Transcript Industrial Automation

Industrial Automation
Automation Industrielle
Industrielle Automation
Device Management Protocols
Protocoles de gestion des appareils
Gerätezugangsprotokolle
4.
4.1
HART, SNMP, TNM, BacNet, MMS
Prof. Dr. H. Kirrmann
ABB Research Center, Baden, Switzerland
Contents
This part treats device remote access in order of increasing complexity
4.1.1 current loop 4..20 mA
4.1.2 HART
4.1.3 SNMP: Simple Network Management Protocol
4.1.4 Train Network Management
4.1.5 BACnet
4.1.6 Manufacturing Messaging Specification
EPFL - Industrial Automation
Device Access Protocols 4.1 - 2
4.1.1 Current Loop
The classical solution for analog values
Field device: example differential pressure transducer
4..20 mA current loop
fluid
The device transmits its value by means of a current loop
EPFL - Industrial Automation
Device Access Protocols 4.1 - 4
4-20 mA loop - the conventional, analog standard (recall)
The 4-20 mA is the most common analog transmission standard in industry
sensor
v
transducer
i(t) = f(v)
RL1
reader
reader
reader
1
2
3
R1
i(t) = 0, 4..20 mA
RL2
R2
R3
RL3
voltage
source
10V..24V
RL4
RL4 conductor resistance
The transducer limits the current to a value between 4 mA and 20 mA,
proportional to the measured value, while 0 mA signals an error (wire break)
The voltage drop along the cable and the number of readers induces no error.
Simple devices are powered directly by the residual current (4mA)
allowing to transmit signal and power through a single pair of wires.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 5
4.1.2 HART
Data over 4..20 mA loops
HART - Principle
HART (Highway Addressable Remote Transducer) was developed by Fisher-Rosemount to
retrofit 4-to-20mA current loop transducers with digital data communication.
HART modulates the 4-20mA
current with a low-level
frequency-shift-keyed (FSK)
sine-wave signal, without
affecting the average analogue
signal.
HART uses low frequencies
(1200Hz and 2200 Hz) to deal
with poor cabling, its rate is
1200 Bd - but sufficient.
HART uses Bell 202 modem
technology, ADSL technology
was not available in 1989, at
the time HART was designed
EPFL - Industrial Automation
Device Access Protocols 4.1 - 7
HART - Protocol
Hart communicates point-to-point, under the control of a master, e.g. a hand-held device
Master
Slave
Indication
Request
time-out
Response
Confirmation
Hart frame format (character-oriented):
preamble
start
address
5..20
(xFF)
1
1..5
EPFL - Industrial Automation
command bytecount
1
1
[status]
data
data
[2]
0..25
(slave response) (recommended)
checksum
1
Device Access Protocols 4.1 - 8
HART - Commands
Universal commands (mandatory):
identification,
primary measured variable and unit (floating point format)
loop current value (%) = same info as current loop
read current and up to four predefined process variables
write short polling address
sensor serial number
instrument manufacturer, model, tag, serial number, descriptor,
range limits, …
Common practice (optional)
time constants, range,
EEPROM control, diagnostics,…
total 44 standard commands
Transducer-specific (user-defined)
calibration data,
trimming,…
EPFL - Industrial Automation
Device Access Protocols 4.1 - 9
HART - Importance
Practically all 4..20mA devices come equipped with HART today
About 40 Mio devices are sold per year.
more info:
http://www.hartcomm.org/
http://www.thehartbook.com/default.asp
EPFL - Industrial Automation
Device Access Protocols 4.1 - 10
4.1.3 SNMP
(Simple Network Management Protocol for the Internet)
SNMP (Simple Network Management Protocol) - Principle
Oldest protocol for management of computer networks
simple node: addresses,
protocols, performance
Network
Management
Station
domain name server:
directories
EPFL - Industrial Automation
SNMP
Agent Protocol
Machine
router
MIB
router
MIB
MIB
router, bridge,firewall,…
routing & translation tables
Network
Management
Station
Device Access Protocols 4.1 - 12
SNMP - Access to Managed Objects
User
manager
interface
User
object interface
managed
information
base
Manager
call
(request)
reply
UDP
IP
ISO 8802-2 Type 1
ISO 8802-3 Token
ATM
(Ethernet)
Ring
MIB
Agent
reply
(confirm)
(response)
management
messages
agent
interface
call
(indication)
UDP
IP
ISO 8802-2 Type 1
ISO 8802-3 Token
ATM
(Ethernet)
Ring
internet
EPFL - Industrial Automation
Device Access Protocols 4.1 - 13
SNMP - Assumptions about the underlying communication network
- the network is connectionless (datagrams): only UDP is used (no TCP).
- manager and agent can send spontaneously messages to each other
- all entities must be able to receive and send packets of at least 484 octets
- the network must be able of broadcasting (!)
EPFL - Industrial Automation
Device Access Protocols 4.1 - 14
SNMP - Which are the MIB objects ?
TCP/UDP/IP
NT network
DHCP
WINS
Appletalk
Nowell
IPX
DecNet
…..
CISCO
(171 objects)
(90 objects)
(14 objects)
(70 objects)
(proprietary)
The objects are mostly parameters, statistics and error counters used exclusively for
the communication itself
EPFL - Industrial Automation
Device Access Protocols 4.1 - 15
SNMP - Operations on objects
There are only five operations:
Get
(read)
GetNext
(transversal reading)
GetResponse
(retrieve response)
Set
(alter)
Trap
(asynchronous agent notification)
Since SNMP does not provide authentication, “Set” commands are normally disabled,
Traps are seldom used.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 16
SNMP - How are objects identified ?
ISO defined a world-wide
addressing scheme on a
hierarchical basis:
MIB objects are identified by a
concatenation of identifiers
(e.g. 1.3. 6.1.4.1.9.3.3.1 = atInput)
quite wasteful, but bearable in LANs
EPFL - Industrial Automation
Device Access Protocols 4.1 - 17
SNMP - Importance
SNMP (SNMP 2) is the keystone for data network management of the Internet
It is restricted to the manipulation of communication components.
It introduced the concepts of MIB (Managed Information Data base)
and universally addressable objects
EPFL - Industrial Automation
Device Access Protocols 4.1 - 18
4.1.4 Train Network Management - Principle
The TNM (Train Network Management) was developed in 1995 for
the Train Communication Network (TCN), an on-board network characterized by modest
speed (1,0 resp. 1.5 Mbit/s) and specific operations (e.g. autonumbering of vehicles).
It allows to control not only the communication stack,
the routers and the gateways,
but also application variables, downloading and
start/stop of processes, …
slide door
Device
Westinghouse
Made by
Crank2000
Model
Serial Number
W23.11.129.43.4
Software
Status
Openings
MVB = vehicle bus
door
air condition
passenger info
light
power
vehicle equipment
EPFL - Industrial Automation
970602.122
closed
1554
brakes
maintenance tool
Device Access Protocols 4.1 - 19
TNM - Services
managed objects
agent
agent
agent
PLCs
network
manager
SPY
engineering
workstation
agent
agent
agent
simple devices
Network Management defines a set of services for:
• development, testing and conformance testing
• commissioning: configuration, downloading, routing and marshalling
• operation: error and performance monitoring
• maintenance: evaluation of error reports, access to equipment information
Transmission of network management data takes place interleaved with transmission of time-critical variables
EPFL - Industrial Automation
Device Access Protocols 4.1 - 20
TNM - Summary of managed objects
station
objects
MVB link
objects
WTB link
objects
status
status
status
messenger
objects
variable
objects
domain
objects
status
domain
control
control
control
reservation
devices
topography
Function
Directory
clock
object
journal
object
equipment
objects
task 1
task 2
task 3
Station
Directory
inventory
task
objects
Bindings
domain
task 4
bus
administrator
Group
Directory
Node
Directory
communication management
remote
access
databases and
to
variables tasks
log for
debugging
All objects have read or write services, and special services such as:
reserve
release
EPFL - Industrial Automation
force
unforce
bindings
attach
set_up
start
download
stop
upload
verify_domain
Device Access Protocols 4.1 - 21
TNM - Communication
there are no events, i.e.
no spontaneous calls
from Agent to Manager
All communication is by Remote Procedure Calls
(paired Call from Manager with Reply from Agent)
Manager
Request
Agent
Indication
time-out
Response
Confirmation
A management session is initiated by the manager writing to the reservation object,
(a lock which reserves the device for this manager until freed or timed out).
Domain download has a special state machine at Manager and Agent since it writes into
flash memory (segment after segment).
EPFL - Industrial Automation
Device Access Protocols 4.1 - 22
TNM - Importance
TNM is limited to the TCN, it is the base for vehicle diagnostics and remote monitoring
over the Internet.
It is an optimised, minimal set of services, which cannot be extended outside of TCN.
It has strongly been influenced by MMS (see later).
EPFL - Industrial Automation
Device Access Protocols 4.1 - 23
4.1.5 BacNet
The building automation messaging specification
BACnet - Building Automation & Control Network
BACnet is a standard for information interchange in building automation issued by
ASHRAE (American Society of Heating, Refrigerating and Air-Conditioning Engineers)
It is a lightweight version of MMS intended for simple devices, and intended to be the sole
information exchange protocol of these devices with other devices.
BACnet is not a network in itself, it is a message interchange convention which makes use
of existing networks such as LON, Ethernet, …
Its origin is in now-extinct building automation busses (M/S) and Echelon’s LonWorks.
Ethernet and TCP/IP came later.
It does not cover EIB (a popular building automation bus), but EIB adapters exist.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 25
BACnet - Network concept
BACnet
clients
housekeeper
and
tenant
air
condition
control
intrusion
access
logging
backbone (e.g. Ethernet)
BACnet
server
room
controller
gateway &
local control
gateway &
local control
router
direct wiring
EIB
LON centralized
LON decentralized
BACnet
server
EPFL - Industrial Automation
BACnet
server
BACnet
servers
BACnet
servers
Device Access Protocols 4.1 - 26
BACnet - Stack
“Application”
BACnet Application Layer
BACnet Network Layer
ISO 8802-2 Type 1
MS/TP
PTP
BVLCI
“Network”
“Link”
UDP
LonTalk
RS 485 RS 232
ISO 8802-3
(Ethernet)
Arcnet
IP
any network
Physical
obsolete new (Appendix J)
BACnet duplicates much of the (possible) functionality of the communication stack.
For instance, it has its own message segmenting protocol and operates with datagrams
(connectionless).
EPFL - Industrial Automation
Device Access Protocols 4.1 - 27
BACnet - Requirements to the communication system
Devices should be able to communicate directly with peer devices on their network;
Devices should be able to do local broadcasts, received by all peer devices on their
network (for unconfirmed services);
Devices should be able to send remote broadcasts to devices residing on networks
with different network numbers;
Devices should be able to do global broadcasting.
These requirements are difficult to fulfil on TCP/IP, but a proposal for UDP/IP exists,
by way of a special device, the BACnet Broadcast Management Device" (BBMD)
EPFL - Industrial Automation
Device Access Protocols 4.1 - 28
BACnet - Object model
32-bit BACnet Object Identifier: unique and valid throughout an installation
10-bit type
22-bit object instance
Object
Object
Device Object
(one per device)
Object
Object
Object
property0
property1
property..
Within a device, an object is identified by its 32-bit object identifier.
Objects are identified in the whole network by the concatenation of their device object
identifier and their own object identifier (64 bits).
Properties of an object are identified by a 32-bit BACnetPropertyIdentifier
EPFL - Industrial Automation
Device Access Protocols 4.1 - 29
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
Analog Input
Analog Output
Analog Value
Binary Input
Binary Output
Binary Value
Calendar
Command
Device
Event Enrolment
File
Group
Loop
Multi-state Input
Multi-state Output
Notification Class
Program
Schedule
Averaging
Multistate Value
Trendlog
EPFL - Industrial Automation
BACnet - 21 Object types
Sensor input
actor input
analog parameter
switch
relay
Binary parameter
Application-specific
Event scheduling by date
generic command
describes and controls the device
events and alarm declaration
data file
device grouping
Events
control loop
device with multiple states
status of devics with multiple states
list of devices to be notified of event and alarm
start, stop, status of program
weekly event scheduling
minimum, maximum and average value
multiple status value
logging of properties for a set criteria
Device Access Protocols 4.1 - 30
BACnet - Simple object: Analog input object
Alarm
lim
From the plant
d
dt
A/D
converter
ChangeOfValue
Alarm
lim
Present_Value
Units
Update interval
Max_Pres_Value
Min_Pres_Value
Alarms&Events
(main properties)
EPFL - Industrial Automation
Device Access Protocols 4.1 - 31
BACnet - Example of simple object: Analog input object properties
Property Identifier
Object_Identifier
Object_Name
Object_Type
Present_Value
Description
Device_Type
Status_Flags
Event_State
Reliability
Out_Of_Service
Update_Interval
Units
Min_Pres_Value
Max_Pres_Value
Resolution
COV_Increment
Time_Delay
Notification_Class
High_Limit
Low_Limit
Deadband
Limit_Enable
Event_Enable
Acked_transitions
Notify_Type
Property Data Type
BACnetObjectIdentifier
CharacterString
BACnetObjectType
REAL
CharacterString
CharacterString
BACnetStatusFlags
BACnetEventState
BACnetReliability
BOOLEAN
Unsigned
BACnetEngineeringUnits
REAL
REAL
REAL
REAL
Unsigned
Unsigned
REAL
REAL
REAL
BAcnetLimitEnable
BACnetEventTransitionBits
BacnetEventTransitionBits
BACnetNotifyType
1: writable if Out_of_service=true
EPFL - Industrial Automation
Code
R
R
R
R1
O
O
R
R
O
R
O
R
O
O
O
O2
O3
O3
O3
O3
O3
O3
O3
O3
O3
Conformance
10 bit object type + 22 bit object instance
corresponding visible string
here: ANALOG_INPUT
actual value
user defined
description of sensor (not device), e.g. “TC103”
{IN_ALARM, FAULT, OVERIDDEN, OUT_OF_SERVICE}
{NO_FAULT, NO_SENSOR, OVER_RANGE,…}
in 10 ms increments
square meters (0), square feet (1), milliamperes (2)(?!)
range of the present value
a change by more than this value causes an event
(optional) notification class to which this object is tied
exceeding these limits triggers an event
2: mandatory if COV_reporting
3: mandatory if intrinsic reporting
Device Access Protocols 4.1 - 32
BACnet - Analog Input Object Example
EPFL - Industrial Automation
Device Access Protocols 4.1 - 33
BACnet - Complex Object: Loop object (PID controller)
Setpoint_Ref
Setpoint
PID
Analog Value Object
Setpoint
Ki
dt
Kp
Kd
lim
AO
Plant
AI
d
dt
Integral_Constant
Proportional_Constant
manipulated variable
Derivative_Constant
Max/Min_Output
Present_Value
Manipulated_Var_Ref
Analog Output Object
Controlled_Var_Ref
controlled variable
Loop Object
Present_Value
Analog Input Object
EPFL - Industrial Automation
Device Access Protocols 4.1 - 34
BACnet - Complex object: loop object properties
Property Identifier
Object_Identifier
Object_Name
Object_Type
Present_Value
Description
Status_Flags
Event_State
Reliability
Out_Of_Service
Update_Interval
Output_Units
Manipulated_Var_Ref.
Controlled_Var_Ref.
Controlled_Var_Value
Controlled_Var_Units
Setpoint_Ref
Setpoint
Action
Proportional_Constant
Proportional_Const_Units
Integral_Constant
Integral_Const_Units
Derivative_Constant
Derivative_Const_Units
Bias
Maximum_Output
Minimum_Output
Priority_For_Writing
COV_Increment
Time_Delay
Notification_Class
Error_Limit
Event_Enable
Acked_transitions
Notify_Type
Property Data Type
BACnetObjectIdentifier
CharacterString
BACnetObjectType
REAL
CharacterString
BACnetStatusFlags
BACnetEventState
BACnetReliability
BOOLEAN
Unsigned
BACnetEngineeringUnits
BACnetObjectPropertyReference
BACnetObjectPropertyReference
REAL
BACnetEngineeringUnits
BACnetSetpointRefence
REAL
BACnetAction
REAL
BACnetEngineeringUnits
REAL
BACnetEngineeringUnits
REAL
BACnetEngineeringUnits
REAL
REAL
REAL
Unsigned
REAL
Unsigned
Unsigned
REAL
BACnetEventTransitionBits
BACnetEventTransitionBits
BACnetNotifyType
EPFL - Industrial Automation
CC
R
R
R
R
O
R
R
O
R
O
R
R
R
R
R
R
R
R
O1
O1
O2
O2
O3
O3
O
O
O
R
O4
O5
O5
O5
O5
O5
O5
Conformance
10 bit object type + 22 bit object instance
corresponding visible string
here: LOOP
actual value
user defined
description of sensor (not device)
references to the three analog objects
associated with the loop
{direct, reverse}
PID controller parameters
Device Access Protocols 4.1 - 35
BACnet - Events
Events are change of value of any object in a device (including the device object)
There are three kinds of event:
1) change-of-value (COV) event: a client subscribes with a server to a certain event
2) intrinsic events: changes to configuration
3) algorithmic events: calculations based on values according to a formula
EPFL - Industrial Automation
Device Access Protocols 4.1 - 36
BACnet - Event Enrolment
Property Identifier
Object_Identifier
Object_Name
Object_Type
Description
Event_Type
Notify_Type
Event_Parameters
Object_Property_Reference
Event_state
Event_Enable
Acked_Transition
Notification_Class
Recipient
Process_Identifier
Priority
Issue_Conformed Notifications
Property Data Type
BACnetObjectIdentifier
CharacterString
BACnetObjectType
CharacterString
BACnetEventType
BACnetNotifyType
BACnetEventParameter
BACnetObjectPropertyReference
BacnetEventState
BACnetEventTransitionBits
BacnetEventTransitionBits
unsigned
BACnetRecipient
Unsigned
Unsigned
BOOLEAN
CC
R
R
R
O
R
R
R
R
R
R
R
O1
O2
O2
O2
O2
Meaning
10 bit object type + 22 bit object instance
corresponding visible string
here: ANALOG_OUTPUT
user defined
algorithm, see next slide
alam, event, ack-notification
see next slide
unique property identifier
{normal, fault, offnormal, high_limit, low_limit,..}
ONE OF (to-offnormal, to_fault, to_normal)
ONE OF (to-offnormal, to_fault, to_normal)
pointer to notification object
device OR address
handle within notified recipient
priority
this object is present in the event server (the one which takes the initiative)
the BACnet client has no corresponding object
1: only if Notification Object used
EPFL - Industrial Automation
2: only if Notification Object not used
Device Access Protocols 4.1 - 37
BACnet - Event_Type, Event_States and Parameters
Event Type
Event State
Parameters
Meaning
CHANGE_OF_BITSTRING NORMAL
Time_Delay
OFFNORMAL Bitmask
List_Of_Bitstring_Values
seconds to wait before trigger
relevant bits in bitstring
several bitstrings
CHANGE_OF_STATE
NORMAL
Time_Delay,
OFFNORMAL List_Of_Values
seconds
reaching one of these states triggers
CHANGE_OF_VALUE
NORMAL
Time_Delay
OFFNORMAL Bitmask
Referenced_Property_Increment
seconds
either bit mask (BITSTRING) or
value change (REAL) which triggers
COMMAND_FAILURE
NORMAL
Time_Delay
OFFNORMAL Feedback_Property_Reference
seconds
BACnetObjectPropertyReference
FLOATING_LIMIT
NORMAL
HIGH_LIMIT
LOW_LIMIT
Time_Delay
Setpoint_Reference
Low_Diff_Limit
Hi_Diff_Limit
Deadband
seconds
Setpoint_Reference
REAL
REAL
REAL
OUT_OF_RANGE
NORMAL
HIGH_LIMIT
LOW_LIMIT
Time_Delay
Low_Limit
Hi_Limit
Deadband
seconds
REAL
REAL
REAL
EPFL - Industrial Automation
Device Access Protocols 4.1 - 38
BACnet - Notification Object
Property Identifier
Object_Identifier
Object_Name
Object_Type
Description
Notification_Class
Priority
Ack_Required
Recipient_List
Property Data Type
BACnetObjectIdentifier
CharacterString
BACnetObjectType
CharacterString
Unsigned
BACnetARRAY[3] of Unsigned
BACnetEventTransitionBits
List of BACnetDestination
CC
R
R
R
O
R
R
R
R
Meaning
10 bit object type + 22 bit object instance
corresponding visible string
here: NOTIFICATION CLASS
user defined
reference given to event-generating object
List of destinations, with for each the address
of the recipient along with its entry point,
the time window during which the event is
relevant, and whether an acknowledgement is
required to clear the event.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 39
BACnet - Importance
BACnet is slowly becoming an established standard in building automation.
It is supported by most firms in the building automation business.
Although it started as an “MMS”-light, it has acquired in the years about the same
complexity as its model.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 40
4.1.6 MMS
The Original Manufacturing Messaging Specification (MMS)
MMS - Manufacturing Message Specification
Developed 1980 (!) for the MAP project (General Motor’s flexible manufacturing initiative)
Originally unluckily tied to the OSI communication stack and Token Bus (IEEE 802.4)
Reputed for being heavy, complicated and costly due to poor implementations.
Boeing adopted MMS as TOPs (MMS on Ethernet), a wise step.
Adopted by the automobile industry and power distribution
Standardized as:
[1]
ISO/IEC 9506-1: Industrial Automation systems - Manufacturing Message Specification Part 1: Service Definition (IS 1990)
[2]
ISO/IEC 9506-2: Industrial Automation systems - Manufacturing Message Specification Part 2: Protocol Specification (IS 1990)
EPFL - Industrial Automation
Device Access Protocols 4.1 - 42
MMS - Application field
schedule
robot
configuration
EPFL - Industrial Automation
Device Access Protocols 4.1 - 43
MMS - Concept
MMS (Manufacturing Message Specifications) defines:
• A set of standard objects which must exist in every conformant device, on which
operations can be executed (example: local variables, read and write) or which
can start spontaneously a transmission
• A set of standard messages exchanged between a manager and an agent station
for the purpose of controlling these objects
• A set of encoding rules for these messages
• A set of rules for exchanging messages between devices (basic protocol)
MMS does not specify application-specific operations(e.g. change motor speed).
This is covered by application-specific, “companion standards”
(e.g. flexible manufacturing, drives, remote meter reading)
EPFL - Industrial Automation
Device Access Protocols 4.1 - 44
MMS - Distributed Control System mode of operation
MMS Clients
MMS client process database
(cache)
MMS Servers
MMS server
process database
1) Polling:
a) the bus scans periodically the variables and actualises the local databases
b) the Operator Workstation polls cyclically the variables it is interested in
2) Events:
a) the Controllers signal predefined events and broadcasts the corresponding values
b) the Operator Workstation defines the relevant events and their destination(s)
EPFL - Industrial Automation
Device Access Protocols 4.1 - 45
MMS - Example: External view of a PLC device
PLC
Journal
programs
keep track of
debugging
domains
(download
/ upload
memory)
Files
file store
only if mass
storage available
variables
named
variables
unnamed
variables
program variables
Operator
Station
HumanMachine
Interface
events
events
& alarms
state machines for
alarms and events
memory locations
and markers
EPFL - Industrial Automation
Device Access Protocols 4.1 - 46
MMS - Manufacturing Message Specification
device
(e.g. SCADA)
MMS specifies a set
of messages which
allow an MMS client
to control an MMS
server
remote
procedure
call interface
MMS specifies a set
of objects which
an MMS server is
expected to contain
MMS
client
request
device
(e.g. PC)
MMS
server
response
(command)
(reply)
communication
stack
linking
device
communication
stack
network
(example)
router
EPFL - Industrial Automation
Device Access Protocols 4.1 - 47
MMS - Basic Communication Principles
MMS assumes that the communication stack offers two services:
MMS Requester
(client)
Request
MMS Responder
(server)
network
Indication
1) Remote Procedure Call
(Call paired with Reply,
synchronous, unicast)
processing
Confirmation
2) Event Reporting
(spontaneous messages sent
by server)
Response
event
Request
Indication
MMS does not specify how to address clients and servers.
Messages contain only a communication reference (number which identifies the
connection) obtained by unspecified means.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 48
MMS - Communication Stack
Association Control Service Element, ACSE, ISO 8649/8650, N2526,N2327
“Application”
Abstract syntax notation,ISO 8822/8823, 8824/8825
Presentation
ISO 8326/8327
Session
ISO 8073 Class 4
Transport
ISO 8473 connectionless
Network
ISO 8802-2 Type 1
ISO 8802-3
(Ethernet)
Link
ISO 8802-4
MAC
Physical
(token bus)
quite heavy… Boeing decided to drop ISO for TCP/IP, is called "TOP".
EPFL - Industrial Automation
Device Access Protocols 4.1 - 49
MMS - Concept of Virtual Manufacturing Device
A virtual device represents a piece of equipment
A physical device may support one or more virtual devices in parallel
e.g.
connection
establishment
viscometer
valve
flowmeter
Virtual
Device
Virtual
Device
Virtual
Device
Application Programming Interface
(MMSI = MMS interface)
MMS messages
communication
stack
ACSE
presentation
session
transport
network
link
physical
EPFL - Industrial Automation
Device Access Protocols 4.1 - 50
MMS - Virtual Manufacturing Device (VMD)
An element of typed data (e.g.
integer, floating point, array, etc.)
A runnable program consisting
of one or more domains.
Represents a resource
(e.g. a program) within
the VMD.
A display and
keyboard for use
by an operator.
A time based
record of events
and variables.
Program
Invocation
Named
Variable
. The device itself is
a VMD object
Domain
Operator
Station
File
Semaphore
Event
Condition
An object that
represents the
state of an event.
EPFL - Industrial Automation
Types
Transaction
Journal
Represents an individual MMS
service request. Not a
named object.
Named
Variable List
A list of variables
named as a list.
Event
Action
Represents the action
taken when an event
condition changes state.
Event
Enrolment
A description of
the format of a
variable's data.
A file in a
file store or
fileserver.
An object used to
control access to a
shared resource.
Which network application to
notify when an event condition
changes state.
Device Access Protocols 4.1 - 51
MMS - 84 Services on the objects
VMD
Support
Domain
Management
Environment
and General
Management
File
Management
Operator
Communication
Variable
Access
MMS
Services
Semaphore
Management
Event
Management
Journal
Management
1. Creation - Deletion
2. Read (Get, Report)
3. Modify (Alter)
4. Invoke (for domains)
5. Operate (Start, Stop,…)
EPFL - Industrial Automation
Device Access Protocols 4.1 - 52
MMS - Variables
Unnamed Variables
VADR
mapping between MMS and real variable
Named Variables
Variable Access Objects
VNAM
Scattered Access
Named Variable List
Named Type
Through the “Variables” service, a client can read and write local variables in a remote device.
Variables are identified by the address of the device and either a local address or a name.
Variables can be read or written as individual variables (not very efficient) or as lists.
In the latter case, a variables list object on the remote device is used.
Consistency can be ensured by scattered access.
The type of the variable (Real, Unsigned,….) defines its data representation, it is stored in
a Named Type object.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 53
MMS - Types
MMS defines the following simple variable types:
BOOLEAN
BIT STRING
BOOLEAN ARRAY
INTEGER
UNSIGNED
FLOATING POINT (IEEE 754)
REAL (8824)
OCTET STRING
VISIBLE STRING
GENERALIZED TIME
BINARY TIME
BCD
OBJECT IDENTIFIER
Array
Structures
EPFL - Industrial Automation
Device Access Protocols 4.1 - 54
MMS - Variable Access Services
Read
Write
InformationReport(optional)
read a remote variable
write a remote variable
spontaneous send the value to a client
DefineNamedVariable
assigns named variable to an unnamed & type
GetVariableAccessAttributes
DefineScatteredAccess
GetScatteredAccessAttributes
DeleteVariableAccess
DefineNamedVariableList
GetNamedVariableListAttributes
DeleteNamedVariableList
defines lists of variables
DefineNamedType
GetNamedTypeAttributes
deleteNamedType
defines the types
EPFL - Industrial Automation
Device Access Protocols 4.1 - 55
MMS - Domains
Domains are named memory regions, for the purpose of downloading
and uploading large unstructured variables such as program code.
Domain loading / uploading requires a special protocol because it can involve the
MMS driver itself or even the communication stack.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 56
MMS - Event services
MMS provides services to:
- Event Condition (define the boolean condition that triggers an event and its priority)
- Event Enrolment (define the MMS client(s) to notify when an event is triggered)
- Event Action (define the MMS confirmed service to be executed when the event occurs)
MMS client
enables/disables
event conditions
MMS client
VMD
(MMS server)
Event
Event
Enrolment Condition
Who?
When?
Event
Action
What?
event notification
and confirmation
Events are the most complicated part of MMS
EPFL - Industrial Automation
Device Access Protocols 4.1 - 57
MMS - Event triggering
MMS client
MMS client
VMD
NETWORKTRIGGERED
Event
Enrolment
Event
Condition
boolean
variable
Event
Action
MONITORED
cyclic monitoring
plant
events are triggered by a change in a boolean variable in the server (monitored event) or
by an MMS client (trigger event) as an invitation procedure
EPFL - Industrial Automation
Device Access Protocols 4.1 - 58
MMS - Primitives
MMS Requester
(Requesting MMS-user)
Request
Confirmation
M_Associate_Req(
MMS_responder_address,
calling_application_reference,
called_application_reference,
communication_parameters,
authentication,..
MMS Responder
(Receiving MMS-user)
Indication
Response
M_Associate_Ind(
MMS_responder_address,
calling_application_reference,
called_application_reference,
communication_parameters,
authentication,..
shorter form to describe parameters....
EPFL - Industrial Automation
Device Access Protocols 4.1 - 59
MMS - Importance
MMS is becoming (after 12 years of existence) a reference model for industry
rather than an actual implementation.
Its high complexity makes it very general, but difficult to implement
It gave rise to several other "simpler" models (DLMS, BacNet, ....)
It is the base of the Utility Communication Architecture (UCA), an EPRI-sponsored
standardisation of data exchange between control centers.
http://www.epri.com/uca/iccp.html
For more information, see:
http://litwww.epfl.ch/MMS/mms_main.htm
EPFL - Industrial Automation
Device Access Protocols 4.1 - 60
MMS - Users
Renault,
FIAT,
British Aerospace,
Bull,
Computervision,
Dassault Systèmes,
IBM,
Matra Datavision,
Silicomp,
Fraunhofer Institute,
Daimler-Benz.
Esprit Projects:
CNMA (1996), CIMOSA,…
EPFL - Industrial Automation
Device Access Protocols 4.1 - 61
4.1.7 MMS companion standards
MMS does not define the meaning of the exchanged information.
For this, companion standards exist, such as:
IEC/ISO 9506-5 Industrial automation systems - Manufacturing message specification Part 3: Companion Standard for Robots (1992)
Part 4: Companion Standard for Numeric Control (1993)
Part 5: Companion Standard for Programmable Controllers (1997)
Part 6: Companion Standard for Process Control (1994)
One standard which emerged in direct line from MMS is the IEC 61850
„Communication networks and systems in substations“
IEC 61850 defines an MMS implementation based on Ethernet,
and elaborates on the object model.
It is currently being developed at ABB, Siemens and Alstom for substation automation.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 62
IEC 61850 - Example of Object Description
Key Attribute: PointName
Attribute: PointType (REAL, STATE, DISCRETE)
Constraint PointType=REAL
Attribute: PointRealValue
Constraint PointType=STATE
Attribute:PointStateValue
Constraint PointType=DISCRETE
Attribute: PointDiscreteValue
Attribute: QualityClass: (QUALITY, NOQUALITY)
Attribute: CurrentSource (TELEMETERED, CALCULATED, ENTERED, ESTIMATED)
Constraint: QualityClass = QUALITY
Attribute: Validity (VALID, HELD, SUSPECT, NOTVALID)
Attribute: NormalSource (TELEMETERED, CALCULATED, ENTERED, ESTIMATED)
Attribute: NormalValue (NORMAL,ABNORMAL)
Attribute: TimeStampClass: (TIMESTAMP, NOTIMESTAMP)
Constraint: TimeStampClass = TIMESTAMP
Attribute: TimeStamp
Attribute: TimeStampQuality: (VALID, INVALID)
Attribute: COVClass: (COV, NOCOV)
Constraint: COVClass = COV
Attribute: COVCounter
EPFL - Industrial Automation
Device Access Protocols 4.1 - 63
Conclusion
Although MMS itself had little success, the concepts behind MMS have inspired numerous
other standards.
Industrial Communication protocols require a comfortable bandwidth and a certain
processing power at the servers, which is incompatible with low-cost, decentralized
periphery, but fully in line with the concept “Ethernet in the factory floor”.
While HART, NIST and TCN are able to connect relatively simple devices, the same is not
true for MMS and its derivatives.
The MMS concept is being challenged by OPC/COM/DCOM and by Web Services,
but these protocols address a lower level in the communication stack.
EPFL - Industrial Automation
Device Access Protocols 4.1 - 64
EPFL - Industrial Automation
Device Access Protocols 4.1 - 65