1 / 65

Device Management Protocols Protocoles de gestion des appareils Gerätezugangsprotokolle

Industrial Automation Automation Industrielle Industrielle Automation. Device Management Protocols Protocoles de gestion des appareils Gerätezugangsprotokolle. HART, SNMP, TNM, BacNet, MMS. 4. 4.1. Prof. Dr. H. Kirrmann. ABB Research Center, Baden, Switzerland. Contents.

halle
Download Presentation

Device Management Protocols Protocoles de gestion des appareils Gerätezugangsprotokolle

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Industrial Automation Automation IndustrielleIndustrielle Automation Device Management ProtocolsProtocoles de gestion des appareilsGerätezugangsprotokolle HART, SNMP, TNM, BacNet, MMS 4. 4.1 Prof. Dr. H. Kirrmann ABB Research Center, Baden, Switzerland

  2. Contents This part treats device remote access in order of increasing complexity 4.1.1 current loop 4..20 mA 4.1.2 HART 4.1.3 SNMP: Simple Network Management Protocol 4.1.4 Train Network Management 4.1.5 BACnet 4.1.6 Manufacturing Messaging Specification

  3. 4.1.1 Current Loop The classical solution for analog values

  4. Field device: example differential pressure transducer 4..20 mA current loop fluid The device transmits its value by means of a current loop

  5. 4-20 mA loop - the conventional, analog standard (recall) The 4-20 mA is the most common analog transmission standard in industry sensor transducer reader reader reader voltagesource 10V..24V 1 2 3 i(t) = f(v) v R1 R2 R3 RL1 RL2 RL3 RL4 RL4 conductor resistance i(t) = 0, 4..20 mA The transducer limits the current to a value between 4 mA and 20 mA, proportional to the measured value, while 0 mA signals an error (wire break) The voltage drop along the cable and the number of readers induces no error. Simple devices are powered directly by the residual current (4mA) allowing to transmit signal and power through a single pair of wires.

  6. 4.1.2 HART Data over 4..20 mA loops

  7. HART - Principle HART (Highway Addressable Remote Transducer) was developed by Fisher-Rosemount to retrofit 4-to-20mA current loop transducers with digital data communication. HART modulates the 4-20mA current with a low-level frequency-shift-keyed (FSK) sine-wave signal, without affecting the average analogue signal. HART uses low frequencies (1200Hz and 2200 Hz) to deal with poor cabling, its rate is 1200 Bd - but sufficient. HART uses Bell 202 modem technology, ADSL technology was not available in 1989, at the time HART was designed

  8. HART - Protocol Hart communicates point-to-point, under the control of a master, e.g. a hand-held device Master Slave command Indication Request time-out response Response Confirmation Hart frame format (character-oriented): preamble start address command bytecount [status] data data checksum 5..20(xFF) 1 1..5 1 1 [2](slave response) 0..25(recommended) 1

  9. HART - Commands Universal commands (mandatory):identification,primary measured variable and unit (floating point format)loop current value (%) = same info as current loop read current and up to four predefined process variables write short polling addresssensor serial numberinstrument manufacturer, model, tag, serial number, descriptor, range limits, … Common practice (optional)time constants, range,EEPROM control, diagnostics,… total 44 standard commands Transducer-specific (user-defined)calibration data,trimming,…

  10. HART - Importance Practically all 4..20mA devices come equipped with HART today About 40 Mio devices are sold per year. http://www.hartcomm.org/ more info: http://www.thehartbook.com/default.asp

  11. 4.1.3 SNMP (Simple Network Management Protocol for the Internet)

  12. SNMP (Simple Network Management Protocol) - Principle Oldest protocol for management of computer networks simple node: addresses, protocols, performance NetworkManagementStation SNMP Agent Protocol Machine MIB router, bridge,firewall,…routing & translation tables domain name server: directories router router MIB MIB NetworkManagementStation

  13. SNMP - Access to Managed Objects User User agent manager interface interface object interface MIB managed information base Manager Agent call (request) call (indication) reply (confirm) reply (response) UDP UDP IP IP ISO 8802-2 Type 1 ISO 8802-2 Type 1 ISO 8802-3(Ethernet) Token Ring ATM ISO 8802-3(Ethernet) Token Ring ATM management messages internet

  14. SNMP - Assumptions about the underlying communication network - the network is connectionless (datagrams): only UDP is used (no TCP). - manager and agent can send spontaneously messages to each other - all entities must be able to receive and send packets of at least 484 octets - the network must be able of broadcasting (!)

  15. SNMP - Which are the MIB objects ? TCP/UDP/IP (171 objects) NT network (90 objects) DHCP (14 objects) WINS (70 objects) Appletalk Nowell IPX DecNet ….. CISCO (proprietary) The objects are mostly parameters, statistics and error counters used exclusively for the communication itself

  16. SNMP - Operations on objects There are only five operations: Get (read) GetNext (transversal reading) GetResponse (retrieve response) Set (alter) Trap (asynchronous agent notification) Since SNMP does not provide authentication, “Set” commands are normally disabled, Traps are seldom used.

  17. SNMP - How are objects identified ? ISO defined a world-wide addressing scheme on a hierarchical basis: MIB objects are identified by a concatenation of identifiers (e.g. 1.3. 6.1.4.1.9.3.3.1 = atInput) quite wasteful, but bearable in LANs

  18. SNMP - Importance SNMP (SNMP 2) is the keystone for data network management of the Internet It is restricted to the manipulation of communication components. It introduced the concepts of MIB (Managed Information Data base) and universally addressable objects

  19. 4.1.4 Train Network Management - Principle The TNM (Train Network Management) was developed in 1995 for the Train Communication Network (TCN), an on-board network characterized by modest speed (1,0 resp. 1.5 Mbit/s) and specific operations (e.g. autonumbering of vehicles). It allows to control not only the communication stack, the routers and the gateways,but also application variables, downloading and start/stop of processes, … slide door Device Westinghouse Made by Crank2000 Model W23.11.129.43.4 Serial Number 970602.122 Software closed Status 1554 Openings MVB = vehicle bus passenger info door air condition light power brakes vehicle equipment maintenance tool

  20. TNM - Services managed objects agent agent agent PLCs network manager SPY engineering workstation agent agent agent simple devices Network Management defines a set of services for: • development, testing and conformance testing • commissioning: configuration, downloading, routing and marshalling • operation: error and performance monitoring • maintenance: evaluation of error reports, access to equipment information Transmission of network management data takes place interleaved with transmission of time-critical variables

  21. TNM - Summary of managed objects station MVB link WTB link messenger variable domain task clock journal equipment objects objects objects objects objects objects objects object object objects status status status status task 1 domain Function control control control task 2 Directory devices topography reservation task 3 Station Bindings domain inventory task 4 Directory bus administrator Group Directory remote access to variables log for debugging Node Directory databases and tasks communication management All objects have read or write services, and special services such as: force set_up start reserve download stop unforce upload release bindings attach verify_domain

  22. TNM - Communication All communication is by Remote Procedure Calls (paired Call from Manager with Reply from Agent) there are no events, i.e. no spontaneous calls from Agent to Manager Manager Agent call Indication Request time-out reply Response Confirmation A management session is initiated by the manager writing to the reservation object, (a lock which reserves the device for this manager until freed or timed out). Domain download has a special state machine at Manager and Agent since it writes into flash memory (segment after segment).

  23. TNM - Importance TNM is limited to the TCN, it is the base for vehicle diagnostics and remote monitoring over the Internet. It is an optimised, minimal set of services, which cannot be extended outside of TCN. It has strongly been influenced by MMS (see later).

  24. 4.1.5 BacNet The building automation messaging specification

  25. BACnet - Building Automation & Control Network BACnet is a standard for information interchange in building automation issued by ASHRAE (American Society of Heating, Refrigerating and Air-Conditioning Engineers) It is a lightweight version of MMS intended for simple devices, and intended to be the sole information exchange protocol of these devices with other devices. BACnet is not a network in itself, it is a message interchange convention which makes use of existing networks such as LON, Ethernet, … Its origin is in now-extinct building automation busses (M/S) and Echelon’s LonWorks. Ethernet and TCP/IP came later. It does not cover EIB (a popular building automation bus), but EIB adapters exist.

  26. BACnet - Network concept BACnet clients air condition control intrusion access logging housekeeper and tenant backbone (e.g. Ethernet) BACnet server gateway & local control gateway &local control router room controller BACnet servers BACnet servers direct wiring EIB LON centralized LON decentralized BACnet server BACnet server BACnet servers BACnet servers

  27. BVLCI UDP IP any network BACnet - Stack “Application” BACnet Application Layer BACnet Network Layer “Network” MS/TP PTP ISO 8802-2 Type 1 “Link” LonTalk ISO 8802-3(Ethernet) Arcnet RS 485 RS 232 Physical obsolete new (Appendix J) BACnet duplicates much of the (possible) functionality of the communication stack. For instance, it has its own message segmenting protocol and operates with datagrams (connectionless).

  28. BACnet - Requirements to the communication system Devices should be able to communicate directly with peer devices on their network; Devices should be able to do local broadcasts, received by all peer devices on their network (for unconfirmed services); Devices should be able to send remote broadcasts to devices residing on networks with different network numbers; Devices should be able to do global broadcasting. These requirements are difficult to fulfil on TCP/IP, but a proposal for UDP/IP exists, by way of a special device, the BACnet Broadcast Management Device" (BBMD)

  29. BACnet - Object model 32-bit BACnet Object Identifier: unique and valid throughout an installation 10-bit type 22-bit object instance Object Device Object (one per device) Object Object property0 Object property1 property.. Object Within a device, an object is identified by its 32-bit object identifier. Objects are identified in the whole network by the concatenation of their device object identifier and their own object identifier (64 bits). Properties of an object are identified by a 32-bit BACnetPropertyIdentifier

  30. BACnet - 21 Object types 0 Analog Input Sensor input 1 Analog Output actor input 2 Analog Value analog parameter 3 Binary Input switch 4 Binary Output relay 5 Binary Value Binary parameter 6 Calendar Event scheduling by date 7 Command generic command 8 Device describes and controls the device 9 Event Enrolment events and alarm declaration 10 File data file 11 Group device grouping 12 Loop control loop 13 Multi-state Input device with multiple states 14 Multi-state Output status of devics with multiple states 15 Notification Class list of devices to be notified of event and alarm 16 Program start, stop, status of program 17 Schedule weekly event scheduling 18 Averaging minimum, maximum and average value 19 Multistate Value multiple status value 20 Trendlog logging of properties for a set criteria Application-specific Events

  31. lim lim BACnet - Simple object: Analog input object Alarm A/D converter d dt From the plant ChangeOfValue Alarm Present_Value Units Update interval Max_Pres_Value Min_Pres_Value Alarms&Events (main properties)

  32. BACnet - Example of simple object: Analog input object properties Property Identifier Property Data Type Code Conformance Object_Identifier Object_Name Object_Type Present_Value Description Device_Type Status_Flags Event_State Reliability Out_Of_Service Update_Interval Units Min_Pres_Value Max_Pres_Value Resolution COV_Increment Time_Delay Notification_Class High_Limit Low_Limit Deadband Limit_Enable Event_Enable Acked_transitions Notify_Type BACnetObjectIdentifier CharacterString BACnetObjectType REAL CharacterString CharacterString BACnetStatusFlags BACnetEventState BACnetReliability BOOLEAN Unsigned BACnetEngineeringUnits REAL REAL REAL REAL Unsigned Unsigned REAL REAL REAL BAcnetLimitEnable BACnetEventTransitionBits BacnetEventTransitionBits BACnetNotifyType R R R R1 O O R R O R O R O O O O2 O3 O3 O3 O3 O3 O3 O3 O3 O3 10 bit object type + 22 bit object instance corresponding visible string here: ANALOG_INPUTactual value user defined description of sensor (not device), e.g. “TC103” {IN_ALARM, FAULT, OVERIDDEN, OUT_OF_SERVICE} {NO_FAULT, NO_SENSOR, OVER_RANGE,…} in 10 ms increments square meters (0), square feet (1), milliamperes (2)(?!) range of the present value a change by more than this value causes an event (optional) notification class to which this object is tied exceeding these limits triggers an event 1: writable if Out_of_service=true 2: mandatory if COV_reporting 3: mandatory if intrinsic reporting

  33. BACnet - Analog Input Object Example

  34. BACnet - Complex Object: Loop object (PID controller) Setpoint_Ref Setpoint PID Ki dt Analog Value Object AO Plant AI lim Kp Setpoint d dt Kd Integral_Constant Proportional_Constant manipulated variable Derivative_Constant Max/Min_Output Present_Value Manipulated_Var_Ref Analog Output Object Controlled_Var_Ref controlled variable Loop Object Present_Value Analog Input Object

  35. Property Identifier Property Data Type CC Conformance Object_Identifier Object_Name Object_Type Present_Value Description Status_Flags Event_State Reliability Out_Of_Service Update_Interval Output_Units Manipulated_Var_Ref. Controlled_Var_Ref. Controlled_Var_Value Controlled_Var_Units Setpoint_Ref Setpoint Action Proportional_Constant Proportional_Const_Units Integral_Constant Integral_Const_Units Derivative_Constant Derivative_Const_Units Bias Maximum_Output Minimum_Output Priority_For_Writing COV_Increment Time_Delay Notification_Class Error_Limit Event_Enable Acked_transitions Notify_Type BACnetObjectIdentifier CharacterString BACnetObjectType REAL CharacterString BACnetStatusFlags BACnetEventState BACnetReliability BOOLEAN Unsigned BACnetEngineeringUnits BACnetObjectPropertyReference BACnetObjectPropertyReference REAL BACnetEngineeringUnits BACnetSetpointRefence REAL BACnetAction REAL BACnetEngineeringUnits REAL BACnetEngineeringUnits REAL BACnetEngineeringUnits REAL REAL REAL Unsigned REAL Unsigned Unsigned REAL BACnetEventTransitionBits BACnetEventTransitionBits BACnetNotifyType R R R R O R R O R O R R R R R R R R O1 O1 O2 O2 O3 O3 O O O R O4 O5 O5 O5 O5 O5 O5 10 bit object type + 22 bit object instance corresponding visible string here: LOOPactual value user defined description of sensor (not device) references to the three analog objects associated with the loop {direct, reverse} PID controller parameters BACnet - Complex object: loop object properties

  36. BACnet - Events Events are change of value of any object in a device (including the device object) There are three kinds of event: 1) change-of-value (COV) event: a client subscribes with a server to a certain event 2) intrinsic events: changes to configuration 3) algorithmic events: calculations based on values according to a formula

  37. BACnet - Event Enrolment Property Identifier Property Data Type CC Meaning Object_Identifier Object_Name Object_Type Description Event_Type Notify_Type Event_Parameters Object_Property_Reference Event_state Event_Enable Acked_Transition Notification_Class Recipient Process_Identifier Priority Issue_Conformed Notifications BACnetObjectIdentifier CharacterString BACnetObjectType CharacterString BACnetEventType BACnetNotifyType BACnetEventParameter BACnetObjectPropertyReference BacnetEventState BACnetEventTransitionBits BacnetEventTransitionBits unsigned BACnetRecipient Unsigned Unsigned BOOLEAN R R R O R R R R R R R O1 O2 O2 O2 O2 10 bit object type + 22 bit object instance corresponding visible string here: ANALOG_OUTPUTuser defined algorithm, see next slide alam, event, ack-notification see next slide unique property identifier {normal, fault, offnormal, high_limit, low_limit,..} ONE OF (to-offnormal, to_fault, to_normal) ONE OF (to-offnormal, to_fault, to_normal) pointer to notification object device OR addresshandle within notified recipient priority this object is present in the event server (the one which takes the initiative) the BACnet client has no corresponding object 1: only if Notification Object used 2: only if Notification Object not used

  38. BACnet - Event_Type, Event_States and Parameters Event Type Event State Parameters Meaning CHANGE_OF_BITSTRINGCHANGE_OF_STATE CHANGE_OF_VALUE COMMAND_FAILURE FLOATING_LIMIT OUT_OF_RANGE NORMALOFFNORMAL NORMALOFFNORMAL NORMALOFFNORMAL NORMALOFFNORMAL NORMALHIGH_LIMIT LOW_LIMIT NORMALHIGH_LIMIT LOW_LIMIT Time_DelayBitmaskList_Of_Bitstring_Values Time_Delay,List_Of_Values Time_DelayBitmaskReferenced_Property_Increment Time_DelayFeedback_Property_Reference Time_Delay Setpoint_ReferenceLow_Diff_LimitHi_Diff_LimitDeadband Time_DelayLow_LimitHi_LimitDeadband seconds to wait before trigger relevant bits in bitstring several bitstrings seconds reaching one of these states triggers seconds either bit mask (BITSTRING) orvalue change (REAL) which triggers seconds BACnetObjectPropertyReference seconds Setpoint_ReferenceREAL REAL REAL seconds REAL REALREAL

  39. BACnet - Notification Object Property Identifier Property Data Type CC Meaning BACnetObjectIdentifier CharacterString BACnetObjectType CharacterString Unsigned BACnetARRAY[3] of Unsigned BACnetEventTransitionBits List of BACnetDestination R R R O R R R R 10 bit object type + 22 bit object instance corresponding visible string here: NOTIFICATION CLASSuser defined reference given to event-generating object List of destinations, with for each the address of the recipient along with its entry point, the time window during which the event is relevant, and whether an acknowledgement is required to clear the event. Object_Identifier Object_Name Object_Type Description Notification_Class Priority Ack_Required Recipient_List

  40. BACnet - Importance BACnet is slowly becoming an established standard in building automation. It is supported by most firms in the building automation business. Although it started as an “MMS”-light, it has acquired in the years about the same complexity as its model.

  41. 4.1.6 MMS The Original Manufacturing Messaging Specification (MMS)

  42. MMS - Manufacturing Message Specification Developed 1980 (!) for the MAP project (General Motor’s flexible manufacturing initiative) Originally unluckily tied to the OSI communication stack and Token Bus (IEEE 802.4) Reputed for being heavy, complicated and costly due to poor implementations. Boeing adopted MMS as TOPs (MMS on Ethernet), a wise step. Adopted by the automobile industry and power distribution Standardized as: [1] ISO/IEC 9506-1: Industrial Automation systems - Manufacturing Message Specification - Part 1: Service Definition (IS 1990) [2] ISO/IEC 9506-2: Industrial Automation systems - Manufacturing Message Specification - Part 2: Protocol Specification (IS 1990)

  43. MMS - Application field schedule robot configuration

  44. MMS - Concept MMS (Manufacturing Message Specifications) defines: • A set of standard objects which must exist in every conformant device, on which operations can be executed (example: local variables, read and write) or which can start spontaneously a transmission • A set of standard messages exchanged between a manager and an agent station for the purpose of controlling these objects • A set of encoding rules for these messages • A set of rules for exchanging messages between devices (basic protocol) MMS does not specify application-specific operations(e.g. change motor speed). This is covered by application-specific, “companion standards”(e.g. flexible manufacturing, drives, remote meter reading)

  45. MMS - Distributed Control System mode of operation MMS Clients MMS client process database (cache) MMS Servers MMS server process database 1) Polling: a) the bus scans periodically the variables and actualises the local databases b) the Operator Workstation polls cyclically the variables it is interested in 2) Events: a) the Controllers signal predefined events and broadcasts the corresponding values b) the Operator Workstation defines the relevant events and their destination(s)

  46. MMS - Example: External view of a PLC device PLC Human-MachineInterface Journal programs keep track of debugging Operator Station domains (download / upload memory) Files file store variables events only if mass storage available named variables unnamed variables events & alarms program variables state machines for alarms and events memory locations and markers

  47. MMS - Manufacturing Message Specification device device MMS specifies a set MMS specifies a set (e.g. PC) (e.g. SCADA) of messages which of objects which allow an MMS client an MMS server is to control an MMS MMS MMS client expected to contain server server remote request response procedure (command) (reply) call interface communication stack communication stack network linking device (example) router

  48. MMS - Basic Communication Principles MMS assumes that the communication stack offers two services: MMS Requester MMS Responder (client) (server) network Request Indication 1) Remote Procedure Call (Call paired with Reply, synchronous, unicast) processing Confirmation Response 2) Event Reporting event (spontaneous messages sent by server) Request Indication MMS does not specify how to address clients and servers. Messages contain only a communication reference (number which identifies the connection) obtained by unspecified means.

  49. MMS - Communication Stack Association Control Service Element, ACSE, ISO 8649/8650, N2526,N2327 “Application” Abstract syntax notation,ISO 8822/8823, 8824/8825 Presentation ISO 8326/8327 Session ISO 8073 Class 4 Transport ISO 8473 connectionless Network ISO 8802-2 Type 1 Link ISO 8802-3(Ethernet) ISO 8802-4 MAC (token bus) Physical quite heavy… Boeing decided to drop ISO for TCP/IP, is called "TOP".

  50. MMS - Concept of Virtual Manufacturing Device A virtual device represents a piece of equipment A physical device may support one or more virtual devices in parallel e.g. viscometer valve flowmeter Virtual Virtual Virtual Device Device Device Application Programming Interface connection MMS messages (MMSI = MMS interface) establishment communication ACSE stack presentation session transport network link physical

More Related