Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Industrial Automation Automation Industrielle Industrielle Automation Device Management Protocols Protocoles de gestion des appareils Gerätezugangsprotokolle 4. 4.1 HART, SNMP, TNM, BacNet, MMS Prof. Dr. H. Kirrmann ABB Research Center, Baden, Switzerland Contents This part treats device remote access in order of increasing complexity 4.1.1 current loop 4..20 mA 4.1.2 HART 4.1.3 SNMP: Simple Network Management Protocol 4.1.4 Train Network Management 4.1.5 BACnet 4.1.6 Manufacturing Messaging Specification EPFL - Industrial Automation Device Access Protocols 4.1 - 2 4.1.1 Current Loop The classical solution for analog values Field device: example differential pressure transducer 4..20 mA current loop fluid The device transmits its value by means of a current loop EPFL - Industrial Automation Device Access Protocols 4.1 - 4 4-20 mA loop - the conventional, analog standard (recall) The 4-20 mA is the most common analog transmission standard in industry sensor v transducer i(t) = f(v) RL1 reader reader reader 1 2 3 R1 i(t) = 0, 4..20 mA RL2 R2 R3 RL3 voltage source 10V..24V RL4 RL4 conductor resistance The transducer limits the current to a value between 4 mA and 20 mA, proportional to the measured value, while 0 mA signals an error (wire break) The voltage drop along the cable and the number of readers induces no error. Simple devices are powered directly by the residual current (4mA) allowing to transmit signal and power through a single pair of wires. EPFL - Industrial Automation Device Access Protocols 4.1 - 5 4.1.2 HART Data over 4..20 mA loops HART - Principle HART (Highway Addressable Remote Transducer) was developed by Fisher-Rosemount to retrofit 4-to-20mA current loop transducers with digital data communication. HART modulates the 4-20mA current with a low-level frequency-shift-keyed (FSK) sine-wave signal, without affecting the average analogue signal. HART uses low frequencies (1200Hz and 2200 Hz) to deal with poor cabling, its rate is 1200 Bd - but sufficient. HART uses Bell 202 modem technology, ADSL technology was not available in 1989, at the time HART was designed EPFL - Industrial Automation Device Access Protocols 4.1 - 7 HART - Protocol Hart communicates point-to-point, under the control of a master, e.g. a hand-held device Master Slave Indication Request time-out Response Confirmation Hart frame format (character-oriented): preamble start address 5..20 (xFF) 1 1..5 EPFL - Industrial Automation command bytecount 1 1 [status] data data [2] 0..25 (slave response) (recommended) checksum 1 Device Access Protocols 4.1 - 8 HART - Commands Universal commands (mandatory): identification, primary measured variable and unit (floating point format) loop current value (%) = same info as current loop read current and up to four predefined process variables write short polling address sensor serial number instrument manufacturer, model, tag, serial number, descriptor, range limits, … Common practice (optional) time constants, range, EEPROM control, diagnostics,… total 44 standard commands Transducer-specific (user-defined) calibration data, trimming,… EPFL - Industrial Automation Device Access Protocols 4.1 - 9 HART - Importance Practically all 4..20mA devices come equipped with HART today About 40 Mio devices are sold per year. more info: http://www.hartcomm.org/ http://www.thehartbook.com/default.asp EPFL - Industrial Automation Device Access Protocols 4.1 - 10 4.1.3 SNMP (Simple Network Management Protocol for the Internet) SNMP (Simple Network Management Protocol) - Principle Oldest protocol for management of computer networks simple node: addresses, protocols, performance Network Management Station domain name server: directories EPFL - Industrial Automation SNMP Agent Protocol Machine router MIB router MIB MIB router, bridge,firewall,… routing & translation tables Network Management Station Device Access Protocols 4.1 - 12 SNMP - Access to Managed Objects User manager interface User object interface managed information base Manager call (request) reply UDP IP ISO 8802-2 Type 1 ISO 8802-3 Token ATM (Ethernet) Ring MIB Agent reply (confirm) (response) management messages agent interface call (indication) UDP IP ISO 8802-2 Type 1 ISO 8802-3 Token ATM (Ethernet) Ring internet EPFL - Industrial Automation Device Access Protocols 4.1 - 13 SNMP - Assumptions about the underlying communication network - the network is connectionless (datagrams): only UDP is used (no TCP). - manager and agent can send spontaneously messages to each other - all entities must be able to receive and send packets of at least 484 octets - the network must be able of broadcasting (!) EPFL - Industrial Automation Device Access Protocols 4.1 - 14 SNMP - Which are the MIB objects ? TCP/UDP/IP NT network DHCP WINS Appletalk Nowell IPX DecNet ….. CISCO (171 objects) (90 objects) (14 objects) (70 objects) (proprietary) The objects are mostly parameters, statistics and error counters used exclusively for the communication itself EPFL - Industrial Automation Device Access Protocols 4.1 - 15 SNMP - Operations on objects There are only five operations: Get (read) GetNext (transversal reading) GetResponse (retrieve response) Set (alter) Trap (asynchronous agent notification) Since SNMP does not provide authentication, “Set” commands are normally disabled, Traps are seldom used. EPFL - Industrial Automation Device Access Protocols 4.1 - 16 SNMP - How are objects identified ? ISO defined a world-wide addressing scheme on a hierarchical basis: MIB objects are identified by a concatenation of identifiers (e.g. 1.3. 6.1.4.1.9.3.3.1 = atInput) quite wasteful, but bearable in LANs EPFL - Industrial Automation Device Access Protocols 4.1 - 17 SNMP - Importance SNMP (SNMP 2) is the keystone for data network management of the Internet It is restricted to the manipulation of communication components. It introduced the concepts of MIB (Managed Information Data base) and universally addressable objects EPFL - Industrial Automation Device Access Protocols 4.1 - 18 4.1.4 Train Network Management - Principle The TNM (Train Network Management) was developed in 1995 for the Train Communication Network (TCN), an on-board network characterized by modest speed (1,0 resp. 1.5 Mbit/s) and specific operations (e.g. autonumbering of vehicles). It allows to control not only the communication stack, the routers and the gateways, but also application variables, downloading and start/stop of processes, … slide door Device Westinghouse Made by Crank2000 Model Serial Number W23.11.129.43.4 Software Status Openings MVB = vehicle bus door air condition passenger info light power vehicle equipment EPFL - Industrial Automation 970602.122 closed 1554 brakes maintenance tool Device Access Protocols 4.1 - 19 TNM - Services managed objects agent agent agent PLCs network manager SPY engineering workstation agent agent agent simple devices Network Management defines a set of services for: • development, testing and conformance testing • commissioning: configuration, downloading, routing and marshalling • operation: error and performance monitoring • maintenance: evaluation of error reports, access to equipment information Transmission of network management data takes place interleaved with transmission of time-critical variables EPFL - Industrial Automation Device Access Protocols 4.1 - 20 TNM - Summary of managed objects station objects MVB link objects WTB link objects status status status messenger objects variable objects domain objects status domain control control control reservation devices topography Function Directory clock object journal object equipment objects task 1 task 2 task 3 Station Directory inventory task objects Bindings domain task 4 bus administrator Group Directory Node Directory communication management remote access databases and to variables tasks log for debugging All objects have read or write services, and special services such as: reserve release EPFL - Industrial Automation force unforce bindings attach set_up start download stop upload verify_domain Device Access Protocols 4.1 - 21 TNM - Communication there are no events, i.e. no spontaneous calls from Agent to Manager All communication is by Remote Procedure Calls (paired Call from Manager with Reply from Agent) Manager Request Agent Indication time-out Response Confirmation A management session is initiated by the manager writing to the reservation object, (a lock which reserves the device for this manager until freed or timed out). Domain download has a special state machine at Manager and Agent since it writes into flash memory (segment after segment). EPFL - Industrial Automation Device Access Protocols 4.1 - 22 TNM - Importance TNM is limited to the TCN, it is the base for vehicle diagnostics and remote monitoring over the Internet. It is an optimised, minimal set of services, which cannot be extended outside of TCN. It has strongly been influenced by MMS (see later). EPFL - Industrial Automation Device Access Protocols 4.1 - 23 4.1.5 BacNet The building automation messaging specification BACnet - Building Automation & Control Network BACnet is a standard for information interchange in building automation issued by ASHRAE (American Society of Heating, Refrigerating and Air-Conditioning Engineers) It is a lightweight version of MMS intended for simple devices, and intended to be the sole information exchange protocol of these devices with other devices. BACnet is not a network in itself, it is a message interchange convention which makes use of existing networks such as LON, Ethernet, … Its origin is in now-extinct building automation busses (M/S) and Echelon’s LonWorks. Ethernet and TCP/IP came later. It does not cover EIB (a popular building automation bus), but EIB adapters exist. EPFL - Industrial Automation Device Access Protocols 4.1 - 25 BACnet - Network concept BACnet clients housekeeper and tenant air condition control intrusion access logging backbone (e.g. Ethernet) BACnet server room controller gateway & local control gateway & local control router direct wiring EIB LON centralized LON decentralized BACnet server EPFL - Industrial Automation BACnet server BACnet servers BACnet servers Device Access Protocols 4.1 - 26 BACnet - Stack “Application” BACnet Application Layer BACnet Network Layer ISO 8802-2 Type 1 MS/TP PTP BVLCI “Network” “Link” UDP LonTalk RS 485 RS 232 ISO 8802-3 (Ethernet) Arcnet IP any network Physical obsolete new (Appendix J) BACnet duplicates much of the (possible) functionality of the communication stack. For instance, it has its own message segmenting protocol and operates with datagrams (connectionless). EPFL - Industrial Automation Device Access Protocols 4.1 - 27 BACnet - Requirements to the communication system Devices should be able to communicate directly with peer devices on their network; Devices should be able to do local broadcasts, received by all peer devices on their network (for unconfirmed services); Devices should be able to send remote broadcasts to devices residing on networks with different network numbers; Devices should be able to do global broadcasting. These requirements are difficult to fulfil on TCP/IP, but a proposal for UDP/IP exists, by way of a special device, the BACnet Broadcast Management Device" (BBMD) EPFL - Industrial Automation Device Access Protocols 4.1 - 28 BACnet - Object model 32-bit BACnet Object Identifier: unique and valid throughout an installation 10-bit type 22-bit object instance Object Object Device Object (one per device) Object Object Object property0 property1 property.. Within a device, an object is identified by its 32-bit object identifier. Objects are identified in the whole network by the concatenation of their device object identifier and their own object identifier (64 bits). Properties of an object are identified by a 32-bit BACnetPropertyIdentifier EPFL - Industrial Automation Device Access Protocols 4.1 - 29 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Analog Input Analog Output Analog Value Binary Input Binary Output Binary Value Calendar Command Device Event Enrolment File Group Loop Multi-state Input Multi-state Output Notification Class Program Schedule Averaging Multistate Value Trendlog EPFL - Industrial Automation BACnet - 21 Object types Sensor input actor input analog parameter switch relay Binary parameter Application-specific Event scheduling by date generic command describes and controls the device events and alarm declaration data file device grouping Events control loop device with multiple states status of devics with multiple states list of devices to be notified of event and alarm start, stop, status of program weekly event scheduling minimum, maximum and average value multiple status value logging of properties for a set criteria Device Access Protocols 4.1 - 30 BACnet - Simple object: Analog input object Alarm lim From the plant d dt A/D converter ChangeOfValue Alarm lim Present_Value Units Update interval Max_Pres_Value Min_Pres_Value Alarms&Events (main properties) EPFL - Industrial Automation Device Access Protocols 4.1 - 31 BACnet - Example of simple object: Analog input object properties Property Identifier Object_Identifier Object_Name Object_Type Present_Value Description Device_Type Status_Flags Event_State Reliability Out_Of_Service Update_Interval Units Min_Pres_Value Max_Pres_Value Resolution COV_Increment Time_Delay Notification_Class High_Limit Low_Limit Deadband Limit_Enable Event_Enable Acked_transitions Notify_Type Property Data Type BACnetObjectIdentifier CharacterString BACnetObjectType REAL CharacterString CharacterString BACnetStatusFlags BACnetEventState BACnetReliability BOOLEAN Unsigned BACnetEngineeringUnits REAL REAL REAL REAL Unsigned Unsigned REAL REAL REAL BAcnetLimitEnable BACnetEventTransitionBits BacnetEventTransitionBits BACnetNotifyType 1: writable if Out_of_service=true EPFL - Industrial Automation Code R R R R1 O O R R O R O R O O O O2 O3 O3 O3 O3 O3 O3 O3 O3 O3 Conformance 10 bit object type + 22 bit object instance corresponding visible string here: ANALOG_INPUT actual value user defined description of sensor (not device), e.g. “TC103” {IN_ALARM, FAULT, OVERIDDEN, OUT_OF_SERVICE} {NO_FAULT, NO_SENSOR, OVER_RANGE,…} in 10 ms increments square meters (0), square feet (1), milliamperes (2)(?!) range of the present value a change by more than this value causes an event (optional) notification class to which this object is tied exceeding these limits triggers an event 2: mandatory if COV_reporting 3: mandatory if intrinsic reporting Device Access Protocols 4.1 - 32 BACnet - Analog Input Object Example EPFL - Industrial Automation Device Access Protocols 4.1 - 33 BACnet - Complex Object: Loop object (PID controller) Setpoint_Ref Setpoint PID Analog Value Object Setpoint Ki dt Kp Kd lim AO Plant AI d dt Integral_Constant Proportional_Constant manipulated variable Derivative_Constant Max/Min_Output Present_Value Manipulated_Var_Ref Analog Output Object Controlled_Var_Ref controlled variable Loop Object Present_Value Analog Input Object EPFL - Industrial Automation Device Access Protocols 4.1 - 34 BACnet - Complex object: loop object properties Property Identifier Object_Identifier Object_Name Object_Type Present_Value Description Status_Flags Event_State Reliability Out_Of_Service Update_Interval Output_Units Manipulated_Var_Ref. Controlled_Var_Ref. Controlled_Var_Value Controlled_Var_Units Setpoint_Ref Setpoint Action Proportional_Constant Proportional_Const_Units Integral_Constant Integral_Const_Units Derivative_Constant Derivative_Const_Units Bias Maximum_Output Minimum_Output Priority_For_Writing COV_Increment Time_Delay Notification_Class Error_Limit Event_Enable Acked_transitions Notify_Type Property Data Type BACnetObjectIdentifier CharacterString BACnetObjectType REAL CharacterString BACnetStatusFlags BACnetEventState BACnetReliability BOOLEAN Unsigned BACnetEngineeringUnits BACnetObjectPropertyReference BACnetObjectPropertyReference REAL BACnetEngineeringUnits BACnetSetpointRefence REAL BACnetAction REAL BACnetEngineeringUnits REAL BACnetEngineeringUnits REAL BACnetEngineeringUnits REAL REAL REAL Unsigned REAL Unsigned Unsigned REAL BACnetEventTransitionBits BACnetEventTransitionBits BACnetNotifyType EPFL - Industrial Automation CC R R R R O R R O R O R R R R R R R R O1 O1 O2 O2 O3 O3 O O O R O4 O5 O5 O5 O5 O5 O5 Conformance 10 bit object type + 22 bit object instance corresponding visible string here: LOOP actual value user defined description of sensor (not device) references to the three analog objects associated with the loop {direct, reverse} PID controller parameters Device Access Protocols 4.1 - 35 BACnet - Events Events are change of value of any object in a device (including the device object) There are three kinds of event: 1) change-of-value (COV) event: a client subscribes with a server to a certain event 2) intrinsic events: changes to configuration 3) algorithmic events: calculations based on values according to a formula EPFL - Industrial Automation Device Access Protocols 4.1 - 36 BACnet - Event Enrolment Property Identifier Object_Identifier Object_Name Object_Type Description Event_Type Notify_Type Event_Parameters Object_Property_Reference Event_state Event_Enable Acked_Transition Notification_Class Recipient Process_Identifier Priority Issue_Conformed Notifications Property Data Type BACnetObjectIdentifier CharacterString BACnetObjectType CharacterString BACnetEventType BACnetNotifyType BACnetEventParameter BACnetObjectPropertyReference BacnetEventState BACnetEventTransitionBits BacnetEventTransitionBits unsigned BACnetRecipient Unsigned Unsigned BOOLEAN CC R R R O R R R R R R R O1 O2 O2 O2 O2 Meaning 10 bit object type + 22 bit object instance corresponding visible string here: ANALOG_OUTPUT user defined algorithm, see next slide alam, event, ack-notification see next slide unique property identifier {normal, fault, offnormal, high_limit, low_limit,..} ONE OF (to-offnormal, to_fault, to_normal) ONE OF (to-offnormal, to_fault, to_normal) pointer to notification object device OR address handle within notified recipient priority this object is present in the event server (the one which takes the initiative) the BACnet client has no corresponding object 1: only if Notification Object used EPFL - Industrial Automation 2: only if Notification Object not used Device Access Protocols 4.1 - 37 BACnet - Event_Type, Event_States and Parameters Event Type Event State Parameters Meaning CHANGE_OF_BITSTRING NORMAL Time_Delay OFFNORMAL Bitmask List_Of_Bitstring_Values seconds to wait before trigger relevant bits in bitstring several bitstrings CHANGE_OF_STATE NORMAL Time_Delay, OFFNORMAL List_Of_Values seconds reaching one of these states triggers CHANGE_OF_VALUE NORMAL Time_Delay OFFNORMAL Bitmask Referenced_Property_Increment seconds either bit mask (BITSTRING) or value change (REAL) which triggers COMMAND_FAILURE NORMAL Time_Delay OFFNORMAL Feedback_Property_Reference seconds BACnetObjectPropertyReference FLOATING_LIMIT NORMAL HIGH_LIMIT LOW_LIMIT Time_Delay Setpoint_Reference Low_Diff_Limit Hi_Diff_Limit Deadband seconds Setpoint_Reference REAL REAL REAL OUT_OF_RANGE NORMAL HIGH_LIMIT LOW_LIMIT Time_Delay Low_Limit Hi_Limit Deadband seconds REAL REAL REAL EPFL - Industrial Automation Device Access Protocols 4.1 - 38 BACnet - Notification Object Property Identifier Object_Identifier Object_Name Object_Type Description Notification_Class Priority Ack_Required Recipient_List Property Data Type BACnetObjectIdentifier CharacterString BACnetObjectType CharacterString Unsigned BACnetARRAY[3] of Unsigned BACnetEventTransitionBits List of BACnetDestination CC R R R O R R R R Meaning 10 bit object type + 22 bit object instance corresponding visible string here: NOTIFICATION CLASS user defined reference given to event-generating object List of destinations, with for each the address of the recipient along with its entry point, the time window during which the event is relevant, and whether an acknowledgement is required to clear the event. EPFL - Industrial Automation Device Access Protocols 4.1 - 39 BACnet - Importance BACnet is slowly becoming an established standard in building automation. It is supported by most firms in the building automation business. Although it started as an “MMS”-light, it has acquired in the years about the same complexity as its model. EPFL - Industrial Automation Device Access Protocols 4.1 - 40 4.1.6 MMS The Original Manufacturing Messaging Specification (MMS) MMS - Manufacturing Message Specification Developed 1980 (!) for the MAP project (General Motor’s flexible manufacturing initiative) Originally unluckily tied to the OSI communication stack and Token Bus (IEEE 802.4) Reputed for being heavy, complicated and costly due to poor implementations. Boeing adopted MMS as TOPs (MMS on Ethernet), a wise step. Adopted by the automobile industry and power distribution Standardized as: [1] ISO/IEC 9506-1: Industrial Automation systems - Manufacturing Message Specification Part 1: Service Definition (IS 1990) [2] ISO/IEC 9506-2: Industrial Automation systems - Manufacturing Message Specification Part 2: Protocol Specification (IS 1990) EPFL - Industrial Automation Device Access Protocols 4.1 - 42 MMS - Application field schedule robot configuration EPFL - Industrial Automation Device Access Protocols 4.1 - 43 MMS - Concept MMS (Manufacturing Message Specifications) defines: • A set of standard objects which must exist in every conformant device, on which operations can be executed (example: local variables, read and write) or which can start spontaneously a transmission • A set of standard messages exchanged between a manager and an agent station for the purpose of controlling these objects • A set of encoding rules for these messages • A set of rules for exchanging messages between devices (basic protocol) MMS does not specify application-specific operations(e.g. change motor speed). This is covered by application-specific, “companion standards” (e.g. flexible manufacturing, drives, remote meter reading) EPFL - Industrial Automation Device Access Protocols 4.1 - 44 MMS - Distributed Control System mode of operation MMS Clients MMS client process database (cache) MMS Servers MMS server process database 1) Polling: a) the bus scans periodically the variables and actualises the local databases b) the Operator Workstation polls cyclically the variables it is interested in 2) Events: a) the Controllers signal predefined events and broadcasts the corresponding values b) the Operator Workstation defines the relevant events and their destination(s) EPFL - Industrial Automation Device Access Protocols 4.1 - 45 MMS - Example: External view of a PLC device PLC Journal programs keep track of debugging domains (download / upload memory) Files file store only if mass storage available variables named variables unnamed variables program variables Operator Station HumanMachine Interface events events & alarms state machines for alarms and events memory locations and markers EPFL - Industrial Automation Device Access Protocols 4.1 - 46 MMS - Manufacturing Message Specification device (e.g. SCADA) MMS specifies a set of messages which allow an MMS client to control an MMS server remote procedure call interface MMS specifies a set of objects which an MMS server is expected to contain MMS client request device (e.g. PC) MMS server response (command) (reply) communication stack linking device communication stack network (example) router EPFL - Industrial Automation Device Access Protocols 4.1 - 47 MMS - Basic Communication Principles MMS assumes that the communication stack offers two services: MMS Requester (client) Request MMS Responder (server) network Indication 1) Remote Procedure Call (Call paired with Reply, synchronous, unicast) processing Confirmation 2) Event Reporting (spontaneous messages sent by server) Response event Request Indication MMS does not specify how to address clients and servers. Messages contain only a communication reference (number which identifies the connection) obtained by unspecified means. EPFL - Industrial Automation Device Access Protocols 4.1 - 48 MMS - Communication Stack Association Control Service Element, ACSE, ISO 8649/8650, N2526,N2327 “Application” Abstract syntax notation,ISO 8822/8823, 8824/8825 Presentation ISO 8326/8327 Session ISO 8073 Class 4 Transport ISO 8473 connectionless Network ISO 8802-2 Type 1 ISO 8802-3 (Ethernet) Link ISO 8802-4 MAC Physical (token bus) quite heavy… Boeing decided to drop ISO for TCP/IP, is called "TOP". EPFL - Industrial Automation Device Access Protocols 4.1 - 49 MMS - Concept of Virtual Manufacturing Device A virtual device represents a piece of equipment A physical device may support one or more virtual devices in parallel e.g. connection establishment viscometer valve flowmeter Virtual Device Virtual Device Virtual Device Application Programming Interface (MMSI = MMS interface) MMS messages communication stack ACSE presentation session transport network link physical EPFL - Industrial Automation Device Access Protocols 4.1 - 50 MMS - Virtual Manufacturing Device (VMD) An element of typed data (e.g. integer, floating point, array, etc.) A runnable program consisting of one or more domains. Represents a resource (e.g. a program) within the VMD. A display and keyboard for use by an operator. A time based record of events and variables. Program Invocation Named Variable . The device itself is a VMD object Domain Operator Station File Semaphore Event Condition An object that represents the state of an event. EPFL - Industrial Automation Types Transaction Journal Represents an individual MMS service request. Not a named object. Named Variable List A list of variables named as a list. Event Action Represents the action taken when an event condition changes state. Event Enrolment A description of the format of a variable's data. A file in a file store or fileserver. An object used to control access to a shared resource. Which network application to notify when an event condition changes state. Device Access Protocols 4.1 - 51 MMS - 84 Services on the objects VMD Support Domain Management Environment and General Management File Management Operator Communication Variable Access MMS Services Semaphore Management Event Management Journal Management 1. Creation - Deletion 2. Read (Get, Report) 3. Modify (Alter) 4. Invoke (for domains) 5. Operate (Start, Stop,…) EPFL - Industrial Automation Device Access Protocols 4.1 - 52 MMS - Variables Unnamed Variables mapping between MMS and real variable Named Variables Variable Access Objects VADR VNAM Scattered Access Named Variable List Named Type Through the “Variables” service, a client can read and write local variables in a remote device. Variables are identified by the address of the device and either a local address or a name. Variables can be read or written as individual variables (not very efficient) or as lists. In the latter case, a variables list object on the remote device is used. Consistency can be ensured by scattered access. The type of the variable (Real, Unsigned,….) defines its data representation, it is stored in a Named Type object. EPFL - Industrial Automation Device Access Protocols 4.1 - 53 MMS - Types MMS defines the following simple variable types: BOOLEAN BIT STRING BOOLEAN ARRAY INTEGER UNSIGNED FLOATING POINT (IEEE 754) REAL (8824) OCTET STRING VISIBLE STRING GENERALIZED TIME BINARY TIME BCD OBJECT IDENTIFIER Array Structures EPFL - Industrial Automation Device Access Protocols 4.1 - 54 MMS - Variable Access Services Read Write InformationReport(optional) read a remote variable write a remote variable spontaneous send the value to a client DefineNamedVariable assigns named variable to an unnamed & type GetVariableAccessAttributes DefineScatteredAccess GetScatteredAccessAttributes DeleteVariableAccess DefineNamedVariableList GetNamedVariableListAttributes DeleteNamedVariableList defines lists of variables DefineNamedType GetNamedTypeAttributes deleteNamedType defines the types EPFL - Industrial Automation Device Access Protocols 4.1 - 55 MMS - Domains Domains are named memory regions, for the purpose of downloading and uploading large unstructured variables such as program code. Domain loading / uploading requires a special protocol because it can involve the MMS driver itself or even the communication stack. EPFL - Industrial Automation Device Access Protocols 4.1 - 56 MMS - Event services MMS provides services to: - Event Condition (define the boolean condition that triggers an event and its priority) - Event Enrolment (define the MMS client(s) to notify when an event is triggered) - Event Action (define the MMS confirmed service to be executed when the event occurs) MMS client enables/disables event conditions MMS client VMD (MMS server) Event Event Enrolment Condition Who? When? Event Action What? event notification and confirmation Events are the most complicated part of MMS EPFL - Industrial Automation Device Access Protocols 4.1 - 57 MMS - Event triggering MMS client MMS client VMD NETWORKTRIGGERED Event Enrolment Event Condition boolean variable Event Action MONITORED cyclic monitoring plant events are triggered by a change in a boolean variable in the server (monitored event) or by an MMS client (trigger event) as an invitation procedure EPFL - Industrial Automation Device Access Protocols 4.1 - 58 MMS - Primitives MMS Requester (Requesting MMS-user) Request Confirmation M_Associate_Req( MMS_responder_address, calling_application_reference, called_application_reference, communication_parameters, authentication,.. MMS Responder (Receiving MMS-user) Indication Response M_Associate_Ind( MMS_responder_address, calling_application_reference, called_application_reference, communication_parameters, authentication,.. shorter form to describe parameters.... EPFL - Industrial Automation Device Access Protocols 4.1 - 59 MMS - Importance MMS is becoming (after 12 years of existence) a reference model for industry rather than an actual implementation. Its high complexity makes it very general, but difficult to implement It gave rise to several other "simpler" models (DLMS, BacNet, ....) It is the base of the Utility Communication Architecture (UCA), an EPRI-sponsored standardisation of data exchange between control centers. http://www.epri.com/uca/iccp.html For more information, see: http://litwww.epfl.ch/MMS/mms_main.htm EPFL - Industrial Automation Device Access Protocols 4.1 - 60 MMS - Users Renault, FIAT, British Aerospace, Bull, Computervision, Dassault Systèmes, IBM, Matra Datavision, Silicomp, Fraunhofer Institute, Daimler-Benz. Esprit Projects: CNMA (1996), CIMOSA,… EPFL - Industrial Automation Device Access Protocols 4.1 - 61 4.1.7 MMS companion standards MMS does not define the meaning of the exchanged information. For this, companion standards exist, such as: IEC/ISO 9506-5 Industrial automation systems - Manufacturing message specification Part 3: Companion Standard for Robots (1992) Part 4: Companion Standard for Numeric Control (1993) Part 5: Companion Standard for Programmable Controllers (1997) Part 6: Companion Standard for Process Control (1994) One standard which emerged in direct line from MMS is the IEC 61850 „Communication networks and systems in substations“ IEC 61850 defines an MMS implementation based on Ethernet, and elaborates on the object model. It is currently being developed at ABB, Siemens and Alstom for substation automation. EPFL - Industrial Automation Device Access Protocols 4.1 - 62 IEC 61850 - Example of Object Description Key Attribute: PointName Attribute: PointType (REAL, STATE, DISCRETE) Constraint PointType=REAL Attribute: PointRealValue Constraint PointType=STATE Attribute:PointStateValue Constraint PointType=DISCRETE Attribute: PointDiscreteValue Attribute: QualityClass: (QUALITY, NOQUALITY) Attribute: CurrentSource (TELEMETERED, CALCULATED, ENTERED, ESTIMATED) Constraint: QualityClass = QUALITY Attribute: Validity (VALID, HELD, SUSPECT, NOTVALID) Attribute: NormalSource (TELEMETERED, CALCULATED, ENTERED, ESTIMATED) Attribute: NormalValue (NORMAL,ABNORMAL) Attribute: TimeStampClass: (TIMESTAMP, NOTIMESTAMP) Constraint: TimeStampClass = TIMESTAMP Attribute: TimeStamp Attribute: TimeStampQuality: (VALID, INVALID) Attribute: COVClass: (COV, NOCOV) Constraint: COVClass = COV Attribute: COVCounter EPFL - Industrial Automation Device Access Protocols 4.1 - 63 Conclusion Although MMS itself had little success, the concepts behind MMS have inspired numerous other standards. Industrial Communication protocols require a comfortable bandwidth and a certain processing power at the servers, which is incompatible with low-cost, decentralized periphery, but fully in line with the concept “Ethernet in the factory floor”. While HART, NIST and TCN are able to connect relatively simple devices, the same is not true for MMS and its derivatives. The MMS concept is being challenged by OPC/COM/DCOM and by Web Services, but these protocols address a lower level in the communication stack. EPFL - Industrial Automation Device Access Protocols 4.1 - 64 EPFL - Industrial Automation Device Access Protocols 4.1 - 65