APPENDIX I TEJAS PROTOCOL EMULATION

I-1

TEJAS PROTOCOL EMULATION

1.1 GENERAL DESCRIPTION
This section briefly describes the VALMET AUTOMATION/TEJAS communication protocol for reference purposes only. The appropriate VALMET/TEJAS documentation should be consulted for complete details of the protocol. The TEJAS SERIES V standard protocol is an asynchronous protocol designed to connect directly to computer communication ports. The protocol may be used either in a point-to-point or in a multi-drop configuration. The protocol can be used in either half or full-duplex operation. It includes provisions for scanning analog and status point data by direct scan or on a by-exception basis. All communications exchanges in TEJAS protocol are initiated by the host. The remote cannot initiate any exchange with the host nor can the remote directly address or communicate with another remote. The remote will return a response to the host for all valid messages sent by the host and addressed to the remote. The only exception to this is in broadcast (all station) messages which produce no response from any remote. Also, all messages received by the remote are validated by checking the header and trailer bytes. If these bytes are not valid, the remote will ignore the message; no action or response will be initiated.

1.2 MESSAGE STRUCTURE 1.2.1 General

All messages have the following basic structure:

MASTER-TO-REMOTE
Scan requests from the Master or Host consist of 5 or 6 bytes, depending on the type of security code implemented. The request message is:

Station ID Opcode Data Security Code

one byte one byte two bytes one or two bytes

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-1

APPENDIX I TEJAS PROTOCOL EMULATION

I-2

REMOTE-TO-HOST
The addressed remote responds to the Host request by sending a variable length response message.

Station ID RTU Status COS Count Data Security Code

one byte one byte one byte variable length one or two bytes

Station ID
Direction Bit = 1 Direction Bit = 0

Opcode

Data

Data

Security Code

ABER COSR

Station ID

RTU Status

COS Count

Data

Security Code

Figure I-1 Typical RTU Message Exchange

Data is transferred in a standard 10 or 11 bit asynchronous byte oriented format. Each byte consists of a start bit, 8 data bits, an optional parity bit and one stop bit. If a parity bit is used it is selected to be ODD parity. All messages consist of a header, data as required by the function code, and a trailer. The header consists of two bytes. The first byte contains the station ID number and a "direction" bit. The direction bit is the high order bit (most significant) bit of the first byte. The station ID is the low order 7 bits of the first byte. Each remote on a communication line must have a unique address. Valid addresses are 1-127 with 0 reserved as the broadcast address. The second byte of the header is composed of the function code and COSR (COS que Reset) and ABER (Analog By Exception Request) flags in the case of Master-to-Remote transmissions or the RTU Status for Remote-to-Master transmissions. The function code may range from 0 to 63; however, not all possible function codes are currently used. Figure I-2 details the TEJAS Series V function codes and identifies those that are currently implemented in the Comm-Troller. Figure I-3 details the RTU Status Codes.

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-2

APPENDIX I TEJAS PROTOCOL EMULATION

I-3

The data portion of a message is always two bytes in length for a Master-toRemote message. The length of the data portion of a message in a Remote-to-Master transmission varies depending on the function being performed.

Function Code 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16-19 20-23 24-27 28 29 30 34 35 36-63

Description Analog Scan Accumulator Scan Status Point Scan Control Select Control Execute Not Used Accumulator Freeze Accumulator Reset Accumulator Freeze and Reset Status Point Change (COS Dump) RTU Status Clear RTU Configuration Request Analog Deadband Download Analog Change Count Request Analog Change (ABE) Dump Analog Output Select Analog Output Operate Analog Output Direct Control Analog Output Setpont Scan SOE Time Sync Time Tagged COS queue dump Pulse Output (no reply) Pulse Output Reserved or Illegal

Implemented Y Y Y Y Y N Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y N

Figure I-2 TEJAS Function Codes

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-3

APPENDIX I TEJAS PROTOCOL EMULATION

I-4

The message trailer consists of either one byte if the security code is set to LRC or two bytes if it is set to CRC. The LRC is produced at the time of transmission from the host by computing the EXCLUSIVE OR of each byte of data as it is transmitted. The value calculated is sent along with its associated ODD parity bit as the last byte of a transmission.. At the receiving end, all the bytes of a message (including the transmitted LRC) are passed thru the EXCLUSIVE OR calculation. If the result is zero the message was received error free. A non-zero result indicates an error condition. Note that the parity column is not included in the LRC calculation.; the parity bit of the LRC byte is calculated as the odd parity of the eight data bits of the LRC character just like any other byte of data. An optional error check technique appends a standard CRC-16 security code at the end of each message. The technique differs from the LRC in two important ways: the individual data bytes do not include a parity bit and are therefore 10 bits long instead of 11 bits and the CRC-16 check consists of two bytes of security code instead of one. The TEJAS protocol uses the generator polynomial X16 + X15 + X2 + 1 to generate the check word.

1.3 Message Types

TEJAS protocol communications exchanges can be divided into two types: data requests and control requests. In data requests, the host transmits a message requesting data values from the remote. The remote responds by transmitting the requested data values. These data values may be discrete (status), analog, accumulator, calculated variables, remote parameters, RTU status, analog outputs or discrete outputs. The format of the data types are as required by the host. Some variations may exist from site to site provided the host and remote are consistent in the data format (e.g. if the host expects BCD accumulator values, the remote must transmit BCD accumulator values). Note that the Comm-Troller does not do any processing on the data collected from the PLC. The PLC ladder logic must perform any data formatting that is required prior to placing the information in the data area which is read by the Comm-Troller. Control requests are defined as any message from the host requesting the remote to change the state of a field device or to change or modify an internal condition of the remote.

1.6 TEJAS CONFIGURATION TABLE

All setup and operation information that the Comm-Troller requires for operation is obtained from the "Configuration Table". The configuration table is an area of memory in the PLC that is initialized by the PLC programmer using standard PLC programming tools. The Comm-Troller automatically reads this table whenever power is first applied. Once the table has COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS I-4

APPENDIX I TEJAS PROTOCOL EMULATION

I-5

been read into the Comm-Troller memory normal operation begins. Based on information stored in the table the Comm-Troller continuously reads data from the PLC(s) that may be required by the host computer. The data read is placed in a dual ported memory bank that is accessible by the TEJAS protocol emulation microprocessor. When a request for information is received from the host it is answered using data already present in the dual-ported memory. Control commands received from the host are first validated and if correct a message is sent to the PLC to perform the desired control action. The configuration table consists of a header and from one to eight data sections as defined below. The header contains general type information such as the RTU Address, remote communications baud rate and parity and other data as defined in section 1.5.1 below. A data section is defined for each block of data to be read from a PLC. Each data section contains the data highway address of the PLC where the data is located as well as the number items a starting address for each group. Group data can be collected from up to 8 PLCs.

1.6.1 TEJAS Configuration Header

The Comm-Troller interprets the configuration header as a string of bytes. Each byte is used to specify a certain option as defined in the table below. The Allen-Bradley PLC uses words (2-bytes) as its basic unit of storage. The Comm-Troller numbers bytes starting with the first word hi-order (left hand) 8 bits as byte #0. Byte #1 is the low-order (right hand) 8 bits of the word. Byte #2 is the hi byte of the next word, byte #3 is the low byte and so on up to the end. When entering data into the configuration table it is usually most convenient to display and enter the number using hexadecimal notation. When using hexadecimal notation each word is represented by 4 hex characters. The left 2 define the hi byte and the right 2 the low byte. The figure below defines both the PLC word and the Comm-Troller byte number for the configuration header data. WORD 0 HI Byte #0 in the configuration header is used to define the RTU address to which the Comm-Troller will respond when communicating with the host. This entry is an 7-bit binary number in the range of 1 to 127 (01H thru EFH). WORD 0 LOW Byte #1 is used to define the number of configuration data sections that are to be read. This entry is a 2 digit hex number in the range of 01 to 08. WORD ! HI, LOW Bytes #2 and 3 are reserved for use as a Radio Delay Timer. The current implementation of the TEJAS protocol in the Comm-Troller ignores these bytes.

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-5

APPENDIX I TEJAS PROTOCOL EMULATION

I-6

WORD 2 HI Byte #4 is used to define the baud rate which will be used while communicating with the host. This entry is a hex coded number. Valid selections are: 300 baud = 04H, 600 baud = 05H, 1200 baud = 06H, 2400 baud = 08H, 4800 baud = 09H and 9600 baud = 0BH. WORD 2 LOW Byte #5 is used to select the host communication line parity bit. Valid settings for this byte are: No Parity (00H), Odd Parity (01H) and Even Parity (02H). WORD 3 HI Byte #6 is used to select the number of Stop Bits to use when communicating with the host. Valid selections are: 1 Stop Bit (01H) or 2 Stop Bits (02H) WORD 3 LOW thru WORD 7 HI Bytes #7 thru 14 are not recognized by the Comm-Troller for the TEJAS protocol.

Word 0 1 2 3 4-6 7 8,9 10 11 12 13 14 15 16 17 18-24

BYTE # 0,1 2,3 4,5 6,7 4-13 14,15 16-19 20,21 22,23 24,5 16,27 28,29 30,31 32,33 34,35 36-49

Function RTU Number; Number of Data Tables To read Reserved-set to 0000H Baud Rate; Parity Stop Bits; Reserved Reserved Reserved; PLC Swap Enable Reserved CRC Enable; Reserved Message Resync Timer (X10ms) Radio Key Address Maximum Message Length Setpoint Arm Timeout (X10msec) Radio Turn-off Delay (x10msec) Reserved; PLC Address for Reset Accumulator Function Accumulator Reset Address Reserved

Figure I-3 Configuration Header

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-6

APPENDIX I TEJAS PROTOCOL EMULATION

I-7

WORD 7 LOW Byte #15 is the PLC "SWAP" enable flag. If this byte is non-zero any failure detected by the Comm-Troller while communicating with the PLC will result in an automatic switch-over to a backup PLC. The backup PLC must have exactly the same configuration information as the primary PLC. The backup PLC address must be the address of the primary PLC plus 1. If the backup PLC subsequently fails the Comm-Troller will attempt to switch back to the primary unit. If this byte is zero then a switch will not be attempted. WORDS 8 and 9 Bytes 16, 17, 18 and 19 are not used for the TEJAS Comm-Troller. Word 10 HI Byte #20 is used to specify the type of error detection to use. Set this byte to 00H to select LRC mode. Set this byte to 01H to select CRC mode. Word 10 LOW Byte #21 is not used. Set to 00H. WORD 11 HI LOW Bytes #22 and 23 are used to specify a message re-sync time-out period. A timer is started when any character is received. If a break in the message occurs for a time longer than the message re-sync time-out period the previous message characters are discarded and a new message assembly is started. The message re-sync time is equal to the count contained in word 11 times 10 msec. WORD 12 HI LOW Bytes #24 and 25 are used to specify a "radio key address". Some radios used for communication require an external contact closure to "key" or start the radio transmitter. A PLC output could be used to perform this function. Word 12 is used to specify the HEX BYTE ADDRESS of a word in the PLC which will be accessed by the Comm-Troller whenever a message is ready to be transmitted. The least significant bit of the word will be set prior to transmission and reset after transmission is completed.. If word 12 is set to 0000H then no radio keying will be performed. WORD 13 HI, LOW Bytes #26 and 27 are used to specify a maximum message length. WORD 14 HI, LOW Bytes #28 and 29 are used to specify a SETPOINT ARM time-out period. If an execute command is not received within the time-out period then the arm command is discarded. The time-out period is equal to the count contained in word 14 times 10 msec.

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-7

APPENDIX I TEJAS PROTOCOL EMULATION

I-8

WORD 15 HI, LOW Bytes #30 and 31 are used to specify a "radio-turn-off" delay. It is sometimes necessary to keep the radio transmitter keyed at the end of a transmission to insure that the last character is completely sent, especially if there are repeater stations involved. The delay period is equal to the count contained in word 15 times 10 msec. WORD 16 HI, LOW Bytes #32 and 33 are used to specify the address of a PLC to use for the "reset accumulator function". See word 17 below. WORD 17 HI, LOW Bytes #34 and 35 are used to specify the HEX BYTE ADDRESS of a word which will be written when a reset accumulator function is received. The least significant bit of the word will be set on if the function is an accumulator freeze command. The least significant two bits of the word will be set for an accumulator freeze and reset command. WORDS 18 thru 24 Bytes 36 thru 49 are not used. Set to 0000H.

1.6.2 PLC Data Configuration for TEJAS Protocol

The PLC Data Configuration Section(s) are each 57 bytes long. There is one section for each block of data to be read from the PLC or PLCs connected to the Comm-Troller. Each data section must specify a unique PLC address. Multiple reads from a single PLC can be accomplished by using the hi two bits in the PLC address as detailed below. The number of PLCs and thus the number of configuration sections to read is defined by byte #1 in the configuration table header. Up to eight (8) data configuration sections can be defined. The Comm-Troller interprets the configuration data section as a string of bytes just like the configuration header. Each byte is used to specify a certain option as defined in the table below. The Allen-Bradley PLC uses words (2-bytes) as its basic unit of storage. The Comm-Troller numbers bytes starting with the first word hi-order (left hand) 8 bits as byte #0. Byte #1 is the low-order (right hand) 8 bits of the word. Byte #2 is the hi byte of the next word, byte #3 is the low byte and so on up to the end. When entering data into the configuration table it is usually most convenient to display and enter the number using hexadecimal notation. When using hexadecimal notation each word is represented by 4 hex characters. The left 2

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-8

APPENDIX I TEJAS PROTOCOL EMULATION

I-9

define the hi byte and the right 2 the low byte. The figure below defines both the PLC word and the Comm-Troller byte number for the configuration header data. The Configuration data tables start at the next address following the end of the header section. Data sections are read in pairs by the Comm-Troller. Up to 4 pairs (8 data sections) can be defined. The amount of data that can be defined in a single table

Word 0 1 2 3 4 5 6 7 8 9 10 11-27 28

BByte 0,1 2,3 4,5 6,7 8,9 10,11 12,13 14,15 16,17 18,19 20,21 22-55 56;00

Function PLC Address; Size=02 Number of digital inputs/16; Start addx.of Digital Inputs HI Digital Input Addx. LOW; Size=02 Number of Analog Inputs; Start Addx of Analog Inputs HI Analog Input Addx. LOW; Size=02 Number of Accumulators; Start Addx of Accumulators HI Accumulator Addx. LOW; Size=02 Number of Control Outputs/16; Start Addx. of Controls HI Control Addx. LOW; Size=02 Number of Setpoints; Start Addx of Setpoints Setpoint addx LOW; Reserved Reserved Reserved; Next Table Start

Figure I-4 PLC Data Section Config.

cannot exceed 244 bytes because this is the maximum length of an Allen-Bradley read command. Also the Comm-Troller limits the total number of items that can be assigned to a particular data type. WORD 0 HI Byte #0 is used to define the address of the PLC on the Data Highway that contains the data to be accessed. Valid addresses are 01H thru 7fH (001 thru 177 octal) Allen-Bradley uses OCTAL notation to define PLC addresses, therefore it is necessary to convert the octal highway address to a hexadecimal equivalent before entering it in the table. For instance if the highway address is 128 then set byte 0 to 0AH (12 octal = 10 decimal = A hex).

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-9

APPENDIX I TEJAS PROTOCOL EMULATION

I-10

The high-order two bits of the PLC address field are used when multiple reads from the same PLC are required. The address bits are not used by the PLC for the highway address. Using PLC 0AH as an example, a second table can be read from the PLC by setting byte 0 to address 4AH. The tired read will be from address 8AH and the fourth from address CAH. WORD 0 LOW Byte #1 is used to define the number of bytes of data for each status input card. Normally it will be set to 2 because a 16-bit register is used to store 16 bits of status information. In special applications however, PLC ladder logic could be used to form "cards" of any width. The TEJAS Comm-Troller only permits a size of 2. WORD 1 HI Byte #2 is used to define the number of status input registers associated with this PLC. A total of 256 bytes of status input information can be defined per Comm-Troller. WORD 1 LOW and WORD 2 HI Bytes #3 and 4 define the starting address (hex byte address) in the PLC for the status input data. WORD 2 LOW, WORD 3 and WORD 4 HI Bytes #5, 6, 7 and 8 are used in a similar fashion to define the Analog input registers for the PLC. A total of 256 bytes of analog input information can be defined per Comm-Troller. WORD 4 LOW, WORD 5 and WORD 6 HI Bytes #9, 10, 11 and 12 are used to define accumulator inputs. A total of 256 bytes of accumulator information can be defined per Comm-Troller. WORD 6 LOW, WORD 7 and WORD 8 HI Bytes #13, 14, 15 and 16 are used to define control outputs. A total of 64 bytes of control output information can be defined per Comm-Troller WORD 8 LOW, WORD 9 and Word 10 HI Bytes #17, 18, 19 and 20 are used to define analog outputs. A total of 64 bytes of analog output information can be defined per Comm-Troller. WORD 10 LOW thru WORD 28 HI Bytes #21 thru 56 are not used in the TEJAS Comm-Troller. Set all bytes to zero.

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-10

APPENDIX I TEJAS PROTOCOL EMULATION

I-11

1.7 JUMPER SELECTIONS FOR TEJAS PROTOCOL

The Comm-Troller jumper selections and EPROM part numbers for TEJAS protocol operation is detailed in the following figure.

JUMPER J2 J3 J4 J5 J6 J7 J8 J9

POSITION 1-2 NOT USED NOT USED NOT USED 1-2 1-2 NOT USED NOT USED

JUMPER J10 J11 J12 J13 J14 J15 J16 J17

POSITION NOT USED 1-2 1-2 NOT USED NOT USED 1-2 NOT USED NOT USED

TEJAS Protocol Communication is on Port P1 (top port), Allen-Bradley Communication is on Port P2 (center port) U13 = #XXX-XXX-X U23 = #XXX-XXX-X

Figure I-5 Jumper Option Selections

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-11

APPENDIX I TEJAS PROTOCOL EMULATION

I-12

1.8 EXAMPLE CONFIGURATION FILE

The following figures detail a sample configuration file for a typical TEJAS protocol application. The configuration information is based on the following information:

Protocol PLC Type Comm. Data Num. of PLCs Num. of Status Num. of Analogs Num. of Accums Num. of Controls Num. of Setpoints

TEJAS Series V One PLC RTU Address =01) PLC-5/15 Leased Line, 1200 baud, 1 stop, Odd Parity One 144 5 6 112 6

Desired location of configuration table at word 000010 Desired starting location of data at word 20010

Figure I-6 Example System Info. 1.8.1 Comm-Troller Switch Settings

The location of the word which points to the start of the configuration table must be specified by setting the three (3) address selection switches on the Comm-Troller. For this example the switch selections are: Pointer Address= 12810 (decimal word address) = 25610 (decimal byte address) = 0100H (hex byte address) Set Comm-Troller switches to 010 (least significant 0 is implied)

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-12

APPENDIX I TEJAS PROTOCOL EMULATION

I-13

1.8.2 Example Table Entries

PLC WORD 128 000 001 002 003 004 005 006 007 008 009 010 011 012 013 014 015 016-24 VALUE (HEX) 0000 0101 0000 0602 0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 00C8 0000 PLC WORD 025 026 027 028 029 030 031 032 033 034 035 036-53 054 VALUE (HEX) 0A02 0901 9002 0501 A202 0601 AC02 0701 B802 0601 C600 0000 00XX

Figure I-7 Example Table Entries

COPYRIGHT 1991 MIILLE APPLIED RESEARCH CO., INC. HOUSTON, TEXAS

I-13