected in the navigation pane.
Status Bar: displays information about the progress or result of an action. Displays Working Online
whenever Toolbox PLUS is communicating with an RTU.
Workspace: displays configuration information about RTUs, modules and variables. Also displays the event
logs. Information displayed varies according to what is currently selected in the navigation pane and wonder
bar.
Wonder Bar: controls the information displayed in the workspace. First select the RTU name to work with
(located in the Navigation Pane). Then select Projects, Dictionary or Event Log. This will display the
corresponding data for the selected RTU name in the workspace. Note: if a project or group name is
selected, the information in the workspace will be different.
Navigation Pane: displays open projects and up to 2 levels within each project - groups and RTUs. The
selection in the navigation pane affects the information displayed in the workspace.
Projects: allows one or more projects to be open at one time.
Groups: allows RTUs that have something in common to be kept together when they are displayed in
Toolbox PLUS.
RTU: displays the address and name of each RTU in the project.

Title Bar
Menu Bar
Tool Bar
Wonder Bar
Navigation Pane
RTU
Bar
Group
Workspace
Status Bar
Project

Navigation - Menu Bar
The commands available from the Menu bar options File, Edit, Tools and Help are described below.

Some commands can be accessed using shortcut keys. These shortcut keys are listed alongside the Menu
Bar commands shown below.

File Menu
New: allows a new project, group [of RTUs],
RTU, module or variables to be created.
Note: menu options are disabled if not
applicable to the current selection in the
Navigation pane.
Open: opens an existing project. Note: an
existing project can be automatically opened
when Toolbox PLUS is started. Edit the
properties of the Toolbox PLUS shortcut
(Right Click, select Properties). Add the path
of the project in quotation marks after the
entry in the Target parameter. Eg. Target:
"C:\Program Files\Kingfisher\Toolbox
PLUS\ToolboxPLUS+.exe" "C:\Water
Project\Pump Station"
Close: closes selected project
Save: saves selected project
Save As: allows project to be saved with a
new name and in a new location.
Export: zips up the selected project and
saves it To File or attaches it To Email. Note:
export does not zip up any ISaGRAF
TM

library files that the project uses. When
exporting To Excel, exports the dictionary
variables to an Excel spreadsheet.
Import: When importing From Excel, allows
dictionary variables to be imported from an
Excel spreadsheet. The format of the
spreadsheet must be the same as the
spreadsheet created using the Export To
Excel function above.
Recent Projects: recent projects that were
opened in the past can be opened again.
Exit: closes Toolbox PLUS program.


Edit Menu
Cut: copies the selected RTU configuration
and then deletes it from the project.
Copy: copies the selected RTU configuration.
Paste: pastes the last copied RTU
configuration into the selected group or
project.
Rename: allows the name of a project, group
or RTU to be changed. Names can include
spaces, hyphens ( - ), underscores ( _ ),
commas ( , ) and periods ( . ).
Delete: deletes the selected group, RTU or
module (modules are selected in the
workspace)
Properties: allows the settings for a project,
group, RTU or module to be changed.


Tools Menu
Connection: contains settings for how to
communicate with the selected RTU. Only
available when a project, group or RTU is
selected.
Communications
#
: launches Wireshark
Ethernet analyser program.
Discovery: detects all RTUs using the
same Subnet address as the local Ethernet
port(s) or connected to the PCs serial port
(requires 2285 firmware or newer).
Statistics: displays the number of
successful or failed messages sent by
Toolbox PLUS.
ISaGRAF *: launches the ISaGRAF
TM

logic editor for the selected RTU.
Build *: compiles the configuration and
ISaGRAF
TM
programs for the selected
RTU. If the program(s) contain errors,
Toolbox PLUS will report the following
ERROR: Cannot make ISaGRAF
download files.
Download: Allows Configuration, Logic or
Firmware to be downloaded to the selected
RTU. Note: Toolbox PLUS will
automatically compile the configuration
and/or logic before downloading.
Upload: uploads the configuration last
downloaded to the connected RTU. Does
not upload logic programs.
Restart: restarts the selected RTU.
Advanced: Can download MC-30 firmware
or update the custom function blocks in
ISaGRAF
TM
with the version stored in
..\ToolboxPLUS+\Updates. Caution!
Please ensure the RTU has firmware that
supports the new function blocks to avoid
RTU malfunction.
Status: displays live status information for
the selected RTU. Multiple module status
windows can be viewed at the same time
for the one RTU.

#
Only enabled when Wireshark is installed.
* Only enabled when ISaGRAF
TM
is installed.


Help Menu
Contents: displays table of contents from
help file.
Search: searches for a keyword in the help
file.
About Toolbox: Displays Toolbox PLUS
program information.

Configuration windows have a help button in the top right-hand corner (as shown). Select the help button
to view information about the current window.


Navigation - Multiple Ways To Select A Menu
The examples below show different ways to edit the RTU properties.

The Menu Bar example is the default method used in this manual.

Menu Bar
navigation pane.
Select Edit, Properties.

Right-Click
Right-click the RTU name in
navigation pane.
Select Properties.

Double-Click
Double-click the RTU name in the
navigation pane.

Shortcut Keys
navigation pane.
Press the Ctrl and Space keys

The Tool Bar provides another way of accessing some Toolbox PLUS commands.


Navigation - Workspace
The information displayed in the workspace changes according to what is currently selected in the navigation
pane (ie. Project, Group or RTU) and the Wonder Bar selection (ie. Projects, Dictionary or Event Log). The
various Workspace displays are shown below.

Workspace - Default View
Wonder Bar Selection:
Projects or Dictionary or Event
Log
Displayed when Toolbox PLUS is
first started or Projects is selected
in the navigation pane
The Recent Projects that were
opened in the past can be opened
again.

Another existing project can be
opened or a new project created.

Workspace - View RTUs
Wonder Bar Selection: Projects
When a project name is selected
in the navigation pane, the RTUs
and RTU groups in that project
are displayed in the workspace.

Workspace - View Modules
Wonder Bar Selection: Projects
When an RTU name is selected in
the navigation pane, the RTUs
modules are displayed in the
workspace.
This view allows module
properties to be configured
(double-click on any module).
Module Properties.


Workspace - View Dictionary
Wonder Bar Selection: Dictionary
dictionary is displayed in the
workspace.
This view allows variables to be
edited (double-click on an existing
variable) or created (select the
New button).
the chapter - Dictionary.

Workspace - View Event Log
Wonder Bar Selection:
Event Log
event log is displayed in the
workspace.
This view allows event logs to be
retrieved from an RTU, filtered,
exported (saved) and cleared.
the topic View - Event Logs.


Navigation - Tabs
Some windows have a number of pages that can be accessed by selecting the tab buttons across the top of
the window. Example:

Edit RTU Properties
Select the RTU name in the navigation pane.
Select Edit, Properties. The RTU Properties window with tabs will then
appear.

Tabs

4. RTU Introduction

An RTU is electronic equipment that contains a computer. RTUs
are often located in remote places. This led to the name Remote
Terminal Unit (RTU). RTUs can be wired to a whole range of
devices like switches, relays and sensors. Each RTU can monitor
and control the devices it is wired to.
There are two types of devices that an RTU can be wired to -
digital and analog. A digital signal is an ON or OFF state of a
switch or a relay. An analog signal is a variable measurement like
tank level or temperature.
An RTU can also obtain data by communicating with intelligent
devices (eg. a PLC).

RTUs can be programmed to carry out a wide range of tasks. For example:
Set outputs according to the state of inputs (eg. run a pump to fill a tank that is low)
Send a message when there is new data or a significant event has occurred
Perform complex mathematical calculations

Kingfisher RTUs have continued to increase in speed and power over the years and can now provide:
Data Logging
Alarming - auto dialing, SMS messages
Diverse communications - data radios, dialup and cellular modems, leased line, Ethernet and more
PLC-like logic processing
Large networks - more than 65,000 RTUs
Support for various protocols: Kingfisher, Modbus, DNP3, SNMP, Allen Bradley DF1 and more

Indirect
Route

RTU3

RTU4

RTU2

Remote RTUs

Direct
Route

Data

Data

Data

RTU1

Data

Network

RTU2 Data

RTU3 Data

RTU4 Data

Master RTU

An RTU network is two or more RTUs that can
communicate with each other in some way. The
communication path is called a route.
Usually one RTU is setup as the Master RTU. The
master RTU regularly polls data from all the other
RTUs. The other RTUs are referred to as Remote
RTUs and can report data changes as they occur
(called exception reports). RTU configuration is
completely flexible and allows for many other types
of communication setups.
This example shows RTU1 as the master RTU and
RTUs 2-4 as the remote RTUs. RTU3 also stores
and then forwards messages between RTU1 and
RTU4.

If only polling is used, it will take up to the regular polling interval before the master RTU obtains new data
from remote RTUs. Example: If the master polls the remote RTUs every 2 minutes, it will take up to two
minutes before the master receives new data from the remote RTUs.

If only exception reporting is used, the master RTU will not know if a remote RTU has failed. If the master
RTU does not receive a message from a remote RTU for a long time this could mean that either there is no
new data or that the remote RTU has stopped communicating.

The best method is to use both polling and exception reports. This means that if a remote RTU fails, the
master RTU will find out about the fail when it performs the next poll. And as soon as data changes or a
significant event occurs, the master RTU will be notified by an exception report.

5. RTU Configuration

Topic Description
Projects How to create a new project, new RTUs and groups of RTUs
Project Properties The project name and details
Add Modules How to add all the modules or cards that the RTU will use
RTU Properties
General RTU settings including RTU address. Skip this topic when using the default
RTU addresses assigned by Toolbox PLUS
Protocols The communication languages that the RTU can use
Ports How to add and configure communication ports in the RTU
Routes
How each RTU communicates with the other RTUs. Skip this topic if there is only
one RTU in the project.
Phone
The phone numbers of remote RTUs to dial if using a dialup option board or external
PSTN modem
Programs The number and type of logic programs that the RTU will use
Module Properties
Allows the IO module or card properties (settings) to be configured. Skip this topic if
the RTU does not have any IO modules or cards or to use the default settings.


RTU Configuration - Projects, Groups, RTUs
A new project must be created before any RTU configurations can be created. A project contains the
configurations for one or more RTUs and allows all the information for a monitoring and control system to be
kept together.

Create New Project
Select New, Project
(Or an existing project can be opened)
When using a lot of RTUs, they can be kept in groups. Groups allow RTUs that have something in common
to be displayed together in Toolbox PLUS. Egs. Water or sewerage RTUs, Radio or PSTN RTUs.

Create New Group
Select the project name in the navigation pane
Select New, Group
RTUs can be added directly into a project or added into a project group.

Create New RTU
Select the project or group name in the navigation pane
Select New, RTU
Select the Type of RTU required: CP-30 or G30-SA (G30 Stand Alone)
The new project, group and RTUs can be renamed.

Rename Project, Group or RTU
Select the project, group or RTU in the navigation pane.
Select Edit, Rename

Note: projects and groups are only used by Toolbox PLUS to organise how the information is displayed and
saved. Project and group names are not downloaded into the RTU.

RTU Configuration - Project Properties
Allows the general settings of the Project to be viewed and configured.

Edit Project Properties
Select the Project name in the navigation pane
Select Edit, Properties (or double-click the Project name)

Name: (0 to 255 characters) Name of the project.

Password, Confirm Password: (0 to 20 characters)
When configured, this password will be required in order
to open the project in Toolbox PLUS. To disable
password protection, clear both parameters.

RTU Configuration - Add Modules

A CP-30 RTU requires at least a power supply module (PS-11) and a processor
module (CP-30). Communications modules (MC-30/31) and IO modules (eg. IO-4)
can be added if required. Each communications module can have up to three
communications ports.
All the modules are installed on a backplane. A backplane has 4, 6 or 12 slots.
Backplanes can also be linked together allowing up to 64 modules in total per
RTU.
A CP-30 RTU can also have a second (redundant) CP-30 processor module.

Toolbox PLUS will automatically create variables in the dictionary corresponding to all the IO points in each
power supply, IO module or card.

Add New Module (CP-30) or Card (G30)
Select the RTU name in the navigation pane
Select New, Module

Once the module or card has been added to the RTU, module or card properties can be changed. Please
see the topic RTU Configuration - Module Properties for details.

Type:
(CP-30: AI-1/4, AI-10, AO-2, AO-3, CP-30, DI-1, DI-10, DI-5, DO-1, DO-2/5/6, IO-2, IO-3, IO-4, MC-30, MC-
31, PS-11/21)
(G30: IOD-MX2, IOD-MX3, IOD-MX4, PSO-ACR, PSO-DCU)
The type of module or card to be added to the RTU. A second CP-30 can be added to the RTU to provide a
redundant (backup) processor. Please see the Redundancy appendix for more information. Note: upgrading
the firmware in an MC-11 will turn it into an MC-30. Upgrading the firmware in a CP-30 will turn it into an MC-
31.

Slot [Not applicable to a G30]: (1-64) The position of the module on the backplane. A CP-30 RTU can have
up to 64 modules arranged as 4 racks of 16 modules. Slot numbers are hard-coded according to the type of
backplane (BA-4, BA-40, BA-6 or BA-12) and the rack number (1-4) of the backplane as illustrated below.
Rack number is set using switches on the backplane (default setting = rack 1). As shown below, the slot
numbers for a BA-4 or BA-40 do not start at 1. Slot numbers for a BA-4 or BA-40 are coded to follow on from
a BA-12 (for each rack number). Note: the slot numbers of all the modules installed in an online RTU can be
viewed by selecting the RTU in the navigation pane and then selecting Tools, Status.

BA-6
RACK 1 1 6
12
SLOT
BA-12
BA-6
RACK 2 17 22
28
SLOT
BA-6
RACK 3 33 38
44
SLOT
BA-6
RACK 4 49 54
60
SLOT
BA-4/40
13 16
29 32
45 48
61 64
BA-12
BA-12
BA-12
BA-4/40
BA-4/40
BA-4/40

For more information about how to link backplanes, please see the Kingfisher PLUS+ Hardware Manual.

RTU Configuration - RTU Properties
Allows the general settings of the RTU to be configured. Each RTU in the network should have a unique
address. A unique address ensures that only one RTU responds to each message.

Edit RTU Properties
Select Edit, Properties (or double-click the RTU name)

Address: (1-65520) Address 1 is commonly used
for the master RTU. Toolbox 32 and SCADA PCs
use addresses 250 to 255 in non-ISaGRAF
TM

systems. It is recommended that address 1 to 249
be used if this RTU is going to be used in a non-
ISaGRAF
TM
network.
System ID: (00 to FF Hex) The communications
sync character used to screen incoming messages.
An RTU will only respond to messages that have
the same sync character as this System ID. It is
recommended that the AE default be used except
when configuring an RTU to relay radio messages
as detailed in the topic RTU Configuration - Routes,
Relaying Radio Messages.
Name: (0 to 64 characters) Name of the RTU.
Description: (0 to 255 characters) Description of
the RTU.
Maximum Event Logs: (0-99,999, default =
10,000) The maximum number of event logs to
maintain in Flash memory. Once the maximum limit
is reached, the oldest event logs are overwritten.


RTU Configuration - Protocols
A protocol is a set of communication commands used to communicate with a device.

Multiple protocols can be used on each Ethernet port. All other ports support one protocol per port.

Allen Bradley, DNP3, Kingfisher, Modbus, SNMP, User Defined, HART and NTP protocols are all available.

The HART protocol can only be used with a HART option board and is automatically added to the RTU when
a HART port is added. All other protocols must be added to the RTU (as detailed below) before they can be
enabled on a port.

Add, Remove or Edit Protocol (to RTU)
Select the Protocols tab
Select the Add button to add a protocol OR select an existing protocol to edit
or remove and then select the Edit or Remove button


Protocols - Allen Bradley
Allows serial communications with an SLC500 PLC using the DF1 protocol in half duplex slave mode. The
data format is 8 data bits, 1 stop bit and no parity. Allen Bradley messages are generated using custom
ISaGRAF
TM
function blocks.

Protocols - Kingfisher
Developed for Kingfisher RTUs. Use of this protocol allows data to be transmitted through multi-level
networks and allows event logs to be uploaded from RTUs. RTU configurations can be downloaded to
remote RTUs and diagnostics can be carried out. Kingfisher messages are generated using custom
ISaGRAF
TM
function blocks.

Note: to store Kingfisher data from remote RTUs, Kingfisher network variables must be manually created.
Please see the appendix RTU Data - Protocols, Kingfisher Data, Network Register Variables for more
information.

Protocols - Modbus
A Kingfisher RTU can behave as a Modbus Master or a Modbus Slave or both a Modbus Slave and a
Modbus Master! Modbus protocol is supported on all RTU ports. Modbus TCP (over Ethernet) is only
supported on Ethernet ports.

Modbus extended addressing is supported allowing up to 65535 data points of each type to be accessed.

Modbus variables must be created in the Dictionary before Modbus data can be sent or received. Modbus
variables are detailed in the appendix RTU Data - Protocols, Modbus Data. Once Modbus variables have
been added to the Dictionary, each variable has settings that can be edited from the Dictionary.

Modbus ASCII: Allows the RTU to initiate and respond to messages using the Modbus function block in
Modbus ASCII data format.

Modbus RTU: Allows the RTU to initiate and respond to messages using the Modbus function block in
Modbus RTU data format.

Modbus TCP: Allows the RTU to initiate and respond to messages using the Modbus function block in
Modbus TCP/IP data format (over Ethernet).

Protocols - User Defined
Can be used on any serial port. Allows a new protocol to be created using the User Defined function blocks
in an ISaGRAF
TM
logic program.


Protocols - SNMP
SNMP is supported on all Ethernet ports. SNMP messages are generated using custom ISaGRAF
TM

function blocks.

The Simple Network Management Protocol (SNMP) was developed in 1988 to monitor and control devices
connected to Ethernet networks. The diagram below shows the basic SNMP components.

Manager

Agent

Query sent to Agent

Trap sent to Manager

Response to Query

SNMP Protocol

A Manager node can query an Agent
node at any time.
The Agent node can also send a status
message to the Manager node at any
time. This is called a Trap.
SNMP queries and traps can occur
simultaneously. There are no restrictions
on when the manager may query the
Agent or when the agent can send a trap
to the Manager.

The SNMP protocol implementations that are available are described below.

SNMP Trap: Allows the RTU to send and receive SNMP trap messages using ISaGRAF
TM
function blocks.

SNMP RMS Trap: Allows the RTU to send and receive RMS Systems SNMP trap messages using
ISaGRAF
TM
function blocks.

SNMP Client (Master): Provides a master (or client) interface that allows the RTU to query, retrieve and set
information associated with remote devices using ISaGRAF
TM
function blocks.

SNMP Daemon (Slave): Provides a slave (or server) interface which allows configuration and state
information for the RTU to be set, queried or retrieved by remote agents using SNMP. ISaGRAF
TM
function
blocks are not used for this implementation of SNMP. The configuration and state information of the RTU is
defined in the Semaphore MIB (as listed in the appendices) and includes:
RTU address and system identifier
RTU hardware modules and I/O states
Event log information
Network interface and traffic information.

SNMP Daemon has the following protocol settings that can be edited.

Public community name: public (default).
Private community name: private (default).

Protocols - HART
The HART protocol can only be used with a HART option board and is automatically added to the RTU when
a HART port is added to the RTU configuration. Messages can be initiated by the RTU using the HART
function block.


Protocols - DNP3
A Kingfisher RTU can act as a DNP3 Slave, a DNP3 Master or both a DNP3 Slave and a DNP3 Master! The
RTU can respond to DNP3 messages (DNP3 Slave), initiate DNP3 messages using DNP3 function blocks
(DNP3 Master) or forward DNP3 messages. DNP3 has various protocol settings that can be edited as
detailed below.

Note: if the RTU only needs to forward DNP3 messages, DNP3 variables do not need to be configured.
DNP3 messages will be forwarded if a route has been configured for the target RTU and the DNP3 protocol
is enabled on that port. The communication timeout and retry parameters associated with this route are
applied to the DNP3 messages forwarded through the RTU.

Once local DNP3 variables have been added to the Dictionary (as shown below), each variable has settings
that can be edited from the Dictionary. If data is to be polled from a remote DNP3 device, additional DNP3
variables will need to be created for storing the remote DNP3 device data.

DNP3 variables for the local RTU are
automatically created in the Dictionary according
to the settings below.
Number of Binary Inputs: (0-65000).
Number of Binary Outputs: (0-65000).
Number of Binary Counters: (0-65000). Note:
Frozen Counters can also be manually created in
the Dictionary. Binary Counter values will then be
copied into the corresponding Frozen Counters
(with the same object number) following the
appropriate DNP command.
Number of Analog Inputs: (0-65000)
Number of Analog Outputs: (0-65000)
The format of local and network DNP3 variables
that can be created are detailed in the appendix -
RTU Data, Protocols, DNP3 Data.
Defaults: Default DNP3 settings to use when the
DNP3 variables are created in the dictionary.

Maximum Transmit Fragment: (14-2048,
default=2048).
Maximum Transmit Frame: (14-292,
default=292).
Link Layer Confirmation: (Never not for any
frame [default], Only for multiframe message
fragment, Always for all frames).
Link confirmation timeout (milliseconds): (1-
65535, default=1000).
Maximum Retries: (0-65000, default=3).
Permit multi-fragment responses: (Tick to
enable).
Require application confirmations for non-
final fragments: (Tick to enable). Default =
disabled.

Timer Poll (milliseconds): (1-65535).
Application layer confirmation timeout
(milliseconds): (1-65535).
Select timeout (milliseconds): (1-65535).

Enable unsolicited reporting: (Tick to enable)
When enabled, the RTU will automatically send
an unsolicited report if there is new Class 1, 2 or 3
data (when enabled respectively). This setting is
used for setting up DNP3 slave functionality.
Destination address: (1-65535). One or more
addresses of remote DNP3 device(s) to send the
unsolicited report to. Multiple addresses are
entered separated by commas. Example: 5,6,7
Unsolicited reporting permitted for Class 1,
Class 2, Class 3: (Tick to enable) The class of
data to monitor and report any changes.

Require authentication for critical functions:
(Tick to enable) Used for DNP3 Slave RTUs when
security is required. When enabled, an Update
key can be entered (consisting of 16 hexadecimal
bytes). This Update key must then be provided by
a DNP3 master device before it can request a
critical function.
For a DNP Master RTU, authentication is
configured for each route that is used to
communicate with a Secure DNP3 Slave RTU.
Critical functions requiring authentication
(according to the DNP3 Secure Authentication
standard) are: Write; Select; Operate; Direct
operate; Direct operate no acknowledgement;
Cold restart; Warm restart; Initialise application;
Start application; Stop application; Enable
unsolicited messages; Disable unsolicited
messages; Record current time; Authenticate;
and Activate configuration.
Session key timeout (0-99999 minutes): The
Update key is used to create an initial session
key. The session key is automatically changed
each Session Key Timeout interval to protect
against replay attacks.
Authentication reply timeout (2-600 seconds):
How long to wait for a reply to the initial
authentication message.

Mapping is useful for data concentration.
DNP3 objects obtained from remote RTUs can be
stored as if they are objects in the local RTU.
To prevent local and remote objects clashing,
objects from the remote RTU are given an offset.
Select the Add button to add a new mapping or
select an existing mapping and then select the
Edit or Remove buttons.
Eg. The local RTU has address 1. A Mapping is
configured with Address=2 and Local
Offset=1000. When DNP objects are polled from
remote RTU2, the objects are stored in RTU1 as
follows:
Remote RTU2 Local RTU1
DNP2BI1 DNP1BI1001
DNP2AI1 DNP1AI1001
etc

Protocols - NTP
The Network Time Protocol can only be used on CP-30 Ethernet port one and allows the RTU time to be
synchronized with a local or remote time server.

Time Server: IP address of the local or remote
time server.
Update Interval (seconds): How often to check
and update the RTU time.


RTU Configuration - Ports
A CP-30 RTU has one to 16 communication ports. A G30 has two or three ports.

Once a port has been added to the RTU configuration, settings can then be configured for each Ethernet,
Serial, Dialup, Line, HART, Spread Spectrum Radio or USB port.

Add, Remove or Edit Port
Select the Ports tab
Select the Add button to add a port (enabled if there is still room in the RTU)
OR select an existing port in the list and then select the Edit or Remove
button

Add: The fixed ports for a CP-30, MC-31, G30 or
MC-30 are automatically added to the Port list. Option
ports can be added by selecting the Add button.
CP-30 / MC-30/31 option ports: Option I - Isolated
Serial, Option S - Non-isolated Serial, Option F -
Fibre Serial, Option D -Dialup Modem, Option L - 2/4
Wire Line, Option H - HART, Option R2 - Spread
Spectrum [Australia], Option R3 - Spread Spectrum
[international], Option R4 - Spread Spectrum [USA]
and Option T2 Ethernet.
G30 option ports: OPT-SER - Isolated Serial, OPT-
LINE 2/4 Wire Line and OPT-HART HART.
A CP-30, MC-31 and MC-30 have one fixed port and
two option ports. A G30 has two fixed ports and one
option port as shown below.

PORT 1 Ethernet (Fixed)
PORT 2 - Option Board
CP-30 / MC-31

PORT 1 Serial (Fixed)
MC-30

PORT 1 Ethernet (Fixed)
PORT 2 USB (Fixed)
G30

Edit: Allows parameters for the selected port to be
configured.
Remove: Option ports that have been added can
be removed from the list.


Ports - Ethernet
Supported by all CP-30/MC-31 ports (1 to 3), MC-30 ports 2 and 3 and G30 ports 1 and 3. When the port is
edited, the following settings are available:

IP Address: (Default=192.168.0.1) A local area
network may be used to communicate with the
RTU. A valid IP (internet protocol) address may be
obtained from the network administrator. Each
number in the IP address can have values in the
range of 0-255. The IP address can then be used by
Toolbox PLUS to communicate with the RTU via
Ethernet.
Subnet Mask: (Default=255.255.255.0) Allows for
detailed configuration of devices on a LAN. The
default setting is used in most cases. Each number
in the Subnet Mask can have values in the range of
0-255.
Gateway: (Default=192.168.0.254) The IP address
that allows access to the outside world for
communications to an RTU on another local area
network. Each number in the Gateway IP address
can have values in the range of 0-255.
Protocols: (Tick to enable) Protocols already
added to the RTU can be enabled on the port. More
than one protocol can be enabled on an Ethernet
port.

Note: The Ethernet Settings for CPU port 1 of the selected RTU can be viewed by pressing F12.

Ports - Serial
Supported by G30 port 3, CP-30/MC-31 ports 2 and 3 and MC-30 ports 1 to 3. The following information
applies to Option - S, I and F serial ports. When the port is edited, the following settings are available:

Type: (RS232 [default], RS422 or RS485) RS232
- serial communications with RTS-CTS control.
RS422 - serial communications used for multiple
RTUs connected to a four-wire highway. RS485 -
serial communications used for multiple RTUs
connected to a two-wire highway. Option - F serial
ports always use RS232.
Bits per second: (9600, 19200, 38400, 57600
[default], 115200) The speed at which the RTU
will send or receive messages.
Protocols: (Tick to enable) A protocol already
added to the RTU can be enabled on the port.
Only one protocol can be enabled.

Pre-Transmission delay (milliseconds): (0
[default] -65000) How long the carrier and RTS
are transmitted for before data is sent. Typically
set to zero for PSTN modems or 10 ms for RS485
and RS422.
Post-Transmission delay (milliseconds): (0
are transmitted for after the data has been sent.
Typically set to zero for PSTN modems or 0 to 10
ms for RS485 and RS422.
Quiet time (milliseconds): (0 [default] -65000)
The minimum amount of quiet time (no received
messages) for the port that the RTU will wait
before sending a message. Messages to be
relayed using the same port will be delayed by
this amount of time before being forwarded.

Enable external modem support: (Tick to
enable) When enabled, allows an external PSTN
modem to be connected to the serial port. Modem
settings can then be configured as for a Dialup
port as detailed below. Not applicable to Option F
- Fibre Serial ports.


Ports - Dialup
The Dialup option board is supported by CP-30/MC-30/MC-31 ports 2 and 3. For external PSTN modems,
please see the topic Ports Serial above. When the dialup port is edited, the following settings are available:

Bits per second: (9600, 19200, 38400, 57600,
115200) The speed at which the RTU will send or
receive messages. When using a PSTN modem
to dial a paging service, se to 9600 if
experiencing problems connecting reliably.
Data Bits: (5, 6, 7, 8 [default]) Number of data
bits used for each character in the message.
Parity: (None [default], Even, Odd)
Stop Bits: (1[default], 2) Number of stops bits
used after each character in the message.
added to the RTU can be enabled on the port.
Only one protocol can be enabled.

are transmitted for before data is sent. Typically
set to zero for PSTN modems.
are transmitted for after the data has been sent.
Typically set to zero for PSTN modems.
Quiet time (milliseconds): (0 [default] -65000)
The minimum amount of quiet time (no received
messages) for the port that the RTU will wait
before sending a message. Messages to be
relayed using the same port will be delayed by
this amount of time before being forwarded.

Initialisation string: (default string:
AT&FTE0V0S0=2&W) These characters are sent
to the modem to initialise it after startup, after
disconnection and if a dial attempt fails. Note: for
dial option boards X3 can be added to the default
string if the modem is unable to recognize the dial
tone or is experiencing problems establishing a
connection ie: AT&FTE0V0S0=2X3&W
Dial timeout (seconds): (0-10000) The time
from when dialing begins that is waited to receive
carrier detect (carrier detect occurs a short time
after the receiving modem has answered). When
dialing a GSM, the Dial Timeout should be set to
at least 45 seconds.
Inactivity timeout (seconds): (0-10000) The
RTU will hang up after this amount of time has
elapsed since the last message received. A value
of 0 disables the function.
Hangup timeout (seconds): (0-10000) The RTU
will hang up after this amount of time has elapsed
after connection or after sending the last
message. A value of 0 disables this function.

Remaining Online
To remain online after connection, set Inactivity timeout to 0 and Hangup timeout to 0 in both RTUs in the
dialup link. If the line is disconnected, the RTU will reconnect when the next TX or RX message is initiated
from ladder logic.

Dialing A Paging Service
If experiencing problems, error correction may need to be disabled by including '\N0' ie.
AT&FE0V0S0=2\N0&W. If experiencing problems when using an MC module and a Dial option board, the
baudrate may need to be limited to 9600 by including F8 in the initialisation string ie. AT&FE0V0S0=2F8&W.

Ports - Line
Line-2 option boards are supported by CP-30/MC-30/MC-31 ports 2 and 3 and G30 port 3. When the port is
edited, the following settings are available:

Bits per second: (1200) The Line 2/4 option board
always operates at 1200 bps.
added to the RTU can be enabled on the port. Only
one protocol can be enabled.

[default] -65000) How long the carrier and RTS are
transmitted for before data is sent. Analog radios
typically require a Pre-Transmission delay of 300
ms while private lines use 50 to 100 ms.
transmitted for after the data has been sent. Analog
radios typically require a Post-Transmission delay of
100 ms while 50 ms is used for private lines.
Quiet time (milliseconds): (0 [default] -65000) The
minimum amount of quiet time (no received
messages) for the port that the RTU will wait before
sending a message. Messages to be relayed using
the same port will be delayed by this amount of time
before being forwarded.


Ports - HART
HART option boards are currently supported by CP-30/MC-30/MC-31 ports 2 and 3 and G30 port 3. When
the port is edited, the following settings are available:

Bits per second: (1200) The HART option board
always operates at 1200 bps.
Protocols: The HART protocol is automatically
added and enabled when the HART option board is
added to the RTU. The HART protocol can be
removed by removing the port from the RTU
configuration.

transmitted for before data is sent. Set to 10 ms or
greater to suit the particular HART device.
transmitted for after the data has been sent. Set to
15ms or greater to suit the particular HART device.


Ports - Spread Spectrum Radio
Spread Spectrum radio option boards are currently supported by CP-30/MC-30/MC-31 ports 2 and 3. There
are three Spread Spectrum radio option boards available: R2 for Australia, R3 for International [low power]
and R4 for the USA. When the port is edited, the following settings are available:

Bits per second: (9600 or 19200) The R2 and R4
Spread Spectrum Radio option boards operate at
9600 bps. The R3 option board operates at 19200
bps.
added to the RTU can be enabled on the port. Only
one protocol can be enabled.

[default] -65000) How long to transmit the carrier
and RTS for before data is sent.
[default] -65000) How long to transmit the carrier
and RTS for after data has been sent.

Point to point mode: (Point to Point or Point to
Multipoint)
Vendor ID: (0-65535, default=13106) Sets the ID
number of the Spread Spectrum radio. All radios on
the same network need to have the same Vendor ID
in order to communicate with each other. It is
recommended that Vendor ID be changed to avoid
interference with other radio networks.
Destination address: (0-65535, default=65535)
Sets the Destination address of the Spread
Spectrum radio. All radios on the same network
need to have the same Destination Address in order
to communicate with each other. It is recommended
that Destination Address be changed to avoid
interference with other radio networks.
Hopping pattern: (0-6, default=0) Sets the Hopping
pattern of the Spread Spectrum radio. All radios on
the same network need to have the same Hopping
pattern to enable them to communicate. To
minimise interference from another RTU using a
spread spectrum radio, a hopping channel number
that is different to the offending radio should be
used.


Ports - USB
Only applicable to G30. A G30 has one fixed USB port that can be used to connect a USB storage device.
The G30 is then able to store images on the USB storage device. The images can be accessed using DNP3
File Transfer or by manually connecting the USB storage device to a PC.

Use External USB Storage if Available: (Tick to
enable) When enabled, the G30 will regularly check
if a USB storage device is connected to the USB
port. If present, images [if available] will then be
saved to the storage device.


RTU Configuration - Routes
Routes tell the local RTU how to communicate with other remote RTUs or devices in the network. Routes
only need to be configured for remote RTUs that the local RTU initiates messages to. If an unsolicited
message is received from a remote RTU, the new Route will be automatically added to the RTUs working
configuration.

Add, Remove or Edit Route
Select the Routes Tab
Select the Add button to add a route OR select an existing route in the list
and then select the Edit or Remove button

The following settings are available when adding or editing a route.

Target RTU: (0-65520) The address of the
destination RTU to communicate with.
System ID: (00 to FF Hex, default=AE) This is
the communications sync character used at the
start of outgoing Kingfisher messages. An RTU
will only respond to Kingfisher messages that
begin with the same System ID as the RTU's own
System ID (as configured in the RTU Properties).
It is recommended that AE be used for all
Kingfisher PLUS+ RTUs except when relaying
radio messages as detailed in the topic below
Routes - Relaying Radio Messages. System ID is
not used by other protocols.
Route: (Direct or Indirect) Direct means the RTU
is directly connected to the target RTU (eg. via a
private line or radio link). Indirect means the RTU
must communicate via one or more other
intermediate RTUs to access the target RTU.
When an RTU receives a message that is not for
itself, it will forward the message to the target
RTU if it has a route configured for that target
RTU.
Port / Via RTU: For a Direct connection, this is the local port number to be used to communicate with the
target RTU. For an Indirect connection, this is the directly connected RTU address via which the message
must next be sent to reach the target RTU.
IP Address: The IP (internet protocol) address of the target RTU. A valid IP address may be obtained from
the network administrator. Each number in the IP address can have values in the range of 0-255.
Protocols: The protocol to use when communicating with the directly connected RTU. Protocols must first
be added to the RTU configuration and enabled on the port before they can be used on a route (please see
the topic RTU Configuration - Protocols).


Timeout: (0-1,000,000 milliseconds [1000
milliseconds = 1 second]) The time that an RTU
will wait for a reply to its first message. If Retries
(see below) is set to 1 or greater and a reply is
not received, the RTU will send the message
again after the timeout has expired.
Retries: (0-999) The number of times the RTU
will retry sending a message to the target RTU if
the previous attempts have failed. The maximum
number of attempts is one more than the Retries
setting. Eg if Retries is 3, the RTU will have up to
4 attempts at sending a message. Note: when
dialing an RTU, the RTU will dial the primary
phone number up to Retries+1 times and then will
dial the Secondary phone number up to Retries+1
times until the PSTN modem successfully
connects or all the dial retries have failed.
Enable DNP3 Secure Authentication: (Tick to
enable). Use this option when the local RTU is a
DNP3 Master and is communicating with a DNP3
Slave that uses security. When enabled, an
Update key can be entered.
Session key timeout (0-99999 minutes): The
Update key is used to create an initial session
key. The session key is automatically changed
each Session Key Timeout interval to protect
against replay attacks.
Authentication reply timeout (2-600 seconds):
How long to wait for a reply to the initial
authentication message.


Example Network

RTU1 can communicate directly with RTUs 2 and 3. RTU3 can also communicate directly with RTU4. RTU1
can communicate indirectly with RTU4 by RTU3 acting as a store-and-forward RTU (it stores the incoming
message and then forwards it to the next RTU). Note: indirect routes can have more than one store-and-
forward RTU.

Master
RTU1
RTU2 RTU3 RTU4
CP-30
Port 2
Direct Route
Indirect Route
CP-30
Port 2
CP-30
Port 2
CP-30
Port 3

The routes for the above network are shown below.

RTU1 Routes

RTU2 Routes

RTU3 Routes

RTU4 Routes


Routes - Relaying Radio Messages
For the radio system below, RTU1 communicates with RTU3 by sending a message to RTU2. RTU2 then
forwards the message to RTU3. Due to the radio setup, it is sometimes possible for RTU3 to receive the
indirect message that is sent to RTU2. This can cause communication fails since RTU3 will respond to the
message at the same time RTU2 is attempting to forward the message.

To prevent both RTU2 and RTU3 responding at the same time, RTU2 and RTU3 are configured with unique
system IDs as shown below. RTU1 sends the indirect message to RTU2 with a System ID of A1. RTU3 will
only respond to messages with a system ID of A2 and so ignores the message. When RTU2 forwards the
message to RTU3, the message is sent with a System ID of A2. RTU3 then responds to the message.
Note: System IDs 00, AC, A5 and FF are reserved and should not be used.

Target RTU System ID Route
RTU1
RTU3
RTU2
System ID=A1
System ID=A2
System ID=AE
Target RTU System ID Route
Port 4
Target RTU System I D Route
1 AE Indirect via RTU 2
Port 5
Port 6
Weak radio signal
Strong radio signal
Strong radio signal
2 A1 Direct via Port 6
3 A2 Indirect via RTU 2
1 AE Direct via Port 5


RTU Configuration - Phone
If the local RTU uses a PSTN port to communicate with a remote RTU, the phone number configured here
for that remote RTU address will be automatically dialed by the local RTU.

Add, Remove or Edit Phone Number
Select the Phone tab
Select the Add button to add a phone number OR select an existing phone
number in the list and then select the Edit or Remove button

The following settings are available when adding or editing a phone number.

Target RTU: (0-65520) The address of the destination
RTU to dial.
Primary phone number: The initial phone number to
dial. If connection fails, the RTU will dial the Primary
phone number again up to Retries more times (as
configured for the port). Spaces used in the phone
number will be ignored by the modem.
Secondary phone number: The backup phone
number to dial if the Primary phone number fails. If
connection fails, the RTU will dial the Secondary
phone number up to Retries more times. Spaces used
in the phone number will be ignored by the modem.


RTU Configuration - Programs
One or more programs can be added to the RTU to provide logical intelligence. When editing a program,
Toolbox PLUS launches the ISaGRAF
TM
Workbench editor. Programs or function blocks can also be
imported from other RTU configurations or projects.

Add, Remove or Edit Program
Select the Programs Tab
Select the Add button to add or import a program OR select a program in the
list and then select the Edit or Remove button to edit or remove a program


Programs can be added in the following IEC 61131 Languages:
Instruction List (IL) is a low level language. Instructions always relate to the current result (or IL
register). The operator indicates the operation that must be made between the current value and the
operand. The result of the operation is stored again in the current result.
Functional Block Diagram (FBD) is a graphic language. It allows the programmer to build complex
procedures by taking existing functions from the standard library or from the function or function block
section.
Ladder Diagram (LD) is a graphic representation of Boolean equations, combining Contacts (input
arguments) with Coils (output results). The LD language enables the description of tests and
modifications of Boolean data by placing graphic symbols into the program chart. LD graphic symbols
are organized within the chart exactly as an electric Contact diagram. LD diagrams are connected on the
left side and on the right side to vertical Power Rails. Please see the topic ISaGRAF
TM
Logic Examples
for Ladder Diagram examples.
Sequential Function Chart (SFC) is a graphic language used to describe sequential operations. The
process is represented as a set of well defined Steps, linked by Transitions. A Boolean Condition is
attached to each Transition. A set of Actions are attached to each Step. For programs, Conditions and
Actions are detailed using three other languages: ST, IL, or LD. For function blocks, Conditions and
Actions are detailed using only two other languages: ST or LD. From Conditions and Actions, any
Function or Function Block in any language can be called.
Structured Text (ST) is a high level structured language designed for automation processes. This
language is mainly used to implement complex procedures that cannot be easily expressed with graphic
languages. ST language can be used for the description of the actions within the Steps and conditions
attached to the Transitions of the SFC or the Actions and Tests of the FC language.
Flow Chart (FC) is a graphic language used to describe sequential operations. A Flow Chart diagram is
composed of actions and tests. Between actions and test are oriented links representing data flow.
Actions and tests can be described with ST, LD or IL programs. Functions and Function blocks of any
language (except SFC) can be called from actions and tests. A Flow Chart program can call another
Flow Chart program. The called FC program is a sub-program of the calling FC program.


RTU Configuration - Module Properties
Modules and cards have properties that can be configured after the module or card has been added to the
RTU configuration (as detailed in the topic RTU Configuration - Add Modules).

Edit Module (CP-30) or Card (G30) Properties
Select the module or card in the workspace
Select Edit, Properties (or double-click the module or card in the workspace)
Select the Configuration or Ports tab

The following modules and cards have configurable properties: PS-11/21, CP-30/MC-31, MC-30, AI-1/4, AI-
10, DO-1/2/5/6, IO-2/3/4, DI-10, G30, MX-2, MX-3, MX-4, PSO.

CP-30/MC-31 Properties

Port 1 of a CP-30/MC-31 is an Ethernet port.
Up to 2 option ports can also be added, removed
or edited (please see RTU Configuration - Ports
for more information)

MC-30 Properties

Port 1 of an MC-30 is a serial port.
Up to 2 option ports can also be added, removed
or edited (please see RTU Configuration - Ports
for more information)

PS-11/21 Properties

Battery Type: (Generic, Sealed Lead-Acid or
NiCad) The battery type to be charged by the
power supply. The PS-11/21 has intelligent
battery charging that is varied according to the
battery type.
Battery: (6, 7, 10, 12, 17, 18 or 25 AH) The size
of the battery to charge.


AI-1/4 Properties

Scan Rate: (1 to 10 seconds, default=8 seconds)
How often to scan all the analog input channels.

AI-10 Properties

Channel 1-8: (None, 4-20 mA, 0-20 mA [default],
+/- 10V, 40mA; +/- 5V, 20mA and +/- 2.5V, 10mA)
The current or voltage input range for that
channel. Each channel can be configured
individually.
When None' is selected the default 0-20 mA
range is used by the AI-10 module for that
channel.
For the 0-20 mA or 4-20 mA ranges, the input will
return zero if the current is negative or below 0 or
4 mA respectively.
When using the +/- channel ranges, the AI-10
sets bit 16 of the analog input register if the
current is negative. If the input goes slightly
negative (when floating around 0%), the analog
input register will return a very large value (0 neg.
to -20mA =65535 to 32768 respectively). To
prevent unnecessary exception reports, bit 16
should be ignored.

DO-1/2/5/6, IO-2/3/4 Properties

Failsafe Outputs: (Tick to enable) If enabled and
there is no comms activity between the processor
and any module on the backplane for 10 seconds
the module assumes that the processor has
failed and sets the outputs OFF (open). If not
enabled (default), all digital outputs will hold their
last value. Note: failsafe outputs are not currently
implemented for the IO-4 module.


DI-10 Properties

Channel Inversion: (Tick to enable each channel
or select Ch Inv button to enable all channels) By
default, when an input channel is energised, a
logical 1 is recorded in the input register and the
channel LED is set ON. If the channel is inverted,
when the input channel is energised, a logical 0
will be recorded in the input register and the
channel LED will be set OFF.
Sequence-of-Events: (Tick to enable each
channel or select Seq of Ev button to enable all
channels) When SOE is enabled, any change of
state of the input channel (an event) is recorded
in the event log to an accuracy of 1 millisecond.
Note: The DI-10 has an internal buffer with
enough space for 1000 event logs. This means
that a DI-10 can cope with bursts of up to 1000
events at a time. Events are uploaded into the
processor module at a maximum rate of 100
events per second allowing the DI-10 to cope with
events at a sustained rate of 100 events per
second. Events are stored in a circular buffer -
which causes the oldest event to be overwritten
with the newest event when the buffer is full.
Debounce Filters: (None, 1ms, 3ms, 10ms, 30ms, 100ms, 250ms and AC Filter) The value in the digital
input register will not update until the input channel has been at the new state continuously for the Debounce
Filter time. Debounce filters are applied to groups of 4 channels as shown above. 'AC Filter' is used when
connecting AC inputs to the DI-10 module.
Counter Inputs: (Frequency, Pulse or Quadrature) The DI-10 can have up to 7 counter inputs which are
stored as 16-bit unsigned integer values. Counters can be used on any input channel(s). Note: quadrature
counting works on pairs of input channels. Channel pairs are 1&2, 3&4, 5&6, 7&8, 9&10, 11&12, 13&14 and
15&16. So selecting Quad Count on channel 1 will actually work with quadrature on channels 1 and 2.
Selecting Quad Count on channel 2 will also work with quadrature on channels 1 and 2, but will reverse the
phase of the inputs. The same applies to the other channel pairs used for quadrature inputs.
Sequence-Of-Events Logs: The User Type (1-31) and Priority (0-7) applied to event logs generated for
channels enabled for Sequence-Of-Events logging. User Type can be used to filter similar types of logs
within the event log list. For example SOE logs could be type 1 while analog input logs could be type 2. It will
then be possible to only upload type 1 SOE logs or type 2 analog input logs instead of having to upload all
the event logs together.

G30 Properties

Port 1 of a G30 is an Ethernet port and port 2 is a
USB port.
One option port can also be added, removed or
edited (please see RTU Configuration - Ports for
more information)


IOD-MX2 Properties

Analog Inputs scan rate (ms): (4, 16, 20) How
often to scan all the analog inputs.
User type: (0-31) The number applied to event
logs generated for channels enabled for
Sequence-Of-Events logging. User Type can be
used to filter similar types of logs within the event
log list. Eg. SOE logs could be type 1 while
analog input logs could be type 2. It will then be
possible to only upload type 1 SOE logs or type 2
analog input logs instead of having to upload all
Priority: (0-7) Allows separation of logs within
each User Type category.
Log Mode: (Freeze, Wrap). Freeze stops
generating new event logs when the buffer is full.
Wrap overwrites the oldest event logs when the
buffer is full.

Mode: (Normal, Frequency, Counter) How to treat
the input signal. Normal sets the input value to 0
or 1. Frequency counts the number of pulses per
second (Hz). Counter records the total number of
rising edges (or falling edges if Invert is enabled).
Debounce: (0- ms) The digital input value will not
update until the input channel has been at the
new state continuously for the Debounce time.
SoE: (Tick to enable) When enabled and Mode is
set to Normal, generates an event log whenever
the input value changes state.
Invert: (Tick to enable) By default, when the input
channel is energised, the value is set to 1. When
the input channel is energised and the channel is
inverted, the value is set to 0.


Mode: (Normal, Frequency, Pulse) The output
channel mode. The output is set according to the
Value parameter of the channel variable. Eg.
SL01MX2DO1.value is the output value for MX2
DO Ch1. Normal sets the channel to open or
closed according to Value (0=open, >1=closed).
Frequency outputs a 50% duty cycle signal with a
frequency of Value Hz. Pulse outputs Value
pulses according to the configured Pulse On and
Pulse Off settings (as detailed below).
Pulse On / Pulse Off: [Only available when Mode
is set to Pulse] (0-16000 ms) The pulse On and
Off times to be used when outputting pulses in
Pulse mode.
Failsafe: (Tick to enable) If enabled and the IO
card loses communications with the G30, the
output will be set to the configured value (as
detailed below). If failsafe is not enabled (default),
the output will hold last state.
Value: (Tick=Closed [ON]) The output state to set
if failsafe is enabled and triggered.

Mode: (Current, Voltage)
Range: (0-20mA, 4-20mA, 0-5V, 1-5V) The
available range settings change according to the
Mode setting.


IOD-MX3 Properties
The IOD-MX3 has the same configuration windows as the IOD-MX2. It also has an analog output
configuration window as shown below.

Mode: (Current, Voltage)
Range: (0-20mA, 4-20mA, 0-5V, 1-5V) The
available range settings change according to the
Mode setting.
output will be set to the configured value (0-
100%). If failsafe is not enabled (default), the
output will hold last value.


IOD-MX4 Properties

User type: (0-31) The number applied to event
logs generated for channels enabled for
Sequence-Of-Events logging. User Type can be
used to filter similar types of logs within the event
log list. Eg. SOE logs could be type 1 while
analog input logs could be type 2. It will then be
possible to only upload type 1 SOE logs or type 2
analog input logs instead of having to upload all
Priority: (0-7) Allows separation of logs within
each User Type category.
Log Mode: (Freeze, Wrap). Freeze stops
generating new event logs when the buffer is full.
Wrap overwrites the oldest event logs when the
buffer is full.

Mode: (Normal, Frequency, Counter) How to treat
the input signal. Normal sets the input value to 0
or 1. Frequency counts the number of pulses per
second (Hz). Counter records the total number of
rising edges (or falling edges if Invert is enabled).
Debounce: (0- ms) The digital input value will not
update until the input channel has been at the
new state continuously for the Debounce time.
SoE: (Tick to enable) When enabled and Mode is
set to Normal, generates an event log whenever
the input value changes state.
Invert: (Tick to enable) By default, when the input
channel is energised, the value is set to 1. When
the input channel is energised and the channel is
inverted, the value is set to 0.

Mode: (Normal, Frequency, Pulse) The output
channel mode. The output is set according to the
Value parameter of the channel variable. Eg.
SL01MX2DO1.value is the output value for MX2
Ch1. Normal sets the channel to open or closed
according to Value (0=open, >1=closed).
Frequency outputs a 50% duty cycle signal with a
frequency of Value Hz. Pulse outputs Value
pulses according to the configured Pulse On and
Pulse Off settings (as detailed below).
Pulse On / Pulse Off: [Only available when Mode
is set to Pulse] (0-16000 ms) The pulse On and
Off times to be used when outputting pulses in
Pulse mode.
output will be set to the configured value (as
detailed below). If failsafe is not enabled (default),
the output will hold last state.
Value: (Tick=Closed [ON]) The output state to set
if failsafe is enabled and triggered.

PSO-ACR/DCU Properties

Battery Capacity: (7Ah, 10Ah, 12Ah, 17Ah,
18Ah, 25Ah) The size of the battery to charge.


6. Dictionary

Topic Description
Variables Overview
New Variables How to create variables
Edit Variables How to configure settings for each variable


Dictionary - Variables

View RTU Variables
Select Dictionary in the Wonder Bar

The RTU uses variables to store and access data and these are kept in the Dictionary. These variables are
also used by ISaGRAF
TM
Workbench logic programs (variables are called symbols in ISaGRAF
TM
).

As IO modules are added to an RTU, Toolbox PLUS automatically adds variables to the dictionary for all the
data that is available from that IO module.

Dictionary variables are downloaded along with the logic programs (even if there are no logic programs).

New variables can be created and existing variables can be edited.

System variables can be added to the dictionary to allow access to internal RTU data. Please see the
appendix RTU Data for details.

An example Dictionary view for an RTU with various types of variables is shown below.

Filter
The dictionary can be filtered so that only variables that contain the characters specified in the filter are
displayed. A blank filter will display all the variables. Alternatively, variables starting with the characters
entered in the Filter box will be displayed when the Filter button is selected. Note: the Filter can be cleared
by selecting the Clear button and then selecting the Filter button again.

Sort
All the variables are alphabetically and numerically sorted when Name, Type, Description or Initial Value is
clicked. To sort the variable groups select the grey arrow on the left side of Name.

Dictionary - New Variables

New Variable
Select Dictionary in the Wonder Bar
Select the New button (located above the variable list)
To create a range of variables, select the Multiple tab

After adding a variable to the dictionary, variable settings can be edited as detailed in the next topic.

Dictionary - Single Variables
This window allows a single variable to be created. To create a range of variables please see the next topic.

Name: (1-127 * characters) The variable name.
Variable names must start with a letter.
Only the first 16 characters of variable names are
event logged.
Variable names can contain the letters a to z or A
to Z (lower or upper case), the digits 0 to 9 or the
underscore character _. Variable names cannot
contain spaces.
Variables starting with the underscore character
are reserved for use by Semaphore and
ISaGRAF
TM
.
Egs: Pump5_Running - OK name.
Pump#5 Running - Bad name. Variable names
cannot use the hash (#) character or spaces.
Note: reserved ISaGRAF
TM
keywords cannot be
used as variable names (please see Appendix
ISaGRAF
TM
- Reserved Variable Names for a
complete list).
When an Kingfisher, Modbus or DNP3 variable is
created, it will be displayed with the corresponding
symbol ( , or respectively). User variables
that are not recognized by Toolbox PLUS are
displayed with the symbol.
Group: (Analog Inputs, Analog Outputs, Digital Inputs, Digital Outputs, DNP Variables, General, Kingfisher
Registers, Modbus Variables, user defined) The name of the Dictionary group to display the variable in.
To create a new group name, select the button.
Initial Value: (Blank or number or text contained within single quotes) If specified, this is the initial value
used by the logic program after the configuration is first downloaded, after a restart or after a power reset.
The value of a variable can be saved during a restart by enabling Retain variable across system restarts
(please see below). The format of values that can be used for each variable type is detailed in the ISaGRAF
help.
Type: The data type of the variable. ISaGRAF
TM
supports a wide range of data types as detailed in the topic
ISaGRAF Variable Types.
Comment: (0-128 characters) Description of the variable.
Retain variable value across system restarts: (Tick to enable) when enabled, the variables last known
value is saved and restored after a restart. The last known value will not be saved and restored if there is a
power reset. After a power reset, the variables Initial Value will be used.
* Some SCADA programs only support variable names up to 16 characters. Limiting Toolbox PLUS variables to 16
characters allows easy integration of the Toolbox PLUS database into these SCADA programs.

Dictionary - Multiple Variables

A range of variables can be created by selecting the Multiple tab (available when creating a new variable).
The following parameters can be specified:

Format: (Free, DNP, Modbus, Kingfisher). If
DNP, Modbus or Kingfisher is selected, the
variable Prefix will be set to DNP, MOD or KF
respectively and the Data type will be
automatically configured for each variable Type.
Prefix: The beginning characters of the variable
names Eg. KF. Can only be configured if Format
is set to Free.
Group: (Analog Inputs, Analog Outputs, Digital
Inputs, Digital Outputs, DNP Variables, General,
Kingfisher Registers or Modbus Variables) The
name of the Dictionary group to display the
variable in. To create a new group, select the
button.
RTU Address: (1-65520) The source of the
variables. Use the local RTU address to create
variables for use by the local RTU. Use the
address of a remote RTU to create variables for
data received from that remote RTU.
Type: The characters to insert between the RTU
address and the register number.
DNP Types: AI (Analog Input), AO (Analog
Output), BC (Binary Counter), FC (Frozen
Counter), BI (Binary Input) and BO (Binary
Output).
Modbus Types: C (Coil), D (Discrete), H (Holding)
and I (Input).
Kingfisher Types: R (Local Register), N (Network
Register) and F (Floating Point Register)
Register Range: The register numbers to use for
the variables.
Data Type: The data type of the variable.
Example: ISaGRAF
TM
supports a wide range of
data types as detailed in the topic ISaGRAF
Variable Types.
The Description at the bottom of the window
shows the range of variables that will be created
when OK is selected.


Dictionary - Edit Variables

Edit Variable
Select the Dictionary wonder bar
Double-click on the variable to be edit (or right-click,
select Edit)

DNP and Modbus variables have settings that can be edited as detailed below.

Dictionary - Modbus Variables

Name: (1-127 characters) Modbus variable name.
Group: The name of the Dictionary group to
display the variable in. To create a new group
name, select the button.
Initial Value: (0-65535) The initial value used by
the logic program.
Type: (BOOL, DINT) The variable type. Type can
be changed if the variable Name is changed (ie.
to another Modbus variable type).
Comment: (0-128 characters) Variable
description.
Retain variable across system restarts: (Tick to
enable) When enabled, preserves the variable
value when the RTU is restarted.

Map to I/O channel: (No Mapping [default] or I/O
channel) If the I/O channel is an output, the
Modbus variable is mapped to the I/O channel. If
the I/O channel is an input, the I/O channel is
mapped to the Modbus variable.
Note: An I/O channel can only be mapped to one
variable. When an I/O channel is mapped to a
Modbus Variable, the Type of the Modbus
Variable is updated to that of the I/O channel. The
I/O channel variable is also removed from the I/O
channel group.

Dictionary - DNP Variables
Settings can be configured for DNP3 Binary Inputs, Binary Outputs, Binary Counters, Analog Inputs and
Analog Outputs as detailed below. IO channels can be mapped to DNP3 objects by configuring the Map to
I/O Channel parameter for each object (as detailed below).

Note: DNP3 events are created when data changes. DNP3 events can also be created periodically (even if it
hasnt changed) by using the Event Log function block.

DNP3 Binary Input Settings

Name: (1-127 characters) DNP3 variable name.
Initial Value: (Tick to enable) The initial value
used by the logic program. When enabled sets
initial value to 1. When disabled, sets initial value
to 0.
Type: (IOPOINT_B)
description.

Class: (None, 1, 2, 3) Data class of the DNP3
object.
Default static variation:
Single bit binary input (variation 1)
Binary input with status (variation 2)
Default event variation: [Only available when
Class is set to 1, 2 or 3]
Binary input change without time (variation 1)
Binary input change with time (variation 2)
Binary input change with relative time (variation 3)
Map to I/O channel: (No Mapping [default] or
digital input channel [if available]) When selected,
maps the digital input channel to the DNP3
variable. Note: An I/O channel can only be
mapped to one variable. When mapped, the I/O
channel variable is removed from the I/O channel
group.


DNP3 Binary Output Settings

Initial Value: (Tick to enable) The initial value
used by the logic program. When enabled sets
initial value to 1. When disabled, sets initial value
to 0.
Type: (IOPOINT_B)
description.

variable.
Binary output (variation 1)
Binary Output status (variation 2)
Binary output change without time (variation 1)
Binary output change with time (variation 2)
Control Actions: (Tick to enable)
digital output channel [if available]) When
selected, maps the value of the DNP3 Variable to
the digital output channel. Note: An I/O channel
can only be mapped to one variable. When
mapped, the I/O channel variable is removed from
the I/O channel group.


DNP3 Binary Counter Settings

Initial Value: (0-65535) The initial value used by
the logic program.
Type: (IOPOINT_D) Provides a 32-bit integer
counter.
description.

Map to I/O channel: (No Mapping [default] or counter
channel [if available]) When selected, maps the counter
channel to the DNP3 Variable. Note: An I/O counter
variable can only be mapped to one DNP3 variable. When
mapped, an I/O counter variable is removed from the I/O
counter variable group.
object.
Frozen class: (None, 1, 2, 3)
32-bit binary counter (variation 1),
16-bit binary counter (variation 2),
32-bit counter without flag (variation 5)
16-bit counter without flag (variation 6)
Default frozen static variation:
32-bit frozen counter (variation 1),
16-bit frozen counter (variation 2),
32-bit frozen counter with time of freeze
(variation 5), 16-bit frozen counter with time of
freeze (variation 6), 32-bit frozen counter without
flag (variation 9) or 16-bit frozen counter without
flag (variation 10)
Class is set to 1, 2 or 3] 32-bit frozen counter
change event without time (variation 1), 16-bit
frozen counter change event without time
(variation 2), 32-bit frozen counter change event
with time (variation 5) or 16-bit frozen counter
change event with time (variation 6)
Default frozen event variation: [Only available
when Frozen Class is set to 1, 2 or 3] 32-bit
frozen counter change event without time
(variation 1), 16-bit frozen counter change event
without time (variation 2), 32-bit frozen counter
change event with time (variation 5) or 16-bit
frozen counter change event with time (variation
6)

DNP3 Analog Input Settings

Initial Value: The initial value used by the logic
program.
Type: (IOPOINT_D, IOPOINT_R) IOPOINT_D
Provides a 32-bit integer. IOPOINT_R provides a
32-bit real.

Map to I/O channel: (No Mapping [default] or analog input
channel [if available]) When selected, maps the value of
the analog input channel to the DNP3 Variable. Note: An
I/O channel can only be mapped to one variable. When
mapped, the I/O channel variable is removed from the I/O
channel group.
object.
32-bit analog input (variation 1), 16-bit analog
input (variation 2), 32-bit analog input without flag
(variation 3), 16-bit analog input without flag
(variation 4).
32-bit analog change event without time
(variation 1),
16-bit analog change event without time
(variation 2),
32-bit analog change event with time (variation 3),
16-bit analog change event with time (variation 4)
Deadband %: (0-100 [default=10]) Generates an
event when the input changes by this setting or
greater.
High Limit %: (0-100 [default=100]) Highest
value allowed for this variable. Higher settings are
ignored and the value is limited to this setpoint.
Either a percentage value or a raw value can be
specified (please see the Advanced tab).
Low Limit %: (0-100 [default=0]) Lowest value
allowed for this variable. Lower settings are
ignored and the value is limited to this setpoint.
Either a percentage value or a raw value can be
specified (please see the Advanced tab).


Use raw values for analog input parameters:
(Tick to enable) When enabled uses raw values
for Deadband, High Limit and Low Limit as
specified. When disabled, uses percentage
values (percentage of total raw range).


DNP3 Analog Output Settings

Initial Value: The initial value used by the logic
program.
Type: (IOPOINT_D, IOPOINT_R) IOPOINT_D
Provides a 32-bit integer. IOPOINT_R provides a
32-bit real.
description.

object.
32-bit analog output status (variation 1)
16-bit analog output status (variation 2)
32-bit analog output event without time (variation
1)
16-bit analog output event without time (variation
2)
32-bit analog output event with time (variation 3)
16-bit analog output event with time (variation 4)
analog output channel [if available]) When
selected, maps the DNP3 variable to the analog
output channel. Note: An I/O channel can only be
mapped to one variable. When mapped, the I/O
channel variable is removed from the I/O channel
group.


7. ISaGRAF
TM

Topic Description
Overview Overview of ISaGRAF
Editing Tips How to create and edit ISaGRAF logic
Variable Types A list of the variable data types supported by ISaGRAF
Defined Words Parameters that can be used instead of constants for function block parameters
Custom Function
Blocks
RTU specific function blocks created for use with ISaGRAF
Logic Examples ISaGRAF Ladder Diagram examples


ISaGRAF
TM
- Overview

ISaGRAF
TM
provides the logic processing for each RTU. ISaGRAF
TM
allows logic
to be created in any of the international IEC 61131 control languages.
The ISaGRAF
TM
editor is called Workbench and is launched whenever a logic
program is edited from Toolbox PLUS (as illustrated below).
ISaGRAF uses function blocks to implement special functions. Custom function
blocks have been developed for use with Kingfisher RTUs as detailed in this
chapter. Logic examples are also detailed below.

Licensing
To learn about ISaGRAF
TM
licensing please review the help provided with the ISaGRAF
TM
Licensing
Manager (Program is labeled Licensing ISaGRAF 5).

ISaGRAF
TM
provides licensing information by using a USB key attached to a local or network PC.

ISaGRAF
TM
5.0 or later is run by all CP-30/G30 Kingfisher PLUS+ RTUs. More Information about
ISaGRAF
TM
can be found at www.isagraf.com.

Manuals
ISaGRAF Getting Started.pdf - Includes ISaGRAF
TM
Overview, details about ISaGRAF
TM
demos and
licensing.

ISaGRAF workbench_i.pdf - Explains all the features of the ISaGRAF
TM
editor - Workbench. This
information is also available in the ISaGRAF
TM
Workbench online help.


ISaGRAF
TM
- Editing Tips
Logic is processed from top to bottom, left to right.
An coil (digital output) can be put in any column but must be the last block on the rung.
To insert a contact (digital input), click one of the following buttons
The type of contact can be changed by selecting the contact and then pressing the SPACE bar or by
clicking the following button
To insert a function block, click one of the following buttons
To view the entire function block, the ISaGRAF
TM
grid may need to be expanded by clicking
Function block parameters are configured by double-clicking outside the function block, next to the
parameter.
Constants, Defined Words or Variables can be used for function block parameters. Variables must
have the same data type as the function block parameter.
Note: it is possible to use a function block name as a parameter of a function block. This will create
unpredictable results and should be avoided.
A single bit of a variable can be referenced by using the format VariableName.i where i is a constant
0 to 7 (8 bit variable) or 0 to15 (16 bit variable) or 0 to 31 (32 bit variable) or 0 to 63 (64 bit variable).
Example: SL04IO3AI1.value.15 refers to the 16th bit of a slot 4, IO-3 module, analog Input channel 1.
Values for function block STRING parameters are specified in single quotation marks. Example: 5:1
New variables can be added to the dictionary from within ISaGRAF
TM
. Click to open the
dictionary.
A program can be checked while ISaGRAF
TM
is running by clicking the Build button . ISaGRAF
TM

will report 0 errors and 0 warnings when the program is OK. If there are errors (as shown below),
double-click on the error in the Output window and ISaGRAF will highlight where the error has
occurred.

Toolbox PLUS is locked while ISaGRAF
TM
is running. To continue using Toolbox PLUS, ISaGRAF
TM

must first be shut down.
To view the state or value of all variables while viewing logic and connected to the target RTU, select
the Debug button . When viewing a project in debug mode, output parameters may be displayed
with ??? instead of values if no variables or fixed constants are assigned to function block
parameters.
Some custom function blocks have an error output (ERR). Any function blocks that are connected to
an Error output will only be processed if there is an error. For example, the function block on the right
will only be processed if the function block on the left has an error.

Both function blocks will be processed if they are configured in parallel as shown below.

More examples of ISaGRAF logic (ladder diagrams) are detailed below.


ISaGRAF
TM
- Variable Types
The following IEC 61131 variable types and custom data structures are supported by ISaGRAF
TM
.

Type Description Data Range
BOOL Logic (true or false) value 1 = True, 0 = False
SINT Short integer continuous value (8-bit) -128 to +127
USINT Unsigned short integer continuous value (8-bit) 0 to 255
BYTE Byte value (8-bit) 0 to 255
INT Single integer continuous value (16-bit) -32768 to 32767
UINT Unsigned single integer continuous value (16-bit) 0 to 65535
INT_ARRAY An array of 32 INT variables used for Kingfisher
messages
Each variable: 1 to 2048
Binary IO data structure with four parameters
Value (BOOL)
Timestamp (TIMESTRUC please see below)
Flags (USINT)
IOPOINT_B
Datatype (USINT)

Double Integer data structure with four parameters
Value (DINT)
Flags (USINT)
IOPOINT_D
Datatype (USINT)

Real data structure with four parameters
Value (REAL)
Flags (USINT)
IOPOINT_R
Datatype (USINT)

WORD Word value (16-bit) 0 to 65535
DINT Double integer continuous value (32-bit) -2,147,483,648 to
+2,147,483,647
UDINT Unsigned double integer continuous value (32-bit) 0 to 4,294,967,295
DWORD Double word value (32-bit) 0 to 4,294,967,295
LINT Long integer continuous value (64-bit) -9,223,372,036,854,775,808 to
9,223,372,036,854,775,807
ULINT Unsigned long integer continuous value (64-bit) 0 to 18,446,744,073,709,551,615
LWORD Long word value (64-bit) 0 to 18,446,744,073,709,551,615
REAL Real (floating) continuous value (32-bit). A real variable
has six significant digits.
3.4E-37 to 3.4E+37
LREAL Long real (floating) continuous value (64-bit). A long
real variable has 15 significant digits.
1.7E -308 to 1.7E +308
TIME Time values (32-bit). Stored as a positive number of
milliseconds.
0 to 4,294,967,294 ms
(1193h2m47s294ms)
DATE Date values (32-bit). Positive number of seconds since
1970-01-01 at midnight GMT.
Can store dates in the range 1970-01-01 to 2038-01-18
0 to 4,294,967,294 s
STRING Character string having a defined size, representing the
maximum number of characters the string can contain.
String capacity is limited to 255 characters excluding
the terminating null character (0).
Up to 255 characters in single
quotation marks. Example: DI1
TIMESTRUC Time with two parameters: number of seconds since
01/01/1970, 00:00:00 (a DINT) and number of
milliseconds after the last second recorded (an INT)


ISaGRAF
TM
- Defined Words
The following Defined Words can be used instead of constants for function block parameters.

Defined Word Value For Use With Function Block

DNP_AUTO_NONE 0
DNP_AUTO_OPERATE 1
DNP_AUTO_FEEDBACK 2
DNP Master Analog Command
DNP Master Binary Command
DNP_FC_SELECT 3
DNP_FC_OPERATE 4
DNP_FC_DIRECT 5
DNP Master Analog Command
DNP_CLASS_0 1
DNP_CLASS_1 2
DNP_CLASS_2 4
DNP_CLASS_3 8
DNP Slave Unsolicited Enable / Disable
DNP Master Unsolicited Enable / Disable
DNP Master Class Poll
DNP_CTRL_PULSE_ON 1
DNP_CTRL_PULSE_OFF 2
DNP_CTRL_LATCH_ON 3
DNP_CTRL_LATCH_OFF 4
PROTOCOL_AB 18
PROTOCOL_DNP3 8
PROTOCOL_HART 19
PROTOCOL_KINGFISHER 1
PROTOCOL_MODBUS_ASCII 14
PROTOCOL_MODBUS_RTU 15
PROTOCOL_MODBUS_TCP 16
PROTOCOL_SNMPC 12
Kingfisher Get / Clear Pending Flag
Kingfisher Get / Set Route
ROUTE_DIRECT 0
ROUTE_INDIRECT 1
Kingfisher Set Route


ISaGRAF
TM
- Custom Function Blocks
Protocols and special functions have been implemented using custom ISaGRAF
TM
function blocks as
detailed below.

Function Blocks Description
Kingfisher Messages Kingfisher messages that transfer data between RTUs
RTU System Data
RTU system information eg. RTU Address, firmware build number, time,
communications statistics and parameters
Event Logging Manage local and remote event logs. Includes event log transfer messages.
Allen Bradley DF1 serial communications with an SLC500 PLC
DNP3 Distributed Network Protocol messages
HART HART messages
Modbus Modbus messages
SNMP Simple Network Management Protocol messages
User Defined Allows a serial protocol to be developed in an ISaGRAF
TM
program
Maths Mathematical operations eg. increment, decrement
AGA American Gas Association standard calculations
Bit Set, Clear or Test a bit
Image Allows images to be captured from a network camera

Function Block output parameters are displayed on the right-hand side of the function block and are shown
underlined in the following sections.

Please see the topic ISaGRAF Logic Examples for examples on how to use some of the above function
blocks.

Function Blocks - Kingfisher Messages
Tx Data, Rx Data, Network Tx Data, Network Rx Data, Rx Update Single, Get Variable and Set Variable
messages are detailed below.

Tx Data

Sends up to 32 Kingfisher Local Register variables to a remote RTU.

RTU (UINT): (1-65520) The address of the RTU to send data to. Can be
entered as a constant in ISaGRAF
TM
.
REG (INT_ARRAY): An array of 32 variables. The Initial Value set in
each variable (1-2048) is used to specify the Kingfisher Local Register
Variables to send to the remote RTU. The array variables must be
configured consecutively starting from the first array variable. Example:

NBR (USINT): The number of registers to send (1-32). Can be entered
as a constant in ISaGRAF
TM
.
ERR (DINT): Error status of the function block (0=all parameters within
range, -34=one or more parameters is out of range)

Please see the topic ISaGRAF - Logic Examples Exception Reporting Digitals, Sending The Exception
Report for an example.

Rx Data

Polls up to 32 local registers from a remote RTU and stores them in the
corresponding Kingfisher Network Register Variables.

RTU (UINT): (1-65520) The address of the remote RTU to poll the data
from. Can be entered as a constant in ISaGRAF
TM
.
REG (INT_ARRAY): An array of 32 variables. The Initial Value set in
each variable (1-2048) is used to specify the Local Register Variable to
poll from the remote RTU. The array variables must be configured
consecutively starting from the first array variable. Example:

NBR (USINT): Number of registers to receive. Can be entered as a
constant in ISaGRAF
TM
.
ERR (DINT): Error status of function block (0=all parameters within

Please see the topic ISaGRAF - Logic Examples Polling for an example.


Network Tx Data

Sends up to 25 Kingfisher Network Register Variables to a remote RTU.

RTU (UINT): (1-65520) The address of the remote RTU to send network
register variables to.
REG (INT_ARRAY) An array of variables. The Initial Values set in the
REG array, specify the numbers (1-2048) of the Network Register
Variables to send to the remote RTU. The array variables must be
configured consecutively starting from the first array variable.
NRTU (INT_ARRAY): An array of variables. The Initial Values set in the
NRTU array, specify the network address (1-65520) of each Network
Variable number specified in REG above respectively. The array
variables must be configured consecutively starting from the first array
variable.
Example: To Send KF5N1, KF5N2, KF5N3, KF8N1 and KF8N101
the following REG (NetRegNumbers) and NRTU
(NetRegAddress) array variables are configured as follows:

NBR (USINT): (1-25) The number of Network Register variables to send.
ERR (DINT): Error status of the function block (0=all parameters within


Network Rx Data

Polls up to 25 Kingfisher Network Register Variables from a remote
RTU.

RTU (UINT): (1-65520) The address of the remote RTU to poll network
registers or variables from.
REG (INT_ARRAY) An array of variables. The Initial Values set in the
REG array, specify the numbers (1-2048) of the Network Register
Variables to poll from the remote RTU. The array variables must be
configured consecutively starting from the first array variable.
NRTU (INT_ARRAY): An array of variables. The Initial Values set in the
NRTU array, specify the network address (1-65520) of each Network
Variable number specified in REG above respectively. The array
variables must be configured consecutively starting from the first array
variable.
Example: To poll KF5N1, KF5N2, KF5N3, KF8N1 and KF8N101
the following REG (NetRegNumbers) and NRTU
(NetRegAddress) array variables are configured as follows:

NBR (USINT): (1-25) The number of network registers to poll.


Rx Update Single

Retrieves data and event logs from a remote RTU. This block is useful
for copying event logs from a sub-master to a master RTU. The Rx
Update Single block ignores the source of the event logs in the sub-
master RTU and copies all the logs from the sub-master RTU to the
master RTU.

RTU (UINT): Remote RTU address (1-65520) to get data and event logs
from.
REG (STRING): Control register (16 characters). The channels can be
configured as follows:
Ch1: [LSB] Real-time Data Flag. If this channel is set ON, real-time
data will be polled from the specified RTU. Channel 1 is NOT reset
after a successful data update.
Ch2: Event Logs Flag. If this channel is set ON, event logs will be
polled from the specified RTU that match the specified Priority and
User Type.
Ch5: Status Flag (set by Rx Update Single block). Indicates the
success/failure status of the RX Update. Channel 5 is written to after
polling of the RTU has finished. Channel 5 is set OFF if the update is
completed successfully or is set ON if the update has failed.
MAX (UINT): Maximum number of event logs to receive
PRI (EVENT_FILTER): Priority (0-7) of event logs to receive
UTYP (EVENT_FILTER): User Type (1-31) of event logs to receive

Get Variable

Retrieves the value of a variable from a remote RTU and stores it in a
local variable of the same data type.

RTU (UINT): Target RTU address
TYP (USINT): Data type of variable to get. 1=USINT, 2=SINT, 3=UINT,
4=INT, 5=UDINT, 6=DINT, 7=REAL, 9=STRING, 10=DATE, 11=TIME.
NAM (STRING): Name of variable to get (16 character)
DEST (STRING): Name of variable to write to (16 character)

Set Variable

Sets the value of a variable in a remote RTU.

RTU (UINT): Destination RTU address
TYP (USINT): Data type of variable to set. 1=USINT, 2=SINT, 3=UINT,
4=INT, 5=UDINT, 6=DINT, 7=REAL, 9=STRING, 10=DATE, 11=TIME
NAM (STRING): Name of variable to set (16 character)
VAL (DATA_TYPE): Value to set


Function Blocks - RTU System Data
General, module, clock and communications functions are detailed below.

Get System ID

Returns the system identifier of the local Kingfisher RTU (equivalent to
the #YSYSID available from non-ISaGRAF
TM
RTUs).

ID (INT): System ID of local RTU (0-255, default=174 [AE Hex])

Get Firmware

Returns the firmware revision of the firmware installed in the Kingfisher
RTU (equivalent to #YFIRMW available from Non-ISaGRAF
TM
Kingfisher
RTUs).

NBR (UDINT): Firmware build number

Get Address

Returns the RTU address of the local Kingfisher RTU (equivalent to
#YADDRESS available from Non-ISaGRAF
TM
Kingfisher RTUs).

RTU (UINT): Address of local RTU (1-65520)


Get RTU Type

Returns the processor type of the local Kingfisher RTU (equivalent to
#YRTUTYPE available from Non-ISaGRAF
TM
Kingfisher RTUs).

TYPE (USINT): Processor type of the local RTU (1-255). 1=CP-30.

Get Module Type

Returns the module type installed in the specified slot of the Kingfisher
RTU (equivalent to #YMTYPEss and #YPMODss available from
Non-ISaGRAF
TM
Kingfisher RTUs).

SLOT (UINT): Slot number of the module (1-64)
TYPE (UINT): Module type (1-255). 1= AI-1/AI-4, 2= AO-2, 6=DI-5,
7=DO-1, 8=DO-2/DO-5, 9=DI-10, 11=IO-2, 12=IO-3, 14=IO-4, 15=AO-3,
19=AI-10, 31=PS-11/PS-21, 48=MC-30, 60=CP-30, 255=No module
installed

Get Module OK

Compares module detected on the RTUs backplane with the module
configured in the RTUs configuration.

SLOT (UINT): Slot number (1-64). The slot number of the module to
compare with the RTUs configuration.
ERR (BOOL): Error status of function block. Set TRUE when there is an
error detecting the module or when comparing the detected module with
the module defined within the RTUs configuration.
STAT (BOOL): Module status. Set TRUE when the module matches the
RTUs configuration.

Get Processor

Returns the backplane slot number of the active CP-30 processor.
Useful when using redundant processors.

SLOT (UINT): Slot number (1-64). The slot number of the active CP-30
processor.


Get Real Time Clock

Returns the RTUs time as the number of seconds since 1970/01/01
00:00:00.

SEC (DINT): Number of seconds since 1970/01/01 00:00:00
(-2,147,483,648 to +2,147,483,647)

Set Real Time Clock

Sets the RTUs time as the number of seconds since 1970/01/01
00:00:00.

SEC (DINT): Number of seconds since 1970/01/01 00:00:00
(-2,147,483,648 to +2,147,483,647)

Get Time

Returns each parameter of the RTUs time and date as a separate
variable.

SEC (DINT): Current second (0-59)
MIN (DINT): Current minute (0-59)
HOUR (DINT): Current hour (0-23). 0=12 AM (midnight), 23=11 PM
DAY (DINT): Day of the month (1-31)
MON (DINT): Month of the year (1-12)
YEAR (DINT): Current year since 1900 (0-170). Eg. 1=1901, 104=2004
WDAY (DINT): Day of the week (1-7). 1=Sunday, 7=Saturday

Set Time

Sets each parameter of the RTUs time and date using separate
variables.

SEC (DINT): Current second (0-59)
MIN (DINT): Current minute (0-59)
HOUR (DINT): Current hour (0-23). 0=12 AM (midnight), 23=11 PM
DAY (DINT): Day of the month (1-31)
MON (DINT): Month of the year (1-12)
YEAR (DINT): Current year since 1900 (0-170). Eg. 1=1901, 104=2004
WDAY (DINT): Day of the week (1-7). 1=Sunday, 7=Saturday


Get Communications Statistics

Returns the number of message successes and fails to/from a remote
RTU. Message successes or fails are automatically counted for each
remote RTU that the local RTU communicates with or receives
messages from.

ADDR (UINT): The address (0-65535) of the remote RTU to return
communication statistics for. When ADDR is set to zero, returns the total
number of successes and fails for all RTUs.
ERR (BOOL): Error status. Set TRUE when there is an error returning
the requested communication statistics or if there has been no
communications with the remote RTU.
TXS (UDINT): Number of messages successfully transmitted to the
remote RTU or to every RTU (if ADDR is set to zero). This does not
indicate that the message has been successfully received by the remote
RTU.
TXE (UDINT): Number of messages that failed to be transmitted to the
remote RTU or to every RTU (if ADDR is set to zero).
RXS (UDINT): Number of messages successfully received from the
remote RTU or from every RTU (if ADDR is set to zero).
RXE (UDINT): Number of messages that have not received a valid reply
within the timeout period from the remote RTU or from every RTU (if
ADDR is set to zero).

Reset Communications Statistics

Allows global or specific communication statistics to be reset.

ADDR (UINT): The address (0-65535) of the remote RTU to reset
communication statistics for. When ADDR is set to zero, resets
successes and fails for all (global) remote RTUs.
ERR (BOOL): Error status. Set TRUE when there is an error resetting
the requested communication statistic.

Get Port Statistics

Returns the communication statistics of a local RTU port.

PORT (STRING): The local port to return statistics for. Specified as
slot:port where slot = 0 to 64 and port = 1 to 3. The Port setting must
be entered in single quotation marks. Egs: 5:1, 0:3. Note: zero can be
used for the slot number to refer to the local processor. The top port on a
processor or communications module is port 1.
ERR (BOOL): Error status. Set TRUE when there is an error returning
the statistics for the specified port.
TXS (UDINT): Transmit successes.
TXE (UDINT): Transmit errors.
RXS (UDINT): Receive successes.
RXE (UDINT): Receive errors.


Reset Port Statistics

Resets the communication statistics of a local RTU port.

PORT (STRING): The local port to reset statistics for. Specified as
slot:port where slot = 0 to 64 and port = 1 to 3. The Port setting must
be entered in single quotation marks. Egs: 5:1, 0:3. Note: zero can be
used for the slot number to refer to the local processor. The top port on a
processor or communications module is port 1.
ERR (BOOL): Error status. Set TRUE when there is an error resetting
the statistics for the specified port.

Get Pending Flag

Returns whether a message is still pending (waiting for a reply) to a
remote RTU, for a particular protocol or globally for the local RTU. A
message is pending until a reply is received or until all the retries have
timed out.

ADDR (UINT): The address (0-65535) of the remote RTU to check if a
message is pending. When ADDR is set to zero, checks if a message is
pending to any remote RTU for the protocol specified below.
PROT (USINT): The protocol to check for message pending. When
PROT is set to zero, all protocols are checked. The following defined
words may be used:
PROTOCOL_AB (Allen-Bradley DF1)
PROTOCOL_DNP3 (DNP3)
PROTOCOL_HART (HART)
PROTOCOL_KINGFISHER (Kingfisher)
PROTOCOL_MODBUS_ASCII (Modbus ASCII)
PROTOCOL_MODBUS_RTU (Modbus RTU)
PROTOCOL_MODBUS_TCP (Modbus TCP)
PROTOCOL_SNMPC (SNMP Client)
ERR (BOOL): Error status. Set TRUE when there is an error determining
the pending status for the specified remote RTU and protocol.
PEND (BOOL): Message pending status. Set TRUE when a message is
pending (waiting for a reply) for the specified remote RTU and protocol.

Clear Pending Flag

Clears a message pending flag (waiting for a reply) for a remote RTU

ADDR (UINT): The address (0-65535) of the remote RTU to clear the
message pending flag for. When ADDR is set to zero, clears all
message pending flags for the protocol specified below.
PROT (USINT): The protocol to clear the message pending flag for.
When PROT is set to zero, flags are cleared for all protocols for the
address specified above. The following defined words may be used:
ERR (BOOL): Error status. Set TRUE when there is an error clearing the
pending flag for the specified remote RTU and protocol.


Get Route

Returns information for a communication route. Both the device address
and protocol used to communicate with that device must be specified.
A route is configured using Toolbox PLUS or dynamically created by a
protocol.

DEV (UINT): The address (1-65535) of the remote device for which
route information is to be returned.
PROT (USINT): The protocol for which route information is to be
returned. The following defined words may be used:
ERR (BOOL): Error status. Set TRUE when there is an error in one or
more of the input parameters (DEV or PROT) or when failing to return
the route information for the specified address and protocol.
TYPE (DINT): The route type (0 = direct or 1 = indirect). Returns a
number that corresponds to one of the following defined words:
ROUTE_DIRECT or ROUTE_INDIRECT.
PORT (STRING): The RTU port used to communicate with the specified
device. Port returns x:y where x = slot 0 to 64 and y = port 1 to 3. If
x=0, the port is on the CP-30/G30 processor. If x=1 to 64, the port is on
an MC-30/31 module in slot x. Port only returns a value for direct routes.
ADDR (STRING): The IP address of the remote device. ADDR only
returns a value for direct routes over an Ethernet or IP network.
VIA (UINT): The intermediate device address (1-65535). VIA only
returns a value for indirect routes.


Set Route

Allows existing communication routes to be modified. Both the device
address and protocol used to communicate with that device must be
specified.
A route is configured using Toolbox PLUS or dynamically created by a
protocol. Note: this function block does not allow new routes to be
created.

DEV (UINT): The address (1-65535) of the remote device for which local
route information is to be modified.
PROT (USINT): The protocol for which route information is to be
modified. The following defined words may be used:
TYPE (DINT): The new route type (0 = direct or 1 = indirect). The
following defined words may be used: ROUTE_DIRECT or
ROUTE_INDIRECT
PORT (STRING): The new RTU port to be used to communicate with
the specified device. Specified as x:y where x = slot 0 to 64 and y =
port 1 to 3. If x=0, the port is on the CP-30/G30 processor. If x=1 to 64,
the port is on an MC-30/31 module in slot x. PORT only applies to direct
routes. The Port setting must be entered in single quotation marks. Egs:
5:1, 0:3.
ADDR (STRING): The new IP address of the remote device. ADDR only
applies to direct routes over an Ethernet or IP network.
VIA (UINT): The new intermediate device address (1-65535). VIA only
applies to indirect routes.
ERR (BOOL): Error status. Set TRUE when there is an error in one or
more of the input parameters or when failing to modify the route
information for the specified address and protocol.


Function Blocks - Event Logging
Event Log, Clear Event Logs, Get Event Log Count, Tx Event Logs and Rx Event Logs are detailed below.

Event Log

Logs the data value or state of a variable along with other information.
Note: Kingfisher data variables are logged accurate to one second.
By default DNP3 event logs are created for DNP3 variables in the
dictionary when the data changes. This function can be used to create
additional logs by logging DNP3 variables even when they havent
changed (eg. periodically).

REG (STRING): A string variable or string (16 characters max). If using
a string variable, the Initial Value parameter of the string variable is
configured with the name of the data variable to log in single quotation
marks. Alternatively, the name of the data variable to log can be directly
entered in single quotation marks. Examples: SL05IO3DI1.value
DNPAI3
UTYP (USINT): User Type (0-31). Used to label similar types of logs or
to set the event variation (1 to 4) for DNP3 variables. Event logs of a
single type can then be uploaded from the RTU as required. Note: if
UTYP is set to 0 when logging DNP3 variables, event variation 1 will be
used.
PRI (USINT): Priority (0-7) Allows separation of logs within each User
Type category. 0 is used for the highest priority logs. For DNP3, PRI can
be set to 1, 2 or 3 which corresponds to class 1, 2 or 3 data respectively.
DTYP (USINT): The data type of the variable to be event logged.
1=BOOL/USINT/BYTE, 2=SINT, 3=UINT/WORD, 4=INT,
5=UDINT/DWORD, 6=DINT, 7=REAL, 9=STRING, 10=IOPOINT_B [for
digital inputs], 11=IOPOINT_D [for analog inputs and counters],
12=IOPOINT_R [for floats]. For DNP3, use data types 10, 11 or 12 to
correspond to the variables data type.

Please see ISaGRAF Logic Examples for an example.

Clear Event Logs

Clears all the event logs in the local or remote RTU.

RTU (UINT): RTU address (0-65520). The RTU to clear the event logs
in. When '0' is specified, the event logs are cleared in the local RTU
itself. If a non-zero address is specified, a Clear Event Logs message is
initiated to clear the logs in the remote RTU.


Get Event Log Count

Counts the number of event logs in the local or remote RTU.

RTU (UINT): RTU address (0-65520). The RTU to obtain the event log
count from. When '0' is specified, the event logs are counted in the local
RTU itself. If a non-zero address is specified, a Get Event Log Count
message is initiated to get the log count from the remote RTU.
DES (STRING): Destination variable to store the event log count in (16
characters)

Tx Event Logs

Sends event logs to the destination RTU.

RTU (UINT): Destination RTU address to send event logs to (1-65520).
EPTR (STRING): Event log pointer (16 character). A local variable that
points to the next log to send. Note: this variable should not be used by
any other part of the logic program as it is automatically updated by the
RTU after each Tx Event Logs block.
STAT (STRING): Status register (16 character).
Ch1: [LSB] is set ON when the newest log has been sent. Set OFF
when the newest log has not been sent by the Tx Event Logs block.
Note: this flag is only updated each time the Tx Logs block is
processed.
NBR (UINT): Number of event logs to send.
range, -34=one or more parameters is out of range).

Rx Event Logs

Retrieves event logs that occurred over a specific time period from a
remote RTU. It will keep polling event logs until it has received the
maximum limit of logs or until the end of the event log list is reached.

RTU (UINT): Remote RTU address to receive event logs from (1-65520).
STAT (STRING): Status register (16 character)
Ch1: [LSB] Pending Flag. This bit is set ON when the block is
activated and then set OFF after the block has finished.
Ch2: Status Flag. This bit is updated after the block has finished.
The status flag is set OFF if the block was successful or set ON if
the block failed (eg. communications failure).
TIME (UDINT): Start time of the first event log to receive (minutes before
now).
PRD (UDINT): The time period of event logs to receive (minutes).
MAX (UINT): Maximum number of event logs to receive.
FRTU (UINT): RTU filter. If enabled, only event logs that match the filter
settings below are retrieved.
PRI (EVENT_FILTER): Priority (0-7)
UTYP (EVENT_FILTER) User Type (1-31)


Function Blocks - Allen Bradley

Tx Allen Bradley

Transmits up to 100 consecutive Kingfisher Local Register Variables to
an SLC500 Allen Bradley PLC.
ADDR (DINT): The station address (1-249) configured in the Allen
Bradley PLC. An Allen Bradley PLC is treated like another RTU in the
network. This means that the station address must be different to all the
other addresses in the RTU's Route list.
PLC (BYTE): PLC type (0 or 1). Not currently used.
SRC (DINT): First Kingfisher local register variable (1-2048) to read the
data from.
NUM (BYTE): Number of Kingfisher local register variables to send (1-
100).
DEST (STRING): Destination address in the Allen Bradley PLC where
data is stored. This should be a string reference like N10:1 (single
quotes are required)
ERR (BYTE): Error status of function block (0=all parameters within

Rx Allen Bradley

Receives an error code and up to 100 consecutive registers from an
SLC500 Allen Bradley PLC.
ADDR (DINT): The station address (1-249) configured in the Allen
Bradley PLC. An Allen Bradley PLC is treated like another RTU in the
network. This means that the station address must be different to all the
other addresses in the RTU's Route list.
PLC (BYTE): PLC type (0 or 1). Not currently used.
NUM (BYTE): Number of registers to read (1-100).
SRC (STRING): Source address in the Allen Bradley PLC where data is
read from. This should be a string reference like N10:1 (single quotes
are required).
DEST (DINT): First Kingfisher Local Register Variable (1-2048) in the
Kingfisher RTU to begin storing the error code and the data from. The
first local register variable contains the STS error code in the lower 8
bits, and the EXT STS error code in the higher 8 bits. A successful
message will reset the error code to 0. Data values are stored in the
second local register variable onwards. A value can be written in the first
local register variable before the Rx Allen Bradley message is triggered.
If the message is successful, the first local register variable will be
cleared.
ERR (BYTE): Error status of function block (0=all parameters within

Please see ISaGRAF Logic Examples for an example.

Function Blocks - DNP3
Master functions: Analog Command, Binary Command, Class Poll, Read Group, Clear Restart, Cold
Restart, Freeze Counters, Unsolicited Reporting Enable / Disable and Warm Restart are detailed below.

Slave functions: clock sync and unsolicited reporting enable / disable are detailed below.

Master Analog 16-Bit Command

Sets 16-bit analog values in the DNP Slave device.
ADDR (UINT): Address of the remote DNP3 device (0-65535).
FC (UCHAR): DNP3 Function code (3 to 5 or Defined Word). 3 = Select,
4 = Operate and 5 = Direct. The defined words DNP_FC_SELECT,
DNP_FC_OPERATE and DNP_FC_DIRECT can be used.
AUTO (UCHAR): Automation mode (0 to 2 or Defined Word).The
following function codes are supported: 0 = None, 1 = Operate and 2 =
Feedback. The defined words DNP_AUTO_NONE,
DNP_AUTO_OPERATE and DNP_AUTO_FEEDBACK can be used.
OPER (UINT32): Operate delay (0 to 4,294,967,295 ms) between
SELECT and OPERATE.
PNT (UINT16_t): DNP3 analog point number (0-65535).
VAL (UINT16): Value to be transmitted.

Master Analog 32-Bit Command

Sets 32-bit analog values in the DNP Slave device.
SELECT and OPERATE.
VAL (UINT32): Value to be transmitted.


Master Analog Float Command

Sets float analog values in the DNP Slave device.
SELECT and OPERATE.
VAL (float): Value to be transmitted.

Master Binary Command

Sets Digital values in the DNP Slave device.
OPER (UDINT): Automation delay (0 to 4,294,967,295 ms) between
SELECT and OPERATE.
PNT (UINT16_t): DNP3 digital point number (0-65535).
CTRL (UCHAR): DNP3 binary control (1 to 4 or Defined Word). 1 =
Pulse ON, 2 = Pulse OFF, 3 = Latch ON and 4 = Latch OFF. The
defined words DNP_CTRL_PULSE_ON, DNP_CTRL_PULSE_OFF,
DNP_CTRL_LATCH_ON and DNP_CTRL_LATCH_OFF can be used.
ON (UINT32): Pulse ON time (0 to 4,294,967,295 ms).
OFF (UINT32): Pulse OFF time (0 to 4,294,967,295 ms).

Master Class Poll

Polls a remote DNP3 device for one class of data (eg. class 0). Object
data will be stored in the local RTU if DNP3 variables have been created
in the Dictionary.
MASK (UCHAR): The DNP3 event class to poll (2 = Class 1, 4 = Class
2, 8 = Class 3 or Defined Word). The defined words DNP_CLASS_1,
DNP_CLASS_2 or DNP_CLASS_3 can be used.


Master Read Group

Polls a remote DNP3 device for one type of data (eg. Binary Inputs).
Object data will be stored in the local RTU if DNP3 variables have been
created in the Dictionary.
GRP (BYTE): The data group type to poll. Possible settings:
Binary Input Group = 1
Binary Output Group = 10
Binary Counter Group = 20
Frozen Counter Group = 21
Analog Input Group = 30
Analog Output Group = 40
ERR (UINT) Error status of function block. 0=All parameters within
range, non zero=one or more parameters out of range or invalid.

Master Clear Restart

Commands a slave device to clear a Restart.

Master Cold Restart

Commands a slave device to perform a Cold Restart.

Master Freeze Counters

Freezes the counters in a slave device. Additionally it allows the
counters to be cleared after being frozen.
CLR (BOOL): Clear counters after freeze (0 = dont clear counters or 1 =
clear counters).

Master Unsolicited Enable

Commands a slave device to enable Unsolicited requests.
MASK (UCHAR): The DNP3 event class (2 = Class 1, 4 = Class 2, 8 =
Class 3 or Defined Word) for which unsolicited reporting is to be
enabled. The defined words DNP_CLASS_1, DNP_CLASS_2 or
DNP_CLASS_3 can be used.


Master Unsolicited Disable

Commands a slave device to disable Unsolicited requests.
MASK (UCHAR): The DNP3 event class (2 = Class 1, 4 = Class 2, 8 =
disabled. The defined words DNP_CLASS_1, DNP_CLASS_2 or

Master Warm Restart

Commands a slave device to perform a Warm Restart.

Slave Need Time

Sets the Time Synchronisation Required flag (bit 4) within the Internal
Indication (IIN) parameter in the local RTU requesting a clock
synchronisation. When the master device next polls the local RTU, the
master device will then synchronise the clock of the local RTU.

Slave Unsolicited Enable

Enables unsolicited reporting by the local RTU of class 1, 2 or 3 data in
response to point value changes and control actions.
MASK (USINT): The DNP3 event class (2 = Class 1, 4 = Class 2, 8 =
enabled. The defined words DNP_CLASS_1, DNP_CLASS_2 or

Slave Unsolicited Disable

Disables unsolicited reporting by the local RTU of class 1, 2 or 3 data in
response to point value changes and control actions.
MASK (USINT): The DNP3 event class (2 = Class 1, 4 = Class 2, 8 =
disabled. The defined words DNP_CLASS_1, DNP_CLASS_2 or


Function Blocks - HART

Allows messages to be initiated to a HART device when using a HART
option board. The function block is based on Revision 5 of the Hart
protocol.
HART data retrieved is stored in DINT and REAL Kingfisher variables
(variables must begin with KF) using an RTU address assigned for the
HART data. The address used to store the HART data does not need to
be the same as the address of the HART device.
It is recommended that at least ten 10 DINT and 10 REAL variables be
created in the dictionary for use by the HART function block. Eg. if
address 7 is assigned to store the HART data, the DINT variables would
be: KF7R1 to KF7R10 and the REAL variables would be KF7F1 to
KF7F10.
DEV (UINT): The HART device address (0-15). Address 0 is only used
for point to point installations.
CMD (UINT): The HART command (or function code) to perform (0-108).
Note: PV = primary variable.
Universal Commands: Read Unique Identifier (0), Read PV (1), Read Current
and % of range (2), Read Current and 4 dyn vars (3), Write Polling Address (6),
Read Unique Identifier with Tag (11), Read Message (12), Read Tag, Descriptor,
Date (13), Read PV Sensor Information (14), Read [PV] Output Information (15),
Read Final Assembly Number (16), Write Message (17), Write
Tag/Descriptor/Date (18), Write Final Assembly Number (19).
Common Practice Commands: Read Transmitter Variables (33), Write [PV]
Damping Value (34), Write [PV] Range Values (35), Set [PV] Upper Range
Value (36), Set [PV] Lower Range Value (37), Reset Configuration Changed
Flag (38), EEPROM Control (39), Enter/Exit Fixed Current Mode (40), Perform
Transmitter Self Test (41), Perform Master Reset (42), Set PV Zero (43), Write
PV Units (44), Trim [PV Current] DAC Zeros (45), Trim [PV Current] DAC Gain
(46), Write [PV] Transfer Function (47), Read Additional Transmitter Status (48),
Write PC Sensor Serial Number (49), Read Dynamic Variable Assignments (50),
Write Dynamic Variable Assignments (51), Set Transmitter Variable Zero (52),
Write Transmitter Variable Units (53), Read Transmitter Variable Info (54), Write
Transmitter Variable Damping Value (55), Write Transmitter Variable Sensor
Serial No (56), Read All Dynamic Variables (108).
RTU (UINT): The RTU address (1-255) to use for the HART data. All
source and destination data will be stored in the variables of this RTU.
Eg. if RTU=3, the variables KF3R<Register> (integer) or
KF3F<Register> (floating point) will be used.
EXT (UINT): (1-99999) The first of three consecutive variables to use for
the HART devices extended address (or Unique Identifier). The
extended address is a unique 38-bit number derived from the
manufacturer code, the device type code and the device identification
number. Eg. if EXT=5, the variables KF<RTU>R5, KF<RTU>R6,
KF<RTU>R7 will be used. Note: the Read Unique Identifier (0)
command will store the extended address in these variables.
SRC (UINT): (1-99999) The first variable to get data from for writing
commands. Depending on the type of data required, this may refer to
either integer or float registers, ie. KF<RTU>R<Register> or
KF<RTU>F<Register> respectively.
DREG (UINT): (1-99999) The first register to store data received from
the HART device. Depending on the type of data to store, this may refer
to either integer or float registers, ie. KF<RTU>R<Register> or
KF<RTU>F<Register> respectively.
SREG (UINT): (1-99999) The register to store the status and response
codes returned by the HART device.
STAT (DINT) Error status of function block (0=all parameters within
range, non zero=one or more parameters out of range).

Function Blocks - Modbus
The Modbus function block allows the RTU to initiate Modbus messages. If the RTU only needs to respond
to messages (ie. when operating as a Modbus Slave device) then the Modbus function block is not required.
For all communications, Modbus variables must already exist in the RTU. Modbus extended addressing is
supported.

Sends or retrieves 16-bit registers to/from a Modbus device. The data
received from a Modbus device is stored in variables corresponding to
the Modbus data. The data sent to a Modbus device is taken from the
local RTUs own Modbus variables (not from the variables corresponding
to the remote device).
ADDR (UINT): Remote Modbus device address (0-65535 [2 bytes]) to
send data to or retrieve data from. Note: Modbus only uses addresses 0-
255 [1 byte]. The RTU only uses the lower byte of the address when
sending a message. Device addresses that have the same lower byte
eg. 10 (00 0A hex) and 266 (01 0A Hex) cannot both be used for
Modbus messages. Incoming data is always stored in Modbus variables
corresponding to the remote devices 1-byte address (0-255).
FC (USINT): Function code.
01=Read Coils Modbus addresses 000,001 to 065,535
02=Read Discrete Inputs Modbus addresses 100,001 to 165,535
03=Read Holding Registers Modbus addresses 400,001 to 465,535
04=Read Input Registers Modbus addresses 300,001 to 365,535
05=Write Single Coil Modbus addresses 000,001 to 065,53
06=Write Single Register Modbus addresses 400,001 to 465,5355
15=Write Multiple Coils Modbus addresses 000,001 to 065,535
16=Write Multiple Registers Modbus addresses 400,001 to 465,535

SRC (UINT): The first source register or variable to get data from (1-
65535). Note: this is the variable number eg. 1 not the Modbus address
eg. 40001. When retrieving data, this is the first register to read from the
remote device. When sending data, this is the first variable of the local
RTU to send. Eg. if the local RTU is address 5, this is the first variable
beginning with MOD5.
DST (UINT): The first destination register or variable to store data in (1-
65535). Note: this is the variable number eg. 1 not the Modbus address
eg. 40001. When retrieving data, this is the first variable in the local RTU
to store the data in (these variables use the address of the remote
device). Eg. if the remote device is address 7, this is the first variable
beginning with MOD7 in the local RTU. When sending data, this is the
first register in the remote Modbus device to store the data in.
NUM (UINT): Number of consecutive coils, discrete inputs or registers to
send or retrieve (1-128). This parameter is not used for single read or
write commands but must still contain a valid setting eg. 1.
range, non zero=one or more parameters out of range).

Please see ISaGRAF Ladder Examples for an example.

Function Blocks - SNMP
Trap: Get Trap, Send Trap and RMS messages are detailed below.

Client (Master): Get Integer, Get Unsigned Integer, Get String, Get Object Identifier, Set Integer, Set
Unsigned Integer, Set String and Set Object Identifier messages are detailed below.

SNMP Get Trap

[Only applicable when using the SNMP Trap protocol]
Returns details about one trap message that was received.
When a trap message is received, details associated with the message
are stored in a FIFO (First In First Out) queue managed by the RTU. After
each function call, the details for the oldest message in the queue are
returned as function block outputs. The details for that message are then
removed from the queue.
ERR (INT): Status of the function block. 0=message details successfully
returned. Non-zero=error state (eg. no message details available).
COM (STRING): The community string specified in the trap message.
Note: there is no validation of the authenticity of this community string for
trap messages received.
IP (STRING): The IP address of the agent that sent the trap message.
OID (STRING): The object identifier associated with the trap message.
GTRP (UINT): The generic trap value of the trap message. The
permissible values for this parameter are defined in RFC document 1157,
A Simple Network Management Protocol (SNMP).
STRP (UINT): The specific trap value of the trap message. This value is
device specific.
TIME (UINT): The time stamp of the trap message.

SNMP Send Trap

[Only applicable when using the SNMP Trap protocol]
Sends a trap message to a remote device.
When generating this message, the IP address of the default Ethernet
port of the Kingfisher CP30 or G30 processor is used for the agent
address and the current time is used for the time stamp parameter of the
trap message.
ADDR (UINT): The address of the remote device to send the trap
message to.
COM (STRING): The community name specified in the trap message.
GTRP (UINT): The generic trap value to be used in the message. The
permissible values for this parameter are defined in RFC document 1157,
A Simple Network Management Protocol (SNMP).
STRP (UINT): The specific trap value to be used in the message. This
value is device specific.
OID (STRING): The object identifier.
VAL (INT): The value of the object.


SNMP RMS Trap

[Only applicable when using the SNMP RMS Trap protocol]
Sends a RMS Systems SNMP trap message to a remote device.
SNMP RMS messages differ from SNMP_SEND_TRAP messages
(detailed above). SNMP RMS sends information for multiple object
identifiers defined in the RMS Systems MIB within a single SNMP trap
message. Object values can also be sent in the trap message.
ADDR (UINT): The address of the SNMP agent to send the message to.
COMM (STRING): The community name (64 characters max.) to be
used in the message.
SPEC (DINT): The specific RMS Systems message to send (101 to
111). These messages are defined as follows:
101: rtuAlarm Sent when a port goes into alarm
102: rtuARA Sent when a port goes into ARA
103: rtuHistoric Sent when a port goes into Historic
104: rtuNormal Sent when a port goes normal
105: rtuOutputActivated Sent when an output port is activated
106: rtuOutputDeactivated Sent when an output port is
deactivated;
107: rtuPowerFail Sent when power fails;
108: rtuLogFull Sent when a log reaches the specified alarm
threshold
109: rtuUnitConfigChange Sent when a unit setting has been
changed
110: rtuPortConfigChange Sent when a port setting has been
changed
111: rtuRuleFail Sent when the rules are enabled and they become
invalid (either through a rule change or some other change in the
RTU configuration)
PNAM (STRING): The port name (20 characters max.) associated with
the SNMP trap. This parameter is bound with the object identifier
1.3.6.1.4.1.4119.1.7.7.1 as the first variable of the message.
PCOD (STRING): The position code (20 characters max.) of the port
associated with the SNMP trap. This parameter is bound with the object
identifier 1.3.6.1.4.1.4119.1.7.7.2 as the second variable of the
message.
GCOD (STRING): The group code (20 characters max.) of the port associated with the SNMP trap. This
parameter is bound with the object identifier 1.3.6.1.4.1.4119.1.7.7.3 as the third variable of the message.
PNUM (DINT): The overall port number associated with the SNMP trap. This parameter is bound with the
object identifier 1.3.6.1.4.1.4119.1.7.7.4 as the fourth variable of the message.
PTYP (DINT): The port type (1 to 4) associated with the SNMP trap. This parameter is bound with the
object identifier 1.3.6.1.4.1.4119.1.7.7.5 as the fifth variable of the message. Valid settings are: digital (1),
analog (2), temperature (3) and virtual (4).
PTNM (DINT): The port type number of the port associated with the SNMP trap. This is the port number
within the given port type rather than the overall port number within the configuration. This parameter is
bound with the object identifier 1.3.6.1.4.1.4119.1.7.7.6 as the sixth variable of the message.
ALRM (DINT): The number of alarms on the given port. This parameter is bound with the object identifier
1.3.6.1.4.1.4119.1.7.7.7 as the seventh variable of the message.
ALMP (DINT): The alarm priority level of the port (1 = highest priority). This parameter is bound with the
object identifier 1.3.6.1.4.1.4119.1.7.7.8 as the eighth variable of the message.
ENUM (DINT): The external device number. This parameter is bound with the object identifier
1.3.6.1.4.1.4119.1.7.7.9 as the ninth variable of the message.
ESTR (STRING): The external device string (20 characters max.). This parameter is bound with the object
identifier 1.3.6.1.4.1.4119.1.7.7.10 as the tenth variable of the message.


SNMP Get Integer

[Only applicable when using the SNMP Client protocol]
Retrieves the integer value of an object from a remote device.
For the OUT and STAT parameters, entering a number between 1 and
2048 causes the Value and Status retrieved from the remote device to be
stored in the corresponding local Kingfisher register. Alternatively, a
variable name can be used.
ADDR (UINT): The address of the remote device to retrieve the object
value from.
NAME (STRING): The community name to be used in the message.
OBJ (STRING): The object identifier in the remote device.
OUT (STRING): The variable name (1-255 characters) or Kingfisher
register (1-2048) to store the retrieved value in.
STAT (STRING): The variable name (1-255 characters) or Kingfisher
register (1-2048) to store the result status in. All non-zero values indicate
an error.

SNMP Get Unsigned Integer

Retrieves the unsigned integer value of an object from a remote device.
For the OUT and STAT parameters, entering a number between 1 and
2048 causes the Value and Status retrieved from the remote device to be
stored in the corresponding local Kingfisher register. Alternatively, a
variable name can be used.
value from.
OUT (STRING): The variable name (1-255 characters) or Kingfisher
register (1-2048) to store the retrieved value in.
an error.


SNMP Get String

Retrieves the string value of an object from a remote device.
For the STAT parameter, entering a number between 1 and 2048 causes
the Status retrieved from the remote device to be stored in the
corresponding local Kingfisher register. Alternatively, a variable name can
be used.
value from.
OUT (STRING): The variable name (1-255 characters) to store the
retrieved string value in.
an error.

SNMP Get Object Identifier

Retrieves the identifier of an object from a remote device.
be used.
identifier from.
OUT (STRING): The variable name to store the object identifier value in.
Value is returned in dotted numeric form eg. 1.3.6.1.2.1.1.2.0
an error.


SNMP Set Integer

Sets an integer value of an object in a remote device.
be used.
ADDR (UINT): The address of the remote device to set the object value
in.
IN (DINT): The integer value to set.
an error.

SNMP Set Unsigned Integer

Sets an unsigned integer value of an object in a remote device.
be used.
in.
IN (UDINT): The unsigned integer value to set.
an error.


SNMP Set String

Sets a string value of an object in a remote device.
be used.
in.
IN (STRING): The string value to set.
an error.

SNMP Set Object Identifier

Sets the identifier of an object in a remote device.
For the STAT parameter, entering a number between 1 and 2048
causes the Status retrieved from the remote device to be stored in the
corresponding local Kingfisher register. Alternatively, a variable name
can be used.
in.
IN (STRING): The object identifier value to set. The object identifier is
expected to be in the dotted numeric form (eg. 1.3.6.1.2.1.1.2.0). This
value is then converted to the ASN.1 encoded object identifier format
within the SNMP message.
register (1-2048) to store the result status in. All non-zero values
indicate an error.


Function Blocks - User Defined
The following function blocks can be used in an ISaGRAF
TM
logic program. There are also ISaGRAF
TM

string functions that can be used to encode and decode protocol messages.

User Receive

Reads up to 255 bytes from a local buffer that contains data received from
a remote device. If the buffer contains less than the requested number of
bytes, then all the bytes in the buffer are returned.
ADDR (UINT): The address of the remote device to read data for.
CNT (UINT): The number of bytes to read from the local buffer.
DATA (STRING): The data bytes that have been read from the local
buffer.

User Receive Bytes

Returns the number of bytes that have been received from a remote
device but have not been read (by the USER_RX function block). This
function is useful for checking if a remote device has responded or has
sent data to the RTU without having to process the data.
ADDR (UINT): The address of the remote device to check the data for.
CNT (UINT): The number of bytes in the local buffer that have not been
read.

User Transmit

Transmits up to 255 bytes to a remote device. If the data is successfully
transmitted, the RTUs message success counter is incremented.
ADDR (UINT): The address of the remote device to send data to.
DATA (STRING): The data bytes to be transmitted.


Function Blocks - Maths
Change Detect

Checks if the Input Variable has changed from the last stored value. If
the Input Variable is non-zero, the first time the logic is processed a
change will be detected (since the last stored value will be zero).

INP (DINT): Input Variable.
OUT (BOOL): Output Detected. 1 (TRUE) = Change detected; 0
(FALSE) = No change detected.

Decrement

Reads the value of the Input Variable, decreases it by one and then
stores the resulting value in the Output Variable.

OUT (DINT): Output Variable. Make the output variable the same as the
input variable when wanting to update the input variable.

Increment

Reads the value of the Input Variable, increases it by one and then
stores the resulting value in the Output Variable.

OUT (DINT): Output Variable. Make the output variable the same as the
input variable when wanting to update the input variable.

Multiply Divide Integer

Reads the value of the Input Variable, multiplies it by the Multiply Factor
and divides the result by the Division Factor. The result is then stored in
the Output Variable as an integer value (no decimal places).

MUL (DINT): Multiply Factor. Can be entered as a constant.
DIV (DINT): Division Factor. Can be entered as a constant.
OUT (DINT): Output Variable. Set to the same variable as the Input
Variable when wanting to update the Input Variable.

Function Blocks - AGA
AGA3, AGA7, AGA8 Gross, AGA8 Detailed and AGA9 are detailed below.

AGA3

Uses the factors method of the 1992 revision of the American Gas
Association AGA-3 report to calculate the natural gas mass flow.

N1 (REAL): Unit Conversion Factor (Orifice Flow)
Cd (REAL): Coefficient of Discharge - Orifice Plate
dr (REAL): Reference Orifice Plate Bore Diameter at Reference
Temperature
a (REAL): Linear Coefficient of Thermal Expansion
Tf (REAL): Temperature
Tr (REAL): Reference Temperature
Dr (REAL): Reference meter tube, internal Diameter at Reference
Temperature
Y (REAL): Expansion Factor
dP (REAL): Differential Pressure
p (REAL): Density of Fluid at Flowing Conditions
Qm (REAL): Mass Flow


AGA7

Uses the calculations from the 1980 revision of the American Gas
Association AGA-7 report to calculate the volumetric flow of gas using
the formula:
Qv = Qf x P/Pgr x Tgr/T x Z

Qf (REAL): Flowrate at Flowing Conditions
P (REAL): Pressure (MPa)
Pgr (REAL): Reference Pressure at specific gravity (MPa)
T (REAL): Temperature (deg. C)
Tgr (REAL): Reference Temperature at Specific Gravity (deg. C)
Z (REAL): Compressibility Factor (output from AGA8 Gross calculation)
Qv (REAL): Volumetric Flow

There are no required units for this calculation. Users must take care in ensuring that the units used are
appropriate as recommended below.
Pressure and Reference Pressure must be in the same units and they must be absolute units of
pressure, such as psia, kPaa, MPaa or similar. Absolute units for the line pressure are typically the
pressure from the transmitter (in gauge units) plus the local atmospheric pressure or the reading from an
absolute pressure transmitter.
Temperature and Reference Temperature must be in the same units and they must be the absolute units
of Kelvin (deg C + 273.15) or Rankin (deg F + 459.67).
The Compressibility correction factor is the ratio of the compressibility of the gas at base conditions to
the compressibility of the gas at flowing conditions. To calculate this, you need to execute two AGA8
calculations, using the same gas composition, but the first with the base pressure and temperature to
calculate the base compressibility (Zb) and the second with the flowing pressure and temperature to
calculate the flowing compressibility (Zf). The Compressibility correction factor is then Zb / Zf. Either of
the AGA8 Gross or AGA8 Detailed function blocks can be used, according to the available gas
composition information available.
Note that the Supercompressibility factor, F
PV
, is the square root of the Compressibility Correction Factor,
and can be used (Z = F
PV
2
) if it is supplied from an external source.
The output of the function block, Q
v
will be in the same units as the supplied Q
f
.

AGA9
It is recommended that for the measurement of the flow of natural gas using an Ultrasonic meter, that the
calculations from the AGA-9 report be used. This report refers the reader to the calculations in the AGA-7
report. Kingfisher programmers building software for ultrasonic meter stations should do likewise and simply
use the AGA7 function block.


AGA8 Gross

Uses the American Gas Association AGA-8 report for calculating gas
compressibility using the gross method. This implementation is based
entirely on "Compressibility Factors of Natural Gas and Other Related
Hydrocarbon Gases", AGA Transmission Measurement Committee
Report No. 8, Second Edition, November 1992.

N2 (REAL): Mole Fraction N2
CO2 (REAL): Mole Fraction CO2
SG (REAL): Specific Gravity
Tr (REAL): Reference Temperature (deg. C)
Pr (REAL): Reference Pressure (MPa)
C (REAL): Compressibility factor
S (INT): Status Register
Ch 1: calculation error [LSB]
Ch 2: pressure out of range error (allowed range is 0 to 12 MPa)
Ch 3: temperature out of range error (allowed range is -8 to 62
o
C)

Example:
Temperature
Pressure
Mole N2
Mole CO2
Specific Gravity
Reference Temperature
Reference Pressure
Result
0
o
C
0.6894757 MPa
0.002595
0.005956
0.581078
15.56
o
C
0.101560 MPa
Compressibility = 0.982387, Status=0.


AGA8 Detailed

Uses the American Gas Association AGA-8 standard for calculating gas
compressibility using the detailed characterization method. This
implementation is based entirely on "Compressibility Factors of Natural
Gas and Other Related Hydrocarbon Gases", AGA Transmission
Measurement Committee Report No. 8, Second Edition, November 1992.

Meth (REAL): Molar Fraction of Methane
Nitr (REAL): Molar Fraction of Nitrogen
CaDi (REAL): Molar Fraction of Carbon Dioxide
Etha (REAL): Molar Fraction of Ethane
Prop (REAL): Molar Fraction of Propane
Watr (REAL): Molar Fraction of Water
HySu (REAL): Molar Fraction of Hydrogen Sulphide
Hydr (REAL): Molar Fraction of Hydrogen
CaMo (REAL): Molar Fraction of Carbon Monoxide
Oxy (REAL): Molar Fraction of Oxygen
iBut (REAL): Molar Fraction of i-Butane
nBut (REAL): Molar Fraction of n-Butane
iPen (REAL): Molar Fraction of i-Pentane
nPen (REAL): Molar Fraction of n-Pentane
nHex (REAL): Molar Fraction of n-Hexane
nHep (REAL): Molar Fraction of n-Heptane
nOct (REAL): Molar Fraction of n-Octane
nNon (REAL): Molar Fraction of n-Nonane
nDec (REAL): Molar Fraction of n-Decane
Heli (REAL): Molar Fraction of Helium
Argn (REAL): Molar Fraction of Argon
Cmpr (REAL): Compressibility Ratio
St (INT) Status Indication
Ch1: [LSB] Internal calculation error. The AGA8 Detail calculation is a
fairly complicated non-linear calculation that includes a couple of
iteration loops (ie. it repeats a calculation many times until the result
converges to a solution). The AGA8 function block limits these loops to
a maximum of 100 iterations each, to limit the time taken to perform the
calculation. An 'Internal calculation error' indicates that after 100
iterations the result was still varying slightly (a valid result is still
returned by the AGA8 calculation block). The reason for the variation
may be that the input parameters are close to the limits specified in the
AGA8 Detailed specification. For further details about the parameter
limits and the tolerance levels, please refer to the actual AGA8
Standard. If very precise accuracy is required from the result, the
'internal calculation error' bit can be used as a warning flag, otherwise it
can be ignored.
Ch2: Pressure out-of-range error (allowed range is 0 to 280 MPa)
Ch3: Temperature out-of-range error (allowed range is -130 to 400
o
C)
Ch4: Firmware driver error
Ch5: Gas components outside 'normal' range
Ch6: Gas components outside 'expanded' range


Function Blocks - BIT

Normal Bit

Sets (ON) or Clears (OFF) a bit.

DATA (BOOL): 1=set bit, 0=clear bit
IN (UINT): 16-bit input variable
BIT (USINT): Bit number to set (1-16)
OUT (UINT): 16-bit output variable. Make the output variable the same
as the input variable when wanting to update the input variable with the
new bit state.

Normally Closed Bit

Tests if a bit is closed (TRUE). Outputs TRUE if bit is TRUE.

IN (UINT): 16-bit input variable
BIT (USINT): Bit number to test (1-16)
OUT (BOOL): 1 (TRUE) = bit closed; 0 (FALSE) = bit open.

Normally Open Bit

Tests if a bit is open (FALSE). Outputs TRUE if bit is FALSE.

IN (UINT): 16-bit input variable.
BIT (USINT): Bit number to test (1-16)
OUT (BOOL): 1 (TRUE) = bit open; 0 (FALSE) = bit closed.


Function Blocks Network Image Capture
Retrieves images from a network image device (eg. a network IP camera) and stores them in the general
purpose file transfer area of the processor Flash memory. The images are accessible using DNP3 file
transfer and are stored with time and date stamp in the following format:
YYYYMMDD_HHMMSS_TTT_STRING.ext or STRING_YYYYMMDD_HHMMSS_TTT.ext
YYYY=year, MM=month, DD=day, HH=hour, MM=minutes, SS=seconds and TTT=milliseconds,
STRING=user-defined text (up to 16 characters)
ext=jpg or gif or bin. Extension (file type) of each image is determined by the header returned from the
network image capture device.

URL (STRING): The HTTP web address (1-255 characters) of the
image in the network image capture device eg.
'http://192.168.8.231/jpg/image.jpg'. The image device must be
accessible through the IP address, sub-network mask and gateway
address configured on the Ethernet port of the Kingfisher RTU.
USER (STRING): [Optional] The HTTP authentication username (0-255
characters) to be used to access the network image capture device if
unauthenticated access is rejected.
PASS (STRING): [Optional] The HTTP authentication password (0-255
characters) to be used to access the network image capture device if
unauthenticated access is rejected.
RES (STRING): [Optional] Numeric variable (0-128 characters) to store
the result of the Image function block (typically of type DINT). Instead of
specifying the variable name, RES can be specified as 1 to 2048 and
this will be interpreted as Kingfisher Local Register variable KFR1 to
KFR2048 respectively. The RES variable will then be set to 0 if an
image is successfully retrieved and stored or set to another value if an
error has occurred. Note: the Kingfisher Local Register variable must
first be created in the Dictionary.
TEXT (STRING): [Optional] The user-defined text (0-16 characters) to
be included in the file name of the image retrieved from the network
image capture device.
PREF (BOOL): [Optional] If set to True (or 1) the user-defined text will
be added to the prefix (or front) of the image file name. If False
(default), the user-defined text will be added to the suffix (or end) of the
image file name).
If PREF=1, file name will be: STRING_YYYYMMDD_HHMMSS_TTT.ext
If PREF=0, file name will be: YYYYMMDD_HHMMSS_TTT_STRING.ext
ERR (BOOL): Error status of function block. Set TRUE (1) if one or
more parameters are out of range.

Note: Test Harness from Triangle Microworks supports DNP3 file transfer and can be used to obtain images
from the RTU (available from http://www.trianglemicroworks.com/DownLoads.htm )

ISaGRAF
TM
- Logic Examples
A Toolbox PLUS project containing all the Ladder Diagram logic examples below is available from www.cse-
semaphore.com/mykingfisher.

For tips on how to create and edit ISaGRAF logic, please see the topic ISaGRAF Editing Tips above.

Example Description
Detecting Modules How to check that each module is present on the backplane
Scaling How to convert an analog input into engineering units
Hours On The total number of hours that a variable has been active
Counting Pulses and
Starts
The total number of pulses or starts (OFF to ON transitions) of a variable
Flow Totalisation Counting volume from a flowrate
Daily Totals Rolling over totals at midnight to create yesterday and current totals
Polling How to poll a Kingfisher RTU
Exception Reporting
Digitals
How to send a message when a digital variable changes state
Exception Reporting
Analogs
How to send a message when an analog variable changes significantly
Event Logging How to create periodic or change initiated event logs
DNP3 Protocol How to configure and use the DNP3 protocol
Modbus Protocol How to configure and use the Modbus protocol
Allen Bradley Protocol How to configure and use the Allen Bradley DF1 protocol
Redundant
Communications
Shows how to change port or communication paths in response to a
communication fail. Please see the Redundancy appendix for more
information.


Logic Examples Detecting Modules
The logic below checks that the modules detected in slots 1, 2 and 3 match the configuration loaded in the
RTU (from Toolbox PLUS). The variables Module1_OK, Module2_OK, Module3_OK, ModulesOK and
LogicStatus are all BOOL type variables. Please see the topic ISaGRAF Custom Function Blocks, RTU
System Data, Get Module OK for function block details.

Logic Examples Scaling
The logic below converts an analog input (SL03IO3AI1.value) into engineering units. The input has a raw
range of 0-32760. The input is divided by 32760 and then multiplied by 10000 to convert it to a range of 0-
10000 (this value can then be displayed as 0-1000.0 or 0-100.00 L/s in SCADA software). FlowLperSec is a
DINT variable and LogicStatus is a BOOL variable.

Please see the topic ISaGRAF Custom Function Blocks, Maths, Multiply Divide Integer for function block
details.


Logic Examples Hours ON
Every 3600 milliseconds (3.6 seconds or 1/1000
th
of an hour) the logic checks if SL03IO3DI1.value is ON
and if it is, HrsRun (a DINT variable) is incremented. HrsRun then contains the number of 0.001 hour
intervals that the input is ON ie. 0 to 999,999 = 0 to 999.999 Hrs. HrsRun can be rolled over at midnight to
obtain daily totals.

Logic Examples Counting Pulses And Starts
Low speed pulses (up to 5 pulses per second [Hz]) and starts are both counted the same way. The logic
checks for an OFF to ON (or ON to OFF) transition of a digital input and increments a counter when a
transition is detected.

The actual pulse rate that the RTU can count depends on how fast the logic and IO are processed. Since
pulses are counted by counting the rising or falling edges of digital inputs, the logic and IO needs to be
processed fast enough to allow the RTU to register the pulse in the ON and the OFF states.

The default logic (and IO) cycle time is 100 ms and is configured in ISaGRAF from Project, Run Time
Settings, Settings, Cycle Timing. The minimum cycle time that can be used will vary according to the
number and type of modules in the RTU.

To count higher pulse rates (up to 10 kHz), a DI-10 or DI-5 digital input module can be used. These modules
have dedicated hardware counters and do not rely on the logic cycle time to count pulses.

The logic below shows how to count pulses (or starts) using a positive (rising) edge trigger. Every time there
is a new pulse (from SL03IO3DI1.value), the PulsesToday variable (a DINT variable) is incremented.
LogicStatus is a BOOL variable.


Logic Examples Flow Totalisation
The following example shows how to accumulate a flow volume from a flowrate analog input
(SL03IO3AI1.value). For this example, the flowrate engineering units are 4-20mA=0-1000 L/s. Each second,
the number of litres that have flowed (FlowLastSec [a DINT variable]) is calculated by dividing the analog
input by 32760 (the raw analog input range) and then multiplying by 1000 (the high limit of the engineering
units). This number of litres is then added to the FlowToday total (a DINT variable).

Please see the topic ISaGRAF Custom Function Blocks, Maths, Multiply Divide Integer for function block
details.

Logic Examples Daily Totals
Daily totals are created by rolling over current totals at midnight. The current totals are copied to yesterday
totals and then the current totals are reset.

In the example below, CurrentDAY and SavedDAY are DINT variables and Rollover is a BOOL variable.
When the value for CurrentDAY (of the month) changes at midnight, SavedDAY is updated and Rollover is
set TRUE for one logic scan.

When Rollover is TRUE, the PulsesToday total is copied to PulsesYesterday and then zero is copied to
PulsesToday.

Please see the topic ISaGRAF Custom Function Blocks, RTU System Data, Get Time for function block
details.


Logic Examples Exception Reporting Digitals
An exception report can be generated when a single digital bit changes state or when any of the bits in a
variable change state.

Monitoring A Single Bit
In the example below, a single digital input variable from an IO-3 module (SL03103DI1.value) is monitored
for change. If the input changes, an exception report flag is set (ExReport). DILastValue and ExReport are
BOOL variables.

Monitoring Multiple Bits
In the example below, the four digital inputs from an IO-3 module (SL03IO3DI1.value, SL03IO3DI2.value,
SL03IO3DI3.value and SL03IO3DI4.value) are copied to Kingfisher Register Variable 1 (KFR1). If Register
Variable 1 changes (ie. if any bit changes), an exception report flag is set. NewValue is a DINT variable.
LogicStatus and ExReport are BOOL variables.


Sending The Exception Report
Create one or more Kingfisher Local Register variables to send to the remote RTU. Example: KFR1 (of
type DINT). Please see the appendix RTU Data - Protocols, Kingfisher Data, Local Register Variables for
details.
Create an INT_ARRAY variable to be used for the REG parameter (example: LocalRegisters).
Configure the Initial Value parameter to correspond to the Local Register Variables to send to the
remote RTU. Example: to send Local Register Variables 1 to 5, configure an Initial Value of 1,2,3,4,5
(please see below for details)
Configure a KF_TX_DATA function block in an ISaGRAF
TM
logic program, using the appropriate
variables (ie. correct data type) or constants for the inputs and output. Assign the INT_ARRAY variable
created above to the REG input parameter.
When the function is executed, the RTU will get values from the specified local register variables and
send them to the remote RTU.
In the remote RTU the data will appear in network register variables (for CP-30/G30 RTUs) or network
registers (for CP-11, PC-1 RTUs).

Please see the topic ISaGRAF Custom Function Blocks, Kingfisher Messages, Tx Data for function block
details.

The logic below sends a message to RTU7 when the port is free and the ExReport flag (from above
examples) has been set. MsgWaiting and ErrorStatus are BOOL variables.

The LocalRegisters variable used above is defined as follows:

The initial value of LocalRegisters allows the KFR1 to KFR5 variables to be transmitted to the remote RTU.


Logic Examples Exception Reporting Analogs
The example below shows how to trigger an exception report when an analog input (SL03IO3AI1.value)
changes by 5% (of the analog range) from the last reported value. This is done by using two DINT variables
(AI1HiLimit, AI1LoLimit) and a constant. The variables are used to store the last reported value plus the
constant and the last reported value minus the constant. When the analog value moves above or below
these values, an exception report is triggered and the thresholds are updated (as illustrated below).

AIHiLimit
AILoLimit
Analog Input

The constant to use is calculated as percentage of the analog or register range. For analog inputs which
have a range of 0-32760 (32767 for an AI-10), a 1% change is represented in the RTU by a change of about
328 (0.01 x 32760). Similarly, a 5% change is represented in the RTU by a change of 1638 (0.05 x 32760).

To send the new analog value (that was copied to the KFR2 in the logic above) to another RTU, please see
the topic above, Logic Examples Exception Reporting Digitals, Sending The Exception Report.


Logic Examples Event Logging
The RTU is able to keep a record of variables and their values over time. Variables can be logged on change
or periodically. The maximum number of event logs that an RTU will keep is configured in the RTU
Properties, General tab. By default, the RTU will keep up to 10,000 event logs.

For the two examples below, ErrorStatus is a DINT variable and LogicStatus is a BOOL variable.

Logging Kingfisher Variables
The example below creates an event log whenever digital input 1 (SL03IO3DI1.value) changes state.

REG is configured with the string SL03IO3DI1.value (including the single quotation marks).

Please see the topic ISaGRAF Custom Function Blocks, Event Logging, Event Log for function block
details.

Logging DNP Variables
The example below creates periodic event logs (every 60 seconds) for DNP Analog Input 1 (DNPAI0) with a
priority of 2 (class 2 data).

Please see the topic ISaGRAF Custom Function Blocks, Event Logging, Event Log for function block
details.


Logic Examples Polling
Polling is usually performed by the master RTU in order to get a regular update of remote RTU data and to
determine if communications to the remote RTUs have failed.

Kingfisher protocol allows for full-duplex communications which means the RTU can simultaneously transmit
and receive. However, since most radios are half-duplex, which means that the RTU cannot transmit and
receive simultaneously, it is necessary to force the RTU to wait for a reply to each transmit message. Unless
the RTU is forced to wait, it will transmit all the polling messages one after the other - which can take a few
seconds. Because of the delay, the first polling message will have timed out before the RTU is able to
receive a reply as the RTU is still busy transmitting. The following examples show how to force the RTU to
wait for a reply to each message when polling.

Create one or more Kingfisher Network Register Variables to store the data received from the remote
RTU. Example: KF7R1, KF7R2, KF7R100. Please see the appendix RTU Data - Protocols, Kingfisher
Data, Network Register Variables for details.
Create an INT_ARRAY variable to be used for the REG parameter (example: RTU7Registers).
Configure the Initial Value parameter to correspond to the Local Register Variables to poll from the
remote RTU. Example: to poll Local Register Variables 1, 2 and 100 use an Initial Value of 1,2,100
(please see below for details)
Add the KF_RX_DATA function to an ISaGRAF logic program and configure each of the input
parameters. Assign the INT_ARRAY variable created above to the REG input parameter.
When the function is executed, the RTU will get the local register variables from the remote RTU and
store them in the corresponding network register variables in the local RTU.

Please see the topic ISaGRAF Custom Function Blocks, Kingfisher Messages, Rx Data for function block
details.

Basic Polling
The logic below polls RTU7 Local Register Variables 1, 2 and 100 every 60 seconds when the port is free.
RTU7MsgWaiting, ErrorStatus and PollRTU7 are BOOL variables and RTU7Registers is an INT_ARRAY
variable (as detailed below).


The RTU7Registers variable used above is defined as follows:

The initial value of RTU7Registers allows the KFR1, KFR2 and KFR100 variables to be polled from the
remote RTU.

Polling After Data Has Expired
If a remote RTU has exception reported to the master RTU recently, it is not necessary to poll the remote
RTU until the data is older than X minutes (where X is ideally a SCADA setpoint with a default value of say
10 minutes). If exception reports are generated frequently, it may never be necessary to poll the remote
RTU. Communication statistics are still accumulated as a success is recorded for each exception report
received. Communication Fails are also recorded as the master will still check comms every X minutes if it
has not received a message from the remote RTU during that time. Note: the variables that are exception
reported should be the same as the variables that are polled.

Advantages:
Minimises communications over the network
User can set the maximum age of data before a poll
Disadvantages:
Takes more effort to test

The logic below polls RTU7 Local Register Variables 1, 2 and 100 when the data is too old. The maximum
age of data (in minutes) is set in the variable MaxDataAge (of type DINT). If a message is received from
RTU7 or a poll has occurred, the RTU7QuietTimer (of type DINT) is reset to 0. StatsError, LogicStatus,
and RTU7MsgWaiting are BOOL variables. LastRxSucc, RTU7TxSucc, RTU7TxFails, RTU7RxSucc and
RTU7RxFails are all UDINT variables.


The RTU7Registers variables used above is defined as follows:

remote RTU.

Logic Examples DNP3 Protocol

Setting Up An RTU to be a DNP3 Slave
CP-30
DNP3
Slave
Operator Panel
DNP3 Master
Serial, 9600 bps
Serial
Port 2
Tank Le vel: 95 .2%
Ove rflow: OK
Chlo rine: 0.1 pp m

Add the DNP3 protocol to the RTU (RTU Configuration - Protocols). Edit the DNP3 protocol and
configure the number of local DNP3 objects from the General tab as required.
Add serial port 2 to the RTU configuration (RTU Configuration - Ports). Alternatively an Ethernet port
could be used.
Edit serial port 2 (RTU Configuration - Ports). From the Settings tab of port 2, set Bits per second to
9600 and enable the DNP3 protocol.
Add an ISaGRAF
TM
logic program to copy data into the DNP3 variables as required (RTU Configuration
- Programs). Note: an Initial Value can be configured and an IO channel can be mapped to each DNP3
variable. Please see the topic Dictionary DNP3 Variables for more information.
Download the Configuration and Logic (even if not using a logic program) to the RTU.

Setting Up An RTU to be a DNP3 Master

CP-30
DNP3
Master
Address 23
Serial, 9600 bps
Serial
Port 2
Serial
Port
DNP3
Slave
Device

Add the DNP3 protocol to the RTU (RTU Configuration - Protocols). Edit the DNP3 protocol and
configure the number of local DNP3 objects from the General tab as required. These are the objects that
can be written to the DNP3 slave device.
Add serial port 2 to the RTU configuration (RTU Configuration - Ports). Alternatively an Ethernet port
could be used.
9600 and enable the DNP3 protocol.
Create DNP3 Variables that correspond to the registers to be polled by the CP-30 (Dictionary - Multiple
Variables). Example: DNP23AI0 to DNP23AI4 (DNP3 device 23, Analog Inputs 0 to 4).
Add an ISaGRAF
TM
logic program to copy data into the DNP3 local variables as required (RTU
Configuration - Programs). Note: an Initial Value can be configured and an IO channel can be mapped to
each DNP3 variable.
Configure a DNP3 function block in an ISaGRAF
TM
logic program to poll or send data. An example is
shown below.
Download the Configuration and Logic to the RTU.


The logic below polls class 0 data from DNP3 Device 23 every 10 seconds.


Logic Examples Modbus Protocol
Setting Up An RTU to be a Modbus Slave
CP-30
Modbus
Slave
Operator Panel
Modbus Master
Serial, 9600 bps, Modbus RTU data format
Tank Le vel: 95 .2%
Ove rflow: OK
Chlo rine: 0.1 pp m
Serial
Port 2

Add the Modbus RTU protocol to the RTU (RTU Configuration - Protocols). Alternatively Modbus TCP
can be used an Ethernet port.
Add serial port 2 to the RTU configuration (RTU Configuration - Ports)
9600 and enable the Modbus RTU protocol.
Create local Modbus variables to be polled by the Modbus Master device (Dictionary - New Variables).
Example: MODH71 - Modbus Holding register 71 (40,071). Please see the appendix RTU Data -
Protocols, Modbus Data for Modbus variable formats and addressing details.
Add an ISaGRAF
TM
logic program to copy data into the Modbus variables as required (RTU
Configuration - Programs). Note: an Initial Value can be configured and an IO channel can be mapped to
each Modbus variable.
Download the Configuration and Logic (even if not using a logic program) to the RTU.

Setting Up An RTU to be a Modbus Master

CP-30
Modbus
Master
Modbus Slave
Address 7
Serial, 9600 bps, Modbus RTU data format
Serial
Port 2
Serial
Option
Port

Add the Modbus RTU protocol to the RTU (RTU Configuration - Protocols). Alternatively Modbus TCP
can be used on an Ethernet port.
Add serial port 2 to the RTU configuration (RTU Configuration - Ports).
9600 and enable the Modbus RTU protocol.
Create Modbus Variables to store the data polled from the Modbus Slave device (Dictionary - New
Variables). Example: MOD7H1 to MOD7H5 (Modbus device 7, Holding Registers 1 to 5).
Create local Modbus variables that correspond to the registers to be written to the Modbus Slave device.
Example: MODH14 to MODH16 (Modbus Holding registers 14 to 16). Please see the appendix RTU
Data - Protocols, Modbus Data for Modbus variable formats and addressing details.
Configure a Modbus function block in an ISaGRAF
TM
logic program, using the appropriate variables or
constants for the inputs and output. An example is shown below.


The logic below polls holding registers 1001 and 1002 from Modbus Device 7 every 10 seconds and stores
the data in MOD7H1 and MOD7H2. ErrorStatus, RTU7MsgWaiting and PollRTU7 are BOOL variables.
ModbusStatus is a DINT variable.


Logic Examples Allen Bradley Protocol
Communicating With An Allen Bradley SLC500 PLC
Add the Allen Bradley DF1 protocol to the RTU (RTU Configuration - Protocols).
Add a serial port to the RTU configuration (RTU Configuration - Ports).
Edit the serial port (RTU Configuration - Ports). From the Settings tab of the port, set Bits per second to
the desired baudrate and enable the Allen Bradley protocol.
Add the station address of the PLC to the RTUs Route list (RTU Configuration - Routes). Note: the
station address cannot already be used by another RTU in the list.
Create one or more Kingfisher Local Register variables to send to the PLC or to store data from the PLC.
Example: KFR1 (of type DINT) to KFR200. Please see the appendix RTU Data - Protocols, Kingfisher
Data, Local Register Variables for details.
Configure an Allen Bradley function block in an ISaGRAF
TM
logic program, using the appropriate
variables (ie. correct data type) or constants for the inputs and output. An example is shown below.

The logic below polls 50 registers starting at N10:1 from an Allen Bradley PLC every 10 seconds and stores
the data in KFR10 to KFR60. ErrorStatus, MsgWaiting and PollNow are BOOL variables. ABErrorStatus
is a BYTE variable.

Note 1: The simplest way to connect between an RTU serial port and an Allen Bradley PLC is to use an RS232 null
modem cable (can use the Semaphore ADP-05 adaptor and an RJ45 to RJ45 patch lead). An Allen Bradley SLC5/03
CPU has a DB9 male port while the SLC5/02 CPU has an RS485 RJ45 port and may need to have a communications
module installed for RS232 (RS485 can be used instead).
Note 2: If a 1785-KE interface module is used between the PLC and the RTU, the 1785-KE station number must also be
configured in the Route list. The PLC should then be configured as an indirect link via the 1785-KE station address.


ISaGRAF
TM
- Reserved Variable Names
Listed below are the names that are reserved by ISaGRAF
TM
5.xx and so cannot be used as variable
names. In addition, all names beginning with the underscore character are reserved.

A ABS, ACOS, ADD, ANA, AND, AND_MASK, ANDN, ARRAY, ASIN, AT, ATAN
B BCD_TO_BOOL, BCD_TO_INT, BCD_TO_REAL, BCD_TO_STRING, BCD_TO_TIME, BOO, BOOL,
BOOL_TO_BCD, BOOL_TO_INT, BOOL_TO_REAL, BOOL_TO_STRING, BOOL_TO_TIME, BY,
BYTE
C CAL, CALC, CALCN, CALN, CALNC, CASE, CONCAT, CONSTANT, COS
D DATE, DATE_AND_TIME, DELETE, DINT, DIV, DO, DT, DWORD
E ELSE, ELSIF, EN, END_CASE, END_FOR, END_FUNCTION, END_IF, END_PROGRAM,
END_REPEAT, END_RESOURCE, END_STRUCT, END_TYPE, END_VAR, END_WHILE, ENO, EQ,
EXIT, EXP, EXPT
F FALSE, FIND, FOR, FUNCTION
G GE, GFREEZE, GKILL, GRST, GSTART, GSTATUS, GT
I IF, INSERT, INT, INT_TO_BCD, INT_TO_BOOL, INT_TO_REAL, INT_TO_STRING, INT_TO_TIME
J JMP, JMPC, JMPCN, JMPN, JMPNC
L LD, LDN, LE, LEFT, LEN, LIMIT, LINT, LN, LOG, LREAL, LT, LWORD
M MAX, MID, MIN, MOD, MOVE, MSG, MUL, MUX
N NE, NOT
O OF, ON, OR, OR_MASK, ORN
P PROGRAM
R R, READ_ONLY, READ_WRITE, REAL, REAL_TO_BCD, REAL_TO_BOOL, REAL_TO_INT,
REAL_TO_STRING, REAL_TO_TIME, REPEAT, REPLACE, RESSOURCE, RET, RETAIN, RETC,
RETCN, RETN, RETNC, RETURN, RIGHT, ROL, ROR
S S, SEL, SHL, SHR, SIN, SINT, SQRT, ST, STN, STRING, STRING_TO_BCD, STRING_TO_BOOL,
STRING_TO_INT, STRING_TO_REAL, STRING_TO_TIME, STRUCT, SUB, SUB_DATE_DATE,
SYS_ERR_READ, SYS_ERR_TEST, SYS_INITALL, SYS_INITANA, SYS_INITBOO, SYS_INITTMR,
SYS_RESTALL, SYS_RESTANA, SYS_RESTBOO, SYS_RESTTMR, SYS_SAVALL, SYS_SAVANA,
SYS_SAVBOO, SYS_SAVTMR, SYS_TALLOWED, SYS_TCURRENT, SYS_TMAXIMUM,
SYS_TOVERFLOW, SYS_TRESET, SYS_TWRITE, SYSTEM
T TAN, TASK, THEN, TIME, TIME_OF_DAY, TIME_TO_BCD, TIME_TO_BOOL, TIME_TO_INT,
TIME_TO_REAL, TIME_TO_STRING, TMR, TO, TOD, TRUE, TYPE
U UDINT, UINT, ULINT, UNTIL, USINT
V VAR, VAR_ACCESS, VAR_EXTERNAL, VAR_GLOBAL, VAR_IN_OUT, VAR_INPUT, VAR_OUTPUT
W WHILE, WITH, WORD
X XOR, XOR_MASK, XORN

8. Download

Topic Description
Overview Downloading overview
Connecting To An
RTU
How to establish Ethernet communications between a PC and an RTU
Configuration Downloading configuration settings to an RTU
Logic Downloading ISaGRAF logic and dictionary variables to an RTU
Firmware Downloading firmware into a CP-30, G30 or MC-30/31 module


Download - Overview

Before downloading an RTU configuration and logic, it is recommended that the
project be saved first ie. select File, Save.
When a project is saved, a set of folders is created. The top-level folder uses the
project name. A project can be backed up by saving this set of folders and all
the files they contain.

Configurations, logic programs and firmware can all be downloaded to any RTU that can be directly
communicated with using Ethernet (to CP-30 port 1). Downloads cannot currently be performed through any
intermediate RTUs.

IMPORTANT! Various versions of Toolbox PLUS and firmware have been released. To ensure correct
operation, the Toolbox PLUS version must correspond to the firmware version in the RTU. Required
firmware is listed in the Revision History table at the front of this manual. The firmware version in the RTU
can be checked using the Status command.

Restart
Whenever firmware, a configuration or logic is downloaded, the RTU is restarted. A restart resets all the
variables to the initial values. A restart retains event logs, the RTU configuration and logic.

Restart RTU
Select Tools, Restart


Download - Connecting To An RTU
To connect directly to an RTU with a PC, an Ethernet crossover cable (as supplied with Toolbox PLUS) is
required as illustrated below. If connecting to an Ethernet hub, a straight through cable or a crossover cable
can be used.

Ethernet Crossover Cable
CP-30 PS-11
CP-30 PS-11
Ethernet Straight
Through Patch Cables

Ethernet
Network

The above cables are industry standard and are readily available.

Once a cable is installed, the PCs LAN port needs to be setup as detailed in the next topic.

Note: If the RTU has a Serial option port and the port has already been configured (by first using Ethernet
communications), then Toolbox PLUS can use Serial communications to the RTU as illustrated below.

CP-30 PS-11
Serial Crossover Cable
(Null Modem Cable)
ADP-05
Adaptor
RJ45 Patch Cable


Download - LAN Port Setup
To initially communicate with the RTU, the PCs LAN port must be enabled and setup to communicate with
the RTUs default IP address as detailed below.

1. From Windows Control
Panel, Select Network
Connections. Right-click the
LAN port and select Enable
(this option will only be
available if the LAN port is
disabled).

2. Once the LAN port is
enabled, right-click the LAN
port again and select
Properties. The following
window will then appear.


3. Select Internet Protocol
(TCP/IP) and then click the
Properties button. The
following window will then
appear.

Select Use the following IP
address and enter the IP
address and Subnet mask as
shown and then click OK.

The above settings, assign an IP address to the PCs LAN port. The IP address to be used by Toolbox PLUS
to communicate with the remote RTU now needs to be setup as detailed in the next topic.

Note: once the RTU has been configured with an IP address supported by a LAN, it can be connected to that
LAN. To communicate with the RTU via the LAN, the PCs LAN port should be changed back to Obtain an
IP address automatically (as shown above).

Download - Connection Parameters

Edit Connection Parameters
Select Tools, Connection

By default Toolbox PLUS uses Ethernet to communicate with RTUs. Toolbox PLUS can also use the PCs
serial port to view the status and event logs of an RTU.

Use RTU IP address information: When selected,
Toolbox PLUS uses the IP address configured for port
one of the selected RTU configuration. This option is
used when communicating directly with the target
RTU.
Use the following IP address information: When
selected, Toolbox PLUS uses the specified IP
address. The default IP address used by an RTU is
192.168.0.1. When communicating through a network
of RTUs, this is the IP address of the first RTU.
If the IP address is unknown and the CP-30 processor
is running 1734 firmware or newer, the IP address can
be reset to 192.168.0.1 by removing the link on the
rear of the module and restarting the CP-30 without
the link installed. Restarting the CP-30 without the link
installed clears the configuration and loads the default
settings. Note: the logic is not cleared.
Use the following serial port information: When
selected, Toolbox PLUS uses the specified serial port
(COM1, COM2 ) and speed (9600, 19200, 38400,
57600 or 115200 bps) to communicate with the RTU.
Note: Configurations or logic cannot be downloaded
when using a serial communications.
If using a USB to DB9 serial port converter, a COM
port is assigned to the converter by the PC. To
determine the converter COM port, right-click My
Computer on the Windows Desktop and select
Manage. Select Device Manager on the left hand side
of the Computer Management window. Double-click
Ports on the right hand side of the window. The COM
port assigned to the converter will then be displayed
(the example on the left shows the COM port assigned
to an ATEN converter).
Discovery: detects all RTUs using the same Subnet
address as the local Ethernet port(s) or connected to
the PCs serial port (requires 2285 firmware or newer).

The Advanced tab of the Connection window
contains additional information that may need to be
changed if there is more that one PC communicating
with the RTU, when experiencing delays when
communicating with a remote RTU or when
communicating through a network of RTUs. The
default settings (as shown) can be used in most cases.
Network Address: (1-65535) Because the PC is
treated like another RTU in the network, it must have
its own unique address. Addresses 65521 to 65535
are reserved for Toolbox PLUS. If two or more PCs
running Toolbox PLUS are connected to the same
RTU, each PC should have its own unique address to
avoid communication fails.
Via address: (0-65535) [Only available when using
the Connection options - Use the following IP address
information or Use the following serial port
information]. When using a network of RTUs, this is
the address of the first RTU to communicate through.
Address 0 [default] disables this function.
Timeout (ms): (100 to 60,000 ms [1000 ms = 1 second]) The time waited for a response to a message
attempt before performing the next message attempt or flagging a communications fail. This setting may
need to be lengthened when communicating with a remote RTU (eg. when communicating over a 1200 baud
radio network, 4000 or more milliseconds are recommended.)
Retries: (0-9) The maximum number of attempts (after the first attempt) Toolbox PLUS will have at sending
a message to the RTU if the previous attempts have failed. It is more reliable to set the Number Of Retries to
1 or more when downloading an RTU Configuration or Ladder Logic to a remote RTU.
Repeat Rate (sec): (Continuous, 0.1, 0.2, 0.5, 1, 2, 5, 10, 30, 60 seconds) The rate at which Toolbox PLUS
generates a new message request. If a message fails, Toolbox PLUS will wait until the failed message has
timed out (after 'Timeout' seconds) and then will send the next message at the next Repeat Rate time
interval. When the Repeat Rate is set to 'Continuous' or when downloading files (eg. firmware or
configuration files) messages are continuously sent and received without pausing between messages.
Always use Kingfisher protocol for file transfers: (Tick to Enable) When enabled, Toolbox PLUS uses
the Kingfisher protocol when downloading firmware and configurations over Ethernet or serial connections.
When disabled, Toolbox PLUS uses the SSH internet protocol when downloading over Ethernet (SSH does
not support serial downloads).

Communications Check
If the PCs LAN port is connected to an RTU, the LAN port has been correctly setup and Toolbox PLUS has
the correct IP address of the remote RTU, the Ethernet link can be checked by selecting an RTU in the
navigation pane and then selecting Tools, Status. Toolbox PLUS will then attempt to communicate with the
remote RTU to obtain status information.


Download - Configuration
Downloads the RTU settings (ie. address and RTU properties) without the logic or dictionary variables.

Caution! An RTU will be restarted after downloading the configuration.

Download Configuration
Select Download, Configuration (this option is only available if an RTU
name is selected in the navigation page)

Note: Configurations created using older versions of Toolbox PLUS must be
upgraded before they can be downloaded to the RTU.

Download - Logic
Downloads the logic programs and dictionary variables. Logic programs are automatically checked and
compiled before they are downloaded.

Caution! An RTU will be restarted after downloading the logic.

Download Logic (Only)
Select Download, Logic (this option is only available if an RTU name is
selected in the navigation page)

To check and compile logic programs without downloading, the Build command is used.

Check Logic Program (without downloading)
Select Tools, Build (this option is only available if an RTU name is
selected in the navigation page)

If all is OK, Toolbox PLUS will display the message: Build Successful!


Download - Firmware
Firmware can be downloaded into a processor or communications module to upgrade functionality. The
firmware version that is currently in the CP-30, G30, MC-30 or MC-31 can be checked using the Status
command.

Note: MC-30 firmware can be downloaded into an MC-11 to upgrade it to an MC-30. MC-31 firmware can be
downloaded into a CP-30 to change it into an MC-31 module.

Caution!
An RTU will be restarted after downloading firmware and may take up to two minutes to restart (until the
OK and F3 LEDs are steady ON). After the firmware is downloaded, the OK LED will flash slowly while
the new firmware is being processed. Interrupting the first restart may cause a processor malfunction.
The CP-30/G30 should not be powered down while downloading firmware. Memory corruption may
result.
Before downloading an RTU configuration, the Toolbox PLUS version must correspond to the firmware
version in the RTU. Required firmware is listed in the Revision History table at the front of this manual.

Download CP-30, G30 or MC-31 Firmware
Ensure that an Ethernet cable is connected directly to the module that
firmware will be downloaded to.
Check that Toolbox PLUS can communicate with the module by using the
Status command
Select Download, Firmware
The Connection To RTU window will appear. Specify the IP address of the
Ethernet port that firmware will be downloaded to and then select OK
The Select Firmware File window will appear. Select the firmware file to
download into the CP-30, G30 or MC-31.
Please be patient while the firmware downloads and the RTU restarts

Download MC-30 Firmware
Connect a serial [null modem] cable between the PC
COM and the top port of the MC-30 (or MC-11).
Select Tools, Advanced, Download MC-30
Firmware
Select the Firmware file path and name
(firmware is named MC-30Vxxx.h32 where
xxx=version) and the Serial port to use.
Select OK

RJ45 Cable
DB9 Male PC Serial Port
Adaptor
ADP-05
To USB Port DB9 Male
USB to DB9M RS232 Serial Converter cable
(Only required if PC does not have a spare DB9 serial COM port)
MC-30
Null Modem Cable
OR


9. Viewing Data

Topic Description
Status
View firmware version, date and time, module inputs and outputs and message
totals
Event Logs View time and date stamped data (logs are created using ISaGRAF logic)
Communications View Ethernet messages to and from Toolbox PLUS and between RTUs

The above information can be viewed whenever Toolbox PLUS can successfully communicate with an RTU.


View - Status
Displays the RTU address, firmware version (Build Number), MC-30/31 firmware version, memory usage,
date and time, IO status and the number of messages that have been successfully sent and received. The
date and time can also be set.

View Status
Select Tools, Status
Select the Date & Time tab OR Modules tab OR Statistics tab to view
additional information
Note: if an RTU name is not selected, the Status command will still operate.
Toolbox PLUS will first request the RTU address and System ID of the remote
RTU.


The MC-30/31 firmware version can be viewed by
selecting the MC-30/31 Module above and then
clicking the Details button.

Note: if a message is initiated to a remote device and
there is no route defined for that address, the
Messages Sent Failure count will be incremented
Device Address: (0-65535) Enter the address of the
remote RTU or device to view the message statistics
between the local RTU and that remote RTU or
device. Entering address 0 will display the total
number of messages to and from all remote RTUs
and devices (including messages from Toolbox PLUS
that uses address 65535 by default).


View - Event Logs
Event logs allow the RTU to record time and date stamped data. An event log can be created periodically,
after data changes or on any configurable event using logic. Event logs are initially kept in battery backed
SRAM. Periodically, 4KB blocks of event logs are moved to FLASH RAM (4MB of permanent storage).

View Event Logs
Select Event Log in the wonder bar
Select the Retrieve button
Specify whether to retrieve All Events or the number of newest events to retrieve

Event Log Buttons
Count: Determines how many event logs are stored in the RTU and displays the result (to the right of
the Cancel button).
Filter: Only event logs corresponding to the filter settings will be retrieved if Apply Filter is enabled (tick
to enable).
Retrieve: Retrieves event logs from the RTU. Can retrieve all events or a configurable number of
events.
Export: Saves the uploaded event logs into a CSV file (can be opened using Microsoft Excel).
Clear: Clears all the event logs in the RTU.
Cancel: Only available when retrieving event logs. Stops the uploading of event logs.

Event Log Parameters
Id: Unique index assigned to each event log by the RTU.
Timestamp: Date and time of the event log. Note: Kingfisher IO variables are accurate to one second.
RTU: Address of the RTU that created the event log.
Name: Name of the variable that was logged.
Value: Value of the variable when logged.
Flags: Additional information available when using DNP3.
Type: Configured type of the event log.
Priority: Configured priority of the event log.

Event Log Filter
Allows selected event logs to be retrieved from the RTU.

Configure Event Log Filter
Select Event Log in the wonder bar
Select the Filter button
Specify the General settings of the event logs to upload
Select the Date Range tab to specify time and date settings of the event logs to
upload
Enable Apply Filter (tick to enable) this is tick box is located next to the Count
button.
Select the Retrieve button to upload event logs that correspond to the filter
settings

Max number: (0-65535) Maximum number of event logs to retrieve.

RTU: (1-65520) Event logs corresponding to this address will be retrieved from the selected RTU.

Type: (0-31) Only event logs matching this Type setting will be retrieved.

Priority: (0-7) Only event logs matching this Priority setting will be retrieved.

Range Start: The date and time of the oldest event log to retrieve.

Range Finish: The date and time of the newest event log to retrieve.


View - Communications
Ethernet messages to and from Toolbox PLUS and between RTUs can be viewed using the Wireshark
program.

View Communications
Ensure Wireshark is installed on the PC
Select Tools, Communications (launches Wireshark - this menu option will be
disabled if Wireshark is not installed on the PC)

Wireshark is a network capture and analyser application that can decipher and filter messages and includes
support for Modbus TCP, DNP3 and more that 800 other protocols. Wireshark is designed for Ethernet
network traffic analysis and cannot be used for local analysis of a serial connection (between a PC and an
RTU).

To download a free copy of Wireshark, go to www.wireshark.org. A Kingfisher version of Wireshark is also
available from www.cse-semaphore.com/mykingfisher that has support for deciphering the Kingfisher
protocol.


Wireshark Setup
Select Capture, Interfaces. A window will appear listing all available capture interfaces. Select the Start
button next to the interface that will be used. Wireshark will then begin capturing packets from this interface.

This method captures all of the Ethernet traffic that is directed to or from the Wireshark PC. To capture traffic
that is directed to another device (eg. an RTU) please read on.

Capture Options
(Capture , Options menu - available when Wireshark is not capturing)
Deselect Capture packets in promiscuous mode when only wanting to analyse communications to
and from the Wireshark PC. Leave this option enabled to capture messages from all devices on the
network.
To display messages to or from a particular IP address, enter the filter ip.addr==aaa.bbb.ccc.ddd
where aaa.bbb.ccc.ddd is the required Ethernet address.

Capturing RTU Messages When Using Switches And Routers
Switches and Routers do not broadcast all messages on all ports, but direct messages to the intended port
to minimize network traffic. This means that the PC will not receive all the messages on the network. This
may prevent messages being captured from a remote RTU. This can be solved by connecting everything to
a non-switching hub (these are the older style 10/100 Mbit/s hubs).

A hub sends every message to every port. The hub uses a lower level of logic in that it does not know where
messages are supposed to go, so it sends them to every client on every port and lets those clients accept
the message if they want it and reject it if they dont. This setup allows all the messages to be captured on
the whole network.

To capture messages for an RTU on a switched network, at the RTU end, disconnect the RTU from the
switch. Connect the RTU to the hub and connect the hub to the switch. Then connect the Wireshark PC to
the hub as shown below.


Ethernet Switch
RTU 1 RTU 2
PC will not hear
messages between
RTU1 and RTU2
Ethernet Switch
RTU 1 RTU 2
PC will hear all
messages to and
from RTU2
Non - Switching Hub

For more details on how to access messages that are not directed to the Wireshark PC, please see
http://wiki.wireshark.org/CaptureSetup/Ethernet.

Saving Captured Messages
Once the required messages have been captured, stop capturing messages by selecting Capture, Stop.
The data can then be saved to a file using the menu - File, Save.


10. Appendices

Appendix Description
Glossary Definition of RTU words used in this manual
Kingfisher PLUS+
Details the differences between Kingfisher ISaGRAF
TM
processors (CP-30, G30)
and other processors (PC-1, CP-11, CP-21, LP-1)
Semaphore MIB
RTU parameters that are available for query and setting using the SNMP
Daemon protocol
Redundancy
An RTU can have a second power supply and CP-30 processor that takes control
if the first one fails
Creating Variables
Using Excel
How to export dictionary variables to a Microsoft Excel
TM
spreadsheet and import
the variables back into a Toolbox PLUS configuration
RTU Data Lists the data available from CP-30 or G30 RTUs


Appendix - Glossary
BYTE A group of 8 bits. Each bit can be a 0 (off) or a 1 (on) allowing up to 256 combinations.
CP-30 Kingfisher PLUS+ processor module. Runs the Linux operating system and supports
ISaGRAF
TM
.
DICTIONARY Set of variables available for use in logic programs or to be polled by a remote RTU.
EXCEPTION
REPORT
A sporadic message initiated by a slave RTU to another RTU (usually to the master) to
report new data or a significant event.
FUNCTION
BLOCK
This term refers to a block of code that can be executed by an ISaGRAF
TM
logic program.
Examples of function blocks include AGA gas calculations, hardware configuration and
communication messages.
G30-SA Kingfisher PLUS+ processor module. Runs the Linux operating system and supports
ISaGRAF
TM
. Housed in a stand-alone (SA) enclosure and has one power supply card and
one IO card (optional).
INPUT Signal into the RTU
IO Input, Output
MASTER The device that is responsible for the collection, concentration and ultimate reporting of
information from local and remote devices (conversely described as slave devices). The
Master device may be an RTU or a PC running SCADA software.
The master device is usually responsible for initiating communications with slave devices
(polling) but may also accept unsolicited messages from local and remote devices.
OUTPUT Signal out of the RTU
POLL A periodic message initiated by the master RTU to get the latest data and check the state of
communications to a remote RTU.
PORT A physical connection or socket on an RTU used for communications
PROTOCOL Refers to the format of messages that may be passed to, from and through an RTU in
communication with local and remote devices. Communications may use one or more RTU
ports. Examples of protocols used within telemetry include Kingfisher, Modbus and DNP3.
PS-11 Kingfisher PLUS+ power supply
RTU Acronym for Remote Terminal Unit. Describes a group of processor, communication and IO
modules that comprise a device for monitoring and control of hardware and devices in
remote locations.
SLAVE The device that is responsible for the collection of IO and other information. This data can
then be polled or exception reported to a master device. A slave may be an RTU or
another device.
TCP/IP Transfer Control Protocol / Internet Protocol. Commonly used for Ethernet communications.
UDP Universal Datagram Protocol.


Appendix - Kingfisher PLUS+
The most significant difference between Kingfisher PLUS+ processor modules (PC-1, CP-11, CP-21, LP-x) is
that the CP-30 and G30 processors support ISaGRAF
TM
while the other processors do not. To support
ISaGRAF
TM
, CP-30 and G30 processors handle data in different ways as detailed below.

Item Non-ISaGRAF
TM
Kingfisher
Processors
ISaGRAF
TM
Kingfisher Processors
Processors PC-1, CP-11, CP-21, LP-x CP-30 or G30-SA (stand alone)
Data Limit 2048 Local or Network Registers Virtually Unlimited
Data Format 16-bit registers
Pairs of local registers are used to
create long and float registers (32-
bit)
Most registers are read/write
Variables of various types (Binary,
Integer, Long Integer, Float etc) can
be created in the Dictionary
Storage Location
All registers are stored in Static
RAM.
Local registers are stored in a
fixed location in memory.
Memory for Network registers is
allocated dynamically as needed.
Memory is dynamically allocated to
variables.
Data is stored in the variable itself.
Stores data from Non-ISaGRAF
TM

processors if the corresponding
variables exist in the Dictionary. Eg.
Creating the variable KF17N210 will
allow the RTU to store local register
#R210 from RTU17
Data Address The register address is a
reference to where data is stored
in RTU memory.
Egs. #R533, #DI14.1
Variable names are used to address
data. The RTU manages where the
data is stored. A variable name is a
label that describes the data it
represents.
Egs. SL14IO4DI1,
RTU23_ACPWR_STATUS
RTU System Data System Registers (#Y) allow
access to RTU system data.
Toolbox PLUS automatically adds IO
module variables to the dictionary.
RTU System Data is available from
custom function blocks in
ISaGRAF
TM
.
Available Data Registers do not have to be
created. They are always available
for use in ladder logic.
Data can only be accessed when
variables are created in the
Dictionary (except for IO module
variables that are automatically
created)
Data Transfer Data transferred by referring to
local or network registers
Data transferred by referring to
variable names


Kingfisher PLUS+ General
Item Non-ISaGRAF
TM
Kingfisher
Processors
ISaGRAF
TM
Kingfisher Processors
Configuration
Software
Toolbox 32 Toolbox PLUS
ISaGRAF
TM
Workbench. All international
IEC 61131 control languages are
supported.
Address Range 0-255 (8-bit) 0-65535 (16-bit)
Communications
Path
Called a network link
Direct or indirect
Called a route
Direct or Indirect
Data Transfer Ladder Logic blocks ISaGRAF
TM
Custom Function Blocks
Port Referencing Port Number 1 to 16 Module, Slot Number, Port 1 to 3
Memory Usage Must be manually allocated Automatically allocated
Drivers Download as required Merged automatically by Toolbox PLUS
Protocol Support Supported by some ports Supported by all ports (provided hardware
is suitable)
Projects Optional. RTU configurations can be
kept separate or included in a project.
A project must be created before an RTU
configuration can be created. All RTU
configurations are kept in a project.
Kingfisher TCP/IP
or UDP port
number
473 473
Size of event logs 12 bytes 40 bytes
AI-10 input ranges One range for all 8 channels One range per channel


Kingfisher PLUS+ Protocol
ISaGRAF
TM
processors (CP-30, G30) are designed to be backwards compatible with non-ISaGRAF
TM

processors (PC-1, CP-11, CP-21, LP-1).

ISaGRAF
TM
processors use 16-bit addresses (0-65535) while Non-ISaGRAF
TM
Processors use 8-bit
addresses (0-255). If an RTU network with ISaGRAF
TM
processors only uses RTU addresses less than 256,
then both types of processors are largely compatible for most applications.

An ISaGRAF
TM
processor can handle messages for addresses above 255 while non-ISaGRAF
TM
processor
cannot.

RTU Address Description
0 All RTUs respond to address 0.
1-249 General addresses available to all RTUs
250-255 Reserved for Toolbox 32 / Toolbox PLUS and other PC applications
256-65520 Addresses available for ISaGRAF
TM
processor (CP-30, G30) RTUs
65521-65535 Reserved for Toolbox PLUS and other PC applications

Detailed protocol information can be found in the manual - Kingfisher PLUS+ Protocol - available from
www.cse-semaphore.com/mykingfisher.

Kingfisher Message Structure
Each Kingfisher message has a maximum length of 255 bytes. ISaGRAF
TM
processor modules use two
bytes to store each RTU address while non-ISaGRAF
TM
processor modules use one byte.

[SYSTEM ID][TARGET RTU][NO OF CHARACTERS][INITIATING RTU][VIA RTU][MESSAGE
NO.][FUNCTION CODE] [DATA/ARGUMENTS][CRC]

Number of Bytes Message
Component Non-
ISaGRAF
TM

Processors
ISaGRAF
TM

Processors
Description
SYSTEM ID 1 1 Used to screen and identify incoming messages
TARGET RTU 1 2 Message destination
NO OF
CHARACTERS
1 1 Characters in message excluding System ID and CRC
INITIATING RTU 1 2 Source of the message
VIA RTU 1 2 Relay RTU
MESSAGE NO. 1 1 Sequential Message number. Eg. FF: the first F
indicates the message number. The second F is the
reply number. If the second character is 0, then no reply.
FUNCTION CODE 1 1 Message type as per the protocol
DATA/ARGUMENTS 246 max. 243 max.
CRC 2 2 Ensures data integrity


Appendix - Semaphore MIB
RTU parameters that are available for query and setting using the SNMP daemon protocol include:
RTU network address (configAddress) and system identifier (configSystem)
RTU hardware modules (rtuModulesTable) and I/O states (rtuIOTable)
Event log information (rtuEventsTable)
Network interface and traffic information
These are all defined in the Semaphore MIB below.

In addition to the Semaphore MIB defined below, Kingfisher CP30 and G30 processors also implement the
Management Information Base for Network Management of TCP/IP based internets (MIB-II) as defined in
RFC document 1213. This allows access to system configuration, network interfaces, connection and
protocol information.

SEMAPHORE-RTU-MIB DEFINITIONS ::= BEGIN

IMPORTS
enterprises,
MODULE-IDENTITY,
OBJECT-TYPE,
Integer32,
TimeTicks,
Unsigned32
FROM SNMPv2-SMI
TimeStamp
FROM SNMPv2-TC
OBJECT-GROUP,
MODULE-COMPLIANCE
FROM SNMPv2-CONF;

semaphore MODULE-IDENTITY
LAST-UPDATED "200706261253Z"
ORGANIZATION "CSE Semaphore"
CONTACT-INFO
"Rob Casey <robc@cse-semaphore.com>"
DESCRIPTION
"Semaphore offers the first IP-based RTU solution that enables complete
integration of SCADA, control and communications functionality in one rugged
package. Our products leverage easy-to-use web technologies and inexpensive
public networks to offer dramatically reduced costs versus traditional SCADA
and PLC systems. In addition, Semaphore systems provide fast implementation
and start-up, minimal training and engineering costs and easy integration with
a vast range of third-party devices. Semaphore is the RTU of choice for those
desiring flexible, proven standard or Internet-based technology with minimal
project delay or risks."
REVISION "200706261253Z"
DESCRIPTION
"Initial Revision of Semaphore RTU MIB."
::= { enterprises 27982 }

semaphoreRTUs OBJECT IDENTIFIER ::= { semaphore 1 }

rtuConfig OBJECT IDENTIFIER ::= { semaphoreRTUs 1 }

configType OBJECT-TYPE
SYNTAX OBJECT IDENTIFIER
MAX-ACCESS read-only
STATUS current
DESCRIPTION
"The identifier for the Semaphore RTU product."
::= { rtuConfig 1 }

configAddress OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"The network address of the RTU."
DEFVAL { 1 }
::= { rtuConfig 2 }

configSystem OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"The system identifier for the telemetry system - The identifier is used
within the Kingfisher communications protocol as the synchronisation
character for incoming messages. The recommended value for this identifier
is 0xAE (174), except when configuring an RTU to relay radio messages."
DEFVAL { 174 }
::= { rtuConfig 3 }

configName OBJECT-TYPE
SYNTAX OCTET STRING
STATUS current
DESCRIPTION
"The name of the RTU."
::= { rtuConfig 4 }

configDescription OBJECT-TYPE
SYNTAX OCTET STRING
STATUS current
DESCRIPTION
"The high-level, free-form description of the RTU."
::= { rtuConfig 5 }

rtuParams OBJECT IDENTIFIER ::= { semaphoreRTUs 2 }

paramNumberEvents OBJECT-TYPE
SYNTAX Integer32
STATUS current
DESCRIPTION
"The number of events within the RTU event log. Values less than zero are
indicative that the retrieval of event logs are not supported through SNMP."
DEFVAL { -1 }
::= { rtuParams 1 }

paramNumberAlarms OBJECT-TYPE
SYNTAX Integer32
STATUS current
DESCRIPTION
"The number of alarms within the RTU. Values less than zero are indicative
that the retrieval of alarm information is not supported through SNMP."
DEFVAL { -1 }
::= { rtuParams 2 }

rtuModulesTable OBJECT-TYPE
SYNTAX SEQUENCE OF RtuModulesEntry
MAX-ACCESS not-accessible
STATUS current
DESCRIPTION
"Table of modules installed within RTU."
::= { semaphoreRTUs 3 }

rtuModulesEntry OBJECT-TYPE
SYNTAX RtuModulesEntry
STATUS current
DESCRIPTION
"Entry within table of modules installed within RTU."
INDEX { modulePosition }
::= { rtuModulesTable 1 }

RtuModulesEntry ::= SEQUENCE {
modulePosition Unsigned32,
moduleType Unsigned32
}


modulePosition OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"The installed position of the module within the RTU rack."
::= { rtuModulesEntry 1 }

moduleType OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"The RTU module type."
::= { rtuModulesEntry 2 }

rtuIOTable OBJECT-TYPE
SYNTAX SEQUENCE OF RtuIOEntry
STATUS current
DESCRIPTION
"Table of I/O points available within the RTU module."

rtuIOEntry OBJECT-TYPE
SYNTAX RtuIOEntry
STATUS current
DESCRIPTION
"Entry within table of I/O points available within the RTU module."
INDEX { ioIndex }
::= { rtuIOTable 1 }

RtuIOEntry ::= SEQUENCE {
ioIndex Unsigned32,
ioModule Unsigned32,
ioPosition Unsigned32,
ioType INTEGER,
ioEncoding Integer32,
ioValue OCTET STRING,
ioFlags Integer32
}

ioIndex OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"Index identifier for I/O points."
::= { rtuIOEntry 1 }

ioModule OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"The RTU module associated with the I/O point."

ioPosition OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"The I/O point position within the RTU module."

ioType OBJECT-TYPE
SYNTAX INTEGER {
internal(0),
input(1),
output(2)
}
STATUS current
DESCRIPTION
"The I/O point type."


ioEncoding OBJECT-TYPE
SYNTAX Integer32 (0..255)
STATUS current
DESCRIPTION
"The I/O point encoding."

ioValue OBJECT-TYPE
SYNTAX OCTET STRING (SIZE (0..8))
STATUS current
DESCRIPTION
"The I/O point value."

ioFlags OBJECT-TYPE
STATUS current
DESCRIPTION
"The I/O point flags."

rtuEventsTable OBJECT-TYPE
SYNTAX SEQUENCE OF RtuEventsEntry
STATUS current
DESCRIPTION
"Table of events within RTU."

rtuEventsEntry OBJECT-TYPE
SYNTAX RtuEventsEntry
STATUS current
DESCRIPTION
"Entry within table of events within RTU."
INDEX { eventIdentifier }
::= { rtuEventsTable 1 }

RtuEventsEntry ::= SEQUENCE {
eventIdentifier Unsigned32,
eventTimestamp TimeTicks,
eventRTU Integer32,
eventName OCTET STRING,
eventValue OCTET STRING,
eventEncoding Integer32,
eventFlags Integer32,
eventType Integer32,
eventPriority Integer32
}

eventIdentifier OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"The unique identifier for the event log entry allowing temporal association of
event logs, separate from event timestamps (which may be affected by time skew
between RTUs and RTU modules)."
::= { rtuEventsEntry 1 }

eventTimestamp OBJECT-TYPE
SYNTAX TimeTicks
STATUS current
DESCRIPTION
"The timestamp of the event log."

eventRTU OBJECT-TYPE
STATUS current
DESCRIPTION
"The RTU with which the event log is associated."


eventName OBJECT-TYPE
STATUS current
DESCRIPTION
"The name of the variable associated with the event log."

eventValue OBJECT-TYPE
STATUS current
DESCRIPTION
"The value of the variable associated with the event log."

eventEncoding OBJECT-TYPE
STATUS current
DESCRIPTION
"The encoding of the variable value associated with the event log."

eventFlags OBJECT-TYPE
STATUS current
DESCRIPTION
"Any flags associated with the event log."

eventType OBJECT-TYPE
STATUS current
DESCRIPTION
"The user type of the event log."

eventPriority OBJECT-TYPE
STATUS current
DESCRIPTION
"The user priority of the event log."

rtuAlarmsTable OBJECT-TYPE
SYNTAX SEQUENCE OF RtuAlarmsEntry
STATUS current
DESCRIPTION
"Table of alarms within RTU."

rtuAlarmsEntry OBJECT-TYPE
SYNTAX RtuAlarmsEntry
STATUS current
DESCRIPTION
"Entry within table of alarms within RTU."
INDEX { alarmIndex }
::= { rtuAlarmsTable 1 }

RtuAlarmsEntry ::= SEQUENCE {
alarmIndex Unsigned32,
alarmStartTimestamp TimeStamp,
alarmStartStatus INTEGER,
alarmMessage OCTET STRING,
alarmRecipient OCTET STRING,
alarmEndTimestamp TimeStamp,
alarmEndStatus INTEGER
}


alarmIndex OBJECT-TYPE
SYNTAX Unsigned32
STATUS current
DESCRIPTION
"Index identifier for alarms."
::= { rtuAlarmsEntry 1 }

alarmStartTimestamp OBJECT-TYPE
SYNTAX TimeStamp
STATUS current
DESCRIPTION
"Timestamp at the moment alarm condition appears."

alarmStartStatus OBJECT-TYPE
SYNTAX INTEGER {
noAck(0),
manualAck(1),
autoAck(2)
}
STATUS current
DESCRIPTION
"Status of alarm handling."

alarmMessage OBJECT-TYPE
SYNTAX OCTET STRING
STATUS current
DESCRIPTION
"Alarm message or report file name."

alarmRecipient OBJECT-TYPE
SYNTAX OCTET STRING
STATUS current
DESCRIPTION
"Name of alarm recipient or group."

alarmEndTimestamp OBJECT-TYPE
SYNTAX TimeStamp
STATUS current
DESCRIPTION
"Timestamp at the moment alarm condition disappears."

alarmEndStatus OBJECT-TYPE
SYNTAX INTEGER {
noAck(0),
manualAck(1),
autoAck(2)
}
STATUS current
DESCRIPTION
"Acknowledgement status of alarm."

semaphoreProducts OBJECT IDENTIFIER ::= { semaphore 2 }

productKingfisher OBJECT IDENTIFIER ::= { semaphoreProducts 1 }

productTBox OBJECT IDENTIFIER ::= { semaphoreProducts 2 }

semaphoreGroups OBJECT IDENTIFIER ::= { semaphore 3 }


semaphoreRTUGroup OBJECT-GROUP
OBJECTS {
configType,
configAddress,
configSystem,
configName,
configDescription,
paramNumberEvents,
paramNumberAlarms,
modulePosition,
moduleType,
ioIndex,
ioModule,
ioPosition,
ioType,
ioEncoding,
ioValue,
ioFlags,
eventIdentifier,
eventTimestamp,
eventRTU,
eventName,
eventValue,
eventEncoding,
eventFlags,
eventType,
eventPriority,
alarmIndex,
alarmStartTimestamp,
alarmStartStatus,
alarmMessage,
alarmRecipient,
alarmEndTimestamp,
alarmEndStatus
}
STATUS current
DESCRIPTION
"Managed object group for SEMAPHORE-RTU-MIB module"
::= { semaphoreGroups 1 }

semaphoreCompliances MODULE-COMPLIANCE
STATUS current
DESCRIPTION
"Module compliance information for MIB validation purposes"

MODULE
MANDATORY-GROUPS { semaphoreRTUGroup }
GROUP semaphoreRTUGroup
DESCRIPTION
"Group for RTU related managed objects"
::= { semaphore 4 }

END


Appendix - Redundancy
Redundancy allows RTUs installed in critical applications to continue operating normally when a power
supply, a processor or a communications link fails. Each RTU can also be monitored and controlled by two or
more PCs running SCADA software as detailed in the topic Redundant PCs.

Redundant Processor (odd slot address)
Processor (even slot address)

CP-30

CP-30 PS-11

Standby Active Radio
Standby Redundant Radio
PS-11
Redundant Power Supply
Power Supply
Active Radi o
Redundant Radio
RADIO
RADIO
RADI O
RADI O

Redundant Processors
Two processor modules can provide redundancy by one module operating as the active processor and the
other module operating as the passive processor.

The active processor scans the I/O, runs the logic and manages communications. The passive processor
remains in passive (standby) mode ready to switch to active mode if the active processor fails. Only the
active processor initiates or responds to messages.

To keep the passive processor up to date, logic information, event logs and communication indices are
regularly updated in the passive processor while the active processor is running.

One processor must be installed in an even-numbered slot of the RTU backplane and one processor must
be installed in an odd-numbered slot of the backplane. The processor installed in the even-numbered slot is
initially the active processor and the processor installed in the odd-numbered slot is initially the passive
processor.

The F3 LED indicates active or passive mode of each processor. When steady, the processor is in ACTIVE
mode. When flashing (1 Hz), the processor is in PASSIVE mode.

The processor modules do not need to be installed physically next to each other. They just need to be in odd
and even-numbered slots somewhere on the RTU backplane.

The active processor regularly updates the passive processor with the following items:
ISaGRAF symbols (dictionary variables) that were modified during the last cycle of logic execution. This
includes function block parameters.
New Kingfisher and DNP3 event logs. The values, flags and time stamps as recorded in the active
processor module are all copied. Note: event logs recorded before the last power cycle are not copied to
the passive processor. If all the event logs are cleared in the active processor (eg. using logic), the event
logs in the passive processor will also be cleared.
DNP3 event list indices
Time is synchronised every second. Note: protocols are only enabled on the passive processor after
receiving the first time synchronisation from the active processor. This ensures that I/O points have been
read from the hardware modules before the protocol is enabled.

The passive processor will switch to active mode if communications stop on the backplane for 1500 ms (if
the passive processor is in an odd-numbered slot) or 500ms (if the passive processor is in an even-
numbered slot). This could be caused by:
Removal, reset or failure of the active processor module
Download of the configuration, logic or firmware to the active processor


Configuring Redundant Processors
Ensure one processor is installed in an even slot on the backplane and the other processor is installed in
an odd slot. The even-slot processor will become the active processor and the odd-slot processor will
become the passive processor when the RTU is powered up.
After creating a new CP-30 RTU configuration, add a second CP-30 module to the RTU. The CP-30 in
the even-slot will be labeled CP-30 Active and the processor in the odd-slot will be labeled CP-30
Passive by Toolbox PLUS.
A single configuration can be created for both processors or separate configurations can be created. To
configure separate processors, ensure the Switch button is enabled by selecting the Mirror button. The
processor shown in bold can then be configured. To configure the other processor, select the Switch
button. To use a single configuration for both processors, select the Mirror button (the Switch button will
disappear and both processors will be displayed in regular text).
Once the RTU properties have been configured, download the configuration(s) into both processors.
Note: a single configuration can be downloaded into both processors provided that both processors are
not connected to the same Ethernet network (eg. both processors cannot be connected to the one LAN if
they have the same IP address since both processors will reply to the same message at the same time).

Redundant Power Supplies
Two PS-xx power supplies can be plugged into a backplane and both will run normally, sharing the power
load. If one power supply is removed or fails, the other power supply will supply the complete power load. An
ISaGRAF
TM
program is not required to manage the power supplies.

When two power supplies are present on the backplane, one power supply can be hot swapped while the
RTU is still running. This does not cause any interruption to the processor or inputs and outputs.

To determine the Total Current supplied by both power supplies to the RTU modules and batteries, the
current load for each power supply (SLssPS11AI3.value) is read and the two figures are totalled.


Redundant Communications
It is possible to change the port and/or route used to communicate with a remote RTU if there is a
communications fail.

Note: communications ports on the passive processor cannot be used for redundant communications since
these ports will only operate when the passive processor changes into the active processor.

Redundant Ports
The example below shows how to use CP-30 port 2 as the active port and CP-30 port 3 as the redundant
port. Initially RTU1 is configured with a direct route to RTU7 using port 2. The ladder diagram below shows
how to swap ports after 11 failed communication attempts to RTU7. The configuration will keep switching
between ports if communications continue to fail.

CP30
Port 2
RTU1
Active
Redundant
Port 3
RTU7
RADIO RADIO
RADIO

A number of custom function blocks are used below. Please see the topic ISaGRAF Custom Function
Blocks for function block details and parameter types for Get Route, Get Communication Statistics, Set
Route, Reset Communication Statistics and Rx Data.

In the logic below, RouteError, StatsError and ErrorStatus and LogicStatus are BOOL variables.



remote RTU.


Redundant Routes
The example below shows how to swap between direct and indirect comms routes to RTU7 using the
Kingfisher protocol. Initially RTU1 is configured with a direct route to RTU7 using port 2. Note: to prevent
RTU7 receiving and responding to indirect radio messages that are routed through RTU10, both RTU7 and
RTU10 should have unique System IDs (as illustrated below).

CP30
Direct Active Route
Indirect Redundant Route
CP30
RTU7 RTU1
CP30
RTU10
RADIO RADIO
RADIO
SYSTEM ID=AE
SYSTEM ID=A2
SYSTEM ID=A1

RTU1 Properties:

A number of custom function blocks are used below. Please see the topic ISaGRAF Custom Function
Blocks for function block details and parameter types for Get Route, Get Communication Statistics, Set
Route, Reset Communication Statistics and Rx Data.

In the logic below, RouteError, StatsError and ErrorStatus and LogicStatus are BOOL variables.




remote RTU.


Redundant PCs
Two or more PCs running SCADA or Toolbox PLUS software can be connected to the one RTU as illustrated
below. All the PCs can poll the same data and set the same outputs. If one PC fails, the other PCs will
continue to operate normally.

CP30 MC30 PS11
SCADA
CP30 MC30 PS11
SCADA
Ethernet
Crossover
Cable
RS232
Serial
Crossover
Cable
SCADA
RS485
Serial
Cable
Ethernet
Straight
Through
Patch Cables

Ethernet
Network
SCADA
SCADA
SCADA

Each PC can be assigned its own RTU port or all the PCs can share one Ethernet port by using an Ethernet
Network. Note: a CP-30/MC-30 Ethernet port can handle communications with up to four devices or RTUs
simultaneously.

All the PCs can run the same SCADA software configurations with one exception. Each PC must be
assigned a unique RTU address in the range 65521-65535 to prevent communication conflicts.

The example below configures Toolbox PLUS to use address 65534. Toolbox PLUS uses address 65535 by
default.


Appendix - Creating Variables Using Excel
Dictionary variables in an RTU configuration can be exported to a Microsoft Excel spreadsheet. Variables
can then be edited and created using Excel. When the changes are complete, the spreadsheet is imported
back into the RTU configuration, overwriting any existing variables. This method can be very useful for
creating large quantities of variables with custom settings.

Exporting Variables
Select the RTU name in the navigation pane containing
the variables to export
Select File, Export, To Excel
Select a folder and filename to export the variables to

Importing Variables
Select the RTU name in the navigation pane to store the
imported variables in
Select File, Import, From Excel
Select the Excel spreadsheet (<Filename>.xls) to import
the variables from. Note: the spreadsheet must have the
same columns as the spreadsheet created by the Export
function above.


Importing Notes
Before importing variables from an Excel spreadsheet into an RTU configuration, Toolbox PLUS
extensively checks the spreadsheet for errors. If there are any errors, all variables will not be imported.
When importing IO variables, the corresponding IO module must already exist in the RTU configuration.
If an IO variable is assigned to a slot or channel that is not already defined in the RTU configuration,
variables will not be imported.
When errors are displayed, the row number in the spreadsheet is also displayed so that the error can be
located. Examples:

Rows containing a blank SymbolName (variable name) are ignored

Spreadsheet Format
The spreadsheet is divided into four sections of columns as follows:

The White columns (A to L) contain basic variable parameters

The Yellow columns (M to P) contain optional IO point parameters if the variable is to be linked to an IO
Point

The Blue columns (Q to Z) contain optional parameters for DNP3 variables. These parameters are only read
if the variable has a valid name (SymbolName) and valid data type (SymbolType). For acceptable settings
please see the appendix RTU Data, Protocols, DNP3 Data.

The Green column (AA) contains optional parameters for IEC variables. These parameters are only read if
the variable has a valid name (SymbolName) and valid data type (SymbolType).

Additional columns (AB onwards) can be used for comments and calculations as needed. Columns AB
onwards will be ignored when the spreadsheet is imported back into Toolbox PLUS.


Spreadsheet Parameters
Parameter Description Notes
SymbolName The variable name Maximum length of 128 characters
Only letters, numbers and underscore ( _ )
allowed
Cannot start with a double or single underscore
Cannot start with a number
Cannot be an ISaGRAF Reserved Name
Each variable must have a unique name
Comment A comment for the
variable
Maximum length of 128 characters
SymbolType The data type Must be a type defined and usable within
ISaGRAF
Scope Describes where this
variable is available for
use
The text must be either:
The word Global, which indicates that the
variable can be used in all Functions,
Function Blocks and Programs
The name of a specific Function, Function
Block or Program that the Variable can only
be used in
StringSize The maximum number of
characters in a String
variable
If the variable is not a String, the value must be 0
Attribute A Read Only, Write Only
or Read and Write
variable
Must be: Read, Write or Free (read and write)
Direction Describes the flow of IO
data
If this is not attached to an IO Point, the value
must be Internal. Otherwise, the value must be
Input or Output
Group The dictionary Group Maximum length of 128 characters. If the Group
does not already exist, a new Group will be
created.
Retain Retain variable value
after a reboot
Set Retain to 1 to retain the variable value after a
reboot of the RTU. Otherwise set to 0.
InitialValue An initial value for the
variable
The format of InitialValue depends on its
SymbolType. Array values are entered as values
separated by commas example: 2,3,4 . Strings
are entered as text in single quotations
example: This is a string
String arrays are entered as: first
string,second string,third string
This column is formatted as Text. Cells can be
reformatted as Numeric to allow Excel
calculations. To reformat, select cells or column J
and then select the Excel menu Format, Cells.
From the Number tab, select Number. Once
editing is complete, the cells or column must be
re-formatted back to Text before the spreadsheet
is imported into Toolbox PLUS.
Start Index First index in an array Set to 0 when not using an array. A non-zero
value specifies an array.
End Index Last index in an array Set to 0 when not using an array. Last index must
be greater than or equal to Start Index.
Slot The slot of the IO Point
module
On a G30 RTU, Slot is always 1. If the variable is
not attached to an IO Point, the value can be set
to 1 or left blank.
Card The number of the Option
Card on the Module
If there is no Option Card, as is the case on CP-
30 modules, the value is 1.
G30 MX cards are on option card 2.
G30 power supplies are on option card 3.
If the variable is not attached to an IO Point, the

value can be set to either -1, or left blank.
IOType The type of IO Point Must be: AI, AO, DI, or DO
Channel The IO channel number If the variable is not attached to an IO Point, the
value can be set to -1 or left blank
DnpClass The Class of the DNP
variable
Must be 0, 1, 2 or 3
DnpFrozenClass Frozen Class Must be 0, 1, 2 or 3
Acceptable values depend on the IO Type of the
variable as follows:
IO Type Static
Variation
Binary Input (BI) 1, 2
Binary Output (BO) 1, 2
Binary Counter (BC) 1, 2, 5, 6
Analog Input (AI), IOPOINT_D 1, 2, 3, 4
Analog Input (AI), IOPOINT_R 5
Analog Output (AO), IOPOINT_D 1, 2
DnpStaticVariation Static Variation
Analog Output (AO), IOPOINT_R 3
DnpFrozenStaticVariation Frozen Static Variation Only used by Binary Counter (BC) IO Types.
Must be 1, 2, 5, 6, 9, or 10. All other IO Types
ignore this column.
Acceptable values depend on the IO Type of the
variable as follows:
IO Type Event
Variation
Binary Input (BI) 1, 2, 3
Binary Output (BO) 1, 2
Binary Counter (BC) 1, 2, 5, 6
Analog Input (AI), IOPOINT_D 1, 2, 3, 4
Analog Input (AI), IOPOINT_R 5, 7
Analog Output (AO), IOPOINT_D 1, 2, 3, 4
DnpEventVariation Event Variation
Analog Output (AO), IOPOINT_R 5, 7
DnpFrozenEventVariation Frozen Event Variation Only used by Binary Counter (BC) IO Types.
Must be 1, 2, 5, or 6. All other IO Types ignore
this column.
DnpDeadband The change in value
required to trigger an
Event
Either a percentage value or a raw value
depending on setting of DnpRawLimits
DnpHighLimit Highest value allowed for
this variable
Higher settings are ignored and the value is
limited to this setpoint. Either a percentage value
or a raw value can be specified depending on the
setting of DnpRawLimits.
DnpLowLimit Lowest value allowed for
this variable
Lower settings are ignored and the value is
limited to this setpoint. Either a percentage value
or a raw value can be specified depending on the
setting of DnpRawLimits.
DnpRawLimits Percentage or Raw
values
Type of values used for DnpDeadband,
DnpHighLimit, and DnpLowLimit. 0 = Percentage,
1 = Raw.
IecGroup IEC variable group An integer with range 0 to 16. A value of 0
represents a General group.


Appendix - RTU Data
All data in Kingfisher PLUS+ RTUs is stored as named variables. Space is automatically allocated in RTU
memory according to the number of variables that are created and the size of each variable (eg. if it is a
digital input or a 32 bit counter)

ISaGRAF
TM
programs can use any variables that have been created in the dictionary.

Data is available for IO Modules, IO Cards (G30), System Registers and Protocols.

RTU Data - IO Modules
When an IO module is added to an RTU, variables are automatically created in the dictionary that
correspond to each input, output and data register (eg. counter) available from that module.

Data is available for the following modules: AI-1/AI-4, AI-10, AO-2, AO-3, DI-1, DI-5, DI-10, DO-1, DO-2/DO-
5/DO-6, IO-2, IO-3, IO-4, PS-11/PS-21.

For all the IO variables shown below, ss=slot number 01-64.

AI-1 or AI-4
(Variable Names are shown for the AI1 below)

Data Description Variable Name R/W Notes
Analog Input Ch1 SLssAI1AI1 R
Raw scale 0-32760 = 0-100%

AI-10
Raw scale: Signed -32768 to +32767
The sign bit is set when the current or voltage input is
negative.


AO-2
Analog Output Ch1 SLssAO2AO1 R/W
Raw scale 0-32760 = 0-100%

AO-3
Raw scale 0-32760 = 0-100%
Ch1 Open Loop SLssAO3DI1 R
1 = Open Loop

DI-1
Digital Input Ch1 SLssDI1DI1 R


DI-5
Ch1 Total Pulses SLssDI5AI1 R/W
Ch1 Pulse Rate Hz SLssDI5AI5 R/W
Counts pulses on the first 4 channels. Can count up to
10kHz on channels 1 and 2 and can count up to 255Hz on
channels 3 and 4.

If the maximum pulse rate is exceeded on channels 3 and 4
(>255 Hz), each counter will contain the lowest 8 bits of the
actual pulse rate. Results are unpredictable at pulse rates
greater that 1 kHz


DI-10
Counter 1 SLssDI10AI1 R/W
Has configurable Frequency or Pulse or Quadrature
counting and Sequence-of-Events recording (using event
logs).

Counters 1-7 can count Frequency (0-10kHz max.) or Total
Pulses (0-65535) or Quadrature Count (0-65535) for any
configured channel(s) (as configured using Toolbox PLUS)

DO-1
Digital Output Ch1 SLssDO1DO1 R/W

DO-2/ DO-5 / DO-6
DO-2 has relays in the module
DO-5 and DO-6 have transistor outputs for driving an
external relay board.


IO-2
Digital Input Ch1 SLssIO2DI1 R
Digital Output Ch1 SLssIO2DO1 R/W

IO-3
Analog Input Ch1 SLssIO3AI1 R
Analog Output Ch1 SLssIO3AO1 R/W
Analog raw scale 0-32760 = 0-100%

IO-4


PS-11 or PS-21
Supply Voltage SLssPS11AI1 R Raw Scale= 0-32736, Eng. Units=0 to 32.27V
The DC voltage supplied to the RTU modules on the
backplane (typically 12V) and used to charge the battery.
This voltage is sourced from the battery if there is no input
supply present.
Battery Current SLssPS11AI2 R Raw Scale=0-32736, Eng. Units= -4 to +4 A
Current is positive when charging. Negative when battery is
discharging.
Total Current SLssPS11AI3 R Raw Scale=0-32736, Eng. Units= -4 to +4 A
Total current supplied by the power supply to the RTU
modules and battery.
Battery Temp. SLssPS11AI4 R Raw Scale=0-32736
Eng. Units= -20 to +80 C, 0 C = 6547
Battery Type SLssPS11AI5 R 0 = Default, 1 = Lead-Acid, 2 = Ni-Cad
Battery Size SLssPS11AI6 R Battery Size (x 0.1AH) 0 to 250 = 0 to 25.0 AH Max.
Module Temperature SLssPS11AI7 R Raw Scale=0-32736,
Eng. Units= -20 to +80 C, 0 C = 6547
Power ON SLssPS11DI1 R 1 = AC (PS-11) or DC (PS-21) Power ON
AUX 24V Fail SLssPS11DI2 R 1 = Auxiliary 24V failure or not present
Battery Low SLssPS11DI3 R 0 = Battery low. Note: Active low.
This bit does not indicate if a battery is present as Battery
Low is cleared whenever the input supply is active. If the
input supply is OFF (ie. SLssPS11DI1=0), a battery is
present if the RTU is still running!
Power Supply Type SLssPS11DI4 R 1 = PS-21, 0 = PS-11
Float State SLssPS11DI5 R 1 = float state
Charge State SLssPS11DI6 R 1 = charge state
Boost State SLssPS11DI7 R 1 = boost state
Temperature Sensor
Error
SLssPS11DI8 R 1 = sensor error
Manual Power
Control
SLssPS11DO1 R/W 0 = automatic control (default)
1 = manual control. Allows manual control of Radio and
24V power (and Mains Supply for PS-11)
Radio power OFF SLssPS11DO2 R/W 1 = radio OFF (if SLssPS11DO1=1)
Aux 24V OFF SLssPS11DO3 R/W 1 = 24V OFF (if SLssPS11DO1=1)
Inhibit AC Supply
Input Circuit (PS-11
only)
SLssPS11DO4 R/W 1 = inhibit AC (if SLssPS11DO1=1)


RTU Data - IO Cards
When an IO or power supply card is added to the G30, variables are automatically created in the dictionary
that correspond to each input, output and data register (eg. counter) available from that card.

Data is available for the following cards: IOD-MX2, IOD-MX3, IOD-MX4, PSO-ACR and PSO-DCU.

IOD-MX2
Analog Input Ch1 SL01MX2AI1 R
Digital Input Ch1 SL01MX2DI1 R

Digital Output Ch1 SL01MX2DO1 R/W


IOD-MX3
The MX3 has the same variables as an MX2 (except the variable name uses MX3 instead of MX2) and also
has two analog outputs as detailed below.

Analog Output Ch1 SL01MX3AO1 R/W
Analog Output Ch2 SL01MX3AO2 R/W



IOD-MX4



PSO-ACR
PSO-DCU
Data
Description
ACR Variable
Name
DCU Variable
Name
R/W Notes
Supply Voltage SL01ACRAI1 SL01DCUAI1 R ACR: The DC voltage (V) supplied to the G30 and
option cards (typically 12V) and used to charge the
battery. This voltage is sourced from the battery if
the Mains Supply is Off.
DCR: The DC Input Supply voltage.
Supply Current SL01ACRAI2 SL01DCUAI2 R Current (A) supplied by the ACR power supply or
External Supply (DCU) to the G30 and battery.
Battery Current SL01ACRAI3 N/A R ACR only: Current (A) out of battery (ie. when
discharging). Note: battery current is negative
when charging.
Internal
Temperature
SL01ACRAI4 SL01DCUAI4 R Temperature (C) inside the G30.
External
Temperature
SL01ACRAI5 SL01DCUAI5 R Temperature (C) from the external sensor (if
connected)
Charging Level SL01ACRAO1 N/A R/W ACR only: Battery Charging Level (0 to 100.0 %)
Supply OK SL01ACRDI1 SL01DCUDI1 R DC Supply voltage status: 1=OK, 0=Overload
Auxiliary OK SL01ACRDI2 SL01DCUDI2 R Auxiliary output status: 1=OK, 0=Overload
Mains Detected SL01ACRDI3 N/A R ACR only: 1=Mains Supply Detected, 0=No Mains
Supply.
Battery Charging SL01ACRDI4 N/A R ACR only: 1=Charging, 0=Not charging
Manual Override SL01ACRDO1 SL01DCUDO1 R/W 1=Manual control of outputs
0=Automatic control [default]
RTU Power SL01ACRDO2 SL01DCUDO2 R/W 1=Enable [default], 0=Disable. Caution! If RTU
Power is disabled, the G30 will shut down until the
power supply card is manually switched off and on
again.
Auxiliary Out
Enable
SL01ACRDO3 SL01DCUDO3 R/W 1=Enable [default], 0=Disable


RTU Data - System Registers
The ISaGRAF
TM
system also provides a number of variables that may be used to determine information
about the system.

Variable Name * Read/Write Type Description
_ _SYSVA_RESNAME
R STRING Resource (application) name, maximum length
255 characters
_ _SYSVA_SCANCNT
R DINT Input scan counter
_ _SYSVA_CYCLECNT
R DINT Cycle counter
_ _SYSVA_KVBPERR
R/W BOOL Kernel variable binding producing error
_ _SYSVA_KVBCERR
R/W BOOL Kernel variable binding consuming error
_ _SYSVA_TCYCYCTIME
R/W TIME Programmed cycle time
_ _SYSVA_TCYCURRENT
R TIME Current cycle time
_ _SYSVA_TCYMAXIMUM
R TIME Maximum cycle time since last start
_ _SYSVA_TCYOVERFLOW
R DINT Number of cycle overflows
_ _SYSVA_RESMODE
R SINT Resource execution mode:
-1:fatal error, 0:no resource available, 2:ready to
run, 3:run in real time, 4:run in cycle by cycle,
5:run with SFC breakpoint encountered,
7:stopped in stepping mode
_ _SYSVA_CCEXEC
W BOOL Execute one cycle when application is in cycle
by cycle mod
_ _SYSVA_WNGCMPTNM
R STRING Warning component name
_ _SYSVA_WNGCMD
R/W SINT Warning command. Set it to 1 to get next
warning
_ _SYSVA_WNGARG
R DINT Warning argument
_ _SYSVA_WNGNUM
R DINT Warning number
* The two underscore characters used at the beginning of the variable name do not have a space between them.


RTU Data - Protocols
Variables for the Kingfisher, Modbus and DNP3 protocols are described below. Please see the topic
Dictionary Multiple Variables to create variables for each of these protocols.

Kingfisher Data
Kingfisher Local Register Variables
Variables can be created that correspond to local registers (16-bit) as used in non-ISaGRAF
TM
processor
modules (PC-1, CP-11, CP-21 and LP-1/2/3). Local Register Variables must already exist in the Dictionary
before Local Registers Variables can be used in logic.

Kingfisher local register variables have the format: KFRx

Kingfisher Local Register variables use the DINT data type in ISaGRAF
TM
.

Parameter Description
KF Indicates that it is a Kingfisher variable
R Indicates that it is a local register variable
x The register number (1 to 9999) without leading zeros.

Example
Local register 315, Kingfisher variable = KFR315

Kingfisher Network Register Variables
Local Register Variables polled or received from a remote Kingfisher RTU will only be stored in the local RTU
if Network Register Variables have been manually created for that data.

Kingfisher Network Register Variables have the format: KFrNx

Kingfisher Network Register Variables use the DINT data type in ISaGRAF
TM
.

KF Indicates that it is a Kingfisher variable
r The address of the network (remote) RTU (1 to 65535). No leading zeros.
N Network register variable
x The register number (1 to 9999) without leading zeros.

Example
Local register 210 received from RTU17, stored in variable = KF17N210


Modbus Data
Modbus variables have the format: MODTx or MODrTx

Data polled or received from a remote Modbus device will only be stored in the local RTU if variables have
been manually created for that data.

All Modbus variables use the DINT data type in ISaGRAF
TM
. When using Modbus over Ethernet (Modbus
TCP), the Modbus Ethernet port number is 502. Modbus extended addressing is supported allowing up to
65,535 data points of each type.

MOD Indicates that it is a Modbus variable
r The address of the remote Modbus device (1 to 65535) without leading zeros.
This address is not required for local Modbus variables. Only the lower byte of the
address (1-255) is used in outgoing Modbus messages. Incoming Modbus data is
stored in variables corresponding to the one byte address (1-255).
Variable type Description Modbus Address Range
C Coil 000,001 to 065,535
D Discrete input 100,001 to 165,535
H Holding register 400,001 to 465,535
T
I Input register 300,001 to 365,535
x The variable number (1 to 65535) without leading zeros.

Example
Modbus holding register 256 (Modbus address 400,256) for remote Modbus device 7. Modbus variable =
MOD7H256.


DNP3 Data
Local DNP3 variables are automatically created in the Dictionary when the DNP3 protocol is enabled on a
port and one or more DNP3 objects are configured.

Data polled from a remote DNP3 device will only be stored in the local RTU if variables have been manually
created for that data.

DNP3 variables have the format: DNPTTx or DNPrTTx

DNP Indicates that it is a DNP3 variable
r The address of the remote DNP3 device (1 to 65535) without leading zeros. This
address is not required for local DNP3 variables.
DNP3 object type ISaGRAF
TM
Data Type
BI Binary input IOPOINT_B (binary)
BO Binary output IOPOINT_B (binary)
BC Binary counter IOPOINT_D (double integer)
AI Analog input IOPOINT_D or IOPOINT_R (real)
TT
AO Analog output IOPOINT_D or IOPOINT_R (real)
x The variable number (1 to 65535) without leading zeros.

Example
Binary input 215 for remote DNP device 46. DNP variable = DNP46BI215

ToolboxPLUS+ 3.8.4 User Manual PDF

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ToolboxPLUS+ 3.8.4 User Manual PDF

Uploaded by

Copyright:

Available Formats

For CP-30 and G30 RTUs

Toolbox PLUS User Manual 3.8.4 www.cse-semaphore.com/mykingfisher Page 2

You might also like