Application Programmer

Application Programmer
Programming ToolBox for

MOSCAD™ RTUs
Version
0 9.54
68P02956C55-G
MOTOROLA and the Stylized M Logo are registered in the U.S.

Patent and Trademark Office. All other product or service names
are the property of their respective owners.
Copyright © Motorola 2005 All Rights Reserved

COMMERCIAL WARRANTY (STANDARD)
Motorola radio communications products are warranted to be free from defects in material and workmanship for a period of
ONE (1) YEAR, (except for crystals and channel elements which are warranted for a period of ten (10) years), from the date
of shipment. Parts, including crystals and channel elements, will be replaced free of charge for the full warranty period but
the labor to replace defective parts will only be provided for one Hundred-Twenty (120) days from the date of shipment.
Thereafter purchaser must pay for the labor involved in repairing the product or replacing the parts at the prevailing rates
together with any transportation charges to or from the place where warranty service is provided. This express warranty is
extended by Motorola Communications and Electronics Inc., 1301 E. Algonquin Road, Schaumburg, Illinois 60196, to the
original purchaser only, and only to those purchasing for purpose of leasing or solely for commercial, industrial, or
governmental use.
THIS WARRANTY IS GIVEN IN LIEU OF ALL OTHER WARRANTIES EXPRESS OR IMPLIED WHICH ARE
SPECIFICALLY EXCLUDED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR
PURPOSE. IN NO EVENT SHALL MOTOROLA BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES TO
THE FULL EXTENT SUCH MAY BE DISCLAIMED BY LAW.
In the event of a defect, malfunction or failure to conform to specifications established by seller, or if appropriate, to
specifications accepted by Seller in writing, during the period shown, Motorola, at its option, will either repair or replace the
product or refund the purchase price thereof, and such action on the part of Motorola shall be the full extent of Motorola’s
liability hereunder.
This warranty is void if:
a. the product is used in other than its normal and customary manner;
b. the product has been subject to misuse, accident neglect or damage;
c. unauthorized alterations or repairs have been made, or unapproved parts used in the equipment.
This warranty extends only to individual products, batteries are excluded, but carry their own separate limited warranty.
Because each radio system is unique, Motorola disclaims liability for range, coverage, or operation of the system as a whole
under this warranty except by a separate written agreement signed by an officer of Motorola.
Non-Motorola manufactured products are excluded from this warranty, but subject to the warranty provided by their
manufacturers, a copy of which will be supplied to you on specific written request.
In order to obtain performance of this warranty, purchaser must contact its Motorola salesperson or Motorola at the address
first above shown, attention Quality Assurance Department.
This warranty applies only within the United States.
COMPUTER SOFTWARE COPYRIGHTS
The Motorola products described in this instruction manual may include copyrighted Motorola computer programs stored in
semi conductor memories or other media. Laws in the United States and other countries preserve for Motorola certain
exclusive rights for copyrighted computer programs including the exclusive right to copy or reproduce in any form the
copyrighted computer program. Accordingly, any copyrighted Motorola computer programs contained in the Motorola
products described in this instruction manual may not be copied or reproduced in any manner without the express written
permission of Motorola. Furthermore, the purchase of Motorola products shall not be deemed to grant either directly or by
implication, estoppel, or otherwise, any license under the copyrights, patents or patent applications of Motorola, except for
the normal non-exclusive, royalty free license to use that arises by operation of law in the sale of a product.
Table of Contents
INTRODUCTION ..................................................................................................................................................... 1
DATABASE CONCEPT ............................................................................................................................................ 2
Table Types...................................................................................................................................................... 2
Single-Column Table ....................................................................................................................................................2
Multiple-Column Table .................................................................................................................................................3
Single- and Multiple-Column Tables: A Comparison ...................................................................................................4
Table Groups ................................................................................................................................................... 4
User Tables....................................................................................................................................................................4
System Tables ...............................................................................................................................................................5
Constants Table .............................................................................................................................................................5
Data Types....................................................................................................................................................... 6
Discrete – Internal Bit (bit)............................................................................................................................................6
Integer Value – Internal Integer Value (int) ..................................................................................................................7
Real Value – Internal Real Value (real).........................................................................................................................7
Integer Parameter – Internal Integer Parameter (iprm) ..................................................................................................7
Real Parameter – Internal Real Parameter (rprm)..........................................................................................................7
Discrete Input (d-i) ........................................................................................................................................................7
Discrete Output (d-o).....................................................................................................................................................8
Value Input (v-i)............................................................................................................................................................8
Value Output (v-o) ........................................................................................................................................................9
Scaled Analog Input (sAI) )...........................................................................................................................................9
Scaled Analog Output (sAO) ) ......................................................................................................................................10
Mapped Discrete (mbit).................................................................................................................................................10
Mapped Value (mval)....................................................................................................................................................11
Hours Timer (Hr:Mn) ....................................................................................................................................................11
Minutes Timer (Mn:Sc).................................................................................................................................................11
Seconds Timer (Sc:Ms) .................................................................................................................................................11
Pulses Per Hour (pph) ) .................................................................................................................................................12
Time-Tagged DI (TgDI)................................................................................................................................................12
Programmable Ladder Controller (plc_vi, plc_vo, plc_di, plc_do, plc_ri, plc_ro) ........................................................12
Index..............................................................................................................................................................................12
Constants .......................................................................................................................................................................13
LADDER DIAGRAM LANGUAGE............................................................................................................................. 14
“Inputs” and “Outputs”.................................................................................................................................. 14
Variables.......................................................................................................................................................... 15
Ladder Diagram Elements............................................................................................................................... 15
“Normally-Open (N.O.) Contact” Element ...................................................................................................................15
“Relay On” Element ......................................................................................................................................................16
“Normally-Closed (N.C.) Contact” Element .................................................................................................................17
“Relay Off” Element .....................................................................................................................................................18
Comparators ..................................................................................................................................................................19
“Relay Latch”, “Relay Unlatch” Elements ....................................................................................................................20
Reset..............................................................................................................................................................................22
Timers ...........................................................................................................................................................................23
Differentiators: Positive (UP), Negative (DOWN).........................................................................................................29
Count Up, Count Down.................................................................................................................................................32
i
Jump ..............................................................................................................................................................................33
Scan...............................................................................................................................................................................34
Move Low, Move High .................................................................................................................................................35
Arithmetical Calculations..............................................................................................................................................42
Boolean Algebraic Operations – AND, OR, XOR ........................................................................................................43
Calc ...............................................................................................................................................................................43
Jump To Subprocess, Return .........................................................................................................................................46
Send...............................................................................................................................................................................48
Logical Shift to Left/Right ............................................................................................................................................48
Arithmetical Shift to Left/Right ....................................................................................................................................49
Rotate to Left/Right.......................................................................................................................................................49
Call ................................................................................................................................................................................50
Run Process ...................................................................................................................................................................52
Conversion of Variable Notation...................................................................................................................................54
Copy Columns...............................................................................................................................................................54
User Call Function (UCL) .............................................................................................................................................55
Ladder Diagram Reference ............................................................................................................................. 55
Input Elements...............................................................................................................................................................56
Output Elements............................................................................................................................................................56
APPLICATION PROGRAMMER ................................................................................................................................ 58
Application Programmer Window ................................................................................................................... 59
Standard Toolbar ...........................................................................................................................................................59
Workspace Bar ..............................................................................................................................................................60
Output Bar.....................................................................................................................................................................61
SiteID Bar......................................................................................................................................................................62
File Menu ......................................................................................................................................................................62
New ..........................................................................................................................................................................62
Open .........................................................................................................................................................................63
Open Workspace ......................................................................................................................................................64
Save Workspace .......................................................................................................................................................64
Save Workspace As ..................................................................................................................................................64
Close Workspace ......................................................................................................................................................64
Save ..........................................................................................................................................................................65
Save Active Project As .............................................................................................................................................65
Save All ....................................................................................................................................................................65
Delete Project ...........................................................................................................................................................65
Print ..........................................................................................................................................................................66
Create Central File....................................................................................................................................................66
Recent Workspaces...................................................................................................................................................66
Recent Files ..............................................................................................................................................................66
Edit Menu......................................................................................................................................................................66
Undo .........................................................................................................................................................................66
Redo .........................................................................................................................................................................66
Rung Editor ..............................................................................................................................................................66
Rung Monitor ...........................................................................................................................................................68
Table Editor..............................................................................................................................................................69
Table Monitor...........................................................................................................................................................71
IO Link .....................................................................................................................................................................72
Cut ............................................................................................................................................................................72
Copy .........................................................................................................................................................................72
ii
Paste .........................................................................................................................................................................73
Select All ..................................................................................................................................................................73
Delete .......................................................................................................................................................................73
View Menu....................................................................................................................................................................73
Standard....................................................................................................................................................................73
Status Bar .................................................................................................................................................................73
Operation Bar ...........................................................................................................................................................73
Workspace Tool Bar.................................................................................................................................................73
Workspace Bar .........................................................................................................................................................74
Output Bar ................................................................................................................................................................74
Site ID Bar................................................................................................................................................................74
ToolBox....................................................................................................................................................................74
Database Tree ...........................................................................................................................................................74
Process Tree .............................................................................................................................................................74
I/O Link Tree............................................................................................................................................................74
Monitor Database Tool Bar ......................................................................................................................................74
Monitor Rung Tool Bar ............................................................................................................................................74
Project Menu .................................................................................................................................................................74
Set Active Project .....................................................................................................................................................75
Settings .....................................................................................................................................................................75
Insert Project into Workspace...................................................................................................................................75
Delete Project ...........................................................................................................................................................76
Import Site Configuration.........................................................................................................................................76
Select Site Configuration File...................................................................................................................................77
Import I/O Link File .................................................................................................................................................78
Tools Menu ...................................................................................................................................................................78
Upgrade ....................................................................................................................................................................78
Search .......................................................................................................................................................................79
Options .....................................................................................................................................................................81
Run-Time Menu ............................................................................................................................................................83
Compile ....................................................................................................................................................................83
Download Application/Network...............................................................................................................................84
Compress/Download ................................................................................................................................................84
Upload + Uncompress ..............................................................................................................................................84
Abort.........................................................................................................................................................................84
Search Menu..................................................................................................................................................................84
Find...........................................................................................................................................................................84
Replace .....................................................................................................................................................................84
Next ..........................................................................................................................................................................84
Option Menu .................................................................................................................................................................84
Configure..................................................................................................................................................................84
Window Menu...............................................................................................................................................................85
Close.........................................................................................................................................................................85
Close All...................................................................................................................................................................85
Cascade.....................................................................................................................................................................85
Tile Vertically...........................................................................................................................................................85
Tile Horizontally ......................................................................................................................................................85
Help Menu.....................................................................................................................................................................86
Contents....................................................................................................................................................................86
How to Use Help ......................................................................................................................................................86
iii
Keyboard Shortcuts ..................................................................................................................................................86
About........................................................................................................................................................................86
Keyboard Shortcuts in Application Programmer...........................................................................................................86
Database Builder ............................................................................................................................................. 88
User Tables....................................................................................................................................................................88
System Tables ...............................................................................................................................................................88
Constant Tables .............................................................................................................................................................89
Appending a Table ........................................................................................................................................................89
Editing a Table ..............................................................................................................................................................90
Editing a Single-Column Table ................................................................................................................................90
Editing a Multiple-Column Table.............................................................................................................................92
Search for a Variable or Duplicated Column.................................................................................................................94
Project Commands ........................................................................................................................................................94
Set Active Project .....................................................................................................................................................95
Delete Project ...........................................................................................................................................................95
Append Process ........................................................................................................................................................95
Paste Process ............................................................................................................................................................95
Search Name.............................................................................................................................................................95
Print ..........................................................................................................................................................................95
Help ..........................................................................................................................................................................95
Table Type Commands..................................................................................................................................................96
Append Table ...........................................................................................................................................................96
Copy Tables..............................................................................................................................................................96
Paste Tables..............................................................................................................................................................96
Help ..........................................................................................................................................................................96
Table Name Commands ................................................................................................................................................96
Monitor.....................................................................................................................................................................97
Append Table ...........................................................................................................................................................97
Edit Table .................................................................................................................................................................97
Insert Table...............................................................................................................................................................97
Delete Table .............................................................................................................................................................98
Rename.....................................................................................................................................................................98
Table Description .....................................................................................................................................................98
Copy .........................................................................................................................................................................98
Paste .........................................................................................................................................................................98
Cut ............................................................................................................................................................................98
Print ..........................................................................................................................................................................98
Help ..........................................................................................................................................................................99
Table Contents Commands............................................................................................................................................99
Append Line .............................................................................................................................................................99
Insert Line.................................................................................................................................................................99
Delete Line ...............................................................................................................................................................99
Append Column........................................................................................................................................................99
Insert Column ...........................................................................................................................................................100
Delete Column..........................................................................................................................................................101
Attribute Page...........................................................................................................................................................101
Database Building Examples.........................................................................................................................................102
Process Programming ..................................................................................................................................... 105
Adding a Rung ..............................................................................................................................................................105
Editing a Rung...............................................................................................................................................................106
iv
Adding Elements to the Rung...................................................................................................................................106
Creating Lines ..........................................................................................................................................................108
Creating a Branch .....................................................................................................................................................109
Editing Elements ......................................................................................................................................................109
Using the Keyboard in the Rung Editor.........................................................................................................................111
The Focus .................................................................................................................................................................111
Complex Editing Commands.........................................................................................................................................111
Selecting New Elements ...........................................................................................................................................112
Searching a Rung...........................................................................................................................................................112
Process Commands........................................................................................................................................................112
Append Process ........................................................................................................................................................113
Delete Process ..........................................................................................................................................................113
Copy .........................................................................................................................................................................113
Paste .........................................................................................................................................................................114
Cut ............................................................................................................................................................................114
Append Rung............................................................................................................................................................114
Rename.....................................................................................................................................................................114
Long Description ......................................................................................................................................................114
Short Description......................................................................................................................................................114
Print ..........................................................................................................................................................................114
Rung Commands ...........................................................................................................................................................114
Monitor.....................................................................................................................................................................115
Append Rung............................................................................................................................................................115
Insert Rung ...............................................................................................................................................................115
Edit Rung..................................................................................................................................................................115
Delete Rung..............................................................................................................................................................115
Rename.....................................................................................................................................................................115
Cut ............................................................................................................................................................................116
Copy .........................................................................................................................................................................116
Paste .........................................................................................................................................................................116
Long Description ......................................................................................................................................................116
Short Description......................................................................................................................................................116
Print ..........................................................................................................................................................................116
Help ..........................................................................................................................................................................116
Select All ..................................................................................................................................................................116
Clear All ...................................................................................................................................................................116
Normalize .................................................................................................................................................................117
Rung Element Commands .............................................................................................................................................117
Cut ............................................................................................................................................................................117
Copy .........................................................................................................................................................................117
Paste .........................................................................................................................................................................117
Clear .........................................................................................................................................................................118
Select All ..................................................................................................................................................................118
Delete .......................................................................................................................................................................118
Cut Param .................................................................................................................................................................118
Copy Param ..............................................................................................................................................................118
Paste Param ..............................................................................................................................................................118
Delete Param ............................................................................................................................................................118
Add Input..................................................................................................................................................................118
Insert Input ...............................................................................................................................................................118
v
Add Output ...............................................................................................................................................................118
Open Branch.............................................................................................................................................................119
Close Branch ............................................................................................................................................................119
Out Branch+Input.....................................................................................................................................................119
Out Branch+Output ..................................................................................................................................................119
Examples of Building a Rung Sequence........................................................................................................................119
I/O Link............................................................................................................................................................ 121
I/O Link Column Definition ..........................................................................................................................................122
IO Connect Items...........................................................................................................................................................124
Compiler .......................................................................................................................................................... 127
Download Application/Network ...................................................................................................................... 130
Compress/Download........................................................................................................................................ 132
Upload and Uncompress................................................................................................................................................133
Monitor Mode .................................................................................................................................................. 135
Database Monitoring .....................................................................................................................................................135
Table Monitoring......................................................................................................................................................135
Monitoring Snapshot .....................................................................................................................................................136
Process Monitoring........................................................................................................................................................136
Rung Monitor ...........................................................................................................................................................137
Performance Monitor Table...........................................................................................................................................138
Copying Elements ............................................................................................................................................ 140
File Editor Option............................................................................................................................................ 142
Browse Function.............................................................................................................................................. 143
ToolBox Editor ................................................................................................................................................ 143
SYSTEM AND CONSTANT TABLES ......................................................................................................................... 145
System Tables .................................................................................................................................................. 145
Constant Tables ............................................................................................................................................... 145
Tables Descriptions ......................................................................................................................................... 147
RTU-to-RTU Com Buff and RTU-RTU Frame Types..................................................................................................147
Time & Date Table........................................................................................................................................................147
Index Table....................................................................................................................................................................150
Reserved Flags Table ....................................................................................................................................................154
Performance Monitor Table...........................................................................................................................................159
User Ports Table ............................................................................................................................................................159
Site table........................................................................................................................................................................159
Tx Event Table ..............................................................................................................................................................159
Data Burst Table............................................................................................................................................................159
Reserved Values Table ..................................................................................................................................................159
PRMEVENT TABLE....................................................................................................................................................161
PLC Table .....................................................................................................................................................................161
USER DEFINED LOCAL PORTS ............................................................................................................................... 162
User Ports Table.............................................................................................................................................. 163
PTxFlg Variable and SEND Operator ...........................................................................................................................163
PRxFlg Variable ............................................................................................................................................................167
PRxChr Variable and GetChr Function .........................................................................................................................167
PRxNum Variable and GetDgt Function .......................................................................................................................168
PrtFal Variable ..............................................................................................................................................................169
PrtMod, Protcl and PrtRat Variables .............................................................................................................................169
PrtMod Variable .......................................................................................................................................................169
Protcl Variable..........................................................................................................................................................170
vi
PrtRat Variable .........................................................................................................................................................171
Ready and NotRdy Functions........................................................................................................................................171
Example of Building Local Communication Processes ................................................................................... 172
Database Definitions .....................................................................................................................................................172
Main Process .................................................................................................................................................................174
HeadrP Subprocess........................................................................................................................................................175
KeyInP Subprocess........................................................................................................................................................176
OutP Subprocess ...........................................................................................................................................................177
USER DEFINED MDLC COMMUNICATION ............................................................................................................ 178
Central-to-RTU Data Transfer ........................................................................................................................ 178
Central-to-RTU Broadcast .............................................................................................................................. 180
RTU Event Reporting (IGC/M old central only).............................................................................................. 180
RTU-to-RTU Communication Guidelines........................................................................................................ 181
Variables/Constants & Functions Used for MDLC Communication............................................................... 181
Variables/Constants.......................................................................................................................................................181
Communication Functions available via the CALL Function .......................................................................................181
Site table .......................................................................................................................................................... 182
RTU-to-RTU Communication .......................................................................................................................... 184
RTU-to-RTU Comm Buff / RTU-to-RTU Controls Tables ..........................................................................................184
Last Index (BufEnd) .................................................................................................................................................184
Transmit Variables ...................................................................................................................................................185
Receive Variables .....................................................................................................................................................185
Transmit Mode ..............................................................................................................................................................186
Receive Mode................................................................................................................................................................187
Sequential Frame RTU-to-RTU Communication............................................................................................. 188
RTU Event/Burst Reporting ............................................................................................................................. 189
TX Event Table .............................................................................................................................................................189
Event Definitions 1 and Event Definitions 2 Tables......................................................................................................191
TxEvnt Function............................................................................................................................................................191
Data Burst Table............................................................................................................................................................192
Burst Function ...............................................................................................................................................................193
Example of RTU-to-RTU Communication ....................................................................................................... 194
Site A Database .............................................................................................................................................................194
Internal Values..........................................................................................................................................................194
Communication Constants........................................................................................................................................195
Communication Timers ............................................................................................................................................195
Discrete Inputs..........................................................................................................................................................196
Discrete Outputs .......................................................................................................................................................196
Sites ..........................................................................................................................................................................196
Site A User Rungs .........................................................................................................................................................197
Site B Database .............................................................................................................................................................199
Internal Values..........................................................................................................................................................199
Communication Constants........................................................................................................................................200
Communication Timers ............................................................................................................................................200
Discrete Outputs .......................................................................................................................................................200
Sites ..........................................................................................................................................................................201
Site B User Rungs .........................................................................................................................................................202
vii
ADVANCED FEATURES
ACCESSING DATABASE VARIABLES VIA COORDINATES ........................................................................................ 204

Definitions ....................................................................................................................................................... 205
X.25 PROTOCOL SUPPORT .................................................................................................................................... 207
Service Provider Configuration....................................................................................................................... 207
X.25 Service User Configuration..................................................................................................................... 209
Site Configuration............................................................................................................................................ 210
X.25 Service Configuration...........................................................................................................................................210
X.25 Service Provider ...................................................................................................................................................211
RTU Port Configuration ................................................................................................................................................214
X.25 Service User..........................................................................................................................................................217
File Menu ......................................................................................................................................................................221
Edit Menu......................................................................................................................................................................224
MDLC OVER PRIVATE DATATAC ........................................................................................................................ 225
RTU Site Configuration ................................................................................................................................... 226
User Parameters for Port 2 and 3...................................................................................................................................226
Physical Layer ...............................................................................................................................................................226
Link Layer.....................................................................................................................................................................226
MOSCAD User Application............................................................................................................................. 227
IP Gateway Configuration............................................................................................................................... 227
MDLC OVER MPT1327 ....................................................................................................................................... 228
MDLC over MPT1327 Setup ........................................................................................................................... 229
Radio Configuration ........................................................................................................................................ 229
RTU Site Configuration ................................................................................................................................... 230
User Parameters for Port 3 ............................................................................................................................................230
Physical Layer ...............................................................................................................................................................230
MAP27 Convert Table ..................................................................................................................................... 232
MDLC OVER IP .................................................................................................................................................... 233
ToolBox PC Setup Options .............................................................................................................................. 235
MDLC over IP Setup ....................................................................................................................................... 235
MDLC over IP Site Paging.............................................................................................................................. 236
MDLC over iDEN ............................................................................................................................................ 237
IP Gateway to RTU Communication.............................................................................................................................238
RTU to IP Gateway Communication.............................................................................................................................238
RTU to RTU Communication .......................................................................................................................................239
IDEN Modem Session State/Paging..............................................................................................................................239
MDLC over iDEN Setup ...............................................................................................................................................239
RTU Site Configuration ................................................................................................................................................239
Modem Configuration ...................................................................................................................................................247
Special AT Commands for the iDEN Modem...............................................................................................................248
MDLC over Tetra ............................................................................................................................................ 250
MDLC over Tetra Setup................................................................................................................................................251
Special AT Commands for the Tetra Radio...................................................................................................................255
MDLC over Standard Modem.......................................................................................................................... 256
MDLC over Standard Modem Setup.............................................................................................................................256
Special AT Commands for Standard Modem................................................................................................................261
MDLC over GPRS ........................................................................................................................................... 262
viii
MDLC over GPRS Setup ..............................................................................................................................................263
RTU Configuration........................................................................................................................................................263
MDLC over ASTRO IV&D .............................................................................................................................. 263
Special AT Commands for ASTRO IV&D ...................................................................................................................271
MDLC over Null Modem ................................................................................................................................. 272
MDLC over Null Modem Setup....................................................................................................................................272
MDLC via Astro IP 3.xx .................................................................................................................................. 272
MDLC via Astro IP 3.xx Setup .....................................................................................................................................273
MDLC via Terminal Server (SLIP).................................................................................................................. 277
MDLC via Terminal Server Setup.................................................................................................................................278
Modem Configuration File .............................................................................................................................. 280
Modem Configuration File Example .............................................................................................................................281
Modem Configuration File Sections..............................................................................................................................283
MDLC over IP Modem Configuration ..........................................................................................................................285
MDLC over Dialup Modem Configuration ...................................................................................................................287
Diagnosing the Modem over the MDLC over Dialup Port............................................................................................288
Modem Configuration File Variables............................................................................................................................288
Modem Configuration File Command Syntax...............................................................................................................294
IP Conversion Table ........................................................................................................................................ 295
IP Gateway Configuration............................................................................................................................... 296
Site Configuration .........................................................................................................................................................296
IP Conversion Table......................................................................................................................................................296
Download ......................................................................................................................................................................296
User Application ...........................................................................................................................................................296
MDLC over IP Connection Verification .......................................................................................................... 297
MDLC via TELNET ......................................................................................................................................... 298
MOSCAD Ethernet Interface ........................................................................................................................... 298
Configuring MOSCAD RTU with EPIB .......................................................................................................................300
Ethernet IP Interface Configurator Utility for IP Configuration....................................................................................300
AUTHENTICATION ................................................................................................................................................. 305
General ............................................................................................................................................................ 305
Synchronization ............................................................................................................................................... 307
Authentication Setup........................................................................................................................................ 308
Network Configuration..................................................................................................................................................309
Authentication Options..................................................................................................................................................312
Download ......................................................................................................................................................................313
User Application.............................................................................................................................................. 314
EVENT DRIVEN SOFTWARE ................................................................................................................................... 315
Definitions ....................................................................................................................................................... 315
Data Type ......................................................................................................................................................................315
I/O Link.........................................................................................................................................................................315
Event Driven Mechanism................................................................................................................................. 316
Event Driven Tables ........................................................................................................................................ 317
How to Use the Event Driven Software ........................................................................................................... 318
Reading the TmMost and TmLeas Columns .................................................................................................................321
INTRAC PROTOCOL ............................................................................................................................................ 324
ix
Scope................................................................................................................................................................ 324
Applicable Documents ..................................................................................................................................................325
About the INTRAC Protocol.........................................................................................................................................325
Call Functions for INTRAC Protocol .............................................................................................................. 326
INTRAC Protocol Variable ...........................................................................................................................................327
The INTRAC Free Format Protocol ..............................................................................................................................330
Using the MEIC MDLC Protocol (RTU to RTU) .........................................................................................................331
Channel Status Variables...............................................................................................................................................333
Channel Parameters.......................................................................................................................................................334
Site Configuration............................................................................................................................................ 335
Rung Usage Examples ..................................................................................................................................... 338
Handling an Analog Type INTRAC Frame...................................................................................................................338
Handling an MEIC MDLC Frame.................................................................................................................................340
DUAL CPU OPERATION ........................................................................................................................................ 343
Address Setting .............................................................................................................................................................343
Physical Outputs............................................................................................................................................................344
Using the Dual CPU Option ..........................................................................................................................................344
Updating the Secondary ................................................................................................................................................345
Flags and Diagnostics....................................................................................................................................................348
GLOBAL POSITIONING SYSTEM (GPS) .................................................................................................................. 349
Setting the GPS Parameters ............................................................................................................................ 350
System Tables Variables .................................................................................................................................. 351
GPS Cable ....................................................................................................................................................... 351
PID LOOP - PROPORTIONAL INTEGRAL DERIVATIVE .......................................................................................... 352
General ............................................................................................................................................................ 352
PID Function ................................................................................................................................................... 353
PID Table ........................................................................................................................................................ 353
How to Use the PID......................................................................................................................................... 355
MOSCAD PID Application Example ............................................................................................................... 356
General ..........................................................................................................................................................................356
Glossary.........................................................................................................................................................................356
PID control function......................................................................................................................................................356
Operation mode .............................................................................................................................................................357
Validity Check...............................................................................................................................................................357
Database Tables.............................................................................................................................................................358
Programming Process Rungs.........................................................................................................................................362
SOFTWARE DIAGNOSTICS OUTPUT ....................................................................................................................... 368

TRANSPORT MUX DEVICE = TRNINT....................................................................................................... 368
HEAP DEVICE = HP_F_TX, HP_F_RX, HP_UF_A, HP_UF_U ............................................................... 370
ADAPTER DEVICE = COM1A,RTU1A, LIN1A,…...................................................................................... 372
TRANSPORT DEVICE = TRANS1, TRANS2,... ........................................................................................... 373
MTE ................................................................................................................................................................. 376
LINK ................................................................................................................................................................ 377
NETWORK STOCK (NSTOCK).................................................................................................................... 380
USERROM (USRROM) ................................................................................................................................. 382
NETWORK (NETWRK) .................................................................................................................................. 384
MINISESSION (WIDE , EVNT , STCL) ........................................................................................................ 385
GAPRATIO (GPRTIO) ............................................................................................................................... 389
HDLC (RAD1P, RAD2P,...)........................................................................................................................... 389
x
UART ............................................................................................................................................................... 397
RADIO CHANNEL (RAD1C , RAD2C,…) ...................................................................................................... 409
TRUNK CHANNEL ......................................................................................................................................... 413
RS232 CHANNEL............................................................................................................................................ 418
MODEM CHANNEL ....................................................................................................................................... 422
TIMERS (10__MS , 100_MS , 1__SEC , 1__MIN) ........................................................................................ 427
TIME-TAG (T_TAG)....................................................................................................................................... 427
CO-PROCESSOR (MC68882)........................................................................................................................ 428
DI..................................................................................................................................................................... 428
I/O MODULES (R0M1 , R0M2 ,...) ................................................................................................................ 428
8DO ................................................................................................................................................................. 429
MIX .................................................................................................................................................................. 432
DSP (AC ANALYZER) ..................................................................................................................................... 433
RS485............................................................................................................................................................... 436
FLASH MEMORY (FLASHDB, FLSEXT1) .................................................................................................... 440
LDIALER (DIL2D , DIL 3D) ......................................................................................................................... 442
(ML_DL).......................................................................................................................................................... 443
TOPLC (PLC1L, PLC2L, PLC3L)................................................................................................................... 444
TOSCADA (PLC1L, PLC2L, PLC3L)............................................................................................................. 445
SWITCHER...................................................................................................................................................... 447
FRAME - SEQ ................................................................................................................................................. 448
BURST - SEQ................................................................................................................................................... 448
ROUTER (X25_RTR)...................................................................................................................................... 448
X25 (X25 MDLC , X251X)............................................................................................................................. 450
LAPB (X251L) ............................................................................................................................................... 452
PHONE BOOK LEVEL = 0 PHNBK........................................................................................................... 453
TIMER EVENT ................................................................................................................................................ 454
POOLMNGR ................................................................................................................................................... 455
OCOMM LEVEL = 0.................................................................................................................................... 456
FSKADP (OCOMC) ........................................................................................................................................ 460
GPS.................................................................................................................................................................. 466
CAPPL ............................................................................................................................................................. 469
SFLASH (CPU 400 and above only) ............................................................................................................... 470
RxMyZ (MOSCAD-L only)............................................................................................................................... 471
CTRL (MOSCAD-L Only)................................................................................................................................ 472
GAUART DEVICE = COMxA, RTUxA, LINxA ............................................................................................ 473
SITTBL............................................................................................................................................................. 476
DCFi (for ‘C’ applications only) ..................................................................................................................... 477
IPLINK LINxL ............................................................................................................................................ 478
SLIP LINxSlp .............................................................................................................................................. 484
IPLINK LINxL ............................................................................................................................................ 494
DMAP27 DEVICE = RADxD ........................................................................................................................ 513
MPT1327 (PHYSICAL MODULE) DEVICE = RADxP ............................................................................... 514
IMAP27............................................................................................................................................................ 521
DESx ................................................................................................................................................................ 524
AUSYNC .......................................................................................................................................................... 525
TMAUTH ......................................................................................................................................................... 528
DUART ............................................................................................................................................................ 528
DRS485............................................................................................................................................................ 534
DHDLC............................................................................................................................................................ 536
xi
DRADIO .......................................................................................................................................................... 540
LOGFLAS ........................................................................................................................................................ 544
ERROR MESSAGES ................................................................................................................................................ 547
Error Logger Messages ................................................................................................................................... 547
Compiler Error List ......................................................................................................................................... 591
Corrupted Database Errors............................................................................................................................. 597
Warning List .................................................................................................................................................... 597
xii
Introduction
The ToolBox for MOSCAD RTUs Application Programmer is used to build a program or
control process to be executed by the RTU. You can create an application to retrieve
information from the unit (e.g. measure temperature, test if a button has been pressed) and to
perform operations on the equipment (e.g. activate a pump, turn on a light.)
The RTU is a computer, with a CPU, real-time clock, RAM and ROM memory, serial
communication ports, etc. Whether it is installed at some field site, acting as a controller, or
acting as the communications bridge between a radio (or other) communications system and
the Master Control Center, the RTU can perform compute, communicate, monitor and control,
based on the application program.
An application can be created off-line, without being connected to the actual RTU, and later
linked, compiled and downloaded to the unit for execution.
The application is written is Ladder Diagram Language and ‘C’ language, based on the
variables and entities defined in the database and the system setup (the Site and Network
Configuration described in the System Setup & Diagnostics Tools manual.)
This manual describes how to define the database, program the processes, link the variables in
the database to the physical I/Os (Input/Outputs) of the RTU, and download the application to
the unit. Included is a thorough description of the table-based database concept, the ladder-
diagram language with its various elements, and an overview of the communication protocol.
Also included is a set of special advanced features which are available with the MOSCAD
Programming ToolBox. Some of these are add-on options which must be purchased. The
features include Accessing Database Variables via Coordinates, MDLC over IP, RDLAP, X.25
Protocol Support, Event Driven Software, INTRAC Protocol, Dual CPU Operation, Global
Positioning System (GPS), and PID LOOP.
Two related files are provided to help users. The first, Error Messages, describes, software
error messages and warnings generated by the error logger, corrupted database errors, compiler
errors, and warnings. The messages are listed as they appear on the screen, along with a
general indication of the type of error encountered. The second, a guide to the Software
Diagnostics Output from MOSCAD software modules, can be very useful for fine-tuning the
behavior of the system and allocating memory.
1
Database Concept
The RTU database is the collection of all local variables such as inputs, outputs, calculated
values, parameters, and those variables received via the communication link. It is comprised of
up to 127 user-oriented tables employing user-defined symbolic names.
Application Programmer includes a powerful, yet simple table editor, called Database Builder,
which makes database definition and modification a “snap”.
Defining the database as a set of structured tables provides the following advantages:
• The user-oriented database is easy to understand, define, and modify.
• The same tables are used during automatic creation of the central database.
• The same tables are used during symbolic run-time monitoring of the database.
• Adding/deleting devices is done by modifying the number of rows in the specific table
(table’s last index). The process is automatically adjusted to the new number of devices.
• Since tables are known to the central, communication between central and RTUs is
transparent to the RTU process (no process has to be written for handling the
communication).
• Any portion of any table can be downloaded from or uploaded to the central.
• Qualification formulas may be used as filters at the transmitting site, to reduce the amount
of transmitted data.
Table Types
The system provides two types of tables:
• Single-column tables
• Multiple-column tables
Single-Column Table
Single-column tables hold global RTU variables. All variables in the table (column) are of the
same data type. Each entry in this table is assigned a unique symbolic name. The data type of
the table appears below the table name and table symbol.
For every row in the table there is an associated Change of State (COS) flag. This flag is used
for communication with qualifiers. You may define a name for this flag (in the COS Name
box) to be used in the process (ladder diagram rungs).
The following figure illustrates a single-column table:
2
Database Concept
Multiple-Column Table
Multiple-column tables hold symbolic structured data. Each table represents a group of 1 to
250 similar devices (e.g. pumps, reservoirs, transformers, etc.).
A row (record) in the table represents a single device, and a column a value which is common
to all devices. Each column has a unique symbolic name.
All variables in a specific column share the same data type.
Each variable in the table has a unique logical name: <column name>, <row (device) index>.
The following figure illustrates a multiple-column table:
The above table contains 5 rows (for 5 pumps) and one of the columns is called “Flow”. Here,
“Flow,0” defines the flow of the first pump, and “Flow,4” – the flow of the fifth pump. In
other words, “Flow,x” defines the flow of pump x, where x is the pump index. In each column,
the column data type appears below the column name.
3
Database Concept
For every row in the table there is an associated COS flag. This flag is used for communication
with qualifiers. You may define a name for this flag (in the COS Name field) to be used in the
process (ladder diagram rungs).
The Last Index (last device) is given a free name by the user (LstPmp in the above example; it
is seen when the table is scrolled). This name is used in the process to indicate the last device
in the table. The process is automatically adjusted to the actual number of devices (rows) when
it is changed by the user.
Duplicated Columns
The system enables you to define columns that are windows to other columns in different
tables. These are called duplicated columns. This feature is designed to build a table that will
serve as a report to the central. This table may include various columns that have been defined
in different tables.
This feature may also be helpful during debugging. You may define a table of duplicated
columns (windows) to view simultaneously specific values, located in different tables.
When using the duplicate column operation, the original column is not duplicated in the
database; the duplicated column only holds a “pointer” to the original column.
Single- and Multiple-Column Tables: A Comparison

In a single-column table, each variable is specified by a name. In a multiple-column table each
column is specified by a name and each variable in the table is defined by the column name
and an index, as follows: <Column Name>,Index.
A single-column table holds single variables, while a multiple-column table is designed to hold
N devices (rows) that have the same structure.
A multiple-column table allows you to write an algorithm for a single row (device) and to
apply it to all the rows (devices) using an index. In a single-column table it is not possible and
not necessary to use an index.
Table Groups
The tables in the system are arranged in three groups:
• User tables
• System tables
• Constants tables
User Tables
User tables are defined according to application requirements. Up to 127 user tables may be
defined.
4
Database Concept
The first table in this group is already defined as a single-column table called Qualifiers. The
variables in this table may be named by the user. The qualifiers in this table are used during
group-calls from the old central (IGC/M) to form groups of RTUs (broadcast).
System Tables
The system tables are pre-defined tables, designed to hold communications buffers, index
pointers, time and date variables, and other system-related variables.
Some tables may be modified by the user to meet specific needs. However, system tables may
not be added to this group or deleted from it.
Constants Table
Symbolic constants (and not their numeric value) are used during process (ladder) editing. For
example, if a limit for a process is 100, a symbolic name such as Limit 1, rather than the actual
value, is used.
The symbolic constants provide the following:
• Easy modification, since the constant has to be modified in only one place
• Better understanding and easier maintenance of the ladder
Some of the constant tables are pre-defined, including constants such as ASCII characters, port
names, modes and protocols.
Two tables in this group are provided for event definitions (up to 500 events) via symbolic
names. The event names should be defined in these tables. These events become automatically
known to the control center during the creation of the central database.
The following figure illustrates a system constant table:
Symbolic constants that appear in the tables but are not used in the process (Ladder Diagram)
do not consume any memory space.
5
Database Concept
Data Types
Every column in the database tables (single or multiple-column), may be defined as one of the
following data types (the name in parentheses indicates the column data type in a multiple-
column table):
• Discrete – Internal Bit (bit)

• Integer Value – Internal Integer Value (int)
• Real Value – Internal Real Value (real) (MOSCAD ≥ V1.44, MOSCAD-L ≥ V1.00)
• Integer Parameter – Internal Integer Parameter (iprm)
• Real Parameter – Internal Real Parameter (rprm) (MOSCAD ≥ V1.44, MOSCAD-L ≥
V1.00)
• Discrete Input (d-i)
• Discrete Output (d-o)
• Value Input (v-i)
• Value Output (v-o)
• Scaled Analog Input (sAI) (MOSCAD ≥ V1.44, MOSCAD-L ≥ V1.00)
• Scaled Analog Output (sAO) (MOSCAD ≥ V1.44, MOSCAD-L ≥ V1.00)
• Mapped Discrete (mbit)
• Mapped Value (mval)
• Hours Timer (Hr:Mn)
• Minutes Timer (Mn:Sc)
• Seconds Timer (Sc:Ms)
• Pulses Per Hour (pph) (MOSCAD ≥ V1.61, MOSCAD-L ≥ V1.00)
• Time-Tagged DI (TgDI) (MOSCAD ≥ V1.61, MOSCAD-L ≥ V1.00)
• Programmable Ladder Controller (plc_vi, plc_vo, plc_di, plc_do, plc_ri, plc_ro)
(MOSCAD ≥ V3.70, MOSCAD-L ≥ V1.00)
• Index
• Constants
Discrete – Internal Bit (bit)

This data type may be used for internal logical (calculated) variables that have the following
values:
Value Meaning
‘0’ (false) The operation indicated by the logical variable is not active.
Examples: a machine that is not operating, a de-energized relay, an
alarm that is not activated, or a disconnected switch.
‘1’ (true) The operation indicated by the logical variable is active. Examples:
an energized relay, an operating machine, an activated alarm, a
connected switch.
Variables of this data type are products of internal functions (rungs) or received from another
site through the communication system.. When the system starts at cold start (for example,
after reset load), all Discrete variables are reset to ‘0’.
6
Database Concept
Integer Value – Internal Integer Value (int)

This data type includes the internal (calculated) integer variables (positive and negative) in the
range of -32,768 to +32,767. These variables are represented by two bytes in 2’s complement
format.
after reset load), all Integer Value variables are preset to ‘0’.
Real Value – Internal Real Value (real)

This data type includes the internal (calculated) real variables (floating point) in the range of -
3.402823466x1038 (displayed as -3.402823466E+38) to +3.402823466x1038 (displayed as
+3.402823466E+38). These variables are represented by four bytes in scientific notation.
after reset load), all Real Value variables are preset to ‘0’.
Integer Parameter – Internal Integer Parameter (iprm)

The variables of this data type are almost identical to Integer Value variables. The difference
is that they receive initial values at cold start of the system. While Integer Value variables are
reset to ‘0’ at cold start-up, the Integer Parameter variables receive a value defined by the user.
However, this value may be changed during operation by means of the ladder diagram.
Real Parameter – Internal Real Parameter (rprm)

The variables of this data type are almost identical to the Real Value variables. The difference
is that they receive initial values at cold start of the system. While the Real Value variables are
reset to ‘0’ at cold start-up, the Real Parameter variables receive a value defined by the user.
However, this value may be changed during operation by means of the ladder diagram.
Discrete Input (d-i)

This data type includes all discrete bits received by the Discrete Input modules of the RTU.
The variables of this data type may be assigned the logical value ‘0’ or ‘1’.
The user can connect each entry of any column, defined as Discrete Input, to any physical
input in one of the RTU Discrete Input modules (refer to the I/O Link section in the
Application Programmer chapter of this manual).
The user controls when the physical inputs are read into any column which is defined as
Discrete Input (refer to the Scan operator in the Ladder Diagram Language section).
The physical inputs are usually read before using the values of the column during the process.
7
Database Concept
The possibility of reading the inputs for each column separately enables you to perform
various operations at different rates (priorities).
Discrete Output (d-o)

This data type includes all discrete bits that are to be sent to the Discrete Output modules of
the RTU. The variables of this data type may be assigned the logical value ‘0’ or ‘1’.
The user can connect each entry of any column, defined as Discrete Output, to a physical
output in one of the RTU Discrete Output modules (refer to the I/O Link section in Application
Programmer chapter of this manual).
The user controls when the values of a specific column are sent to the physical outputs (refer
to the Scan operator in the Ladder Diagram Language section).
The values of the column are usually sent to the physical outputs at the end of the column
calculation (by the process).
Value Input (v-i)

This data type includes the positive and negative integer variables read by the I/O modules that
provide numerical values. The range of the Value Input is from -32,768 to +32,767 (same as
Integer Value and Integer Parameter).
Every module may provide different ranges of values. For example, the modules that include
A/D (the A/D provides a value that is proportional to the analog measurement) provide a
number in the range of -4,000 to +4,000 for an analog input in the range of -Full Scale to +Full
Scale.
The modules that include counters (accumulators) provide values in the range of 0 to +32,767.
When the counter reaches the value of +32,767 and is advanced, it returns to 0.
The connection between the variables in the columns, defined as Value Inputs, and the I/O
modules is performed by the I/O Link program (refer to the I/O Link section in Application
The user controls when the physical inputs are read into any column defined as Value Input
(refer to the Scan operator in the Ladder Diagram Language section).
Usually, the physical inputs are read before using the values of the column during the process.
The possibility of reading the inputs for each column separately enables you to perform
various operations at different rates (priorities).
Value Output (v-o)

This data type includes the positive and negative integer variables that are to be sent to one of
the I/O modules as a numeric or analog output. The range of the Value Output is from -32,768
to +32,767 (same as Integer Value and Integer Parameter).
8
Database Concept
Note that every module may receive different ranges of values. For example, the modules that
include analog output should receive values between 0 and +2,000 for output voltage and
between 0 and +Full Scale for current.
The connection between the variables in the columns, defined as Value Outputs, and the I/O
modules is performed by the I/O Link program (refer to the I/O Link section in Application
Usually, the values of the column are sent to the physical outputs at the end of the column
Scaled Analog Input (sAI) )

This data type includes the variables representing physical values that are read by the A/D
modules only and scaled to Engineering Units (EGU) (real values). The range of the Scaled
Analog Input variable is from -3.402823466E+38 to +3.402823466E+38 (same as Real Value
and Real Parameter).
The user has to define the physical value at two points, so that the system will translate the
sensor output to a physical value, as demonstrated in the following graph:
Y physical
value
EGU High
20%
EGU Zero
{ 0
sensor
output
0 800 4,000 X
The first point, EGU High (EGUH), is the physical value when the sensor is at full scale. The
second point is the physical value when the sensor output is 0 or live-zero, as in the case of the
4-20 mA sensors. This second point is called EGU Zero, EGU0. For sensors that output
voltages in the range of ±V, the calibrating point is the physical value when the sensor output
is 0 and not -V.
The values of EGU Zero and EGU High should be defined in the relevant table by means of
the Show Related Data function. You also may define whether the EGU Zero is live-zero or
not.
9
Database Concept
The connection between the variables in the columns, defined as Scaled Analog Inputs, and
the A/D modules is performed by the I/O Link program (refer to the I/O Link section in
The user controls when the values of a specific column are read from the physical inputs (refer
Usually, the physical inputs are read before using the values of the column calculation during
the process.
The possibility of reading the inputs for each column separately enables performing various
operations at different rates (priorities).
Scaled Analog Output (sAO) )

This data type includes the variables that are scaled to Engineering Units and are to be sent to
one of the I/O modules. The range of the Scaled Analog Output variable is from -
3.402823466E+38 to +3.402823466E+38 (same as Real Value and Real Parameter).
The user may define the two points (EGU Zero and EGU High) of the scaling function. Refer
to Scaled Analog Input.
The connection between the variables in the columns, defined as Scaled Analog Outputs, and
the I/O modules is performed by the I/O Link program (refer to the I/O Link section in
The values of the column are usually sent to the physical outputs at the end of the column
Mapped Discrete (mbit)

This data type enables you to define a column of discrete variables that are a copy of discrete
variables in other tables. In this case, the discrete variables are copied from various tables (for
a copy of a complete column, refer to the Duplicate Column operation described in this
chapter).
For each variable in a column defined as Mapped Discrete you should define the discrete
variable from which it is to be copied.
The user controls when the values are copied to the table (refer to the Scan operator in the
Ladder Diagram Language section). Performing the Scan operation on a Mapped Discrete
column is the same as separately mapping each variable in the column.
10
Database Concept
Mapped Value (mval)

This data type enables you to define a column of value variables that are a copy of value
variables in other tables. In this case, the value variables are copied from various tables (for a
copy of a complete column, refer to the Duplicate Column operation described in this chapter).
For each variable in a column defined as Mapped Value, you should define the value variable
from which it is to be copied.
The user controls when the values are copied to the table (refer to the Scan operator in the
Ladder Diagram Language section). Performing the Scan operation on a Mapped Value
column is the same as separately mapping each variable in the column.
Hours Timer (Hr:Mn)

This data type includes timers to be used as delays or retentive timers with resolution of one
minute. The maximum value of this type of timer is 99:59 (99 hours and 59 minutes).
A timer of less than one hour should be defined as a Minutes Timer, rather than Hours Timer,
in order to improve its resolution.
In each column defined as Hours Timer, the user should define the preset time of every timer.
This preset time is assigned to the timer at cold start-up of the system and may be set to
another value by the appropriate ladder diagram functions.
A detailed explanation about the use of the Hours Timer is provided in Ladder Diagram
Language.
Minutes Timer (Mn:Sc)

This data type includes timers to be used as delays or retentive timers with a resolution of one
second. The maximum value of this type of timer is 99:59 (99 minutes and 59 seconds).
A timer of less than one minute should be defined as Seconds Timer rather than Minutes
Timer in order to improve its resolution.
In each column defined as Minutes Timer, the user should define the preset time of every
timer. This preset time is assigned to the timer at cold start-up of the system and may be set to
A detailed explanation about the use of the Minutes Timer is provided in Ladder Diagram
Language.
Seconds Timer (Sc:Ms)

This data type includes timers to be used as delays or retentive timers with resolution of
10 milliseconds. The maximum value of this type of timer is 99:99 (99 seconds and
990 milliseconds).
In each column defined as Seconds Timer, the user should define the preset time of every
timer. This preset time is assigned to the timer at cold start-up of the system and may be set to
11
Database Concept
A detailed explanation about the use of the Seconds Timer is provided in Ladder Diagram
Language.
Pulses Per Hour (pph) )

This data type defines variables (integers) with a value equal to the pulse rate in pulses per
hour.
The user has full control of the time that the pph is updated in the column (refer to the Scan
operator in the Ladder Diagram Language section.)
The user can connect each entry of any column, defined as Pulses Per Hour, to any physical
input in one of the RTU Discrete Input modules (refer to the I/O Link section in Application
Time-Tagged DI (TgDI)
This data type is similar to the DI data type. In addition, the system keeps track of these inputs
and every change is recorded in a Time-Tag log buffer and/or events buffer together with the
date and time in 1 msec resolution. The Time-Tag buffer can be read using the Time-Tag
Logger tool. The events buffer can be read via a ladder construct by calling the GtEvnt
function (see Advanced Features in the Application Programmer manual).
This data type is relevant for electric applications and only the important inputs should be
defined as Time-Tagged DI, since this feature is CPU-time consuming.
The user can connect each entry of any column, defined as Time-Tagged DI, to any physical
input in one of the RTU Discrete Input modules (refer to the I/O Link section in Application
Programmable Ladder Controller (plc_vi, plc_vo, plc_di, plc_do, plc_ri, plc_ro)

This data type is used to read from the PLC or write to the PLC, which supports the Third
Party protocols (refer to the Third Party Protocols Support manual).
Index
This data type includes pointers to rows of multiple-column tables. Since each row in a
multiple-column table represents the variables of a device, the Index is a pointer to the device.
The Index enables the user to write an algorithm for one row of the table and apply it to all
table rows. The Index variable may be defined only in the Index table (one of the system
tables). The index value is limited to the range 0-250 at any given time (the number of rows in
a table is limited to 250). If an index exceeds the 250 limit, an error message will be recorded
in the Error Logger, because no tables have more than 250 rows.
12
Database Concept
Constants
Constants are defined by a symbolic name and numeric value in single-column tables. The
symbolic name of the constants are used in the ladder diagram.
There are two types of constants: Integer and Real (MOSCAD ≥ V1.44, MOSCAD-L ≥
V1.00).
The advantage of using the symbolic name in the ladder diagram rather than the value is that in
case of changes, it is easier to change the value only in one place (in the table) rather than
searching in all functions.
13
Ladder Diagram Language
The ladder diagram language is the user’s means to define the functions to be performed by the
RTU. In order to define the control program, its outputs should be defined as a function of the
inputs and time.
For your convenience, the user control program is divided into several (one or more)
processes. Each process has a 256 character name(of which the first six characters are unique)
and a description of up to 20 characters.
Each process consists of functions (rungs) that may have a logical name (optional) and a short
description. It is possible to open a window and to add a detailed description (without length
limitation) of the function.
The optional logical name is necessary only when activating the JMP operator to that rung.
Nevertheless, assigning a logical name and a brief description to each rung will be very helpful
when performing maintenance and modifications.
The first process in the Process List is always the MAIN process. This process must be defined
since it is performed by the system. In addition, the commands that activate other processes are
issued from the MAIN process by means of special operators.
The system software performs the process in cycles. All the rungs are executed sequentially in
each cycle. The time needed to perform one cycle is called “scan time”.
“Inputs” and “Outputs”

Each rung defines the behavior of an “output” (or “outputs”) as a function of both the state of
the “inputs” and the time. Thus, by building a rung for each “output” (or “outputs”) separately,
the entire control program is defined. In the following, “inputs” and “outputs” will also be
designated by the general designation variables.
The words “inputs” and “outputs” are enclosed within quotation marks because these variables
are not necessarily physical inputs and outputs. They may also be “internal variables” -
variables that comprises the “output” of a rung and that may serve as an “input” in another
rung. The use of such internal variables enables the appropriate RTU to define and perform
complex monitoring and control functions.
The relationship between the “inputs” and the “output” (the function) is indicated in a
symbolic manner that expresses a relationship of logical conditions between the “inputs” and
the “outputs”. The RTU executes (computes) the logic function defined by the rung, and the
result for each “output” is either “1” or “0” where “1” means “the rung is true” and “0” means
“the rung is false”. The operation on the “output” is performed according to the result received
from the rung.
14
Variables
The database, built by Database Builder as a set of tables, includes variables of various data
types. Each variable is described by a symbolic name: <Name> for a single-column table and
<Name>,<Index> for a multi-column table. The variables in the system may be of the
following data types (refer to the Database Concept chapter in this manual):
• Discrete
• Integer Value, Real Value
• Integer Parameter, Real Parameter
• Timers (three resolutions: Hours, Minutes, and Seconds)
• Mapped Discrete, Mapped Value
• Discrete Input, Discrete Output
• Value Input, Value Output
• Scaled Analog Input, Scaled Analog Output
• Time-Tagged DI
• PPH
• Index
• Integer Constant, Real Constant
The following section describes each element variable and its relevant data types.
Ladder Diagram Elements

The elements used by the ladder-diagram language, and the operations that the system
performs for each element, are described in this chapter. They should be studied and practiced
carefully. There are two types of elements:
• Elements that define relations to “inputs” (“input operator”)
• Elements that define an operation to be performed on an “output” according to the “result”

of the rung (“output operator”)
The rung may be perceived as an “array” of contacts (representing the states of the relevant
“inputs”) through which “current” must “flow” towards the element that represents the
operation to be performed on the “output”. When such a flow path exists, the rung is “true”
and the appropriate operation is performed on the “output”. When a rung does not include any
“input” element, it is considered true and the output operation is always performed.
“Normally-Open (N.O.) Contact” Element

——| |——
This element is used to designate an N.O. type contact element, such as a switch, a device, a
timer or an internal variable. When entered, the element name appears above the element.
15
When the state of the element is “0” (false, not operating), the contact is considered to be open
(not conducting current). When the state of the element is “1” (true, operating), the contact is
considered to be closed (connected, conducting current). Consider this:
SW1
——| |——
The above symbolic contact represents the state of switch SW1. When switch SW1 is actuated,
the contact representing it is “connected”, and when the switch is not actuated, the contact is in
its normal state, that is, not connected.
The data type of the variable above the N.O. element may be one of the following:
• Discrete (internal bit)

• Discrete Input
• Timer Contact
• Mapped Discrete
• Discrete Output
• Time-Tagged DI
“Relay On” Element

——( )
This element designates an operation performed on a two-state element (“0” – not actuated,
“1” – actuated). When the name of the controlled element is entered, it appears above the
element, as follows:
MOTOR
——( )
If the rung is “true”, the element (in the above case, MOTOR) will be actuated. If the rung is
“false”, the controlled element will be stopped.
The data type of the variable above the “RELAY ON” element may be one of the following:

• Discrete Output
As an example, consider the automatic operation of a heating coil, designated Heater. The coil
which is actuated when a heating control switch, designated HeatSw (heating switch), is
actuated and when a float installed in a tank designated LvlSw (water level switch), which
checks that there is water in the tank, is also actuated. The rung for performing the actuation of
the heating coil should be as follows:
HeatSw LvLSw Heater

( )
16
Only when both contacts are actuated the rung is “true”; “current” reaches the “relay on”
element and the heating coil is actuated. The order in which the two “input” elements appear
in the rung is not important and has no influence on its operation.
In Boolean algebra, the rung above represents an AND operation:
Heater is “on” when: HeatSw is “on” AND LvlSw is “on”
In notation form: Heater = HeatSw⋅LvlSw
“Normally-Closed (N.C.) Contact” Element

——| / |——
Sometimes it is necessary to condition a rung on a certain device being in OFF state. This
means that the contact which represents the device closes (conducts current) when the device
is not actuated and opens (does not conduct) when the device is actuated. This function is
achieved by the Normally-Closed Contact element.
The data type of the variable above the N.C. element may be one of the following:

• Discrete Input
• Timer Contact
• Mapped Discrete
• Discrete Output
• Time-Tagged DI
1. Refer again to the actuation of the heating coil and add one more condition for its
actuation. We shall assume that a valve is installed for emptying water from the
container, and let us stipulate that the heating coil is to be actuated on condition that
this valve is closed (not actuated). We shall designate the valve by the symbolic name
Valve. The rung will look as follows:
HeatSw LvLSw Valve Heater

/ ( )
When Valve is not actuated, i.e., the contact is closed, the rung is “true” and the
heating coil is actuated.
2. A motor (MOTOR) is to be switched on when at least one of three push-buttons

(PB1, PB2, or PB3) is pressed, but on condition that an emergency relay (EMRG) is
not actuated:
17
PB1 EMRG MOTOR

/ ( )
PB2
PB3
3. Let us also consider a more complex function:
A B C D E X
/ ( )
Device X will be actuated when current flows through any of the branches in the rung.
The Motorola Advanced Ladder-Diagram Language enables you to define complex rungs, with
the only restriction being that the branches of the rung do not cross each other.
“Relay Off” Element

——( / )——
Sometimes, it is more convenient to define the logic conditions under which the controlled
device is to be stopped (instead of defining those conditions under which it is actuated). The
Relay Off element performs the opposite of the Relay On element; that is, when the rung is
“true”, the controlled device is stopped; as long as the rung is not “true”, the controlled device
is operating.
The variable above the Relay Off element may be defined as one of the following data types:

• Discrete Output
For example, suppose that device C is to be stopped on the operation of device A or B:

A C
( / )
If either A or B is operating, the condition of the rung is fulfilled and device C is not
operating.
In Boolean algebraic notation this may be expressed as a NOR operation: C = A + B or

C = A+ B
18
Note that if C stops when A or B is actuated, then C is actuated when both A and B stop, as
expressed in the following rung:
A B C
/ / ( )
Or in Boolean algebraic notation: C = A⋅ B

The two rungs given for this example are equivalent. The De-Morgan law of Boolean algebra
states that: A + B = A ⋅ B
Comparators
V1 V1 V1 V1
= ≠ > <
V2 V2 V2 V2
Sometimes it is necessary to make a function (rung) conditional on the values of variables. For
this purpose, the language includes symbols representing four different types of comparators.
When the equality or inequality described by the comparator is fulfilled, the result is a closed
“contact” (enabling the flow of current through the “contact” of the comparator). When the
equality or inequality is not fulfilled, an open “contact” results.
The data type of the V1 and V2 variables may be one of the following:

• Timer (hour, minute, second)
• PPH
• Index
• Mapped Value
If one of the values is constant, then the second value should not be constant. If the variable is
defined as a timer, the system automatically refers to the “time-left” value (refer to Timers.)
With the comparator operator, you may use real values and integer values.
As an example of the use of comparators, refer again to the case of the heating
element and add another condition for its actuation: the temperature of the water in
the tank be less than 95°C. Suppose that a thermometer with a continuous analog
output is installed in the tank, connected to an analog input of the RTU, and that an
integer variable designated TEMP has been defined (in the value input data type).
The rung performing the required control function is described below:
HeatSw LvlSw Valve TEMP Heater

/ < ( )
95deg
19
“95deg” is a constant defined as equal to the value input corresponding to the analog
reading of 95°C.
The comparator compares TEMP to 95deg. Only if it is less than 95deg (and, of
course, all the other conditions are also fulfilled) is the heater actuated.
We will assume, still using the example above, that instead of a constant, the
temperature is compared to the value obtained from an external potentiometer (which
serves as a sort of thermostat). If we designate the value obtained from the
potentiometer with the symbolic name Preset (in the value input data type), we get the
following rung:
HeatSw LvlSw Valve TEMP Heater

/ < ( )
Preset
The condition greater-or-equal to and smaller-or-equal to should be written as follows:
For Speed ≥ Limit:

Speed
>
Limit
Speed
=
Limit
For Speed ≤ Limit:

Speed
<
Limit
Speed
=
Limit
“Relay Latch”, “Relay Unlatch” Elements

——(L) ——(U)
In some cases, it is more convenient to define separately the conditions under which an
“output” (relay or any other) is actuated, and the conditions under which that same “output” is
stopped (released), on the assumption that while the conditions for its actuation or release are
not fulfilled, the “output” remains in its last state. These two elements perform the respective
operation on the “output” when the rung is true. The symbol name of the relay output is always
entered and appears above the element. When the rung is false, it has no influence on the
“output”.
The data type of the variable above the “RELAY LATCH” and “RELAY UNLATCH”
elements may be one of the following:
20

• Discrete Output
For example, refer to the turning on and off of a lighting system from five different
locations and with two push-buttons in each location, shown below.
ON 1
OFF 1
LIGHT
RTU
ON 5
OFF 5
Five pairs of ON/OFF switches are connected to the RTU, which actuates LIGHT.
The rung for performing this control function may be built in the conventional
“START-STOP” circuit form:
LIGHT OFF1 OFF2 OFF3 OFF4 OFF5 LIGHT

/ / / / / ( )
ON1
ON2
ON3
ON4
ON5
Each momentary pressing of one of the ON switches actuates LIGHT which then
provides “self-holding” or latching function. Each momentary pressing of one of the
OFF switches turns the lighting off.
The same control function may be performed using the ( L ) – “relay latch” and ( U )
– “relay unlatch” element:
21
ON1 LIGHT
( L )
ON2
ON3
ON4
ON5
OFF1 LIGHT
( U )
OFF2
OFF3
OFF4
OFF5
The latching and unlatching operations occur only if the rung is true, therefore there is
no need for “self-holding” of LIGHT.
The advantages of these elements will become apparent in complex systems where they are
used in conjunction with additional elements that are explained in the following paragraphs.
Reset
——(RST)
When the conditions of the rung are fulfilled, the variable that appears above the element is
reset to zero. This variable may be of the following data types:
• Integer Value
• Integer Parameter
• Value Output
• Index
• Retentive Timer
In the case of retentive timers, the RST operator presets the timer, i.e., it returns the timer to its
preset time so that it may be actuated again by an appropriate rung (refer to Retentive Timer).
To zero a Real variable, MOVE the value 0 to it.
Timers
One of the most important parts of any control system is the timer. The timer provides delays
between different processes or the activation of a certain process for a predetermined time
period.
22
During database building, it is possible to define specific columns as Timers. The resolution of
the Timer is according to the selected type: Hours, Minutes, or Seconds Timer.
Each Timer may function as one of the following:
• On-Delay (DON) Timer

• Off-Delay (DOF) Timer
• Retentive Timer
The Timer mode of operation is set according to its definition as an output in the Ladder
Diagram.
The Timer has an unlimited number of contacts of the “normally open” and “normally closed”
types that may be used as “inputs” to other rungs (this is done simply by writing the same
symbolic name that was used for the output operator).
When defining a Timer in the Database Builder, its “duration time” (preset value) is also
defined. The preset value may be modified in the course of control program execution through
other rungs by using any “output” element that will update the value such as MOVE, or
Arithmetical Calculation operators. The new preset value is used by the Timer when next
started.
Timer1
( MOVE )
NewPst
When all conditions of the rung are fulfilled, the value of the NewPst constant or variable is
used as the new preset for Timer1.
When you define constants to be used as preset values for timers, you should consider the
following:
• For Hours Timer: the HH:MM preset value (0≤ HH≤ 99, 0≤ MM≤ 59) should be defined
as 60⋅(HH) + MM, since in memory the Hours Timer counts with resolution of one minute.
• For Minutes Timer: the MM:SS preset value (0≤ MM≤ 99, 0≤ SS≤ 59) should be defined
as 60⋅(MM) + SS, since in memory the Minutes Timer counts with resolution of one
second.
• For Seconds Timer: the SS:mm preset value (0≤ SS≤ 99, 0≤ mm≤ 99) should be defined as
100⋅(SS) + mm, since in memory the Seconds Timer counts with resolution of 10
milliseconds.
• For Hours Timer and Minutes Timer you can define timers in the Time Constants table. In
this table you can define timers in the XX:XX format.
The Time Constants table (one of the Constants tables) may be used for defining hour and
minute timer constants, without the need to perform the calculations described above.
23
“On Delay” Timer

——(DON)
The DON timer operates as a function of the rung’s being true or false as follows:
a) When the rung is false, the timer is in its normal state (not actuated) and all its “normally
open” type contacts are open and those of the “normally closed” type are closed
(actuated).
b) When the rung changes its state to true the timer begins to run until its preset time period
elapses. While the timer is running, the state of its contacts is as described in a. above.
c) When the preset time of the timer elapses, the timer changes its state to true and all its
contacts of the “normally open” type close while those of the “normally closed” type open.
d) As soon as the rung ceases to be true, the timer stops, returns immediately to its normal
state, and the state of its contacts is once again as described in a) above. The On Delay
Timers timing diagram is shown below.
TRUE "1"
RUNG
{ FALSE "0" e
PRESET COUNT
"TIME
LEFT" { 0
DOWN
CLOSED "1"
TIMER'S
"NORMALLY
OPEN"
CONTACT
{ OPEN "0"
ON
DELAY
The “time left” comprises the delay time left. This time is kept at the preset value as long as
the rung is false and is then counted down when the rung is true. When the time left reaches
zero the “on delay” is finished.
The following are some examples of the use of “on delay” timer.
1. The pump PUMP1 is to be actuated 10 seconds after valve VLV1 is opened

(actuated).
24
VLV1 Tmr1
(DON)
Tmr1 PUMP1
( )
The contact Tmr1, which is a contact of the timer of the same name, is actuated 10
seconds after VLV1 is actuated and thus turns on PUMP1.
2. The light must turn on for a predetermined period of 10 minutes as a result of the
momentary pressing of the push-button START.
START LIGHT
RTU
To explain this example, let us go back to the timing diagram given previously, and
assume that the rung which actuates the timer is constantly true and ceases to be true
for a short period of time.
TRUE "1"
RUNG
{ FALSE "0"
ON DELAY
CLOSED "1"
{
TIMER'S
"NORMALLY
OPEN"
CONTACT OPEN "0"
CLOSED "1"
TIMER'S
"NORMALLY
CLOSED"
CONTACT
{ OPEN "0"
We get a pulse of the duration of the timer’s preset time plus the time for which the
push-button was pressed (a “differentiator” may be used to cancel the influence of the
push-button on-time). The ladder-diagram for this example looks as follows:
START T
/ (DON)
T LIGHT
/ ( )
3. Turn on a lamp every four seconds for a short time.
Before explaining this example, let us first explain the concept of “scan”.
25
In order to execute the control program defined in the ladder-diagram, the RTU
periodically performs all functions written in the Ladder Diagram one after the other.
After a certain period of time the RTU repeats this procedure. The performance of the
Ladder Diagram functions is called “scan” and the time between two scans is called
“scan time”.
Sometimes it is necessary to build, via the rungs of the ladder-diagram, a “clock

function” for synchronizing and actuating various processes. For our example, let us
assume that such a “clock function”, designated CLOCK, is to be built and that
CLOCK should be true once every four seconds for the period of one scan time.
Let us further assume that each time CLOCK is true, a lamp, designated LIGHT, is
latched. The lamp is turned off by an OFF condition external to the system.
LIGHT
RTU
OFF
The ladder-diagram for performing these functions will look as follows:
CLOCK LAMP
( L )
OFF LAMP
( U )
CLOCK CLOCK
/ (DON)
CLOCK is a timer with a preset time of 04:00 seconds. The special rung in which the
timer is actuated (on condition that it is not true) provides a pulse, shown below.
1 scan
CLOSED "1"
{
TIMER'S
"NORMALLY
OPEN"
CONTACT OPEN "0"
ON DELAY
In this example, the rung with the DON output must be located after the rungs using
the timer contacts, since during that scan in which the timer concludes the countdown
of the delay (the delay is over), it again presets itself.
26
“Off Delay” Timer

——(DOF)
The operation of this timer is similar to that of the “on delay” timer, except that the delay starts
with the transition of the rung to the state of OFF (“0”) instead of the transition to ON (“1”).
TRUE "1"
RUNG
{ FALSE "0"
PRESET COUNT
"TIME
LEFT" { 0
DOWN
OFF DELAY OFF DELAY

CLOSED "1"
TIMER'S
"NORMALLY
OPEN"
CONTACT
{ OPEN "0"
The DOF Timer may be set to any one of the three resolutions: hours, minutes, or seconds.
The DOF Timer can generate a positive pulse with a duration that is equal to the Timer delay
if it receives TRIG (TRUE) for one SCAN. The appropriate rungs are described below.
TRIG PULSE
( DOF )
PULSE
1 scan
"1"
TRIG
"0"
OFF DELAY
PULSE
TIMER
As an example let us assume that a delay is necessary between the two outputs A and
B. Output B should start five seconds after output A has started and stops 20 seconds
after output A has stopped.
27
A
5 sec 20 sec
A T1
(DON)
T1 T2
(DOF)
T2
( B )
The two delays are added “in series”, one influencing the upward transition and the
other – the downward transition. In this example the order in which the rungs are
written is irrelevant and DOF can precede DON.
Retentive Timer
——(TRT)
The retentive timer operates as follows:
RST
TRUE "1"
RUNG
{ FALSE "0"
PRESET
TIMER'S CLOSED "1"

"NORMALLY
OPEN"
CONTACT
{ OPEN "0"
a) As long as the rung is true (“1”) the timer counts down from its preset time.
b) When the rung ceases to be true, the time left is “frozen”, i.e., the timer stops counting but
remains at the point in the countdown that it reached while the rung was true.
28
c) When the rung again becomes true, the timer resumes its countdown from the “frozen”
point.
d) When the time left is zero, all the “normally-open” contacts of the timer close, while all
the “normally-closed” contacts open.
e) The retentive timer will remain in this state until preset again by an RST output operator
having the same symbolic name as the timer.
The main application of the retentive timer is for accumulating the operating time of a certain
installation or device, and supplying an indication that a certain predetermined operation
period has come to an end. This indication may merely serve as a warning to the operator of
the system, or may automatically start another operation.
In cases where more than 99 hours must be counted, this may be done by combining a counter
and a retentive timer.
An RTU operates a motor, designated MOTOR, and that an external maintenance

alarm via a lamp, designated L1, should be activated after 75 hours of operation. After
servicing the motor, a switch, SW1, is pressed and the time count starts again. In this
example we use a retentive timer with resolution of minutes, named MotrHr, that has
a preset time of 75:00 hours.
MOTOR
(Conditions for actuating the motor) ( )
MOTOR MotrHr
( TRT )
MotrHr L1
( )
SW1 MotrHr
( RST )
Differentiators: Positive (UP), Negative (DOWN)

——| ↑ |—— ——| ↓ |——
For versions ≥V3.70, the number of usable differentiators in the application is unlimited.
For versions <V3.70, the number of differentiators is limited to 1024 positive and 1024
negative differentiators.
The operation of the differentiator will be explained by the following example.
29
A stepping motor, designated StpMtr, is to be actuated by pulses of 0.5 second

resulting from the pressing of a switch designated STEP. The pressing of the switch
may take longer than the actuating pulse itself. In addition, the motor should not react
to a further pressing of the switch within less than four seconds.
STEP
RTU StpMtr
"1"
STEP
"0"
"1"
StpMtr 0.5 sec.
"0"
A convenient way for performing this task is to identify the start of the pressing of the
switch by a “differentiating operation” performed by the positive differentiator
operator.
The differentiator is located on the branches of the rung as are the input operators.
The task of the positive differentiator is to identify and conduct current for the
duration of one scan when all the contacts along the branch, which includes the
differentiator (from its beginning to the location of the positive differentiator), have
changed state from open to closed.
The task of the negative differentiator is to identify and conduct current for the
duration of one scan when the contacts from the beginning of that branch to the
location of the negative differentiator stop being true.
In order to execute the task set in the example, two “off delay” timers must be used
(refer to Timers above): one of 0.5 second for actuating the stepping motor; the other
of 4 seconds for preventing an additional actuation. Both timers will be actuated by
the pressing of the switch (the 0.5-second timer will actuate the 4-second timer).
It should be noted that the differentiator in the first rung identifies the point in time at
which the switch STEP is pressed and timer T4S is not actuated. If STEP is pressed
before the timer has completed its countdown, the differentiator “waits” for the timer
(on condition that STEP is still pressed).
30
TS4 STEP TO.5S

/ ↑ ( DOF )
TO.5S T4S
( DOF )
TO.5S StrMtr
( )
STEP
1 scan
DIF
StpMtr
(T0.5S) 0.5 sec.
T4S 4 sec.
The following are examples illustrating the influence of the differentiators in a more
complex rung.
A B RELAY
↑ ( L )
C
Relay ( L ) is executed every time that the function (A⋅B)+C becomes true. In this
case, the differentiator influences the entire rung, from its beginning.
E F RELAY
( U )
G H
↑
In the last rung, RELAY is unlatched when E is true in addition to one or both of the
following conditions: F is true or a COS (Change of State) from 0 to 1 in G and (H or
K).
31
Count Up, Count Down

——(CTU)—— ——(CTD)——
If the rung with the CTU or CTD operator is true, then the variable above the operator is
incremented in the case of the CTU operator, or decreased in the case of the CTD operator.
If the rung is true and its condition continues for more than one scan and only one count is
required, a differentiator must be included in the rung, to ensure that the output operator will
be activated only once.
The CTU and CTD operators may be used with the following data types:
• Index
• Integer Value
• Value Output
You can apply the CTU and CTD operators to a Real variable by using—[+ ] or —[- ]
where the added/subtracted value is 1.
1. For a packing machine: when “n” products have been packed into a case, the
conveyor belt on which the cases are located should move forward to position the next
case to be filled. For each product placed into a case, a contact closes at an input
designated LOAD. The conveyor belt is advanced via an output designated STEP,
which should be actuated for one second.
LOAD COUNTR
↑ ( CTU )
COUNTR PlslSc
> ( DOF )
M
PlslSc COUNTR
( RST )
STEP
( )
Where M = n – 1.
The COUNTR variable (of value data type) counts the cases. When COUNTR≥n a
DOF Timer (Off Delay Timer; see Timers), named Pls1Sc, is activated with a preset
time of 1 second. This timer activates the STEP output and resets the COUNTR
variable.
2. For a tank or reservoir that is filled through two pipes: each pipe is equipped with
an output that emits a pulse for every liter of liquid passed into the tank. The tank also
has an outlet pipe equipped with the same kind of output, which emits a pulse for
every liter of liquid emptied from the tank. It is required to set up a counter that will
32
indicate the exact quantity of liquid in the tank at any given time. Note that the pulses
from the various pipes may appear simultaneously.
Since the value, designated TOTAL, is incremented with every liter of liquid going
into the tank, and decreased with every liter of liquid going out of it, its value is
always equal to the exact quantity of liquid in the tank at any given time.
IN1 TOTAL
↑ ( CTU )
IN2 TOTAL
↑ ( CTU )
OUT1 TOTAL
↑ ( CTD )
Jump
——(JMP)
The JMP operator is the only operator that affects the sequential order of the rungs
performance. When the JMP operator is activated, the program “jumps” to the rung whose
name is specified above the operator.
The JMP operator may be used in the following two ways:
• Jump forward (skip)

• Jump backward (for a loop)
The jump forward is used to skip several rungs that should not be performed if the rung with
the JMP operator is true. For example, if FLAG is true the program will jump to the rung
named NEXT.
FLAG NEXT
( JMP )
( )
( )
( )
Using the JMP operator reduces the necessary memory space since the alternative to the JMP
operator is to insert a N.C. element (on the FLAG variable) in each rung to be skipped when
FLAG is true. It also reduces the time performance since some rungs are skipped.
The jump backward is usually used when performing a loop with an index.
The JMP operator should be used only for skipping rungs within the process and not between
processes.
For jumping from one process to another, refer to Jump to Subprocess.
When using the JMP operator, it is not possible to add other output elements in the same rung.
33
Scan
——(SCAN)
The SCAN operator is used for reading data from physical input modules to update a table
column defined as Discrete Input, Value Input, PPH, or Scaled AI, and for writing data from a
Discrete Output, Value Output, or Scaled AO column to the physical output modules. The
SCAN operator is also used for updating the Mapped Discrete or Mapped Value columns. The
column name above the operator indicates to the system if inputs are to be scanned or outputs
to be updated. In addition, the SCAN is used to get data from an external PLC using the Third
Party protocols (refer to the Third Party Protocols Support manual).
Using this operator, the user can control the refresh rate for all types of variables. Important
data should be scanned at a high rate, while other data can be scanned at a low rate.
Refer to the following pumps table:
Name: Pumps
Flow Presur Fail Control

Ind -------------
(v-I) (v-I) (d-I) (d-o)
0
1
.
.
n
This table includes n+1 rows for n pumps and the following columns (variables):
• Flow – a Value Input variable that specifies the flow for each pump.
• Presur – a Value Input variable that specifies the pressure of each pump.
• Fail – a Discrete Input variable that indicates a failure of the pump.
• Control – a Discrete Output variable used a control for the pump operation.
The table includes other internal variables and parameters, not shown in the table.
The variables of this table are used by an algorithm to compute the Contrl output as a
function of the Flow, Presur, Fail, and other variables. Before performing the
algorithm, the actual values of these variables should be read (by using the SCAN
operator) from the appropriate physical inputs of the I/O modules into the table
columns.
Once the algorithm has been performed, the calculated values of the Contrl column
should be sent (by using the SCAN operator) to the appropriate physical outputs of
the I/O modules.
34
Move Low, Move High

——(MOVE) ——(MOVH)
MOVE is an output operator; when the conditions of the rung are fulfilled, the value below the
operator (A) is stored in the B variable, specified above the operator.
B
( MOVE )
A
The A variable may be of the following data types:

• PPH
• Index
• Scaled AI, Scaled AO
• Mapped Value
The B variable may be of the following data types:

• Value Output
• Index
• Scaled AO
1) Moving 8 bits to the low byte of an integer variable
The MOVE operator may also be used to transfer eight bits (starting with a byte boundary) of
discrete variables to the low byte of an integer variable.
A
( MOVE )
b1
In this rung the MOVE operator takes a series of eight consecutive bits (starting with b1) from
a single-column table and inserts it to the low byte of A (the high byte of A is not influenced).
The following diagram describes the bits arrangement in the integer variable. Note that the
first bit (b1) is inserted into a7.
35
a15 a8 a7 a0
HIGH BYTE LOW BYTE
b1
b2
b3
b4
b5
b6
b7
b8
The bits table may be of the following data types:

• Time-Tagged DI
• Mapped Discrete
• Integer Value
• Value Output
2) Moving the low byte of an integer variable to 8 bits
The MOVE operator may also be used to transfer the low byte of an integer variable to eight
consecutive bits, starting with a byte boundary. The following rung transfers the low byte of A
to eight consecutive bits of a single-column , starting with the bit named b1.
b1
( MOVE )
A
The following diagram describes the operator in this case.
36
a15 a8 a7 a0
HIGH BYTE LOW BYTE
b1
b2
b3
b4
b5
b6
b7
b8
• Integer Value
• Mapped Value
• Constant
• Index
• Discrete
• Discrete Output
3) Moving 8 bits to the high byte of an integer variable
The MOVH operator is used to transfer eight bits of discrete variables to the high byte of an
integer variable.
A
( MOVH )
b1
This operator takes a series of eight consecutive bits (starting from b1) from a single-column
table and inserts it to the high byte of A (the low byte of A is not influenced).
The following diagram describes the bits arrangement in the integer variable. Note that the
first bit of the byte (b1) is inserted into a15.
37
a15 a8 a7 a0
HIGH BYTE LOW BYTE
b1
b2
b3
b4
b5
b6
b7
b8

• Time-Tagged DI
• Mapped Discrete

• Integer Value
• Value Output
4) Moving the high byte of an integer variable to 8 bits
The MOVH operator may also be used to transfer the high byte of an integer variable to eight
bits.
b1
( MOVH )
A
The following diagram describes the operator in this case.
38
a15 a8 a7 a0
HIGH BYTE LOW BYTE
b1
b2
b3
b4
b5
b6
b7
b8
• Integer Value
• Mapped Value
• Constant
• Index
• Discrete
• Discrete Output
Sometimes it is necessary to hold groups of discrete variables as values for storing and
communication purposes. When it is necessary to perform an operation on these values, they
should be transferred to a column of single bits (having a name for each bit). At the end of the
operation, the result is returned to the value variable form.
The Packed column of the following multi-column table includes 100 packed groups of bits
(16 bits in each packed group are represented as a value).
Ind --- Packed --- --- --- --- ---
0
1
.
.
99
39
The single-column table of discrete data type, named Unpacked Bits (below), includes 16
specific names for each one of the bits in the Packed value. In this example we will refer to the
bits as Bit15, Bit14, etc. In a real system, we will refer to the bits in meaningful names such as,
Status, Fail, Alarm, Contrl, etc. The order of the bits is from Bit15 to Bit0 to fit the MOVE
operator.
PACKED, I
b15 b8 b7 b0
HIGH BYTE LOW BYTE
Unpacked
bits
Bit15
:
: MOVH
:
:
Bit8
Bit7
:
: MOVE
:
:
Bit0
The following rungs perform a loop with index over all 100 values in the Packed column. All
values are moved, each at a time, into the Unpacked Bits table. The algorithm is performed on
the bits and the result is returned to the Packed table; the index is advanced to the next row.
The dashed rungs perform the algorithm on the unpacked bits. The algorithm does not include
an index since the same algorithm is applied on all groups.
Bit15 is the first bit of the high byte and Bit7 is the first bit of the low byte.
Temp is a temporary variable of Integer Value type.
40
I
(RST)
Temp
P_Loop (MOVE)
Packed,I
Bit15
(MOVH)
Temp
Bit7
(MOVE)
Packed,I
( )
( )
algorithm
rungs
( )
( )
Temp
(MOVH)
Bit15
Temp
(MOVE)
Bit7
Packed,I
(MOVE)
Temp
I
(CTU)
I P_Loop
< (JMP)
LstPac
I
=
LstPac
5) MOVE/MOVH between an integer variable and a bits column of a multi-column table
The operators that perform these operations are the following:
A BitCol,0
( MOVE ) ( MOVE )
BitCol,0 A
A BitCol,0
( MOVH ) ( MOVH )
BitCol,0 A
BitCol is the name of the bits column of a multi-column table. Note that in this case, the
number 0 is not an index, but the byte number (8 bits). BitCol,0 is the first byte, BitCol,1 is the
second byte, and so on.
The data types for these four cases are as specified above.
41
Arithmetical Calculations
C C C C
+A -A xA / A
B B B B
C=A+B C=A-B C=AxB C=A/B
Arithmetical calculations are always used in the rung as output operators. When the conditions
in the rung are fulfilled (the rung is true), the calculation is performed and its result is stored in
C (A and B are not affected).
The A and B “inputs” to the operator may be of the following data types:
• Integer Value
• Mapped Value
• Index
• Real Value
• Real Parameter
• Real Constant
• Integer Constant
The C output of the operator may be of the following data types:
• Integer Value
• Value Output
• Index
• Real Value
• Real Parameter
• Scaled AO
• PPH
In arithmetical calculations you can not, normally, mix real values and integer values.
However, to mix real values and integers, you can move the integers to temporary Real-type
variables and perform the operations you want.
When defining the control program, it must be taken into consideration that the arithmetical
calculations (in particular multiplication and division) use considerable scan time, and
therefore should be performed only when strictly necessary, and not with every scan.
The calculation is performed only when the rung is true. If the calculation is to be performed
only once, the positive differentiator must be inserted in front of the calculation symbol.
For example, the variable X must be divided once every second by the variable Y and the
result applied to an analog output (digital-to-analog conversion) connected to a meter that
indicates a value designated RATIO.
42
T1Sec RATIO
/X
Y
T1Sec T1Sec
/ ( DON )
T1Sec is true for the duration of one scan once every second. Therefore, the calculation is
performed every second.
In many cases, a sequence of arithmetical calculations are to be performed only under certain
conditions. In such cases, the JMP operator may be used to skip over this sequence when the
calculation is not required.
Boolean Algebraic Operations – AND, OR, XOR

C
O A C = A U B = A(OR)B = A+B
R B
A C
N A
D B C = A ! B = A(AND)B = A+B
X C
O A C = A ⊕ B = A(XOR)B = A+B
R B
The AND, OR, and XOR operators perform (when the rung is true) a (Boolean) logic bitwise
operation on two variables (designated A and B in the elements above), and the result is stored
in the variable designated C (A and B are not affected).
The A and B inputs to the operator may be of the following data types:
• Integer Value
• Mapped Value
• Index
The C output of the operator may be of the following data types:
• Integer Value
• Value Output
• Index
Calc
The CALC function enables you to write arithmetic expressions as you would on paper.
43
The system software will then calculate the expression according to common mathematical
rules, (for example: x+y*z is considered as x+(y*z)) and the result will be stored in the output
operator.
The inputs to the operator may be of the following data types:
• Integer Value
• Real Value
• Timers Hour
• Timers Minute
• Timers Second
• Real Parameter
• Mapped Value
• PPH
• PLC Value Input
• PLC Value Output
• PLC Real Input, PLC Real Output
• Real Constant
• Index
The output of the operator may be of the following data types:
• Integer Value
• Real Value
• Timers Hour
• Timers Minute
• Timers Second
• Real Parameter
• Mapped Value
• Value Output
• Scaled AO
• PPH
• PLC Value Output
• PLC Real Output
All the binary operators require two parameters of the same type, integer value or real value.
If one parameter is an integer value and the other is a real value, the integer will be cast to
real. The only exception to this rule, is the power (^) operation which always converts the
operands to real value data type.
A valid arithmetic expression may contain:
• The following operators:

44
+ (Plus), - (Minus), * (Multiply), / (Divide), ^ (Power),

% (Mod), & (And), | (Or), $ (XOR), Log, Log2, Log10,
ACos, ASin, ATan, Cos, Sin, Tan, Exp, Sqrt, Abs and Neg (negative).
Note that the operators are not case sensitive.
• Balanced parenthesis.
• The string ‘<??????>’ which represents an unknown symbol.
• “Blanks” (which are ignored during save).
Before using the CALC function for your computations, please notice the following
restrictions.
1. Do not use bit variables, neither in the expression nor in the result.
2. Do not use a real value operand in a logic operator, either as a symbol, or as a partial
expression result.
3. Enter only Radian values in the trigonometric functions.
4. Do not use the plus (+) symbol to label a positive number.
5. Use the Neg function to label a negative number. Do not use the minus (-) symbol for this
purpose.
6. Do not use variable names which are identical with the functions’ names (for example: Sin
and Cos), since they will be considered as functions.
7. Do not include operator characters into the symbols names (for example: ‘n1+n2’ or
‘n3/’), since the characters will be considered as operators.
8. The user is responsible for the function’s parameters legality. No warning will appear if a
function receives a parameter with an illegal value. Examples of illegal values include:
Log(0), Log2(0), Log10(0), Sqrt(y) where y is a negative number, ASin(x) where x<=1
and x>= -1, ACos(x) where x<=1 and x>= -1, Tan(p/2+n*p) where n is an integer.
9. Each arithmetic expression may include up to 26 functions and 26 different variables.
10. The system software does not check the overflow during computation. The overflow is
checked while placing the expression result into the result symbol.
The ladder controlled ClcStt value is included in the Reserved Values table (System Tables).
When an overflow occurs, ClcStt is set to ‘1’ and it is the user responsibility to reset it.
The following example illustrates the data types selection significance.
Let x1=1, x2=2 and y1=2 where x1, x2 are of integer value data type and y1 is real
value.
45
The two rungs below provide different results for the same expression, due to the
different selected data types.
1.
Result
(CALC)
Edit Calculation
x1+x1/x2
The above expression is calculated as follows: first x1 is divided by x2 (integer

division) and the result is 0. Then 0 is added to x1 (integer addition), so the final
result is 1.
2.
Result
(CALC)
Edit Calculation
x1+x1/y1
The above expression is calculated as follows: first x1 is divided by y1 (real division),

so the result is 0.5. Then 0.5 is added to x1 (real data type addition again), and the
final result is 1.5 if the “Result” variable data type is real value and 1 if the “Result”
variable data type is integer. In this case, the ClcStt value becomes ‘1’.
Jump To Subprocess, Return

——(JSP) ——(RET)
As mentioned earlier, it is very convenient to divide the control program into processes
according to different subjects. Each process should handle one table or a few tables. One way
(see also Run Process) to activate a process is to call it as a “subroutine” by using the JSP
output element, as follows:
<Process Name>
( JSP )
When all conditions of the rung ending with the JSP operator, are fulfilled, the system “jumps”
to perform the process, specified above the JSP operator, as a subprocess. It is also possible to
call another subprocess from that subprocess (subprocess nesting).
The performance of the subprocess stops when one of the following occurs:
1. The last rung has been performed.
46
2. A true rung that ends with the RET operator is encountered.
When the program returns to the original process (from which the subprocess has been called),
it continues by performing the rung following the rung with the JSP operator.
For example, refer to the following table that consists of n+1 rows (n+1 devices) and
eight values (columns) for each device (A to H).
Ind A B C D E F G H
0
1
.
.
n
There is a process, named FindH, that computes H as function of A to F and I (the

row index):
H,I = H(I) = f(A,B,C,D,E,F,I). The process includes the necessary rungs to compute H
for a specific row i.e., the index I is set and then the subprocess is called to compute
H. Note that the “calling” process defines the row while the “called” subprocess
performs the computation as a separate algorithm.
Suppose that the DEVICE variable indicates the row number and I is defined in the
Index table. The appropriate rungs for calling the FindH subprocess are:
I
(MOVE)
part of Main DEVICE
process or any
other process FindH
(JSP)
The FindH process:
( )
:
( )
E
< (RET)
D
:
:
last rung ( )
The FindH process returns to the Main process if the last rung is performed or the
algorithm has found that E < D.
47
It is not necessary to use the RET operator in the last rung of a subprocess. Use this operator
in a specific rung (not the last one) when you condition the return to the calling process.
When JSP and RET are used in a rung as output operators, it is not possible to add other
output operators than to that rung.
Send
——(SEND)
The SEND operator enables you to send a free-format message to the ports defined as User
Ports (controlled by the Ladder Diagram). The User Ports may be used to connect a computer,
printer, or any other device that requires serial communication.
For a detailed description of this operator, see User Defined Local Ports.
Logical Shift to Left/Right

——(LSL) ——(LSR)
LSL: When the rung is true, a logical shift is performed on the variable (A), specified above
the operator, n times (1 to 15) to the left. ‘0’ are inserted to the shifted least significant bits.
• Integer Value
• Value Output
For example, if LSL is executed with n=4 on A=01011000 10101101, the result will be:
A=10001010 11010000.
a15 a0
A
( LSL )
n
LSR: Same as LSL, with the shift to the right.
a15 a0
A
( LSR )
n
48
Arithmetical Shift to Left/Right

——(ASL) ——(ASR)
ASL/ASR: Arithmetical shift to the left/right of the integer variable A, n times (1 to 15). In the
arithmetical shift the sign bit (bit 15) of the value does not change when the shift occurs.
• Integer Value
• Value Output
ASL: Shift to the left.
a15 a0
" 0
A
( ASL )
n
ASR: Shift to the right.
a15 a0
"
A
( ASR )
n
For example, if ASR is executed with n=2 on A=01110101 10111001, the result will be
A=00011101 01101110.
Note that using ASL is multiplying by 2n and using ASR is dividing by 2n. It is more efficient
(less time consumption) to use the ASL or ASR operators to multiply/divide by 2, 4, 8, etc.
Rotate to Left/Right
——(ROL) ——(ROR)
ROL: When the rung is true, the bits of the A integer are shifted n times to the left. For every
shift the bit in a15 is inserted in a0. Note that the rotated bits are “wrapped around” (in
comparison to the shift operators).
• Integer Value
• Value Output
49
a15 a0
A
( ROL )
n
ROR: The opposite of ROL (rotate right).
a15 a0
A
( ROR )
n
Call
——(CALL)
The CALL function allows “calling” various functions that receive and return variables
through the various tables in the system tables.
When the CALL operator is selected, a choice list of all available functions is displayed. You
should select the required function by using the arrow keys and pressing [Enter].
The following table lists the diverse functions:
GetChr, GetDgt These functions are used to read characters or digits from the
User Port. For further information refer to User Defined Local
Ports.
Ready This function controls the Data Terminal Ready (DTR) and
switches it from ‘off” to ‘automatic’. If the input buffers are
clear, the Data Terminal Ready will be ‘on’, otherwise it will be
‘off’.
NotRdy This function switches the Data Terminal Ready (DTR) from
‘automatic’ to ‘off’.
SndFrm, AnsFrm, Refer to User Defined MDLC Communication
RcvFrm, TxFrm
SndSeq, GetSeq Refer to User Defined MDLC Communication

TxEvnt, Burst, Refer to User Defined MDLC Communication
Tevent, Tburst
Fetch, Store Refer to Advanced Features in the Application Programmer

manual, Accessing Database Variables via Coordinates.
50
GtEvnt, StEvnt, Refer to Advanced Features in the Application Programmer:

StTmr, Time Event Driven Software
TxIntr, RxIntr, Refer to Advanced Features in the Application Programmer:
UpIntr, DvIntr, INTRAC Protocols
TxWdth, RxWdth
Sync (MOSCAD ≥ This function allows for sites synchronization using the ladder-
V 3.70, MOSCAD- diagram language. The synchronizing site time may be received
L ≥ V 1.00) from the Time&Date or from the GPS connected to the
synchronizing site’s Port 2.
This function has two parameters: the function name itself
“Sync”, and the Site ID, defined in the Site table (System
Tables).
Following are two examples illustrating a full system synchronization, and the
synchronization of all the units with Radio1 connected to one port (link
ID=RADIO1), as illustrated in the site table below:
1. Full system synchronization:
Sync
( CALL )
AllSYS
2. Synchronization of all units with Radio1 connected to one link ID.
51
Sync
( CALL )
Rad1
Run Process
——(RUNP)
The RTU is based on a multi-tasking operating system. From all tasks that support the system,
five tasks may be used by the user processes written in ladder diagram language. These five
tasks run under five different priorities, as follows (high priority is the highest priority and
TskPrD - the lowest one):
• High priority task (main process)

• TskPrA (task priority A)
• TskPrB (task priority B)
• TskPrC (task priority C)
• TskPrD (task priority D)
One of many advantages of dividing the user application into processes is the capability to run
them under different priority tasks. The MAIN process is automatically run by the system
under the High priority task.
It is possible, but not always efficient, to call all the processes by the JSP operator as
subroutines of the MAIN process. Since all processes have the same priority, the Scan Time
will be very long (all processes have to be executed).
Usually, some of the processes are executed more often than others. Therefore, if some of the
processes will run under lower task priority, the MAIN process and the processes connected to
it by the JSP operator will run at a faster speed.
In a multi-tasking system the MAIN process may perform a few cycles while another process
that runs under a lower priority task performs only one cycle.
CYCLE 1 CYCLE 2 CYCLE 3 CYCLE 4

RUNNING
HIGH PRIORITY TASK
RUNNING
TskPrA
SUSPENDED
To run a process under a specific task, you should use the RUNP operator in the following
manner:
52
<Process Name>
( RUNP )
TskPr(x)
When the rung is true, the process appearing above the operator, is run under the task specified
below the operator. Before running the process, you should ensure that this task is not busy.
For this purpose, the system provides four task priority flags in the Reserved Flags table (one
of the System tables), named TskPrA, TskPrB, TskPrC, and TskPrD.
When a task is busy, its corresponding flag is ‘1’. Therefore, one of the conditions of the rung
that includes the RUNP operator is that the relevant task flag is ‘0’.
It is very important not to run a task continuously because it will be impossible to run tasks
that have lower priority, including the system tasks. Thus, you should condition the RUNP
operator on a timer that will define the cycle time.
The following rungs run a process called EXEC under TskPrA. The conditions are that the
task is not busy (TskPrA=0) and the DOF Timer has completed its delay.
TskPrA CYCLE TEMP

/ / ( )
TEMP EXEC
( RUNP )
TskPrA
TEMP CYCLE
( DOF )
1 scan
"1
"
RUNP
0
task is running
TskPrA
timer delay
CYCLE
DELAY
OFF
If the timer delay is too short, then TskPrA will run continuously and lower priority tasks will
not be handled.
53
Conversion of Variable Notation

——(BCD) ——(BIN)
Sometimes it is necessary to convert variables appearing in memory from one notation to

another.
The BCD operator refers to the value of the variable below the operator as a number in binary
format and converts it to a number in BCD format. The converted number is assigned to the
variable above the operator.
The BIN operator refers to the value of the variable below the operator as a number in BCD
format and converts it to a number in binary format. The new number is assigned to the
variable above the operator.
The input to be converted may be of the following data types:
• Integer Value
• Value Input
• Index
• Mapped Value
The converted value may be of the following data types:
• Integer Value
• Value Output
Copy Columns
C Dest
P Src
Y Count
The CPY operator allows you to copy columns of any data type to any other data type. The
number of bytes to be copied is specified by the Count variable.
The Dest variable may be any variable of a single-column table or any column of a multiple-
column table. This variable may be of any data type, except index.
The Src variable may be any variable of a single-column table or any column of a multiple-
column table. This variable may be of any data type.
The Count variable, that specifies the number of bytes to be copied, may be any variable of a
single-column table or a specific variable of a multiple-column table. This variable may be of
the following data types:
• Integer Value
• Index
54
1. Copying a floating-point column to the TxBuf column in order to transmit it to

another RTU. For explanation of how to use the TxBuf, refer to User Defined MDLC
Communication.
C Tx_Buf,0
P Presur
Y Length
If Presur has x rows, then Length=4⋅x (since a floating-point variable is four-bytes

long).
2. Copying 16 bytes for a vector of values, named V, to a 128-bit vector, named B.
Length
( MOVE )
#16
C B,0
P V,0
Y Length
#16 is a constant defined in a Constants table. Its value is 16 (16 bytes*8=128 bits).
During the copy operation, the MOSCAD RTU checks that the number of bytes to be copied is
not greater than the size of the Dest column. If the number of bytes is greater than the size of
the Dest column, the copy operation is not performed and an appropriate message is sent to the
Error Logger.
User Call Function (UCL)

U C-func
C P1
L P2
The UCL operator together with the ‘C’ Toolkit allows you to program the application using
‘C’ blocks. Refer to the ‘C’ Toolkit manual.
For more information about this option, please contact the Motorola System Support Center.
Ladder Diagram Reference

Following is a quick reference of all elements, input and output, used in the Ladder Diagram
Language.
55
Input Elements
—| |— Normally Open (N.O.) Contact
—| / |— Normally Closed (N.C.) Contact
—| = |— Comparator Equal to
—| < |— Comparator Less than
—| ≠ |— Comparator Not Equal to
—| > |— Comparator Greater than
—| ↑ |— Positive Differentiator (up − rising edge)
—| ↓ |— Negative Differentiator (down − falling edge)
Output Elements
—( ) Relay On Contact
—( / ) Relay Off Contact
—( L ) Relay Latch
—( U ) Relay Unlatch
—(DON) On Delay Timer
—(DOF) Off Delay Timer
—(TRT) Retentive Timer
—(CTU) Count Up Counter
—(CTD) Count Down Counter
—(RST) Reset
—(BCD) Convert to BCD Format
—(BIN) Convert to Binary Format
—(JMP) Jump
—(JSP) Jump to Subprocess

—(RET) Return from SubProcess
—(RUNP) Run Process
—(MOVE) Move Value or Low Byte
—(MOVH) Move High Byte
—( + ) Arithmetical Calculation + (plus)
56
—( - ) Arithmetical Calculation - (minus)

—( X ) Arithmetical Calculation x (multiply)
—(DIV) Arithmetical Calculation / (divide)
—(AND) Boolean Bitwise AND
—(OR) Boolean Bitwise OR
—(XOR) Boolean Bitwise XOR
—(LSR) Logical Shift to Right
—(LSR) Logical Shift to Left
—(ASR) Arithmetical Shift to Right
—(ASL) Arithmetical Shift to Left
—(ROR) Rotate to Left
—(ROL) Rotate to Right
—(CPY) Copy Memory Vectors
—(SEND) Send ((to RS232/RS485 User Port))
—(SCAN) Scan physical and mapped I/O
—(CALL) Call a function (GetChr, GetDgt, Ready, NotRdy, SndFrm, AnsFrm, RcvFrm,
TxFrm, SndSeq, GetSeq, TxEvnt, Burst, Fetch, Store, AGA3, AGA7V, AGA7M,
PID, GtEvnt, StEvnt, SetTmr,Time,TxIntr, RxIntr, UpIntr, DvIntr, TxWdth,
RxWdth,Sync)
—(UCL) User “C” Call Function
57
Before configuring your database, carefully read Database Concept, which provides the
necessary theoretical background, and Ladder Diagram Language, which describes in detail
all programming symbols.
Application Programmer may functionally serve either as a programmer, to configure a user

application (database and process) to be executed by the system software in the RTU(s), or as
an on-line monitor of the defined control program in the selected RTU. Application
programming involves the following:
• Defining the database

• Programming the process (building the rung sequences)
• Linking the external I/Os (between the RTUs and the external devices)
• Compiling the resulting program
• Downloading the program to the RTUs
The following chart illustrates the process.
OPEN FILE
DEFINE
DATABASE
DEFINE
PROCESS*
DEFINE I/O LINK
COMPILE FILE
YES
ERRORS
NO
DOWNLOAD MONITOR SAVE PROJECT PRINT PROJECT
*If needed
58
Application Programmer Window
To start the Application Programmer, double-click the Application Programmer icon in the
MOSCAD Programming ToolBox folder. The following is displayed. To begin working,
create a new workspace or open an existing one. Various toolbars and commands will become
available in different contexts. The basic toolbars are described below. For more on toolbars,
see the View Menu below. Certain keyboard shortcuts are also available as described below.
Standard Toolbar
The following is the list of the standard toolbar command icons.
Icon Corresponding menu command
File menu, New command
File menu, Open command
File menu, Save command
File menu, Save All command
View menu, Show/Hide Workspace Bar command
View menu, Show/Hide Output Bar command
Tools menu, Search command
59
Run-Time menu, Compile command
Run-Time menu, Download Application/Network command
Abort command
Undo command
Redo command
Help menu, About Application Programmer command
Workspace Bar
The Workspace Bar becomes available after you create a new project file or open an existing
one. The Workspace Bar includes three tabs. The Database tab lists the tables in the database.
The Process tab lists the processes which have been programmed for the application. The I/O
Link tab enables you to link variables in the user tables to actual I/Os in the RTU.
60
Output Bar
The Output Bar displays assorted information about the project, the download/upload process,
etc. The Output Bar appears at the bottom of the Application Programmer screen by default,
but can be closed by clicking on the ‘x’ in the upper left-hand corner. To redisplay, check
Output Bar on the View menu.
Project Info Tab

Once a project is opened, the Project Info Tab lists the application (project) name and version,
the project directory, and the name of the configuration file once it has been imported into the
project.
Download Tab
This tab is used to display information about the download of the application to the RTU. For
more information, see the Download Application/Network command below. (Run-Time menu)
Upload Tab
This tab is used to display information about the upload of the application to the RTU. For
more information, see the Upload and Uncompress command below. (File menu)
Compile Information Tab
This tab is used to display information about the compilation of the application. For more
information, see the Compiler command below. (File menu)
Show I/O Info Tab
This tab displays the configuration of the I/Os in the unit by Rack and Module. See I/O Link.
Analyze Info Tab
This tab displays the results of the analysis of a copy/move operation of an element (database
table, process or rung) into the project. See Copying Elements.
Search Tab
This tab displays the results of a search for a variable in the project. See Search command.
Variable Tab
This tab displays name and values of the TmMost and TmLeas variables, the time parameters
from the PRMEVENT table. These represent the date and time when an event occurred and
can be viewed during monitoring. For more information, see the Event Driven Software
section of the Advanced Features section of this manual.
Monitor Tab
This tab displays the results of the process monitoring, communications with the unit and
information received. See Monitor Mode below.
61
SiteID Bar
The SiteID Bar is used to specify the RTU to which the application will be downloaded. If the
desired RTU is not the local one, click on Remote and specify the Site ID and Link ID of the
Remote RTU. See Download Application/Network.
File Menu
You can perform basic operations on the file and workspace using the commands listed in the
File menu. Some commands have keyboard shortcuts which appear in parentheses.
New
The New command (Ctrl+N) opens a dialog box where you specify the name and path of the
new application. ToolBox defaults to the user sub-directory of the ToolBox (tbox952)
directory.
You can create a new project or workspace in the default directory \tbox952\user, or select
another directory. You can also create a new file.
Dialog box parameters

Project Name
Enter the name of the project to be created. If the Create new workspace radio button is
62
selected, the new project will be created in a new workspace. If you want the new project
added to the current workspace, click on Add to current workspace.
Location
ToolBox defaults to the \tbox952\user sub-directory. If you want to create a new application
under \user, just add the application name to the end of the displayed string. For example, if
the application name is Pumps, make sure the string reads: \tbox952\user\pumps. Then click
the OK button.
Application Programmer automatically opens a new sub-directory for each application. In the
above example a sub-directory named Pumps is created under \tbox952\user. The application
files are automatically named after the sub-directory (e.g. pumps.prg, pumps.wrk).
If you don’t want to use \tbox952\user, type a drive and directory, and click OK. For example,
to create an application named Pumps, in drive C, type c:\pumps and click OK.
If you want to store applications in a “root” directory of your own, first create the root. For
example, to create an application named Pumps in a directory named MyApps, in drive C,
create MyApps then type: c:\myapps\pumps in this box, and click OK.
To browse for a different folder, click on the button to the right of the Location field and select
the desired folder.
Open
The Open command (Ctrl+O) opens an existing application or associated file. The command
displays the following dialog box:
The default directory is the current directory. The default file type is .prw. If the desired
application, workspace or file is listed, double-click it. Otherwise, type the path and
63
application name in Selected Path, and click Open.
If you open an application developed under an earlier version of ToolBox, the dialog below
prompts you to decide whether or not to upgrade to the current version or handle the
application in its current version. To upgrade the application, click Yes button. To preserve
the older version, click No. For more on upgrading, see the Upgrade command.

Use the parameters in the order specified below.
Look in
If the currently displayed directory is not the correct one, open the Look in list and locate the
directory. To access sub-directories, double-click parent directories.
Files of Type
This box shows the type (extension) of the files currently displayed in the File Name list. The
file types available in the drop-down list include: workspace (.prw), project (.prp), application
(.prg), .C, .H and link files.
File Name
Type the name of the desired file. Application Programmer automatically adds the extension.
Alternatively, locate the file name in the file list, and double-click the name.
Open Workspace
The Open Workspace command opens an existing workspace. The command displays a dialog
box as in the Open command.
Save Workspace
The Save Workspace command saves changes to the project settings in the current workspace.
Save Workspace As
The Save Workspace As command copies the current workspace by saving it under a new
name. The command displays the Save As dialog box to specify the new workspace name.
Close Workspace
The Close Workspace command closes the current workspace without exiting Application
Programmer. If you made changes to the workspace since the last save, ToolBox will prompt
you to save before closing the application.
64
Save
The Save command (Ctrl+S) saves the current application (tables, rungs, I/O, configuration)
without closing Application Programmer.
When the application is saved, a central file is automatically created which can be downloaded
into the control central computer. See the Create Central File section later in this chapter.
Modified elements will be marked with an asterisk in the workspace treeview until the
application is saved.
Save Active Project As

The Save Project As command enables you to create a copy of the current application by
saving it under another name. This command opens a dialog box shown below, which allows
you to specify the location and project name. Click OK to create the new application. As in
Save, ToolBox allows you to upgrade the application and creates the central file automatically.
Save All
The Save All command saves all changes made in the application all prg in workspace +
workspace.
Delete Project
The Delete Project command deletes the project and workspace of the application. All
application files, any other files which exist in the directory, and the directory itself are all
deleted.
After you select the Delete command, you will be prompted for confirmation. Click Yes to
delete and No to cancel the delete.
65
Print
The Print command prints the contents of the project (database and rungs) to your standard
system printer.
Create Central File

This function creates a file that carries the project name with the .out extension, to be loaded
into the control center computer. This enables the database of an RTU or a group of RTUs to
be automatically built in the control center.
Recent Workspaces
The Recent Workspaces command enables the user to easily access the five most recently used
workspaces.
Recent Files
The Recent Files command enables the user to easily access the five most recently used text
files.
Edit Menu
The Edit menu contain all the editing commands performed in the Application Programmer
tool. Certain commands are only available when a text-based file is opened (e.g. .doc, .c, .h
file). Some commands have keyboard shortcuts which appear in parentheses.
Undo
The Undo command (Ctrl+Z) undoes the last edit operation.
Redo
The Redo command (Ctrl+Y) redoes the last edit operation.
Rung Editor
Rung editor commands. (Available during rung editing only.) Most of the rung editor
commands are also available from the right-click context menus on rung elements. For more
on editing rungs, see the Editing a Rung section below.
Cut Element/s
The Cut Element command (Ctrl+X) cuts the selected element(s) from the rung.
Copy Element/s
The Copy Element command (Ctrl+C) copies the selected element(s) from the rung.
Paste Element/s
The Paste Element command (Ctrl+V) pastes the cut/copied element(s) in the rung.
66
Select All
The Select All command (Ctrl+A) selects all the elements in the rung.
Clear All
The Clear All command clears all the elements in the rung.
Delete Selection
The Delete Selection (D, Ctrl+Delete) deletes all selected elements in the rung.
Set Main Rung

The Set Main Rung sets the selected element to be the main element in the rung.
Normalize
The Normalize command (F9) automatically rearranges the elements in the rung in a neater
layout, according to formats (sizes, fonts, colors) defined in the Options command in the Tools
menu.
OR Comment Elements
The OR Comment Elements command opens and closes a branch around a set of elements.
Add Input
The Add Input command (A) adds an input element to the rung. If the rung contains an
existing input element, the new input will be added after the focused input element (framed
with a dotted rectangle). This command is one of several one-shot editing commands available
in the Rung Editor. For more information, see Complex Editing Commands below. For more
on focused elements, see The Focus below.
Insert Input
The Insert Input (I) command adds an input element to the rung. If the rung contains an
existing input element, the new input will be added before the focused input element. This
command is one of several one-shot editing commands available in the Rung Editor. For more
information, see Complex Editing Commands below. For more on focused elements, see The
Focus below.
Add Output
The Add Output command (O,T) adds an output element to the rung. If the rung contains an
input element, the new input will be added after the focused input element. This command is
one of several one-shot editing commands available in the Rung Editor. For more information,
see Complex Editing Commands below.
Open Branch
The Open Branch command (B,P) opens an “OR” branch from an input element. The branch
will be displayed (in blue by default) and must be closed later with a “Close Branch” line (in
red by default). This command is one of several one-shot editing commands available in the
Rung Editor. For more information, see Complex Editing Commands below.
67
Close Branch
The Close Branch command (C,L) closes an “OR” branch from an input element. The branch
line will be displayed in red by default. Note that you must select the Close Branch command
when the input element to which the branch will connect is focused. This command is one of
several one-shot editing commands available in the Rung Editor. For more information, see
Complex Editing Commands below.
Out Branch+Input
The Out Branch+Input (U) creates a new branch which will include at least one input element
and after than a new output element. The branch will be added to the focused element. The
branch line will be displayed in magenta by default. Note that the Close Branch command
cannot be used on this branch. Instead use the Add Output command to end the branch. For
more information, see Creating a Branch below. This command is one of several one-shot
editing commands available in the Rung Editor. For more information, see Complex Editing
Commands below.
Out Branch+Output
The Out Branch+Output command (S) creates a new branch consisting of an output element.
The branch will be added to the focused element. The branch line will be displayed in magenta
by default. For more information, see Creating a Branch below. This command is one of
several one-shot editing commands available in the Rung Editor. For more information, see
Complex Editing Commands below.
Rung Monitor
Rung monitor commands. (Available during run-time rung monitoring only.) The rung
monitor commands are also available on the Monitor Rung toolbar and in the right-click
context menus of a rung.
Unqualify Refresh
The Unqualify Refresh command samples/monitors the current elements regardless of the
qualifier conditions set by Set Qual. In the case of an indexed element, the indexed value is
sampled only if it matches the equal (=) qualifier set by Set Qual (for example, D,9 is sampled
only when I=9). If the RTU is not executing the current rung, a message appears where you
can hit ESC to exit.
Qualify Refresh
The Qualify Refresh command samples/monitors the current element upon any operation when
all the qualifier conditions (set by Set Qual) are met.
For example, after setting the following qualifiers: I=9, J=3, K<5, the indexed element will be
sampled when all qualifiers conditions are fulfilled. In the rung, only D,I will be displayed
since J and K are not specified.
The values are sampled immediately after the rung has been executed. If the rung includes the
JMP, JSP, or RET operators, the values are sampled before executing the rung.
Abort
The Abort command aborts the rung monitor operation. If no operation has been started, the
68
Abort command/icon will be dimmed.
Refresh Rate
The Refresh Rate command is used to define the intervals (in seconds) at which the continuous
refresh from the RTU of the currently displayed rung will be performed. The Refresh Rate
command opens the Set Refresh Rate dialog. Enter the time (in seconds) between the current
scan and the next one, and click OK.
Set Qualifier
The Set Qualifier command sets qualifiers to monitor the database elements based on certain
conditions. In the case of an indexed element (V,I for example) used by the rung, the variable
is sampled when the equal (=) operation occurs.
Toggle Name/Value
The Toggle Name/Value command toggles between database symbol names and actual
values/variable names during run-time rung monitoring.
Table Editor
Table Editor commands. (Available during table editing only.) Most of these commands are
available in the context menu which appears when you right-click inside an open table. The
commands on the right-click menu of table cells are also available in the Operation bar.
Append Line
The Append Line command adds one row to the end of the table. If the table is an empty
single-column table, the following columns appear:
Column Description
Index The new row is automatically numbered; the number appears

in the Index column and cannot be modified manually. You
can, however, change the sequence by inserting a line with
the Insert Line button.
Name This is where you type the name of the variable. Click the cell
and type a name up to 256 characters long, whose first six
characters are unique.
Value If necessary, type the initial value of the variable.
Insert Line
The Insert Line command is the same as Append Line, but the line is inserted between existing
rows. Click in the row above which you want to add a new line, and click Insert Line.
ToolBox renumbers the lines.
Delete Line
The Delete Line command deletes a line. Click in the line you want to delete, then click Delete
Line. Note: ToolBox does not allow you to delete a line used in the process program or in a
mapped column (such as in a rung).
69
Append Column
The Append Column command enables you to add a new column to a multiple-column table.
The Append Column command opens the Append Column dialog box where you define the
new column. The new column is added to the right of the existing columns. The following
figure illustrates the Append Column dialog box which is identical to the Insert Column
dialog, except for the box title.

Column Name
For a new column, type the name of the column. The first six characters of the column name
must be unique.
For a duplicated column, type the name of the existing column. A duplicated column is one
that already exists in another table and that you want to display in the current table for
reference.
Column Type
For a new column, open the drop-down list and select a data type.
Since a duplicated column already exists elsewhere, and has a data type, this parameter is not
active for a duplicated column.
Duplicate Column
Click this option if Column Name contains the name of an existing column that you want to
duplicate in the current table.
The last index of a duplicated column should be equal or less than the last index of the original
column. For example, assume that a value data type defined as V1 in a multiple-column type
that has 10 rows (0-9). When you duplicate, the last index should be less or equal to 9.
Otherwise the compiler will report an error.
After clicking OK, the dialog box closes and a new column appears in the table. The location
of the new column depends on the operation:
• Append adds the column to the right of the last column.

• Insert adds the column to the left of the selected column.
Note that duplicate columns cannot be modified.
70
Insert Column
The Insert Column command enables you to add a new column to a multiple-column table.
The Insert Column command opens the Insert Column dialog box where you define the new
column. The new column is added to the left of the current columns. (Before selecting this
command, click in a cell in the table.) The Insert Column dialog box is identical to the
Append Column dialog, except for the box title.
Delete Column
The Delete Column command deletes an existing column from a multiple-column table. Click
in a cell of the column to be deleted, then click Delete Column.
Note that ToolBox does not allow you to delete a column used in the process program or in a
mapped column.
Table Description
The Table Description allows you to enter detailed notes about the table. See ToolBox Editor
below.
Table Monitor
Table Monitor commands. (Available during table editing only.) Most of these commands are
available in the Monitor Database toolbar.
Refresh Once
The Refresh Once command retrieves the values of the currently displayed table from the RTU
one time only.
Refresh Continuously
The Refresh Continuously command retrieves the values of the currently displayed table from
the RTU. The rate of the refresh (in seconds) is defined using the Refresh Rate command.
Update
The Update command updates the RTU with the last changes to the database. See also Update
Every Change.
Abort
The Abort command aborts the monitor operation. If no operation has been started, the Abort
icon will be dimmed.
Refresh Rate
The Refresh Rate command defines the intervals (in seconds) at which the continuous refresh
from the RTU of the currently displayed table will be performed. The Refresh Rate command
opens the Set Refresh Rate dialog. Enter the time (in seconds) between the current scan and
the next one, and click OK.
Update Every Change

The Update Every Change command determines whether or not each change to the currently
displayed table will be sent immediately to the RTU. If this command is checked, each change
71
is immediately sent to the RTU and you do not have to use the Update RTU command.
Change Format
The Change Format command allows you to display a table column in a format different from
the default format of the corresponding data type (except for float). The following is
displayed:
In the Display Format dialog box, open the drop-down list to see the options, and select one.
The default corresponds to the normal format of the data type in question.
Scan Off
The Scan Off command applies to I/O columns only. Select this command to instruct the
application not to update the inputs from the external environment and not to send outputs to
it. I/O columns appear in red. The icon changes to Scan On which you can use to cancel the
Scan Off status.
Scan On
The Scan On command applies to I/O columns only and cancels the Scan Off status. Select
this command to instruct the application to update the inputs from the external environment
and to send outputs to it.
IO Link
I/O Link commands. (Available during I/O Link only.) The I/O Link commands are also
available in the Operation bar and in the right-click context menu in the I/O link work window.
IO Connect Items
The IO Connect Items command enables you to quickly connect large numbers of variables to
physical modules. For more information on I/O Links, see the I/O Link section below.
Cut
The Cut command cuts the selected text from the file being edited. (Available during text file
editing only.)
Copy
The Copy command copies the selected text from the file being edited. (Available during text
file editing only.)
72
Paste
The Paste command pastes the cut/copied text to the file being edited. (Available during text
file editing only.)
Select All
The Select All command selects all the text in the file being edited. (Available during text file
editing only.)
Delete
The Delete command deletes the selected text from the file being edited. (Available during text
file editing only.)
View Menu
You can show or hide the various toolbars using the commands listed in the View menu.
Toolbar command icons become enabled in the appropriate contexts. Place the mouse over an
icon to see the command name in a tool tip window and the command function in the Status
bar at the bottom of the screen. Some commands have keyboard shortcuts which appear in
parentheses.
Standard
The Standard Toolbar contains the basic command icons. See Standard Toolbar above.
Status Bar
The Status Bar at the bottom of the window displays the command function of an icon when
the mouse is placed over the icon in a toolbar. See Standard Toolbar above.
Operation Bar
The Operation Bar contains command icons used in editing database tables and process rungs
and in connecting I/O items.
Workspace Tool Bar

The Workspace Tool Bar contains command icons used in adding and monitoring database
tables and process rungs and in editing the table and rung names.
73
Workspace Bar
The Workspace Bar (Alt+0), which appears by default on the left side of the screen, displays
the Database, Process and I/O Link tabs. See Workspace Bar above.
Output Bar
The Output Bar (Alt+2) displays assorted information about the project, the download/upload
process, etc. See Output Bar above.
Site ID Bar
The Site ID Bar enables the user to specify the Site ID and Link ID with which to
communicate. See SiteID Bar above.
ToolBox
The ToolBox Bar contains the input and output control icons used in building rungs.
Database Tree
The Database Tree command (Ctrl+Shift+D) displays the Database tab in the workspace.
Process Tree
The Process Tree command (Ctrl+Shift+P, Ctrl+Shift+R) displays the Process tab in the
workspace.
I/O Link Tree

The I/O Link Tree command (Ctrl+Shift+I) displays the I/O Link tab in the workspace.
Monitor Database Tool Bar

The Monitor Database Tool Bar contains the command icons for monitoring a database table.
Monitor Rung Tool Bar

The Monitor Rung Tool Bar contains the basic command icons for monitoring a process rung.
Project Menu
You can perform basic project operations using the commands listed in the Project menu.
Some commands have keyboard shortcuts which appear in parentheses.
74
Set Active Project

The Set Active Project command sets the selected project to be the active project in the
workspace. All commands and operations are performed on the active project.
Settings
The Settings command (Alt+F7) enables you to adjust the settings for the project.
The Project Settings screen includes four tabs:

General Information Tab
This tab displays the project information, i.e. the application (project) name, the project
directory, and the name of the configuration file once it has been imported into the project.
Compiler Tab
This tab enables you to determine the settings for the compiling the application. See
Compiler.
DownLoad Tab
This tab enables you to determine the settings for the application download. See Download
Application/Network.
Project Description Tab
This tab enables you to enter a free text description of the project.
Insert Project into Workspace

This command opens a dialog from which you can choose a file of type .prp or .prg from
75
another project. Double-click on the file name or single-click and then click Open to insert the
project into the workspace.
Delete Project
The Delete Project command deletes the current project from the workspace. All application
files, any other files which exist in the directory, and the directory itself are all preserved.
After you select the Delete command, the following dialog box prompts you for confirmation.
Click Yes to delete and No to cancel the delete.
Import Site Configuration

The Import Site Configuration command allows you to load the RTU’s site configuration file.
You’ll need the site configuration parameters when linking the application to the RTU I/O
modules, as defined in the site configuration file.
The procedure whereby you load the RTU’s site configuration changes, as explained below:
First import operation: A dialog box opens where you select the configuration file. After
selecting the file, it is copied to the application directory.
Subsequent import operation (the application version notwithstanding): If you select a site
configuration file whose name is identical to one of the existing configurations, a dialog box is
displayed (shown below), where you are requested to decide whether or not to overwrite the
existing configuration file.
Subsequent import operation (application version is 5.00 or later): If you select a

configuration file the name of which is different from those that exist, the following dialog box
76
is displayed:
Use the Replace command to overwrite the existing configuration file. Use the Add command
to add the imported configuration file to the project.
Subsequent import operation (application version is older than 5.00): The following dialog
box is displayed:
The Replace command deletes the configuration file from the application directory and copies
the imported file to that directory. This operation also changes the I/O L4 file name.
See also Select Site Configuration File below.
Version 5.00 (or later) of ToolBox enables you to link one application to more than one site
configuration so that the same application can be used for RTUs that have been configured
differently (different port and I/O definitions). To support this feature, all output
(configuration) file names, including the I/O file (L4) are derived from the configuration file
name and not from the application name (which was the case in older versions).
In any case, only one configuration is active at any given time. The active configuration
appears at the bottom of the Application Programmer window.
Select Site Configuration File

Version 5.00 (or later) of ToolBox enables you to link one application to more than one site
configuration so that the same application can be used for RTUs that have been configured
differently (different port and I/O definitions). The select Site Configuration command
displays the following dialog box and enables you to select a configuration file.
77
If the selected site configuration differs from the current file, the dialog below appears.
Import I/O Link File

The Import I/O Link File command opens the standard Open dialog box which defaults to files
with a .l4 extension. Select the I/O link definitions files that required for your application.
This option enables you to “import” an L4 file which is fully or partially compatible with the
selected configuration. When you access I/O links, the non-compatible I/O links are
automatically deleted and ToolBox requires you to redefine only the deleted ones.
Tools Menu
The Tools menu enables the user to perform certain functions such as upgrading and searching
an application, and changing the format of elements and workspace. Some commands have
keyboard shortcuts which appear in parentheses.
Upgrade
The Upgrade command becomes active after loading an application that has been developed
for earlier versions. During current work with such an application, you can use this command
to upgrade the application to the new version.
After selecting the command the following dialog box opens:
78
Open the drop-down list and select the version to which you want to upgrade. Once the
application has been upgraded, it cannot be downgraded back to its original version.
Search
The Search command (Ctrl+F) enables the user to search for a symbol in the project. When
the command is selected, the Search dialog box appears, as shown below.
First enter the name of the item you are looking for. Next, select the project which you would
like to search. Specify the kind of name to search for, i.e. table symbol, rung symbol, or rung
name. Finally click on Search.
Dialog box parameters and functions

Find Name
The variable, column name, column entry, table symbol, COS name, last index name or rung
name to search for. Type in the name or use the Browse button to search the entire project. If
the Whole Word Only field is not selected, part of a string can be searched for in a rung.
Project List
The project which is to be searched. Use the pull-down menu to select one of projects in the
workspace.
Search
Click on the Search button to start the search process. The results will appear in the Output
bar at the bottom of the screen.
Browse
To select an item name from among all the symbols in the project, click on the Browse button.
The following screen will appear. Select the type of symbol (e.g. Int) or All (to search all
symbols) and locate the desired name in the Data base names column. Click on the desired
79
name and click OK. The name will appear in the Find Name field. See Browse Function.
Search Symbol in Table

Click on this option to search for the symbol among the database tables.
In the Find Name field, enter the name of the symbol as it appears in the database. Select the
Search Symbol in Table option. Click OK, and the ToolBox will display the path to the desired
symbol in the Search tab of the Output bar. To view or edit the table, click on the path name
in the Search tab and the table will be opened.
Or click on the Browse button. Select the symbol type (e.g. Int) or All from the Groups list on
the left side of the Browse screen. Locate the desired symbol name in the list of names on the
right side of the Browse screen and double-click on the name.
Search Symbol in Rung
Click on this option to search for a symbol among the process rungs.
In the Find Name field, enter the name of the symbol as it appears in the rung. Select the
Search Symbol in Rung option. Click OK, and the ToolBox will display the path to the desired
symbol in the Search tab of the Output bar. To view or edit the rung, click on the path name in
the Search tab and the rung will be opened.
Or click on the Browse button. Select the symbol type (e.g. Int) or All from the Groups list on
the left side of the Browse screen. Locate the desired symbol name in the list of names on the
right side of the Browse screen and double-click on the name.
Search Rung
Click on this option to search for a rung name among the list of process rung names.
In the Find Name field, enter the name of the rung as it appears in the Name column of the
Rungs List. Select the Search Rung option. Click OK, and the ToolBox will display the path
to the desired rung in the Search tab of the Output bar. To view or edit the rung, click on the
80
path name in the Search tab and the rung will be opened.
Or click on the Browse button. Select RungNames from the Groups list on the left side of the
Browse screen. Locate the desired rung name in the list of names on the right side of the
Browse screen and double-click on the name.
Search Duplicated
Click on this option to search for the symbol among the duplicated column names.
Search Input
Click on the option to search only the input elements of a rung. This option is only enabled
with the Search Symbol in Rung option.
Search Output
Click on the option to search only the outputs elements of a rung. This option is only enabled
with the Search Symbol in Rung option.
Case Sensitive
Click on this option for a case-sensitive search of the symbol name.
Whole Word Only
Click on this option to search only for a whole word in the rung symbol names. Otherwise
search for parts of strings. (Rung search only.)
Options
The Options command enables the user to change the defaults of formatting for elements of
the Application Programmer utility and the workspace. For each category, the items or
attributes to be reformatted vary.
Format tab
Category
The list of categories from which the user selects to reformat. The list includes Workspace
81
Bar, Output Bar, Spreadsheet View, Table Editor, Table Monitor, Rung Editor, Rung Monitor,
Element and Normalize.
Reset All
Resets all formatting to the default settings.
Font
Selects the desired font style for the category.
Size
Selects the desired font size for the category.
Items
Within the selected category, selects the item or attribute to be reformatted. For each category,
the list of items or attributes to be reformatted varies.
Foreground
Selects the foreground color for the item to be reformatted.
Background
Selects the background color for the item to be reformatted.
Control
When the category is Element, selects the control type for the element to be reformatted. Can
be one of 3D Look or Flat.
Font Type
When the category is Element, selects the font type for the element to be reformatted. Can be
one of Normal or Bold.
Size
When the category is Normalize, selects the vertical and horizontal gap between rung elements
in the Normalize feature. Range: 5-80. Default: 30.
When the category is Element, selects the rectangular size of the element (e.g. 64 x 38).
82
In the Workspace tab, pick a category to format. Select the font size and
foreground/background colors as applicable.
Save options
Save while compile
Saves the changes to the workspace when compiling.
Save supplemental rung
Saves sections or elements of a rung which are not attached to the main rung and therefore not
saved in the .prg file. For more on main rungs (identified with a red bullet), see Set Main
Rung below.
When this option is set to off the user will not see the rest of the rung (not main rung) during
open/save operations.
Recent file list contains:
Determines how many file names will appear in the File Menu Recent Files list.
Recent workspace list contains:
Determines how many workspaces names will appear in the File Menu Recent Workspaces
list.
Run-Time Menu
The Run-Time menu enables the user to compile, compress/uncompress and download/upload
the application. Some commands have keyboard shortcuts which appear in parentheses.
Compile
The Compile command (F7) compiles the application so that it can be downloaded to the RTU.
For more information, see Compiler below.
83
Download Application/Network
Downloads an application/network file to the RTU. For more information, see Download
Application/Network below.
Compress/Download
Compresses and downloads an application to the RTU. For more information, see
Compress/Download below.
Upload + Uncompress
Uploads and uncompresses an application from the RTU which has previously been
compressed and downloaded. For more information, see Upload and Uncompress below.
Abort
Aborts the current run-time operation.
Search Menu
The Search menu becomes available when a text-based file is opened (e.g. .doc, .c, .h file).
Some commands have keyboard shortcuts which appear in parentheses.
Find
Opens a standard Windows Find dialog box. Enter the string to be searched for.
Replace
Opens a standard Windows Find/Replace dialog box. Enter the string to be searched for and
the replacement string.
Next
Finds the next instance of the last Find string.
Option Menu
The Option menu becomes available when a text-based file is opened (e.g. .doc, .c, .h file).
Configure
File Editor also provides a Configure option, which enables the user to customize the Options
menu by adding commands. The menu item name is specified along with associated command
(executable) and any desired options. Menu items can also be changed or removed using the
Configure command, as shown below.
84
Window Menu
The commands in the Window menu are designed to handle the display of the windows and
the style of these windows.
Close
This command closes the current active window. If you have made changes in the currently
active window and have not yet saved the workspace, Application Programmer asks if you
want to save the changes. To save the changes, click on Yes. To close the window without
applying the changes, click on No.
Close All
This command closes all the open windows. If you have made changes in any active windows
and have not yet saved the workspace, Application Programmer asks for each window if you
want to save the changes. To save the changes, click on Yes. To close the window without
applying the changes, click on No.
Cascade
This command arranges the various screens in cascade style.
Tile Vertically
This command arranges the various screens in vertically tiled style.
Tile Horizontally
This command arranges the various screens in horizontally tiled style.
85
Help Menu
The Help menu enables the user to view the version information and help files which relate to
the Application Programmer tool. Some commands have keyboard shortcuts which appear in
parentheses.
Contents
This command opens the help files which describe the Application Programmer tool and other
MOSCAD Programmer ToolBox utilities.
How to Use Help

The How to Use Help explains to the user how the MOSCAD Programmer ToolBox help is
used.
Keyboard Shortcuts
This command displays the list of keyboard shortcuts which can be used in the Application
Programmer tool. See Keyboard Shortcuts in Application Programmer below.
About
This command displays the version information for the Application Programmer tool.
Keyboard Shortcuts in Application Programmer

Several keyboard shortcuts are available in the Application Programmer tool (≥ V9.52 SP2).
These are useful when the mouse attached to the ToolBox PC is not working properly.
Key Action
Rung Editor
Arrows (Left, Right, Up, Down) Move between elements; both selection and focus are moved. The
window is auto scrolled if necessary.
Alt-Arrows Move between lines. Alt-Down Arrow opens the list of database
names to select a rung element parameter.
Ctrl+Arrows Move focus between elements. Selection is left intact.
Ctrl+Space Toggle selection of the focused element.
Shift-Arrows Move and select the elements (“extend selection”).
PgUp, PgDn Scroll the window up and down.
Alt-PgUp, Alt-PgDn Scroll the window left and right.
Complex Editing Commands
A Add an Input element after the current element.
I Insert an Input element before the current element.
O or T Add an Output element after the current element.
B or P Open an “OR” branch before the current element and add an
Input element to it.
C or L Close a Branch after the current element.
U Open a branch with an “Output” line and add an Input element.
86
Key Action
S Open a branch with an “Output” line and add an Output element.
Other Keys
Esc Cancel mouse actions before finishing. Cancel dragging. Cancel
element parameter editing in rung.
F9 Normalize the rung.
F7 Compile the rung.
Del, Ctrl+C, Ctrl+X, Ctrl+V, Standard edit operations (Delete, Cut, Copy, Paste, Undo, Select
Ctrl+Z, Ctrl+A All) on elements, lines or characters in edit strings.
Menu key The Menu key (near the right Ctrl) invokes context menus.
Ctrl+PgUp, Ctrl+PgDn Go to the previous/next rung.
Ctrl+Plus, Ctrl+Minus/Ctrl+* Zoom In/Zoom Out/Zoom Normal.
Enter, Space, E Edit the first parameter of the element.
Parameter Editing in Element
Alt-Down Open the Lookup dialog.
Tab, Shift-Tab Move between parameters.
Esc Cancel parameter editing without saving.
Enter Save and finish parameter editing.
Rung Monitor Actions
F2 Toggle Name/Value
F4 Set Qualifier Table
F5 Unqualify Refresh
F6 Qualify Refresh
File Operations
Ctrl+N New File
Ctrl+O Open File
Ctrl+S Save File
Application Programmer Navigation
Alt-0 Toggle Workspace bar.
Alt-2 Toggle Output bar.
Ctrl+F Find
F3 Find Next
Ctrl+Shift-D Go to Database tab in the workspace bar.
Ctrl+Shift-R Go to Process (Rung) tab in the workspace bar.
Ctrl+Shift-I Go to I/O Link tab in the workspace bar.
Esc Return to the editor window.
Enter (on a tree control) Open the corresponding item in the editor.
Miscellaneous Keys
F1 Help
Alt-F7 Project Settings
Ctrl+Q Abort Download
For more on using the keyboard during rung editing, see Using the Keyboard in the Rung
Editor below.
87
Database Builder
The Database Builder is used to build the application’s data tables. These tables are the basis
for process programming, I/O link definition, automatic central database definition, real-time
monitoring of the RTU operation, etc.
When a project is opened, three types of tables appear in the workspace. Right-click on a table
type (e.g. User Tables) or a table name (e.g. PID Table) and a menu of commands will appear,
enabling various operations to be performed. These menu items are also available in the
Workspace Tool Bar.
User Tables
User tables contain the user-defined data (variables). One table has been defined for you, the
Qualifiers table. This table may be edited in a similar way to other user tables.
The Qualifiers table should be used to set special qualifiers (fields and/or subgroups of
variables) that affect the process in another site, in RTU-to-RTU communication, or to set
qualifiers that will identify and respond to a broadcast sent by the central (refer to User
Defined MDLC Communication).
Note: When third party protocols are used for communication, the Qualifiers table may be
deleted and recreated as a regular user table.
System Tables
The system tables include reserved variables that may be used as symbolic names during
process programming. Note that it is not possible to add tables to the system tables list.
88
Constant Tables
The constants tables include reserved constants that may be used as symbolic names during
process programming. Some constants tables have been defined for you. You can add your
own tables.
After you go to the Constant Tables in the Database tab, the following list is displayed:
Appending a Table
To create a new table and append it to the list of tables, right-click on a table type or table
name and click on Append Table. If the Workspace Tool bar is shown, you can also click on
the Append Table icon. The following is displayed:
Note: No tables can be appended to System Tables.
89

Table Name
Enter a table name of up to 256 characters, the first 20 characters of which must be unique.
Note that in applications created under old versions of ToolBox, the length of table names is
limited to six characters. If the application is upgraded to version 9.5x or greater, names can
be up to 20 characters.
Table Symbol
Enter the table symbol to be used in the programming process. Symbol names can include
spaces and special characters, except for a comma. Table symbol names can be up to 256
characters, the first six characters of which must be unique.
Table Type
Select the appropriate type - single-column or multiple-column (for constant tables, this field is
disabled.)
Data Type
For a single-column table, open the drop-down list and select the appropriate data type. For a
multiple-column table, set the data type of each column separately, as described Editing a
Multiple-Column Table.
After clicking OK, the table appears. Create new rows and columns as described in Editing a
Table and the table values.
Editing a Table
Adding values to a newly appended table or modifying the values in an existing table is done
in the table form itself. Open a new table using the Append Table or Insert Table command.
Open an existing table by clicking on the table name in the workspace.
The commands for editing tables are available in the right-click menus in the table headings in
the table form, in the Edit Menu under Table Editor or as icons in the Operation bar.
Editing a Single-Column Table

A single-column table includes one data type (for example, parameters). In each row you can
define the symbol name (PAR1, for example) as it will be referred to during the process. The
90
value column is used either to define a preset value and/or to display the value during on-line
monitoring. A single-column table may include up to 250 rows.
The following figure illustrates the table form box for a newly appended single-column table.
To create new entries in a single-column table, click on Append Line or Insert Line in the
Operation bar or select the Append Line or Insert Line commands in the right-click menus in
the table headings, or under Table Editor in the Edit Menu. See Table Contents Commands
below.
To modify entries in a single-column table, click in a cell in the table that appears at the top
of the form, and overwrite with a new value. The figure above illustrates a single-column table
that contains several lines. To change a name, for example, click an entry in the Name column,
and type the new entry.

Table Name
This is the name you recorded for the table in the Append Table dialog box. You can modify
the name (click the text box and edit). All tables in the database must have unique names.
Table Symbol
This is the symbol you recorded for the table in the Append Table dialog box. You can modify
the symbol (click the text box and edit). All tables in the database must have unique symbols.
COS Name
Specify the COS (Change of State) flag name of the table. COS name may contain all special
characters except comma. Refer to User Defined MDLC Communication.
91
Last Index, Last Index Name

Last Index indicates the last indexed row of the table, up to 250 (0-249) rows.
The Last Index Name which enables you to define the last index by a specific name (Last
Index Name) to be used in the rungs, is not relevant for single column tables.
Table Type
This is the data type you recorded for the table in the Append Table dialog box. You can
change the data type (open the drop-down list and select).
Changing the data type of an I/O column automatically cancels the corresponding I/O link
definitions. Changing the data type of a column that has related data (like timers, parameters)
cancels their preset values.
Editing a Multiple-Column Table

Multiple-column tables may include up to eight columns for several types of data (for
example, discrete input, discrete output, etc.) having common characteristics. The symbol
name of the column is indexed (according to the row number in the column). A multiple-
column may include up to 250 rows.
In a single-column table, the data type is defined in the Append Table dialog box; in a
multiple-column table it is defined through the Append Column dialog box.
Every column in a multiple-column table should be edited separately. Every column may
include a different data type.
The following figure illustrates the table form a newly appended multiple-column table.
To create new entries in a multiple-column table, click on Append Line/Column or Insert
92
Line/Column in the Operation bar or select the Append Line/Column or Insert Line/Column
commands in the right-click menus in the table headings, or under Table Editor in the Edit
Menu. See Table Contents Commands below.

Table Name
This is the name you recorded for the table in the Append Table dialog box. You can modify
the name (click the text box and edit). All tables in the database must have unique names.
Table Symbol
This is the symbol you recorded for the table in the Append Table dialog box. You can modify
the symbol (click the text box and edit). All tables in the database must have unique symbols.
COS Name
Specify the COS (Change of State) flag name of the table. Refer to User Defined MDLC
Communication.
Last Index, Last Index Name
Last Index specifies the last indexed row, as required, up to 250 (0-249) rows. If you change
the last index to 4, for example, four new entries in the table will be created. You must then
define names for each new row in the table. The Last Index can only be changed once
columns have been defined.
You can also define the last index by a specific name (Last Index Name) to be used in the
rungs. For example, if the last index row is 4, and the last index name is END, (END actually
= 4), the value of END changes as the last index changes.
To modify column names in a multiple-column table, use the Column Name field in the
Column tab in the Table & Column Properties section of the form, shown below.
To modify column types in a multiple-column table, use the Column Type field in the
Column tab in the Table & Column Properties section of the form.
Note: Changing the data type of an I/O column automatically cancels the corresponding I/O
link definitions. Changing the data type of a column that has related data (like timers,
parameters) cancels their preset values.
93

Column Name
Displays the current name of the column. If you want to change it, click the box and type a
different column name.
Column Type
Displays the current data type of the column. If you want to change it, open the drop-down list
and select another type.
Search for a Variable or Duplicated Column

ToolBox features a search mechanism that allows you to quickly find variables (column name
or entry in a single-column table), duplicated columns, table symbols, COS names or last index
names. For more, see the Search command in the Tools menu.
Project Commands
The following commands are available in the context menu which appears when you right-
click on a project name in the workspace tree. Some of the items on the project right-click
menu are also available in the Workspace Tool Bar.
The project appears in the treeview of all three tabs of the workspace, but not all commands
will appear in all tabs.
94
Set Active Project

See the Set Active Project command in the Project Menu.
Delete Project
See the Delete Project command in the Project Menu.
Append Process
See the Append Process command in the list of Process Commands. This command appears
in the right-click menu in the Process tab only.
Paste Process
See the Paste command in the list of Process Commands. This command appears in the right-
click menu in the Process tab only.
Search Name
Allows you to find the name of a symbol, rung symbol or rung name. See Search for a
Variable or Duplicated Column this chapter and the Search command in the Tools menu. This
command appears in the right-click menu in the Database and Process tabs only.
Print
The Print command prints the elements of the current tab of the selected project to your
standard system printer. See also Print in the File Menu.
Help
Opens the Application Programmer help file to the relevant page.
95
Table Type Commands

When a project is opened, three types of tables appear in the workspace. Right-click on a table
type (e.g. User Tables) and a menu will appear as shown below. These menu items are also
available in the Workspace Tool Bar.
click on a table type (i.e. User Tables, System Tables, or Constant Tables) in the workspace
tree.
Append Table
Opens the Append Table dialog box where you can define a new single-or multiple-column
table, or a PID table. The new table is added to the end of the list and can be edited. See
Appending a Table earlier in this chapter.
Copy Tables
Copies the tables to be pasted, usually into another project/workspace. See Copying Elements
below.
Paste Tables
Pastes the copied tables, usually into another project/workspace. See Copying Elements
below.
Help
Table Name Commands

Open a table type and a list of table names will appear. The following commands are available
in the context menu which appears when you right-click on a table name (e.g. PID Table) in
the workspace tree. Most of these menu items are also available in the Workspace Tool Bar.
96
Monitor
Enables the user to monitor the database table. See Table Monitoring below.
Append Table
table, or a PID table. The new table is added to the end of the list and can be edited. See
Appending a Table earlier in this chapter.
Edit Table
Opens the Edit Table dialog box where you can add new lines to the table, or modify existing
table entries. See Editing a Table earlier in this chapter.
Insert Table
table, or a PID table. The new table is inserted above the selected row in the list and can be
edited. See Editing a Table earlier in this chapter.
97
Delete Table
Deletes the selected table. After selecting a table name and clicking this button, ToolBox asks
you to confirm that you want to delete the table. If you click Yes, the table, including all its
lines and columns will be deleted.
If a column in the table is a duplicate column in another table, then the table cannot be deleted.
And if any of the table’s columns or rows has been mapped, this table cannot be deleted. In
theConstant Tables, you can only delete those table which you have added.
Rename
Right click on the process item you want to rename, then select rename command from the
context menu, this will invoked the rename dialog displayed as following
Table Description
Allows you to enter detailed notes about the table. See ToolBox Editor below.
Copy
Copies a table or table set to paste it elsewhere. Tables can also be dragged and dropped
directly in the workspace. See Copying Elements below.
Paste
Pastes a table or table set which has previously been copied or cut. See Copying Elements
below. Tables can also be dragged and dropped directly in the workspace.
Cut
Cuts a table or table set to paste it elsewhere. See Copying Elements below. Tables can also
be dragged and dropped directly in the workspace.
Print
The Print command prints the contents of the selected table to your standard system printer.
See also Print in the File Menu.
98
Help
Table Contents Commands

click inside an open table. The commands on the right-click menu of table cells are also
available in the Operation bar. Most are also available in the Edit Menu under Table Editor.
Append Line
Adds one row to the end of the table. The following columns appear:
Column Description
Index The new row is automatically numbered; the number appears

in the Index column and cannot be modified manually. You
can, however, change the sequence by inserting a line with
the Insert Line button.
Name This is where you type the name of the variable. Click the cell
and type a name up to 256 characters long, whose first six
characters are unique.
Value If necessary, type the initial value of the variable.
Insert Line
Same as Append Line, but the line is inserted between existing rows. Click the row above
which you want to add a new line, and click Insert Line. ToolBox renumbers the lines.
Delete Line
Deletes a line. Click the line you want to delete, then click Delete Line. However, ToolBox
does not allow you to delete a line used in the process program or in a mapped column (such
as in a rung).
Append Column
Enables you to add a new column to a multiple-column table. The Append Column command
opens the Append Column dialog box where you define the new column. The new column is
added to the right of the existing columns. The following figure illustrates the Append
Column dialog box which is identical to the Insert Column dialog, except for the box title.
99

Column Name
For a new column, type the name of the column. The first six characters of the column name
must be unique.
For a duplicated column, type the name of the existing column. A duplicated column is one
that already exists in another table and that you want to display in the current table for
reference.
Column Type
For a new column, open the drop-down list and select a data type.
Since a duplicated column already exists elsewhere, and has a data type, this parameter is not
active for a duplicated column.
Duplicate Column
Click this option if Column Name contains the name of an existing column that you want to
duplicate in the current table.
The last index of a duplicated column should be equal or less than the last index of the original
column. For example, assume that a value data type defined as V1 in a multiple-column type
that has 10 rows (0-9). When you duplicate, the last index should be less or equal to 9.
Otherwise the compiler will report an error.
After clicking OK, the dialog box closes and a new column appears in the table. The location
of the new column depends on the operation:
• Append adds the column to the right of the last column.

• Insert adds the column to the left of the selected column.
Note that duplicate columns cannot be modified.
Insert Column
Enables you to add a new column to a multiple-column table. The Insert Column command
opens the Insert Column dialog box where you define the new column. The new column is
added to the left of the current columns. (Before selecting this command, click a cell in the
table.) The Insert Column dialog box is identical to the Append Column dialog, except for the
box title.
100
Delete Column
Deletes an existing column from a multiple-column table. Click in a cell of the column to be
deleted, then click Delete.
Note that ToolBox does not allow you to delete a column used in the process program or in a
mapped column.
Attribute Page
Displays the table and column properties of the table. The Attribute Page command is a toggle
which is either checked (when attributes are displayed) or unchecked (when attributes are
hidden).
101
Database Building Examples

The following examples are used later on to build the sample process.
1. Single-column Table
A pump (PUMP1) should be actuated under the following conditions:
− 10 seconds after valve VLV1 or VLV2 is on.

− The emergency switch (EMRG) is off.
− Water temperature is below 80 degrees.
After selecting the appropriate data types, edit each table as follows, using the Append Table
on single-column tables:
− Discrete Inputs: VLV1, VLV2, EMRG.

− Value Input: AN1 (analog reading).
− Timers Seconds: T1 (value: 10:00 sec.).
− Discrete Output: PUMP1.
− Parameter: TEMP (value: 3,200).
A temperature parameter of 80°C should be entered as 3,200, since the range of reading of the
analog-to-digital converter is -4,000 to +4,000. Assuming a full analog scale of 100°C (100%),
this parameter value should be 3,200.
Step-by-step procedure for defining a single-column table:

Click the Append Table button and define: table name (Discrete Inputs), table symbol (DisIn),
table type (single-column), and data type (discrete input).
Access the Discrete Inputs table by clicking the Edit Table button, and edit it as shown below.
Enter, as described above, the remaining data elements (and values when required) in separate
tables per each data type: AN1, T1 (10:00), PUMP1, TEMP (3,200).
102
2. Multiple-Column Table
A series of 10 inputs (the first of which is IN) can execute a series of 10 outputs. The loop is
executed 10 times in the course of one scan.
Step-by-step procedure for defining a multiple-column table:

Click on Append Table in the Workspace Tool Bar or in one of the Table right-click menus.
Define a table named LOOP, with Table Symbol Loop, and Table Type Multiple-Column.
Click on Append Column in the Operation Bar or in right-click menu in upper area of the table
form. Define a column IN of data type Discrete Input. Click on OK.
Add another column named OUT of data type Discrete Output.
Click the Last Index box and type 9. In the Last Index Name box, enter LstInd. The table
should look as displayed below.
103
When a series is involved, the series elements can be used as rung symbols during process
programming either directly (i.e., IN,5), or as an indexed series (IN,I). The index name (I) is
defined through the System’s Index table.
You can assign meaningful names to variables in the database, such as KeyInp, TxCntr,
RxVal, etc., with capital letters. The system is not case-sensitive, therefore when writing
rungs, you do not have to type in the variable names with capital letters. The system will
automatically adjust your entries as defined in Database Builder.
104
Process Programming
Once all variables participating in the control program have been defined via the Database
Builder, you can proceed to programming the process.
Each process is built by programming a sequence of rungs in the Motorola Advanced Ladder
Diagram Language. Each rung defines the behavior of one or several outputs as a function of
both the states of their inputs and the time.
To start process programming, select the Process tab. The following is displayed:
The Process tab window initially contains one process in the tree view. As you add rungs or
process, the tree view will be filled. When you expand a process item in the tree view, the
corresponding Rungs list will be displayed as the child item of the process. From the tree, you
enter names and descriptions of processes and rungs in the same way that you edit a table in
the Database tab window.
To program the process, create new rungs and edit them, as described in Adding a Rung and
Editing a Rung below.
Adding a Rung
To create a new rung and append it to the list of rungs for the process, right-click on a process
name or rung name and click on Append Rung. If the Workspace Tool bar is shown, you can
also click on the Append Rung icon. The command opens the Append Rung dialog, shown
below. A new tree item will appear in the process tree. The new rung will appear below the
current rung.
105

Name
Enter the name of the rung (up to 256 characters, the first six of which must be unique).
Description
Enter a short description of the rung (up to 20 characters). See ToolBox Editor below. The
short description will appear next to the rung name in the workspace.
Editing a Rung
The Rung Editor window is opened when you select a rung in the Process tree list in the
Workspace bar, and double-click the rung item. If the rung has elements then elements will be
shown in the rung editor. If there are no elements in the rung, (e.g. newly created rung) a
blank window will be shown.
Note: The current version of the Application Programmer supports older versions of the
ToolBox and permits you to open applications developed under older versions. However, the
rung layout in this version, which includes the unattached rung (where the rung appears in the
same window with the main rung, but is not saved in the .prg file) cannot be viewed properly
in older versions of the ToolBox.
Basically, there are two types of rung elements:
• Elements that define inputs

• Elements that define outputs
The rung may be perceived as an array of contacts (representing the states of the relevant
inputs), through which “current” must “flow” towards the elements which represent the
operation to be performed on the output. When such a flow path exists, the rung is “true”, and
the appropriate operation is performed by the output.
For a full description of the input/output operators, see the Ladder Diagram Language section.
Adding Elements to the Rung

Before you edit a rung, the rung must be open. You can add as many elements to the open
rung as necessary. Basically there are two types of rung elements: Elements that define inputs
and elements that define outputs. By default when you open a rung editor window, a toolbox
will appear on the right of the main window. The window has two tabs pages, one of input
elements and the other of output elements.
106
The icons in the top row of both the input and output tabs are used to draw the lines
(connectors) between the rung elements. See Creating Lines below.
To add an element to the rung using the mouse, click on an element icon in the toolbox, either
in the Input or Output tab. Click in the rung editor window to create an instance of the selected
element, of default size. To change the default size of a created element, use the Options
command in Tools menu. To resize an element, select the element and drag the nodes to the
desired dimensions.
To add an element to the rung using the keyboard or Edit Menu, use the one-shot command
shortcuts (e.g. A, O) or commands (e.g. Add Input, Add Output). For more on the one-shot
commands, see Complex Editing Commands below. For more on the Edit Menu commands,
see Rung Editor above.
To create an element of a different size, left-click in the rung editor window, drag a rectangle
and then release the mouse. The element which will be created in the rung editor window, will
be the same size as the rectangle you dragged.
To create multiple instances of the same element, press the CTRL key when you select the
element icon. Then click or drag in the rung editor window as many times as you want the
107
element to appear. Or Copy and Paste the element using the command in the right-click menu.
Note this method can also be used to create lines as described below.
Once an element has been created, it can be moved around the window. Click on the element
to select it and drag it to the desired location. To move more than one element, use the CTRL
key when selecting, or drag with the mouse around the desired elements and move the group.
An element can be connected to other elements using lines and edited to add parameters. See
Creating Lines and Editing Elements below.
The first element to be created will have a small red handle, designating it as the starting
element of the rung. All other elements will have white handles.
Creating Lines
Lines are used to establish the relationship between elements. There are four types of lines in
the Rung Editor:
AND line , Open Branch line , Close Branch line and Multiple Output
line .
When you edit your rung using complex, one-shot commands, the lines are automatically
added to the elements. See Complex Editing Commands below.
When you edit your rung using the Input and Output Toolbox, add the lines using the mouse.
To create a line between two rung elements, click on the desired line icon in the toolbox. Drag
from the handle of the start element in the rung editor window to the end element you want to
connect to. The line should appear between the two elements. In a simple rung containing an
input element and an output element, connect the two elements using the AND line (appears in
black by default).
Because a line represents the relationship between elements, not all lines can be used to
connect all elements. For example, output elements can only accept an input and cannot
export any line from the right side; you cannot use a DIFFDN or DIFFUP element to create an
Open Branch Line. If you try to create a line, and the line cannot be created, review the logic
of your ladder in order to find the error.
When you put the mouse near a line, the cursor will change to a crosshair cursor. You can
select the line by left-clicking the mouse. If the line is selected, handles will appear to indicate
the nodes in the line. If you drag from the line node, the node will change to a new position.
Or you can drag from any point in the line, and a new node will be added to the line. If you
move the start node or the end node of a line to another element, this will change the
relationship between the elements.
Once a line or node has been added, it can be moved and deleted. When a line is selected,
right click to open a popup menu. You can delete the line from the menu. If the mouse is near
the node of the line, the right-click menu will also enable you to delete the node. The DELETE
key can also be used to delete a selected line.
108
Creating a Branch
A rung can include branches which add elements in parallel lines of inputs (“OR” function), or
for adding multiple outputs. The branches are attached to the main rung and are part of the
ladder logic. “OR” branches lines, created with the control, will appear as blue lines
and are closed with red “close branch lines”. Close branch lines, created with the
control, will appear as red lines. Multiple outputs, created with the control, will
appear as magenta lines. Multiple output branches can either be connected directly to an
additional output or to an input and then to the additional output. Be sure to close all
branches, either with an output element or by looping back, using the Close Branch control.
The “OR” icon on the Operation Bar (which also appears in the Output toolbox) can be
used to open and close a branch around a set of elements. To change the default colors of the
connector lines, use the Options command from the Tools menu/
Branches can be created using the Input/Output toolbox (with a mouse) by selecting elements
and lines and connecting them as desired in the work area. Branches can also be created using
the complex, one-shot commands from the rung element context menu, or the Rung Editor
commands in the Edit Menu. When the one-shot commands are used, the elements are
connected automatically by the tool.
! IMPORTANT
Up to 16 branches may be used in a single rung provided that each branch is looped
back to the level from which it was opened. In applications developed under older
versions of ToolBox, up to six branches may be used.
Editing Elements
To edit an element’s content using the mouse, double-click on the label (the area above or
below the element symbol). A browse dialog (see Browse Function) will appear to select the
parameter for the element (e.g. an input variable names defined in a database table.) You can
also point the cursor at the label area. The arrow cursor will turn into a finger pointing cursor.
Left-click the label; the cursor will turn into a cross hair. Type in the parameter name. If the
entered parameter is undefined, or invalid for the element, an error message will appear and
the system will set it to NULL.
When using the keyboard, use Enter/Space/E to go into editing mode on the first parameter of
the element. To move to the second parameter, if one exists, use the Tab key. Type in the
parameter name or use Alt-Down Arrow to open the Browse dialog and Tab/arrow keys to
select the desired parameter name.
Parameters can be cut, copied, pasted and deleted using the parameter right-click menu and
keyboard shortcuts like Ctrl+C, Ctrl+V. A parameter being editing changes color (usually
white). The font of the parameter (size, color, etc.) can modified using the Options command.
Note that when a parameter is being edited, certain commands will be disabled. Use the Esc
109
key to cancel parameter editing and the commands will be enabled.
The element can have one to three parameters, according to the type of the element., according
to the type of the element. Some elements have different type parameters, so the dialog listing
the parameters may vary, as shown in the examples below:
An Input element can have one or two elements (e.g. Input 1 and Input 2).
An Output can have up to three elements (e.g. Input 1, Input 2, and Output).
The CALL operator enables the user to select a ToolBox function from a
choice list, and to optionally pass a parameter to it. For details about the functions, see User
Defined Local Ports and User Defined MDLC Communication.
The UCL operator enables the user to select a user defined C function from
a choice list, and to optionally pass parameters to it. For details about the functions, see the ‘C’
Toolkit for MOSCAD Family RTUs manual.
The CALC operator enables the user to enter a formula that contains
operations and variables and to store the result. See Calc in the Ladder Diagram Language
section.
The SEND operator enables the user to record text combined with variables,
that can be sent through user ports. See User Defined Local Ports.
To delete an element using the mouse, select the Delete command from the right-click menu.,
To delete an element using the keyboard, select the element using the arrow keys and then
delete it using the Delete Selection command from the Edit Menu Rung Editor commands, a
keyboard shortcut or the Delete key. To delete all the elements in the rung, select Clear from
the right-click menu, Clear All from the Edit Menu Rung Editor commands, or select all the
elements using Select All and then Delete.
Set Main Rung

In a given window, we can create more than one rung. However, only one rung can be
compiled as part of the application. We must designate one rung (though it may include
branches and complex logic) to be the main rung to be saved in the .prg file. All others rungs
are called unattached rungs. If you have more than one rung in the window, click somewhere
on the rung to be the main rung, and then click on the Set Main Rung icon on the Operation
bar. Or select the Set Main Rung command from the Edit Menu Rung Editor commands or the
110
right-click context menu of the element. The leftmost handle of the first element of the rung
will change to red, as shown below. If there is only one rung in the window, the Set Main
Rung icon will be disabled.
Any rungs in the window which are not attached to the main rung will be saved with the
application and can be edited in the Toolbox, but will not undergo compilation and will not be
part of the application running in the RTU. Note: This option will not work with applications
developed under earlier versions of ToolBox that have not been upgraded.
Normalize
The Rung Editor allows you to draw elements and lines anywhere in the window. This may
lead to a rather messy layout. To automatically rearrange the rung elements in a neater layout,
click on Normalize icon on the Operation bar.
Using the Keyboard in the Rung Editor

The keyboard can be used to perform commands and navigate the window (≥ V9.52 SP2). For
a detailed list of all keyboard shortcuts, see the Keyboard Shortcuts section above.
The Focus
One element in the Rung Editor is always focused. The focused element is designated with a
dotted rectangle around it. The focused element is not necessarily selected. A selected item is
designated with a black frame around it. Focus is not the same as selection; several elements or
no elements may be selected at any time, but only one element is focused.
The focus generally moves with the selection. To move both the selection and the focus, click
on the desired element, or use the arrow keys. To select additional elements, press the Ctrl key
and click on the desired elements. To move only the focus, press Ctrl with the arrow keys. If
you switch out of a window, both the focus and selection are maintained.
Lines may be focused too; for lines, selection and focus are the same. Only one line can be
selected/focused at a time. A selected/focused line changes color.
Complex Editing Commands

Seven complex, “one-shot” rung editing commands (similar to those available in ToolBox
V8.50) are available. These commands can be accessed from an element’s context menu, the
Rung Editor commands in the Edit Menu and from the keyboard. Some commands are
disabled depending on the context. Note that the keyboard shortcuts are not case sensitive.
Key Menu Action

Command
A,a Add Input Adds an Input element after the current element.
111
Key Menu Action

Command
I,I Insert Input Inserts an Input element before the current element.
O,o (or T,t) Add Output Adds an Output element after the current element.
B,b (or P,p) Open Branch Opens an “OR” branch before the current element and adds an
Input element to it.
C,c (or L,l) Close Branch Closes a branch after the current element.
U,u Out Branch+ Opens a branch with an “Output” line and adds an Input element.
Input
S,s Out Branch+ Opens a branch with an “Output” line and adds an Output
Output element.
All “one-shot” commands, except Close Branch, perform five actions (where necessary):
• Clear space for the new element.
• Insert the new element logically into the rung,
• Insert the new element logically into an existing line.
• Connect the other side of the new element.
• Mark the new element as the Main if it was inserted before the Main element.
Note that Undo/Redo of a “one-shot” command will undo/redo all five of these actions at once.
Selecting New Elements

When a complex, one-shot command is used, a new element must be added to the rung. Based
on the command chosen, either the Input Elements to be Inserted or the Output Elements to be
Added dialog will be displayed. Click on the desired input element from the list or navigate
the list of elements using arrow keys or by typing the first letter of an element name. Finally,
click OK to select the new element.
Searching a Rung
The Search Rung button allows you to quickly locate a rung or a specific variable or symbol
throughout the rung sequences. You can type in the rung/symbol name or select it from a
browse menu. If the item is found, you can double-click on the search results to open the
relevant rung. For more information, see the Search Symbol in Rung and Search Rung options
in the Search command in the Tools Menu.
Process Commands
click on a process name (e.g. MAIN process) in the workspace tree. Some of the items on the
process right-click menu are also available in the Workspace Tool Bar.
112
Append Process
The Append Process command enables you to define a new process for the project. The
command opens the Append Process dialog, shown below.

Name
Enter the name of the process.
Note: The MAIN process is a system default. It cannot be changed.

Description
Enter a short description of the process. See ToolBox Editor below.
Delete Process
Click on the process item which you want to delete, select Delete Process command from the
menu. A dialog will popup to ask you to confirm the deletion of the process and its
corresponding rungs. You can also delete the selected process item by pressing the Delete key
directly.
Copy
To copy a process, click on the process item and select Copy from the right-click menu. See
Copying Elements below.
113
Paste
To paste a process, click on any process item on the tree view and select Paste from the right-
click menu. See Copying Elements below.
Cut
To cut a process, click on the process item and select Cut from the right-click menu. See
Copying Elements below.
Append Rung
The Append Rung command enables you to define a new rung for the process. See Append
Rung under Rung Commands.
Rename
The Rename command enables you to rename an existing process. The command opens the
Rename dialog, shown below.
To rename the rung, enter the new name and click OK.
Long Description
This command opens a ToolBox Editor dialog where you can document the process in detail.
If a very brief description is enough, use the Short Description command. See ToolBox Editor
below.
Short Description
This command opens a ToolBox Editor dialog where you can document the process in brief.
The short description is limited to 20 characters. If you need more than that, use the Long
Description command. See ToolBox Editor below.
Print
This command prints the current process to the designated printer.
Rung Commands
114
click on a rung name in the workspace tree. Some of the items on the rung right-click menu
are also available in the Workspace Tool Bar.
Monitor
The Monitor command enables the user to monitor the rung. See Process Monitoring below.
Append Rung
The Append Rung command enables you to define a new rung for the process after the
selected rung. See Adding a Rung above.
Insert Rung
The Insert Rung command enables you to insert a new rung for the process before the selected
rung. See Adding a Rung above.
Edit Rung
The Edit Rung command enables you to edit a new rung in the process. See Editing a Rung
above.
Delete Rung
The Delete Rung command enables you to delete the selected rung from the process.
Rename
The Rename command enables you to rename the selected rung.
115
Cut
The Cut command cuts the selected rung from the process. To cut a rung, click on the rung
name in the list and select Cut from the right-click menu. See Copying Elements below.
Rungs can also be dragged and dropped directly in the workspace.
Copy
The Copy command copies the selected rung from the process. To copy a rung, click on the
rung name in the list and select Copy from the right-click menu. See Copying Elements below.
Rungs can also be dragged and dropped directly in the workspace.
Paste
To paste a rung, click on any rung item on the tree view and select Paste from the right-click
menu. See Copying Elements below. Rungs can also be dragged and dropped directly in the
workspace.
Long Description
This command opens a ToolBox Editor dialog where you can document the rung in detail, as
shown below. If a very brief description is enough, use the Short Description command. See
ToolBox Editor below.
Short Description
This command opens a ToolBox Editor dialog where you can document the rung in brief, as
shown above. The short description is limited to 20 characters. If you need more than that, use
the Long Description command. See ToolBox Editor below.
Print
Prints the current rung to the designated printer.
Help
The Help command opens the Application Programmer help file to the relevant page.
The following additional commands are available in the context menu which appears when
you right-click in the rung edit window in the workspace tree. Some of the items are also
available in the Operation bar and in the Edit Menu under Rung Editor.
Select All
The Select All command selects all the elements in the rung.
Clear All
The Clear All command clears all the elements in the rung.
116
Normalize
The Normalize command automatically rearranges the elements in the rung in a neater layout.
Rung Element Commands

click on a rung element. If a rung element parameter is being edited, hit Esc, then right-click
on the rung element.
Cut
To cut a rung element, click anywhere in the element and select Cut from the right-click menu.
This command corresponds to the Cut Element/s command in the Edit Menu under Rung
Editor.
Copy
To copy a rung element, click anywhere in the element and select Copy from the right-click
menu. This command corresponds to the Copy Element/s command in the Edit Menu under
Rung Editor.
Paste
To paste a rung element, click anywhere in the element and select Paste from the right-click
menu. This command corresponds to the Paste Element/s command in the Edit Menu under
Rung Editor.
117
Clear
To clear all elements and lines in a rung, click anywhere in the rung edit window and select
Clear from the right-click menu. This command corresponds to the Clear All command in the
Edit Menu under Rung Editor.
Select All
To select all elements and lines in a rung, click anywhere in the rung edit window and select
Select All from the right-click menu.
Delete
To delete a rung element, click anywhere in the element and select Delete from the right-click
menu.
Cut Param
To cut a parameter from the rung element, click on the parameter name and select Cut Param
from the right-click menu.
Copy Param
To copy a parameter from the rung element, click on the parameter name and select Copy
Param from the right-click menu.
Paste Param
To paste a parameter into a rung element, click on the desired parameter area in the element
and select Paste Param from the right-click menu.
Delete Param
To delete a parameter, click on the parameter name and select Delete Param from the right-
click menu.
Add Input
To add an input to a rung, click either in an empty rung or on a rung element and select Add
Input from the right-click menu. The Input Elements to be Inserted dialog will be displayed.
Select the desired input element and click OK.
Insert Input
To insert an input before a rung element, click on the rung element and select Insert Input from
the right-click menu. The Input Elements to be Inserted dialog will be displayed. Select the
desired input element and click OK.
Add Output
To add an output to a rung, click either in an empty rung or on an input rung element and
118
select Add Output from the right-click menu. The Output Elements to be Added dialog will be
displayed. Select the desired output element and click OK.
Open Branch
To open an “OR” branch from a rung element, click on the input rung element and select Open
Branch from the right-click menu. The Open Branch to this Input Element dialog will be
displayed. Select the desired branch and click OK. The branch will be displayed (in blue by
default) and must be closed later with a “Close Branch” line (in red by default).
Close Branch
To close an “OR” branch to a rung element, click on the input rung element and select Close
Branch from the right-click menu. The line closing the branch will be displayed in the rung (in
red by default).
Out Branch+Input
To create a branch which will include at least one input element and after than a new output
element, click on the input rung element and select Out Branch+Input from the right-click
menu. The branch will be displayed in the rung (magenta line by default). The Close Branch
command cannot be used on this branch. Instead use the Add Output command to end the
branch.
Out Branch+Output
To create a new branch consisting of an output element, click on the rung element and select
Out Branch+Output from the right-click menu. The line branch will be displayed in the rung
(magenta line by default). The Close Branch command cannot be used on this branch. Instead
use the Add Output command to end the branch.
Examples of Building a Rung Sequence
The examples below use variables mentioned in Database Builder examples earlier in
this chapter.
Example 1
Pump (PUMP1) should be actuated under the following conditions:
− 10 seconds after valve VLV1 or VLV2 is on.

− The emergency switch (EMRG) is off.
− Water temperature is below 80 degrees.
First Rung:
119
Valves VLV1 (Open Branch Input) or VLV2 (Close Branch Input) as N.O. contact
inputs.
Output operator is DON (On Delay Timer), designated as T1.
Second Rung:
T1 is used as an N.O. input, EMRG as an N.C. contact input, and analog input AN1
depends on a comparator (if less than 3,200). The numeric value of the TEMP
parameter is 3,200. 3,200 is the value of a parameter data type, predefined in the
database.
The output operator will be Relay ON, designated as PUMP1.
Process 1:
VLV 1 T1
RUNG1 ( DON )
VLV 2
T1 EMRG AN1 PUMP1

RUNG2 / < ( )
TEMP
Example 2 – An Index Series
A series of 10 inputs (from IN,0 to IN,9) can execute a series of 10 outputs. The loop
is executed 10 times in the course of one scan.
Rung1: Reset index I.
Rung2: Index I counts up.
Rung3: If input IN,I is on, perform a Relay On operation on OUT,I.
Rung4: If I < 10 (the value of V10 in the database is 10), jump to rung2. i.e., the
process is repeated for IN,1 – OUT,1; IN,2 – OUT,2... up to IN,9 – OUT9.
I
RUNG1 ( RST )
I
RUNG2 ( CTU )
T1 OUT, I
RUNG3 ( )
I RUNG2
RUNG4 < ( JMP )
V10
120
I/O Link
After the program is completed, it should be linked to the outside world by creating the link
between the variables defined in the database and the physical I/Os of the appropriate RTU, as
configured via Site Configuration.
The I/O link portion of the application uses the RTU configuration details, which were defined
and downloaded through Site Configuration. For further details, refer to Site Configuration.
Any change in the RTU configuration affects the application. Therefore, if you change the
configuration, do not forget to update the I/O link definition. Before defining links, you
should load the site configuration file using the Import Site Configuration command (File
menu).
Note that changes in the database tables may create incompatibilities that affect the I/O links.
I/O Link Column Definition allows you to link the desired I/O variables by entering the data
described below.
a) The I/O location (Rack 0-15 for MOSCAD RTUs and Rack 0 for MOSCAD-L RTUs) for
the physical I/Os to/from the RTU (based on site configuration definition).
b) The I/O definitions already defined in Database Builder, according to the different data
types:
1) AN_IN_1 – AN_IN_8, AN_TEMP: Eight analog inputs to the RTU (previously

defined in Database Builder as value input data type, or scaled analog input data type).
2) IN_1 – IN_16: 16 discrete inputs to the RTU (previously defined in Database Builder
as discrete input data type).
3) FC_IN_ 1 – FC_ IN_2: The counters that count the number of pulses according to the
respective inputs (previously defined in Database Builder as value input data type).
4) OUT_1 – OUT_16: 16 control relay outputs of the RTU (previously defined in

Database Builder as discrete output data type).
5) AN_OUT_1 – AN_OUT_4 (CURRENT, VOLTAGE, or TEST): The analog outputs

of the RTU (previously defined in Database Builder as value output data type, or scaled
analog output data type).
6) BI_1 – BI_16: Discrete inputs which are back indication for discrete outputs (discrete
input variables linked to a physical discrete output).
7) MOD_FAIL: The module fail status (previously defined in Database Builder as

discrete input).
A data type may have several link options according to the I/O module defined in Site
Configuration. For example, when linking a Discrete Input variable to a Mixed I/O module
(including 8DI + 2AI + 4DO), the following options will appear in the I/O Link column:
IN_1–IN_8, BI_1–BI_4, and MOD_FAIL.
To start the I/O link process, select the I/O Link tab in the workspace and expand the I/O Link
121
tree, which is generated on the basis of the application database. Those database tables which
contain I/Os will be displayed, as shown below.
Right-click on the table name and select the Edit command. For a single-column table, you can
also double-click the table name to open I/O Link Column Definition table. For a multiple-
column table, you can double-click on the column name to open the I/O Link Table Definition
table and then proceed to the column definition. See I/O Link Column Definition below.
To view the types of I/O available in the RTU, click on the Show I/O Information tab in the
Output bar at the bottom of the screen. The defined I/O configuration, will be displayed, as
shown below.
I/O Link Column Definition

The I/O Link function enables you to link the physical I/Os to the definitions in the single- and
multiple-column tables.
If the database table was defined as a single-column table, the I/O link table includes the I/O
name (already defined in Database Builder; for example, IN1) and three more columns, as
shown below. The Rack and Module columns are for linking the database I/O with the
physical one (mapped according to the respective rack and module). The I/O link Column
Definition column is the I/O link programmer definitions. Open the drop-down list and select
an item.
122
If the database table was defined as a multiple-column table, the I/O link table for each column
includes the Rack, Module, and I/O link Column Definition columns.
123
IO Connect Items
The IO Connect Items command enables you to quickly connect large numbers of variables to
physical modules. The command becomes active after you define at least one row. What
happens after you press Connect Items, depends on the module type. The IO Connect Items
command is available in the Edit Menu under IO Link and the icon is available in the
Operation bar.
For all modules, except for single-cable modules, a list of items is displayed, as shown in
the following figure.
The lower half of the dialog lists the items that await connection. Select each item to be
connected, and click OK.
For a single-cable module, ToolBox leads the user to the Connect Items command, by
displaying “Use Connect Items” in the I/O Link Column Definition column, as illustrated
below:
124
Select the IO Connect Items command/icon and the IO Connect Item dialog box is displayed.
Because two levels of selections are required with a single-cable module, the dialog provides
two lists. In the Choose Item Group list (leftmost list) you select a group. For each group, a
different list of items is displayed (rightmost list). To select one or more item from the list,
125
click on the desired items(s) and then click OK to connect the items.
If the selected items overwrite existing definitions, the following message box appears where
you can confirm or cancel the operation.
Also, if you select more items than the number of rows in the database table, the following
message is displayed. If you confirm (Yes) the extra items are excluded from the operation.
126
Compiler
The Compile command (Run-Time menu) translates the application program into a suitable
form for downloading to the appropriate RTU (object file).
If errors are found during the compilation process, they are displayed, and the object file is not
created. The errors are stored in a log file with a .log extension in the application folder. If an
older file exists for the same configuration and application, it will be overwritten. ToolBox
also displays the contents of this file in the Compile Information tab in the Output bar at the
bottom of the screen. The error log can only be printed or saved from the .log file.
Before running the Compile command, select Settings from the Project menu (or enter
ALT+F7). Click on the Compiler tab and the following is displayed. Click OK to save the
Compiler settings.

RTU
Select the RTU type.
Version
Select the RTU version.
V3.70 and later support a database and an application larger than 64 Kbytes.
Choosing the Less than V3.70 option enables the CPU selection buttons.
127
CPU
MOSCAD CPU 300: The memory size available for the application is 64 Kbytes.
MOSCAD CPU 200: The memory size available for the application is 4 to 7 Kbytes. This
option is available for RTU versions less than 3.70. Later versions are supplied on CPU 300
and CPU 400.
Once the Compiler settings have been set, select Compile from the Run-Time menu or hit F7.
The compile process will begin and the compiler messages and status will appear in the
Compile Information tab of the Output bar on the bottom of the screen, as shown below.
Note: You can press ESC at any time to abort the compilation process.
The following list describes the extensions of the created object files.
ToolBox
Software
File Name Description
Version
<config name>.CFG site configuration ALL
<network name>.SCF network configuration ALL
<network name>.TBL network configuration ALL
<project name>.PRG application source file (rungs and data- ALL
base)
<project name>.FCS Compressed application source file ≥ V3.90
<project name>.WRK Intermediate application source file ≥ V5.00
<project name>.BAK back-up application ALL
<project name>.DOC description file ALL
<project name>.WDO Intermediate description file ≥ V5.00
<project name>.BDO temporary back-up application description ALL
file
<config name>.L4 I/O link file ALL
<config name>.WL4 Intermediate I/O link file ≥ V5.00
<config name>.BL4 temporary back-up I/O link file ALL
128
ToolBox
Software
Version
<project name>.PRN print project or phone book ALL
<project name>.PRC print process ALL
<project name>.PR print specific process ALL
<project name>.DB print data-base ALL
<project name>.TBL print table ALL
< project name>.P30, compiler output monitoring maps < V3.90
.P31, .P32
<config name>.N30, compiler output monitoring maps ≥ V3.90
.N31, .N32
< project name>.TMP compiler output internal dissembler < V3.90
<config name>.DIS compiler output internal dissembler ≥ V3.90
< project name>.RAM compiler output (the required RAM size < V3.90
for the compiled application)
<config name>.RA1 compiler output (the required RAM size ≥ V3.90
for the compiled application)
<project name>.OUT central file ALL
<config name>.B compiled application ≥ V5.00
<config name>.LOG log file with all warnings/errors from the ALL
compile
<project name>.LO2 unattached, inactive rung segments which ≥ V9.52
are saved with the application source
See Set Main Rung.
<project name>.LOT unattached, inactive rung segments which ≥ V9.52
are saved with the application source
See Set Main Rung.
<project name>.PRP project(s) settings ≥ V9.52
<project name>.PRW project(s) workspace ≥ V9.52
<project name>.NAM long variable symbol name aliasing ≥ V9.52
In ToolBox versions earlier than 5.00, output file names are derived from the project name and
not from the configuration name.
129
Download Application/Network
The application can be downloaded only after downloading the site configuration. Any
change in the site configuration affects the application. Therefore, if you change the site
configuration, update the I/O link definitions, recompile and download the application again.
You can download the application together with the network configuration and the compressed
source.
During the download process, ToolBox checks that the configuration is compatible with the
RTU (for MOSCAD versions up to 3.8x). The free RTU memory space for the application is
also checked. MOSCAD versions later than 4.00 or MOSCAD-L 1.00 or later do not require
full correspondence between the configuration and the application. It is the user’s responsible
to ensure proper functioning of the application.
Before downloading the application, select Settings from the Project menu (or enter ALT+F7).
Click on the DownLoad tab and the following is displayed. Click OK to save the project
download settings information.
Once the project download settings have been saved, select Download application/network
from the Run-Time menu. The download process will begin and the download messages and
status will appear in the Download tab of the Output bar on the bottom of the screen. You can
press CTRL+Z or click Abort to abort the download process.
130

Application
Reset load
Downloads the program with system initialization. Select this option if this is the first time that
the RTU is being loaded with a program, or if the RTU has been programmed in the past but
the database of the downloaded program has been modified, or if you choose to reset the
database.
Load
Downloads the program without system initialization. Select this option if the RTU has been
programmed in the past and you wish to retain the current database values or if you have made
minor changes in the application (no changes in database, or in constants, or in rungs that
have differentiators or constants).
Compress source & download
This option is identical to the Compress/Download command. See Compress/Download
below.
Customize
If you selected Compress/Download, this button becomes available and leads you to the
Compress/Download dialog box. See below.
Update date & time after download
If you select this option, after downloading the application, ToolBox updates the RTU time
and date according to the PC time and date.
Network file
Enter the name of the network file to be downloaded with the application.
Browse
If you do not know the name of the network configuration file, click this button. ToolBox
displays the Open dialog box which defaults to the configuration directory.
Site ID, Link ID
For network configuration download purposes, specify the Site ID and Link ID of the RTU. If
you specified the Site ID and the Link ID in the main window, the information is copied from
there.
131
Compress/Download
The Compress/Download command on the Run-Time menu is used to save the application in
flash memory, so it can be retrieved via the ToolBox computer. The command opens a dialog
box where some files are already marked for compression.
The default files are:

<project name>.PRG Source file (rungs and database)
<project name>.OUT Central file
<config name>.L4 I/O link file
<config name>.CFG The site configuration file associated with the application.
<config name>.NAM The long variable symbol name aliasing file
In versions earlier than 5.00, the L4 and the output file names are identical to the project name.
Left-clicking a name (or pressing the spacebar) toggles between selection and deselection.
Select the files you want to compress and, optionally, download.
132

Compress Into
This parameter shows the path to and the name of the compressed file. Clear the box if you
don’t want to create it (for downloading the existing .FCS file).
Download Compressed File
When this box is checked, the compressed files (<project name>.FCS) are downloaded to the
flash memory of the RTU. If no MDLC communication has been performed yet, you will be
prompted to enter the communication password.
Execute
Click this button to perform the operation.
Upload and Uncompress

The Upload + Uncompress command uploads from the RTU the information that has been
downloaded with Download and Compress.
Select the Upload + Uncompress command from the Run-Time menu. The upload process
will begin and the upload messages and status will appear in the Upload tab of the Output bar
on the bottom of the screen. Press CTRL+Z or click Abort to abort the upload process. If no
MDLC communication has been performed yet, you will be prompted to enter the
communication password.
The Upload dialog will appear, as shown below.
To proceed with the upload, click on the Proceed button. The application will save the
uploaded application in a directory Application Name under the Tbox952 directory. To save
under a different name, use the Save As button. Enter the desired folder name in the dialog
below which will appear.
133
If the application to be uploaded already exists on your computer, you will be prompted with
the dialog box below.
Click on the Overwrite button to replace the application on the disk with the version in the
RTU. To upload and save the application under a different name, click on the Save As button.
134
Monitor Mode
Monitor Mode provides on-line monitoring of the RTU, either locally or from a remote
computer. This mode allows real-time monitoring of the actual values of the variables defined
in every database table or in every rung. It also provides I/O freeze function (Stop Scan) for
simulation and system test purposes, and allows you to change, update, or set conditions for
some of the database elements.
To work in monitor mode, the ToolBox computer should be connected to the RTU, either
locally or remotely.
Database Monitoring
Database Monitoring allows you to monitor the actual values received from the RTU during
run-time operations, for each database table. To monitor a table, right-click on the table name
from the Database tab in the workspace, and select the Monitor command from the right-click
menu. The Application Programmer opens the Database Monitoring Form, which is similar to
Database Builder Form.
Note: The Monitor command will be disabled if any of the database tables is open for editing.
Table Monitoring
After the table to be monitored has been selected, the table is displayed in the Table
Monitoring state, as shown below.
If a CRC discrepancy between the application in the RTU and in the PC is detected, the
135
following message appears: “Project is not compatible with unit application. Continue
monitoring Table <name>?” If you click Yes, the monitor retrieves partial information. For
example, if the application in the RTU includes a table holding 20 lines, and the same table on
the PC includes 40 lines, the process retrieves the 20 lines, and displays 0 in all other lines. In
this case you will not be able to write to a spot in the database that does not exist in the RTU.
In all subsequent windows, ToolBox displays “No communication/incompatible CRC”.
Output messages are shown in the Monitor tab of the Output Bar, usually found at the bottom
of the screen.
To search for a rung name or symbol name in a rung while monitoring, use the Search
command from the Tools menu.
When a table is being monitored, the icons on the Monitor Database Tool Bar become
available.
The icons on the Monitor Database Tool Bar correspond to the Edit Menu commands under
Table Monitor above.
Monitoring Snapshot
A snapshot of table monitor values can be saved to a file. The contents of the monitored table
are saved in CSV (comma delimited) format for use in Excel spreadsheets.
To set the option, go to the Prg sub-directory of the ToolBox (tbox952) directory. The
changes are made directly in the TOOLBOX.INI file located in the tbox952\Prg\. The file can
be modified using a standard Windows text editor. The parameter to be changed is in the
[General] section of the file, as shown below. Add /DBMONFILE to the Flags variable.
[General]
Flags =/DELTMP /DBMONFILE
In order for the changes to the Table Monitoring to take effect, close the Application
Programmer tool if it is open. Start the Application Programmer tool again and select the
desired application and database table to monitor. When the User table being monitored is
closed, the contents of the table (without the column headings) are then saved. The snapshot
file named <index>.mon (where <index> is the number of the table as shown in the main
Database Builder and Database Monitoring screens.) is kept in the application directory (e.g.
tbox952\user\applx).
Process Monitoring
The Process Monitoring command allows you to monitor the actual values received from the
RTU during on-line operations, for each predefined rung. This is useful when debugging the
process.
136
To monitor a rung, go to the Process tab in the workspace. Click on the process name (under
the Project in the treeview), and then right-click on a rung. Select the Monitor command from
the right-click menu. The Application Programmer opens the Process Monitor dialog box
which is similar to the Process Programming dialog.
Note: The Monitor command will be disabled if any of the rungs is open for editing.
Rung Monitor
The Rung Monitor dialog box is where you monitor the behavior of the selected rung during
run-time.
If a CRC discrepancy between the application in the RTU and in the PC is detected, the
following message appears: “RTU CRC not equal to the DB’s CRC” and the monitor fails.
Output messages are shown in the Monitor tab of the Output Bar, usually found at the bottom
of the screen.
To search for a symbol name in a table while monitoring, use the Search command from the
Tools menu.
When a table is being monitored, the icons on the Monitor Rung Tool Bar become available.
137
The icons on the Monitor Rung Tool Bar correspond to the Edit Menu commands under Rung
Monitor above.
Performance Monitor Table

The Performance Monitor values are handled by fixed functions in the system. They may be
displayed during on-line monitoring. First click on the Database tab of the workspace. Click
to open the System Tables item and then select the Performance Monitor Table. This table
contains the System Performance Monitoring variables:
ScnTim (Scan Time): The system updates this variable to indicate the Main process scan time
(in 10 msec resolution). The scan time is measured from the beginning of the scan until the
beginning of the next scan.
MaxScn (Maximum Scan): This variable is also updated by the system. It indicates the
maximum Main process scan time (in 10 msec resolution). During monitoring this variable
displays the longest scan time since the system was started or since the variable was reset. It is
possible to reset this variable during monitoring by writing 0 into it for searching the longest
scan time.
ScnLst (Scan Last): This variable is updated by the system. It indicates the time (in 10 msec
resolution) that has passed since the system has accessed and performed the last task (the
lowest priority task in the system software).
138
DtyCyc (Duty Cycle): This variable indicates the percentage of CPU cycle time that is
assigned for the Main process and all system tasks in higher priorities. The system starts with
60% duty cycle for these tasks.
When the system cannot execute the lower priority tasks (including the ladder tasks in
priorities A to D), it reduces the CPU percentage assigned for the higher tasks to allow for the
execution of the lower priority tasks.
139
Copying Elements
The Application Programmer allows you to reuse existing database and ladder elements by
copying/moving them from one project/workspace into other projects.
Note that some elements, such as some system tables, may not be moved. If the table name
that you wish to copy has been mapped or used in rungs, then this table can only be copied, but
cannot be cut. And if the table is open, then it cannot be cut.
When you request to copy/move (import) elements, the Application Programmer goes through
the following stages:
• Analyzes the user request,
• Displays a report that shows the changes the utility is about to make in the destination
project,
• Executes the copy/move process.
Step 1. Select a source project.

Locate the project from which you want to copy or move a table, process or rung. If the
project does not exist in the current workspace, then you should insert it into the current
workspace. The project will appear in the treeview. See Insert Project into Workspace.
Step 2. Request to copy or move elements.
To start copying or moving:
1. In the Workspace Bar, expand the tree to locate the elements you want to copy/move.
2. Right click on the source name, then select the Copy or Cut command.
3. Select an element in the destination, as follows:
For tables, click on a table type or table name.
For entire processes, select the process name (the source processes will be added to the end
of the process list).
For specific rungs, expand the process, locate and select the rung after which you want to add
the source rung(s).
4. Open the right-click menu and select the Paste command. If you are dragging the source
elements, drop them.
Step 3. Request analyzed and results reported.

After the paste is performed, the system analyzes the process, reports the results (including
warnings and errors) by displaying the Analyze Result dialog box, shown below.
Warnings appear when the copy or cut utility detects an error that it can correct – for instance,
when you copy or move elements that already exist in the destination application. As names
140
(tables, field, process, rung names) should be unique, the paste process assigns new names to
the copied or cut elements and the warning report indicates them. New names consist of the
old names and a numeric prefix that the utility selects randomly. The random prefix may
contain up to six digits.
If you want to perform the import process, click Continue. If, as a result of the import,
undesired consequences will occur, click Abort to stop it. If you click Abort, no action will
take place.
Step 4. Import the elements.

If you choose to continue, the elements are copied/moved to the destination. The results of the
operation are displayed in the Analyze Information tab of Output bar. Modified elements will
be marked with an asterisk in the workspace treeview until the project is saved.
141
File Editor Option

The Open command in the File menu enables users to open and edit files within the framework
of the MOSCAD Programming ToolBox. The editor is specifically intended for users of the
“C Toolkit”, though it can serve others as well. C, header and link files associated with an
application or other text files can be edited without having to find an external editor such as
WORDPAD or NOTEPAD. Standard Windows file operations, (new, open, close, save, save
as), and Standard Windows text operations (cut, copy, paste, clear, delete, find, replace) are all
available. Several files can be edited at once.
To quickly reopen files which have previously been opened, use the list of Recent Files in the
File menu.
Note that the options in the menu bar changes when the File Editor is invoked. The View
menu, the Tools menu, and the Run-Time menu no longer appear. The Abort
Aborts the current run-time operation.
Search Menu and the Option Menu appear in the menu bar.
142
Browse Function
The Browse function allows you to select names like variable or process names, wherever
necessary. The Browse button opens a dialog box divided into two lists, as shown below.
The Groups box lists the categories (like the basic variable types or process names). Click a
group to list the corresponding names in the Database Names box. Then, select a name and
click OK.
The Browse function is available in the Search dialog and when editing parameters in rung
elements. See Search command and Editing Elements.
ToolBox Editor
The ToolBox Editor window appears when you click on a Description command throughout
the Application Programmer. It allows you to enter detailed notes for documenting your
application, processes, rungs, or tables.
ToolBox manages the documentation texts internally and assigns each text to the correct
entity. For example, when you click Description for a table, ToolBox stores the text you
entered in the editor window with the related table.
To start the editing facility:
1. Right-click on the entity (e.g. table name, process name).
2. Click on the relevant Description command.
This opens the ToolBox Editor shown below. Enter your text and click OK to save it.
143
The editor uses standard Windows text editing functionality. You can select text by dragging
the mouse over it, use cut-and-paste (CTRL+C, CTRL+X, CTRL+V), as well as undo
(CTRL+Z).
The notes are automatically included in the documentation printout created with the Print
command (File menu).
144
System and Constant Tables
This chapter describes and explains the system and constant tables, including examples. The
order of description is according to the system tables list. The constant tables are described
with the relevant system table.
System Tables
The system tables are pre-defined tables, designed to hold communications buffers, index
pointers, time and date variables, and other system-related variables. While the user tables and
some constant tables may be modified by the user to meet specific needs, the system tables
may not be modified. The following figure shows the system tables.
The system tables include reserved variables that may be used as symbolic names during
process programming.
Note that when you click the System Tables tab, you do not see all of the tables. Use the scroll
bar to see the rest of the list.
Constant Tables
The user may use symbolic constants (instead of their numeric value) during process (ladder)
editing. For example, if a limit for a process is 100, a symbolic name such as LIMIT 1 is used
in the process instead of the value.
The symbolic constants provide the following:
• Simplified modification, as the constant is modified in only one place

• More understandable ladder and ease of maintenance
145
Some of the constants tables are pre-defined, including constants such as, ASCII characters,
port names, modes and protocols, etc. These tables are described later in this chapter.
The following figure illustrates the constants tables.
Note that when you click the Constants Tables tab, you may not see all of the tables. Use the
scroll bar to see the rest of the list.
146
Tables Descriptions
The following is a description of the pre-defined tables.
RTU-to-RTU Com Buff and RTU-RTU Frame Types

The RTU-to-RTU Comm Buff system tables enable the user to define buffers for RTU-to-RTU
communication (the communication protocol is defined by the user). The RTU-RTU Frame
Types constants table includes the various types of frame transmission in RTU-to-RTU
communication.
For further details about the RTU-to-RTU configuration, refer to User Defined MDLC
Communication.
Time & Date Table

The Time & Date table, displayed below, includes variables that enable the user to write
programs with time-dependent processes.
To facilitate the use of the Time & Date table, the system provides constant tables to be used
in the ladder application.
There is an appropriate constants table for each variable in the Time & Date table (except for
the Seconds variable). The user may define constants to be used with the Seconds variable.
These constants should be in the range of 00 to 59.
147
Year variable: the Years table includes symbolic names for the years (starting from 1991).
The user may add constants to this table and also modify the names of the existing constants.
Month variable: the Months variable includes the names of the months of the year. This table
is protected and is not editable.
148
Date variable: the Dates table includes all possible dates - from the 1st of the month up to the
31st. This table is also protected and is not editable.
Day variable: the Days table includes the days of the week. This table is also protected and is
not editable.
149
Time variable: the Time constants table allows you to define constants with values in the 24-
hour format Hr:Mn (Hr varies between 0 and 23, and Mn varies between 0 and 59).
1) The following rung activates the DyStrt process at a specific hour, defined as
SrtTim.
Time DyStrt
= ↑ ( JSP )
StrTim
Note that the differentiator causes a single access to the DyStrt process at the
beginning of the minute defined by the StrTim variable.
2) The following rung performs the same operation five days a week (Saturday and
Sunday are not included).
DAY DAY Time DyStrt

≠ ≠ = ↑ ( JSP )
Sat Sun StrTim
3) The following rung performs the MnStrt process once, on the first of the month. In
the same way it is possible to make process performance conditional on a month
and/or year.
DATE MnStrt
= ↑ ( JSP )
1'st
Index Table
This table (which may be edited) allows the user to define the necessary indices for writing
programs. It is recommended to define indices with one-character symbolic names (such as I,
J, K) for creating 6-character symbolic names for variables. The variable name field in the
Ladder Diagram is 8-character long: SYMBOL,x.
One of the advantages of building the data base in multiple column tables (in which each row
represents a controlled device) is that it provides the possibility to define one algorithm for
one device and to run this algorithm by an “index” on all the devices. The index is actually a
variable pointer to the table rows. For this purpose, the system provides an index data type. To
define indices, use the Index table (one of the system tables). Each variable defined in this
table is an index.
1. Refer to a system that consists of 50 fans, represented in the following table:
150
The various variables are described below:
• ENABLE – a bit variable that specifies whether the air conditioner in a specific
section should be activated or not.
• TEMP – a value input variable that is the temperature reading from a specific
section.
• LowLmt – a parameter that defines the temperature lower limit for a specific
section.
• HiLmt – a parameter that defines the temperature upper limit for a specific
section.
• FAN – a digital output variable used to activate the fan.
The LstFan variable (defined by the user) indicates the number of the last fan, in this
case 49. The following rungs activate all 50 fans; I is the index, defined in the Index
table.
151
TEMP
(1) ( SCAN )
I
(2) ( RST )
ENABLE,I TEMP,I FAN,I

FnLoop (3) > (L)
HiLmt,I
ENABLE,I FAN,I
(4) / (U)
TEMP,I
>
LowLmt,I
I
(5) ( CTU )
I FnLoop
(6) < ( JMP )
LstFan
I
=
LstFan
FAN
(7) ( SCAN )
Before performing the algorithm, the 50 temperatures (complete column) are read by
the SCAN operator. The I index is then reset to point the first row in the table. When
I=0, all values of the indexed variables refer to the first section. Therefore, the
algorithm will start with the first row (i.e., the first section).
The algorithm is written as a loop (rungs 3 to 6), starting at the FnLoop rung and
ending at the rung with the JMP operator. The algorithm logic is as follows:
• If the section is ENABLED and the actual temperature is higher than HiLmt, the
fan is activated by the LATCH operator (rung 3).
• If the section is not ENABLED or the actual temperature is lower than LowLmt,
the fan operation is stopped (rung 4).
• The I index is advanced by the CTU (count up) operator to perform the algorithm
on the next section (rung 5).
• The I index is compared to the LstFan variable (rung 6). If it is found smaller or
equal to the LstFan variable it means that the loop is to be performed again (for
the next section). If the I index is higher than the LstFan variable, the program
exits the loop and proceeds to the next rung (7).
152
The last rung (7) scans the FAN variable to update physical outputs according to the
FAN column in the table.
By using an index, the algorithm is written only once and not n times.
The loop size is defined by the LstFan variable, and not 49 (the last section in our
example). That is, by a single operation (refer to the Database Builder section in the
Application Programmer chapter) you can reduce or enlarge the size of the table – the
algorithm is automatically adjusted to the number of sections.
You can refer to a specific row by assigning a number rather than the index. For
example, TEMP,3 indicates the temperature of section number 3 (the 4th row, starting
from 0).
2. When the algorithm for an external device (for each row in the table) is long and
complicated (considering CPU time), you may want to divide the control operation so
that only one row of the table will be handled in a process SCAN. This case is
different from the previous example, where the algorithm for all rows is handled in
one SCAN. In this case, the rungs are as follows:
I I
(1) > ( RST )
LstFan
I TEMP
(2) = ( SCAN )
0
ENABLE,I TEMP,I FAN,I

(3) > (L)
HiLmt,I
ENABLE,I FAN,I
(4) / (U)
TEMP,I
>
LowLmt,I
I
(5) ( CTU )
I FAN
(6) > ( SCAN )
LstFan
The first rung checks that the I index is in the correct range. If I>LstFan, it is reset to
0. Only when I=0, all temperatures are read by the SCAN operator.
The logic of activating and deactivating the fans is similar to the previous example
and so are the rungs (3 and 4). The I index is incremented by the CTU operator to be
ready for the next row in the next SCAN.
153
When I>LstFan the FAN column is scanned to send the values to the physical outputs.
Note that the SCAN operator is performed on the TEMP and FAN variables once
every 50 cycles (in this case) and not in every cycle.
In example 1, the I index of the loop may be used in the same process for another loop, since
the index is used only within the loop.
In example 2, you should not use the I index again, since it is incremented in between cycles
and keeps the pointer for the next cycle. Therefore, it cannot be used in another loop.
It is recommended to define indices of one character to enable assigning meaningful names of

six characters to variables in the Ladder Diagram (the format is <name>,<index> of eight
characters).
Indices are defined only in the Index table. You may perform arithmetic operations on indices
beside the RST, CTU, and CTD operators. Refer to the description of the relevant operator.
Reserved Flags Table

This table, shown below, includes variable flags (such as I/O Fail, Power-up), handled by fixed
functions in the system. These flags are used for exchanging information between the control
program written by the user and the RTU system software, or used by the appropriate rungs
when requested through the appropriate functions.
I/O_Fl: This variable is set by the system; ‘1’ indicates that one of the I/O modules is faulty.
This variable may be used to activate a local relay output, named BELL, that is reset by a local
push-button, named ACK.
154
I/O_F1 BELL
↑ (L)
ACK BELL
(U)
The differentiator causes the Latch operation to be performed only at I/O_Fl appearance.
The I/O_Fl variable may also be used for sending events to the central. Refer to RTU Event
Reporting in User Defined MDLC Communication.
Init: Initialization. This variable is set by the system to ‘1’ when a new application is
downloaded to the RTU during “reset-load” (all variables are preset), or when a “cold-restart”
is performed. If this variable is used, it should be reset at the end of the process.
For example, the PreSet process is run at initialization. At the end of the process, the Init
variable is reset to ‘0’.
Init PreSet
Part of Main ( JSP )
Process
PreSet Init
Process (U)
PwrUp: A variable set by the system to ‘1’ upon power-up or power restore (not as the Init
variable that is set to ‘1’ only at cold start-up). If the PwrUp variable is used, it should be reset
after performing all power-up operations.
The PwrUp variable may be used as a condition to perform various operations at power-up as
in the following example.
PwrUp CONT
/ ( JMP )
Power-up PwrUp
Operations (/)
CONT
When the PwrUp variable is not true (no power-up), the rungs that perform the power-up
operations are skipped.
Note that during “cold-restart” the Init and the PwrUp flags are set to ‘1’, and during “warm-
restart” the Init flag is set to ‘0’ and the PwrUp flag is set to ‘1’. It is the user’s responsibility
to reset these flags.
AC_Fal: This flag is set by the system to ‘1’ when a power failure causes switching to a back-
up battery. It is reset when power is restored. A parallel external LED AC(FAIL) on the CPU
front panel is lit upon AC power fail.
155
Note that this flag is relevant only if the unit is equipped with a back-up battery.
For example, if the AC power failure is longer than 10 minutes, a local buzzer will sound and
an event will be sent to the central. The FalDly delay-on timer is defined as a Minutes Timer
and its value is set to 10:00 (10 minutes).
AC_Fal FalDly
( DON )
FalDly BUZZER
( )
FalDly
↑ event transmission
BatFal: This flag is set by the system to ‘1’ when the voltage of the CPU back-up lithium
battery is low. Note that this flag is relevant only if the battery is present in the CPU module. If
the battery is not inserted in the CPU module, this flag will not indicate the battery absence.
PushB1( MOSCAD ≥V 2.00, MOSCAD-L ≥V 1.00), PushB2 ( MOSCAD ≥V 2.00): These two
variables allow you to access the status of the PB1 and PB2 push-buttons via the ladder
diagram. When a push-button is pressed, the appropriate variable is set to ‘1’. The variables
may be reset by the rungs (latch operation).
AuthOK: This variable is set to '1' when the second and third Authentication keys (used in the
synchronization of an RTU) are valid, but the first key (used in authenticating incoming frame
data) may not be. In this case, synchronization messages from a server to a client will be
processed. Incoming data frames will be accepted by the RTU if the timestamp is valid and
will be rejected if it is not.
The AuthOK variable is set to '0' when the second and third Authentication keys are not valid,
but the first key may be valid. In this case, synchronization messages from a server to the
client will no longer be processed. Incoming data frames will be accepted by the RTU if the
timestamp is valid and will be rejected if it is not. As soon as the receiving RTU's clock
becomes unsynchronized, no incoming data frames will be accepted by the RTU. The user
will then have to redefine the second and third authentication keys and download them to the
RTU using the Network Configuration utility.
For more details on authentication keys and the synchronization of the RTU based on the Max
Drift parameter, see the Authentication chapter in Advanced Features in the Application
Programmer manual.
TskPrA - TskPrD (Task Priority): These four system flags indicate to the ladder whether the
A to D tasks are running or not. Refer to the RUNP output operator in Ladder Diagram
Language.
GPSVal ( MOSCAD ≥V3.70, MOSCAD-L ≥V1.00): This variable indicates if the GPS is
communicating with the MOSCAD, or if it is disconnected. It is set by the system to ‘1’ when
the communication is valid, and to ‘0’ when it is null. Refer to Global Positioning System in
Advanced Features in the Application Programmer manual.
156
ErrLog: This flag is set by the system to ‘1’ when there is at least one error in the error log
file. It is reset when the file is empty.
The ErrLog variable may be used to inform the control center that there is an error (ErrLog=1)
– as in the following rung.
ErrLog INFOER
↑ ( JSP )
When ErrLog=1, the program jumps to the INFOER (inform error) process. This process
performs the task of sending events to the control center. In this case, the event is an error
event. An example of such a process is given in User Defined MDLC Communication - RTU
Event Reporting.
TimTag: This flag is set by the system to ‘1’ when there is at least one message in the Time
Tag log file. It is reset when the file is empty.
The TimTag variable may be used to inform the control center that there is a message
(TimTag=1) in the Time Tag log file – as in the following rung.
TimTag INFTAG
↑ ( JSP )
When TimTag=1, the program jumps to the INFTAG (inform time tag) process. This process
performs the task of sending events to the control center. In this case, the event is a message in
the Time Tag log file. An example of such a process is given in User Defined MDLC
Communication – RTU Event Reporting.
DefC_Y: This flag is set by the system to ‘1’ only when the RTU “knows” its default central.
At the first transmission of the central (after system setup), each RTU holds the routing to the
default central. If such a transmission has not occurred (DefC_Y=0), then an RTU
transmission to the default central will result with an error – the ERR LED of the MOSCAD
RTU will light.
For example, refer to a process that performs burst communication towards the default central.
This process includes the following rungs:
Esite
( MOVE )
Cntral
To prevent an RTU transmission to the default central without “knowing” the default central
(such a transmission will result with an error), the transmission rung should be conditioned by
the DefC_Y flag, as follows:
DefC_Y TxEvnt
( CALL )
b
157
The TxEvnt function will be called only when DefC_Y=1, that is RTU “knows” its default
central.
CntCom: This variable indicates whether there is any communication (interrogation,

command, broadcast, event acknowledge) to the central or not. This variable is set to ‘1’
whenever the central has succeeded in communicating with the unit.
For example, it is possible to activate a DOF timer (with a T preset time) according to the
CntCom variable in order to change the RTU mode of operation in case of central failure
(CntCom=0), as follows:
CntCom T
/ ( DOF )
T MODE2
/ (L)
The MODE2 user bit may be used to activate the RTU in an independent mode of operation. If
MODE2=0, there is communication with the central. If MODE2=1, there is no communication
with the central.
EvOvfl: This flag is set by the system. ‘1’ indicates that the event queue is full and the next
event will be written over the existing events. It is the user’s responsibility to reset this flag.
PrmFlg: For Dual CPU Mode, ‘1’ indicates that the CPU is plugged in Slot-0 (Primary).
PrmFal: For Dual CPU Mode. The Secondary’s application may use this flag to check if a
failure has occurred in the Primary CPU module. ‘1’ indicates that there is a failure in the
Primary.
DisCom: When active (1), the CPU does not respond to messages that were sent to its main
address, and in addition, does not send any message (burst, SndFrm etc.). The CPU responds
only to messages that were sent to its secondary address or messages that were sent in LOCAL
Mode.
158
Performance Monitor Table

The Performance Monitor values are handled by fixed functions in the system. They may be
displayed during on-line monitoring.
User Ports Table

The User Ports table is a buffer that is used in communication for ports defined as User Ports
(ladder controlled) in the Site Configuration program. The associated constants tables are:
User Port Names, User Port Modes, User Port Protocols, and User Port Baud Rates. For a
detailed explanation and examples, refer to User Defined Local Ports.
Site table
The Site table is applicable only for RTU-to-RTU communication, event reporting, data burst,
and sync. This table is used to define all the RTUs that the present RTU wishes to
communicate with. For each destination RTU, the user should define a symbolic name, logic
address (Site ID), and the link (link ID) through which it is connected. When programming the
process using the ladder rungs, the user should employ only the symbolic site name in the
appropriate rung for sending the data to that site. For further details including examples, refer
to User Defined MDLC Communication.
Tx Event Table
The Tx Event table is used as a buffer when sending events to the central. The events should
be defined in the constants Event Definitions 1 & 2 tables. The MDLC Port ID’s table includes
the port name(s) which connects the central computer to the FIU. For further details, refer to
User Defined MDLC Communication.
Data Burst Table

The Data Burst table is used by the RTU to transmit data to the central. The data to be
transmitted may be either a complete row of a multi-column table or a single-column table. For
further details, refer to User Defined MDLC Communication.
Reserved Values Table

This table includes system values that may be used in the process programming for various
purposes.
159
SelfID: This variable provides the Site ID of the unit. For example, this variable may be used
when you do not want to create many applications with minor changes. You can use the SelfID
variable to modify one common application according to the needs of a specific RTU.
PLCStt (MOSCAD ≥ V3.00, MOSCAD-L ≥ V1.00): This variable provides an indication on

the communication with third-party PLCs. The values for this variable defined in the PLC
Statuses table (one of the Constant Tables). For further details about Third-Party Protocols,
refer to Third Party Protocols Support manual.
ClcStt (MOSCAD ≥ V3.70, MOSCAD-L ≥ V1.00): This variable is updated following a Calc
operation. When an overflow occurs, CllStt is set to ‘1’ and it is the user’s responsibility to
reset it.
UclStt (MOSCAD ≥ V3.70, MOSCAD-L ≥ V1.00): This variable is used by the ‘C’ Toolkit
and it is updated following a Ucl output operation. It is the user’s responsibility to reset this
variable.
GpsOfs (MOSCAD ≥ V3.70, MOSCAD-L ≥ V1.00): This variable enables the user to update
the RTU to daylight savings time. The GpsOfs default value is ‘0’, and it may be either
positive or negative according to the local time offset in respect to the universal time
(measured in hours).
For further details about the GPS, refer to Global Positioning System in Advanced Features in
the Application Programmer manual.
160
PRMEVENT TABLE
The PRMEVENT table enables the user to define buffers for the Event Driven software.
Unlike polling/scanning, the Event Driven software performs calculations or sends commands
only when changes occur at the inputs.
For further details about the Event Driven software, refer to Event Driven Software in
Advanced Features in the Application Programmer manual.
PLC Table
The PLC table is used to define the connectivity to third-party controllers in the system.
For further details about Third-Party Protocols, refer to Third Party Protocols Support manual.
161
User Defined Local Ports
Some ports in the system may be defined as user ports via Site Configuration. The user ports
are controlled by the ladder application through the appropriate functions and through the user
ports table (one of the system tables). There are specific constant tables, described below, that
play a role in user defined communication.
When a port is defined as a user port, the port and the protocol are controlled by the user that
writes the rungs. For example, you may use a port for printing on a printer or for connection to
a computer (or any other smart unit) by writing the appropriate protocol.
The RS-232 ports in the system use a telephone-type 8-pin connector. To connect any
equipment that requires a standard RS-232 interface, use one of the following cables:
1) Terminal adapter cable FLN6457 (with female 25-pin D-type connector) for connection to a
terminal, computer, or printer.
2) Modem adapter cable FLN6458 (with male 25-pin D-type connector) for connection to an
external modem.
To connect two RS-232 ports of two sites (configured as RS-Link in Site Configuration), use
the above mentioned cables (connect the male and female 25-pin D-type connectors). You can
not connect two RS-232 ports without these cables.
162
User Ports Table

The user ports table is the link between the user rungs and the communication software that is
part of the RTU system software. The number of rows in the table should be modified
according to the number of user ports defined in Site Configuration.
Each row in the table includes the variables and flags for each User Port. User_1 refers to row
0, User_2 – to row 1, and User_3 – to row 2 (refer to the User Port Names table in the
Constants Tables list). Use these symbols to refer to the port (the assignment of the physical
ports is performed by Site Configuration).
Select the user ports table from the System Tables list. It looks as shown below.
PTxFlg Variable and SEND Operator

The PTxFlg flag is updated once the SEND operator is called. The SEND operator sends
messages (character strings) to the appropriate port. After calling the SEND operator, the
PTxFlg flag specifies whether or not the message has been taken by the system for
transmission (queue is full). PTxFlg = ‘1’ means that the message has been taken.
163
USER_2
(SEND)
This is a DEMO message.
This rung sends the message in the window to USER_2 (User Port no.2). The next
rung, after performing the SEND operator, should check whether the message is to be
sent or not (since the system buffer is full). You should insert the value of USER_2
into an index variable (for example, x) and then check if PTxFlg,x is equal to 1 or not.
If the message was not taken for transmission, then the SEND operator should be activated
again after a while.
You may call the SEND function with an index that has been loaded with the appropriate
value: USER_1 to USER_3.
Instead of using PTxFlg,x, you may use the following:
PTxFlg or PTxFlg,0 for User Port 1.
PTxFlg,1 for User Port 2.
PTxFlg,2 for User Port 3.
The SEND operator sends a free-format message to the ports defined as user ports.
USER_1
(SEND)
free-format message
When the rung is true, the message in the window is sent to the user port specified above the
SEND operator.
The message may include characters, text, and also variables combined with text. The message
may be sent to a printer, terminal, or may be used for communicating with any other unit using
serial protocol.
If the rung conditions are constantly fulfilled and you want to send the message only once, a
differentiator should be used.
The following rungs print a message that includes the temperature when it exceeds
HiLmt or goes below LowLmt. TEMP is the temperature variable and HiLmt and
LowLmt are constants.
164
TEMP USER_2
> ↑ ( SEND )
HiLmt
TEMP
<
LowLmt
The temperature is: <TEMP> degrees.
<TEMP> indicates to the unit that the value of the TEMP variable should be sent. The
variable in between the angular brackets must be defined in the data base. The
variable may be either from a single-column table or from a multi-column table
including an index (for example, Status,I).
The variable values will be printed/displayed according to the following formats:
Format 1:
<BIT>: Sends the value of a discrete variable (0 or 1) with a space before the digit: “ 0” or
“ 1” (i.e., two characters).
Format 2:
<VAL>: Sends the value of the VAL variable defined as one of the following data types:
• Integer Value, Parameter • PPH

• Mapped Value • Index
The value is sent as a fixed field of six characters in the range of -32,768 to +32,767. For
example:
30000
-27263
+12
-500
1
0
If the VAL variable is defined as one of the following data types, then the value is sent as a
fixed field of 16 characters in the range of -3.402823466x1038 to +3.402823466x1038:
• Real Value
• Real Parameter
• Real Constant
165
Format 3:
<<BIT>: Sends the value of a discrete variable (0 or 1) without a leading space.
Format 4:
<<VAL>: Sends the value of the VAL variable in its actual length (not as a fixed field length).
Note that formats 1-4 convert the value of the variable into an ASCII string while Format 5
sends the value of the variable as a character directly to the port.
Format 5:
‘n<STRING,I>: Sends a series of characters (n characters) whose codes (variables) are stored
in the low bytes of the variables in a column named STRING (starting at STRING,I). For I=K
the first string to be sent is LOWBYTE(STRING,K) and the last one
LOWBYTE(STRING,K+n). It should be noted that n may be an integer constant or index. n as
index enables sending a string with variable length (supported from version ≥ V1.63).
The ‘<STRING,I> sends a single character; i.e., ‘<STRING,I> = ‘1<STRING,I>.
When the RTU sends the text, it adds <LF> and <CR> characters at the end of each line. The
codes appear in the following order: <LF> (Hex-0A) and <CR> (Hex-0D).
You may cancel the insertion of these two codes by adding the “\” character at the end of the
line (after the last character). This feature is useful when defining a protocol by the SEND
operator and also when sending “Escape Sequences” or parts of sentences to a terminal screen.
If you use “\”, make sure that there are no additional spaces after the character. Otherwise, it is
not considered as CR-LF cancellation.
The rung below positions the cursor on column 30 of the first line and then sends the
following heading: ALARM REPORT SCREEN.
USER_1
(SEND)
<-[1;30H\
ALARM REPORT SCREEN
Note that you must make sure that the terminal accepts “Escape Sequences”.
The first line in the window positions the cursor on the screen. The “Escape Sequence” starts
with the Esc character; type the Esc character on your keyboard – the symbol will appear on
the screen.
The \ character at the end of the first line informs the system not to insert <LF> and <CR> at
the end of the “Escape Sequences”.
166
If the “\” character at the end of a line is part of your text, then add a space at the end
of the line.
The rung may be written in another way:
USER_1
(SEND)
<-[1;30HALARM REPORT SCREEN
In this example, it is difficult to identify the beginning of the text.
To print a variable in 24-hour format, use %<VAL>. This will send the VAL variable as:
“_HH:MM”. For example, %<TIME> will send the TIME variable in this format.
The system automatically identifies a Timer variable (Hours, Minutes, or Seconds) in between
< > or << >, and sends it in Timer format: “_XX:YY” for <Timer> and “XX:YY” for
<<Timer>.
To print at different locations of the screen, use the following format:

[<<y>;<<x>H
where:
y is the variable that represents the row number
x is the variable that represents the column number
For example, for row 14, column 24: y=0x3134 (the ASCII values of 1 and 4, respectively)
and x=0x3234 (the ASCII values for 2 and 4, respectively).
PRxFlg Variable
The PRxFlg variable is updated by the system when the GetChr and GetDgt functions are
called. The variable receives the value ‘1’ whenever a character is read from the selected User
Port. If the PRxFlg variable is ‘0’ after calling the GetChr function, it means that no character
has been received. Refer to the PRxChr and PRxNum variables.
PRxChr Variable and GetChr Function

The GetChr function is called by the CALL operator. It reads one character from the specified
port into the PRxChr variable in the appropriate row of the user ports table.
You should ensure that the reading operation was successful (a character has been read) by
checking the PRxFlg variable.
167
The following rung will read a character from User Port no.3.
GetChr
(CALL)
USER_3
The ASCII table, accessed from the Constant Tables list, contains all the characters that you
may use for comparison with the PRxChr value. The ASCII characters are detailed in the
following table.
Ind Name Value Ind Name Value Ind Name Value

0 ChrDgt 8196 42 Chr__l 108 84 Chr_æ 145
1 Chr_Lf 10 43 Chr__m 109 85 Chr_Æ 146
2 Chr_Cr 13 44 Chr__n 110 86 Chr_ô 147
3 ChrEsc 27 45 Chr__o 111 87 Chr_ö 148
4 ChrSpc 32 46 Chr__p 112 88 Chr_ò 149
5 Chr_A 65 47 Chr__q 113 89 Chr_û 150
6 Chr_B 66 48 Chr__r 114 90 Chr_ù 151
7 Chr_C 67 49 Chr__s 115 91 Chr_ÿ 152
8 Chr_D 68 50 Chr_t 116 92 Chr_Ö 153
9 Chr_E 69 51 Chr_u 117 93 Chr_Ü 154
10 Chr_F 70 52 Chr_v 118 94 Chr_@ 64
11 Chr_G 71 53 Chr_w 119 95 Chr_( 40
12 Chr_H 72 54 Chr_x 120 96 Chr_) 41
13 Chr_I 73 55 Chr_y 121 97 Chr_* 42
14 Chr_J 74 56 Chr_z 122 98 Chr_+ 43
15 Chr_K 75 57 Chr_0 48 99 Chr_- 45
16 Chr_L 76 58 Chr_1 49 100 Chr_/ 47
17 Chr_M 77 59 Chr_2 50 101 Chr_: 58
18 Chr_N 78 60 Chr_3 51 102 Chr_; 59
19 Chr_O 79 61 Chr_4 52 103 Chr_< 60
20 Chr_P 80 62 Chr_5 53 104 Chr_= 61
21 Chr_Q 81 63 Chr_6 54 105 Chr_> 62
22 Chr_R 82 64 Chr_7 55 106 Chr_? 63
23 Chr_S 83 65 Chr_8 56 107 Chr_\ 92
24 Chr_T 84 66 Chr_9 57 108 Chr_] 93
25 Chr_U 85 67 Chr_Ç 128 109 Chr_[ 91
26 Chr_V 86 68 Chr_ü 129 110 Chr_^ 94
27 Chr_W 87 69 Chr_é 130 111 Chr_! 33
28 Chr_X 88 70 Chr_â 131 112 Chr_” 34
29 Chr_Y 89 71 Chr_ä 132 113 Chr_# 35
30 Chr_Z 90 72 Chr_à 133 114 Chr_$ 36
31 Chr__a 97 73 Chr_å 134 115 Chr_% 37
32 Chr__b 98 74 Chr_ç 135 116 Chr_& 38
33 Chr__c 99 75 Chr_ê 136 117 Chr_’ 39
34 Chr__d 100 76 Chr_ë 137 118 Chr_{ 123
35 Chr__e 101 77 Chr_è 138 119 Chr_} 125
36 Chr__f 102 78 Chr_ï 139
37 Chr__g 103 79 Chr_î 140
38 Chr__h 104 80 Chr_ì 141
39 Chr__i 105 81 Chr_Ä 142
40 Chr__j 106 82 Chr_Å 143
41 Chr__k 107 83 Chr_É 144
PRxNum Variable and GetDgt Function

The PRxNum variable may receive a series of digits by using the GetDgt function. It indicates
the equivalent of that series at any given time.
The GetDgt function is called by the CALL operator. It reads one digit from the specified port
into the PRxNum variable in the specified row. PRxNum = (old PRxNum)*10 + Input Digit.
Once the GetDgt function has been executed, you should check the following:
• PRxFlg is ‘1’, indicating that a digit has been read from the port.
168
• PRxChr has received the value of ChrDgt (8196 – refer to the ASCII table). If the value of
the PRxChr variable is not equal to ChrDgt, it means that the received character is not a
digit. In this case the received character is stored in the PRxChr variable and PRxNum is
not affected.
PrtFal Variable
The PrtFal (Port Fail) variable is updated by the system when the SEND function is called.
The PrtFal variable specifies the status of the port:
• PrtFal=0 indicates that the port is OK.
• PrtFal=1 indicates that the port is faulty.
PrtMod, Protcl and PrtRat Variables

The PrtMod (Port Mode), Protcl (Protocol), and PrtRat (Port Rate) variables allow you to
define the mode of operation, protocol, and data speed for the communication port. These
variables may be set by the user when building the user ports table using the Show Related
Data option. The default is: 8 bit, no parity, one stop bit, binary protocol, and 1,200 bps. The
user can modify these variables during runtime by using the MOVE operator on the
appropriate constants, detailed in the following tables.
PrtMod Variable
The PrtMod variable may receive one of the modes that appear in the User Port Modes table
(one of the Constant tables) shown below:
169
The various modes are described in the following way:
• 7b/8b – stand for 7 bits or 8 bits, respectively.
• Np/Ev/Od – stand for no parity, even parity, or odd parity, respectively.
• 1S/2S – stand for 1 stop bit or 2 stop bits, respectively.
For example, 7bEv2S means 7 bits, even parity, and 2 stop bits.
Protcl Variable
The Protcl variable defines the protocol to be used. It may receive one of the options that
appear in the User Port Protocols table (one of the Constant tables) as shown below:
In the Binary protocol (default in the table and in the system), the characters are transparently
transferred.
The XonXof protocol defines the ports for ASCII and automatically supports the Xon and Xoff
control characters. If you use Xon/Xof, make sure that the data that is sent does not conflict
with the Xon/Xof values (the data should not include the values 10/13).
170
PrtRat Variable
The PrtRat variable defines the port data speed. It may receive one of the options that appear
in the User Port Baud Rates table as shown below:
Ready and NotRdy Functions

The Ready and NotRdy functions, called by the CALL operator, allow manual control (via
rungs) of the DTR (Data Ready) or CTS (Clear To Send) signals, depending on the type of
connection. The functions may be applied on user ports only.
If the RTU acts as DTE, then the Ready and NotRdy functions control the DTR signal. If the
RTU acts as DCE, then these two functions control the CTS signal.
The default mode of operation is that the system software automatically controls the
communication. Calling the NotRdy function will reset either the DTR or CTS signal. Calling
the Ready function will return the automatic mode of operation (controlled by the system
software).
Contrary to the Send operation which sends the job to the system software for execution, the
Ready/NotRdy functions affect the port immediately. This means that, if you need to perform
an operation between Ready and NotRdy, use a delay timer to ensure the execution of the Send
operation.
171
Example of Building Local Communication Processes

The following example describes the relevant processes of a simple case: A keyboard and
screen of a terminal is connected to the unit port. A header will be displayed at the top of the
screen and then the message “Enter Number”. The end user will enter a number while each
digit will be displayed (echo). After pressing ENTER, the number is multiplied by a factor
(defined in the database). The result is then displayed. The database of definitions (variables
and constants) and the process/subprocesses of this simple example are shown below.
Database Definitions
Two value variables (STATE and RESULT) are used in the process programming. They are
defined in a User table named Internal Variables.
172
An internal parameter (FACTOR) is also used in the process programming. It is defined in a

User table named Internal Parameters.
Four constants, Header, KeyIn, OutSt, and Finish, which define the STATE variable, are also
used in the process programming. They are defined in a Constant table named Internal
Constants.
173
The following process list, includes all subprocesses.
• MAIN – The main process calls the sub-processes as a function of the STATE variable.
• HeadrP – Sends a header and instructions to the screen.
• KeyInP – Positions the cursor and displays the typed number after each digit.
• OutP – Sends a message to the screen including the result.
Main Process
The main process controls the RTU local communication. The main process checks the
STATE variable and jumps to a subprocess accordingly. First, the process sends the headers to
the screen. Then, it receives the number entered by the end user and multiplies it by an internal
factor. Finally, the result is sent to the screen, and the STATE variable is reset to 0.
Note that the process is serial and any subprocess will not be performed until the previous one
has been executed (by the STATE variable that is advanced after the subprocess execution).
After performing one complete cycle of receiving, computing, and displaying the result, the
STATE variable is compared to the Finish variable to start another cycle.
The main process rung list is displayed:

174
The rungs are as follows:
STATE HeadrP
J_Hadr = (JSP)
Header
STATE KeyInP
J_KyIn = (JSP)
KeyIn
STATE OutP
J_Outp = (JSP)
OutSt
STATE GetChr
Reset = (CALL)
Finish USER_1
PrxFlg,0 STATE
(MOVE)
Header
PrxNum,0
(RST)
HeadrP Subprocess
This subprocess sends messages (headers) to the screen by the following rungs:
USER_1
(SEND)
[2J
[1;25H\
THIS IS A DEMO SCREEN
[3;0H\
Enter Number:\
PTxFlg,0 STATE
(MOVE)
KeyIn
The first row in the window clears the screen. The second row positions the cursor in column
25 of the first line of the screen. The third row includes the header to be displayed. The fourth
row positions the cursor at the beginning of line 3 of the screen, and the last row includes the
message “Enter Number :” to be displayed.
175
The second rung checks the PTxFlg,0 (indicates the flag of port USER_1) variable. If it is 1, it
means that the messages have been taken for transmission to the port, and the STATE variable
is assigned the KeyIn value.
KeyInP Subprocess
This subprocess receives each key press (checks whether it is a numeric or non-numeric key)
and displays the digits typed in. Then, upon receiving the CR character, the number is
multiplied by the FACTOR constant. At this stage, the STATE variable is advanced. The
subprocess comprises the following rungs:
GetDgt
(CALL)
(1)
USER_1
PTxFlg,0 PRxChr,0 USER_1

(2) = (SEND)
ChrDgt
[5;0H<PRxNum,0>\
PTxFlg,0 PRxChr,0 RESULT

(3) = X PrxNum,0
Chr_CR FACTOR
STATE
(MOVE)
OutSt
The first rung (1) calls the GetDgt function in order to read a digit into the PRxNum variable.
The second rung (2) checks that a digit has been received (PRxFlg,0 is true) and that it is a
digit by comparing the value of the received digit (PRxChr,0) to ChrDgt. If so, then the
accumulated number PRxNum is sent to the screen.
The third rung (3) checks if a CR character has been received (PRxFlg,0 is true and the value
of the received character is Chr_CR). If it so, then the received number, accumulated in
PrxNum, is multiplied by the FACTOR constant, the result is inserted into the RESULT
variable, and the STATE variable is advanced.
176
OutP Subprocess
This subprocess sends the result to the screen. It comprises the following rungs:
USER_1
(SEND)
[7;0H\
INPUT NUMBER MULTIPLIED BY FACTOR = <FACTOR>
EQUALS TO <RESULT>.
STRIKE ANY KEY TO CONTINUE
PTxFlg,0 STATE
(MOVE)
Finish
177
User Defined MDLC Communication
The MOSCAD system uses the MDLC protocol, based on the OSI (Open Systems
Interconnection) model published by ISO. The protocol comprises the seven recommended
layers adapted for SCADA and supports all Toolbox functions. It also supports the following
functions:
• Central-to-RTU data transfer

• Central-to-RTUs broadcast
• RTU event reporting
• RTU burst reporting
• RTU-to-RTU communication
Central-to-RTU Data Transfer

The central is able to affect (read/write from/to) any RTU in the system, since all RTU
database tables are known to the central. The definition of the RTU database tables is
automatically transferred to the central by means of the Create Central File function.
In addition, any cross-section of any table can be downloaded from or uploaded to the central.
The central may download/upload any number of rows, columns, a complete table, and one or
more columns in one or more rows if they meet specific conditions.
This type of communication is almost transparent to the process in the RTU. The definition of
the database tables cross-sections to be included in each transmission is performed by the Data
Transaction Selectors (refer to the MCP-M User Guide).
The central may condition the data transfer from the RTU on the COS (Change of State) flag.
The RTU will transmit only the row numbers of the required tables in which the COS flag is
true, and the relevant data. When the data is transferred to the central, the RTU resets the COS
flag to 0.
The COS flag is a single bit for every row of all tables. It may be true in the following cases:
• Any change in one of the table entries, defined as Discrete Input, will automatically set the
COS flag of the appropriate row.
• In table columns defined as Value Input/Scaled Analog Input, any change in the last
reported data that is greater than COS delta (defined for every Value Input in the I/O Link)
will automatically set the COS flag of the appropriate row. The user can also set and reset
the COS flag in an application, using services provided by the ‘C’ Tookit.
• By applying the Ladder Diagram operators on the COS Name variable, the user can define
the conditions (such as, calculated variables) to set/reset the COS flag.
To set the COS flag in a single/multi-column table, use the following rung:
178
<Name>,I
( L )
<Name> is the COS Name that you have assigned to the single/multi-column table. I is an
index that indicates the row of the relevant COS flag.
In previous versions of the Toolbox, the COS flag was supported by means of the SetCOS
function. From version 1.74 of the Toolbox, the COS flag is supported by the COS Name
variable. When upgrading previous versions, the SetCOS function is still supported.
Remember that if the relevant rungs of the SetCOS function are deleted, you will have to use
the COS Name variable to handle the COS flag.
179
Central-to-RTU Broadcast
The system enables simultaneous data transmission to a group of RTUs. This type of
communication, called Broadcast, should modify the RTUs’ mode of operation or serve as a
trigger for a specific operation. The broadcast command includes the necessary information
concerning the addressed RTUs and the command itself.
The broadcast may be transmitted over a specific link or all links in the system. The broadcast
message includes a condition (qualifier). The broadcast is received by all RTUs on the
specified link(s). Only the RTUs that fulfill the condition will refer to the broadcast (the other
RTUs which do not fulfill the conditions will ignore the broadcast). An unlimited number of
RTU groups may be created by defining different qualifiers. The qualifiers are defined in the
Qualifiers table (reserved by the system as one of the User Tables). For more information, see
the MCP-M/IP Gateway manual.
Since the value of the qualifier can be dynamically changed, the composition of the RTU
group can vary accordingly. Each RTU checks the validity of the qualifier; if the condition is
valid, the RTU automatically belongs to the group.
The broadcast command then assigns a value to a specific variable in the Qualifiers table in all
RTUs that belong to the group.
Broadcast reception does not require any support in ladder diagram; it is sufficient to define
the qualifiers in the Qualifiers table to be used by the user process.
Since the MCP-M/IP Gateway does not know how many RTUs will belong to the group, there
is no acknowledgment for this type of communication. Therefore, you should use broadcasts
only when a synchronized operation is to be performed on a group of RTUs.
Logically, the broadcast may be described in the following manner (Qual1 and Qual2 are two
variables defined in the Qualifiers table):
If (Qual1 = x) then Set Qual2 = y.
The Qual2 variables of all RTUs having a Qual1 variable equal to x, receive the value of y.
The y value may be used to control the RTUs’ mode of operation or as a trigger for a specific
operation. You may create any number of groups by defining different qualifiers in the
Qualifiers table. Each RTU may belong to more than one group, according to the defined
qualifiers.
RTU Event Reporting (IGC/M old central only)

This type of communication is designated for reporting events that have occurred in the RTU
to the central. The Scheduler in the central (refer to the IGC/M manual) uses the events as
conditions. Upon reception of an event, the Scheduler can transmit/receive data to/from either
the RTU that has transmitted the event or any group of RTUs.
The events are defined during RTU process programming, where each event is defined by a
symbolic name in the Events table. See RTU Event/Burst Reporting.
180
RTU-to-RTU Communication Guidelines

RTU-to-RTU communication is used for transferring data between different RTUs. The
system provides all variables and constants to be used for this type of communication. The
communication system supports network communications, including transmission retries in
case of communication failures.
Since all variables and constants required for this type of communication are already included
in the appropriate System tables, the user may build the applicable communication process
through the process programming, using rung sequences. The user should specify the data to
be transmitted and the name of the addressed RTU.
Each RTU may send/receive frames in two ways:
• Normal fashion – the order of the transmitted frames is not guaranteed. The order of the
received frames may be different from the order of the transmitted frames.
• Sequential fashion – the order of the received frames is identical to the order of the
transmitted frames.
Variables/Constants & Functions Used for MDLC

Communication
Variables/Constants
The user can control the MDLC two-way communication between RTUs (burst and broadcast)
and event reporting to the central by using the appropriate variables/constants and functions
provided by the system (see Communication Functions available via the CALL Function in
this chapter).
The variables and constants are from the following database tables: Site table, RTU-to-RTU
Comm Buff, RTU-to-RTU Controls, Tx Event, Tx Burst, and Event Definitions.
Communication Functions available via the CALL Function

Data transfer between RTUs and event reporting to the central are supported by the following
functions that are executed by the CALL output operator:
• SndFrm (Send Frame): Transmission of an MDLC frame initiated by the RTU to another
RTU. Answer is required. Appropriate when the data is being relayed through other sites
(i.e. when Source/Destination sites are not the From/To sites.)
• AnsFrm (Answer Frame): Answering of an MDLC frame in response to another RTU
transmission. Appropriate when the data is being relayed through other sites (i.e. when
Source/Destination sites are not the From/To sites.)
• RcvFrm (Receive Frame): Reception of an MDLC frame transmitted by another RTU.
181
• TxFrm (Transmit Frame): Transmission of an MDLC frame initiated by the RTU to

another RTU. No answer is required. No retries are initiated at the application level.
Usually appropriate when the data is being sent directly to the destination site.
• TxEvnt (Transmit Event): Transmission of an event to the central (IGC/M old central).
• Burst (MOSCAD ≥ V1.44, MOSCAD-L ≥ V1.00): Transmission of data to the central. An ACK is
only sent if the appropriate Data-Ack from central Advanced Parameter is set.
• SndSeq (Send Sequence) (MOSCAD ≥ V3.00, MOSCAD-L ≥ V1.00): Sequential transmission of
MDLC frames initiated by the RTU to another RTU. No Ack is sent.
• GetSeq (Get Sequence) (MOSCAD ≥ V3.00, MOSCAD-L ≥ V1.00): Sequential reception of
MDLC frames transmitted by another RTU. No Ack is sent.
• BrsSeq (Burst Sequence) (MOSCAD ≥ V3.70, MOSCAD-L ≥ V1.00): Sequential transmission of
data bursts to a central.
Site table
In the Site table, you should define all the RTUs which perform RTU-to-RTU communication,
and the centrals to which you want to send events. The Site table includes four columns/fields,
as detailed below:
• Site Name – symbolic name of the RTU or group of RTUs.
• Site ID – the RTU Site ID as defined in the Site Configuration program.
182
• Link ID – the link through which the RTU is connected to the network. Pressing [Enter]
when the cursor is in this field will display a choice list.
• ComFal (MOSCAD ≥ V1.44, MOSCAD-L ≥ V1.00) – indicates if communication to this site

exists. When the site comes up or when communication to the site is initiated (SndFrm,
Burst, SndSeq, GetSeq, BrsSeq), the ComFal bit is set to ‘0’. If no ACK is received, even
after retries at all level of communications have been exhausted, the ComFal bit is set to
‘1’(SndFrm, Burst only). Any subsequent communication with the same site that succeeds
resets the ComFal to ‘0’ (SndFrm, Burst, SndSeq, GetSeq, BrsSeq). Note that in cases of
serial transmissions to the same site, the ComFal will continuously be reset, and the Error
bit in the SndFrm routine should be used. (See Transmit Mode below.)
The site names defined in this table should be used when writing rungs. The system will
communicate with the RTUs according to the Site IDs and Link IDs defined in this table.
The first row in the table, Cntral (for central), is the system default central (IGC/M old central
only). If the system includes several centrals that are designated to receive events, they should
be defined in this table: the central symbolic name and the Site ID and Link ID of the
RTU/FIU connected to that central.
In this table, you may also define names of groups for transmitting broadcasts (do not confuse
RTU-to-RTU communication broadcast with broadcasts that are sent from the central to a
group of RTUs according to qualifiers). To define a broadcast, define the Site ID as 0. The
Link ID should be the link name to which the broadcast is to be transmitted. To send a
broadcast to all RTUs in the system, the Link ID should be ALL_LINKS (selected from the
choice list).
When Site ID = 0, all RTUs in the specified link (or all RTUs in the system if Link ID =
ALL_LINKS) will receive the transmitted frame. You may add conditions to the transmitted
frame by using the variables of the Qualifiers table. In this case, only the RTUs that fulfill the
conditions will refer to the transmitted frame.
When using the Site_ID variable for setting the DstSit or for comparison with SrcSit, the
Database Table Monitoring mode will display the Site_ID index in the Site table and not its
real value. This is different from other variables in order to make the communication more
efficient without wasting time on the conversion of indices to names.
183
RTU-to-RTU Communication
RTU-to-RTU communication consists of transferring information between an application
defined for one RTU and another application defined for a parallel RTU. When configuring
the RTU application, the user should update the applicable tables previously defined.
The RTU-to-RTU communication includes a frame transmission (of Origin type or FrmSeq –
see Receive Variables in this chapter) from RTU A to RTU B and a frame transmission (of
Answer type – see Receive Variables in this chapter) from RTU B to RTU A, with or without
data as an acknowledgment.
Note that you may also send a broadcast from RTU A to a group of RTUs. There is no
acknowledgment.
RTU-to-RTU Comm Buff / RTU-to-RTU Controls Tables

The communication between RTUs is carried out by the RTU-to-RTU Controls and the RTU-
to-RTU Comm Buff tables, which include buffers for transmission and reception (TxBuf and
RxBuf). Data is transmitted by inserting it into the TxBuf and calling the SndFrm, AnsFrm,
TxFrm or SndSeq functions. The data received by the RcvFrm or GetSeq functions is stored in
RxBuf.
Last Index (BufEnd)

The Last Index (BufEnd) defines the size of the transmit/receive buffers – the maximum
number of values (up to 80) to be transmitted/received. The buffers consist of values, each
comprised of 16 bits.
184
Transmit Variables
DstSit (Destination Site): The name of the addressed RTU, as defined in the Site table. The
DstSit variable is used only by the SndFrm and SndSeq functions.
Tx_Len (Transmit Length): The number of values to be transmitted. This number must be
between 1 and the number of values defined in the buffer. After the frame is taken by the
system, the system clears Tx_Len variable to 0. Otherwise, it means that the queue is full.
TxBuf (Transmit Buffer): Up to 80 variables that are the transmit buffer. Use the MOVE or
CPY operators to insert the variables into the TxBuf (you may use indexes).
Receive Variables
ScrSit (Source Site): After calling the RcvFrm or GetSeq functions, this variable receives the
name of the transmitting RTU. The site identification is performed by comparing the RTU
name (in the SrcSit variable) to the RTU names defined in the Site table (see Site table in this
chapter).
FrmTyp (Frame Type): When a frame is received, this variable is updated according to the
type of frame received. There are six types of frames in the RTU-RTU Frame Types table (one
of the Constants Tables), as follows:
• Origin – For a frame that has been transmitted by the SndFrm function from the other
RTU. An answer is required.
• Answer – For a frame that has been transmitted by the AnsFrm function from the other
RTU. No answer is required.
185
• GrpCal – For a frame that has been transmitted by the TxFrm/ SndFrm function from the
other RTU. No answer is required.
• Messag (MOSCAD ≥ V1.61, MOSCAD-L ≥ V1.00) – For a frame that has been transmitted by
the TxFrm function from the other RTU. No answer is required.
• NO_Ans – When the RcvFrm function is activated and the addressed unit has not
answered, SrcSit receives the index of the unit and Rx_Len is reset to 0.
• FrmSeq (MOSCAD ≥ V3.00, MOSCAD-L ≥ V1.00) – For a frame that has been transmitted by
the SndSeq function from the other RTU.
Rx_Len (Receive Length): The number of values received (up to 80). When the frame is
received by the RcvFrm or GetSeq functions, the Rx_Len variable is set to the number of
values received by the buffer. If no frame is received Rx_Len is reset to 0.
RxBuf (Receive Buffer): Up to 80 variables that are the receive buffer.
If a frame of Origin type is received, a frame of Answer type should be sent as an

acknowledgment. If there is no data to send back, you should send a frame (of one value) as an
acknowledgment. If such a frame is not transmitted as an answer, the frame of Origin type will
be retransmitted.
Transmit Mode
The transmission is performed through the RTU-to-RTU Controls and RTU-to-RTU Comm
Buff tables. The user should write rungs to set the destination site name (DstSit variable), the
Tx_Len (number of values to be transmitted in the frame), and move the values to be
transmitted by the MOVE/CPY operators, to the corresponding variables in TxBuf.
The transmission is initiated by calling the SndFrm function.
SndFrm
( CALL )
<Error>,n
After calling the SndFrm or SndSeq functions, the Tx_Len variable should be checked. If this
variable has been reset to 0, it means that the frame has been queued for transmission. If it has
remained the same, it means that the frame has not been taken for transmission because the
internal buffers are full. In this case, you should retry sending the frame after a period of time
(by using a timer).
In case of failure, such as faulty addressed RTU, or if no Ack is received, the bit (<Error>,n)
specified by the user below the CALL operator is set to ‘1’ to indicate a failure. Note that this
bit is reset to ‘0’ at the beginning of the transmission routine. You should select the name of
the variable (after defining it in the database). You also can define a column for these error
bits and use an index (e.g. Err,x) to indicate an error for each RTU.
This Error bit is useful when several transmissions are to be sent to the same site. Because the
ComFal bit defined in the Site table for each site is reset to 0 each time transmission is
initiated, the Error bit in the SndFrm function can be used to track the status of each
186
transmission to the site, rather than the status of the site itself. Otherwise, the behavior of the
error bit is exactly like that of the ComFal bit (see Site table above).
Another transmit function, TxFrm can be used in RTU-to-RTU communications. TxFrm,

unlike SndFrm, does not perform retries on the application level and does not require an
answer. This function is appropriate when the transmitting site is also the Source site and the
receiving site is the Destination site (i.e. when the data is not being relayed through other
sites.) The one exception to this is when the Destination is a Dual CPU. In this case, if the
CPU is secondary/not active, it can only react (Answer) and cannot initiate transmission.
Therefore, SndFrm/Answer should be used.
Receive Mode
The receive function is carried out by using one of the following rungs:
RcvFrm
( CALL )
GetSeq
( CALL )
When a frame is received, the Rx_Len variable is set by the system to the number of values in
the received frame, and the SrcSit variable is set to the name of the transmitting site. The
transmitting site name (SrcSit) should be checked by comparing it (using comparator
elements) to the site names defined in the Site table. The frame type should be compared to the
frame types defined in the RTU-RTU Frame Types table.
If no frame has been received, the function is returned with Rx_Len=0.
If the transmitting site is not defined in the Site table, the frame is received by the system and
SrcSit = -1.
To answer a call initiated by another RTU, the answering function is carried out by using the
following rungs:
DstSit
( MOVE )
SrcSit
Tx_Len
( MOVE )
#1
AnsFrm
( CALL )
DstSit should receive the SrcSit from which the Origin frame has been sent. Tx_Len should be
assigned the value of 1 even if there is no data to transmit (used as an acknowledge).
The AnsFrm function is identical to the SndFrm function except that the error bit name is not
included.
The answer frame is transmitted to the site that sent the frame of Origin type.
187
Sequential Frame RTU-to-RTU Communication

When using regular RTU-to-RTU communication, transmitted frames are not guaranteed to be
received in their original transmit order because of the unknown number of retries and
acknowledgments. It is the application’s responsibility to rearrange the data in its logical
order.
In some applications, such as file transfer, it is important to receive frames in their original
order. The system features a unique sequential frame RTU-to-RTU communication (SndSeq
and GetSeq functions) which does not use retries and acknowledgments. This type of
communication re-arranges the frames at the receiving site in their original transmit order.
Every transmitted frame is assigned a sequential number, which is used at the receiving site to
re-arrange the frames by means of an internal buffer.
Following is an example of a site that transmits frames in Sequential Communication, to Site2
and Site3. A counter is included in TxBuf,0 to allow the application at the receiving site to
check the numbering of the received frames.
The rungs at the transmitting site are as follows:
188
Cnt1
CntUp ( CTU )
Cnt1 Send
= ( JMP )
defBIG
( RET )
Tx_Len
Send ( MOVE )
#10
DstSit
( MOVE )
Site2
PushB1 SndSeq
( CALL )
PushB2 DstSit
( MOVE )
Site3
SndSeq
( CALL )
P1
( RST )
TxBuf,0
( CTU )
RTU Event/Burst Reporting
TX Event Table
Transmitting an event (including the data and time of occurrence) to a central (IGC/M old
central) is performed by the variables defined in the Tx Event table.
189
The Tx Event table includes the following variables:
Event: This variable should be loaded with the name of the event to be transmitted by using the
MOVE operator. The event names are defined by the user in the Event Definitions tables.
After calling the TxEvnt function, check if this variable has been reset to 0. If it is reset, it
means that the event has been sent. If not, try to resend it after a period of time (by using a
timer).
EvIndx (Event Index): This index, attached to the event, provides additional information on the
event. For example, refer to a pump table of five rows defined for five pumps. If a failure
(defined as PmpFal) has occurred then the EvIndx can be used to indicate the row number
(pump) that has failed.
ESite (Event Site ID): This variable should be loaded with the name of the central site to
which the events are to be transmitted. If the system includes several centrals, then the Site ID
and Link ID of the RTU/FIU to which each central is connected, should be defined in the Site
table. If you wish to transmit only to the active central (default central), you should use the
Cntral name that appears in the first row of the Site table, and check that DefC_Y=1 and not 0
(IGC/M old central only).
EPrtID (Event Port ID): The central is usually connected to one of the FIU ports (in some
cases directly to an RTU). Since the event is transmitted to the FIU address, the port should
also be specified. This variable should be loaded with one of the following values: Comp_1 or
Comp_2 (refer to the MDLC Port ID’s table in the Constants Tables menu). If the ESite
variable is defined as the default central (the first line in the Site table), you should not refer to
the EPrtID variable (IGC/M old central only).
190
Event Definitions 1 and Event Definitions 2 Tables

These two identical tables enable the user to fill in event definition names (the code values are
automatically inserted for each name, but you can manually change them) that includes several
event name examples. These event names are automatically transferred to the central by the
Central File and may be used in the central without the need to redefine them.
Use the MOVE operator to move an event name to the Event variable prior to calling the
TxEvnt function.
Do not use the first entry (index=0), since after calling the TxEvnt function, this value is reset
by the system to 0, indicating that the event has been transferred to the transmission queue.
TxEvnt Function
To send an event, you should enter the values into the Tx Event table variables by the MOVE
operator and call the TxEvnt function – refer to the following rungs as an example.
ESite
( MOVE )
Cntral
Event
( MOVE )
PmpFal
EvIndx
( MOVE )
I
DefC_Y TxEvnt
(CALL)
<Error>,x
In this example, the I index indicates the number of the failed pump.
If all events are to be transmitted to the same central, then you should activate the first two
rungs only once since the ESite and EprtId variables will not change.
After calling the TxEvnt function, you should check that the Event variable has been reset, as
indication that the event has been taken by the system for transmission. If the Event variable
191
has not been reset, it means that the event has not been taken for transmission (all buffers are
full). In this case, you should try resending the event after a period of time (by using a timer).
The RTU sends the event through the communication network to the central and receives an
acknowledgment for the event from the central.
If the event has not been acknowledged after a specific number of retries, the system will set a
bit (<error>,n; defined by the user), to indicate that the event has not been acknowledged by
the central.
Data Burst Table

Transmitting data (a row of a table) from an RTU to the central (MCP-M or IP Gateway) is
performed by the variables defined in the Data Burst table.
The Data Burst table includes the following variables:
BSite: The name of the central site (MCP-M or IP Gateway) to which the data is to be
transmitted. If the system includes several centrals, then the Site ID and Link ID should be
defined in the Site table.
BPrtID: If the central (IGC/M old central) is connected to one of the FIU ports (in some cases
RTU). Since the data is transmitted to the FIU address, the port should also be specified. This
variable should be assigned one of the following values: Comp_1 or Comp_2 (refer to the
MDLC Port ID’s table in the Constants Tables menu). If the BSite variable is defined as the
default central (the first line in the Site table) or MCP-M, you should not refer to the BPrtID
variable (IGC/M old central only).
BStat: After calling the Burst function, you should check the BStat variable. When the data
burst is taken for transmission into one of the system buffers then BStat=0. When there is no
free buffer, the burst data will not be transmitted and BStat=1. If the burst data is not
transmitted, try to resend it after a period of time (by using a timer).
In case of a burst transmission, the RTU can transmit data equivalent to one complete row of a
table or multiple rows of the same scan that have fit in one communication buffer. The table
name and row number must be specified in the process programming.
192
Burst Function
To transmit data from an RTU to the central you should specify the name of the central to
which the data is to be transmitted, and define the data to be transmitted (table symbol and row
number) – refer to the following rungs as an example.
BSite
( MOVE )
Cntral
DefC_Y Burst
( CALL )
Tbl,I
Tbl is the data table symbol and I is the row number index.
After calling the Burst function, check the Bstat variable to see if it equals ‘0’. If Bstat=0, that
does not necessarily mean that the burst transmission has been received by the central. To
ensure that the burst transmission has been received, check the ComFal bit in the Site table
after a period of time. If ComFal=1, it means that the central has not received the burst
transmission. If ComFal=0, it means that the central has received the burst transmission.
Note that the Burst function will only raise the ComFal bit if the Application Data-Ack from
Central parameter (in Site Configuration Advanced Parameters) is enabled.
The line of data to be transmitted (table, row #) is typically much smaller than the size of a
frame (160 bytes). Therefore the system has the ability to send multibursts, i.e. several lines of
data in one burst, to a given unit. The actual transmission will take place either:
1. when the frame is full,
2. when the scan of the ladder ends,
3. when the scan time is so long that it exceeds the timeout for sending (as defined by the
system.)
Both MCP-M and IP Gateway can handle single or multibursts without any special
notification.
The BrsSeq function, like the Burst function, can send single or multibursts, though it differs
from Burst in that it does not send Ack and cannot raise the ComFal bit.
193
The rung at the receiving site is as follows:
GetSeq
( CALL )
Example of RTU-to-RTU Communication

The following example is an application of RTU-to-RTU communication, designed to evaluate
the communication between two sites, named Site A and Site B. Database definitions and
rung processes are included.
Site A initiates, at definite intervals, a value transmission to Site B. Site B, after receiving the
value, is supposed to transmit back the same value to Site A.
Each transmission, initiated by Site A, is conditioned on the success of the previous

transmission cycle. Any failure in the communication should stop the system, and show the
failure cause. Site A increments the transmitted value when starting a new cycle.
It is possible to get a printout of the number of transmissions and receptions that Site A has
performed at any time by pressing the PRINT push-button.
The RESET push-button allows the restarting of the application (as well as when the system
has stopped).
Site A Database
Internal Values
The following value variables are used in the process programming:
• TxVal – the transmitted value
• RxVal – the received value
• TxCntr – counts the number of transmissions
• RxCntr – counts the number of receptions
• BsyTry – counts the number of retries if the value is not taken for transmission (no free
buffers in the transmit queue)
These variables are defined in one of the User tables, named Internal Variables table
(“Integer Value” data type).
194
Communication Constants
Three constants, #0, ONE, and N are also used in the process programming. They are defined
in one of the Constant tables, named Comm Constants table.
Communication Timers
Two Seconds timers are used in the process programming, as follows:
• TryDly – timer of 1:00 second used in case the value has not been taken for transmission
• Cycle – timer of 30:00 seconds, a complete transmission cycle
These timers are defined in one of the User tables, named Comm Timers.
195
Discrete Inputs
Two discrete inputs, RESET and PRINT, are used in the process programming. They are
defined in one of the User tables, named Buttons table.
Discrete Outputs
The following discrete outputs (LEDs), defined in one of the User tables, named LEDs table,
are used in the process programming:
• TxOn – transmit indicator
• BsyFal – indicates that the value has not been taken for transmission
• TxFail – indicates that acknowledgment has not been received
Sites
Site B (the name of the site that Site A communicates with) should be defined in the Site table
(one of the System tables).
196
Site A User Rungs

Cycle TxVal TxVal

Prepar / = ( CTU )
RxVal
TxBuf,0
( MOVE )
TxVal
DstSit
( MOVE )
Site_B
Tx_Len
( MOVE )
ONE
BsyTry
( MOVE )
N
Cycle
( DOF )
The Prepar rung checks if a new cycle is to be started according to the Off Delay timer of
30:00 seconds. The transmission of another value is disabled by this timer during the
transmission cycle. The rung also verifies that no failures have occurred by comparing TxVal
and RxVal. If they are not equal, it means that a failure has occurred.
If a new value is to be transmitted, then TxVal is advanced by the CTU operator and its value
is assigned to TxBuf,0 for transmission. Site_B is moved to the DstSit variable to specify the
destination site. Tx_Len receives the value ONE (one value is to be transmitted), and BsyTry
receives the value of N, which indicates the number of retries in case the value is not taken for
transmission.
197
BsyTry TryDly SndFrm

Trnsmt > / ( CALL )
#0 TxFail
BsyTry
( CTD )
Tx_Len BsyTry
= ( RST )
#0
TxCntr
( CTU )
Tx_Len TryDly
≠ ( DOF )
#0
TxOn
( )
BsyTry Tx_Len BsyFal

= ≠ ( L )
#0 #0
Tx_Len
( RST )
The Trnsmt rung calls the SndFrm function until BsyTry is 0 (the value has been transmitted).
The TxOn LED is lit by the relay on element. The rung checks that the TryDly is not on (delay
between retries). The transmission is then enabled by calling the SndFrm function. TxFail will
be set to ‘1’ in case of failure. BsyTry is decreased (the value has been transmitted once).
If the value has been taken for transmission (Tx_Len=0), BsyTry is reset to 0 (to prevent
calling the SndFrm function) and TxCntr (counts the number of transmissions) is advanced.
If the value has not been transmitted (Tx_Len≠0 ), the Off Delay timer TryDly is activated.
If all retries have been performed (BsyTry=0) and the value has not been transmitted
(Tx_Len≠0), the BsyFal LED is lit and Tx_Len is reset to 0.
RcvFrm
Receiv ( CALL )
Rx_Len SrcSit FrmTyp RxVal

≠ = = (MOVE)
#0 Site_B Answer RxBuf,0
RxCntr
( CTU )
The reception is carried out by calling the RcvFrm function. If a value has been received, and
Rx_Len is not 0, the SrcSit (transmitting site) is Site_B, and the received frame is of Answer
type (FrmTyp=Answer), then RxBuf,0 (the received value) is moved into the RxVal variable.
Rx_Cntr is advanced.
198
RESET
( SCAN )
RESET Report
/ ( JMP )
TxVal
( RST )
RxVal
( RST )
TxCntr
( RST )
RxCntr
( RST )
BsyTry
( RST )
Tx_Len
( RST )
BsyFal
( U )
TxFail
( U )
PRINT USER_1
Report ↑ ( SEND )
No. of transmitted frames = <TxCntr>

No. of received frames = <RxCntr>
Tx Value = <TxVal> Rx Value = <RxVal>
TxOn
( SCAN )
The buttons are scanned by the SCAN operator. If the RESET button is pressed, all variables
(TxVal, RxVal, TxCntr, RxCntr, BsyTry, Tx_Len, and Rx_Len) are reset to 0. If the PRINT
button is pressed, the message in the window will be sent to the screen. Note that since there
are no codes in the window, the message will be displayed in scroll mode.
Site B Database
Internal Values
The BsyTry value variable is used in the process programming. This variable counts the
number of retries in case the value is not taken for transmission. It is defined in one of the User
tables, named Internal Variables table.
199
Communication Constants
Three constants, #0, ONE, and N are also used in the process programming. They are defined
in one of the Constant tables, named Comm Constants table.
Communication Timers
A Seconds timer, TryDly, is used in the process programming. This timer is of 1:00 second
and is used in case the value has not been taken for transmission. It is defined in one of the
User tables, named Comm Timers table.
Discrete Outputs
The following discrete outputs (LEDs) are used in the process programming:
• TxOn – transmit indicator
• BsyFal – indicates that the value has not been taken for transmission
These discrete outputs are defined in one of the User tables, named LEDs table.
200
Sites
Site A should be defined in the Site table (one of the System tables).
201
Site B User Rungs

BsyTry RcvFrm
Receiv = ( CALL )
#0
Rx_Len FrmTyp TxBuf,0

≠ = ( MOVE )
#0 Origin RxBuf,0
Tx_Len
( MOVE )
ONE
BsyTry
( MOVE )
N
The first rung checks that the unit is not transmitting (BsyTry=0) before calling the RcvFrm
function. Then, if Rx_Len≠0 (a frame has been received) and the received frame is of Origin
type, then the received value (in RxBuf,0) is assigned to TxBuf,0 (for transmission, Site B
transmits back to Site A the same value). Tx_Len is set to ONE and BsyTry is set to N (10).
BsyTry TryDly AnsFrm
Trnsmt > / ( CALL )
#0
BsyTry
( CTD )
Tx_Len BsyTry
= ( RST )
#0
Tx_Len TryDly
≠ ( DOF )
#0
TxOn
( )
BsyTry Tx_Len BsyFal

= ≠ ( L )
#0 #0
Tx_Len
( RST )
TxOn
( SCAN )
The Trnsmt rung transmits the value until BsyTry is 0. The TxOn LED is lit by the relay on
element. The rung checks that TryDly is not on (delay between retries). The transmission is
then enabled by calling the AnsFrm function. BsyTry is decreased (the value has been
transmitted once).
If the value has been transmitted (Tx_Len=0), BsyTry is reset to 0.
If the value has not been transmitted (Tx_Len≠0), the Off Delay timer TryDly is activated.
When the timer is on, the value is not transmitted (because of the Normally Closed element
applied on TryDly).
202
If all retries have been performed (BsyTry=0) and the value has not been transmitted
(Tx_Len≠0), the BsyFal LED is lit and Tx_Len is reset to 0.
203
Accessing Database Variables via
Coordinates
This feature is available in ToolBox versions ≥ V2.00.
One of the most important features of the RTU is its database structure and concept (refer to
Database Concept). The RTU database is divided into reserved and user-defined
variables/constants, arranged according to various data types (such as discrete inputs/outputs,
value inputs/outputs, timers, parameters, etc.)
The application database is built as a set of tables, where each table defines a group of devices,
each row defines a separate device and each column contains a specific device data. The table
entries are assigned user-significant names, such as PUMP1.
Since database variables are assigned meaningful logical names, it is very easy to build,
understand and modify the database.
Two functions, FETCH and STORE, are available for accessing database variables also via
coordinates. Every database variable can be accessed by the following three coordinates:
• Z coordinate (Z=0,1,...,126) is the user table number in the RTU database
• Y coordinate (Y=0,1,...,249) is the row number in the user table that appears under the
index (Ind) column
• X coordinate (X=0,1,....,7) is the column number in the user table.
This way of accessing database variables may be useful for mapping the database of one RTU
into another RTU using user protocols (which use coordinates to access database variables
rather than logical names).
204
Accessing Database Variables via Coordinates
Definitions
Using the FETCH and STORE functions requires the definition of a single-column user table
of integer value type, with the following variables.
Note that the order of the variables in the table is mandatory. The variable names shown in the
table are recommended.
The first three values (Table#, Row# and Column#) represent the coordinates of the required
variable in the database. They must be set by the user before calling the FETCH or STORE
functions.
The FETCH/STORE call return code will be returned in the RetCod variable, as follows:
0 – OK
1 – spare
2 – invalid Z coordinate
3 – invalid Y coordinate
4 – invalid X coordinate
When calling the FETCH function, the required data will be put in Data0/ Data1 variables
according to the data type (specified by the ColTyp variable), as follows:
• If the data is of Bit type (ColTyp=1), the data will be put in Data0 variable according to the
following:
– If the data is 0, then Data0=0x0

– If the data is 1, then Data0=0xFFFF
• If the data is of Value type (ColTyp=2), the data will be put in Data0 variable.
• If the data is of Floating Point type (ColTyp=4), the data will be put in Data0 and Data1
variables.
Before calling the STORE function, the data to be stored in the database must be set as follows:
205
Accessing Database Variables via Coordinates
• If the data is of Bit type (ColTyp=1), the data must be put in Data0 variable according to the
following:
– If the data is 0, then Data0=0x0

– If the data is 1, then Data0=0xFFFF
• If the data is of Value type (ColTyp=2), the data must be put in Data0 variable.
• If the data is of Floating Point type (ColTyp=4), the data must be put in Data0 and Data1
variables.
For example, to store the value of fl1 (floating point variable) in the Z0,Y0,X0 coordinates, the
following rungs should be used:
Table#
( MOVE )
Z0
Row#
( MOVE )
Y0
Colmn#
( MOVE )
X0
C Data0
P fl1
Y #4
Store
( CALL )
Table #
#4 is a constant defined in a Constants table. Its value is 4 (4 bytes*8=32 bits).
206
X.25 Protocol Support
This feature is available in ToolBox versions ≥ V3.00, but the option, named X.25 option for
ToolBox, must be purchased separately. A separate license is required for each RTU which
uses the option.
This chapter refers to MOSCAD and MOSCAD-L.
The X.25 protocol is available in the X.25 Service Provider configuration, for establishing a
MOSCAD MDLC-based network (as the X.25 Packet Private Network) which provides X.25
services for user computers and/or user X.25-based RTUs. The protocol is also available in
X.25 Service User configuration, for communicating between MOSCAD RTUs as DTEs over
existing X.25 networks based on non-MOSCAD Packet Switching Equipment (PSE).
Service Provider Configuration

In this configuration (shown in the figure below), the user DTE (Data Terminal Equipment) is
connected to a MOSCAD MDLC-based Packet Data Network, rather than to an X.25-based
Packet Data Network.
DTE
X.25 X.25
DTE
MOSCAD
MDLC-based
X.25 Network
X.25 X.25
RTU
DTE
The MOSCAD MDLC-based Network is comprised of MOSCAD RTUs communicating over

various communication links, such as: conventional radio, trunked radio, microwave, etc.
The MOSCAD RTUs operate as the DCE (Data Communication Equipment), representing the
network's interface to the user DTE. (If needed, the MOSCAD RTU port may be configured as
a DTE).
207
Each DTE is connected to a port of a MOSCAD RTU that is configured to support X.25
protocol.
An example of such a network is shown in the following figure:
DTE
X.25
MOSCAD
RTU RADIO
MDLC -based
X.25 Network
MOSCAD MOSCAD
RTU RADIO . . . . . . RADIO
RTU
X.25 X.25
RTU
DTE
The following figure describes an example of expanding an existing X.25 network with
MOSCAD RTUs. In this example, the MOSCAD RTUs are used as a communication media
for DTEs (highlighted in the figure) that cannot be connected via line.
208
DTE
X.25
X.25
Packet Data
Network
X.25
X.25
DTE
MOSCAD
RADIO
RTU
MDLC
DTE
MOSCAD
RADIO RTU X.25
X.25 Service User Configuration

In this configuration (shown in the figure below), the MOSCAD RTUs act as DTE (Data
Terminal Equipment), connected to an X.25-based Packet Data Network with Packet Switching
Equipment (PSE) rather than to a MOSCAD MDLC-based Packet Data Network.
209
MOSCAD RTU
( DTE )
X.25
(DCE)
Third Party X.25
Provider
X.25 X.25
MOSCAD RTU
( DTE ) MOSCAD RTU
( DTE )
Site Configuration
The Site Configuration program includes two levels of definitions for X.25 support, as follows:
• Service Configuration: the type of connection and related parameters (logical definition)
• RTU Port Configuration (physical definition)
The logical definition is carried out via the System option, and the physical definition is carried
out via the Ports option of the Site Configuration program. Note that the system cross-checks
both definitions for conflicts (appropriate messages are displayed).
X.25 Service Configuration

Before configuring the ports for X.25 support, the type of connection and related parameters
must be defined. To define the type of connection:
1. Access the Site Configuration program.
2. Open the site configuration file and click on the X.25 tab.
3. Double-click on the X25 Type button and open the X25 Support drop-down list. The
following screen is displayed:
210
The options support various configurations, as detailed below:
a) Service Provider, 1 to Many, Master - for the MOSCAD RTU to which the Host/PSE
(Packet Switching Equipment ) is connected.
b) Service Provider, 1 to Many, Slave - for the MOSCAD RTUs to which the user's DTEs
are connected.
c) Service User - for the MOSCAD RTUs that act as DTEs.
X.25 Service Provider

In the figure below, there are two types of MOSCAD RTUs defined as Service Provider:
MOSCAD RTU as Master and MOSCAD RTU as Slave.
HOST / PSE
Service Provider, 1 to Many, Master

X.25 X.25 Protocol MOSCAD RTU as DCE
X.25-MAIN
MOSCAD
RTU
as RADIO
Master
MDLC -based
X.25 Network
MOSCAD MOSCAD
RTU RTU
as RADIO . . . . . . as RADIO
Slave Slave
X.25 X.25
Service Provider, 1 to Many, Slave

DTE
X.25 Protocol MOSCAD RTU as DCE
X.25-P1
RTU
211
a. Service Provider, 1 to Many, Master
For the MOSCAD RTU defined as Master (the MOSCAD RTU that is connected to the
Host/PSE), select the Service Provider, 1 to Many, Master option - the following is displayed:
You have to define the following:
Number of Slaves: Range: 2 - 250.
The number of slaves connected to the X.25 network.
Number of Logical Range: 1 - 16.

Channels per Slave:
The maximum number of logical channels at the Master
per Slave.
212
Master/Slave Address: Format: 1234567890SS** where,
The first part of the address (1234567890) defines the

logical address of the Master. If the address of the
received frame is equal to the logical address of the
Master, then the frame is sent to one of the Slaves
(MDLC). If the address of the received frame is not equal
to the logical address of the Master, then the frame is sent
to the Host/PSE.
The second part of the address (SS) defines the routing.

For example, if the Master/Slave Address has been
defined as 123456789[SS][**] and the received address is
123456789[001][15], then the routing is to station 001
(this is a pointer to the Site table). The routing is
performed only if the first part of the defined and
received addresses are identical.
The third part of the address (***) is not relevant for the
Master.
213
b. Service Provider, 1 to Many, Slave
For the MOSCAD RTUs defined as Slave (the user's DTE/RTU are connected to these
MOSCAD RTUs), select the Service Provider, 1 to Many, Slave option - the following is
displayed.
You have to define the following:
Number of Logical Range: 1 - 16.

Channels:
The maximum number of logical channels per Slave.
Port Address Field: Format: ************P*
The port address field.
Note that the Master/Slave Address and Port Address Field definitions must match - the length
of the third part of the address must be identical. For example, if the Master address is
123456789SS[**], then the corresponding port address is ************[P*].
Note also that the value of P must correspond to the port name of one of the X.25 ports (X25-
P1, X25-P2, etc.)
RTU Port Configuration

Ports 1 and 3 may be defined as X.25 ports. The definition for both ports is identical except for
the Physical Interface that cannot be modified for Port 1. It is set to: X.25 Protocol MOSCAD
RTU as DCE with TxClk Input.
214
Port 1 or Port 3 define the Port Interface as X25 PROTOCOL (RS-232, Sync, X.25). The
resulting User parameters are:
Port Type/Connection Mode: RTU as DTE, RTU as DCE, RTU as DCE with TxClk Input
(only for Port 3).
Default: RTU as DCE.
This field defines the physical interface between the RTU and
the user's DTE.
RTU as DTE: the Programmable RS232 plug-in module
receives the TxClk and RxClk clocks from the DCE.
RTU as DCE: the Programmable RS232 plug-in module
provides the TxClk and RxClk clocks to the DTE.
RTU as DCE with TxClk Input: the Programmable RS232
plug-in module provides the TxClk clock to the DTE and
receives the RxClk clock from the DCE. Note that this is the
default physical interface for Port 1.
Port Name: X.25-MAIN, X.25-P1, X.25-P2, X.25-P3,
X.25-P4, X.25-P5
X.25-MAIN: In Service Provider configuration, the port of the
RTU as Master that is connected to the Host/PSE must be
defined as X.25-MAIN.
X.25-MAIN: In Service User configuration, this is the port of
the RTU which is connected to the external X.25
communication provider (Third Party).
X.25-P#: In Service Provider configuration, the port of the
RTU as Slave that is connected to the DTE/RTU must be
defined as X.25|P1 to X.25-P5.
Link Name: Range: X25 1 to X25 3
215
Default: X25 1
Data Speed: Range: 300 to 9600 Bd
Default: 9600 Bd
No. of Tx Retries: Range: 1 to 9
Default: 1
The number of times that a message is automatically
retransmitted if it has not been acknowledged. Type in the
desired value and press [Tab] to advance to the next field.
Logically Defined as: Range: DTE, DCE
Default: DTE
The RTU may be logically defined either as DTE or DCE,
according to the user equipment.
Description: A free-format field.
After entering all your selections, click the OK button to return to the Ports List table. Note that
the table has been updated according to your entries.
216
X.25 Service User

For the MOSCAD RTUs serving as DTE, select the Service User option when configuring the
port in the Site Configuration. If you are using Port 1 as the X.25 port, define it as shown
below. Be sure to set ‘Logically defined as’ to DTE.
If you are using Port 3 as the X.25 port, define it as shown below. Be sure to set ‘Logically
defined as’ to DTE.
For a description of the parameters for Port 1 and Port 3, see RTU Port Configuration above.
Next click on the X.25 tab and double-click on X.25. The following is displayed.
217
You must define the following parameters. The third parameter defaults to 60 seconds, but this
can be changed, if desired.
Number of SVC’s to Range: 0 - 250. Default = 3

other MOSCAD units:
Switched Virtual Circuits (SVCs).
Number of PVC’s to Range: 0 - 250. Default = 0

other MOSCAD units:
Permanent Virtual Circuits (PVCs).
Double-click on Advanced Flow and you will get the screen below with Logical Channel
parameters.
218
All the parameters can be left at their default values, except the following parameter:
NO ack (RR) over Default = Without ACK

MDLC’
Set this to With ACK
Scroll down in the Advanced Flow window and more parameters will be displayed (Logical
Channel continue/LAPB).
You should change the following parameter:
Inactivity Timer Default = 0 (off) 0-3000 *100ms
Set this to 1.
The Advanced timers/heap tab shows more parameters which may be left at their default
values.
X.25 Address Table Definition (X.25 Service User Only)
In order to enable communication between MOSCAD RTUs over X.25 networks, the Sites and
their X.25 addresses must be defined and downloaded to the units. This is done using the X.25
Address Table tool. To start the program, double-click the X.25 Address Table icon in the
MOSCAD Programming ToolBox folder. The following screen is displayed.
219
The dialog opens with an empty X.25 address table. You can define a new table or load an
existing one and type in changes or additions.
The following is the list of the available command icons.
Icon Corresponding menu command
File menu, New command
File menu, Open command
File menu, Save command
Edit menu, Cut command
Edit menu, Copy command
Edit menu, Paste command
File menu, Print command
File menu, Download command
File menu, Upload command
Edit menu, Insert Site command
220
Edit menu, Delete Site command
Edit menu, Delete Group of Sites command
Edit menu, Sort by Site ID command
File menu, Abort command

Site ID
Type or edit the Site ID of the unit.
X.25 Address
You can enter up the X.25 address for each site. The address can hold up to 14 characters. The
valid characters are: 1234567890.
File Menu
You can perform all the basic file operations using the commands of the File menu. After
opening the menu, the following commands are displayed:
New
The New command clears the current address table from the dialog. If you have made changes
without saving them, the tool asks you if you want to save the file. Then it opens a new address
table file.
Open
The Open command opens an existing address table. After activating this command, the tool
displays the Open dialog box, as shown below.
221
The Open dialog box defaults to the config sub-directory of the ToolBox (tbox954) directory,
and to the .x25 type files (address table files). The config sub-directory is where ToolBox
stores address table files by default.
Select the address table file (see parameters below) and click OK to load it.
Use the parameters in the order specified below. Normally you’ll only use the File Name
parameter.
Look in
If the displayed drive is not the one that holds your address table files, open the drop-down list
and select the correct drive. If the currently displayed directory is not the correct one, double-
click the drive letter at the beginning of the Directories list and locate the directory. To access
sub-directories, double-click parent directories.
File name
Type the name of the address table file. ToolBox automatically adds the .x25 extension.
Alternatively, locate the file name in the file list, and double-click the name.
After loading the file, you can edit existing data by direct typing or using the Edit menu
command, or add new entries.
Files of type
This box shows the type (extension) of the files currently displayed in the File Name list. If the
displayed file type “filter” is not .x25, open the drop-down list and select the .x25 type.
Close
The Close command closes the current address table.
Save
The Save command stores the current address table.
If the file has not been saved at least once, ToolBox opens the Save As dialog box where you
assign a name to the address table file.
If the file has been saved at least once, ToolBox just saves the file.
Save As
The Save As... command (File menu) saves the current address table under a different file
name. Generally, you’ll use this command when you want to create an address table file that is
slightly different from an existing one (load the existing file, save it under a new name, and
make the changes).
The command opens the dialog box shown below. This dialog also appears when you request
to save an address table file for the first time.
222
Use the parameters in the order specified below. Normally you’ll only use the File Name
parameter.
Look in
If the displayed drive is not the one that holds your address table files, open the drop-down list
and select the correct drive.
If the currently displayed directory is not the correct one, double-click the drive letter at the
beginning of the Directories list and locate the directory. To access sub-directories, double-
click parent directories.
File Name
Type the name of the address table file you want to create, and click OK. ToolBox
automatically adds the .x25 extension. If you specify the name of an address table file that
appears on the list, ToolBox issues a message asking you whether you want to overwrite the
existing file. Select Yes only if you want to replace the existing file with the new one.
Files of Type
This box shows the type (extension) of the files currently displayed in the File Name list. If the
displayed file type “filter” is not .x25, open the drop-down list and select the .x25 type.
Print
The Print command prints the current X25 conversion file to your standard system printer. If
no printer is set up, see Windows Help or your system administrator.
Download
The Download command sends the current X.25 Address Table to the local RTU if Local was
selected or to a remote RTU if Remote (including Site ID and Link ID) was selected. Click on
the Download button to send the table to the unit. If no previous applications have been used
which require communications with the RTU, you will be prompted for a password. While the
X25 Conversion table tool is communicating with the RTU, the icon at the top right
hand corner of the window will be animated.
Upload
The Upload command gets the X25 Conversion Table from the local RTU if Local was
selected or from a remote RTU if Remote (including Site ID and Link ID) was selected. Click
on the Download button to get the table from the unit. If no previous applications have been
used which require communications with the RTU, you will be prompted for a password.
While the X25 Conversion table tool is communicating with the RTU, the icon at the
top right hand corner of the window will be animated.
Abort
The Abort command terminates the download or upload operation currently in progress with
the RTU.
223
Exit
The Exit command exits the X25 Conversion Table utility. If changes have been made to the
current file, the tool will ask if you want to save those changes. If you specify yes, the Save As
dialog box will appear and enable the current X25 conversion file to be saved under a different
file name. If no changes have been made, the X25 Conversion Table screen will disappear.
Edit Menu
The Edit menu contains the following commands:
Insert Site
Inserts a new line above the line where the cursor currently stands.
Delete Site
Deletes the line where the cursor currently stands.
Delete Group of Sites

Deletes the lines which are currently highlighted.
Sort by Site ID
Rearranges the table in Site ID order.
224
MDLC Over Private DataTac
This chapter refers to MOSCAD and MOSCAD-L (≥ V7.00).
MOSCAD RTUs (≥ V7.00) can communicate over Private DataTac systems (RDLAP) with
SCADA centrals and with other RTUs. All MDLC features are preserved except for clock
synchronization.
RTUs are connected to RDLAP radios (e.g. VRM 500, 600, 650, 660, and TRM 660) via
RS232. An RTU sends a message (MDLC), through the radio to the Radio Network Controller
(RNC). The RNC encapsulates the MDLC message and send it over IP to the IP Gateway.
The IP Gateway then extracts the MDLC message from the IP envelope and transmits it to the
appropriate destination. If the destination is another RTU over Private DataTac, the IP
Gateway (≥ V3.00) must support the reflector feature, which enables it to “reflect” the message
back over RDLAP.
SCADA
Central
Ethernet
Host Computer
IP Gateway
w/Reflector RNC/WINGS
RS-232
Programming
ToolBox
RF
SYSTEM
PRIVATE DATATAC PRIVATE DATATAC

RADIO RADIO
RS232 RS232
MOSCAD MOSCAD-L
RTU RTU
RS-232
Programming
ToolBox
The picture above shows a typical system which supports MDLC communication over RDLAP
radios. Note that the IP Gateway is configured as RDLAP reflector. A host computer attached
to the Ethernet can receive TCP/IP applications from non-MOSCAD terminals on existing
RDLAP systems, if required. A MOSCAD ToolBox can be connected to one of the RTUs, and
can access another RTU by using its Site ID and Link ID. ToolBox can also be attached to one
of the serial ports of the IP Gateway.
225
RTU Site Configuration

In the Site Configuration tool, set up either port 2 or port 3 (with programmable piggyback
modem) as:
RS232, Async, External modem, RDLAP, RTU.
Most of the Advanced Parameters for MDLC Over Private DataTac use the default values.
Those which should be modified are described below.
User Parameters for Port 2 and 3

The Default Router parameter will automatically be set to : to Master/Central.
Link Name Set to LINE X.
Physical Layer
The values of the following parameters should be modified.
Number of idles to announce 'End of RX' Range: 1-200

Default: 80
Set to 3000.
and NOT more than <10-2000> mSec: Range: 10-2000
Default: 80
Set to 3000.
Interval between Link TX retries 10 ms Range: 100-6000
Default: 500
Set to 800.
Link Layer
The values of the following parameters should be modified.
Number of TX retries Range: 0-9

Default: 2
Set to 4.
TX to failed RTU every <> Min Range: 0-30
Default: 3
Set to 5. (0 is DISABLE.)
Interval between FULL DUPLEX TX retries Range: 10-100
(*100mSec)
Default: 50
Set to 80.
226
Interval between TX retries upon BUSY ACK Range: 10-100

(*100mSec)
Default: 40
Set to 100.
MOSCAD User Application

If communication between RTU and RTU is required, all RTUs should be defined in the Site
table, where the Link Name is LINE 1. This should be the Link Name in the IP Gateway
reflector port.
IP Gateway Configuration
Define a new logical port of the IP port as RDLAP reflector, where the Link Name is “Line 1.”
This is actually a virtual port, with MDLC Stack over RNC Stack over IP.
227
MDLC over MPT1327
The information in this chapter refers to MOSCAD ≥ V8.00.
This feature is available in MOSCAD Programming ToolBox versions ≥ V8.50.
With MDLC over MPT1327, two MOSCAD RTUs can communicate with one another in an
MDLC network over MPT1327 radio infrastructure using the MAP27 communication
protocol.
Each RTU is attached to a radio. A MAP27 conversion table, which maps Site IDs to Radio
IDs, is created in the ToolBox and downloaded to the RTUs. This acts as a kind of phone book
and enables routing over the MDLC network to the proper radio/site destination.
All MDLC communication is supported, including clock synchronization. For this reason, the
infrastructure (i.e. Base Station) must support Group Call. Both the radio and the Base Station
must support nonprescribed data transmission.
When using this media, the initial communication between two radios is established using an
MAP27 protocol (UART communication) while data is sent using the MDLC protocol
(synchronous communication). Once the information has been transmitted, the call is ended as
it began, using MAP27.
An RTU will end an MDLC over MPT1327 call either when the radio disconnects or when the
communication is idle for a certain amount of time. As long as no call exists, the CPU polls
the radio once per second to maintain communication with the radio.
In the diagram below, a typical configuration is shown, with RTUs attached via Port 3 to
trunked radios which communicate through MPT1327 infrastructure.
228
MDLC over MPT1327
SCADA
Central
Programming
ToolBox Ethernet
LINE 1
IP
RS-232 Gateway
Programming
ToolBox
Base MDLC
Station
Network
MPT Trunked MPT Trunked

RADIO RADIO
Piggyback Piggyback
Port 3 Port 3
Modem Modem
MOSCAD MOSCAD-L
RTU 1 RTU 2
RS-232
Programming
ToolBox
MDLC over MPT1327 Setup

1. Define site configuration for Port 3.
2. Define the MAP27 conversion table using the MAP27 Convert Table icon in the
MOSCAD Programming ToolBox folder.
3. Download both site configuration and MAP27 conversion table, together with network
configuration, if necessary, applications, etc. to the RTU.
Radio Configuration
When the system is purchased, the radio’s default configuration is set up for MAP27
communication. These defaults must NOT be changed in the RSS by the user. The radio’s
RSS values should match the recommended defaults.
The radio’s RSS parameters must match the parameters stored in the MOSCAD RTU exactly.
If changes are made to the radio parameters (besides the address values), the system will not
work properly.
229
MDLC over MPT1327

In the Site Configuration tool, set up Port 3 (with MPT1327 piggyback modem) according to
the radio equipment as:
Radio, MPT Trunking, GM1200E, MPT1327, DPSK
or
Radio, MPT Trunking, General Radio, MPT1327, DPSK
The Advanced parameters should be set as defined below.
User Parameters for Port 3

Link name: Range: RADIO 1-RADIO 29.
Default: RADIO 1
Data Speed: Default: 1200
This is the data speed for the synchronous communication
used in transmitting the MDLC data.
Control Data Speed: Range: 1200 – 9600
Default: 9600
This is the data speed for the asynchronous
communication used in establishing and closing the call.
This corresponds to the data speed defined in the RSS.
The Advanced Parameters which are unique to MDLC over MPT1327 do not appear in the Site
Configuration section of the System Setup and Diagnostics Tools manual, and are described
below. Advanced Parameters which are not unique but whose default is different for this
feature are also described below.
The values of these parameters are generally not modified. Changes must be done carefully or
the system may not work properly.
Physical Layer
To access the parameters below, click on the Advanced Physical tab, on the More button and
again on the More button.
Interval between calls Range: 0-255

retries(Sec) Default: 0
The number of seconds between call retries, if the
Number of call retries is > 0.
Number of call retries Range: 0-255
Default: 0
If = 0, no call retry will be attempted.
Currently not implemented.
230
MDLC over MPT1327
Hanging up an unused Range: 0-255

radio by INITIATOR Default: 5
after (0-255) sec
The number of seconds of idle on the line before a call is
disconnected by the call initiator.
Note: The corresponding parameter in the radio must be
greater than this value.
Hanging up an unused Range: 0-255
radio by RESPONDER Default: 10
after (0-255) sec
The number of seconds of idle on the line before a call is
disconnected by the call responder. This value should be
greater than the corresponding Time Interval for the call
initiator.
Note: The corresponding parameter in the radio must be
greater than this value.
Number of IMAP ticks Range: 0-255
for not ready dialing Default: 10
Number of times to try to access the radio for dialing
while receiving ‘not ready’ status from the radio.
‘Call Connnected’ to Range: 0-65000
start TX Interval Default: 2500
(mSec)
The time between receipt of call acknowledgement from
the call responder and the beginning of transmission by
the call initiator. This allows the responder to open the
line before transmission begins.
This value varies between radio systems. The default
should suit all systems but may be tuned.
MAP27 Not applicable.
communication flag Reserved for future use.
231
MDLC over MPT1327
MAP27 Convert Table

Click on the MAP27 Sites Table icon in the MOSCAD Programming ToolBox to start the tool.
For each Site ID, enter the Radio ID as shown below.
The radio ID, which is burned into the radio appears in the RSS as MPT1327 Format: Own
Prefix and Own Ident. This is represented in the MAP27 conversion table as MAP27 Prefix
and MAP27 Ident (e.g. Prefix: 4, Ident: 4101).
Note: One of the first entries of the MAP27 conversion table, Site ID 0, must contain the radio
address defined in the system for group call (broadcast). All radio IDs in the MAP27
conversion table must be registered in the Base Station.
Once it is complete, the MAP27 conversion table is downloaded to the all RTUs in the
network.
232
MDLC over IP
Most of the information in this chapter refers to MOSCAD and MOSCAD-L ≥ V8.xx, except
for the MOSCAD Ethernet Interface, which refers to MOSCAD ≥ V3.7x and MOSCAD-
L/MOSCAD NFM ≥ V1.00. The information regarding Tetra, Standard Modem, and Null
Modem refers to MOSCAD and MOSCAD-L ≥ V9.10. The information regarding Astro
IV&D (Integrated Voice and Data) refers to MOSCAD and MOSCAD-L ≥ V9.24.
The MDLC over IP feature is available in ToolBox versions ≥ V8.5x, but the option, named
MOSCAD over IP option for ToolBox, must be purchased separately. A separate license is
required for each RTU which uses the option.
With the MOSCAD over IP option, MOSCAD RTUs and IP Gateways (≥ V3.00) can use IP
(Internet Protocol) technology to interface to advanced radio infrastructure (e.g. TETRA or
GPRS) and to standard private IP networks. Most benefits of the MDLC protocol are
preserved. MDLC and IP networks can be integrated in the same system, as networking
properties are preserved. MOSCAD MDLC applications need not be modified as the lower
layers of the protocol support IP.
MDLC packets to be transmitted are enveloped inside IP datagrams and sent between remote
RTUs or between an IP Gateway and an RTU over UDP port 2002. UDP Port number is
configurable.
A ToolBox can be connected to one of the RTUs, to one of the serial ports of the IP Gateway,
or to the Ethernet.
Each RTU/IP Gateway is assigned a Site ID. In addition, each RTU/IP Gateway with an IP
interface is assigned an IP address. An IP conversion table which maps Site IDs to IP
addresses is created in the ToolBox and downloaded to the RTUs and IP Gateway. This
enables routing over the IP network to the proper destination.
MDLC over IP can be used in one of four ways:
1. MOSCAD RTU connected to a packet data radio/modem through SLIP (Serial Line IP) or
PPP (Point to Point Protocol). The RTU can act as a remote unit or as a front end serving a
SCADA control center (over PLC or user port).
2. MOSCAD RTU connected to a LAN through an EPIB (Ethernet Plug in Board). A direct
LAN connection exists between the EPIB unit and the radio infrastructure. The RTU can
act as a remote unit or as a front-end serving a SCADA control center (over PLC or user
port).
3. IP Gateway connected to LAN. An IP Gateway (IPGW) serves as a front-end for a TCP/IP

based SCADA central and enables it communicate with remote RTUs. The IPGW uses a
direct LAN connection to the radio infrastructure. It cannot be connected with a packet
data modem/radio over SLIP or PPP. For this purpose an RTU (with packet data
radio/modem) is needed with Rs232/RS485 to connect them.
4. MCP-M connected to LAN. An MCP-M serves as a front-end for a TCP/IP based SCADA
central and enables it communicate with remote RTUs. The MCP-M uses a direct LAN
233
MDLC over IP
connection to the radio infrastructure, using EPIB. It cannot be connected with a packet
data modem/radio over SLIP or PPP. For this purpose an RTU (with packet data
radio/modem) is needed with RS232/RS485 to connect them.
In most wireless packet data networks, broadcast IP is not supported. When transmitting a
group call, a separate frame is transmitted to each site specified in the IP Conversion Table
over UDP/IP. If broadcast IP exists, such as in ASTRO IP 3.xx, then this IP can be specified
and a single message is sent to all RTUs over UDP/IP to that address. Note that unlike ASTRO
IP 3.xx, in ASTRO IV&D a separate message is transmitted to each site.
Several MDLC over IP connections exist. In MOSCAD/MOSCAD-L ≥ V8.x, the following

connections are supported:
• MDLC via IDEN iM1000 modem (over SLIP)
• MDLC via Astro3.xx radio (Astro Digital Spectra) (over SLIP)
• MDLC via Terminal Server (over SLIP)
• MDLC via Ethernet Interface, connected to LAN via Ethernet Piggyback Board
(MOSCAD/MOSCAD-L ≥ V3.7x)
In MOSCAD/MOSCAD-L ≥ V9.10, the following additional connections are supported. Please

note that using this firmware requires new hardware: CPU420 for MOSCAD and CPU20 for
MOSCAD-L.
• PPP which can be used when connecting the MOSCAD/MOSCAD-L with a Tetra radio,
GPRS modem, etc. The iDEN can be set up with either PPP or SLIP.
• MDLC via Standard modem, which is a packet data modem operating above SLIP or PPP
connection types. GPRS g18 modem and Tetra radios are included in this category. See
MDLC over Standard Modem Setup for configuration details. A modem configuration file
must be downloaded to the RTU when using this connection.
• MDLC via Tetra radio. This is similar to Standard modem. Tetra operates above the PPP
connection type. See MDLC over Tetra Setup for configuration details. A modem
configuration file must be downloaded when using this connection.
• MDLC via Null modem. This operates above the PPP connection type only. It is suitable
for direct cable connections over PPP with devices such as Terminal Servers.
• MDLC over ASTRO IV&D (Integrated Voice & Data). This is similar to TETRA. ASTRO
IV&D operates above the PPP connection type. See MDLC over ASTRO IV&D for
configuration details. A modem configuration file can optionally be downloaded when
using this connection but it is not needed. Note this connection is different than ASTRO IP
3.xx. (MOSCAD/MOSCAD-L ≥ 9.24)
Please note that using this firmware requires hardware: CPU420 for MOSCAD and CPU20
for MOSCAD-L.
In order for a variety of modems (and radios which act like modems, such as Tetra) to be used,
a modem configuration file is downloaded to a specific port configured for MDLC over IP. The
modem/radio can also be diagnosed using AT commands specified in that file. For MDLC over
IP this feature is applicable only to the following connections: Standard Modem, Null Modem,
234
MDLC over IP
Tetra, and iDEN. Note: The same modem configuration file can be used when configuring a
port for MDLC over IP or when configuring the port for dialup. For details, see Modem
Configuration File below.
Several variations of MDLC over IP exist: MDLC via Tetra, MDLC via Standard modem,
MDLC via GPRS, MDLC via Null modem, MDLC via Terminal Server (SLIP), MDLC via
Astro3.xx, MDLC via Ethernet Interface, and MDLC via Astro IV&D.
ToolBox PC Setup Options

In order to communicate with RTUs and IP Gateways, the MOSCAD Programming ToolBox
computer can be connected in one of three ways. The Communication Setup utility is used to
configure the setup.
1. Serial port connection - The serial port of the PC is connected to the computer port of an
RTU or IP Gateway.
2. Ethernet port connection – The PC’s Ethernet connection is connected to a LAN via an
RTU or IP Gateway. In the Comm Setup utility, select Ethernet Port and set the Local IP
Address to that of the RTU or IP Gateway.
3. Peripheral Interface connection – The PC’s serial port (or PCMCIA) is connected to a
phone or a modem. The ToolBox can communicate with other RTUs/IP Gateways which
are attached to radio/modems. In the Comm Setup utility, select Ethernet Port and set the
Local IP Address to that of such an RTU. Note: The user must get access permission from
the provider to communicate with that RTU. A RAS connection such as Standard Modem
must be set up in the PC. Run Dial-up networking and "dial" into the modem/radio before
running Toolbox.
MDLC over IP Setup

The general setup described below applies to all variations of MDLC over IP. For the actual
values to be assigned in the site configuration (port type and parameters) refer to the
appropriate setup section for variation.
1. Define the site configuration for either Port 2 or Port 3.

The port type will follow the form of:
RS232, Async, Connection Type, Connection Mode
where Connection Type is either SLIP or PPP and Connection Mode can be any of several
options, such as Tetra, iDEN, Standard Modem, etc.
Several Advanced Parameters will be set. The Advanced Parameters which are unique to
MDLC over IP do not appear in the Site Configuration section of the System Setup and
Diagnostics Tools manual. The parameters for MDLC over IP are described in detail
under RTU Site Configuration for the MDLC over iDEN option below. For changes to
these parameter settings for other variations, see the specific setup section.
235
MDLC over IP
2. Define the IP conversion table using the IP Address Table icon in the MOSCAD
Programming ToolBox folder. This icon will only appear with the purchase of the
MOSCAD over IP option.
3. Download both the site configuration and IP conversion table, together with the network
configuration, and, if necessary, applications, etc. to the RTU.
4. Where a modem configuration file is used, this too should be downloaded to the RTU.
5. Verify that the RTU can successfully communicate over IP via the radio/modem.
MDLC over IP Site Paging

With MOSCAD/MOSCAD-L ≥ V9.10, a paging mechanism has been added to each site (peer)
in the IP conversion table to make MDLC over IP more reliable. Paging a site before
transmitting MDLC data to it over IP, guarantees that the site is reachable. This is necessary
because MDLC over IP does not have a confirmed type of link in which the peer acknowledges
received packets (as opposed to other types of MDLC ports). It relies on the radio to have a
link layer that will guarantee a ‘best effort’ delivery, and thus avoids overloading the channel
with excessive traffic.
A site is paged by sending it a poll request and awaiting a poll reply. During this time, the
MOSCAD can continue to transmit to other sites (and receive transmission from other sites). If
the site responds with a poll reply, or any other MDLC data, it is considered as reachable, and
all pending transmissions are sent to it immediately. Further transmissions will be sent to it as
well without paging until the site is declared as failed.
If an ‘ICMP Destination Unreachable’ message is received or if the site does not respond to
paging for a configurable poll interval, it will be polled again for a maximum number of polls.
If there is still no response, the site is considered to be failed, and the network layer is notified
so any pending transmissions can be redirected to an alternative route. If subsequent
transmissions are to be sent to the site through an MDLC over IP port, paging will be
performed again before actual transmission takes place.
The Site Paging mechanism can be enabled or disabled. Though it is only supported on system
versions ≥ V9.10, an RTU with site paging can page an RTU with system versions ≥ V8.x or
an IP Gateway >=V4.xx which does not have this option.
When using modem devices iDEN, Tetra, Standard and Null modem, all sites are reset to
unknown state when disconnecting and reconnecting the modem/cable to RTU. For ASTRO
IV&D because no DCD exists, the RTU detects the lack of signal from the port several seconds
(40 by default) after the data cable is disconnected, or the radio is powered off. As a result,
following this operation, paging will be performed before a transmission is sent.
With non-modem devices, such as Terminal server (SLIP), ASTRO3.xx and MDLC via
Ethernet, reconnecting cable will not cause paging to be performed.
Three parameters (Check Alive timeout in seconds, Poll interval in seconds, and Maximum
number of polls) have been added to the Advanced Link layer for paging purposes and are
described in detail in the Link Layer section under MDLC via iDEN. For each variation of
MDLC over IP, the parameter setting may vary.
236
MDLC over IP
MDLC over iDEN

With SCADA systems, MOSCAD/MOSCAD-L RTUs (> V8.00) can be connected to iDEN
iM1000/iM1500 modems (OEM version >=35.01.00) to communicate using SLIP over iDEN
infrastructure to the IP network. Since iDEN infrastructure connects to Local Area Networks
(LAN) as well, a LAN-connected IP Gateway (or an RTU using SLIP) can communicate
directly with these RTUs over iDEN infrastructure.
For MOSCAD and MOSCAD-L ≥ V9.10, it is also possible to connect to an iM1000/iM1500

modem over PPP instead of SLIP.
The iM1000/iM1500 is configured to operate works in various modes, including:
• Packet Data (PD)

• Circuit Data (CD)
• Packet Data over Circuit Data (PD over CD)
MDLC over iDEN, which uses IP technology, deals only with the first mode (PD). The other
two can only be used with an external dialup port in the MOSCAD RTU, and do not support
direct communication with another RTU/IP Gateway having an MDLC over IP port. Therefore
they are not relevant to this topic.
In the figure below, the SCADA central and IP Gateway are connected via LAN to iDEN
infrastructure. Each RTU has an iM1000/iM1500 modem connected to its MDLC over IP Port
using SLIP. A unique IP address is assigned to each RTU according to its modem’s identifier.
All communication between RTUs and the IP Gateway involves sending datagrams in packets
over the internet (IP). A PC running MOSCAD Programming ToolBox can be connected
directly to an RTU or operate remotely over IP.
237
MDLC over IP
SCADA
Central
Ethernet
IP
LINE 1 Routing
Net
IP
RS-232 Gateway
Configurator/
ToolBox
Home
iDEN Agent
infrastructure Interface
Router
Mobile
Base Data
Station Gateway
LINE 1
iDEN iM1000 iDEN iM1000

Packet Data Packet Data
modem modem
MOSCAD MOSCAD
RS-232 RTU-A RTU-B
Configurator/
ToolBox
IP Gateway to RTU Communication

A datagram transmitted from the IP Gateway is received by the Home Agent (HA) which
encapsulates the frame and transmits it through the Interface Router (IR) to the Mobile Data
Gateway (MDG). In IP terms, encapsulating a datagram and directing another entity to de-
encapsulate it, is called tunneling. The MDG de-encapsulates it and extracts its destination IP
Address from the IP Header. The MDG then consults a table which maps each IP Address to its
correlated iM1000 modem. Using the LAPi protocol, the MDG encapsulates the datagram in a
LAPi frame, and transmits it to the appropriate iM1000 modem. The modem may need to be
paged before the actual transmission. (See IDEN Modem Session State/Paging below.)
RTU to IP Gateway Communication

When a MOSCAD RTU configured for MDLC over iDEN transmits a datagram towards the IP
Gateway, the modem requests a packet channel. When an available packet channel is found,
the modem encapsulates the frame in LAPi and transmits it over the air and base station to the
MDG. The MDG then extracts the RTU’s datagram from the LAPi frame and passes it to the
Interface Router (IR) on the LAN. The IR routes the packet to the IP Gateway using
conventional IP routing. Depending upon the LAN topology, datagrams may or may not pass
through the HA (which acts as a default Internet router in this case).
238
MDLC over IP
RTU to RTU Communication

When an RTU transmits a datagram to another RTU’s IP Address, the transmission to the
MDG is handled the same way as when transmitting to an IP Gateway. The MDG forwards the
datagram to the IR on the LAN. The IR functions as an internet router, routing the datagram to
the Home Agent (HA). The HA tunnels it to the MDG (through the IR). which de-encapsulates
the original datagram and identifies the iM1000 modem address for the destination IP address.
The MDG then encapsulates the datagram in LAPi protocol and transmits it to that iM1000
modem as described above. (See IDEN Modem Session State/Paging below.)
iDEN does not support group calls (RTU-to-RTU broadcasts). To send a frame to a group of
sites, the application should send to each site individually, leaving a short wait time between
each transmission (about 300 milliseconds).
IDEN Modem Session State/Paging

In order to lengthen battery life and also to allow voice and data operations in a modem at the
same time, the concept of session state was defined for iDEN equipment. A modem is dormant
or idle when it has not received/transmitted data for some time. Because less communication is
required in dormant/idle state, the battery drain is reduced. In this state, it is able to receive
both voice dispatch calls/alerts, and paging.
Paging is a “wake up call” which causes a dormant/idle modem to wake up and allocate
appropriate RF resources needed to communicate over a packet data network. Once the packet
channel has been accessed, the paged modem will become active for a limited amount of time.
While in active state, the modem can only handle packet data, and cannot get any voice
dispatch calls. It is important to note that the iM1000 modem only handles data and no
voice/dispatch calls.
Note: Because of the overhead involved in paging and accessing a channel, there will be a
certain delay before the modem becomes active and can receive data. The length of the delay
depends on the topology and state of the network. This may be relevant for some applications
involving data sent from one RTU to another.
MDLC over iDEN Setup

The general steps of the MDLC over iDEN Setup are identical to the MDLC over IP Setup.
Note that with MOSCAD/MOSCAD-L ≥ V9.10, a paging mechanism has been added to the
MDLC protocol in order to make MDLC over IP more reliable. Setting these parameters in the
Advanced Link layer is explained above in MDLC over IP Site Paging above.

In the Site Configuration tool, set up either Port 2 or Port 3 as RS232, Async, SLIP. Select
IDEN and then MDLC over IP:
RS232, Async, SLIP, IDEN, MDLC over IP
Note that with MOSCAD/MOSCAD-L ≥ V9.10, the user can configure PPP instead of SLIP:
239
MDLC over IP
RS232, Async, PPP, IDEN, MDLC over IP
Currently the iDEN modem can be physically connected to Port 2 or 3. Note however, that in
this case, no external radio can be added to MOSCAD or MOSCAD-L due to physical
limitations. MOSCAD-L with iDEN connected to Port 2 can support an internal radio (e.g.
Spread Spectrum) on Port 3.
If radios are externally connected, or a customized RTU is purchased, any internal/external

radio can be connected to Port 3, while the iDEN modem is connected to port 2.
The Advanced parameters should be set as defined below.
User Parameters for Port 2 and Port 3

Link name: Range: LINE 1-LINE 29.
Default: LINE 1
All RTUs and IP Gateways use the same line.
Data Speed Range: 1200 - 57600
Default: 19200
Self IP Address IP address of the RTU.
This parameter should remain 000.000.000.000. It is read
from modem when modem is connected to RTU.
Default routing IP The home agent of the iDEN infrastructure.
address This value should remain 000.000.000.000. It is read
from modem when it is connected.
IP network mask The subnet mask assigned by iDEN to the modem.
This value should remain 000.000.000.000. It is read
from modem when it is connected.
MDLC over IP port Range: 1-65535
number Default: 2002
This number is common to all RTUs and IP Gateways
connected to the link. This number identifies the MDLC.
This is a UDP port number and the provider should be
consulted.
It is important that this number not be in use as specified
by the TCP/IP standard RFC0960.
Number of sockets Range: 1-16.
Default: 1.
This parameter can be used with RTUs ≥ V9.24.
This number determines the number of sockets to be
opened. It also determines the size of the IP stack heap
and can be extended if the "ICMP:Source Quench"
message is received from the RTU after transmitting to it
a lot of data. The default settings of the port are
configured to prevent this, so it is not recommended to
change this parameter.
240
MDLC over IP
Notify IP Address Range: Disable/Enable

when connected Default: Enable
When enabled, if an RTU’s IP address is changed or
obtained from a modem, the RTU will send a message to
update its IP Address in all sites.
Note: these messages are sent one after the other, and it
is not guaranteed they will be delivered and accepted.
The three parameters Self IP Address, Default routing IP address, IP network mask are learned
from the iDEN infrastructure through the modem and will appear dimmed in the Site
Configuration screen. They should be left 0.
Note that the Default routing IP address is identical for all RTUs. Therefore if all other
parameters are the same, one identical configuration file can be created and maintained for all
units.
If a PPP connection type is used, the following optional parameters exist as well but they
should be left empty:
User name Set appropriate user name for connecting to the modem
when performing PPP authentication.
If a modem configuration file was downloaded, the
username variable in the file overrides this setting.
Password Set appropriate password for connecting to modem when
performing PPP authentication.
password variable in the file overrides this setting.
The Advanced Parameters which are unique to MDLC over IP do not appear in the Site
Configuration section of the System Setup and Diagnostics Tools manual, and are described
below.
241
MDLC over IP
Physical Layer
The values of these parameters are identical to other variations of MDLC over IP as described
above.
Format The valid values are:

7 bits Even Parity 2 stop bit
7 bits Odd Parity 2 stop bit
8 bits No Parity 2 stop bit
Default: 8 bits No Parity 1 stop bit
Port Mode Default: DTR/CTS Support
Hardware flow control of the port includes DTR and CTS
signals.
Optional AT command This additional AT string can be used to enhance the
string modem just before the modem is returned to online mode
after configuration. For more details, see Modem
Configuration below.
RTS Always On The RTS of the RTU is connected to the modem’s DTR.
It is controlled by software, and is On. If this parameter is
set to Enabled, during a warm restart it remains On. By
default, it is On.
Number of Default: 2.
configuration attempts Range: 0 to 255.
to reset radio/modem
This parameter can only be used with RTUs ≥ V9.24.
If the RTU fails to configure or register an iDEN modem,
it restarts the iM1000/iM5000 modem using AT
commands. This parameter determines how many failed
attempts to connect modem are required before restarting
it.
n_failstoreset variable in file overrides this setting.
Wait time after Reset Default: 7 seconds.
radio [sec] Range: 0 to 255 seconds.
Specify how long to wait after restarting the radio/
modem as above before attempting to configure and
register it.
SetRtsTimeout variable overrides this setting.
242
MDLC over IP
PPP echo send max Default: 0

retries Range: 0 to 255.
If not 0 it determines the number of retries to poll the
modem if it does not reply. If retried with no response for
max retries, the data cable to the modem is regarded as
disconnected.
For iDEN leave it 0.
This parameter is intended to be used when no DCD input
signal is provided by the modem.
pppechosendmaxretry variable overrides this setting.
If a PPP connection type is used the following optional parameters exist as well but for iDEN
they should be left unchanged. They can only be used with RTUs ≥ V9.24, and are intended to
support more modems/radios.
PPP echo send Default: 0

interval [sec] Range: 0 to 255.
If not set to 0, it determines the time interval to poll the
modem over PPP. If no reply is received within PPP
echo send max retries, it will declare the cable as
disconnected, and start to reconnect with the modem.
For iDEN leave it as 0.
pppechosendinterval variable overrides this setting.
PPP protocol Default: Enable
compression Range: Disable/Enable
If enabled, this configures PPP to use protocol field
compression as defined in RFC1661.
For iDEN leave it enabled.
pppprocomp variable overrides this setting.
243
MDLC over IP
PPP address Default: Enable

If enabled, this configures PPP to use address field
For iDEN leave it enabled.
pppaddrcomp variable overrides this setting.
Link Layer
Maximum rows in Range: 0-200
conversion table Default: 100
Maximum number of sites with which the RTU can
communicate.
TX to failed RTU every Range: 0-30
<O: DISABLE 0-30> Default: 0 (also disables)
Min
It specifies a period of time in seconds, after which a
failed link will be considered as being back in order,
provided the value of the Periodic check of failed RTU
parameter is set to Disable.
With RTUs ≥ V9.24, if the Periodic check of failed RTU
parameter is enabled, it specifies the period of time in
seconds after which the Network layer issues a control
frame to check the failed link.
Periodic check of Default: Disable
failed RTU This parameter can be enabled only for RTUs ≥ V9.24.
The network sends a control frame to check whether the
link is still in "failed" status. The frame is issued if the
link has been in "failed" status for the period of time
specified in the TX to failed RTU every <O:DISABLE 0-
30> Min parameter.
Modem configuration Range: 40-255 sec
timeout (Sec) Default: 40
The period of time the network will wait for successful
configuration of the modem upon power up of modem or
MOSCAD. If within this period, the modem
configuration does not complete, MOSCAD marks the
port as Failed, though configuration continues. If
configuration fails, the modem may not be properly
configured. Configuration status can be checked using the
Error Logger and Software Diagnostics (LIN1L Level 0,
101.
For more details, see Modem Configuration below.
244
MDLC over IP
Enable RALP Default: Yes

Radio Application Layer Protocol. Enables periodic
sampling of the modem to get messages about its status
(whether the modem is registered in the network and can
send/receive packet data over the infrastructure). Modem
diagnostics can also be checked using the ToolBox
Software Diagnostics utility. The valid values are:
Yes
No
Like RCP, RALP uses a separate socket from the data
socket and works in parallel to MDLC over the air using a
SLIP/PPP connection.
Get modem status Range: 0-255 sec
sample time (Sec) Default: 10
Relevant only if Enable RALP is YES.
The period of time to wait between checking the status of
the modem (if it is registered with the network and able
and to send/receive packet data over the infrastructure.)
Modem diagnose reply Range: 10-255 sec
timeout (Sec) Default: 10
The period of time for the ToolBox Software Diagnostics
to wait a reply from the modem before returning an error.
(e.g. LIN1L levels, 102, 103.)
Restart modem when Range: 10-255 sec
deregistered Default: Yes
If Yes, then restart the modem each time it is detected that
the modem has been de-registered by the system. This
will make the modem more reliable, however MDLC data
may be lost when restarting the modem (until it initiates
itself.)
Disconnect on idle Range: 1- 65535
timeout sec Default: 0
When specifying a timeout in seconds, the RTU monitors
the delay from the last time anything was received from
the modem (during PPP mode). If this time expires, this
means there is a problem with the modem connection.
The RTU will disconnect and reconnect to the modem.
If 0, this parameter ignored.
245
MDLC over IP
Registration life time Range: 0 to 65535 seconds

Default: 7200
If not 0, this sets an interval in which a connected
radio/modem is deregistered and reregistered for packet
data.
The RTU adds an offset to this number, which is derived
from its site ID, so not all radios are restarted and context
activated at the same time.
If a file was downloaded, this parameter can be
overridden using the regLifeTimeout variable.
With MOSCAD/MOSCAD-L ≥ V9.10, a paging mechanism to each site (peer) in IP
conversion table has been added to make MDLC over IP more reliable. The following
parameters have been added to Link layer and are optional. For more information refer to
MDLC over IP Site Paging.
Check Alive timeout in Range: 0-65535 sec

seconds Default: 300
Specify timeout in seconds from the last reception from a
peer. If nothing has been received from the peer during
that timeout, it will be paged before the next transmission
(see below). This behavior guarantees that a peer will be
reachable over IP. If it does not respond, route
transmissions to it through alternate routes.
Check alive timeout is measured independently for each
site in the IP conversion table.
If this parameter is 0, a peer will always be considered as
reachable, once a single reception has been received from
it.
This parameter is considered to be 0 regardless of its
value if ‘Maximum number of polls’ is 0.
Poll interval in Range: 0-65535 sec
seconds Default: 10
Specify interval in seconds between polls of peer. When a
peer is being paged, a poll request is sent. If no answer is
received after that period of time, another poll request
will be sent until the Maximum number of polls was sent
(next parameter).
Poll interval is measured independently for each site in
the IP conversion table.
If this parameter is 0, a single poll (or no polls) will be
sent to the peer according to Maximum number of polls
(0 or not.)
246
MDLC over IP
Maximum number of Range 0-255

polls Default: 5
Specify the number of poll requests to send in order to
check if the peer is alive. When paging a peer, if no
response is received, it is polled again. If the peer has
been polled for the Maximum number of polls without
answering, it is considered as failed, and all transmission
are routed through an alternate path.
MDLC Session Logical Channels Advanced Parameters

Application layer
Stack size of Range: 1000-4000

application manager Default: 1300
task
Modem Configuration
The parameters described above for the iDEN modem are configured through the MOSCAD
Programming ToolBox Site Configuration utility when the modem or MOSCAD is powered
up. The RTU sends AT commands to the modem to change its mode to offline, program the
necessary settings, and return it to online mode. This is transparent to the user, but during this
time the MOSCAD cannot transmit MDLC via this port. Any data sent is queued until the
modem returns to online mode. If the configuration fails, queued data is returned to the
network for retransmission via an alternative route. If the configuration fails, it is possible that
the modem was not properly configured. The Error Logger and Software Diagnostics should
be checked to identify the problem (IPLINK LIN1L Level 0, 101).
Other parameters are set by the iDEN infrastructure over the air when the modem is powered
up. If the configuration fails, this may be due to a problem with the iDEN infrastructure. In
this case, users should consult with the iDEN network operator.
If one of the modem’s internal settings (i.e. the service key used for fraud prevention/
authentication, number assignment module, network ID, or passcode) needs to be modified,
this can be done locally, using the Applet IX1000 software. The Master Reset operation may
also be required to change the modem identification number and enable the iDEN
infrastructure to reset parameters in the modem. These changes should only be performed in
coordination with the technical support group.
• Disconnect the modem from the MOSCAD.

• Connect the modem to a PC running the Applet software.
• Open the Modem Configurations window.
• Modify the settings as instructed by the technical support group.
• Power/cycle the modem.
• Reconnect the modem to the MOSCAD.
247
MDLC over IP
Special AT Commands for the iDEN Modem

The following default AT commands are sent by the RTU when configuring the iDEN modem.
These commands can be overridden/added by specifying the Optional AT command string in
the Advanced Physical Layer parameters in the Site Configuration utility. This string will be
sent last to the modem prior to setting it to “online mode” and may override previous settings.
Note: The set of AT commands listed below is suitable for iM1000 modem. If another iDEN
modem is used, such as iO1000, it may require a different set of AT commands. For that
purpose, an appropriate modem configuration file can be downloaded to RTU. (For details, see
Modem Configuration File below.) For a complete description of the AT commands, refer to
Applet user manual.
ATZ2 – Load profile 2 (packet data) into the modem.
AT&D0 – Instruct the modem to ignore DTR, since the RTU does not support it.
AT&C1 – Instruct the modem to activate CD in online mode.
AT+WV300=1 – Instruct the modem to use its own mobile IP stack.
AT+WV302=7200 – Set the modem registration lifetime to two hours.
AT+WV175=10 – Set the modem’s session timeout to 10 seconds, i.e. after 10 seconds from
the last communication over the air, the modem becomes idle and needs to be paged in order to
receive data. Setting it to 0 makes the session state permanent.
AT+WS46=24 – Set the modem to packet data mode.
AT+WS45=3 – The modem will initiate SLIP when going online.
If a PPP connection was selected instead of SLIP, this command is replaced with
AT+WS45=4. The modem initiates PPP when going online.
AT+WS182=3 – Communication over the air will not be compressed. Setting this parameter to
1 will compress data over the air.
Note: If needed, before the modem is set to online mode, it is reregistered using the commands
AT+WPDEREG and AT+WPREG. This occurs only when the RTU powers up, and after the
modem has been deregistered from the system.
AT+wvreset – (RTUs ≥ V9.24) Reset modem via AT command.
In versions < V9.24, iM1000 (or iM1500) were restarted using RALP over PPP. This occurred
only after the modem was registered and online. In firmware of RTUs ≥ V9.24, the modem is
also restarted using this AT command after several unsuccessful attempts to configure or
register it (refer to Number of configuration attempts to reset radio/modem). This command is
also issued by the RTU when connecting to the modem for the first time.
AT+WS53? – (RTUs ≥ V9.24) Checks the signal quality on a normalized scale (from 0 to
100), where 100 is the best signal, and <75 means it is poor quality.
In RTU ≥ V9.24, the firmware checks the signal quality before attempting to register the
modem. If signal quality is below 75, the RTU will keep issuing this command until getting a
better value. If reasonable quality is not reached within Modem configuration timeout (by
248
MDLC over IP
default it is 40 seconds), the RTU declares the modem configuration as failed. It will retry to
configure the modem immediately afterwards. If failed for more than Number of configuration
attempts to reset radio/modem times successively, it will restart the modem using the above AT
command.
AT+IPR= – (RTUs ≥ V9.24) Sets the modem data speed.

By default, the data speed of the iDEN iM1000/iM1500 modem is set to 19200 to match the
default data speed of the RTU. Firmware ≥ V9.24 automatically sets the modem data speed to
the rate specified by the user for the port. For firmware < V9.24, it is recommended that the
user add AT+IPR=<data speed> to the optional AT command string located in Advanced
Physical Layer screen (e.g. AT+IPR=19200.)
If the data speed of the RTU port is changed, firmware ≥ V9.24 will change the modem speed
accordingly. For firmware < V9.24, change the modem data speed by issuing an AT+IPR<data
speed>= command locally from a PC terminal to the modem.
It is recommended that all RTUs operate their modems on the same data speed.
249
MDLC over IP
MDLC over Tetra

With SCADA systems, MOSCAD/MOSCAD-L RTUs ≥ V9.10 can be connected to a Tetra
radio. Tetra infrastructure and radio should support packet data. This is relevant to Motorola
Dimetra subscribers.
The connection to Tetra can be made via LAN or via radio. An IP Gateway or an RTU with an
Ethernet Plug in board (EPIB) can be connected to a LAN. In Tetra terms, an RTU that is
connected through LAN is called a LAN RTU. An RTU that is connected to a radio is called a
PEI (Peripheral Interface) RTU. A PEI RTU is connected to a radio through RS232 using
standard PPP (Point to Point Protocol).
In the figure below, the SCADA central and IP Gateway are connected via LAN to Tetra
infrastructure. Each RTU has an MTM700 radio connected to its MDLC over IP Port using
PPP. A unique IP address is assigned to each RTU according to its radio’s identifier (SSI). All
communication between RTUs and the IP Gateway involve sending datagrams in packets over
the internet (IP). A PC running MOSCAD Programming ToolBox can be connected directly to
an RTU or operate remotely over IP.
SCADA
Central
Ethernet
IP
LINE 1 Routing
Net
IP
RS-232 Gateway
Programming
ToolBox
Tetra
Infrastructure
SW MI
LINE 1
Tetra Tetra
MTP700 MTP700
radio radio
MOSCAD MOSCAD
RS-232 RTU-A RTU-B
Programming
ToolBox
250
MDLC over IP
The MOSCAD Programming ToolBox can communicate with remote RTUs over IP using the
Tetra infrastructure. The PC running the ToolBox is connected to the Tetra radio (e.g.
MTH500 radio) or to the RTU. For this purpose, the PC should have a Tetra PD installation
(as specified in the TetraMSdialupInstall.wri file in the C:\Tbox954\Doc directory). After
setting up the connection, the user should run the ToolBox Communication Setup utility, select
Ethernet port and specify in a focal point RTU/IP Gateway IP Address under ‘Local Site IP
Address’.
It is important to note that RTU to RTU communication is routed through the infrastructure
LAN system and not directly.
Note that a paging mechanism to each site (peer) in IP conversion table makes MDLC over IP
more reliable. For details, see MDLC over IP Site Paging.
Tetra does not support group calls (RTU-to-RTU broadcasts). To send a frame to a group of
MDLC over Tetra Setup

The general steps of the MDLC over Tetra Setup are similar to the MDLC over IP Setup,
except that a modem configuration file is always required. Use the Downloader tool to select
the modem configuration file for the specified port and download the modem configuration file
(e.g. MTM700.stm).
Note that MDLC over Tetra can only be set on MOSCAD/MOSCAD-L RTUs ≥ V9.10.

In the Site Configuration tool, set up either Port 2 or Port 3 as RS232, Async, PPP. Select
Tetra and then MDLC over IP:
RS232, Async, PPP, Tetra, MDLC over IP
As with the iDEN modem, if the Tetra is connected to Port 2, no additional external radio can
be connected to Port 3 due to physical limitations. If no external radio is used, the Tetra can be
connected to Port 3.
Use the FTN6359A connector (RS232-E+). This will enable the RTU to control DTR of the
radio. Refer to Appendix A of the System Setup & Diagnostics Tools manual for details on the
FTN6359A (RS232-E+) connector.
The Advanced parameters are the same as described above for general MDLC over IP with the
following exceptions:

Data Speed Range: 1200 – 57600
Default: 9600
Default group IP Range: 000.000.000.000-255.255.255.255
address Identifies Site ID 0 which is used for Group Call.
251
MDLC over IP
username variable in the file overrides this setting.
Password Set appropriate password for connecting to the modem
password variable in the file overrides this setting.
Default: 1.
opened and should be left as the default, as specified in
MDLC over iDEN.
Physical Layer
above.

after configuration. For more details, see Special AT
Commands for the Tetra Radio below.
default, it is On.
If the RTU fails to configure or register a modem, and the
modem supports this feature, it can restart the modem
using AT commands. This parameter determines how
many failed attempts to connect to the modem are
required before restarting it.
252
MDLC over IP

Specify how long to wait after restarting the radio as
above before attempting to configure and register it.

modem over PPP. If no reply is received within 'PPP
echo send max retries', it will declare the cable as
disconnected.
253
MDLC over IP

Link Layer
Disconnect on Range: Disable/Enable
icmp:netunreach Default: Disable
If set to Enable, connection to the modem/radio will be
terminated by force when getting an icmp:netunreach.
This message specifies that the peer site was unreachable
because of network problems. Sometimes these problems
can be resolved by reconnecting to the modem.
For Tetra, it is recommended to leave it set to Disable.
Does modem support Range: YES/NO
abort sequence Default: NO
With Tetra radios such as MTM700, no abort sequence is
supported. Abort sequence is a +++ string sent with a 1
second delay before and after, causing the modem to
move into command mode.
Specifying this parameter as NO will expedite connection
to Tetra radio.
254
MDLC over IP

Default: 7200
If not 0, this sets an interval in which a connected
radio/modem is deregistered and reregistered for packet
data.
Ignore CD Range: Never, Always, When connect
Default: Never.
When connecting to the modem, its CD is constantly
being polled, and if inactive, the RTU will reconnect to it.
This parameter enables the user to bypass the polling by
ignoring CD. Setting this parameter to Always will cause
RTU not to check CD at all. Setting it into When connect
will ignore CD during the PPP connection phase. When
PPP is connected, CD will be polled.
Setting this parameter to Never will always check CD.
With Tetra, a paging mechanism to each site (peer) in the IP conversion table has been added
to make MDLC over IP more reliable. If the parameters below are not visible, they will have
the default values as specified. The parameters are the same as in other variations of MDLC
over IP, but their default values were changed to suit Tetra infrastructure. For more
information, refer to MDLC over IP Site Paging.

seconds Default: 300 sec
polls Default: 3
Special AT Commands for the Tetra Radio

The following AT commands are sent by the RTU when configuring the Tetra radio. They can
be overridden/added by specifying the Optional AT command string in the Advanced Physical
Layer parameters in the Site Configuration utility.
It is recommended to override these defaults by downloading a modem configuration file

adopted for the radio, such as MTM700.stm for MTM700. For details, see Modem
Configuration File below.
255
MDLC over IP
AT+IFC=2,2 – Instruct the radio to use hardware flow control.
AT&C1 – Instruct the modem to activate CD in online mode.
AT&D1 – Instruct the modem to check DTR is active. When the RTU deactivates DTR, the
radio will reset its port, and the PPP connection will terminate.
AT+WS45=4 – Instruct the radio to initiate PPP with the RTU when getting the ATD
command.
MDLC over Standard Modem

To avoid system setup for each modem/radio which supports packet data, a general concept has
been introduced for MOSCAD/MOSCAD-L RTUs ≥ V9.10, whereby MDLC over IP can
connect to any modem or radio supporting packet data. A standard modem supporting packet
data is a modem which requires an AT command set to configure and PPP or SLIP to initiate. It
can connect to a PC using Microsoft Standard Modem and RAS setup.
A modem configuration file can be downloaded into the RTU specifying the exact command
set needed by the modem/radio. A default AT command set is used in case this file is not
downloaded. The same concept is used for circuit data modem over dial port.
The following modems/radios may be configured using a modem configuration file. Files for
this purpose are provided in the C:\Tbox954\config directory.
• GPRS G18 modem (G18.stm file)
• Motorola Tetra radio MTM700 (MTM700.stm file)
• Other standard SLIP/PPP radios
Connection to Standard modem is made using either PPP or SLIP over the operator
infrastructure. Since the operator infrastructure connects to LAN as well, a LAN-connected IP
Gateway, or an RTU with an Ethernet Plug in board (EPIB), can communicate directly with
these RTUs over that infrastructure, if enabled by the operator.
MDLC over Standard Modem Setup

The general steps of the MDLC over Standard modem Setup are identical to the MDLC over IP
Setup. If a modem configuration file is used, this too must be downloaded to the RTU port.

In the Site Configuration tool, set up either Port 2 or Port 3 as RS232, Async, and select PPP or
SLIP for Standard Modem and then MDLC over IP:
RS232, Async, PPP, Standard Modem, MDLC over IP
RS232, Async, Slip, Standard Modem, MDLC over IP
256
MDLC over IP
As with the Tetra radio, if the Standard modem is connected to Port 2, no additional external
radio can be connected to Port 3 due to physical limitations. If no external radio is used, the
Standard modem can be connected to Port 3.
As with Tetra, the FTN6359A connector (RS232-E+) should be used. Refer to Appendix A of
the System Setup & Diagnostics Tools manual for details on the FTN6359A (RS232-E+)
connector.
The Advanced parameters are the same as described above for general MDLC over IP and
MDLC over Tetra. Some of their defaults have been changed.

Data Speed Range: 1200 – 57600
Default: 9600
Specify the following parameters if the RTU needs to login into the modem when using PPP
connection.
Password Set appropriate password for connecting to the modem
Default: 1.
opened and should be left as the default, as specified in
MDLC over iDEN.
Physical Layer
above.

after configuration. For more details, see Special AT
Commands for Standard Modem below.
257
MDLC over IP
default, it is On.
If the RTU fails to configure or register a modem, and the
modem supports this feature, it can restart it using AT
commands. The G18 (for GPRS) modem can also be
powered off and on using the RTU's RTS signal from
RS232. This parameter determines how many failed
attempts to connect modem are required before restarting
it.
Specify how long to wait after restarting the radio/
modem as above before attempting to configure and
register it.

modem over PPP. If no reply is received within 'PPP
echo send max retries', it will declare the cable as
258
MDLC over IP

disconnected.
Link Layer
If set to Enable, connection to the modem/radio will be
For Standard modem, it is recommended to leave it set to
Disable.
259
MDLC over IP

abort sequence Default: YES
Specify YES if the modem supports abort sequence.
Abort sequence is a +++ string sent with a 1 second delay
before and after, causing the modem to move into
command mode.
Specifying this parameter as NO will expedite connection
to the Tetra radio.
Default: 0
This parameter (RTUs ≥ V9.24 only) is useful with
infrastructure that requires periodic restart or registering
of radio.
If 0, periodic restart/register of radio is disabled (but can
be done via application). If not 0, it specifies how long
the RTU keeps the radio registered for packet data before
restarting/deregistering, and then reregistering it.
Default: Never.
When connecting to the modem, its CD is constantly
being polled, and if inactive, the RTU will reconnect to it.
This parameter enables the user to bypass the polling by
ignoring CD. Setting this parameter to Always will cause
RTU not to check CD at all. Setting it into When connect
will ignore CD during the PPP connection phase. When
PPP is connected, CD will be polled.
Setting this parameter to Never will always check CD.
The paging mechanism is used with Standard modem, as with Tetra and iDEN. A paging
mechanism to each site (peer) in IP conversion table makes MDLC over IP more reliable. If
these parameters are not visible, they take their default values as 0, thus disabling paging. They
have the same meaning as in MDLC over iDEN. For more information, refer to MDLC over IP
Site Paging.
260
MDLC over IP

polls Default: 3
Special AT Commands for Standard Modem

The following AT commands are sent by the RTU when configuring the Standard modem.
They can be overridden/added by specifying the Optional AT command string in the Advanced
Physical Layer parameters in the Site Configuration utility.
It is recommended to override these defaults by downloading a modem configuration file

adopted for the radio, such as G18.stm for GPRS. For details, see Modem Configuration File
below.
AT+IFC=2,2 – Instruct the radio/modem to use hardware flow control.
AT&C1 – Instruct the radio/modem to activate CD in online mode.
AT&D1 – Instruct the radio/modem to check if DTR is active. When the RTU deactivates
DTR, the radio/modem will reset its port, and the PPP connection will terminate.
AT+WS45=3 – Instruct the radio/modem to initiate SLIP with the RTU when getting the ATD
command.
OR
AT+WS45=4 – Instruct the radio/modem to initiate PPP with the RTU when getting the ATD
command.
261
MDLC over IP
MDLC over GPRS

A MOSCAD/MOSCAD-L RTU can be connected to GPRS through a LAN or through a radio.
An IP Gateway or an RTU with an Ethernet Plug in board (EPIB) can be connected to the
LAN. An RTU which is connected to a radio through RS232 using standard PPP (Point to
Point Protocol).
In the figure below, the SCADA central and IP Gateway are connected via LAN to the GPRS
infrastructure. Each RTU has a G18 GPRS/GSM modem connected to its MDLC over IP Port
using PPP. A unique IP address is assigned to each RTU according to its modem identifier
(IMSI). All communication between the RTUs and the IP Gateway involves sending
datagrams in packets over the Internet (IP). The GPRS infrastructure routes those packets
directly between two RTUs, or between IP Gateway and an RTU. A PC running MOSCAD
Programming ToolBox can be connected directly to an RTU or operate remotely over IP.
SCADA
Central
Ethernet
MOSCAD
IP RTU
Gateway RSlink1
g18 GPRS
Packet Data
modem
GPRS
infrastructure
LINE 1
g18 GPRS g18 GPRS

Packet Data Packet Data
modem modem
MOSCAD MOSCAD
RS-232 RTU-A RTU-B
Configurator/
ToolBox
A single GPRS modem can be connected to an RTU. Other ports can be connected to other
GSM modems using dialup ports.
The operator should provide an APN (Access Point Name) for a fixed IP address and enable
one modem to communicate with another over UDP port 2002.
262
MDLC over IP
GPRS does not support group calls (RTU-to-RTU broadcasts). To send a frame to a group of
MDLC over GPRS Setup

Configuring an RTU to operate over GPRS is the same as configuring MDLC over IP for the
Standard modem connection. If a modem configuration file is used (e.g. G18.stm), this too
must be downloaded to the appropriate RTU port.
Note that before downloading the modem configuration file for GPRS, you need to change its
APN according to your operator instructions. The APN (Access Point Name) is an address such
as intranet.motorola.co.il in the following string under [ConfigurePD] section:
<AT+CGDCONT=1,"IP","intranet.motorola.co.il","0.0.0.0",0,0><OK><4>
The APN defines the security and capabilities set by your provider for your SIM cards.
For MDLC over IP to work it must have a fixed IP Address. Most GPRS APNs change IP
addresses each time the MOSCAD reconnects PPP. Reconnecting PPP is a valid operation and
can be done more than once. In order for other sites to communicate with an RTU using
MDLC over IP, it is mandatory that the MOSCAD receive the same IP Address each time it
reconnects PPP. Therefore, you must request APN having a fixed IP address allocation from
your operator.
Note: Each SIM Card has unique identifiers for a GPRS/GSM modem. Placing a given SIM
card on different modems causes the same settings to be retrieved from infrastructure (phone
number, IP Address etc.) regardless of the modem.
Use the Downloader tool to select the modem configuration file for the specified port and
download the G18.stm file.
RTU Configuration
In the Site Configuration tool, set up either Port 2 or Port 3 as RS232, Async, PPP. Select
Standard Modem and then MDLC over IP:
The Advanced parameters are the same as described above for MDLC over Standard Modem.
MDLC over ASTRO IV&D

With SCADA systems, MOSCAD/MOSCAD-L RTUs ≥ V9.24 can be connected to an
ASTRO IV&D radio. The ASTRO infrastructure (6.4 or higher) and radio must support
integrated voice and data (named IV&D). This is relevant to Motorola subscriber data radios
such as the XTL 5000 mobile, and XTS 2500 portable (version ≥ 6.5, configured for data).
The connection to ASTRO IV&D can be made via LAN or via radio. The LAN is called a CEN
(Customer Enterprise Network). An IP Gateway or RTU with an Ethernet Plug in board (EPIB)
can be connected to the CEN. On the other end, a MOSCAD/MOSCAD-L RTU ≥ V9.24 can
263
MDLC over IP
be connected to an ASTRO IV&D radio via an RS232 data cable. Note that a specific codeplug
which supports the data option must be used when programming them.
Note also that mobile radios such as XTL 5000 can work in Analog mode on Trunk II with a
DPSK modem. It has nothing to do with MDLC over IP, both the radio and the RTU are
configured differently.
In the figure below, the SCADA central and IP Gateway are connected via LAN to a Customer
Enterprise Network (CEN). The CEN is connected via a border router gateway to the ASTRO
IV&D infrastructure. A MOSCAD/MOSCAD-L RTU, running MDLC over IP protocol over
PPP, is connected via XTL 5000 radio using an RS232 data cable. A unique IP address is
assigned by the GPRS Gateway Support Node (GGSN) to each RTU according to its radio
individual unit ID (UID), such that when a frame is transmitted from the CEN to that IP
address, the Packet Data Router (PDR) and Radio Network Gateway (RNG) transmit it to the
appropriate radio.
Unlike other infrastructures such as iDEN and TETRA, this IP address and radio unit ID
cannot be retrieved for diagnostics from the radio. Instead a dummy IP Address is provided by
the radio as configured in its CPS.
SCADA
Central
Ethernet
Customer
LINE 1 Enterprise
Network
IP
RS-232 Gateway
ToolBox
ASTRO IV&D GGSN

infrastructure
PDR
Base RNG
Station
LINE 1
XTL5000 Radio XTL5000 Radio
MOSCAD MOSCAD
RS-232 RTU-A RTU-B
ToolBox
264
MDLC over IP
A PC running MOSCAD Programming ToolBox can be connected directly to an RTU, directly

to a radio, or it can operate remotely over the CEN.
For an RTU or PC to communicate over the air using an ASTRO IV&D radio, the radio must
be context activated, or registered for data, in addition to the PPP connection over RS232
interface. The RTU uses SNMP protocol and sets a value in a MIB variable defined for this
radio. When this succeeds, the radio configuration is completed, and the radio (using the IP
address provided periodically by the GGSN in the infrastructure) is able to receive and transmit
data. If the context activation fails or is deactivated, the RTU causes the radio to restart (power
itself off and on.) Once the radio has been context activated, an RTU (or PC) can transmit IP
frames over the air to the PDR which routes them to the GGSN and CEN.
Certain configuration steps are performed on the radio itself using the CPS and in the
infrastructure using the UCM tool. See the relevant radio documentation for more information.
There are two types of hardware interface between the RTU and the radio: For a mobile radio
such as the XTL 5000, the interface is comprised of a radio data cable over RS232.
Note: A PC needs a tool called Data Link Manager (DLM) in order to communicate over the
air.
For portable radio such as XTS 2500 the interface is comprised of a dedicated FKN4106 data
cable and a plastic box with a special interface board, FCN6070, supplies both power and
RS232 connectivity to the radio. If the RTU needs to restart the radio, it uses this board to
deactivate the RTS output and power the radio off and on.
ASTRO IV&D does not support group calls (RTU-to-RTU broadcasts). To send a
frame to a group of sites, the application should send to each site individually, leaving
a short wait time between each transmission (300-1000 milliseconds depending upon
the communication used.)
Sending frames from one RTU to another when both are connected to radios may not
be reliable, because of the ASTRO IV&D's limited resources. It is recommended to
have an RTU connected to LAN (CEN) that will route the information between them.

In the Site Configuration tool, set up either Port 2 or Port 3 as:
RS232, Async, PPP, ASTRO IV&D, MDLC over IP
As with the Tetra radio, if the radio is connected to Port 2, no additional external radio can be
connected to Port 3 due to physical limitations. If no external radio is used, the ASTRO IV&D
radio can be connected to Port 3.
MDLC over Tetra. Some of their defaults have been changed.
265
MDLC over IP
As an option, the user can override some of these settings by downloading a modem
configuration file such as XTL5000.stm to the RTU port to which the radio is connected.

Default: LINE 1
Default: 19200
Self IP Address IP address of the RTU.
This parameter should remain 000.000.000.000. It is read
from the radio when the modem is connected to RTU.
Default routing IP The default gateway of the RTU.
address This value should remain 000.000.000.000.
IP network mask The subnet mask assigned by to the radio.
This value should remain 000.000.000.000.
MDLC over IP port Range: 1-65535
number Default: 2002
This number is common to all RTUs and IP Gateways
connected to the link. This number identifies the MDLC.
This is a UDP port number and the provider should be
consulted.
It is important that this number not be in use as specified
by the TCP/IP standard RFC0960.
When enabled, once a radio get context activated, the
RTU send a message to update its IP Address in all sites.
If the RTU needs to log into the infrastructure/radio using a user name via PPP connection,
specify the following parameters.
User name Set the appropriate user name for connecting to the
modem when performing PPP authentication.
By default it should be left empty.
username variable overrides this setting.
266
MDLC over IP
Password Set the appropriate password for connecting to the

modem when performing PPP authentication.
By default it should be left empty.
password variable overrides this setting.
Default: 1.
opened.
SNMP agent port Range: 0-65535
number Default: 161.
This number determines the UDP port number for setting
the SNMP context activate MIB variable in the radio.
Relevant only if Context activate radio is set to Enable in
the Advanced Link Layer.
SNMP trap port Range: 0-65535
number Default: 162.
This number determines the UDP port number for getting
traps from the radio via SNMP during context activation.
Relevant only if Context activate radio is set to Enable in
the Advanced Link Layer.
Packet data status Default: .1.3.6.1.4.1.161.3.6.30.2.1.1.1.
name This is a string identifying the MIB name for context
activating the radio. It is called packet data status (PDS)
MIB. Relevant only if Context activate radio is set to
Enable in the Advanced Link Layer.
Physical Layer
above.

after configuration.
RTS Always On For a portable radio such as the XTS2500, the RTS signal
is provided by the special board (FCN6070) through the
data cable. The RTU powers the radio off by unsetting
this signal.
If this parameter is set to Enable, during RTU warm
restart this signal remains On thus driving power to the
radio. By default, it is On.
If this parameter is set to Disable, after an RTU warm
restart, the radio will be powered off and on.
267
MDLC over IP
If the RTU fails to context active the radio, it restarts it
using AT commands. With the XTS25000 portable, it
also powers it off and on using internal board (FCN6070)
and its RTS signals.
This parameter determines how many failed attempts to
connect (context activate) the radio must occur before
restarting the radio.
n_failstoreset variable overrides this setting.
Specify how long to wait after restarting radio as above
before attempting to configure and register it.

If not 0 it determines the time interval to poll the radio
over PPP. If no reply is received within max retries, it
will declare the cable as disconnected, and start to
connect with the radio again.
This parameter is needed because ASTRO IV&D radios
do not have DCD.
retries. Range: 0 to 255.
radio if no reply is received. If no response is received
after max retries, the data cable to the radio is regarded as
disconnected.
This parameter is needed because ASTRO IV&D radios
do not have DCD.
268
MDLC over IP

If enabled this configures PPP to use protocol field
For ASTRO IV&D, leave it disabled.
PPP address Default: Disable
If enabled this configures PPP to use address field
For ASTRO IV&D, leave it enabled.
Link Layer
If set to Enable, the connection to the radio will be
For ASTRO IV&D it is recommended to leave it set to
Disable.
DisconctIcmpNet variable overrides this setting.
abort sequence Default: YES
Specify YES if the modem supports an abort sequence, a
+++ string sent with a 1 second delay before and after,
causing the modem to move into command mode.
For ASTRO IV&D radios, this parameter should be set to
YES.
AbortSeqExist variable overrides this setting.
269
MDLC over IP

the modem (during PPP mode). If this time expires, there
is a problem with the radio context activation. The RTU
will disconnect and context activate the radio.
DisconctRxIdleTime variable overrides this setting.
Default: Always.
ASTRO IV&D radios do not provide DCD signal when
connected, therefore this parameter should Always ignore
CD.
IgnoreCD variable overrides this setting.
Registration life time Range: 0 – 65535
Default: 0
This parameter (RTUs ≥ V9.24 only) is useful with
infrastructure that requires periodic restart of radio.
If 0, periodic restart of radio is disabled (but can be done
via application). If not 0, it specifies how long the RTU
keeps the radio context activated before restarting, and
then context activates it again.
The RTU connected to the radio uses the MDLC paging mechanism as with Tetra and iDEN.
An MDLC paging mechanism to each site (peer) in IP conversion table makes MDLC over IP
more reliable. For the IP Gateway and IP Interface connected on the CEN, if these parameters
are not visible, they take their default values as 0, and issue no MDLC paging from the CEN.
For more information, refer to MDLC over IP Site Paging.

polls Default: 3
270
MDLC over IP
The following parameters affect the way the RTU context activates the radio and monitors it
via SNMP protocol. The ASTRO IV&D setup requires an SNMP component to be configured
in order for the radio to context activate (register for data). This is configured in the radio using
the CPS tool and in the RTU using Toolbox.
Context activate radio Range: Disable/Enable

Default: Enable
When enabled, context activate the radio via SNMP, and
monitor it according to the below parameters.
Radio context Range: 0-255 sec
activation timeout Default: 30 sec
This parameter is relevant if Context activate radio is set
to Enable.
It determines how long to wait for a radio to be context
activated. If the timeout expires, the RTU will
reconfigure the radio, and restart it if needed.
Get radio status Range 0-255 sec
sample time Default: 10 sec
to Enable.
Once the radio is context activated, the RTU will monitor
it periodically to see that it is still context activated. This
parameter determines how frequently to do check this.
SNMP socket timeout Range: 0-255 sec.
Default: 10 sec.
to Enable.
The RTU sets a radio’s context activate variable and
monitors it via an SNMP socket. This parameter
determines how long to wait for a response from the
radio, before declaring it as failed. If failed, RTU will
reconfigure the radio, and restart it if needed.
Special AT Commands for ASTRO IV&D

The following AT commands are sent by the RTU when configuring the ASTRO IV&D radio.
They can be overridden/added by specifying the Optional AT command string in the Advanced
Physical Layer parameters in the Site Configuration utility.
A modem configuration file such as XTL5000.stm for mobile XTL5000 radio can be
downloaded to override these defaults.
AT#RESET – Instruct the radio to restart.
AT – Check that the radio is connected and can be configured.
ATH – Disconnect the radio from PPP mode after issuing an abort sequence (+++).
ATE0V1 – Set no echo and AT command verbose return codes.
271
MDLC over IP
AT&K3 – Instruct the radio to use hardware flow control.
ATD – Connect the radio in PPP mode.
MDLC over Null Modem

The RTU can connect to any device using direct cable over PPP. This is supported for
MOSCAD/MOSCAD-L RTUs ≥ V9.10 MDLC over IP and can connect, for example, to a
Terminal Server over PPP.
This connection is made using PPP and is basically the same as MDLC over Standard modem.
When the RTU is powered up, it sends a client string and expects a clientserver response. Only
when it gets that response will it initiate PPP and poll for CD. CD is constantly being polled,
and if it drops, PPP is disconnected. The user can opt to ignore CD using Advanced Link Layer
parameters in the site configuration. In this case, PPP is initiated upon power up. When
connected, CD is polled in order to stay connected. If it drops, then PPP is reconnected.
By default, the RTU acts as a Windows NT/2000 Null modem connection. It sends a client
string and expects a clientserver response before initiating PPP. The user can override this
behavior by downloading a modem configuration file.
MDLC over Null Modem Setup

The general steps of the MDLC over Null modem Setup are identical to the MDLC over IP
Setup. Although no real modem exists, a modem configuration file can be downloaded to
override the default settings of the port.

In the Site Configuration tool, set up either Port 2 or Port 3 as RS232, Async, and select PPP or
SLIP for Null Modem and then MDLC over IP:
RS232, Async, PPP, Null Modem, MDLC over IP
As with the iDEN modem, if the Null modem is connected to Port 2, no additional external
radio can be connected to Port 3 due to physical limitations. If no external radio is used, the
Null modem can be connected to Port 3.
MDLC over Standard modem and are therefore not repeated here.
MDLC via Astro IP 3.xx

This information refers to ASTRO 3.xx infrastructure only. It does not relate to newer ASTRO
IV&D systems which are covered in MDLC over ASTRO IV&D.
RTUs can be connected via SLIP connection to an ASTRO 3.xx radio, which is part of an IP
network. The mapping of the radio ID to an IP address is done in the Wireless Network
Gateway (WINGS) box which can then be connected via Ethernet to an IP Gateway, SCADA
Central, etc.
272
MDLC over IP
In the diagram below, a typical configuration is shown, with RTUs attached via SLIP over
RS232-E to ASTRO 3.xx radios which support IP data capability. A ToolBox is connected to
one of the RTUs through either Port 2 or Port 3. The IP Gateway on Ethernet acts as a
gateway, translating between the IP and MDLC protocols.
SCADA
Central
Programming
ToolBox Ethernet
IP
Cloud
LINE 1
IP
RS-232 Gateway
Programming WINGS
ToolBox
RNC
ASTRO RF IP
SYSTEM
Network
ASTRO RADIO ASTRO RADIO
LINE 1 SLIP Connection LINE 1 SLIP Connection
MOSCAD MOSCAD-L
RTU RTU
RS-232
Programming
ToolBox
MDLC via Astro IP 3.xx Setup

The general setup for MDLC via ASTRO 3.xx is the same as described under MDLC over IP
Setup. The specific settings for the RTU port type and advanced parameters are as follows:

In the Site Configuration tool, set up either Port 2 or Port 3 (with programmable piggyback
modem) as RS232, Async, SLIP, ASTRO 3.xx, and then MDLC over IP:
RS232, Async, SLIP, ASTRO 3.xx, MDLC over IP

Default: LINE 1
273
MDLC over IP

Default: 9600
Self IP Address Range: 000.000.000.001-255.255.255.254
IP address of the RTU. This address also goes into the
WINGS box for mapping a radio address (LLI) to the IP
address to which it is connected.
The address here MUST be different for each RTU.
Therefore a separate configuration file must be created
and maintained for each unit.
Default routing IP Range: 000.000.000.001-255.255.255.254
address If Astro IP, this should be the IP address of the WINGS
box.
IP subnet mask Range: 000.000.000.000-255.255.255.255
This should be the same mask for all RTUs in the same
segment. (For Astro IP, it is usually 255.255.255.0).
Default group IP Range: 000.000.000.000-255.255.255.255
address Identifies Site ID 0 which is used for Group Call. This
Group IP address should be set in the WINGS Box for
LLI 10,000,000. Can also be overridden in IP conversion
table. If no group is defined in either table, RTU will
send Group Call to all addresses in the IP conversion
table, one at a time.
Default: 1.
opened. It should be set as default 1 in ASTRO IP 3.xx.
update its IP Address in all sites. In ASTRO IP 3.xx it
will be sent as a group call.
The Advanced parameters are the same as described above for general MDLC over IP with the
following exceptions:
Physical Layer
The values of these parameters are generally not modified.
Connection String (For future support.) If needed, can be used to send

initialization string to a connected device upon RTU
startup.
274
MDLC over IP
It is controlled by software, and is On. Though this
parameter is set to Enabled, it has no meaning for
ASTRO 3.xx.
Link Layer
Maximum rows in Range: 0-200
conversion table Default: 100
Maximum number of sites with which the RTU can
communicate.
Periodic check of Default: Disable
failed RTU This option cannot be enabled in MDLC over IP.
Enable RCP Default: Enable
(ASTRO 3.xx only) Radio Control Protocol. Interface to
configuring/diagnosing radio and getting messages from
radio about its status. The valid values are:
Enable
Disable
Radio encryption Default: Clear
mode (ASTRO 3.xx only) The only valid value is Clear.
Radio diagnose reply Range: 10-255 sec
timeout Default: 10
(ASTRO 3.xx only) The period of time to wait for
configuring the radio upon power up and for getting
diagnose reply from the radio through ToolBox
Diagnostics (e.g. LIN1L levels, 103, 104.)
With the Site Paging mechanism (MOSCAD/MOSCAD-L ≥ V9.10), the following three
parameters are 0 by default for ASTRO 3.xx..

seconds Default: 0
Specify timeout in seconds from the last reception from a
peer. If nothing has been received from the peer during
that timeout, it will be paged before the next transmission
(see below). This behavior guarantees that a peer will be
reachable over IP. If it does not respond, route
transmissions to it through alternate routes.
Check alive timeout is measured independently for each
site in the IP conversion table.
If this parameter is 0, a peer will always be considered as
reachable, once a single reception has been received from
it.
This parameter is considered to be 0 regardless of its
value if ‘Maximum number of polls’ is 0.
275
MDLC over IP

seconds Default: 0
Specify interval in seconds between polls of peer. When a
peer is being paged, a poll request is sent. If no answer is
received after that period of time, another poll request
will be sent until the Maximum number of polls was sent
(next parameter).
Poll interval is measured independently for each site in
the IP conversion table.
If this parameter is 0, a single poll (or no polls) will be
sent to the peer according to Maximum number of polls
(0 or not.)
polls Default: 0
Specify the number of poll requests to send in order to
check if the peer is alive. When paging a peer, if no
response is received, it is polled again. If the peer has
been polled for the Maximum number of polls without
answering, it is considered as failed, and all transmission
are routed through an alternate path.
MDLC Session Logical Channels Advanced Parameters

Application layer
Stack size of Range: 1000-4000

application manager Default: 1300
task
Set to 2000 when diagnosing an ASTRO IP port, because
the ToolBox SW Diagnostics communicates with the
radio itself and needs more stack.
(For MOSCAD/MOSCAD-L V7.0x only.)
MDLC via Terminal Server (SLIP)

If the RTUs are on a Local Area Network (LAN), each can be connected to a Terminal Server
attached to the Ethernet. The Terminal Server converts the RS232 to the Ethernet LAN and
enables communication with an IP Gateway, or between RTUs.
276
MDLC over IP
In the diagram below, a typical configuration is shown, with RTUs attached via SLIP (Serial
Line IP) port to a Terminal Server, which is in turn attached to Ethernet.
With MOSCAD/MOSCAD-L > V9.10, Terminal server can be connected with PPP (Point to
Point Protocol) instead of SLIP, using a Null Modem connection, as specified under MDLC
over Null Modem.
Note: With a Null Modem connection over PPP, the RTU functions as Windows NT/2000 by
sending a client string and expecting a clientserver response. With a SLIP connection it does
not. This behavior can be overridden by downloading a modem configuration file.
SCADA
Central Programming
ToolBox
Ethernet
LINE 1
IP
RS-232 Gateway
Programming
ToolBox IP
Network
Ethernet
Terminal Server Terminal Server
LINE 1 LINE 1 LINE 1 LINE 1
MOSCAD MOSCAD MOSCAD MOSCAD

RS-232
RTU-IP1 RTU-IP2 RTU-IP3 RTU-IP4
Programming
ToolBox
MDLC via Terminal Server Setup

The general steps of the MDLC via Terminal Server Setup are identical to the MDLC via Astro
IP 3.xx Setup

In the Site Configuration tool, set up either Port 2 or Port 3 (with programmable piggyback
modem) as RS232, Async, SLIP, Terminal Server, and then MDLC over IP:
277
MDLC over IP
RS232, Async, SLIP, Terminal Server, MDLC over IP
The Advanced parameters are the same as described above for general MDLC over Astro with
the following exceptions:

Default routing IP Range: 000.000.000.001-255.255.255.254
address This should be the address of the Gateway on the LAN.
Physical Layer
Connection String (optional) If needed, can be used to send initialization
string to a connected device (e.g. to a Terminal Server)
upon RTU startup.
default, it is On.
Default: 1.
opened, and should be left as the default as specified in
MDLC over iDEN.
update its IP Address in all sites. If no group IP Address
exists, it will send a message it for each of them.
If Terminal Server is used with PPP using Null Modem, the following optional parameter
appears instead of Connection String:
Optional AT Specify an optional command to send when connecting to

Command String Terminal Server upon RTU startup. Usually for login into
Terminal Server (e.g. specify ‘\n’ for Equinox Terminal
Server).
Link Layer
A paging mechanism to each site (peer) in IP conversion table makes MDLC over IP more
reliable. If these parameters are not visible, they take their default values as 0, thus disabling
278
MDLC over IP
paging. They have the same meaning as in MDLC over Astro IP 3.xx. For more information,
refer to MDLC over IP Site Paging.

polls Default: 0
Modem Configuration File

For MOSCAD/MOSCAD-L RTUs ≥ V9.10, a modem configuration file can be downloaded to
the following PPP/SLIP ports (packet data modems):
RS232, Async, SLIP, iDEN, MDLC over IP
RS232, Async, SLIP, Standard Modem, MDLC over IP
RS232, Async, PPP, iDEN, MDLC over IP
RS232, Async, PPP, Tetra, MDLC over IP
RS232, Async, PPP, Null Modem, MDLC over IP
RS232, Async, PPP, ASTRO6 IV&D, MDLC over IP
For MOSCAD/MOSCAD-L RTUs ≥ V9.10, a modem configuration file can be downloaded to

the following dialup (circuit data) port:
RS232, Async, External dialup
(Note for dialup: You must use a new adapter instead of the old modem adapter called
RS232E+).
The modem configuration file (also called standard modem configuration file) is an ASCII file
with sections in which exact AT commands can be specified for connecting to a modem. Some
“environment variables” can be set as well to define the exact behavior of the port control
function (dealing with connecting the modem and checking that it remains connected.) This file
also contains special sections for diagnosing the modem using AT commands via Toolbox SW
Diagnostics.
Since several circuit data modems can be connected to RTU, the user should specify for which
port the file is being downloaded: i.e. port 1, 2 or 3. This is done in Toolbox Downloader
utility. Note that for now, only a single packet data modem/radio can be connected to an RTU.
The same configuration file can be used with different sections for circuit data programming
and packet data programming. Since dialup port (circuit data) and PPP/SLIP ports (packet data)
configure the modem differently, separate sections have been set for each type: The
ConfigureCD section configures a dialup port, and ConfigurePD configures a PPP/SLIP port.
279
MDLC over IP
For dialup ports only, a dedicated section called ChkVld is used to check that the modem is
operational and able to receive calls.
To enable the user diagnose the modem status, Diag0 to Diag7 sections have been allocated.
These sections are invoked when using the Toolbox SW Diagnostics level 223 or above. Level
223 is set for running Diag0, level 224 for Diag1, etc. This diagnostic disconnects the modem
temporarily while diagnosing the modem. For that reason, the dialup port will refuse to
perform this operation while in the middle of a call and returns an error. MDLC Over IP
enables this feature by disconnecting SLIP/PPP temporarily and turning it back on once the
diagnostics are complete.
Modem Configuration File Example

The following is an example of a modem configuration file for the G18 modem (G18.stm):
[Initialize]
$FileVersion= 1.10 ; Version of file 1.x must stay the same.
; Advised to increase revision on each
update.
$WaitForOk= 2000 ; Wait time for OK in milliseconds
$WaitForDial= 30000 ; wait time for Dialup in milliseconds
$WaitForDiag= 15000 ; Wait for diag timeout in milliseconds
$DTEIPAddr= 0.0.0.0 ; IP Address of DTE (MOSCAD).
; Set to 0 in order to obtain from radio.
$GtwyIPAddr= 0.0.0.0 ; IP Address default gateway.
$DTESubnetMask= 0.0.0.0 ; Subnet Mask
$Username= ; PPP user name if authentication is
needed.
$Password= ; PPP password if authentication is
needed.
$AbortSeqExist= 1 ; 1 - Modem support abort Sequence
$IgnoreCD= 2 ; 0 - Never / 1 - Always / 2 - Ignore CD
when connecting
$DisconctIcmpNet= 0 ; 1 - Disconnect modem when getting
ICMP:Net Unreach
$DisconctRxIdleTime= 900 ; Disconnect on idle timeout in seconds
(15 min)
; 0 - never disconnect if inactive,
$UnsetRtsTimeout= 2000 ; Wait time before restart the modem
(unset RTS).
$SetRtsTimeout= 4000 ; Wait time after restart the modem
(setting RTS).
$ModemAddress= 0 ; Modem/radio address (string)
$ModemVersion= 0 ; Modem/radio version (string)
$ModemName= Motorola GSM g18 ; Modem/radio type for diagnotic purposes
$ModemRSSI= -- ; Modem/radio RSSI
$ToggleRtsCommand= 0 ; 1 - Toggle RTS (modem's DTR) at
SetCommandMode
$pppechosendinterval= 0 ; PPP Echo send interval in milliseconds.
$pppechosendmaxretry= 0 ; PPP Echo send max retries.
$pppprocomp= 1 ; 1- Enable PPP protocol compression
$pppaddrcomp= 1 ; 1- Enable PPP address compression
$pppmaxmtu= 1500 ; PPP Max MTU frame size
$pppauthpro= 0 ; PPP Authentication Protocol
0xc023/0xc223
$pppasynctl= 0 ; PPP Async Control Char Map
$n_failstoreset= 2 ; Number of configuration failures to reset
modem
280
MDLC over IP
$max_failedtime= 120000 ; If failed to configure for 120 seconds

errorlog
; Applicable for IP and not for dialup modems
$WaitAfterDial= 2000 ; 2 seconds to wait after dialup to another
modem
; Relevant for dialup only.
$RetryModemConfig= 0 ; Set to 1 if need to retry modem
configuration
; Relevant for dialup only.
$RegLifeTime= 7200 ; Registration timeout in seconds
[Prereset]
; Does nothing except for unsetting RTS
; (powers modem's plastic box off)
[Postreset]
; Does nothing except for setting RTS
; (powers modem's plastic box on)
[SetCommandMode]
<><><1> ; Wait 1 second.
<+++><><1> ; Wait 1 second.
[HangupCD] ; **For MDLC over Dialup**

<ATH0x0D><> ; Send ATH\r. Expect no reply.
<ATH><NO CARRIER><4> ; Send ATH\r; Expect NO CARRIER reply
; within 4 seconds.
<AT><OK><2> ; Send AT\r; Expect OK reply within
; 2 seconds.
[HangupPD] ; **For MDLC over IP**
<0x7e0xff0x030xc00x210x050x020x000x040x590x280x7e><><2> ; Send LCP
; Terminate Request
<ATH0x0D><> ; Send ATH\r. Expect no reply.
<ATH0x0D><> ; Send ATH\r; Expect no reply.
<AT><OK><2> ; Send AT\r; Expect OK reply within
; 2 seconds.
[VerifyParms]
<ATI3><$ModemVersion> ; Send ATI3\r; store reply in $ModemVersion
<AT+CIMI><$ModemAddress>; Send AT+CIMI\r; store reply in $ModemAddress
<AT+CSQ><$ModemRSSi> ; Send AT+CSQ\r; store reply in $ModemRSSi
[ConfigureCD] ; **For MDLC over Dialup**
<><><5> ; Wait 5 seconds after modem recovers.
<AT&F0><OK> ; Restore to factory configuration.
<ATE0V1Q0X4&C1S0=2><OK> ; Configuration string
<AT+CMGF=10x0D><><2> ; Set modem in SMS text mode.
<AT&W0><OK> ; Save in profile 0.
<AT&Y0><OK> ; After powerup, load profile 0
[ConfigurePD] ; **For MDLC over IP**
<AT><OK><2> ; Send AT\r; expect OK reply within 2
; seconds.
<AT&F0&D0&C2&K3E0V1W1S95=47><OK><2> ; Configuration within 2 seconds.
<AT+CMGF=10x0D><><2> ; Set modem in SMS text mode
<AT+CGATT=1><OK><5> ; Attach to GPRS; expect OK reply within 5
; seconds.
<AT+CGPRS?><+CGPRS: 1><2> ; Check GPRS coverage.
; Expect +CGPRS: 1 reply.
<AT+CGDCONT=1,"IP","intranet.motorola.co.il","0.0.0.0",0,0><OK><4>
; Define APN - PDP contact (profile)
[DialPD] ; **For MDLC over IP**
<ATD*99#><CONNECT><40> ; Set Modem in PPP mode by dialing ATD*99##
281
MDLC over IP
[GoOnLine] ; **For MDLC over Dialup**

<ATO><CONNECT> ; Go online from command mode (circuit data).
[ChkVld] ; **For MDLC over Dialup**

<AT><OK> ; Send AT\r; expect OK.
<AT+CREG?><+CREG:000 001> ; Send AT+CREG?\r; expect +CREG:000 001
; reply.
[Diag0] ; This is level 223.
<ATI3><$Diag> ; Modem version :
<AT+CIMI><$Diag> ; Modem IMSI :
<AT+CPIN?><$Diag> : Modem pin number:
<AT+CGMR><$Diag> : Hardware Version:
<AT+CGMI><$Diag> : Manufacturer :
<AT+CSQ><$Diag> ; Signal quality :
<AT+CREG?><$Diag> ; Registration :
<AT+CGATT?><$Diag> ; Is GPRS Attached:
<AT+CGPRS?><$Diag> ; Is GPRS Covered :
<AT+CMGF?><$Diag> ; Is in Text mode :

<ATE1><OK>
<AT&V><$Diag><2>
Modem Configuration File Sections

Several modem configuration files are included as part of the MOSCAD Programming
ToolBox 9.52 installation. The structure of the modem configuration file is comprised of the
following sections.
Section Name PPP/SLIP port Dialup Invoked when

Initialize Starting to configure Starting to configure Starting to configure
modem or when a new file modem or when a new file modem.
was downloaded. was downloaded.
SetCommandMode Hanging up SLIP/PPP. Hanging up call.
HangupCD Hanging up call. Dialup only.
HangupPD Hanging up SLIP/PPP. SLIP/PPP only.
Hanging up SLIP/PPP is
invoked when need to
diagnose modem, or when
start to configure it.
VerifyParms Configure modem in SLIP/PPP only.
SLIP/PPP Step [1]. Modem is configured when
it is detected that
SLIP/PPP is not connected
or when RTU is restarted
or when a new file is
downloaded.
ConfigureCD Configuring modem made Dialup Only.
at power restart or when
check validity fails. Step [1]
of 3.
282
MDLC over IP

ConfigurePD Configure modem in SLIP/PPP only.
it is detected that
SLIP/PPP is not connected.
VerifyIPParms Optional step before SLIP/PPP only.
DialPD. If need to read modem IP
Address via AT commands
such as iM1000.
DialPD Configure modem in SLIP/PPP only.
it is detected that
SLIP/PPP is not connected.
ChkVld Checking modem able to Dialup only.
receive calls. Made when If fails, modem is
modem was idle for reconfigured.
specified number of
seconds.
Diag0 SW Diagnostics of LIN1L SW Diagnostics of LIN1D LIN1L and LIN1D is the
level 223. level 223. name of the port with
LINE1 link ID.
This section is optional.
Diag1 SW Diagnostics of LIN1L SW Diagnostics of LIN1D This section is optional.
level 224. level 224.
The following new sections are available as of MOSCAD V9.24. If a file including these variables is
downloaded to older firmware, they will be ignored and no error will be generated.

Prereset Issue reset AT command to Issue reset AT command to RTU≥9.24 only.
radio/modem when radio/modem when
applicable. Some modems applicable. Some modems First time configuring
can be powered off and on can be powered off and on modem, or after failed to
this way. this way. configure several times
consecutively.
283
MDLC over IP

Postreset Check if modem connected Check if modem connected RTU≥9.24 only.
after restarted. after restarted.
After restarting modem
and waiting for it to
recover.
MDLC over IP Modem Configuration

The MDLC over IP port runs certain sections of the modem configuration file to configure the
modem and set it in PPP/SLIP. This is done using a packet data modem connection such as
Standard Modem or Tetra. During this time, the port is not considered eligible for
transmission, and any transmissions are held pending for a predetermined time in a queue.
This time is determined in the site configuration in the Advanced Link Layer Modem
Configuration Timeout parameter.
Modem restart
This section applicable for RTU ≥ V9.24 only.
1. Prereset section.
2. Toggle RTS.
3. Postreset section.
This section is issued when first configuring the modem, or after failing to configure the
modem several times consecutively. The [Prereset] section is intended to restart power via an
AT command. If the modem does not support this feature, leave this section empty.
Depending upon the hardware setup with the modem, the RTU RS232 signals may be used to
power it off and on. For example with G18, the RTU toggle its RTS and powers off and on the
modem. A new board FCN6070 provides that feature for some portable radios such as ASTRO
IV&D XTS2500.
Finally, the RTU waits for the modem to power up, and then checks if it is alive by running the
[Postreset] section.
The RTU will not continue configuring modem until the modem restart succeeds. Leave those
sections empty if they are not supported by your modem.
Modem disconnection:
4. SetCommandMode section.
5. HangupPD section.
This puts the modem into command mode and makes sure the modem is connected to the port
prior to configuring it.
284
MDLC over IP
In some modems such as G18, an LCP Terminate Request must be sent. This binary string,
which is part of the PPP protocol, makes sure that the modem disconnects PPP, if it was on.
Therefore this is the first string sent in the HangupPD section.
Note for SetCommandMode: Some modems do not support an abort sequence (a 1 second idle
line, followed by +++ string and another 1 second of idle line.) When a modem is connected
this sequence sets it in command mode, where it can be programmed using AT commands.
However, for modems that do not support this feature, leave section [SetCommandMode]
empty, and set the following variable ToggleRtsCommand=1. This will force the RTU to
toggle its RTS output when setting command mode. Using a proper RS232E+ adaptor/cable
(FTN6359A) will connect that signal to the modem’s DTR input, causing it to disconnect. For
that to work, the modem must have been configured previously with AT&D1.
Modem configuration:
6. VerifyParms section. Verifies modem identity. This is not a mandatory section.
7. ConfigurePD section.
8. DialPD dialup modem and place it in PPP/SLIP mode. This cause modem to register
within infrastructure.
Once modem has been configured it is now monitored to maintain that connection. Its PPP
connection is monitored as well as its DCD signal, which shows that it is active. This indicates
that the modem is indeed registered and able to receive and transmit IP over the air. Some
modems do not have DCD. A variable named IgnoreCD can be set to 2 (IgnoreAlways) so the
DCD will not be polled. It is recommended to consult with technical support before using such
a modem/radio.
SLIP based modems do not have a protocol to check if they are connected. Only the DCD
signal conveys this information. Once dial has succeed, SLIP is set up immediately, and DCD
is checked to be active. If so, then the port is eligible for transmission, and pending frames are
transmitted.
PPP based modems initiate PPP once you dial into it. Unlike SLIP, connecting PPP involves
actually registering the modem within the infrastructure. This may take several seconds or up
to a minute. During this time, the port is not considered eligible for transmission and any
transmissions are still held pending in queue. Once PPP is connected, the frames can be
transmitted.
The modem is configured in the following situations:
1. When it is detected that the modem is not PPP connected, or its DCD has dropped;
2. When the RTU experiences a power restart (with or without battery);
3. When the RTU restarts because of a new configuration;
4. When downloading a new configuration file;
5. When diagnosing the modem using modem configuration file; levels 223 and above are
used for that purpose.
In the last three cases, the modem is disconnected and is not configured immediately. When
diagnosing using a modem configuration file, the modem is interrogated using AT commands,
285
MDLC over IP
and its responses are queued within the MDLC over IP port. Once all responses received,
MDLC over IP port reconfigures the modem as specified above.
Note that if it is done remotely, e.g. over a GPRS network, the diagnostic response may take 30
seconds or more. The user should set the modem configuration timeout to be long enough so
that the response does not get lost. A 30 seconds timeout is a typical delay but it may need to
be extended to 60 seconds.
MDLC over Dialup Modem Configuration

The user can configure the modem from the RTU using the MDLC over Dialup port. In
previous systems, the user had to configure the modem externally (e.g. PC terminal) and then
save those parameters in the modem. As of MOSCAD systems ≥ V9.00, a config modem
string can be defined in the Physical Layer to configure the modem. As of MOSCAD systems
≥ V9.10, the modem configuration file enables the user includes the config modem string and
other AT commands. If no modem configuration file exists, the config modem string will be
used. If both exist, the modem configuration file will be used.
MDLC over Dialup is different than MDLC over IP in the way it configures modem and
connects it. It is important to note that the same modem can work in both modes, but the user
must decide when configuring the port, what method to use. With MDLC over Dialup, the
modem is placed in circuit data mode, meaning it establishes phone call conversations with
remote sites upon transmitting to them. It accepts calls when another site transmits an MDLC
frame to it. Most of the time the modem is idle, meaning it is in command mode. It only
moves into data mode, when it needs to transmit or is called from another site. After a
predetermined idle time, the modem disconnects the call. With MDLC over IP, the modem is
ALWAYS in a “call”. The “call” is actually SLIP or PPP mode. This enables it to receive
MDLC over IP frames from remote sites, as well as sending them. This “call” does not
consume any air resources since it begins with the RTU and ends in the modem itself.
MDLC over Dialup configures the modem by running the following sections of the modem
configuration file:
Modem disconnection:
1. SetCommandMode section.
2. HangupCD section.
This puts the modem into command mode and makes sure the modem is connected to the port
prior to configuring it.
Modem configuration:
3. VerifyParms section. Verifies modem identity. This is not a mandatory section.
4. ConfigureCD section.
Once the above is accomplished, the modem is not connected. It simply waits for calls, and if
frames need to be transmitted, the RTU initiates a call to a remote site.
To make it more reliable when using wireless modems such as G18 GSM modem in dial mode,
the modem is monitored periodically to check if it is registered. This is done by running the
chkvld section every few seconds. This section is optional, and if empty, no action is taken.
286
MDLC over IP
In the G18.stm file, this section is not empty; if it fails to get an appropriate response from the
modem, it reconfigures modem as specified above.
Diagnosing the Modem over the MDLC over Dialup Port

MDLC over Dialup can also diagnose a modem using its modem configuration file. This is
done by connecting the MOSCAD Programming ToolBox and running the SW Diagnostics on
Device LIN1D Level 223 or above. If the appropriate DiagX section (e.g. Diag0 for 223,
Diag1 for 224) does not exist in the modem configuration file, no action is taken. If it exists,
the modem is interrogated and its responses are displayed in Toolbox SW Diagnostics.
Note that for MDLC over Dialup, if a phone call is held, this operation is not executed and an
error is displayed. This means, that unlike MDLC over IP, diagnosing the modem using its
configuration file cannot be done remotely over dialup. (It can be done either locally from
another port or remotely from another link.)
Modem Configuration File Variables

The variables listed below control the way modem is configured by the RTU.
The modem configuration file serves both types of ports: MDLC over IP port connected to a
packet data modem over SLIP/PPP and MDLC over dialup port connected to a circuit data
modem. For MDLC over IP some of these variables also appear in the Site Configuration and
are marked accordingly. Some of these variables are relevant only for SLIP/PPP (packet data),
and some are relevant for dialup as well.
The variables are initialized in the modem configuration file in the [Initialize] section
each time modem is to be configured. If a variable exists in the file, that value overrides default
settings in the site configuration.
There are three types of variables:
• INT – Four byte integer variables representing time or Boolean (true or false) values.
Boolean values are 0 for false and 1 for true.
• IP Address – Four digit IP addresses in the form of xxx.xxx.xxx.xxx where xxx ranges
from 0 to 255.
• String – Any character string up to 30 characters.
Usually a variable is set manually in the [initialize] section as explained above. For
example:
$WaitForOk= 2000
sets the WaitForOK variable to 2000.
A variable can also be set/overridden from the modem. For example:

<AT+CIMI><$ModemAddress>
sends the AT+CIMI command to the modem and sets the ModemAddress variable to the
modem address in the response.
287
MDLC over IP
All variable values can be viewed using the Toolbox SW Diagnostics level 221 for LIN1L (or
LIN1D in dialup port). LIN1 stands for link ID LINE1. If a different link ID is used, such as
LINE7 the device would be LIN7L or LIN7D.
The FileVersion variable is used to identify the modem configuration file version.
FileVersion=xx.yy, where xx is the file version and yy is the file revision. When the file
is downloaded, the RTU verifies that it supports its version.
The file version (xx) should not be changed unless stated. The revision number (yy) is used to
keep track of your changes to the file. It has no meaning to the modem but it is recommended
that it be increased each time the file is changed. For the first release of this feature, the file
version should be set to 1.0.
Variable name Meaning Type Comment

FileVersion File version and revision: STRING Used for both PPP/
version.rev (e.g. 1.0) SLIP and dialup.
The following variables are used when programming the modem. Some of them are
SLIP/PPP-specific. Some are common to both MDLC Over IP and MDLC Over Dialup.

WaitForOk Default timeout in millisecs INT Common to both
to wait for modem reply MDLC Over IP and
MDLC Over Dialup
WaitForDial Default timeout in millisecs INT MDLC over Dialup

to wait for connection to only
succeed when dialing
WaitForDiag Timeout in millisecs used INT Common to both

when diagnosing modem; has
no meaning for now
DTEIpAddr IP Address of RTU IP Address MDLC Over IP only
DCEIpAddr IP Address of modem IP Address MDLC Over IP only
GTWYIpAddr IP Address of gateway IP Address MDLC Over IP only
DTESubnetMask Subnet mask of modem IP Address MDLC Over IP only
DTEPrefixlen Number of 1s (most INT MDLC Over IP only

significant bits) in subnet (iDEN especially)
mask, e.g. 16: 255.255.0.0
UserName Username to be used when STRING MDLC Over IP only

authenticating PPP using Also found in Site
PAP or CHAP configuration user
section.
288
MDLC over IP

Password Password to be used when STRING MDLC Over IP only
authenticating PPP using Also found in Site
PAP or CHAP configuration user
section.
AbortSeqExist 1 if modem supports abort INT Common for both
sequence. Abort sequence is
+++ string sent to modem in For MDLC over IP,
order to change it from data also found in Site
to command mode. configuration
Advanced Link.
IgnoreCD Whether or not to ignore CD. INT Common to both

0 – never ignore, 1 – ignore
always, 2 – ignore during For MDLC over IP,
dial. also found in Site
configuration
Advanced Link.
DisconctIcmpNet Disconnect modem when INT MDLC Over IP only

getting ICMP:Destunreach Also found in Site
configuration
Advanced Link.
DisconctRxIdleTime Disconnect modem when not INT MDLC Over IP only

getting anything for Also found in Site
RxIdleTime in seconds. 0 configuration
means it will never be Advanced Link.
disconnected.
SetRTSTimeout Time to wait after setting INT Common to both

RTS in milliseconds and
powering on the modem
where applicable (e.g. G18
and XTS2500 ASTRO
IV&D radio)
UnsetRTSTimeout Time to wait after unsetting INT Common to both

RTS in milliseconds and
powering on the modem
where applicable (e.g. G18
and XTS2500 ASTRO
IV&D radio)
ToggleRTSCommand 1 if need to toggle RTS when INT Common to both

setting modem in command
mode.
0 RTS will not be toggled
when setting modem in
command mode.
289
MDLC over IP
The following variables are for diagnostics only.

ModemName Name of modem STRING Common to both
ModemAddress Address of modem such as STRING Common to both

MAC address
ModemVersion Version of modem STRING Common to both
ModemRSSI RSSI of modem STRING Common to both
The following new variables are available as of MOSCAD V9.24. If a file having these
variables is downloaded to older firmware, they will be ignored and no error will be generated.
Some of these variables can be set from Site Configuration of Toolbox 9.54 as well. If in a
file, their value set in that file overrides those settings.

Pppechosendinterval PPP Echo send interval in INT MDLC over IP only.
milliseconds. By default it is
0. To support modems that
do not provide DCD input to
RTU, RTU will poll modem
using PPP in order to check
if it is connected.
Pppechosendmaxretry PPP Echo send max retries. INT MDLC over IP only
If modem does not reply
within that limit, it is
detected as disconnected.
RTU will try to reconnect it
via PPP.
Pppprocomp PPP protocol compression. INT MDLC over IP
This parameter can be 0 or 1.
By default it is 1 which
specifies that the RTU use
this option. For those CDMA
modems which do not
support that feature, it should
be set to 0.
Pppaddrcomp PPP address compression. INT MDLC over IP
This parameter can be 0 or 1.
By default it is 1 which
specifies that the RTU use
this option. For those CDMA
modems which do not
support that feature, it should
be set to 0.
290
MDLC over IP
PPPmaxmtu PPP maximal frame in bytes. INT MDLC over IP

1500 is standard.
Pppauthpro PPP authentication protocol. INT MDLC over IP
If 0, it will be negotiated with
the modem via PPP protocol.
Two other authentication
protocol supported are
0xc023 (PAP), and 0xc223
(CHAP). The user can force
the RTU to ask for another
protocol, but as a PPP client
this is usually 0.
PPPasynctl PPP Async Control Character INT MDLC over IP
Map. Usually set to 0.
291
MDLC over IP
The following variables are available as of V9.24 and are not PPP related:

N_failstoreset Number of configuration INT MDLC over IP
failures to reset modem. This
MDLC over Dialup
parameter is interpreted
differently in MDLC over IP
than in dialup.
In MDLC over IP, when
failing to connect to the
modem several times, it
determines after how many
failures to restart the modem.
If 0, it will never be restarted.
In dialup, the modem is
restarted immediately after
detecting it has failed. If this
parameter is 0, it will not be
restarted.
Max_failedtime This parameter is in INT MDLC over IP
milliseconds.
If the RTU failed to connect
with modem for 120 seconds,
it will notify the error logger.
WaitAfterDial Time to wait in milliseconds INT MDLC over Dialup
after dialing to another
modem and getting
connected. This is to enable
the other modem enough
time to connect. By default
this parameter is set to 2000
(2 seconds).
RetryModemConfig If set to 1, instruct the RTU INT MDLC over Dialup
to keep retrying to configure only
modem in case it was
disconnected and failed
configuration.
By default it is 0: The RTU
will try to configure modem
only once, and if it fails will
not retry.
The following variable is for the [DiagX] section such as Diag0. It instructs the RTU to route
the modem response into the Toolbox SW Diagnostics.

Diag Last modem response when STRING
executing Diag section.
292
MDLC over IP
Modem Configuration File Command Syntax

The format of the AT commands in the modem configuration file is as follows:
<AT command><Expected response><Timeout in seconds>
If no <AT command> is specified, no command will be issued. Note that empty brackets <>
must be used if no command is to be issued.
If no <Expected response> is specified, the RTU will wait the specified timeout and ignore any
response. Note that empty brackets <> must be used if no response is expected. ‘0x0D’ should
be appended to the AT command with in this case.
If no <Timeout in seconds> is specified, the RTU will wait $WaitForOkTimeout seconds for
the modem to respond.
If the received response does not match the <Expected response>, the RTU will keep waiting
for specified timeout (500 milliseconds). If the desired response is still not received, it will
restart modem configuration again.
Each AT command is automatically appended with \r (0x0D Hex), unless <Expected

Response> is empty. In that case, ‘0x0D’ should be appended explicitly in the command.
Each AT command response is automatically prefixed and appended with \n\r (0x0A and
0x0D) by the modem. When specifying the <Expected response>, there is no need to specify
them.
<Expected response> can also be an environment variable. For example:

<AT+CIMI><$ModemAddress>
will issue the AT+CIMI Command and put its response in ModemAddress variable.
Multiple responses can be expected by specifying them inside the braces (of expected
response). For example:
<ATH><(OK)(NO CARRIER)>
will expect either OK or NO CARRIER response.
<AT+CREG?><+CREG:00(0)(1) 001>
will expect +CREG:000 0001 or +CREG:0001 001 as an output.
The \ delimiter can be used as an escape character if ‘$’ or ‘>’ is within an AT command or a
response, as follows:
<AT\$command><OK>
will issue AT$command and expect an OK response.
One can also send binary bytes instead of ASCII by prefixing each byte with ‘0x’ as follows:
<0x7e0xff0x030xc00x210x050x020x000x040x590x280x7e><><2> ; LCP
Terminate Request
This string is a binary string comprised of the bytes 7e in hex, ff in hex, 03 in hex etc. It is used
for terminating a PPP session.
293
MDLC over IP
IP Conversion Table
When the MOSCAD over IP option is installed, the IP Address Table icon will be added to the
MOSCAD Programming ToolBox folder. Click on the icon to start the tool. Add entries for
each Site ID, as shown below.
Note that for MDLC over Astro3.xx, all IP addresses in the IP conversion table must be
registered in WINGS. These can be changed remotely afterwards. If an RTU IP address is
changed in the site configuration and downloaded, then the RTU updates the radio which
updates the WINGS box. Entries in the WINGS box need not be updated manually.
In PPP, the IP Address is usually read from the radio once it is connected to the RTU. In Astro
IV&D, this is not the real IP address set by the infrastructure; rather, it is a dummy address
configured in the radio via the CPS Mobile Computer IP address which is (by default
192.168.128.2). In the IP conversion table do not specify this address, but the actual IP address
assigned by the infrastructure operator. Note: The IP Address display by the MOSCAD
Programming Toolbox SW Diagnostics LIN1L level 0 is the dummy address and should not be
used in the IP conversion table.
For Astro IV&D, it is recommended to create two IP conversion tables – one that will be
downloaded to an EPIB or IP Gateway on the LAN – which are not connected with the radio,
and one to all other RTUs which are connected with the ASTRO IV&D radios. The first will
include the above information concerning each RTU, and the second will have only the EPIB
and IP Gateway.
For MDLC over iDEN, MDLC over Tetra, and MDLC over Standard or Null Modem, consult
the system provider for the infrastructure relating to the IP addresses.
You can also check the IP Address yourself. After the RTU is configured using Site
configuration, connect the modem to the RTU, and invoke the SW Diagnostics tool in the
Software Diagnostics & Loggers utility. For a port link ID named LINE1, first run device
LIN1L level 101 and see if the state of the configuration task is “Connected and registered”.
Then run level 0, and see the RTU IP Address as obtained from the modem.
294
MDLC over IP
For all variations of MDLC over IP except MDLC via Telnet, download the IP conversion
table to all the RTUs in the network.
IP Gateway Configuration
Site Configuration
Configure a Port 1 as MDLC over IP, as follows:
(Note that this is one of the virtual ports over Port 1, rather than physical port.)
Link ID: (e.g. LINE 1) Same as for all RTUs.
Port number: (e.g. 2002) Same as for all RTUs.
Default group IP Same as for all RTUs. For Astro IP, this is the same as
address the address registered in the WINGS Box. (See RTU Site
Configuration.) This is optional.
The rest of the parameters are set up according to normal IP Gateway procedures. Any
exceptions or known problems are described in the release notes.
IP Conversion Table
Prepare an IP conversion table with IP addresses of all RTUs and IP Gateway, identical to the
one prepared for the RTUs. Note that the same file may be used.
Download
Download the site configuration and IP conversion table along with network configuration, if
necessary to the IP Gateway.
User Application
Because there is no full ACK between RTU and RTU, you have to be careful about using
TxFrm. It is possible that frames will be lost because there is no Frame Sequence and no End
to End Acknowledge. This ACK may be done at the application level, if necessary.
MDLC over IP Connection Verification

Once the setup for the desired MDLC over IP variation is completed and the necessary files
(site configuration and IP Conversion table and perhaps modem configuration file) have been
downloaded to the RTU, the connection should be verified.
1. Check that the radio/modem is powered up. This can generally be done by checking
the radio display. For Astro radios, the RTU powers it off and on every few seconds, if
295
MDLC over IP
it is unable to context activate it. If the radio has no display (e.g. Astro model type I),
check that the LED on top is turned on when the PTT button is pressed.
2. Check the connection status using the MOSCAD Program Toolbox Software
Diagnostics tool. In device LINxL, level 101, verify that the State of configuration
task is set to Connected and Registered. (This means that the radio is context
activated.) In device LINxL level 0, check that the IP Address was set by the
radio/modem/infrastructure (no longer 000.000.000.000). Next, check that the Port is
in Fail diagnostic is set to No.
3. If the above diagnostics indicate a configuration failure, repeat the steps described in
the MDLC over IP setup for the desired variation and check the physical connection
between the RTU and the radio. Certain Astro IV&D and GPRS radios/modems that
are not context activated will be restarted by the RTU. You can recheck the State of
Configuration Task and the Cause for configuration failure diagnostics and check the
error logger after two minutes. Verify that the Site ID appears in the IP Conversion
table, check the IP addresses, etc. For Astro IV&D radios that were configured using a
CPS, verify that the radio was programmed correctly.
4. Once the radio has been successfully context activated by the RTU, check the
communication over the air. For example, try to read the error logger from a remote
RTU using the MOSCAD Programming Toolbox. The local RTU should be able to
communicate with the remote RTU over the radio/modem.
296
MDLC over IP
MDLC via TELNET

MDLC via TELNET requires the purchase and use of the Terminal Server option in the IP
Gateway.
Communication between RTUs and between RTUs and IP Gateway is performed by opening
channels over TELNET in the IP Gateway. Each RTU must have a separate channel and every
channel must have a separate link ID. Data transmitted from one RTU to another is switched
by the IP Gateway, even if both RTUs are connected to the same Terminal Server. Therefore,
the MDLC network grows with each RTU added to the network, and overhead is created when
transmitting data over the network. This is in contrast to MDLC via Terminal Server and
MDLC via Astro IP, where all the RTUs and IP Gateway share the same link ID.
In the diagram below, a typical configuration is shown, with several RTUs attached via
TELNET to a Terminal Server, which is in turn attached to Ethernet.
All versions of RTUs can be connected to Terminal Server via TELNET.
SCADA
Central
Ethernet
RSLINK 1.....RSLINK4
MCP/T or
RS-232 IP Gateway
Programming
ToolBox IP
Network
Ethernet
Terminal Server Terminal Server
RSLINK 1 RSLINK 2 RSLINK 3 RSLINK 4
MOSCAD MOSCAD MOSCAD MOSCAD

RS-232
RTU 1 RTU 2 RTU 3 RTU 4
Programming
ToolBox
MOSCAD Ethernet Interface

This section refers to MOSCAD ≥ V3.7x and MOSCAD-L/MOSCAD NFM ≥ V1.00 and
requires the purchase of the MOSCAD over IP option for ToolBox (ToolBox versions ≥
V7.51.)
In order to allow MOSCAD and MOSCAD-L RTUs to communicate over Ethernet media, the
following two products have been developed:
297
MDLC over IP
• Ethernet plug in board (EPIB) - It is plugged in on Port 3 of MOSCAD/MOSCAD-L.

The connection to Ethernet is via the 10BT connector on the EPIB.
• Ethernet unit (EU) – It is enclosed in compact plastic and it includes two ports. The
connection to Ethernet is via the 10BT port and the connection to MOSCAD/MOSCAD-L/
MOSCAD NFM RTU is via the RS232 port on the EU. The EU can be connected to any
RS232 port of MOSCAD/MOSCAD-L/MOSCAD NFM RTU. The EU is utilized on
MOSCAD/MOSCAD-L in cases when the EPIB cannot be plugged into Port 3.
The functionality of the EPIB and EU is identical. Within the scope of this document, the EPIB
and EU products are referenced as EPIB.
The figure below illustrates an example of SCADA system with IP Gateway and MOSCAD
RTUs connected to Ethernet LAN:
SCADA
Central Programming
ToolBox
Ethernet 1
LINE 1
IP
RS-232 Gateway
Programming
ToolBox IP
Network
Ethernet 2
Ethernet 3
10BaseT 10BaseT
10BaseT
Ethernet MOSCAD MOSCAD
Unit RTU-IP2 RTU-IP3
RS-232 with with
Ethernet Ethernet
MOSCAD Plug-in Plug-in
RTU-IP1 board on board on
RS-232 Port 3 Port 3
Programming
ToolBox
The MOSCAD RTU with EPIB provides TCP/IP connectivity over Ethernet LAN – for both
SCADA and NFM systems. In addition, it supports transmitting/receiving of MDLC packets
that are enveloped inside IP datagrams. This feature is known as MDLC via IP or MDLC over
IP.
For NM application, the MOSCAD RTU with EPIB, based on SNMP /UDP, provides the
NMC (Network Manager Center) users with the current status of NE (Network Element)
objects and with the events (Traps) that are associated with each entity.
For SCADA application, the MOSCAD RTU with EPIB, based on TCP/IP API, provides the
users with the current values of the MOSCAD tables and with the events (Bursts) that are
associated with each entity.
298
MDLC over IP
The SCADA central or the NM manager can access the database of the MOSCAD RTU with
EPIB by using the TCP/IP API or the SNMP protocol. The SCADA central or the NM
manager can access directly to the Data Base of the MOSCAD RTU with EPIB only, but not to
the data Base of any other MOSCAD that is connected to it via the MDLC network.
The figure below describes the architecture of NM and SCADA systems that are based on IP
network and includes control center workstations and computer that exchange data with the
MOSCAD RTU with EPIB.
Programming
Control Center ToolBox
NM or SCADA
Platform
TCP/IP on Ethernet
Router
WAN
Router Router Router

MUX TCP/IP on Ethernet
TCP/IP on Ethernet TCP/IP on Ethernet
MOSCAD MOSCAD MOSCAD

Microwave RTU 1 RTU 2 RTU 3
with EPIB with EPIB with EPIB
Environmental
Sensors SCADA Relays and
Communication
Site Sensors
Site
Configuring MOSCAD RTU with EPIB

The user should configure the MOSCAD/MOSCAD-L/MOSCAD NFM port to which the
EPIB or EU is plugged in or is connected to. In Site Configuration this port should be defined
as follows:
• Port type: RS-232,Async,RTU-to-RTU

• Link name: Line 1
• Data speed : 19200 Bps
Ethernet IP Interface Configurator Utility for IP Configuration

In order to configure the EPIB unit, the Ethernet IP Interface Configurator utility is used. This
utility will appear in the main MOSCAD Programming ToolBox folder when the MOSCAD
over IP option has been purchased and installed.
After activating the Ethernet IP Interface Configurator program, the user should define the IP
Configuration and the SNMP Configuration parameters. In addition, the user should define the
IP Conversion Table. The IP Conversion Table is needed only if the MDLC network is
299
MDLC over IP
extended by the IP network or, in other words, the MDLC frames are enveloped in IP
datagrams (MDLC over IP is being used).
The defined SNMP Configuration, IP Configuration and the IP Conversion Table are then
downloaded to the EPIB from the Ethernet IP Interface program or by specifying Remote Site
ID of 65286 from the MOSCAD Programming ToolBox IP Conversion Table utility.
Once the IP address of an EPIB unit has been configured, it can be redefined remotely by
downloading a new IP Interface configuration.
To configure the EPIB, set the IP and SNMP Configuration parameters shown in the figures
below.
IP Configuration parameters
IP Interface (MOSCAD) IP ADDRESS
Range: 000.000.000.001-255.255.255.254
IP address of the MOSCAD RTU with EPIB. For information on this and other IP Addresses in
the configuration, see your network administrator.
Default Router IP Address
Range: 000.000.000.001-255.255.255.254
Net Mask Address
Range: 000.000.000.000-255.255.255.255
300
MDLC over IP
The figure below shows the SNMP Configuration parameters to be set.
SNMP Configuration parameters

Name
The Name identifies the name of the MOSCAD RTU with EPIB’s location/zone. The NMC
(Network Management Control Center) application retrieves this name by using the IP
Gateway MIB.
SSC SUPPORT
The SSC Support button allows selecting the type of the Gateway MIB. When this button is
enabled, the selected MIB supports Motorola specific OmniLink and SmartZone systems. If the
SSC Support button is disabled, the generic MIB is supported.
Source IP
The MOSCAD RTU with EPIB sends SNMP Trap_PDUs that include a virtual “source IP”
address.
Manager Host IP
The MOSCAD RTU with EPIB sends, without the need for registration, SNMP Trap_PDUs to
the SSC manager with “Manager host IP” address.
Manager Port ID
The MOSCAD RTU with EPIB sends SNMP Trap_PDUs to the SSC manager with non-
standard SNMP Port ID.
MIB II
The following four fields are part of MIB II parameters that define the contact person’s name
and the location of the MOSCAD RTU with EPIB, as well as the Community Strings that serve
as passwords for accessing the MOSCAD RTU with EPIB.
301
MDLC over IP
Contact
The name of the contact person responsible for setting, configuring and maintaining the
MOSCAD RTU with EPIB and all NFM RTUs and devices installed at the communication
sites.
Location
For maintenance purposes, the address of the location of the MOSCAD RTU with EPIB device
should be provided. The NMC application or the MIB Browser can retrieve this address by
using the MOSCAD RTU with EPIB MIB.
Community Read
The definition of the Community String Read provides a READ security password to the
MOSCAD RTU with EPIB. The NMC should supply the same Community String (case
sensitive) in order to read information from the MOSCAD RTU with EPIB:
(Get_PDU/Get_Next_PDU Requests PDUs) and for sending Traps).
Community Write
The definition of the Community String Write provides a WRITE security password to the
MOSCAD RTU with EPIB. The NMC should supply the same Community String (case
sensitive) in order to write information to the MOSCAD RTU with EPIB: Set_PDU Request.
DB Refresh Interval[s]
The database refresh interval specifies the refresh (validity) interval in seconds of the data
received from the sites in the internal MOSCAD RTU with EPIB cache. The data is discarded
after this interval expires.
Direct EPIB Connection

An external EPIB (Ethernet Unit) can be configured by directly connecting a ToolBox to it, as
shown below.
RS-232
Special
MOSCAD
Cable EPIB RS-232
RTU
from PC from EPIB
to EPIB Port 2 to
Programming Port 1 RTU Port 1
ToolBox or 2
The connecting RS232 cable (not provided by Motorola) should be a D-type connector adapter,
female with 25 or 9 pins configured as below. Note that the location of the pins in the 8-pin
connector is from left to right (1 to 8).
302
MDLC over IP
RS232 Pin 8-pin Connector 25-pin 9-pin Direction

Function (on Ethernet Female Female
Unit) (on PC) (on PC)
TX-DATA 1← 2 3 from PC
RX-DATA 2→ 3 2 to PC
RTS 6← 4 7 from PC
CTS 3→ 5 8 to PC
CD 5→ 8 1 to PC
PGND 4 7 5 Protective
Ground
DTR 8← 20 4 from PC
The RTU port data speed should be set using the ToolBox to 19200. Once the ToolBox is
connected to the EPIB, other downloading, programming or diagnostic operations may be
performed.
Errors or diagnostics from the EPIB can be read using the ToolBox either directly from an
external unit or via the MOSCAD from the plug in board. In order to do so, set up the
ToolBox communication with Site ID 65286 Link ID LINE 1.
Download
Once the IP Interface Configuration has been completed, it is downloaded to the EPIB unit,
using the Download icon or the Download command from the Tools menu. The name of the IP
Conversion table must also be specified (see below) so that it too will be downloaded. The
button to the right of the checkbox enables the user to browse for the IP Conversion table
name.
After the Ethernet IP Interface Configuration has been downloaded to the EPIB, it can be
changed remotely. In the Comm Setup utility, specify the EPIB IP address. Run the Ethernet
IP Interface Configurator utility and modify the IP/SNMP settings. Specify the IP Conversion
table and download the new Ethernet IP Interface configuration.
303
Authentication
General
The information in this chapter refers to MOSCAD and MOSCAD-L ≥ V8.00.
This feature is available in ToolBox versions ≥ V8.50, but the option, named Authentication
over MDLC, must be purchased separately. A separate license is required for each
authenticated RTU.
With the Authentication option, MOSCAD RTUs/IP Gateways can rely on the integrity of
information sent on the MDLC network. An RTU/Gateway can be certain that received data
was transmitted by the original sender and not by some other, unauthorized source.
In order for authentication to work, the clocks of RTUs connected to the authenticated links
must be synchronized. Each MDLC data packet transmitted over an authenticated link is
marked with an encrypted timestamp (ETS) which indicates when the frame was sent.
Information whose timestamp has expired will be discarded as invalid (though negative
acknowledgement is not sent).
The following terms are used in this chapter:
Authenticated Link (AL): a link configured as authenticated (operates in authentication

mode).
Synchronizing Server (SS): An RTU or IP Gateway which synchronizes the clocks of other
RTUs or IP Gateways.
Synchronized Client (SC): An RTU or IP Gateway whose clock is synchronized by an SS.
If a given link is configured as an authenticated link, all RTUs on that link must be defined as
authenticated or they will not “understand” the timestamp and will discard the authenticated
frames as invalid. Similarly, an authenticated RTU connected to a link which is not
authenticated will not understand incoming frames and will discard them as invalid. Thus, one
authenticated RTU communicates with another authenticated RTU, and an RTU which is not
defined as such communicates with another unauthenticated RTU. The figure below depicts a
system with both authenticated and unauthenticated links.
304
Authentication
SCADA Programming
Central ToolBox
Ethernet LINE 1 (Unauthenticated)
LINE 1
IP
Gateway
RS-232 RSLink 1 (Authenticated*)

MOSCAD
GPS
Astro RTU-1
Radio RSLink
RS-485 (Authenticated)
2 Radio 1
(Authenticated)
LINE 2
(Unauthenticated) MOSCAD MOSCAD MOSCAD MOSCAD MOSCAD
RTU-11 RTU-12 RTU-13 RTU-14 RTU-15
MOSCAD MOSCAD
RS-232 DIAL
RTU-111 RTU-151
(Unauthenticated)
MOSCAD MOSCAD
RTU-112 Fiber Optic PSTN RTU-152
LINE 3
DIAL
(Authenticated)
(Unauthenticated)
MOSCAD MOSCAD
RTU-113 RTU-153
MOSCAD MOSCAD MOSCAD MOSCAD MOSCAD MOSCAD
RTU-114 RTU-115 RTU-116 RTU-141 RTU-142 RTU-143
*For IPGW V4.00 or higher
Because authentication is a function of the link and not of the CPU, an RTU can be connected
to an authenticated link through one port and to a regular (unauthenticated) link through
another port. Authentication is currently available on all media except MDLC over IP,
(Ethernet, Astro radio, SLIP) MDLC over DataTac, X.25, Dial and Terminal server, because
RTUs cannot be time synchronized via these types of media. Any RTUs connected to those
links cannot be synchronized (through those links) and therefore cannot be defined as
authenticated. In fact, authentication cannot be implemented on any media which cannot
support RTU clock synchronization. There are some links which cannot be authenticated even
if they are connected to a reliable clock source, because the network time delay is variable and
authentication is based on time.
In the figure above, RTU-11 cannot receive authenticated data over the Astro radio link from
RTU-111, but it can receive it from RTU-115 via LINE 3 which is connected to a different
port. Note that the three RTUs on the DIAL link (e.g. RTU-142) can be < V8.00 because
authentication is not relevant for them. Older RTUs which are to be connected to an
authenticated link must be upgraded to V8.00 or higher.
Note: If an RTU with an RS232 link is connected through a Terminal Server to a remote
Gateway, this link cannot be authenticated because it cannot be synchronized. While the
Network Configuration tool does not prevent the link from being marked authenticated, the
communication will fail. This same RTU can be connected via another authenticated RS232
link to local RTUs.
Authentication is not performed in local communication, e.g. between the MOSCAD

Programming ToolBox and the RTU to which it is connected, as there is no way to synchronize
the PC’s clock via an MDLC link, nor can a SYNC command be sent from the PC to the
MOSCAD. However an authenticated dataframe can be sent from the Toolbox to the RTU to
305
Authentication
be forwarded to a remote RTU, if the RTUs are connected to each other with an authenticated
link.
Note: MDLC frames containing ACK information are not authenticated.
In order to authenticate communication between two (or more) authenticated MDLC networks,
the link connecting them must be an authenticated link. If the data is to be authenticated, each
of the links through which it is routed (from the source to the destination) must also be so.
Synchronization
The concept of time-based authentication relies on proper synchronization of RTU clocks. In a
given network, one primary clock source can synchronize all the RTUs in a hierarchical
manner.
Synchronization is based on a client/server relationship. A site with a reliable clock (e.g. from
GPS or user application) is defined by the user as a Synchronizing Server. Other RTUs which
are directly connected to that primary source are defined as its Synchronized Clients. When
the server starts up, it notifies its clients of its availability, who can then request
synchronization from the server. When a client starts up, it requests clock synchronization
from the RTU defined as its server. (Note that SYNC requests frames are also authenticated.)
The server will periodically send out synchronization broadcasts to its clients.
In a given network, there can be more than one server but each RTU will only have one
defined server. If an RTU is connected to two links (or to two zones) each of which has a
server, the RTU will use the one with the smaller Site ID as its server. Note that in a multi-
zone network, if one radio zone is authenticated, all zones are authenticated, because they are
actually the same radio link.
An RTU can also be defined as a Synchronized Client/Synchronizing Server (or client/server).

In this case, when its clock is synchronized from a server through one link, and it then
synchronizes other RTUs via another link.
In the example below, the letters in the RTU names reflect their operation modes, i.e. “S”
indicates a server, “C” indicates a client, and “CS” indicates a client/server. The figure below
depicts a network of RTUs with one server, RTU-S1, which gets its time from GPS. It
synchronizes those RTUs connected to it via RSLink2 , i.e. RTU-CS11, RTU-C12, RTU-C13,
RTU-C14 and RTU-CS15. As soon as RTU-CS5 (a client/server) receives its synchronization
from RTU-S1, it will in turn synchronize all the site attached to it on Radio1 (i.e. RTU-C151,
RTU-C152, etc.) Note that RTU-142 is not synchronized because it is on a DIAL connection.
It will also be unauthenticated, as are the RTUs linked via Astro radio. If communication
between RTU-141 and RTU-142 must be authenticated, a primary clock source such as GPS
can be connected to one of the RTUs to enable synchronization. However, the link to RTU-
C14 remains unauthenticated.
306
Authentication
SCADA Programming
Central ToolBox
Ethernet LINE 1 (Unauthenticated)
LINE 1
IP
Gateway
RS-232 RSLink 1 (Unauthenticated)

MOSCAD
GPS
Astro RTU-S1
Radio
RS-485 RSLink 2 (Authenticated)
Radio 1
(Authenticated)
LINE 2
(Unauthenticated) RTU- RTU-
RTU-C12 RTU-C13 RTU-C14
CS11 CS15
MOSCAD RTU-
RS-232 DIAL
RTU-111 C151
(Unauthenticated)
MOSCAD RTU-
RTU-112 Fiber Optic PSTN C152
LINE 3
DIAL
(Authenticated)
(Unauthenticated)
MOSCAD RTU-
RTU-113 C153
RTU- RTU- RTU- MOSCAD MOSCAD MOSCAD
C114 C115 C116 RTU-141 RTU-142 RTU-143
Time synchronization can only be performed over a single link between two RTUs (e.g. from
RTU S1 to RTU C11, from RTU CS15 to RTU C152.). In order to reach sites which are not
directly connected to the server, clients must be defined as servers (hence the name
client/server) to “repeat” or propagate the synchronization message. Each link must have one
server.
A client/server which has not received synchronization from its server in a long time, (perhaps
due to a communication problem in the network) will stop sending periodic synchronization to
its clients, because it assumes that its own clock is no longer synchronized. In this case, the
client/server will act as a pure client until it is synchronized, and then it will return to
client/server mode.
Note: If an RTU has at least one authenticated link, all synchronization messages initiated by
the application will be blocked. It is, therefore, recommended to modify existing MOSCAD
Ladder/C applications so that they will no longer initiate clock synchronization.
In the figure above, the GPS is connected to the MOSCAD server. As of IP Gateway version
V3.20, the IP Gateway can act as a server and RTU-S1 is not required. The IP Gateway cannot
be connected to GPS, but it can use another clock source, such as NTP or ToolBox PC clock.
An MCP-M can only support authentication if it is attached to a MOSCAD CPU.
Authentication Setup
The setup for Authentication is performed in the Network Configuration utility. The sites in
the network and their associated links are defined. The authentication and synchronization for
307
Authentication
each link is configured as well as the related Advanced Parameters. The completed network
configuration is then downloaded to the RTU.
Note: No changes to the site configuration are required. However, if the Clock
Synchronization Delay of the link is not zero (e.g. for MTS-2000 Conventional Radio), this
parameter may need to be updated in the Site Configuration utility.
Network Configuration
To set up the system for Authentication, double-click the Network Configuration utility in the
MOSCAD Programming ToolBox folder. Plan your network topology on paper and decide
which links will be authenticated and the operation mode (client, server, client/server) of each
site. Define all the sites and their associated links, as described in the Network Configuration
section of the System Setup and Diagnostics Tools manual.
Note that in certain cases, the order of the sites in the network configuration file can be
important. The Network Configuration utility assumes that the first instance of a radio zone
(e.g. RADIO1/1) is the server for the RTUs in the zone.
When the Authentication option is installed, two new commands will be available in the Edit
menu of the Network Configuration utility.
-Authenticate Links- enables the user to configure those links which are authenticated.
-Authentication Options- enables the user to set the Advanced Parameters related to
authentication.
Authenticate Links
When the Authenticate Links command is selected, a table of all links in the network is
displayed, as shown in the Links Authentication Information window below.
308
Authentication
To specify that the link is authenticated, check the Authenticated box to the right of the Link
ID.
Next, specify the Site ID of the server which will perform synchronization for all the RTUs on
the link. If the RTU is a server, you will specify its Site ID for all the authenticated links
connected to it. If an RTU is a client, its Site ID cannot be entered into the Server ID field. If
an RTU is a client/server, specify its Site ID for the appropriate links for whom it will act as a
server.
Each radio zone will have ONE Server ID. The first appearance of a radio zone in the network
configuration file is the RTU server of that zone. That radio zone will appear first in the list of
links in the Links Authentication Information window (i.e. if RADIO4/1 is the server, it will
appear before RADIO4/2 and RADIO4/3 in the list.) If you enter a Server ID for another link
(e.g. RADIO4/3), it will not be saved. The next time you open the Links Authentication
Information window, that Server ID will not appear.
If the RTUs are not attached to a server, but have another clock source (e.g. GPS attached to
each site), the Server ID is left at zero. Close the Link Authentication Information window and
the authenticated link will appear in a gray background.
If the RTUs are attached to a server, you must enter a Server ID. Double-click anywhere in the
entry in the Links Authentication Information window. The Define Keys and Aliases dialog
(see below) will open. Enter the Site ID of the server in the Server ID field.
Next, define the authentication keys/key aliases to be used for validating the timestamp in the
dataframe. If you close the Define Keys and Aliases dialog using the OK button, the Has
Keys/Has Aliases buttons to the right of the entry in the Links Authentication Information will
be marked with a check. When you close the Links Authentication Information, the
authenticated link will appear in a red background.
Note: If the Server ID or authentication keys are not defined for any link in the table, the
authentication information will not be downloaded to the network.
It is possible to authenticate a link from the main Network Configuration screen by clicking the
right mouse button and selecting Authenticate Link when the cursor is in a Link ID cell. The
next time you open the Links Authentication Information window, the box to the right of that
Link ID will be already checked. You will still have to define the server for the link, if one
exists.
Authentication Keys
The Authentication Keys are defined for a given link within a given network. This enables the
user to determine which subnetworks within the system will understand each other. When
either the Has Keys or Has Aliases button is selected, the screen below is displayed.
309
Authentication
Three keys of eight bytes each should be defined. Each byte can be entered as either a numeric
value or as a string. To switch from numeric to string format, click the appropriate field. If the
chosen number cannot be displayed in ASCII format, an asterisk will be displayed instead.
To use the same authentication keys for all links in the network, click the Force All Links
button. In this situation, all data transmitted around the network will be understood by all
authenticated RTUs.
Note: Force All Links can be used to define keys for all the links and then certain links can be
modified in order to vary the authentication and limit the motility of the data.
The authentication keys are not saved on the disk. When the Network Configuration utility is
exited, the authentication keys are erased from the ToolBox. Yet it may be difficult to
remember which authentication keys were downloaded to the Flash memory of the RTU.
Therefore, a name or key alias may be defined for each authentication key to remind the user of
the key without compromising the integrity of the authentication. To define a key alias, type a
string in the Alias field.
Click OK to save the key definitions or Cancel to exit without saving. . If you close the Define
Keys and Aliases dialog using the OK button, the Has Keys/Has Aliases buttons to the right of
the entry in the Links Authentication Information will be marked with a check.
310
Authentication
Authentication Options
To set the advanced parameters for Authentication, select the Authentication Options command
from the Edit menu. The range of values for each parameter is specified between < > symbols.
For example, <1-200> means that the value can be a number between 1 through 200. You can
specify a value greater than the maximum value, in which case the system only issues a
warning message. Exceeding the range may consume additional memory and may cause
unexpected or incorrect behavior in the RTU. The default is automatically entered in the
parameter field and appears between square brackets (for example: [80]). You can change this
value.
TX Stamp Interval (seconds) <5-1800> [150]
This parameter defines the interval between two consequent generations of an authentication
stamp for transmission. A higher value saves CPU time but at the same time decreases the
protection of the authentication mechanism, since an authentication stamp generated at a given
instant will be used to authenticate all the outgoing frames in the next TX Stamp Interval
seconds.
TX Periodic Server SYNC Interval (seconds) <60-30000> [1800]
This parameter defines the interval between two periodic SYNC messages sent by a Server or a
Client-Server. A lower value will decrease the clock drift between any two CPUs in the
network, but will increase the communication overhead on the network.
RX Periodic Sync Interval (seconds) <120-60000> [3600]
This parameter defines the interval between two expected SYNC messages. It is relevant to
Client and Client-Server operation modes. If an expected SYNC message does not arrive at an
RTU within this time interval, it will send a SYNC request message to its known Server. In
case of a Client-Server, if an expected periodic SYNC message does not arrive, the RTU will
not send any periodic SYNC messages on those Links it serves, until it succeeds in requesting
SYNC from its Server and receiving a valid response. It is recommended that this value be set
to at least twice the value of Server TX Periodic SYNC Interval.
TX Sync Request Retry Interval (seconds) <10-30000> [20]
This parameter defines the interval between two consecutive retries to transmit a SYNC request
and receive a valid response. It is relevant to Client and Client/Server operation modes. The
request is used by the RTU after restarting (to initially get the Server’s clock) and also when
(for some reason) the periodic SYNC message is not received, or not properly authenticated.
In case of an unreachable server (due to some communication problem), communication

overhead will be higher as this parameter is lower (more frequent request transmissions). On
the other hand, a client may be left with an invalid clock for at least the period of time defined
in this parameter, if the server is unreachable.
TX After Restart Retry Interval (Seconds) <0-255> [10]
This parameter defines the interval between two consecutive retries to transmit an “After
Restart” message to the entire network (on the authenticated Links only). This parameter is
relevant only to Server and Client/Server operation modes. Note that the number of retries is
not set since a Server will try endlessly to transmit an After Restart message until it succeeds.
Max Drift (seconds) <10-3600> [300]
This parameter defines the maximum drift allowed between the timestamp contained in an
authenticated received frame and the local clock or the receiving RTU. Hence this parameter
defines the maximum drift between any two CPUs’ clocks. If Max Drift is set to x, then for a
given time t0 (local receiver clock), a received frame must carry a timestamp in the range of t0
311
Authentication
+/- x in order that it NOT be discarded. Recall that a received timestamp is added to the value
of Maximum Network Delay and only then it is checked against the local receiver clock. The
authentication mechanism of a received frame is stricter as Max Drift is set lower.
Note that the maximum drift may actually be smaller than the Max Drift parameter, because the
incoming timestamp is compared to an internal generated timestamp and not to an actual clock.
The internal timestamp is generated every TX Stamp Interval. Consider a situation where the
Max Drift is set to 300 seconds and the TX Stamp Interval is set to 150 seconds. An RTU
whose clock has drifted by 200 seconds may reject the received frame as invalid if its internal
timestamp was generated 140 seconds previously.
Max Network Delay (Msec) <0-3600000> [0]
This parameter defines the maximum of all delays of the authenticated links in the network. It
is relevant to received frames only. If a frame carrying a timestamp with a value of t1 is
received, the receiving RTU will add the value of Maximum Network Delay to t1 for the
purpose of authenticating the frame. In most cases, this parameter should be set to zero.
Once the parameters have been set, click OK.
Download
Once the network has been configured and the authentication information has been defined, the
network configuration is downloaded to each site in the network. This can be done using the
Download icon or the Download command from the Tools menu.
Note After downloading the network configuration, the RTU does not need a cold restart to
perform authentication.
The Authentication configuration can be downloaded remotely to an RTU, but this is not
recommended for security reasons. If the Authentication must be downloaded remotely, the
most remote sites should receive the configuration first and then the closer sites (bottom-up
along the hierarchy) so that communication is maintained at all times.
Note: A network configuration file which includes Authentication information cannot be

downloaded using the Downloader utility (from the MOSCAD Programming ToolBox folder),
because the encryption keys are not saved on the user’s local disk. Downloading such a file
can only be done using the Network Configuration Download command.
User Application
The system variable AuthOK on the Reserved Flags table in the System Tables of the
Application Programmer Database Builder. See the System and Constant Tables section of the
Application Programmer manual.
312
Event Driven Software
Some applications, especially electrical ones, have to deal with fast changes caused by various
events. The RTU provides you with the necessary database types and special functions in order
to deal with such events.
These functions allow you to get information on the change that has occurred (database
coordinates, data, and time stamp) and activate a specific process accordingly, rather than
polling the database. It also allows you to activate "fast" timers (shorter than Scan time) upon
events.
This chapter describes the event-driven Change-Of-State (COS).
The time stamp can also be retrieved without waiting for an event to take place and stored in
the Ladder Database.
Definitions
Data Type
The Event Driven concept is applicable only for Discrete Inputs of Time-Tagged DI (TgDI)
data type.
This data type is similar to the DI data type (see Database Concept). Note that only the
important inputs should be defined as Time-Tagged DI, since this feature is CPU-time and
space consuming. By calling the Time function, a time stamp can also be retrieved and
appended to an analog input called via the SCAN function from the Ladder. This need not be
related to a specific event.
I/O Link
The specification of a Time-Tagged DI as Event-Driven is done during I/O Link (accessed
from the Application Programmer). For details, refer to Application Programmer.
During I/O linking, each Time-Tagged DI may be defined in the Event Type column as one of
the following types:
313
• TIMETAG – for time-tagged COS. Changes are stored in a time tag logger with the time of
occurrence in 1 msec resolution. For further details, refer to Utilities in the System Setup
and Diagnostics Tools manual.
• EVENT – for event-driven COS, described in this chapter.
• TAG+EVENT – for time-tagged and event-driven COS. A combination of the above two
types.
Event Driven Mechanism

When a COS occurs in one of the digital inputs defined as TgDI, the change is recorded in an
event queue, including the rack number, module number, and input number. In version 3.40,
or higher, the event occurrence time (day, month, year, hour, minute, second and mili-seconds)
is also recorded.
When calling the GtEvnt function, the event is transferred to the Event-Driven database table
(PRMEVENT table), while the rack, module, and input numbers are translated into X,Y and Z
coordinates, (where: X=column no., Y=row no., Z=table no.). Simultaneously, the
corresponding table in the database is updated according to the change that has occurred.
In version 3.40, or higher, the event's time (date and time) is written to the TmMost and
TmLeas columns in the PRMEVENT Table). These are two real type parameters, that
represent the event's time as follows:
TmMost TmLeas
Day Month Year Hour Minute Second mili-seco
1 byte 1 byte 1 byte byte 1 byte 1 byte 2 bytes
1-31 1-12 0-99 0-23 0-59 0-59 0-999
314
Since the tables can hold up to eight columns, all the time's parameters (day, hour etc.) are
arranged in two real type variables. In order to read specific information (e.g: seconds), the
user should perform LSL (Logic Shift Left) or LSR (Logic Shift Right) for the relevant
variable, TmMost or TmLeas.
The number 0 in the YEAR byte (part of the TmMost) represents the year 1980, the number 1
represents the year 1981 etc. until the number 99 which represents the year 2079. (e.g: 15
represents the year 1995).
The system can simultaneously handle up to 150 events and timers. If there are more than 150
events/timers, the EvOvfl flag of the Reserved Flags table (one of the System Tables), will be
set to 1. In this case, it is recommended to clear the events queue (by calling the StEvnt
function), and performing ordinary scan.
The system can set timers for up to 10 seconds. If no event is read during this period of time,
the timer will be turned off, and the EvOvfl flag will be set to 1. It is the user's responsibility
to reset this flag to 0.
For operations that require delay, the RTU provides the SetTmr function. The end of the timer
is regarded as an event.
Event Driven Tables

The Event Driven software includes one System Table, named PRMEVENT. When you open
the PRMEVENT table, the following is displayed.
The PRMEVENT Table includes the following parameters:
• ___Typ – defines the type of event, as follows:
0 - there is no event in the queue (all other parameters are meaningless).
1 - there is an event in the queue (see other parameters).
2 - the event is caused by a delay timer (set by the SetTmr function).

315
3 - The RTU's time was set by the ToolBox (using the Time & Date utility or Send Sync, F9,
from the Time Tag menu)
4 - The event is a power failure report.
5 - The existence of the time's parameters in the TmMost and TmLeas columns, is a result of
calling the Time function.
• ___Tbl – the table number in the RTU database.
• ___Row – the row number in the table (___Tbl).
• ___Col – the column number in the table (___Tbl).
• ___Bit – the current status of the input.
• ___Val – the value for the timer (in x10 msec).
• ___TmMost – a four byte real number. Represents the following:

Day, Month, Year and Hour (1 byte each).
• ___TmLeas – a four byte real number. Represents the following:

Minutes, Seconds and mili-seconds.
The two frames at the bottom of the PRMEVENT Table, show the time and date (TmMost and
TmLeas), in a readable format. The user may read these parameters on-line, by activating the
Monitor mode in the Application Programmer.
How to Use the Event Driven Software

The RTU provides you with three functions in order to implement the Event Driven concept, as
follows:
• GtEvnt – to retrieve an event from the event queue.
• StEvnt – to perform various functions, as follows:
♦ 0 – to clear the event queue (set value to 0).
♦ 1 – to disable the event-driven mechanism (set value to 1).
♦ 2 – to enable the event-driven mechanism (system default) (set value to 2).
• SetTmr – to start a timer after an event. The termination of the timer is also regarded as an
event (this timer does not depend on the Scan time). The value of the timer should be set in
the ___Val variable (in x10 msec).
The following rungs provide examples that cover all aspects of the Event Driven mechanism.
316
Part of MAIN process
StEvnt
(1) ( CALL )
#2
GtEvnt
(2) ( CALL )
__Typ __Tbl
Procs1
(3) = ( JSP )
#0 #9
__Typ __Tbl
Procs2
(4) = ( JSP )
#0 #11
__Typ __Tbl
Procs3
(5) = ( JSP )
#0 #13
As part of the MAIN process, the above rungs check that an event has occurred, and fulfilling
certain conditions, activate appropriate subprocesses. The above rungs are described below:
Rung 1: The StEvnt function is called with a parameter of 2 to enable the Event Driven
mechanism. It is recommended to put this rung in the Init process.
Rung 2: The GtEvnt function is called; the system retrieves an event from the event queue
into the PRMEVENT table, including the event type, table number, column
number, row number, and data of COS.
Rungs 3-5: These rungs check the ___Typ variable and the affected table number; if ___Typ
is not 0 (meaning that there is an event in the queue), the system jumps to perform
a specific process according to the table number. For example, in rung 4 the
system jumps to the Procs2 subprocess since the table number is 11.
The rungs below describe the use of the timer function of the Event Driven mechanism.
317
Part of Procs2 subprocess
I
(1) ( MOVE )
__Row
__Typ Inp1, I Inp2, I

Send2C
(2) / ( JSP )
#1
Inp1, I Inp2, I
__Typ Inp1, I Inp2, I

__Val
(3) ( MOVE )
#30
#1
Inp1, I Inp2, I
SetTmr
/ / ( CALL )
__Typ
Send2C
(4) ( JSP )
#2
(5) ( RET )
Rung 1: This rung stores the row number (___Row) in the I index.
Rung 2: If it is an event (not caused by a timer; ___Typ=1), and Inp1,I is not equal to
Inp2,I, then the system jumps to the Send2C subprocess to send specific bits to
the central.
Rung 3: If it is an event (not caused by a timer; ___Typ=1), and Inp1,I is equal to Inp2,I,
then the ___Val variable gets the value of 30 (thus, setting the timer to 300 msec),
and the SetTmr function is called to activate the timer. Note that the parameters of
the event are still kept in the PRMEVENT table.
Rung 4: If the event is caused by a timer (___Typ=2), the system jumps to the Send2C
subprocess to send the current status of Inp1,I and Inp2,I to the central.
Rung 5: Returns to the MAIN process.
In the MAIN process, you should add appropriate rungs to perform a loop, that checks if there
are additional events in the queue.
318
Reading the TmMost and TmLeas Columns

The following rungs demonstrate how to read the time parameters from the PRMEVENT table.
The time parameter columns in the PRMEVENT table has two variables with seven parameters
each. When a specific parameter is required, the user should use the rotation functions LSL or
LSR (see Ladder Diagram Language) as needed.
The following rung checks the analog value ANA1, and according to its value, activates the
Time function. This option allows the user to get the occurrence time of an analog event.
ANA1
Time
( CALL )
500+
To obtain the date and time, decode TmMost and TmLeast, as follows (provided that TmMost
and TmLeas are not zero and contain date/time information to be decoded):
Step 1. Define a set of user variables, as illustrated below. Variables 0 through 6 will get the
date and time components; variables 8 through 11 are auxiliary variables:
Data type: Integer Value (int)
Ind Name Value

0 Myear
1 Mmonth
2 Mday
3 Mhour
4 Mmin
5 Msec
6 Mmsec
7
8 Mv1
9 Mv2
10 Lv1
11 Lv2
Mv1, Mv2 (for TmMost) and Lv1, Lv2 (for TmLeas) must be consecutive.
Step 2. Define the following constants:
Data type: Int Constant
Ind Name Value

0 #4 4
3 #255 255
4 #8 8
319
Step 3. Move the values as follows:
C Mv1
P TmMost
Y #4
C Lv1
P TmLeas
Y #4
Rung: r6
Mday
( MOVE )
Mv1
Mday
( LSR )
#8
A Mmonth
N Mv1
D #255
MYear
( MOVE )
Mv2
MYear
( LSR )
#8
A Mhour
N Mv2
D #255
Rung: r7
320
Mmin
( MOVE )
Lv1
Mmin
( LSR )
#8
A Msec
N Lv1
D #255
MSec
( MOVE )
Lv2
Rung: r8
321
INTRAC Protocol
Scope
The INTRAC software module included in the ToolBox, provides the user with the ability to
define the INTRAC parameters, including protocol parameters, timing parameters and
hardware interface definition, in order to allow integration of the RTU with MOTOROLA
INTRAC equipment and the INTRAC protocol. The INTRAC module supports Ladder
Diagram Language, parameter tables and the related call functions. In addition to the INTRAC
networks, the software also supports the old MDLC protocol, which is used in the RTU to RTU
communication for MEIC 1000 units.
The hardware interface is a piggyback modem, which is connected to the CPU and to the
physical channel through the CPU's Port-3. A general system view is provided in the following
figure.
INTRAC
EQUIPMENT
INTRAC
COMMUNICATION
CONVENTIONAL
TRUNK RADIO
RADIO
MOSCAD
CPU
RS-232
INTRAC
OR PORT-3
MODEM PROGRAMMING
TOOL BOX (PC)
This chapter provides the user with the information, required to build the Ladder Diagram for
INTRAC net and to define the channel parameters.
322
INTRAC Protocol
In addition, the chapter explains the call functions and their parameters.
Applicable Documents
In this chapter we assume that you are familiar with the ToolBox software. However,
additional documentation is available if necessary. For description of the INTRAC protocol
and INTRAC system, refer to manual: – INTRAC 2000 – Service Manual, 68P02962G05-O.
About the INTRAC Protocol

The INTRAC communication is a 32 bit protocol. The INTRAC protocol contains information
(data section) and parameters (address, group ID etc.). The structure of the INTRAC codeword
is shown below.
SYSTEM
BIT 0 ADDRESS BIT 15
SECURITY
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
GROUP DATA
STATION
ADDRESS
ADDRESS
32 BIT INTRAC WORD
Bit 0 – Indicates how to interpret the station address, either as an individual or

set call address.
Bit 1-9 – Station address, identifies the remote unit within a system.
Bit 10-11 – System address, identifies the system (four combinations) SYSTEM-0 ..
SYSTEM-3.
Bit 12-14 – Group address (Group A-H). Identifies the receive group (in a codeword
transmitted by the remote station) or the transmit group (in a codeword
received by the remote station).
Bit 15 – May be used to distinguish between codeword transmitted from a

remote or a central station. Bit 15 "0" for transmission from a remote
station and "1" for transmission from a central station.
Bit 16-25 – Data. Contains the specific data according to the nature of the group
being transmitted or received.
Bit 26-31 – Security for the entire codeword. 5 bit or a cyclic code of all the
preceding data bits (according to the Bose Chaudhuri 26/31 code). Bit
31 is the overall parity check bit.
323
INTRAC Protocol
Call Functions for INTRAC Protocol

Four new functions were added to the Ladder Diagram Language, so as to support the
INTRAC protocol communication. These functions and the affected parameters, are described
in the following paragraphs.
TxIntr Function
TxIntr – This function allows the RTU to transmit a frame, using the INTRAC protocol. The
type of the transmitted frame data section is defined by the function's parameters where the
options are:
I_ANALOG This parameter determines which data section is defined as an analog

value. The range is -512 to +511.
I_CNTR The data section is a counter type (0-999).
I_PARM The data section is a 8 bit integer (0-255).
I_BIT The data section is an eight bit word. The remaining two bits determine the
type of information for the other eight bits (EXEC, CNTRL etc.).
Before transmission, ITxStt=1. If the frame was queued for transmission, ITxStt=0.
RxIntr Function
RxIntr – This function allows the RTU to receive an INTRAC frame from the INTRAC
equipment. Processing the received frame's data section is dependent upon the function
parameters, where the options include: I_ANLG, I_CNTR, I_BITS and I_PARM (see TxIntr
function).
The user should define the appropriate parameter for this function, according to the Group ID
(or Sub-group ID) of the received frame. This information is available after calling the UpIntr
function (see the next paragraph).
Calling the RxIntr function when the queue is empty will reset the IRxStt.
Update Function
UpIntr – Calling this function allows the user to read the main parameters of a received frame
from the queue. The function sets the frame parameters into the INTRAC table, except for the
data section. The original frame remains in queue until the RxIntr or DuIntr function is called.
Calling the UpIntr function when the queue is empty will reset the IRxStt (INTRAC Receive
Status) parameter. The affected parameters from this function are:
IRxStn The address of the sending station.
IRxDir Indication of the data transfer direction. If IRxStn=0, the direction is R-

T-M (Remote To Master); if 1, the direction is M-T-R (Master To
Remote).
324
INTRAC Protocol
IRxGrp If a frame is received, the IRxGrp contains the group ID of the transmit
station. The enable value: 0..7 (Grp_A..Grp_H).
IRxSub If a frame is received, the IRxSub contains the sub-group ID of the

transmit station. The enable value: 0..3.
DuIntr Function
DuIntr – This function dumps a received INTRAC frame from the reception queue. This is
useful when the parameters of the received frame (address, group etc.) do not match the
receiving station definitions.
INTRAC Protocol Variable

The following table presents the list of variables that support the INTRAC protocol. These
variables appear in the INTRAC System Table which is one of the System Tables in the
Database Builder menu. The enable values for each variable are listed in the Parameters
column.
Some of these variables are dedicated for the INTRAC protocol only, while others are defined
as general variables, and may be used for other protocols.
325
INTRAC Protocol
Variable Description Parameters

Tx_Rpt Number of repetitions for 0 means frame is transmitted once
frame sending
Tx_Lnk Transmission channel Radio (1) – Channel = conventional

definition radio
Line (2) – Channel = line
LoTrnk (1) -Transmit to trunked radio

with Low priority. This means that you
have to wait a minimum period before
asking for TxEn.
HiTrnk (11) – Transmit to trunked

radio with High priority. This means
that you have to wait a specific period
before asking for TxEn.
ITxStt Transmission status. Before transmission: ITxStt=1

Updated after calling the
TxIntr function. After transmission, if the frame is
queued for transmission:
NOTE:
ITxStt=0
ITxStt should be set to "1"
before transmission
Rx_Lnk Reception channel Radio (1) – The frame is received

indication. Updated after over the radio channel.
calling the RxIntr or UpIntr
functions Line (2) – The frame is received over
the line channel.
ITxStn In transmission: Range : 0..2047
The destination address for If the transmitted frame is a Setcall,

the sent frame. the value 2048 should be added to the
ITxStn value.
(configuration parameter)
ITxDir Direction of transmitted 0 = R-T-M (Remote To Master)

frame
1 = M-T-R (Master To Remote)
ITxGrp Group ID of the Transmitted Range : 0..7 (Grp_A..Grp_H)

frame.
326
INTRAC Protocol
ITxSub The transmitted frame's Range : 0..3

Sub-Group ID. Used only for
Bits Or Parameter data type
ITxDat The contents of the data For I_ANALOG : -512..511

section in the transmitted
frame. For I_CNTR : 0..999
Bits/Parm : 0..255
IRxStn The station address which Address range: 0..2047

sent the frame. Updated
after calling the UpIntr or If the received frame is a Setcall, the
RxIntr functions. value 2048 should be subtracted from
the IRxStn value.
IRxDIR Data transfer direction If (0): Direction = R-T-M (Remote To

indication. Updated after Master)
calling the RxIntr or UpIntr
functions, if a new frame If (1): Direction = M-T-R (Master To
was received. Remote)
IRxGrp If a new frame was Range: 0..7 (Grp_A.. Grp_H)

received, the IRxGrp
contains the Group ID of the
source station. Updated
after calling the RxIntr or
UpIntr functions.
IRxSub If a new frame was Type: Bit or Parm

received, the IRxSub
contains the Sub-Group ID Range: 0..3
of the source station. It is
updated after calling the
RxIntr or UpIntr functions,
and used to indicate the
data type of the received
frame.
IRxDat The data section of the Analog : -512..511

received frame. Updated
after calling RxIntr. Counter : 0..999
Bit or Parm : 0..255
IRxStt Reception status. Updated If an INTRAC frame has been

after calling RxIntr or received: IRxStt=1
UpIntr.
Otherwise: IRxStt=0
327
INTRAC Protocol
The INTRAC Free Format Protocol

The INTRAC free format protocol, illustrated below, allows the user to design the structure of
the INTRAC frame, according to his needs. The largest section of the frame, 26 of 32 bits, can
be determined by the user, and the last six bits are dedicated for security (CRC). Using the
INTRAC free format protocol is made by calling the TxIntr or RxIntr (see Call Functions for
INTRAC Protocol) with the I_GNRL parameter.
ITD_Hi (FOR TRANSMISSION) ITD_Lo (FOR TRANSMISSION)
IRD_Hi (FOR RECEPTION) IRD_Lo (FOR RECEPTION)
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
SECURITY
DATA
(CRC)
32 BIT INTRAC WORD
Variables for INTRAC Free Format Protocol

Four new variables were added to the Ladder Diagram Language, to support the INTRAC free
format protocol. Two variables, ITD_Hi and ITD_Lo, are used to hold the data of the
transmitted frame, and the two other variables, IRD_Hi and IRD_Lo are used for reception.
The free format protocol uses five more general variables, which are common to other
functions as listed in the following table. The user should call the RxIntr with I_GNRL
parameter when a reception of a free format INTRAC frame is expected.
The acceptable address range for reception is the entire enable system address range.
The variables for Free Format Protocol are listed below:
328
INTRAC Protocol
Variable Description Values
Tx_Rpt
Tx_Lnk
Rx_Lnk ITxStt See variable table above in Intrac Protocol
IRxStt Variable.
ITD_Hi The higher 10 bits of the transmitted frame Any: Bit 25 .. Bit 16
(High .. Low)
ITD_Lo The lower 16 bits of the transmitted frame Any: Bit 15 .. Bit 0
(High .. Low)
IRD_Hi The higher 10 bits of the received frame Any: Bit 25 .. Bit 16
(High .. Low)
IRD_Lo The lower 16 bits of the received frame Any: Bit 15 .. Bit 0
(High .. Low)
Using the MEIC MDLC Protocol (RTU to RTU)

The MEIC MDLC is a 16 byte protocol. Two new functions were added to the Ladder Diagram
Language, in order to allow the RTU to communicate with MEIC MDLC equipment.
Transmit an MEIC MDLC Frame, TxWdth Function

TxWdth: Transmit an MEIC MDLC frame. Before calling this function, it
is required to define the following parameters:
TxTo: The frame destination address.
Tx#Vl: The number of values in the transmitted frame; The permissible

range: 1..5. If the frame was successfully queued for
transmission, the system resets this variable to "0".
TxVl1..TxVl5: The data values of the transmitted frame, according to the Tx#Vl
parameter. For example: if the Tx#Vl was set to 3, the user should
define the data for the following three variables: TxVl1, TxVl2 and
TxVl3.
Receive an MEIC MDLC Frame, RxWdth Function

RxWdth: Receive an MEIC MDLC frame. Calling this function updates
the following variables:
329
INTRAC Protocol
RxTo: Destination address of the received frame. Checking this variable

allows the user to decide if the received frame is appropriate for
his system or not.
Rx#Vl: The number of values in the received frame. If no frame was
received, Rx#Vl=0.
RxVl1..RxVl5: The data values of the received frame, according to the value of
Rx#Vl. For example: if Rx#Vl=4, the information given in
RxVl1 through RxVl4 is valid.
Variables Supporting the MEIC MDLC Protocol

The following table summarizes the variable list that the MEIC MDLC protocol uses. The
variables which are common to the other functions were already mentioned above.
Variable Description Values
Tx_Rpt See variable table above in

Tx_Lnk INTRAC Protocol Variable.
Rx_Lnk
TxTo Destination address of the 0 .. 8191

transmitted frame
RxTo Destination address of the 0 .. 8191

received frame
Tx#Vl Number of values in the 1 .. 5

transmitted frame
If the frame was successfully queued for
transmission, the system resets this
variable.
Rx#Vl Number of values in the 1 .. 5

received frame
If Rx#Vl=0, the received frame has no
values.
TxVl1 .. Txvl5 Values of the transmitted Any

frame
RxVl1.. Rxvl5 Values of the received Any

frame. Updated after calling
the RxWdth function.
RxFrom The source station address 0 .. 8191

in the received frame.
330
INTRAC Protocol
Channel Status Variables

Since all the protocols described in this chapter (INTRAC, INTRAC Free format and MEIC
MDLC) use the system channels, it is required to consider the channel status as it is reflected in
the channel variables. These variables are described in the following table:
Variable Description Parameters
R_TxOn For transmission: I_TxOf (0): No transmission on the channel.

Last transmission was successfully
Radio channel status completed.
I_TxFl (2): No transmission on the channel.

The last transmission failed.
I_TxOn (1): A frame is queued for

transmission.
L_TxON For transmission: As for R_TxOn
Line channel status
R_Stt Radio channel status I_Free (0): Channel is free.
I_Busy (1): Channel is busy.
L_Stt Line channel status I_Free (0): Channel is free.
I_Busy (1): Channel is busy.
1. The radio channel status (R_Stt) is recognized by the "Channel Busy" line. This line has a
polarity which may be defined by the user (configuration parameter), according to the
following table.
2. For trunked radio, channel is recognized as a "busy" when both the RxEn condition and
Tone Detected are active.
The Configuration Set-Up for "Channel Busy" Parameters is listed below:
No. Chosen Value Busy Channel Condition
1 Busy LOW Channel Monitor Low
2 Busy HIGH Channel Monitor High
3 Busy LOW & T.D. Channel Monitor Low
4 Busy HIGH & T.D. Channel Monitor High
5 Tone Detect Only Tone Detected
331
INTRAC Protocol
Channel Parameters
The parameters, listed below, are used to define the interface between the RTU and the
channel. These are configuration parameters which may be changed during system run time.
ROvrid: For radio channel: Waiting time (100 mSec units) before transmission is burst
over the channel, despite the existence of a "Channel Busy" indication.
RQuiet: For conventional radio: A quiet channel period (mSec units), during which
transmission is disabled. After this period, transmission will start.
LOvrid: For Line channel: Waiting time (100 mSec units) before forcing transmission onto
a channel, despite the existence of a "Channel Busy" indication.
LQuiet: For Line: Quiet channel period (mSec units), during which transmission is
disabled.
R_Ptt: For radio channel: Warmup time (mSec units) between a PTT request and the start
of data transmission (a constant tone is transmitted for this period before data
transmission).
L_Ptt: Warmup time for Line channel (see R_Ptt).
RptMod: Repeater Mode: When the Repeater Mode is active, and a frame is received on a
channel, the system will transmit the frame to the other channel. For example, if
the repeater mode is active, and a frame has been received in the line channel, this
frame will be sent during the radio channel and vice versa.
StnAdr: RTU TO RTU Station address: If an MEIC MDLC frame is received with a
destination address which matches the RTU TO RTU Station address parameter,
then this frame will be accepted.
The reception of an MEIC MDLC frame depends on the following conditions being fulfilled:
1. The destination address of the received frame does not exceed the MDLC protocol address
range.
2. The destination address field in the received frame, is the desired individual station address,
or system address.
All channel timing parameters are defined in mSec units, except for the ROvrid and LOvrid
which are defined in 100 mSec units.
These parameters can be changed during system run time using the Rung or Monitor utilities.
If the user input value for these parameters is not correct, (out of range), the user is alerted by
the system's error logger to correct the value. In a normal operating situation (after definition
and download execution of configuration), these parameters receive their initial values from the
configuration files.
The previously mentioned parameters, with the exception of StnAdr and RptMod, cannot to be
changed during transmission. A user change request will be accepted only at the end of the
current transmission cycle.
332
INTRAC Protocol
Site Configuration
The configuration of an INTRAC channel in the RTU is enabled only on Port-3. To define the
INTRAC channel parameters, configure the port to INTRAC, Conventional (or Trunked). The
configuration parameters are divided between the User and Advanced Physical Layer tabs. The
parameters are listed below:
Parameter Conventional Line
Protocol Parameters
RTU to RTU Station Address 0-8191
RTU to RTU System Address 0-8191
RTU to RTU Address Range Low/High 0-8191
INTRAC Address Range Low/High 0-2047
Repeat Radio to Line and Line to Radio YES or NO
Timing Parameters
Override time on busy channel 0-9999 Sec. 0-999.9 Sec.
Quiet time on free channel 0-9999 ms 0-9999 ms
Wait for channel access timeout 1-600 Sec 1-600 Sec
Warmup channel time 10-9999 ms 0-9999 ms
Transmission timeout 1-1000 Sec 1-1000 Sec
Wait for holdup timeout 10-60 Sec 10-60 Sec
Holdup channel time 0-1000 ms 0-1000 ms
Shutup channel time 100-1000 ms 100-1000 ms
Hardware Interface Parameters
Pre-emphasize Enable ENABLE or DISABLE
De-emphasize Enable ENABLE or DISABLE
Transmission Level (mVrms) 15-25 0

60-95 180-225
95-140 300-365
140-170 430-525
170-210 580-700
210-250 765-930
250-290 990-1200
290-350 1280-1560
Channel Busy Indication CM (Active Low) TD

CM (Active High)
CM (Active Low) & TD
CM (Active High) & TD
TD Only
333
INTRAC Protocol
Parameter Conventional Line
Channel Monitor Polarity Active Low TD

Active High
AGC Enable ENABLE or

DISABLE
Conventional Radio Channel Parameters Description

a. INTRAC Address Range: If an INTRAC frame has been received with a destination
address that matches the INTRAC Address Range parameter, the frame will be
accepted.
b. Repeat Radio to Line and Line to Radio (RptMod): When the Repeater Mode is active,
and a frame is received on one of the channels, the system will transmit the frame to the
other channel. For example, if the repeater mode is active, and a frame has been
received on the line channel, this frame will be sent over the radio channel and vice
versa.
The permissible values for RptMod are RptON(1) or RptOf(0). When

(RptMod=RptOn(1)), the repeater mode is activated. If RptMod=RptOf(0), the repeater
mode is not active.
c. RTU-to-RTU System address: The network address of a specific station.
d. RTU-to-RTU Station address: If an MEIC MDLC frame is received with a destination

address which matches the RTU TO RTU Station address parameter, then this frame will
be accepted.
The reception of an MEIC MDLC frame depends on the following conditions:
1. The destination address of the received frame does not exceed the MDLC protocol
RTU-to-RTU Address Range.
2. The destination address field in the received frame is our station address, or the
system address.
e. Override time on busy channel: During transmission, if a "Channel busy" is detected,

this parameter will determine the waiting time before forcing transmission onto a
channel (even if the channel is still busy). Setting this parameter to "0" will terminate
the option.
f. Quiet time on free channel: Quiet channel period before transmission. Setting this
parameter to "0", will terminate the waiting time and transmission will start immediately
after the "free channel" detection.
g. Wait for Channel-Access Timeout: Maximum waiting time for available channel for
transmission. If at the end of this period, the channel is not available, the system
provides a failure notice and the transmission attempts will be terminated.
334
INTRAC Protocol
h. Warmup Channel Time: Transmits a constant tone during this period, before data
transmission starts.
i. Transmission timeout: The maximum time frame for data transmission. Transmission
over this time will be terminated, and a failure will be declared. The transmission
always ends (normally or forced) with a constant tone for holdup time.
j. Wait for Holdup timeout: During this period, the system allows the plug-in modem to
transmit the contents of its internal buffer, after the MOSCAD RTU has finished data
transmission. It is not recommended to change this parameter.
k. Holdup Channel Time: The length of time a constant tone transmission is continued
after the end of transmission.
l. Shutup Channel Time: The minimum waiting time between one frame transmission and
the next. It is measured from the end of the constant tone of the last transmission.
1st FRAME 2nd FRAME

TRANSMISSION TRANSMISSION
WARMUP HOLDUP
TIME TIME SHUTUP
CHANNEL TIME
m. Preemphasize enable: A radio transmission and reception technique.
n. Deemphasize enable: A radio transmission and reception technique.
o. Transmission level [mVrms]: Determines one of 8 levels of transmission.
p. Channel busy indication: Technique used for detecting radio input. In most cases, CM
(Channel Monitor) alone is used. TD (Tone Detect) is an audio signal more commonly
associated with Trunked radios.
q. Channel monitor Polarity: relates to radio channel busy criteria and reception conditions
for CM only. Polarity should be set based on the digital signal used by the radio (see radio
specifications).
Trunked Radio Channel Parameter Description

Parameters, common to the Conventional and Trunked radio, were already explained in the
previous section, items a-d and h-l. The following are the parameters dedicated for trunked
radio.
a. No Channel Time before Request (Low): When the channel does not exist, this
parameter determines the allotted time to wait before asking for TxEn (transmit enable).
This parameter is relevant if one of the functions, TxWdth or TxIntr was called with
Tx_Lnk=1 (Tx_Lnk=LoTrnk or Radio).
b. No Channel Time before Request (High): When the channel does not exist, this
parameter determines the allotted time to wait before asking for TxEn (transmit enable).
This parameter is relevant if one of the functions, TxIntr or TxWdth was called with
Tx_Lnk=11.
335
INTRAC Protocol
c. Quiet Channel Time before Request (High): When the channel exists and is quiet, this
parameter determines the time to wait before asking for TxEn (transmit enable). This
parameter is relevant if one of the functions, TxWdth or TxIntr has been called with
Tx_Lnk=11 (Tx_Lnk=HiTrnk).
d. Channel Request PTT Active and Negated time: These two parameters, are used to
determine the PTT active time (Pressed) and PTT release time after the transmit enable
TxEn request.
e. Warmup channel: This parameter has the same meaning as in the conventional radio,
but the "Warmup time" must be greater than the "Trunk turn around time" parameter of
the specific radio.
The hardware parameter definition for Conventional and Trunked radio is identical, except for
the "busy channel" detection and reception condition. For trunked radio, the system
determines these parameters to be "RxEn active" and "Tone Detected", as a default.
Rung Usage Examples

The following examples demonstrate how to build Rungs using the CALL functions, as well as
new parameters which were added to the Ladder Diagram Language.
Handling an Analog Type INTRAC Frame

This sequence has the following three steps:
1) Prepare a frame (Rung-1)

2) Transmit a frame (Rung-2)
3) Receive a frame (Rung-3).
Preparation – Rung-1
Parameter Values:
Destination Address = 511
Tx-Direction = R-T-M (Remote To Master)
Group = 5
Data = +100
336
INTRAC Protocol
Preparation Rung
TxDir
( MOVE )
#0
ITxStn
( MOVE )
#511
ITxGrp
( MOVE )
#5
ITxDat
( MOVE )
#100
Frame Transmission
In this Rung, transmission depends on pressing the CPU PB1 push-button. The following are
the frame parameters:
• ITxStt = 1
• TxRpt = 0 (send once)
• TxLnk = 2 (channel = Line)
After calling the TxIntr function, if the frame was queued for transmission, the system resets
the variable ITxStt. The Rung checks this variable, and if ITxStt=0 it resets the Push-button
PB1 flag. If the frame was not queued for transmission, ITxStt remains "1" and a new
transmission attempt will start.
Transmission Rung
PushB1
ITxStt
( MOVE )
#1
TxRpt
( MOVE )
#0
TxLnk
( MOVE )
Line
TxIntr
( CALL )
I_Angl
ITxStt
PushB1
= ( U )
#0
337
INTRAC Protocol
Reception Rung
The following is a Rung example for an analog frame reception. The execution of RxIntr
function, depends on the following conditions:
• IRxStt≠0 (indicates that there is a frame in queue)
• IRxGrp=6 (the source station of the received frame, belongs to Group-6.)
As mentioned before, these parameters (IRxStt and IRxGrp) are available after calling the
UpIntr function.
After checking these variables, the Rung calls the RxIntr function with the I_Anlg parameter
and increases the value of the counter variable Rx_Cnt.
Reception Rung
UpIntr
( CALL )
IRxStt IRxGrp
RxIntr
= ( CALL )
#0 #6
RxCnt
( CTU )
Handling an MEIC MDLC Frame

This example contains the following three steps:
1) Prepare a frame for transmission (Rung-1)

2) Transmit a frame (Rung-2)
3) Receive a frame (Rung-3)
Preparation Rung
The preparation Rung defines a frame transmission with four values, to address 511. The
following are the Rung parameters:
− Destination Address = 511

− Number of Values = 4
− Transmitted Value 1 = 10
338
INTRAC Protocol
Preparation Rung
TxTo
( MOVE )
#511
Tx#Vl
( MOVE )
#4
TxVl1
( MOVE )
#10
TxVl2
( MOVE )
#11
TxVl3
( MOVE )
#12
TxVl4
( MOVE )
#13
Transmission Rung
The frame transmission in this example, depends on the CPU's push-button 1 (PB1). If PB1
was pressed (once), a transmission sequence of an MEIC MDLC frame will start with the
following parameters:
Tx#Vl = 5
TxRpt = 0 (send once)
TxLnk = 2 (Line)
Calling the TxWdth function prepares the frame and sends it. If the frame has been queued for
transmission, the variable Tx#V1 is 0, and the Rung uses this condition to reset the Push-button
PB1 flag. If the frame has not been queued for transmission, the value of Tx#V1 and BP1 flag
is not changed and a new transmission attempt will start.
339
INTRAC Protocol
Transmission Rung
PushB1
Tx#Vl
( MOVE )
#5
TxRpt
( MOVE )
#0
TxLnk
( MOVE )
Line
TxWdth
( CALL )
Tx#Vl
PushB1
= ( U )
#0
Reception Rung
The following is a Rung example for an MEIC MDLC frame reception. If there is a frame in
the queue, increment the counter Rx_Cnt.
Reception Rung
RxWdth
( CALL )
IRxStt
RxCnt
( CTU )
#0
340
Dual CPU Operation
(MOSCAD ≥ V3.40)
This chapter refers to MOSCAD only.
The most important single Module in an RTU is its CPU. Using the Dual CPU option (two
CPU modules at one RTU), ensures that a single failure in the CPU will not cause the whole
RTU to fail.
Two CPU modules are plugged into the MOSCAD RTU. The first CPU Module, named
Primary, is plugged into slot "0" of the first motherboard and the second CPU, named
Secondary, is plugged into slot "1" of the same motherboard.
Both CPUs, use the same communication port (e.g: Port 3) to communicate with the central.
Only the active CPU activates its communication port, and responds to received frames.
The active CPU will also be the only one that controls the I/O Bus, the nonactive CPU will be
blocked from the I/O Bus.
The Secondary CPU uses the motherboard connection between the modules, to check
(automatically by the firmware), if the Primary is alive and active.
In case of a malfunction in the Primary CPU module, the Secondary CPU module
automatically (after a few seconds) starts functioning It takes over the I/O Bus and the
Communication channels to the central.
After the Secondary has taken control, there is no way to change this situation (return the
control to the Primary), other than switching OFF the system power, plugging in the new
Primary CPU, and turning it ON again.
Address Setting
Both CPUs, are usually loaded with the same application (or a similar application), enabling
the Secondary to take control when a failure is detected in the Primary. If a specific
application consists of accumulated information (measurements, counters, etc.), the Secondary
must be updated with this particular information, in order to prevent loss of the information.
The CPUs communicate with each other via the RS485 Link (using the RTU to RTU
Communication), and this requires that they both have different addresses. This requirement
contradicts with the requirement to assign the same address for both CPUs, allowing the central
to communicate with the Secondary after a switchover, in case of a malfunction in the
Primary.
To resolve this contradiction, use the "Dual-Address" feature of the MOSCAD (this feature is
set up during the CPU Configuration phase). The Primary CPU is configured with two
addresses: the main address and main address minus 1 (e.g: 100 and 99).
341
Dual CPU Operation
ACCESS TO
SCADA ADDRESS 100
RTU
RADIO RADIO
ADDRESS RANGE=
(Site ID -1)
99-100
CPU MODULE PORT-3

PRIMARY
ADDRESS RANGE=
(Site ID +1)
ACCESS
100-101
TO 99 UPDATING
DISABLE
101
CPU MODULE
SECONDARY
PORT-3
The Secondary CPU is also configured with two addresses: the main address and main address
plus 1 (e.g.: 100 and 101). The result is that the central continues to use the main address (100)
for communicating to the RTU, and the "shifted" addresses (±1) are used for communication
between the CPUs. For remote communication to this RTU (for diagnostics, upload and
download), the user should use the unique addresses (99 and 101) or LOCAL mode.
Physical Outputs
When the Secondary becomes active, it takes over the I/O Bus. The ML (Magnetically
Latched) relay outputs keep their last state. The EE (Electrically Energized) momentary relays,
the Analog Outputs and the AC analyzer outputs are reset and revert to their original values, as
updated by the application in the Primary (before it failed). The behavior of the digital outputs
in the mixed I/O modules depends on their relay types as described above.
Using the Dual CPU Option

Using the Dual CPU option is almost like defining two different RTUs with identical
applications and identical Site ID (e.g: 100), with the difference between them being the Site
ID offset (+1 for the Secondary and -1 for the Primary). The applications are identical except
for the updating section in the Primary application. This section is used to transfer necessary
data to the Secondary.
The Site ID offset is set in the Advanced Parameters. Click on the Site Configuration icon
from the main MOSCAD Programming ToolBox window. Open the configuration file, click
on Advanced Parameters and then on the MDLC Network Layer parameters.
342
Dual CPU Operation
Change the Addr. Range response for ‘All RTU Simulation’ parameter to -1 for the Primary
and +1 for the Secondary.
Updating the Secondary will be explained by the following example.
Updating the Secondary

In this example, the Secondary must be updated by a four-value vector every 60 seconds.
Timer
First define the Timer rung. In the User Table list, create one table, named Timer. In this table,
define two parameters, Ta and Tb, and set each value to 0:30 (Sec)
User Table List
Ind Table Name

1 timers
Table Name: timers Last Index (Ind): 4
Data Type: Timers Minute (Mn:Sc)
Ind Name Value

0 Ta 0:30
1 Tb 0:30
Define a process, named MAIN, with one rung r1. This rung will activate the Updating rung
every 60 seconds (Ta+Tb).
Process List
Process Description
Main Main process
343
Dual CPU Operation
Ta
Updat
↑ ( JSP )
Ta
Tb
/ ( DON )
Tb
Ta
( DON )
rung: r1
Updating Process
Set the value 3 in the BufEnd parameter in the RTU to RTU Comm Buff table, to support the
four value vector - Vec (0-3).
The updating process contains two rungs:
− The first rung, sends the vector Vec from the Primary to the Secondary.
− The second rung contains the Secondary's response.
Updating rung
DstSit
( MOVE )
Secndry
Tx_Len
( MOVE )
#5
TxBuf,0
( MOVE )
. Vec,0
. TxBuf,3
( MOVE )
Vec,3
SndFrm
( CALL )
DmyBit
In addition to the above mentioned rung, the Primary CPU is also required to receive the
Secondary's response. If a valid answer has been received from the Secondary, the SecStt flag
is set to High. The following rung performs this process:
344
Dual CPU Operation
RcvFrm
( CALL )
Rx_Len FrmTyp SrcSit

SecStt
( )
#0 AnsFrm Scndry
In the Secondary, you should define the following rungs:
− Reception rung, to receive the vector Vec from the Primary.
− Reply rung, in response to the Primary updating frame.
Reception
RcvFrm
( CALL )
Rx_Len FrmTyp SrcSit

MY_Vec,0
| ( MOVE )
RxBuf,0
#0 Origin Primry .
.
MY_Vec,3
( MOVE )
RxBuf,3
SndAns
( L )
Send Answer
SndAns DstSit
( MOVE )
SrcSit
Tx_Len
( MOVE )
#1
AnsFrm
( CALL )
Tx_Len
SndAns
( U)
#0
345
Dual CPU Operation
Flags and Diagnostics

Two flags are used to provide indications for the application:
PrmFlg : '1' indicates that the CPU is plugged in slot-0 (Primary).
PrmFal : The Secondary's application may use this flag to check if a failure has occurred
in the Primary CPU. '1' indicates that there is a failure in the Primary.
346
Global Positioning System (GPS)
(MOSCAD ≥ V3.70, MOSCAD-L ≥ V1.00).
The MOSCAD/MOSCAD-L system uses the MOTOROLA ONCORE GPS receiver precise
time measurement application for synchronization purposes, for example to synchronize the
RTU with other SCADA systems. Two options are available to connect the GPS receivers:
1. Connect a GPS receiver to the MCP/M. The MCP/M will then synchronize the entire
system according to a synchronization layout, accessed from the Programming ToolBox
Time Tag Logger utility or from the Sync CALL function of the ladder-diagram language.
2. Connect a GPS receiver to each MOSCAD unit.
The MOTOROLA ONCORE GPS receiver is capable of providing autonomous position,

velocity and time information over a serial RS232 port. The port is configured as a data
communication equipment (DCE) port and provides the main control and data path between the
receiver and the system controller. The I/O protocol is customized to meet the system
requirements.
The MOSCAD units use ONCORE GPS receivers equipped with a 1 Pulse per Second (PPS)
output. The receivers are connected to Port 2 of each RTU. In case of a satellite failure, the
time is manufactured internally and the receiver indicates its inability to trace the satellite.
! IMPORTANT
MOSCAD only: If your system is from before V3.70, make sure you are using the
required modified CPU prior to GPS connection.
347
Global Positioning (GPS)
Setting the GPS Parameters

Open the Site Configuration program and configure Port 2 to RS-232, Async, GPS receiver.
The User parameters are automatically set as shown below.
The default values may be changed according to the following:
The Time period to get data from GPS (sec) field defines the interval between two time updates
from the GPS receiver. The range is 2 to 60 Seconds.
The Local offset from universal time (hours) field defines the time offset of the current location
from the Universal Time Coordinate (UTC). The range is -23.5 to 23.5 hours.
In the Description field you may enter a free-format description of the port interface (up to 36
characters).
After entering all your selections, press [Esc] to return to the Ports List table. Note that the
table has been updated according to your entries.
348
Global Positioning (GPS)
After setting the GPS parameters and downloading the configuration to the RTU, the unit starts
updating its time accordingly. You may use the Site Time & Date utility, to verify the RTU
time.
System Tables Variables

The system set flag, GpsVal, is included in the Reserved Flags (system) table. ‘1’ indicates that
a GPS receiver is connected to the RTU and the receiver is updated from the satellite. When
GpsVal=1 the RTU updates its time from the GPS, and ignores any synchronization words
received from other systems, from the Site Time & Date utility, or through the ladder diagram
language. GpsVal=0 indicates that the GPS receiver is not connected to the RTU, or that the
GPS is connected and a satellite connection failure has occurred. Following system power-on,
it takes up to 15 minutes for the GPS receiver to start reading the satellite time.
The ladder controlled GpsOfs value is included in the Reserved Values (system) table. This
value enables the user to update the MOSCAD unit to Daylight Savings Time.
The GpsOfs default value is ‘0’, and it may be either positive or negative according to the
specific time changes (measured in hours). This value is added to the “Local offset from
universal time” value, defined in the RS232-GPS RECEIVER definition window, following
thereafter.
When the GpsOfs is set, the RTU time is updated starting from he next GPS report, except
following a “cold start”, which may last up to one minute.
GPS Cable
To connect Port 2 of the RTU to the GPS receiver, you should use the FKN4487 adapter and
the connection cable described in User Guide.
349
PID LOOP - Proportional Integral
Derivative
General
The following figure describes the PID Loop performed by the MOSCAD RTU.
The measured process value is converted by the transducer into voltage or current, which in
turn is converted by the A-to-D converter into a scaled analog input - a real (32-bit floating
point) value designated by the symbol pidIN which represents the current value of the
measured process.
The PID block is driven by the error signal (E) calculated as the difference between the
setpoint - pidSP (the desired value) and pidIN (the actual value).
The PID block transfer function is defined by its parameters. Its output, pidOUT, is a real
(32-bit floating point) value, driving the D-to-A converter.
The output of the D-to-A converter, voltage or current, is used as the controlling drive for
the process.
The purpose of the loop is to minimize the error E(t) by driving the process to follow the
setpoint value.
If E(t) = SP(t) - IN(t), then the transfer function of the PID block is defined as follows:
OUT (t ) = I 0 + KKi ∫0 E (t )dt + KE (t ) + KKd dE ( t )

t
dt
where:
350
PID LOOP - Proportional Integral Derivative
IN(t) - the PID input that represents the measured process value in "Input
Engineering Units" [IEU].
SP(t) - the setpoint value in [IEU].
E(t) - the error signal.
OUT(t) - the output of the PID loop in "Output Engineering Units" [OEU].
K- the gain of the loop in [OEU/IEU].
Ki - integration factor in "repetitions per second" [l/sec].
Kd - derivative factor in seconds.
I0 the initial value of the integral (when t=0) in [OEU].
In the PID table, all the abovementioned variables have the prefix pid, i.e. IN becomes
pidIN, SP becomes pidSP, etc.
Note that up to eight PID loops can be calculated in a MOSCAD CPU 400.
PID Function
The PID function performs the following three calculations:
• The proportional calculation, whose contribution to the output signal is directly

proportional to the error signal.
• The integration, whose contribution to the output signal is proportional to the integral of
the error between 0 to t plus I0, which serves as the initial value of the integral (for t=0).
The integral drives the process of the setpoint value with a zero position error.
• The derivation, whose contribution to the output signal is proportional to the rate of
change of the error signal.
PID Table
To access the PID table, open the Application Programmer in the MOSCAD Programming
ToolBox folder. Click on the Database Tab in the Workspace Bar. Click on the
Workspace name and on User Tables to open the list of database user tables as shown
below.
351
• If no PID Table appears in the list of user table names, it must be created. Right-click on
the User Tables and select Append Table -> PID Table from the context menu.
• If PID Table appears in the list of user table names, double-click its name in the table
name list.
The following is displayed:
The PID table includes the following parameters. For more details on each parameter, see
the example project:
• pidIN - the scaled analog input (32-bit floating point value) that represents the
controlled process.
The value in this column is updated when the SCAN function using this column name
is called.
352
• pidSP - this variable represents the setpoint, the desired state of the controlled process.
This is a real parameter variable that has an initial value for each row (each loop).
You may modify the value of this variable in the rungs when a change in the controlled
process is needed.
• pidK - this real parameter variable represents the gain of the loop. Its initial value
usually remains the same. The value of this variable may be modified in the rungs.
• pidKd - derivative factor in seconds that controls the output correction rate at which the
output responds to the change of error. A value of zero will disable the derivative
action. The value of this variable may be modified in the rungs. Default: 0.0
• pidKi - integration factor in "repetitions per second”. A value of zero will disable the
derivative action. The value of this variable may be modified in the rungs. Default: 0.0
• pidInt - this is the integral section in the equation above, i.e.
This real parameter value starts with an initial value which represents I0. It is
continuously modified to represent the value of the above equation. The value may be
changed in the rungs to any desired value.
• pidDb - this variable defines the PID output dead band. It prevents frequent changes of
the pidOUT variable when the absolute value of the difference between the new
calculated value and the current value is smaller than the pidDb value. When pidDb=
pidOUT, the pidOUT variable is always updated by the PID. Default: 0.0
The value of this variable may be modified in the rungs.
• pidOUT - the scaled analog output (32-bit floating point value) that drives the process.
Note that the PID table, like all other User tables in the database, can be edited, deleted,
searched, or converted to a printable file. Rows can be added, as can a table description.
How to Use the PID

In order to use the PID, the PID table and other User tables are built in the MOSCAD
Programming ToolBox Application Programmer Database Builder, with variables
corresponding to physical elements. Process rungs are programmed in the Ladder Diagram
language which define the behavior of outputs as a function of the states and their inputs
and time. An analog input is scanned, the PID function is called to perform the PID loop
and then the analog output of the PID loop is scanned.
The example below shows a PID application for a MOSCAD RTU. While the specific
application controls water flow, the concept of the PID control is universal and the example
described herein can be used for other applications.
353
MOSCAD PID Application Example
General
This application is used to control water flow by changing the position of a regulating
valve. The flow is measured by an Analog Input (range: 0-15000 liter/hour). The valve
position is controlled by an Analog Output (range: 0-100%).
The database used in this example is described below. Each table in the database is shown
as it appears in the Database Builder. Each variable used in the tables is described. Finally
the application process rungs are described as they have been implemented in the sample
project.
Glossary
CV - Controlled Value: The measured or calculated process input
SP - Process SetPoint value
Err - Process error = SP - CV
AO - Process Analog Output: Sets the position of the controlled element
PID control function

A PID control function is used to set an analog output as a function of a process setpoint
and a feedback analog signal of the controlled value. The function include three
adjustments, each of which is represented in the MOSCAD PID table by a variable:
• Proportional (pidK variable)

• Integral (pidKi variable)
• Derivative (pidKd variable)
The application includes additional features, such as:
• Operation Mode – Manual (set by operator) or Automatic (PID) mode.

• Validity Check - The process variables are to be within a predefined valid range.
• Cycle time - Time interval between consecutive calculations of PID function
The impact of the three adjustments of the PID is as follows:
1. The proportional part of the PID function contributes to its output the result of
(PidK) x (Err). That means that AO increases when Err increases, and AO decreases when
Err decreases, by the proportional gain PidK.
The PID function does not put a limit to the proportional part. In certain cases, when Err is
large, it may cause the AO to be changed by large steps and to reach its limits. This may
cause fluctuations in analog output and unstable condition of the controlled process. In
order to prevent this problem, the application reduces the PidK when Err is large. Thus the
Integral action is dominant when Err is large, and the Proportional action is more dominant
354
Note: Setting the PID function parameters requires some knowledge about tuning PID
loops. The current version of MOSCAD PID function and the application example
described below, does not include 'self tuning' feature. The user has to set them manually,
write additional application or use external PC based software for this purpose.
2. The integral part of the PID contributes to its output the result of
[(PidK*PidKi) x Integral of (Err)], where the summation is performed every time the PID
calculation is performed. That means that AO increases as long as Err is positive, and AO
decreases as long as Err is negative. The summation result is stored in the PidInt variable,
where it can be set by the application too.
The PID function does not put a limit to the integral part. In certain cases, this may cause
the AO to reach its low or high limits. The application, as explained later, has to deal with
such situations.
3. The derivative part of the PID contributes to its output the result of
(PidK*PidKd) x (Err rate of change). That means that AO increases as long as Err rate of
change is positive, and AO decreases as long as Err rate of change is negative. If Err is
constant the derivative portion of the PID function equals to zero.
In the described example the derivative factor was set to zero, since its action is not
required for flow control.
Operation mode
A PID loop can be either in Auto mode or in Manual mode. In Auto mode, the operator
can set the required flow and the PID function sets the AO according to process conditions.
In Manual mode, the operator can set the position of the regulating valve directly, and the
PID function results are ignored.
The MOSCAD application handles the transition from one operation mode to the other.
Validity Check
The controlled value of a loop is usually an analog input. The application in the following
example also supports the validity check of the CV, in order to prevent loop malfunction.
The PID setpoint is also checked to be within predefined limits. If it exceeds these limits, it
is operates according to the minimum or maximum setpoint range accordingly.
Moreover, the resulting AO of the PID function is also checked for validity before updating
the physical analog output.
The MOSCAD PID application, described in this section, uses the built in PID table, with
additional User tables and process, to control the CV (e.g. pipe flow) by setting the position
of the AO (e.g. regulating valve). The inputs of the function are the required flow (SP) and
the measured flow (CV).
Database Tables
The database tables are shown below. Each variable used in the tables is described.
355
Operator Interface Table

This table contains the variables that can be set by the operator who controls the process via
an HMI station:
Table name: Operator Interface COS name:

Table symbol: Last index (Ind): 0
Last index name: LstPid
Ind CV_Set AO_Set ModSet
(int) (int) (iprm)
0 0
CV_Set - Controlled Value setting for PID loop in Auto mode

AO_Set - Analog Output setting for PID loop in Manual mode
ModSet - Setting of PID loop Operation mode (1 = Auto, 0 = Manual)
PID Table
Table name: PID Table COS name:
Last index name: I_PID
Ind pidIN pidSP pidK pidKd pidKi pidInt PidDb PidOUT

(sAI) (rprm) (rprm) (rprm) (rprm) (rprm) (rprm) (sAO)
0 0.0 3.0-4 0.0 10.0 0.0 0.0
Ind pidIN EGU Zero (%) EGU EGU High

Zero 100%=Full Scale
0 0% 0.0 1.0
Ind PidOUT EGU Zero (%) EGU Zero EGU High

100%=Full Scale
0 0% 0.0 1.0
The PID function runs according to the following variables:
pidIN - PID controlled value input. - Represents the controlled value (CV). This value is
not linked directly to the analog input and is updated by application. The scaling of the
input can be defined in this column, by setting the EGU Zero and EGU High accordingly.
356
pidSP - Represents the process setpoint (SP)
pidK - Proportional gain factor. A default value is defined in the table. Application changes
the value according to Err value, as explained later.
pidKd - Differential factor. Equals zero. Not used for flow control process.
pidKi - Integral factor. A default value for the integral part mutiplier is defined in the table.
However, application changes this value when the relevant pidK is changed, as explained
later
pidInt - Accumulated (calculated) integral part.
pidDb - PID Process output deadband sets the minimum step of change in the PID function
output. In the application example it is set to zero. For fast response process this value
should be kept to a minimum.
pidOUT - PID function output. This value is not linked directly to the analog output. The
scaling of the output can be defined in this column, by setting the EGU Zero and EGU
High accordingly. For the process in this example the output range is defined as 0 - 100
(%). Its value is checked to be in a certain range before updating the analog output variable.
PID I/O Table

This table is used to link the process CV analog input and AO analog output. The values
are scaled to 0 - 100 percent.
Table name: PID I/O COS name:

Last index name:
Ind Pid_AI Pid_AO

(sAI) (sAO)
Ind Pid_AI EGU Zero (%) EGU Zero EGU High

100%=Full Scale
0 20%=Live Zero 0.0 100.0
Ind Pid_AO EGU Zero (%) EGU Zero EGU High

100%=Full Scale
0 20%=Live Zero 0.0 100.0
Pid_AI - PID loop controlled value analog input (linked to an AI module)

Pid_AO - PID loop analog output (linked to an AO module)
EGU Zero–used to define the scaling of the PID controlled value input pidIN
357
EGU High –used to define the scaling of the PID controlled value input pidIN
PID P & I Parameters Table

These parameters are used to define the basic proportional and integral factors.
Table name: PID P & I Parameters COS name:

Last index name:
Ind PID_P PID_I

(rprm) (rprm)
0 3.0-4 10.0
PID_P - Proportional factor (also multiplies the Integral part)

PID_I - Integration factor
PID Parameters Table

This table includes user definable parameters that are used to check validity of input (CV)
or output (AO) of the PID function.
Table name: PID Parameters COS name:

Last index name:
Ind AlrDB AlrTim CV_Min CV_Max AO_Min AO_Max

(rprm) Mn:Sc (rprm) (rprm) (rprm) (rprm)
0 5.0 05:00 0.0 15000.0 0.0 100.0
AlrDB - PID alarm dead band (percent of full scale)

AlrTim - Time delay to set the PID alarm flag. This alarm indicates that the PID process
value did not reach the setpoint within the AlrDB range within this time delay.
CV_Min - Minimum value of CV (controlled value)
CV_Max - Maximum value of CV (controlled value)
AO_Min - Minimum value of AO (analog output)
AO_Max - Maximum value of AO (analog output)
358
PID Flags Table

The variables of this table are used for checking the existing error (SP-CV) of the PID loop.
Table name: PID Flags COS name:

Last index name:
Ind PidDif DifTmp RTemp O_Max O_Min PidAlr

(real) (real) (real) (bit) (bit) (bit)
PidDif - Difference (Err) between setpoint (SP) and process controlled value(CV)
DifTmp – Process error in CV engineering units
RTemp - Process error in percents of CV full scale
O_Max - Temporary bit. Indicates that output has reached its maximum position
(AO_Max)
O_Min - Temporary bit. Indicates that output has reached its minimum position (AO_Min)
PidAlr - Pid loop alarm flag. This alarm indicates that the PID process value did not reach
its setpoint (including the AlrDB deadband) within the predefined time (AlrTim)
Second Timers Table

Table name: Second Timers COS name:
Data type: Timers Second (Sc:Ms)
Ind Name Value
0 TPID 01:00
TPID - PID calculation time interval (multiplied by 10 ms). The timer preset value is set by
PtPID.
User Flags Table

Table name: User Flags COS name:
Data type: Discrete (bit)
Ind Name Value
0 BTemp
Btemp - Temporary flag
359
User Parameters Table

Table name: User Parameters COS name:
Data type: Integer Parameter (iprm)
Ind Name Value
0 PtPID 100
PtPID - A parameter to set PID calculation time interval (10msec resolution). The
minimum setting for running 8 PID loops is 100 (1 second).
Constants
The application uses the following constants:
Integer Constants - Manual = 0, Auto = 1

Real Constants - R0 = 0.0, R100 = 100,0
Programming Process Rungs

The chart below lists the rungs which have been programmed for application.
Rung Description
P05 Scan PID AI
P10 Reset Index p
PL10 Local Setpoints
PL12 Local Setpoints
P18 Manual mode limits
P20 Manual Mode
P21 Jmp P50 if no TPID
P25 Auto Mode
P30 Check Input range
P50 Increment Index p
P60 Check Index p
P90 Run PID Calc
M91 Jmp P200 if no TPID
P100 Reset Index p
P110 Check Output range
P112 Calc PID loop error
P113 Set PI factors
360
P114 Set O_Max flag

P115 Set O_Min flag
P130 Increment Index p
P140 Check Index p
P200 Scan analog output
P210 Run PID Timer
The following are the actual rungs of the application.
Rung P05: Scan the analog input (CV) of the PID loop.
Pid_AI
P05 (SCAN)
Rung P10: The number of PID loops which are controlled by the application is set by the
number of rows in the PID Table. The same application with an index 'p' handles all loops.
This rung resets 'p' index to run the first PID loop.
p
P10 ( RST )
Rung PL12: In Auto mode, the Pid_AO is always copied to AO_Set. This enables smooth
transition to Manual mode without a step change in the loop SP.
ModSet,p AO_Set,p
PL12 = (MOVE)
Auto Pid_AO,p
Rung P18: In Manual mode, the AO_Set value is checked to be within a predefined range
(AO_Min and AO_Max). If it exceeds these limits, the output is set to the relevant limit.
ModSet,p AO_Set,p Pid_AO,p

P18 = > (MOVE)
Manual AO_Max AO_Max,p
AO_Set,p Pid_AO,p
< (MOVE)
AO_Min AO_Min,p
Rung P20: In Manual mode, the Pid_AI is checked to be within a predefined range
(CV_Min and CV_Max) and copied to CV_Set. This enables smooth transition to Auto
mode without a step change in the loop PidSp.
361
In addition, the AO_Set value is checked to be within a predefined range (AO_Min and
AO_Max) and is copied to Pid_AO, and PidInt. Updating the latter variable is also
important to keep the AO in the last position when loop mode is changed to Auto, while
there is no change in the setpoint.
ModSet,p Pid_AI,p Pid_AI,p pidSP,p

P20 = > > (MOVE)
Manual CV_Min,p CV_Max,p Pid_AI,p
Pid_AI,p Pid_AI,p
= =
CV_Min,p CV_Max,p CV_Set,p
(MOVE)
pidSP,p
AO_Set,p AO_Set,p Pid_AO,p
> < (MOVE)
AO_Min AO_Max AO_Set,p
AO_Set,p AO_Set,p
= =
AO_Min AO_Max pidInt,p
(MOVE)
Pid_AO,p
Rung P21: Skips the next two rungs when PID loop is not calculated.
TPID P50
P21 / ( JMP )
Rung P25: In Auto mode, the CV_Set (set by the operator) is checked to be within a
predefined range (CV_Min and CV_Max) and copied to PidSp. In addition the AO_Set
value is updated by the Pid_AO.
ModSet,p CV_Set,p CV_Set,p pidSP,p

P25 = > < (MOVE)
Auto CV_Min,p CV_Max,p CV_Set,p
CV_Set,p CV_Set,p
= =
CV_Min,p CV_Max,p AO_Set,p
(MOVE)
Pid_AO,p
362
Rung P30: In Auto mode, the Pid_AI is checked to be within a predefined range (CV_Min
and CV_Max) and copied to PidIn accordingly.
ModSet,p Pid_AI,p Pid_AI,p pidIN,p

P30 = > < (MOVE)
Auto CV_Min,p CV_Max,p Pid_AI,p
Pid_AI,p Pid_AI,p
= =
CV_Min,p CV_Max,p
Pid_AI,p pidIN,p
> (MOVE)
CV_Max,p CV_Max,p
Pid_AI,p pidIN,p
< (MOVE)
CV_Min,p CV_Min,p
Rung P50: Counts up (increments) the index counter (to execute the next loop).
p
P50 ( CTU )
Rung P60: Checks the index counter.
p PL10
P60 < (JMP)
I_PID
p
=
I_PID
Rung P90: Runs the PID calculation on all loops every TPID interval.
TPID P.I.D.
P90 ( CALL )
Rung M91: Skips the next rungs, which check the PID function results, if PID function was
not performed.
TPID P200
M91 / ( JMP )
363
Rung P100: Resets a new index.
p
P100 ( RST )
Rung P110: Checks the PidOut (PID function output) to be within a predefined range
(AO_Min and AO_Max), and copies it to Pid_AO accordingly.
ModSet,p pidOUT,p Pid_AO,p

P110 = < (MOVE)
Auto AO_Min,p AO_Min,p
pidOUT,p Pid_AO,p
> (MOVE)
AO_Max,p AO_Max,p
pidOUT,p pidOUT,p Pid_AO,p

> < (MOVE)
AO_Min,p AO_Max,p pidOUT,p
pidOUT,p pidOUT,p
= =
AO_Min,p AO_Max,p
Rung P112: PID loop performance is checked. If the output fails to be within a predefined
range (PidSp +/- AlrDB) for longer than AlrTim, an alarm flag (PidAlr) is set.
ModSet,p PidDif,p
P112 = - pidSP,p
Auto Pid_AI,p
DifTmp,p
(MOVE)
PidDif,p
DifTmp,p DifTmp,p
< - R0
R0 DifTmp,p
RTemp,p
(CALC)
RTemp,p
AlrTim,p
>
(DON)
AlrDB,p
AlrTim,p PidAlr,p
( )
RTemp,p = DifTmp,p/(CV_Max,p - CV_Min,p) * (R100)
364
Rung P113: In order to prevent large fluctuations in output when Rtemp (process error in
percents) is greater than AlrDb (user defined parameter), the application divides the PidK
by a constant 100. In order to keep the integral factor unchanged, it is multiplied by the
same constant. Thus, the Integral action is dominant when process error is large, and the
Proportional action is more dominant when process error is small.
ModSet,p RTemp,p pidK,p

P113 = > / PID_P,p
Auto AlrDB,p R100
RTemp,p pidKi,p
= x PID_I,p
AlrDB,p R100
RTemp,p pidK,p
< (MOVE)
AlrDB,p PID_P,p
pidKi,p
(MOVE)
PID_I,p
Note: The constant is used for the example only. For a practical PID loop, the proper
constant (or other type of handling these factors) must be implemented.
Rung P114: In Auto mode, when PidOut exceeds AO_Max, it is kept at that level. The first
time the process error becomes negative, the AO_Max is copied to PidInt. This operation
eliminates the effect of positive accumulated value of the Integral portion when AO is in its
maximum position.
ModSet,p pidOUT,p O_Max,p

P114 = > ( L )
Auto AO_Max,p
O_Max,p PidDif,p pidInt,p

< (MOVE)
R0 AO_Max,p
O_Max,p
(U )
365
Rung P115: In Auto mode, when PidOut exceeds AO_Min, it is kept at that level. The first
time the process error becomes positive, the AO_Min is copied to PidInt. This operation
eliminates the effect of negative accumulated value of Integral portion when AO is in its
minimum position.
ModSet,p pidOUT,p O_Min,p

P115 = < ( L )
Auto AO_Min,p
O_Min,p PidDif,p pidInt,p

> (MOVE)
R0 AO_Min,p
O_Min,p
(U )
Rung P130: Counts up (increments) the index counter (to execute the next loop).
p
P130 ( CTU )
Rung P140: Checks the index counter.

p P110
P140 < ( JUMP )
I_PID
p
=
I_PID
Rung P200: Writes the resulting analog output to Pid_AO by Scan operation.
Pid_AO
P200 ( SCAN )
Rung P210: Sets and runs the TPID timer.
TPID TPID
P210 (MOVE)
PtPID
TPID TPID
/ (DON)
366
367
Software Diagnostics Output
This section lists the diagnostics which are available for the various MOSCAD RTU devices. The
messages are listed as they appear on the screen, with %% signs in the text to represent the device’s
current alphanumeric values.
The description which follows the diagnostics messages, provides an explanation for the variables.
Terms that are used frequently in diagnostics are described below:
Term Explanation
Device A MOSCAD/MOSCAD-L software module.

Instance (of a device) A device may appear more than once in
MOSCAD/MOSCAD-L, each carrying a
unique name.
Level A group of diagnostic checks. Up to 100 (0
through 99) levels can be custom-defined for
each device.
PIN table A pointer which allows “cabling” between
two devices during run time.
Address Numeric sum of Site ID and System
Address.
Tick Time measurement unit, equal to 10 ms.
TRANSPORT MUX DEVICE = TRNINT
## 16 LEVEL = 0
Mini Session Channels : %% 1
Master Channels : %% 2
Slave Channels : %% 3
1. Number of logical mini-sessions that serve the RTU applications. A mini-session is an API layer that
serves the RTU-to-RTU communications, event bursts, and setcall.
2. The number of logical channels above the Presentation layer from which the RTU can initiate
communications. In an RTU there are no such logical channels as there is no application that can
initiate a call. Control centers (e.g. MCP-M) do have such applications such as schedulers and
command dispatchers.
3. The number of logical channels above the Presentation layer through which the RTU reacts to calls
simultaneously (such as error logger, diagnostics, D.B. monitor, process monitor, date and time,
download). The RTU does not need more than 2-4 channels for regular and orderly activity.
368
## 17 LEVEL = 1
Minisession Channels
--------------------
Minisession Key Application ID
--------------- -----------------
This is the applications table that uses the mini-session API for communication purposes. For each
application this table records the key for the instance of the mini-session, and the application ID.
## 18 LEVEL = 2
Master Channels
-------------------
Transport Key Slave: Site Port Link
------------- ---- ---- ----
This table defines the logical channels located above the Presentation layer, and capable of initiating
communications. For each channel the table records the call destination. The destination address consists
of the site ID, the port ID, and the link ID.
## 19 LEVEL = 3
Slave Channels
--------------
Transport Key Master: Site Port Link Channel Id
------------- ---- ---- ---- ----------
This table defines the active logical channels that can react to communications from ToolBox, the control
center, MCP-M or IP Gateway. For each logical channel, the table records information about the SRC that
initiated the call, namely, the site ID, link ID, Port ID and the identification number of the logical channel
that was used for the call.
## 20 LEVEL = 4
Frame Sequence Channels
-----------------------
Frame Seq Key Application Id
------------- --------------
The Frame Seq Key field holds the key of the application that should receive the frames originating from
the corresponding application on the transmitting side, specified in the Application ID field.
## 21 LEVEL = 5
Exp Send L_dup State T_reset T_dup T_hole B_reset B_ack
Exp The expected sequence number.
Send The sequence number of the next frame sent.
L_dup The last sequence number that can be accepted as the sequence of a duplicated frame.
State The status registered in the internal status engine.
369
T_reset The amount of time a unit waits after having acknowledged repeated reset requests, before
sending its own reset frame.
T_dup The amount of time a unit, which has received frames with identical numbers, considers
them as duplicates instead of new transmissions.
T_hole The amount of time a unit, which has received frames with holes in the sequence numbers,
still expects to receiving the missing frames.
B_reset 1 means that the frame contains a reset bit.
B_ack 1 means that the frame contains a reset ACK bit.
## 23
Curr Since Last Diagnostic: Max # # Max #
Waiting Waiting Range Time Hole Resets
Buffers Buffers Holes Holes Len
Current Waiting Buffers Number of frames held in Waiting Queue.
Max Waiting Buffers Maximum number of frames in Waiting Queue.
# Range Holes The number of range “holes” found since the last diagnostic.
# Time Holes The number of time “holes” found since the last diagnostic.
Max Hole Len The maximum length of time “holes.”
# Resets The number of resets/rejects since the last diagnostic.
HEAP DEVICE = HP_F_TX, HP_F_RX, HP_UF_A, HP_UF_U
HP_F_TX, HP_F_RX MDLC Formatted

HP_UF_A MDLC adapter (unformatted)
HP_UF_U USER Port
370
## 32 LEVEL = 0
# of buffers in heap : %% 1
# of buffers left in heap : %% 2
The minimum # of buffers left
in heap from last diagnostic : %% 3
# of times the heap was empty
since last diagnostic : %% 4
Size of one buffer in bytes : %% 5
During init flag : %% 6
Bad heap flag : %% 7
Unit time for freeing by force : %% 8
Pointer to start chain : %% 9
Pointer to current chain : %% 10
Pointer to end chain : %% 11
1. Number of buffers in heap instance
2. Number of free buffers in heap.
3. Minimum number of free buffers left in heap since the last diagnostic. This information reflects the
extent to which the heap is capable of meeting RTU needs under heavy traffic.
4. The number of times, since the last diagnostic, the RTU software detected an empty heap. A large
number of times points to incorrect allocation of memory resources.
5. Size of buffer including the overhead for managing a single buffer.
6. The flag that indicates that the RTU is in startup stage.
7. The flag that points to memory overwrite in the memory area allocated to the heap.
8. Unit of time to be measure how long a buffer is out of the heap (used by other parts of the system).
9. 10. and 11. The heap consists of a chain of joined buffers. For chain management purposes, a key
holds pointers to the beginning of the chain, the end of the chain, and to the next buffer that will be
taken from the chain. The P_current_chain value must be (numerically) between the start and end
values.
## 32 LEVEL = 1
Buf Key Next Cntr #FF
--------------------------------------
Buf Address of the buffer in the memory.
Key Handle (identifier) of the heap. (If =0, buffer is in heap. Otherwise buffer is in use by system.)
Next Next buffer in heap to be allocated. (Meaningful only if key=0.)
Cntr Counts intervals of time that the buffer is out of the heap. (Meaningful only if key ≠ 0)
#FF Forced free. (Meaningful only if key ≠ 0.) Indicates the total number of units that the buffer was
in use out of the heap. Set back to zero when heap is returned to heap. If this value is greater
than 3, there may be a memory leak problem. Please consult product group.
371
ADAPTER DEVICE = COM1A,RTU1A, LIN1A,…
## 48 LEVEL = 0
Physical device key : %% 1
Physical PIN’s table : %% 2
Heap key, to be used by the receive function : %% 3
Heap key, to be used by the transmit function : %% 4
Mask address (ignore addresses or not) : %% 5
System address : %% 6
Specific logical address (site id) : %% 7
Extra address 1 : %% 8
Extra address 2 : %% 9
Mode of operation : %% 10
TimeAuth device key (HEX) : %% 11
TimeAuth handle : %% 12
Authentication stamp offset : %% 13
General - The adapter is the layer which coordinates the transmission / reception of the MDLC frame
above Asynchronous Port.
1. The physical asynchronous key.
2. PIN Table - A pointer which allows “cabling” during run time to the physical asynchronous layer
selected in Site Configuration.
3. The Rx Heap key - This is the key to the formatted buffer Heap HP_F_RX to be used to collect the
stream of bytes which is received in the Asynchronous Port in the MDLC Frame.
4. The Tx Heap key - This is the key to the unformatted buffer Heap HP_UF_A to be used to convert
the MDLC frame into a stream of bytes for transmitting through the Asynchronous Port.
5. 0XFFFF - means receiving every MDLC frame regardless of its address. (used for the Protocol
Analyzer)
6. The System address - In the local port (not above radio) the value is zero , even if the user chooses a
different value.
7. The Site ID.
8. Used for transmissions in the local address (-2).
9. Used as a default router address
10. Whether or not to allow reception of SYNC frames.
11. TimeAuth device key in Hexadecimal form.
12. TimeAuth identifier.
13. Offset of Authentication stamp within the buffer for authenticated SYNC frames only.
372
## 49 LEVEL = 10,11
# of transmitted frames : %% 1
# of transmission fails : %% 2
# of received frames : %% 3
# of received frames (with error) : %% 4
Mask of errors (receive) : %% 5
Number of non-properly authenticated SYNC frames : %% 6
1. The number of unformatted frames that have been transmitted.
2. The number of unformatted frames that have been transmitted and for which the physical layer
returned a fail signal.
3. The number of received frames includes only correct frames (including acknowledgment frames).
4. The number of unformatted frames that have been received with some error.
5. The following figure illustrates the mask:
6. Number of synchronization frames which were not properly authenticated.
b15 . . . . . . . . . . b8 b7 b6 b5 b4 b3 b2 b1 b0
unformatted buffer heap is empty

Reserved
inverse byte, end of frame

empty frame received
invalid destination
frame, more than 200 bytes
inverse byte, inverse byte
invalid byte after inverse byte
CRC error
Recovery of UF heap
TRANSPORT DEVICE = TRANS1, TRANS2,...
## 64 LEVEL = 0
Logical channel no. : %% 1
Timeout between Tx retries : %% 2
Timeout between channel busy retries : %% 3
Timeout between Rx frames : %% 4
Timeout of Rx wait (till session chk) : %% 5
Current timeout between Tx retries : %% 6
Current timeout between channel busy retries : %% 7
Current timeout between Rx frames : %% 8
Current timeout of Rx waiting : %% 9
No. of Tx retries : %% 10
No. of channel busy retries : %% 11
Current no. of Tx retries : %% 12
373
Current no. of channel busy retries : %% 13

Sequence of master session : %% 14
No. of frames in burst : %% 15
No. of frames in current burst : %% 16
Size of Tx queue : %% 17
Index in Tx queue of first buffer : %% 18
Index in Tx queue of next free place for buffer : %% 19
Sequence of first frame in Tx queue : %% 20
Sequence of last frame in Tx queue : %% 20
Size of Rx queue : %% 21
Index in Rx queue of first frame : %% 22
Sequence of first frame in Rx queue : %% 23
Sequence of first expected frame : %% 24
Index in Rx queue of for expected frame : %% 25
Size of temp queue : %% 26
Index in temp queue of first frame : %% 26
Index in temp queue of next free place for frame : %% 26
(flag) should start session frames to be expected : %% 27
(flag) is ack required ? : %% 28
(flag) is sync ack arrived ? : %% 29
(flag) was sync ack sent ? : %% 30
(flag) has new data arrived ? : %% 30
(flag) is it a master device ? : %% 31
(flag) is device in Tx state ? : %% 32
(flag) has reset by master occurred ? : %% 33
(flag) was session aborted ? : %% 34
(flag) first ack with burst in msg ? : %% 35
(flag) is it first Tx burst in session ? : %% 36
In_retry : %% 37
1. The logical channel number.

2. The number of seconds between transmission attempts when ACK is not received at the Transport
layer.
3. The number of seconds between transmission attempts when a Busy ACK is received. (not enough
logical channels on the answering site).
4. The preset time that the site will wait until it issues its ACK to a partial reception.
5. The preset time that the site will wait for the first time until it asks the other site “is session on?”
6. The current number of seconds between transmission attempts.
7. The current number of seconds between transmission attempts in case of Busy ACK.
8. The actual time that the site waits until it issues its ACK to a partial reception.
9. The actual time that the site will wait for the first time until it asks the other site “is session on?”
10. Number of transmission attempts.
11. Number of transmission attempts in case of Busy ACK.
12. The current number of transmission attempts.
13. The current number of transmission attempts in case of Busy ACK.
14. The sequence number of the master session at the initiator’s site.
15. The current number of frames in a single transmission while waiting for ACK on the receiving site.
374
16. The total number of frames in a single transmission while waiting for ACK on the receiving site.
17. The size of the Tx queue until the Transport layer suspends the application.
18. The index of the next buffer to be transmitted. (beginning of queue).
19. The index of the next buffer to be added to the queue. (end of queue).
20. The sequence number of the first frame and last frame in the queue.
21. The size of the Rx queue.
22. The next frame to be received by the Rx queue.
23. The sequence number of the frame to be received.
24. The expected sequence number of the next frame to be received.
25. The location of the next frame to be received in the Rx queue.
26. A temporary queue in case of holes in reception (the receiving sequence number is different from
expected). The data is similar to the Rx queue
27. Does Transport expect start session in the next frame to be received?
28. Is Sync ACK required?
29. Has Sync ACK arrived?
30. Was Sync ACK transmitted? Have new frames been received?
31. Is this Instance master or slave?
32. Is this Instance in Tx state?
33. Has a Reset been sent from the Master?
34. Has the current session been aborted?
35. Send ACK in next transmission?
36. Is this the first burst in the current transmission for sending Start Session?
37. Is the Transport layer retrying?
## 65 LEVEL = 1
no. of buffers in Tx queue : %%
no. of buffers in Rx queue : %%
no. of buffers in temp queue : %%
The number of MDLC frames in each queue in this instance of the Transport layer.
375
## 66 LEVEL = 10/11
# of re-transmitted frames : %% 3
# of received frames (with error) : %%
# of frames in Tx queue : %%
# of frames in Rx queue : %%
# of frames in Tx queue (held by link layer) : %%
# of frames in Tx queue (held by physical layer) : %%
1. The # of Transmitted Frames (does not include retransmission and acknowledgment frames.)
2. The # of Received Frames (includes only correct frames.)
3. The # of Re-transmitted Frames represents only frames rejected by the physical layer (do not use this
number; use the # of Re-transmitted Frames in the Link device).
MTE
## 80 LEVEL = 0
Unused RAM memory : %% 1
Total RAM handled by MTE : %% 2
Number of created tasks : %% 3
Number of created devices : %% 4
Spare stack for each task stack : %% 5
Spare stack for sup. stack : %% 5
Length of sup. stack (without spare) : %% 6
Unused sup. stack (without spare) : %% 7
Length of 1 task control block (tcb) : %% 8
Length of 1 device control block (dcb) : %% 8
Address of mt_curtaskid : %% 9
Address of mt_curprio : %% 9
Maximum allowed value for low task watchdog : %% 10
Maximum allowed value for high task watchdog : %% 10
Maximum reached value of low task watchdog : %% 11
Maximum reached value of high task watchdog : %% 11
1. The amount of unused memory in bytes.
2. The amount of memory that the MTE (the operating system) received at startup and distributed
among all of the instances that were created in the system.
3. The number of tasks (infinite threads) that were created according to the site configuration.
4. The total number of instances created by the MTE according to the site configuration.
5. The number of extra bytes for each stack. These bytes are designed to detect memory corruption.
6. The length in bytes of the supervisor stack.
7. The amount of unused bytes in the supervisor stack.
8. The length in bytes in the MTE structures — TCB (Task Control Block) and DCB (Device Control
Block).
376
9. Data on the current task (the task ID and the task priority).
10. The RTU tasks are wrapped by two inner tasks (high, low) which are to be reached by the CPU every
so and so ticks (the numbers are defined).
11. These two numbers are the maximum reached by the two tasks above.
## 81 LEVEL = 1
The list of all of the instances created, the key of each one of them and its address in memory.
## 82 LEVEL = 2
The list of all of the tasks created in the system, the stack address of each one of them, and the current
number of unused bytes.
LINK
## 112 LEVEL = 0
Number of boxes in table (size of Tx queue) : %% 1
Number of ack buffers to alloc : %% 2
Sequence (most + least - up to 13 bits) : %% 3
Number of retries until positive ack received : %% 4
Number of retries for negative ack (busy) : %% 5
Interval until next retry in case of busy : %% 6
Number of retries for setcall frame : %% 7
Simultaneous (4 channel priority) : %% 8
Specific logical address : %% 9
System address : %% 10
Number of holds : %% 11
Interval between holds : %% 12
All RTU range response : %% 13
Stop using AUTH TX state (flag, 1=YES) : %% 14
Start using AUTH TX state (flag, 1=YES) : %% 14
Stop using AUTH RX state (flag, 1=YES) : %% 15
Start using AUTH RX state (flag, 1=YES) : %% 15
Stop obeying AUTH TX (flag, 1=YES) : %% 18
Start obeying AUTH TX (flag, 1=YES) : %% 19
Stop obeying AUTH RX (flag, 1=YES) : %% 10
Start obeying AUTH RX (flag, 1=YES) : %% 11
Is AUTH active TX (flag, 1=YES) : %% 12
Is AUTH active RX (flag, 1=YES) : %% 13
Obeying AUTH TX (flag, 1=YES) : %% 14
Obeying AUTH RX (flag, 1=YES) : %% 15
TimeAuth handle: : %% 16
TimeAuth device key (HEX): : %% 17
1. The number of MDLC frames that the Link layer can handle simultaneously.
2. The number of ACK frames that are available to the instance Link for transmitting ACK for the
receiving MDLC frames.
3. The number of bits reserved for the sequence number in the Link layer protocol of the MDLC Frame.
377
4. The number of times the MDLC frame was retried without receiving ACK.
5. The number of MDLC frame retries that received Busy ACK. (The receiving site does not have
enough room to handle it because of overload).
6. The number of seconds between transmission attempts in case of Busy ACK.
7. The number of times the broadcast frame was retried.
8. The number of different addresses the Link will transmit to simultaneously.
9. The RTU Site ID.
10. The RTU System address.
11. The time that the Link layer waits when the Physical layer returns Busy to the transmission attempts
of the Link layer in “private conversation”, until it retries.
12. The number of times the Link layer will try to transmit to the Physical layer, if the latter returns Busy
in “private conversation”.
13. The Link layer is capable of answering a range of addresses. This number is the upper bound that the
RTU reacts to, whereas the lower bound is the Site ID.
14. Flag which indicates AUTH TX state (1=YES, 0=NO)
15. Flag which indicates AUTH RX state (1=YES, 0=NO)
16. Flag which indicates Stop obeying AUTH TX (1=YES, 0=NO)
17. Flag which indicates Start obeying AUTH TX (1=YES, 0=NO)
18. Flag which indicates Stop obeying AUTH RX (1=YES, 0=NO)
19. Flag which indicates Start obeying AUTH RX (1=YES, 0=NO)
20. Flag which indicates that AUTH is active for TX (1=YES, 0=NO)
21. Flag which indicates that AUTH is active for RX (1=YES, 0=NO)
22. Flag which indicates Obeying AUTH TX (1=YES, 0=NO)
23. Flag which indicates Obeying AUTH RX (1=YES, 0=NO)
24. TimeAuth identifier
25. TimeAuth device key (HEX)
378
## 113 LEVEL = 1
Address 0 to transmit in same snapshot : %% 1
Network device key : %% 2
Physical pin’s table : %% 3
Last reported station in fail : %% 4
Port fail flag : %% 5
‘one to one’ flag : %% 6
Full duplex flag : %% 7
# of frames in Tx queue : %% 8
# of frames in ‘wait for ack’ queue : %% 9
# of frames in ‘busy & setcall’ queue : %% 10
# of frames in ‘busy & finish’ queue : %% 11
‘private conversation’ flag : %% 12
1. The Link layer is capable of sending to up to four different addresses simultaneously. These fields
contain the last four target addresses transmitted in the same transmission.
2. The Network layer key.
3. The pins table and key of the Physical layer below link. The Link layer is capable of connecting to
any of the different physical media.
4. The last unit that has been reported to be in fail state.
5. The physical port in fail.
6. Mark if the link answers to the local address.
7. Mark if the link is full duplex.
8. The number of frames currently in the Tx queue.
9. The number of frames currently in the Wait for ACK queue .
10. The number of frames currently in the Busy and Broadcast queue that are waiting for the timeout
between retries.
11. The number of frames waiting for the timeout between retries to be over and to be transmitted before
new data frames waiting in the Tx queue.
12. Whether link functions in the private conversation mode (not in use in RTU).
## 115 LEVEL = 10/11

# of re-transmitted frames : %% 2
1. The # of Transmitted Frames does not include retransmission and acknowledgment frames.
379
2. The # of Re-transmitted Frames represents only frames rejected by the physical layer (do not use this
number; use the # of Re-transmitted Frames in the Link device).
3. The # of Received Frames includes only correct frames.
NETWORK STOCK (NSTOCK)
## 144 LEVEL = 0
RAM stock size : %% 1
RAM stock length : %% 2
Network configuration size : %% 3
Was network configuration downloaded ? : %% 4
Used site id for download : %% 5
Used link id for download : %% 6
Is it a node ? : %% 7
Does alternative path to local link exist ? : %% 8
# of entries in Remote Failed Links table : %% 9
Size of Remote Failed Links table : %% 10
Remote Failed Links table entry timeout : %% 11
1. The bank size of learned paths by the Network program.
2. The number of learned paths currently in the bank.
3. The number of paths in the network loaded by the RTU.
4. Whether the Network configuration was loaded to the flash memory.
5. The Site ID which was used for loading the network (must be the same as the self site ID).
6. The Link ID which was used for loading the network (must be one of the RTU links).
7. Whether the RTU is a node in the network.
8. Does the network file downloaded to the RTU have the 'alternative path to local link' feature on?
(YES=1; NO=0)
9. The number of entries in the Remote Failed Links Table used to identify failed links.
10. The maximum size of Remote Failed Links table.
11. The number of minutes that an entry will remain in the Remote Failed Links table before being
erased. This prevents an entry from remaining in the table forever if the link restoration message is
lost.
## 145 LEVEL = 1
Nothing in stock *
Marked with * if no path was learned, otherwise a table of the learned paths appears:
Dest Link Via Site Thru Link
380
## 146 LEVEL = 2
Nothing in scf *
Marked with * if no network was downloaded, otherwise as in ##145.
## 147 LEVEL = 3
Nothing in direct link scf *
Marked with * if no multiple direct link exists, otherwise as in ##145.
## 148 LEVEL = 11
# of times remote failed links table was full : %% 1
# of time tried to add data to remote failed links
table while it was disabled : %% 2
1. The number of times the Remote Failed Links table was full.
2. The number of times an attempt was made to add data to the Remote Failed Links table while it was
disabled.
## 151 LEVEL = 4
Pointer to authentication information header : %% 1
1. Points to the header of the authentication information.
## 153 LEVEL = 5
Remote Failed Link - Table :
Table dest dest fail report is me report via via fail
index link site link site orig? back? link site counter
%%1 %%2 %%3 %%4 %%5 %%6 %%7 %%8 %%9 %%10
1. Index into the Remote Failed Link table diagnostic display.
2. The Link ID of the link which leads to the destination RTU, i.e. the last link in the routing path.
3. The Site ID of the RTU to which the frame is to be transmitted, i.e. the frame destination site.
4. The Link ID of the failed link.
5. The Site ID of the site reporting the failed link.
6. Is the RTU the originator of the frame? (1=YES; 0=NO)
7. When the failed link is restored, should this node transmit a "restored link" frame or just delete the
entry from the table? (1=YES; 0=NO)
8. The Link ID of the link used by the failed frame to access its neighbor site (via site) when trying to
reach the destination site.
9. The Site ID of the neighbor site used by the failed frame when trying to reach the destination site.
381
10. The amount of time that has passed since the failure was discovered.
Note: The Remote Failed Links table is dynamic, so entries may move from one location to another,
without changing the table meaning and information. (See Table index in #1 above.)
USERROM (USRROM)
## 160 LEVEL = 0
Does application exist ? : %% 1
Is application running ? : %% 2
User RAM base address : %% 3
Allocated user RAM length : %% 4
Diffs. down address : %% 5
Diffs. up address : %% 6
1. Whether the application ladder is loaded in flash memory.
2. Whether the application ladder runs in flash memory.
3. The memory start address reserved for ladder application.
4. The number of bytes reserved for the ladder application.
5. The address of the beginning of differentiators down area in memory.
6. The address of the beginning of differentiators up area in memory.
## 161 LEVEL = 1
status = U_STOP => 161 1
U_NONE => 162 2
U_RUN => 163 3
1. Application exists but stopped.
2. There is no application.
3. Application exists and running.
When LEVEL = 1, DEVICE = USERROM, then the following diagnostic will be delivered, depending on
the status.
## 163 LEVEL = 1
Flow input scan rate: %% * 10msec. 1
Minimum calculation period in scans: %% (100 / %% percent accuracy) 2
Number of pph columns: %% 3
Total number of pph elements: %% 4
1. Time period in units of 10msec between two successive scans of each digital input for which PPH is
being performed.
2. Minimum time period between two PPH calculations (the time is in scan units as described above).
382
3. The number of PPH type columns.
4. The total number of PPH elements.
## 165 LEVEL = 1
Flash sets
----------
Type Operation Start End Burn_adr Source length Erased_len
Type The type of flash: (2=user application flash, 3=logging flash).
Operation The type of operation to be performed on the specified flash (0=Erase, 1=Program,
0xFFFE=Abort, 0xFFFF=no operation (default)).
Start The starting address of the flash memory.
End The ending address of the flash memory.
Burn_adr The address of the flash memory which is to be programmed.
Source The source address of the information to be written to the flash.
length The size of the information to be written to the flash.
Erased_len The size of the memory that was actually erased.
NETWORK (NETWRK)
## 180 LEVEL = 0
# of links actually connected to network layer : %% 1
Transport interface key : %% 2
Formatted buffers heap key 1 : %% 3
Formatted buffers heap key 2 : %% 3
Network stock key : %% 4
Default central link key : %% 5
Default central via link-id : %% 6
Default central thru site-id : %% 7
The unit site-id : %% 8
The default central flag : %% 9
The network transparent flag : %% 10
Response up to : %% 11
Time To Live Counter preset value : %% 12
Is Remote Fail Link detection enabled? : %% 13
Re-route returned frames? : %% 14
Current communication links : %% 15
1. The number of links registered on the network layer, when each zone is considered a separate link.
2. The Transport Multiplex layer key.
383
3. Heap keys. Identifier of heap from which to take buffers for the Network to transmit Default central
location, and also to duplicate MDLC frame, if needed.
4. The network bank key.
5. The link key through which MDLC frames should be channeled in case of Dest = default central.
6. The link ID of the Default control path in the unit.
7. The site ID where the MDLC frame is directed towards the Default Central.
8. The unit site ID.
9. This parameter determines whether this site is the Default Central.
10. Is the Network “transparent,” i.e. is there only a single path for transmission?
11. The sum of the unit Site ID and the advanced network layer parameter from the site configuration
named Addr. range response for 'All RTU simulation'.
12. The preset value for the Time To Live counter, which is inserted into each frame by the frame
originator. 0 means Time To Live Counter feature is not activated. The value must be greater than
the longest path in the network (maximum numbers of nodes in the entire longest path). All units in
the system must support this feature or frames will be discarded.
13. Flag that indicates whether the Remote Fail Links Detection mechanism is enabled or disabled.
14. When the Remote Failed Links Table feature is enabled, this parameter determines whether a returned
frame from a remote failed link is dropped or rerouted to the destination using another available link.
15. A list of links currently available to the node.
## 181 LEVEL = 10/11

# of received frames (with error) : %% 3
# of received frames (with protocol not supported) : %% 4
# of frames discarded due to Time To Live counter : %% 5
Minimum value of Time To Live counter via this node : %% 6
Source of last frame discarded due to TTL expiration : %% 7
1. The # of transmitted frames does not include retransmission and acknowledgment frames.
2. The # of received frames includes only correct frames.
3. The # of received error frames.
4. The # of received whose protocol is not supported.
5. The # of frames which were discarded because the Time to Live counter expired.
6. The value of the Time to Live (TTL) counter from frames passing through this site. The value is
updated in the RTU diagnostic only if the TTL of the current passing frame is lower than the current
diagnostic stored in RTU. (The field will contain the minimum of TTL value of frames passed
through this site since the last time the diagnostic was cleared - level 10).
384
7. The source RTU of the last frame which was discarded due to Time To Live counter expiration.
MINISESSION (WIDE , EVNT , STCL)

WIDE RTU-to-RTU communication device
EVNT Event & Burst device
STCL Broadcast reception device
## 200 LEVEL = 0
Application id : %% 1
No. of boxes in device : %% 2
No. of retries : %% 3
Interval between retries : %% 4
Time till flushing rcv frames : %% 5
Protocol flags : %% 6
Does task exist ? : %% 7
Is flushing needed ? : %% 8
Heap key : %% 9
Index of first box in free queue : %% 10
Index of first box in “wait for answ” queue : %% 11
Index of first box in “answers from outside” queue : %% 12
Index of first box in “request to applic” queue : %% 13
Index of first box in “waiting for applic answer” queue : %% 14
Index of first box in “originate from applic” queue : %% 15
Index of first box in “setcall from applic” queue : %% 16
Index of first box in “answers from applic” queue : %% 17
1. The application ID.
2. The number of frames to be managed simultaneously in the device instance.
3. The number of Tx retries.
4. Timeout in seconds between TX retries.
5. The time in seconds until the system discards the MDLC frames not solicited by the Application layer
(Ladder or “C” application)
6. Instance internal signals.
7. Whether the instance functions with task.
8. Mark if queues should be cleared.
9. Heap key used for transmission.
10. The next index of free boxes.
11. The next index of frames awaiting answer.
12. The next index of slave answer.
13. The next index of incoming frames.
385
14. The next index of incoming “originate” frames.
15. The next index of outbound “originate” frames.
16. The next index of broadcast frames to be issued.
17. The next index of answer frames to be issued.
## 201 LEVEL = 1
Boxes_nr : %% 1
Boxes in free queue : %% 2
Boxes in wait_for_outside_answr queue : %% 3
Boxes in outside_answrs queue : %% 4
Boxes in requests_from_applic queue : %% 5
Boxes in wait_for_applic_answr queue : %% 6
Boxes in originate queue : %% 7
Boxes in setcall queue : %% 8
Boxes in answer queue : %% 9
1. Total number of boxes to be handled by this instance. Each box handles one MDLC frame.
2. Current number of free boxes.
3. Current number of boxes waiting for answer.
4. Current number of boxes that are slave-answers.
5. Current number of frame boxes that arrived.
6. Number of originate boxes that arrived.
7. Number of originate boxes to be sent.
8. Number of broadcast boxes to be sent.
9. Number of answer boxes to be sent.
## 202 LEVEL = 2
“waiting for outside answer queue”
------------------------------------------
buf site port link retries ret_time indx p_indx _indx q_nr
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
1. Frame address.
2. Destination site ID.
3. Destination port ID.
4. Destination link ID.
5. Number of retries left.
386
6. Amount of time left until the next retry.
7. Box index.
8. Previous box index.
9. Next box index.
10. The internal queue ID.
## 203 LEVEL = 3
“outside answers queue”
-------------------------------
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
See #202 above.
## 204 LEVEL = 4
“requests from application queue”
-----------------------------------------
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
See #202 above.
## 205 LEVEL = 5
“waiting for application queue”
--------------------------------------
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
## 206 LEVEL = 6
“originate queue”
---------------------
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
## 207 LEVEL = 7
“setcall queue”
------------------
387
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
See #202 above.
## 208 LEVEL = 8
“answers queue”
--------------------
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
See #202 above.
## 209 LEVEL = 9
“free queue”
---------------
---------------------------------------------------------------------
%% %% %% %% %% %% %% %% %% %%
1 2 3 4 5 6 7 8 9 10
See #202 above.
## 210 LEVEL = 10/11

# of transmitted frames as originate : %%
# of transmitted frames as groupcall : %%
# of transmitted frames as answer : %%
# of transmitted frames as message : %%
# of re-transmitted frames originate : %%
# of received frames as originate : %%
# of received frames as groupcall : %%
# of received frames as answer : %%
# of received frames as message : %%
See Diagnostics in the System Setup and Diagnostics Tools manual.
GAPRATIO (GPRTIO)
## 220 LEVEL = 0
The main process CPU usage in percent : %% 1
The other system tasks usage in percent : %% 2
The main process flag (hplcin) : %% 3
The main process key : %% 4
1. The percent of the CPU reserved for the ladder application and the tasks above it ( the 10ms and the
Rxlink tasks).
388
2. The percent of the CPU reserved for the rest of the tasks under the ladder application.
3. A flag for three different states:
a. Whether the ladder application is running at the moment.
b. Whether the ladder application is not running at the moment.
c. Whether the ladder application has been running for 1.2 seconds continuously.
4. The main process key.
HDLC (RAD1P, RAD2P,...)
## 260 LEVEL = 0
HDLC hardware/software last status :-
Internal software data (key) (DATA) : %% 1
Internal hardware registers (IREG) : %% 2
Internal hardware parameters (IRAM) : %% 3
Current channel port (HDLC_PORT) : %% 4
Reception data lock (RXBD_LOCK) : %% 5
Transmission data lock (TXBD_LOCK) : %% 6
Reception data header (RXBD_HEAD) : %% 7
Reception data tail (RXBD_TAIL) : %% 8
Transmission data header (TXBD_HEAD) : %% 9
Transmission data tail (TXBD_TAIL) : %% 10
Communication signals (HDLC_SIGNAL) : %% 11
Communication buffers (HDLC_TYPE) : %% 12
Discard frame counter (DISFC) : %% 13
Crc error counter (CRCEC) : %% 14
Abort sequence counter (ABTSC) : %% 15
Non matching address counter (NMARC) : %% 16
Frame retransmit counter (RETRC) : %% 17
Current reception empty buffers : %% 18
Current reception ready buffers : %% 19
Current transmission ready buffers : %% 20
Current transmission empty buffers : %% 21
1. Device key address.

2. Address of H-W registers.
3. Address of H-W parameters.
4. The port number.
5. Semaphore of the reception function.
6. Semaphore of the transmission function.
7. Offset in RX_QUEUE (descriptors) for the entry of the new frame that has been received in port.
8. Offset in RX_QUEUE for moving the next frame to upper layers.
9. Offset in TX_QUEUE for moving a new frame to transmission, by upper layers.
10. Offset in TX_QUEUE from where this device takes the next frame for transmission.
11. MTE signal of events that took place.
12. Whether the frame is formatted/unformatted.
389
13. The number of discarded frames.

14. The number of CRC-error frames.
15. The number of abort-sequence frames.
16. The number of nonmatching address frames.
17. The number of retransmitted frames.
18. The number of empty frames ready to be received.
19. The number of frames received.
20. The number of frames transmitted.
21. The number of empty frames directed to transmission.
## 261 LEVEL = 1
HDLC hardware control and status :-
Scc configuration register (SCON) : %% 4
Scc mode register (SCM) : %% 5
Scc data sync. register (DSR) : %% 6
Scc event register (SCCE) : %% 7
Scc mask register (SCCM) : %% 8
Scc status register (SCCS) : %% 9
Temp receive crc (RCRC_L/H) : %% %% 10
Crc polynom mask (C_MASK_L/H) : %% %% 10
Temp transmit crc (TCRC_L/H) : %% %% 10
Crc error counter (CRCEC) : %% 10
Nonmatch address counter (NMARC) : %% 10
Receive frame maximum length (MFLR) : %% 10
Receive frame length counter (MAX_CNT) : %% 10
User define frame address mask (HMASK) : %% 11
User define frame addresses (HADDRX) : %% %% %% %% 12
4. Determines the clock direction (Rx or Tx) and the baud rate
5. Determines the work mode — HDLC or UART.
6. Determines the HDLC flags.
7. The events that generate the interrupt.
8. Mask to block the interrupt.
9. The CM (Channel Monitor) and TD (Tone Detect) statuses.
390
10. Not in use.
11. Mask of received addresses.
12. The addresses to which this site responds via this port.
## 262 LEVEL = 2
HDLC hardware data buffers status :-
Receive buffer descriptor 0 (RXBD0) : %% %% %% %% 4
Transmit buffer descriptor 0 (TXBD0) : %% %% %% %% 12
Rxd/Txd function code (R/TFCR) : %% 20
Maximum receive buffer length (MRBLR) : %% 21
Current receive buffer status : %% 22
Current receive buffer offset (RBD#) : %% 23
Current receive data pointer : %% 24
Current receive byte counter : %% 24
Current receive temp memory : %% 24
Current transmit buffer status : %% 25
Current transmit buffer offset (TBD#) : %% 26
Current transmit data pointer : %% 27
Current transmit byte counter : %% 27
Current transmit temp memory : %% 27
4. Address of frame in descriptor RX 0.
391
12. Address of frame for transmission in descriptor 0.
20. Rx and Tx function code.
21. Maximum received frame length.
22. The reception status of the last received frame.
23. The offset value in the descriptors of the last received frame.
24. Internal variable of 68302.
25. The status of the last transmitted frame.
26. The offset value in the descriptors of the last transmitted frame.
392
## 263 LEVEL = 3
HDLC software control and status :-
Current mode parameters (MODE_BACKUP) : %% 4
Current rate parameters (RATE_BACKUP) : %% 5
Current sync parameters (SYNC_BACKUP) : %% 6
Address mask parameters (MASK_BACKUP) : %% 7
Address data parameters (ADRS_BACKUP) : %% %% %% %% 8
Current channel name (CHAN_BACKUP) : %% 9
Current channel data (CHAN_DATA) : %% 10
Current channel code (CHAN_CODE) : %% 11
Current heap name (HEAP_BACKUP) : %% 12
Current heap name (HEAP_DATA) : %% 13
Current heap data (HEAP_CODE) : %% 14
Current channel port (HDLC_PORT) : %% 15
Reception next free (RXBD_FREE) : %% 18
Transmission next free (TXBD_FREE) : %% 19
Communication signals (HDLC_SIGNAL) : %% 22
Communication buffer (HDLC_TYPE) : %% 23
Communication HDLC lock (HDLC_LOCK) : %% 24
Communication time lock (TIME_LOCK) : %% 25
Communication time data (TIME_DATA) : %% 26
Communication status (NOISY) : %% 27
(QUIET) : %% 28
Communication preset/timers (GRANT) : %% %% 29
(QUIET) : %% %% 30
2. H-W registers address.
3. H-W parameters address.
4. Working mode of the channel (synchronous, asynchronous, DTE, DCE).
5. Communication baud rate.
6. Not relevant.
7. Not relevant.
8. The addresses to which this site will respond through this port.
9. The channel access name.
10. The channel access device key.
11. Channel access pin table.
12. The heap name (HP_F_RX).
13. The heap device key.
393
14. The heap pin table.
15. The Port number.
18. Offset in Rx descriptors to the next free descriptor.
19. Offset in Tx descriptors to the next free descriptor.
20. Offset for Rx descriptors for receiving frame.
21. Offset for Tx descriptors for transmitting frame.
22. MTE signal of conditions that were met.
23. Whether the frame is formatted or unformatted.
24. Device semaphore.
25. Not in use.
26. Coded time stamp of last received frame (in ticks).
27. Current counter of noise.
28. Current counter of quiet.
29. GRANT-TIME for channel access: The time the site will wait to obtain a transmission channel until it
decides that a channel is not available.
30. QUIET-TIME after transmission: The time to wait before a retry.
## 264 LEVEL = 4
394
## 270 LEVEL = 10/11

CRC error counter (CRCEC) : %% 2
Non matching address counter (NMARK) : %% 4
## 271
CRC error counter (CRCEC) : %% 2
Non matching address counter (NMARK) : %% 4
395
UART
## 280
UART hardware/software last status :-
Current channel port (UART_PORT) : %% 4
Communication signals (UART_SIGNAL): %% 11
Communication buffers (UART_TYPE) : %% %% 12
Idle characters counter (IDLC) : %% 13
Parity error counter (PAREC) : %% 14
Framing error counter (FRMEC) : %% 15
Noise error counter (NOSEC) : %% 16
Break error counter (BRKEC) : %% 17
Current reception empty buffer : %% 18
4. The Port number.
13. The actual counter that counts the number of idles since the last character was received. For example,
the time that a character takes to arrive (corresponds to idle) at 9600 baud is 1 msec.
14. The number of times the parity error occurred during the reception of a single byte.
15. The number of times the framing error occurred during the reception of a single byte.
396
16. The number of times the noise error occurred during the reception of a single byte.
17. The number of times a break signal (end of reception) was received at the port.
## 281
UART hardware control and status :-
Idle characters maximum (MAX_IDL) : %% 10
Break characters register (BRKCR) : %% 12
User defined UART addresses (UADDRX) : %% %% 17
Control character register (RCCR) : %% 18
Control character table (CHARACTERX) : %% %% %% %% 19
: %% %% %% %%
10. How many idles to wait before declaring that the transmission has ended.
397
12. Break register.
17. Not in use.
18. Control character register.
19. The characters that are used to close a frame.
## 282
UART hardware data buffers status :-
Rxd/Txd function code (R/TFCR): %% 20
Current receive data pointer : %% %% 24
Current transmit data pointer : %% %% 27
398
399
## 283
UART software control and status :-
Current mode parameters (MODE_BACKUP): %% 4
Current rate parameters (RATE_BACKUP): %% 5
Current sync parameters (SYNC_BACKUP): %% 6
Address mask parameters (MASK_BACKUP): %% 7
Address data parameters (ADRS_BACKUP): %% %% %% %% 8
Current channel name (CHAN_BACKUP): %% 9
Current channel data (CHAN_DATA) : %% 10
Current channel code (CHAN_CODE) : %% 11
Current heap name (HEAP_BACKUP): %% 12
Current heap name (HEAP_DATA) : %% 13
Current heap data (HEAP_CODE) : %% 14
Communication buffer (UART_TYPE) : %% 23
Communication HDLC lock (UART_LOCK) : %% 24
(QUIET) : %% 28
(QUIET) : %% %% 30
6. Not relevant.
7. Not relevant.
9. The channel access name.
10. The channel access device key.
11. Channel access pin table.
12. The heap name (HP_F_RX).
400
14. The heap pin table.
25. Not in use.
401
## 285
Communication buffers (UART_TYPE) : %% %% 12
4. The Port number.
402
## 286
UART hardware control and status :-
Reserved register (RES2) : %% 8
Reserved register (RES3) : %% 10
Idle characters maximum (MAX_IDL) : %% 12
Break characters register (BRKCR) : %% 14
User defined UART addresses (UADDRX) : %% %% 19
Control character register (RCCR) : %% 20
Control character table (CHARACTERX) : %% %% %% %% 21
: %% %% %% %%
8. Reserved.
10. Reserved.
12. How many idles to wait before declaring that the transmission has ended.
403
14. Break register.
19. Not in use.
20. Control character register
21. The characters that are used to close a frame.
## 287
UART hardware data buffers status :-
404
405
## 288
UART software control and status :-
Current heap name (HEAP_KEY) : %% 9
Current channel port (DART_PORT) : %% 10
Communication buffer (DART_TYPE) : %% %% 18
Communication UART lock (DART_LOCK) : %% 19
(QUIET) : %% 23
(QUIET) : %% %% 25
Incoming Call flag : %% 26
Second counter : %% 27
6. Not relevant.
7. Not relevant.
406
19. Internal variable that represents the device status.
20. Not in use.
26. Internal device variable.
27. Internal device variable.
## 290
## 291
407
RADIO CHANNEL (RAD1C , RAD2C,…)
## 300 LEVEL = 0
Radio hardware/software last status :-
Current channel port (CHAN_PORT) : %% 4
Channel status mode (CHAN_MODE) : %% 5
Channel driver lock (CHAN_LOCK) : %% 6
Channel signals (CHAN_SIGNAL): %% 7
Channel access type (CHAN_ACCESS): %%
Channel driver type (CHAN_TYPE) : %% 8
Channel control register (PBCNT) : %% 9
Channel direction register (PBDDR) : %% 10
Channel data register (PBDAT) : %% 11
Current reception ready buffer : %% 13
1. Device-key address.
4. Port number.
5. Configuration mode.
6. Channel access semaphore.
7. MTE signal on events that took place.
8. Whether FSK, DPSK or FSK.
9. Defines the functionality of port B in 68xxx (68000 family).
10. Determines whether the pin is for input or output.
11. Defines the value of the pin (previous parameter).
12. Number of empty Rx descriptors.
13. Number of busy Rx descriptors.
14. Number of busy Tx descriptors.
15. Number of empty Tx descriptors.
408
## 301
Radio hardware control and status :-
Channel direction register (PRDDR) : %% 11
10. Defines the functionality of port B in 68.
## 302 LEVEL = 2
Radio hardware data buffers status :-
409

410
## 303 LEVEL = 3
Radio software control and status :-
Channel status mode (CHAN_MODE) : %% %% 8
Channel signals (CHAN_SIGNAL) : %% 10
Channel access type (CHAN_ACCESS) : %%
Channel addresses (CHAN/NEXT/MASK) : %% %% %% 12
Channel status (NOISY) : %% 13
(QUIET) : %%
Channel preset/timers (OVERRIDE) : %% %% 14
(RESOLUTE/QUIET) : %% %%
(SHUTUP) : %% %%
(GRANT) : %% %%
(WARMUP) : %% %%
(TRANSMIT) : %% %%
(HOLDUP) : %% %%
(RESPOND) : %% %%
6. Not relevant.
7. Port number.
411
12. The address to which this site will respond through this port.
13. Actual channel access timers.
14. Preset timers for fields defined in the advanced parameters of Port 3.
TRUNK CHANNEL
## 320
Trunk radio hardware/software last status :-
4. Port number.
412
## 321
Trunk radio hardware control and status :-
Channel control register (PBCNT): %% 10
Channel direction register (PRDDR): %% 11
Channel data register (PBDAT): %% 12
## 322
Trunk radio hardware data buffers status :-
413

414
## 323
Trunk radio software control and status :-
Channel acks (ACK_SLOT) : %% 13
Channel random (RANDOM_REGISTER) : %% 14
(QUIET) : %% 15
(LATCH) : %% 15
(GRANT) : %% 15
(ACTIVE) : %% 15
(NOACTIVE) : %% 15
(RESOLUTE/QUIET) : %% %% 16
(SHUTUP) : %% %% 16
(GRANT) : %% %% 16
(WARMUP) : %% %% 16
(TRANSMIT) : %% %% 16
(HOLDUP) : %% %% 16
(RESPOND) : %% %% 16
(RELEASE) : %% %% 16
(RECEIVE/CHECK) : %% %% 16
(REQUEST) : %% %% 16
(SHORT_WARMUP) : %% 16
(SMART_MIN) : %% 16
(SMART_LONG) : %% 16
(SMART_WARM) : %% 16
(OFF_SLOT) : %% 16
415
6. Not relevant.
7. Port number.
13. The ACK transmission slot.
14. Random value to obtain a channel during a retry.
RS232 CHANNEL
## 340
Rs232 hardware/software last status :-
4. Port number.
416
## 341
Rs232 hardware control and status :-
417
## 342
Rs232 hardware data buffers status :-
418
## 343
Rs232 software control and status :-
(QUIET) : %% 13
(SHUTUP) : %% %% 14
(GRANT) : %% %% 14
(WARMUP) : %% %% 14
(TRANSMIT) : %% %% 14
(HOLDUP) : %% %% 14
(RESPOND) : %% %% 14
419
6. Not relevant.
7. Port number.
MODEM CHANNEL
## 360
Modem hardware/software last status :-
4. Port number.
420
## 361
Modem hardware control and status :-
Channel control register (PBCNT): %% 10
Channel direction register (PRDDR): %% 11
Channel data register (PBDAT): %% 12
4. Determines the clock direction (Rx or Tx) and the baud rate.
421
## 362
Modem hardware data buffers status :-
422
423
## 363
Modem software control and status :-
Current mode parameters (MODE_BACKUP) : %% %% %% %% %% %% %% %% 4
: %% %% %% %% %% %% %% %%
(QUIET) : %% 13
(SHUTUP) : %% %% 14
(GRANT) : %% %% 14
(WARMUP) : %% %% 14
(TRANSMIT) : %% %% 14
(HOLDUP) : %% %% 14
(RESPOND) : %% %% 14
6. Not relevant.
7. Port number.
424
TIMERS (10__MS , 100_MS , 1__SEC , 1__MIN)
## 380 LEVEL = 0
# of entries in the service table (actual) : %% 1
Maximum # of entries in the service table : %% 2
# of time units passed from last task running : %% 3
The limit # of time units passed without activating task : %% 4
1. The number of timer services (in the specific Instance) currently in use.
2. The maximum number of timer services that can be used.
3. The number of time units (depending on the timer resolution) that have elapsed since the last
execution.
4. The maximum number of time units that will elapse without activating the instance, until an error
message reports instance timer delay.
TIME-TAG (T_TAG)
## 400 LEVEL = 0
time_tag
The start pointer in queue : %% 1
The writer pointer in queue : %% 2
The read pointer in queue : %% 3
The end pointer in queue : %% 4
# of free bytes in queue : %% 5
The last event in queue is an i/o event : %% 6
There is at least 1 i/o event in queue : %% 7
Queue was full at least one time : %% 8
Queue is locked : %% 9
1. Pointer to the time-tag queue.
2. Pointer to the next write.
3. Pointer to the next read.
4. Pointer to the end of the queue.
5. Number of free bytes in the queue.
6. Whether the last element in the queue is COS (Change of State) of I/O.
7. Whether there is COS (Change of State) of any I/O.
8. Whether the queue was ever full.
9. Lock for down load purposes.
425
CO-PROCESSOR (MC68882)
## 420 LEVEL = 0
The mc6888 coprocessor is connected and is OK
All floating point and double precision calculations are
performed by the mc68882 coprocessor.
Note: #420-423 describe different states of the CO-PROCESSOR.
## 421 LEVEL = 0
The mc68882 coprocessor is connected and is OK , but is not active.
All floating point and double precision calculations are emulated
by software, as requested by software.
## 422 LEVEL = 0
The mc68882 coprocessor is connected, but is faulty.
emulated by software.
## 423 LEVEL = 0
The mc68882 coprocessor is not connected !!!
emulated by software.
DI
I/O MODULES (R0M1 , R0M2 ,...)
## 500 LEVEL = 1
Di : priority=%% , eirq=%% , test=%% , di_pol=%% , cntr=%% , sr=%%
1 2 3 4 5 6
1. Interrupt priority level : 1 - 254 (0 - no interrupts)
2. EIRQ line : 0 - disabled, 1, 2 or 3
3. DI loop test on : YES/NO
4. Reverse polarity : YES/NO
5. Counter rate : 0 = 30 KHZ , 1 = 3.75 KHZ
6. Serial rate : Approximate values
0 38 msec
426
1 19
2 9.5
3 4.75
4 2.4
5 1.2
6 0.6
8DO
## 501 LEVEL = 1
Do : init=%% 1 , one submodule: sub_module=%%: 2
mode2.refresh=%% 3 , sub_priority=%% 4 , sub_test=%% 5
mode0 : irq_en=%% 6 , no_clk1=%% 7 , sr=%% 8
mode1 : no_clk=%% 9 , wdt_sel=%% 10 , bi_int=%% 11 , ext_int=%% 12
ref_sel=%% 13 , ocs=%% 14
1. Init state : 1 = CREATE , 2 = POWER UP , 3 = DONE
2. Submodule 0 or 1
3. Refresh trigger
4. Interrupt priority level : 1-254 (0 - no interrupts)
6. IRQ Enable : YES/NO
7. “NO CLOCK” WDT Enable : YES/NO
8. Sr - Serial rate : Approximate values
0 38 msec
1 19
2 9.5
3 4.75
4 2.4
5 1.2
6 0.6
10. WDT SELECT : 0 - 4 secs , 1 - 1 sec
11. Relay Readback : 0 - Actual , 1 - Desired
12. Led display of RO: 0 - Actual , 1 - Desired
13. Refresh start : 0 - no refresh of DO , 1 - 1.1 sec refresh, 2 - 4.5 sec refresh, 3 - 18 sec refresh
14. Pulse width for ML Relays : 0 - no clock , 1 - 8 msec, 2 - 16 msec, 3 - 32 msec
427
## 502
Do : init=%% 1 , two submodules: sub_module=%%: 2
mode2.refresh=%% 3 , sub_priority=%% 4 , sub_test=%% 5
mode0 : irq_en=%% 6 , no_clk1=%% 7 , sr=%% 8
mode1 : no_clk=%% 9 , wdt_sel=%% 10 , bi_int=%% 11 , ext_int=%% 12
ref_sel=%% 13 , ocs=%% 14
sub_module=%%:
mode2.refresh=%% , sub_priority=%% , sub_test=%%
mode0 : irq_en=%% , no_clk1=%% , sr=%%
mode1 : no_clk=%% , wdt_sel=%% , bi_int=%% , ext_int=%%
ref_sel=%% , ocs=%%
1. Init state : 1 = CREATE , 2 = POWER UP , 3 = DONE
2. Submodule 0 or 1
3. Refresh trigger
6. IRQ Enable : YES/NO
8. Sr - Serial rate : Approximate values
0 38 msec
1 19
2 9.5
3 4.75
4 2.4
5 1.2
6 0.6
10. WDT SELECT : 0 - 4 secs , 1 - 1 sec
11. Relay Readback : 0 - Actual , 1 - Desired
12. Led display of RO: 0 - Actual , 1 - Desired
13. Refresh start : 0 - no refresh of DO , 1 - 1.1 sec refresh, 2 - 4.5 sec refresh, 3 - 18 sec refresh
14. Pulse width for ML Relays : 0 - no clock , 1 - 8 msec, 2 - 16 msec, 3 - 32 msec
## 503 LEVEL = 1
Ai : priority=%% 1 , irq_ctrl=%% 2 , eom_fifo=%% 3 , tx_fifo=%% 4
filter_rank=%% 5
428
2. IRQ line : 0 - disabled, 1m, 2, or 3
3. End of message FIFO : Y/N
4. Num bytes in TX FIFO : 0 - 8
5. Filter Rank : 1 , 2 , 4 or 8
## 504 LEVEL = 1
Ao : ao_swap=%% 1 , ao_rate=%% 2 , ao_ref_sel 3 , ao_refresh=%% 4
irq_priority=%% 5 , eirq=%% 6 , ai_irq_en=%% 7 ,
di_irq_en=%% 8
spi_control=%% 9 , spi_cs_control=%% 10
smc_byte=%% 11 , wamst=%% 12
1. Swap order of AO bits : Y/N
2. AO transfer time : 0 - 3/4 msec , 1 - 3 msec
3. AO refresh select : 0 (no refresh) , 1 - 1/4 sec , 2 - 1 sec , 3 - 4 sec
4. AO refresh enable : 1 bit per channel : Y/N
6. IRQ Line : 0 - disabled , 1, 2, or 3
7. AI IRQ Enable : Y/N
8. DI IRQ Enable : Y/N
9. SPI Control byte
10. SPI CS force : Y/N
11. SMC byte
12. WAMST byte
MIX
## 505 LEVEL = 1
Mixed i/o : ro_wdt=%% 1 , ro_ck=%% 2 , ro_ref=%% 3
di_fc_en=%% 4 , di_cos_en=%% 5 , di_sr=%% 6
di_enc=%% 7 , ai_rate=%% 8 , ai_make_delay=%% 9 ,
ai_start_delay=%% 10
ai_filter_rank=%% 11
irq_priority=%% 12, eirq=%% 13, ai_irq_en 14 ,
di_irq_en=%% 15 spi_control=%% 16 , spi_cs_control=%% 17
smc_byte=%% 18 , wamst=%% 19
1. RO WDT select : 0 - 4 secs , 1 - 16 secs
429
2. RO pulse width (ML) : 0 - 8 msec , 1 - 17 msec , 2 - 35 msec, 3 - 128 msec
3. RO refresh rate : 0 -1 sec , 1 - 4 sec, 2 - 9 sec, 3 - 18 sec
4. DI Fast Capture En : 1 bit for each input : Y/N
5. DI Cos Enable En : 1 bit for each input : Y/N
6. DI Serial rate : Approximate values
0 38 msec
1 19
2 9.5
3 4.75
4 2.4
5 1.2
6 0.6
7. AI channel select is encoded : Y/N
8. AI rate : 0 - 8 micro on , 24 off ; 1 - 17 micro on , 48 off
9. AI make delay : 0 - 70 micro , 1 - 140 micro, 2 - 280 micro, 3 - 560 micro
10. AI start delay : 0 - 140 micro , 1 - 280 , 2 - 0.5 msec , 3 - 1 msec
11. AI filter rank : 1 , 2 , 4 , 8
13. IRQ Line : 0 - disabled , 1, 2, or 3
14. AI IRQ Enable : Y/N
16. SPI Control byte
17. SPI CS force : Y/N
18. SMC byte
19. WAMST byte
## 506 (MIX , LEVEL = 2)

Mixed i/o : ai error count=%%
Count of AI fail or loss of synchronization (Information only: the problem is corrected by software).
430
DSP (AC ANALYZER)
## 507 LEVEL = 1
Dsp : di_pol=%% 1 , cb_pol=%% 2 , di_fc_en=%% 3 , di_cos_en=%% 4
ga_eirq=%% 5 , ga_eirq_with_irq=%% 6 , ga_eirq_without_irq=%% 7
sr=%% 8 , sr_with_irq=%% 9 , sr_without_irq=%% 10
ga_prior=%% 11 , di_irq_en=%% 12
dsp_prior=%% 13 , dsp_eirq=%% 14 , dsp_irq_en=%% 15
ro_ref_rate=%% 16 , ro_duration=%% 17 , ro_type=%% 18
div_en=%% 19 , div_ratio=%% 20
dsp_mode=%% 21 , host_mode=%% 22
dsp_wd_rate=%% 23 , dsp_wd_irq_en=%% 24 , dsp_wd_en=%% 25
1. DI polarity reversed : Y/N
2. Checkback polarity reversed : Y/N
3. DI Fast Capture Enable : 1 bit for each input : Y/N
4. DI Cos Enable : 1 bit for each input: Y/N
5. GA IRQ Line : 0 - disabled, 1, 2, or 3
6. Default GA IRQ Line when using IRQ
7. Default GA IRQ Line when not using IRQ
8. DI Serial rate : Approximate values
0 38 msec
1 19
2 9.5
3 4.75
4 2.4
5 1.2
6 0.6
9. DI serial rate when using interrupts
10. DI serial rate when not using interrupts
11. GA Interrupt priority : 0 - disabled , 1 - 254
13. DSP Interrupt priority : 0 - disable , 1 - 254
14. DSP IRQ Line : 0 - disabled, 1, 2, or 3
15. DSP IRQ Enable : Y/N
16. RO refresh rate : 0 - 1 sec , 1-4 sec , 2-9 sec, 3-18 sec
17. RO pulse duration (ML) : 0 - 17 msec , 1-35 msec, 2-128 msec, 3-500 msec
431
18. RO Type : 1 bit for each RO - 0 - EE , 1 - ML
19. Enable Divider :Y/N
20. Divider ratio “n” : divide by 2 (n + 1)
21. DSP DMA mode : 0 - Host Read IRQ , 1 - Host Write IRQ , 2 - Read - Write IRQ , 3 - Read 8 bit
DMA , 4 - Read 16 bit DMA , 5 - Write 8 bit DMA , 6 - Write 16 bit DMA
22. GA Mode : 0 - IRQ , 1 - DMA
23. DSP WDT rate : 0-64 msec, 1-250 msec, 2-1 sec , 3-4 secs
24. DSP WDT IRQ Enable : Y/N
25. DSP WDT Enable : Y/N
## 508 (SC , LEVEL = 1)

Single cable : rx_task_priority=%% 1 , tx_task_priority=%% 2 ,
eirq=%% 3 , cosirq_en=%% 4 , rxirq_en=%% 5 ,
txirq_en=%% 6 , after_reset=%% 7 ,
slave_handshake=%% 7 , activity_state=%% 7
sensitive_40v=%% 7 , line1_rtu_fail=%% 8 ,
line2_rtu_fail=%% 9
sgc_software_ver_num=%% 10 , init=%% 11
1. Task priority of Rx task.
2. Task priority of Tx task.
3. EIRQ line : 0 - disabled, 1, 2 or 3
4. COS IRQ Enabled: Y/N
5. RX IRQ Enabled: Y/N
6. TX IRQ Enabled: Y/N
7. Inn er flags in the module to be called through the application.
8. RTU warning - failure on line 1.
9. RTU warning - failure on line 2.
10. Inner program version of module.
11. Whether the module state is init or regular.
## 510
Dsp: Loadable Code - address=%% 1, length=%% 2
P MEM: Code - address=%% 3, length=%% 4
X MEM: Data - address=%% 5, length=%% 6
1. Address of DSP Loadable Code.
432
2. Length of DSP Loadable Code.
3. Address of DSP P Mem Code.
4. Length of DSP P Mem Code.
5. Address of DSP X Mem Data..
6. Length of DSP X Mem Data.
## 511
Dsp: AO Image: Number of AO locations in use=%% 1
Location Value
1. Number of AO locations in use.
Table of AO locations and their values.
## 513
Dsp: Num error calls to dsp_init()=%% 1
1. Number of error calls to the dsp_init function.
## 518
Auto IO Recognition: %% 1
1. Automatic I/O Configuration bit in Site Configuration is Enabled/Disabled.
## 519
Number of IO Modules: %% 1
List of All IO Module Types: 2
1. Number of modules found in unit.
2. List of all I/O Module Types defined in unit.
433
RS485
## 520
4. Port number.
434
## 521
4. Determines the clock direction (Rx or Tx) and the baud rate.
435
## 522
Rs485 hardware data buffers status :-
436
## 523
(QUIET) : %% 13
(SHUTUP) : %% %% 14
(GRANT) : %% %% 14
(WARMUP) : %% %% 14
(TRANSMIT) : %% %% 14
(HOLDUP) : %% %% 14
(RESPOND) : %% %% 14
437
6. Not relevant.
7. Port number.
FLASH MEMORY (FLASHDB, FLSEXT1)
## 600 LEVEL = 0
Pointer to entries : %% 1
Number of entries : %% 2
Flash start address : %% 3
Flash end address : %% 4
Flash length : %% 5
Flash number of burns: %% 6
1. Pointer to block IDs address list.
2. Maximum number of different types of block ID.
3. The starting address of the flash memory.
4. The end of the flash memory.
5. The size of the flash memory in bytes.
6. The number of times the flash memory has been burned.
438
LEVEL = 2
Disabled blocks for type- %%1
Block- 0 : %%2
Block- 1 : %%2
1. The block type (block id). For the FLASHDB device (application flash), there can be up to 50 blocks
. For FLSEXT1 (logging flash), the user can define up to five blocks (0-4).
2. The status of the blocks in the application or logging flash can be one of: 0 (block enabled) or 1
(block disabled).
## 601 LEVEL = 1, 20 , 21 , ... , 39

Pointer to version : %% 1
Pointer to data : %% 2
Length of data : %% 3
File Name : %% 4
Block Description : %% 5
1. Pointer to block’s header.
2. Pointer to block’s data.
3. Length of block’s data.
4. Name of file in block (downloaded blocks only)
5. Description of block (download blocks only)
• Supported only by versions < 3.70. Previous versions support 20 types of blocks.
In order to receive diagnostics on block number 0 , use LEVEL = 20.
In order to receive diagnostics on block number 5 , use LEVEL = 25.
• From versions ≥ V3.70 on, at LEVEL = 1 the system displays a table that includes all of this data for
all block IDs.
439
## 620
Low byte : %%
Message : %%
‘send message’ : %%
‘comm established’ flag : %%
‘message exist’ flag : %%
Warmup not done : %%
Dial number : %%
Physical key : %%
Mini - session key : %%
Unformatted heap key : %%
LDIALER (DIL2D , DIL 3D)
## 640 LEVEL = 0
Physical pin’s table : %% 2
Async dial physical device key : %% 3
Async dial physical pin’s table : %% 4
Interval between phone call retries (sec) : %% 5
# of phone call retries : %% 6
# of times to call the physical_receive
before hanging up (indicator) : %% 7
# of times to call the physical_receive
before hanging up (responser) : %% 8
‘wait for call’ interval in (milli - sec) : %% 9
1. Adapter layer device key.

2. Adapter pin table.
3. Dial (DART) device key.
4. Dial (DART) PIN table.
5. Interval between two dialing attempts.
6. Number of phone call retries.
7. Quiet time, in seconds, before hanging up on the initiating site.
8. Quiet time, in seconds, before hanging up on the responding site.
9. Inner program waiting time for a new incoming call.
## 641 LEVEL = 1
Ldialer current state : : %% 1
Current hang up counter : %% 2
Last / current dialed phone number : %% 3
Previous dialed phone number : %% 4
Last / current partner site id : %% 5
Is initiator : %% 6
1. Ldialer state: 0 - wait for new call, 1- communication established
440
2. Time counter until disconnection.
3. Last or current dialed number.
4. Previous number dialed.
5. Last site ID connected.
6. Whether initiator or responder.
(ML_DL)
## 645 LEVEL = 0
# of dial links (preset) : %% 1
Network key : %% 2
Pointer to links table : %% 3
1. Number of dialing channels.
2. Network layer device key.
3. Pointer to Dial-type channels table
441
## 646 LEVEL = 1
# of dial links (current) : %% 1
Last failed link used : %% 2
Port status partner link_key ldialer_key
------------------------------------------------------
3 4 5 6 7
1. Number of dialing channels.
2. The last failed channel used.
3. The dialing line.
4. The call status.
5. The initiator site ID.
6. The Link layer device key.
7. The Ldialer layer device key.
TOPLC (PLC1L, PLC2L, PLC3L)
## 660 LEVEL = 0
Port name : %% 1
Connection to : %% 2
Appl. code area : %% 3
Appl. code length : %% 4
Appl RAM area : %% 5
Appl. RAM len : %% 6
Number of retries : %% 7
Number of polls : %% 8
No response timeout : %% 9
# of idles timeout : %% 10
# of diag errors : %% 11
Load module vers : %% 12
Load module rev : %% 13
Load module name : %% 14
Load module diag : %% 15
Diagnostics for third party protocol port defined as connected ‘TO PLC’.
1. PLC1 / PLC2 / PLC3

2. PLC (slave)
3. Address where the FLS file was downloaded.
4. Length of the code that was downloaded.
5. Start of RAM - used for the PLC PORT software.
6. Length of RAM - used for the PLC PORT software.
7. Maximum number of retries.
8. Maximum number of pollings.
442
9. Maximum amount of time to announce no response.

10. Number of idles to announce end of RX.
11. Number of errors.
12. Downloadable module version.
13. Downloadable module revision.
14. Name of the downloadable module.
15. Diagnostic string given by the downloadable module.
## 661 LEVEL = 1
Parm 1 : %%
Parm 2 : %%
Parm 3 : %%
Parm 4 : %%
Parm 5 : %%
Parm 6 : %%
Parm 7 : %%
Parm 8 : %%
Parm 9 : %%
Parm 10 : %%
• Diagnostics for driver specific parameters for port connected ‘TO PLC’
• These parameters are actually the driver specific parameters (‘TO PLC’ port). The parameters can be
defined in the PLC expert parameter screen. Currently these parameters are not in use.
TOSCADA (PLC1L, PLC2L, PLC3L)
## 670 LEVEL = 0
Port name : %% 1
Connection to : %% 2
Appl. code area : %% 3
Appl. code len : %% 4
Appl RAM area : %% 5
Appl. RAM len : %% 6
# of diag errors : %% 7
Local plc reply timeout : %% 8
Remote reply timeout : %% 9
Mode of translation : %% 10
No response timeout : %% 11
#of idles timeout : %% 12
Load module vers : %% 12
Load module rev : %% 13
Load module name : %% 14
Load module diag : %% 15
1. PLC1 / PLC2 / PLC3
2. Master computer.
3. Address of downloaded FLS file.
443
4. Length of downloaded FLS file.
5. Start of RAM - used for the PLC PORT software.
6. Length of RAM for the PLC PORT software.
7. Number of errors.
8. Reply timeout in seconds from PLC (locally connected).
9. Reply timeout in seconds from PLC (remotely connected).
10. Modbus Reg # to (z , y , x) mode of translation.
11. Maximum time to announce no response.
12. Maximum number of idles to announce end of Rx.
13. The downloadable module version.
14. The downloadable module revision.
15. The downloadable module name.
16. The downloadable module diagnostic string.
## 671 LEVEL = 1
Parm 1 : %%
Parm 2 : %%
Parm 3 : %%
Parm 4 : %%
Parm 5 : %%
Parm 6 : %%
Parm 7 : %%
Parm 8 : %%
Parm 9 : %%
Parm 10 : %%
• Diagnostics for driver specific parameters for port connected ‘TO MASTER’
• These parameters are actually the driver specific parameters (‘TO MASTER’ port). The parameters
can be defined in the PLC expert parameter screen. Currently these parameters are not in use.
SWITCHER
## 680 LEVEL = 0
Maximum number of plc ports : %% 1
Actual number of plc ports : %% 2
• Third party protocol switcher (network) diagnostics.
1. Maximum number of third party protocol ports allowed.
444
2. Number of defined third party protocol ports.
## 681 LEVEL = 1
Plc port connected to link device name
1 2 3
• The third party protocol port list.
1. Port 1 / 2 / 3 for PLC1 / PLC2 / PLC3
2. SLAVE / MASTER
3. Physical layer device name
## 682 LEVEL = 2
Number of switcher_push_reply calls : %% 1
Number of switcher_push_control calls : %% 1
Number of switcher_push_frame calls : %% 1
Number of switcher_send_control calls : %% 1
Number of userrom_push_reply calls : %% 1
Number of userrom_push_control calls : %% 1
Number of tmuxsend_frame calls : %% 1
Number of plcs_s2m_send_reply calls : %% 1
Number of plcs_m2s_send_control calls : %% 1
Number of errors : %% 2
1. Internal counters that count the number of times activated.
2. Number of times an error has occurred.
FRAME - SEQ
## 700
application identity : %% 1
maximum buffers in ready queue : %% 2
Number of buffers in list : %% 3
Time (in sec) to flush rx frames : %% 4
# rx frames thrown under flush : %% 5
1. Application ID number.
2. Maximum number of frames allowed to be accumulated
3. Number of frames currently waiting in the queue.
4. The amount of time required to flush received frames.
5. The number of frames which were flushed from the received queue.
445
BURST - SEQ
## 710
application identity : %% 1
maximum buffers in ready queue : %% 2
Number of buffers in list : %% 3
1. Application ID number.
2. Maximum number of frames allowed to be accumulated.
3. Number of frames currently waiting in the queue.
ROUTER (X25_RTR)
## 720 LEVEL = 0
Router mode : %% 1
Num slave : %% 2
X25 address : %% 3
‘self’ digits : %% 4
‘route’ digits : %% 5
‘ignore’ digits : %% 6
Is bad address : %% 7
No. of tables : %% 8
No of lcn in slave : %% 9
Slave diagnostics : %% 10
1. 1 - Master , 2 - Slave , 3 - User
2. Master - Number of slaves , Slave - 2 , User - 0
3. X.25 address - 14 digits and characters that contain: ‘self’, ‘rout’, ‘ignore’ digits
4. Master only. Distinguish between its slave address and public address.
5. Master only. If slave address, points to the right slave.
6. Used only by slave.
7. Bad X.25 address was specified. (e.g. no ‘self’ part)
8. The number of logical channels tables, usually three. (Four if two X.25 ports)
9. The number of logical channels for each slave.
10. Master or slave. Pointer to diagnostics data in RAM for each slave.
## 722 LEVEL = 1
Num_entry ptr_entry search port_id x25_key
For each table the following fields exists:

446
• NUM_ENTRY : Number of logical channels in table.
• PTR_ENTRY : Pointer to first entry in table.
• SEARCH : 0 - Search free logical channel from start to end.

1 - Search free logical channel from end to start.
• PORT_ID : Relevant to slave. When opening a session, it is represented in the slave

address, in the ‘p’ location.
• X.25 KEY : X.25 Device key over LAPB or X.25 over MDLC.
## 724 LEVEL = 30(X.25 OVER MDLC) 31(USER)

32(MASTER OVER LAPB) 33(SLAVE OVER LAPB)
Status entry table
For every entry of a table the following fields:
• STATUS : 0 - free
1 - occupy
2 - wait for call confirm
3 - wait for clear confirm
• TABLE : Peer table pointer.
## 725 LEVEL = 10/11

ind svc_open peak empty Rx_data tx_data
For each slave the following information:
• SVC_OPEN: Number of current open sessions.
• PEAK: Maximum number of simultaneous opened sessions.
• EMPTY: Number of times sessions could not be opened because there were no
free channels.
• RX_DATA: Number of received data packets from the slave.
• TX_DATA: Number of transmitted data packets to the slave.
X25 (X25 MDLC , X251X)
## 900 LEVEL = 0
id flags state busy
For each X25 interface the following information:
• FLAGS: Two bytes of flags for each interface.
447
• STATE: State of interface is STATE = 5, interface is ready.
• BUSY: Number of times ERR_BUSY returned from Tx operation.
## 901 LEVEL = 1
id gn cn state ps pr pa w q_len cong.+ cong.- Tx Rx
For each logical channel the following information:
• GN: Logical channel group number.
• CN: Logical channel number.
• STATE: State of logical channel. If STATE = 6 the channel is in flow control

mode , i.e. - data can be TX / RX.
• PS: Index of next packet to transmit.
• PR: Expected receive packet.
• PA: Expected acknowledge index.
• W: Size of transmit window.
• Q_LEN: Number of frames in TX queue.
• CONG.+: Limit of congestion of packets in TX queue. When limit is reached,

send RNR to peer.
• CONG.-: When number of packets in TX queue falls below this number, send
RR to peer.
• TX: Number of packets transmitted in the logical channel.
• RX: Number of packets received in the logical channel.
## 902 LEVEL = 2
id flg init pvc d_bit upcnf t11 t12 t13 rnr pack clreq intr acc_m
• ID: Two bytes of flags for each logical channel.
• FLG: Hexadecimal value of all flags.
• INIT: 0 - Log channel was not initiated. 1 - Log channel was initiated.
• PVC: 0 - SVC channel. 1 - PVC channel.
• D_BIT: 0 - D_BIT is not supported. 1 - Supported.
• UPCNF: Upper confirm. If MOSCAD is router, as in service provider, it is 1. If it is DTE

(Service User), the value is 0.
• T11: 1 - T11 timer (for call request) is running.

448
• T12: 1 - T12 timer (for reset request) is running.
• T13: 1 - T13 timer (for clear request) is running.
• RNR: 1 - Channel is in RNR state.
• PACK: 1 - Logical channel has pending acknowledgment.
• CLREQ: 1 - User issued clear request.
• INTR: 1 - Interrupt sent issued to L4 layer.
• ACC_M: 1 - Support Mbit (Buffer Accumulation) (Service Provider - 0 , User - 1)
## 903 LEVEL = 3
id flg_2 t09 ackrt cong. busy busycos i_ack
• ID: More flags for each logical channel.
• FLG_2: Hexadecimal value of all flags.
• T09: 1 - T09 timer.
• CONG.: 1 - The logical channel has congestion of frames in TX queue.
• BUSY: 1 - Cannot route frame through L4. Respond with RNR to data frames.
• BUSYCOS: 1 - RR or RNR must be issued once per change in busy state.
• I_ACK: 1 - In X.25 over MDLC (no ACK mode), this is a pointer to last
transmitted frame. It can be tested to ensure all frames transmitted.
LAPB (X251L)
## 920 LEVEL = 0
flg vs vr va rc state t1 n1 n2 inactive
For each link on the port (usually only one link), the following information:
• FLG: Two bytes of link flags.
• VS: Index of next frame to transmit in the TX window.
• VR: Index of expected receive frame.
• VA: Next expected acknowledge index.
• RC: Retry counter.
• STATE: Link state. When state is 3, the link was established.
449
• T1: Transmission timer.
• N1: Maximum bytes in data frame.
• N2: Maximum number of transmit retries.
• INACTIVE: If value of that timer is not 0, the MOSCAD will initiate SABM to
establish the link.
## 921 LEVEL = 1
Tx_i Tx_rr Tx_rnr Tx_rej Tx_frmr
For each link (again , usually number of links is one), the following TX information :
• TX_I: Number of transmitted data frames.
• TX_RR: Number of transmitted RR frames.
• TX_RNR: Number of transmitted RNR frames.
• TX_REJ: Number of transmitted reject frames.
• TX_FRMR: Number of transmitted FRMR frames.
## 922 LEVEL = 2
Rx_i Rx_rr Rx_rnr Rx_rej Rx_frmr ns_err
For each link the following Rx information :
• RX_I: Number of transmitted data frames.
• RX_RR: Number of transmitted RR frames.
• RX_RNR: Number of transmitted RNR frames.
• RX_REJ: Number of transmitted reject frames.
• RX_FRMR: Number of transmitted FRMR frames.
• NS_ERROR: Number of times received NS was out of sequence.
## 923 LEVEL = 3
Tx fail : %% Tx full: %% Tx lock : %% Tx else : %%
Tx error counter : %%
For each link, the following error indication from HDLC :
• TX_FAIL: 1 - ERR_FAIL returned from HDLC_TRANSMIT.
• TX_FULL: 1 - ERR_FULL returned from HDLC_TRANSMIT.
• TX_LOCK: 1 - ERR_LOCK returned from HDLC_TRANSMIT.

450
• TX_ELSE: 1 - Other error returned from HDLC_TRANSMIT.
• TX_ERROR_COUNTER: Number of times an error returned from

HDLC_TRANSMIT.
PHONE BOOK LEVEL = 0 PHNBK
##940
Start at flash : %% 1
Number of entries : %% 2
1. The phone book address in the flash.
2. The number of entries in the phone book.
##941
Site Id Phone Numbers:
• The contents of phone book in the flash is provided.
451
TIMER EVENT
##960
Timers max. value (in 10msc units) : %% 1
Max. number of events / timers in buffer : %% 2
Current number of events / timers in buffer : %% 3
# of heap_aloc_buf failed : %% 4
1. The maximum number of timers that can be set by SetTmr to a specific event.
2. The maximum number of events and timers that can be managed simultaneously by the timer event
device. (They are managed by the heap.)
3. The number of events and timers currently in the heap.
4. The number of failed attempts to allocate buffers from the events’ and timers’ heap. (Its size as in 2.)
##961
Is device running ? : %% 1
Events enabled ? : %% 2
Last written heap buffer : %% 3
Current 10ms index : %% 4
Last read index : %% 5
1. Whether the device is running. (Does not run during load and reset load.)
2. Whether the events are enabled. (Controlled by Call StEvnt.)
3. The time index of the last logged event.
4. The time index of the current event.
5. The time index of the last read event.
• The above indexes are in a cyclic array that return a pointer per 10 msec. Every such pointer points to
the list of events that were received in those last 10 msec.
452
POOLMNGR
## 1130
Pool address : %% 1
Pool size (in bytes) : %% 2
Pool end address : %% 3
First free chunk address : %% 4
Largest free chunk address : %% 5
Sum of all free memory : %% 6
# of times that allocation
failed (from last diag) : %% 7
Was enough space for 2 aloc : %% 8
1. The pool address.

2. The size of the whole pool.
3. Pointer to the first byte after the pool.
4. Pointer to the first free chunk. Updated only by check validity function, thus might not be free.
5. Pointer to the largest free chunk. Updated only by check validity function, thus might not be free nor
the largest one.
6. The sum size of all the free chunks.
7. The number of times that allocate failed.
8. The number of times that the function poolmngr_2_allocs_ok returned NO.
## 1131
Chunk address Chunk size Is free?
------------- ---------- --------
1 2 3
• A table of all of the chunks that were allocated in the pool (some were freed and therefore marked
free).
1. The chunk address.

2. The chunk size.
3. Whether the chunk is occupied or free.
## 1132
Is Check- Check-
Chunk addr Chunk size free? Bits Word
---------- ---------- ----- ----- -----
1 2 3 4 5
• A table of all of the chunks that were allocated in the pool manager (some were freed and therefore
marked free).
1. The chunk address.

2. The chunk size.
3. Whether the chunk is occupied or free.
453
4. Status of Check-Bits - check chunk boundaries to see if part of this chunk is overlapped by another
chunk.
5. Status of Check-Words - check chunk boundaries to see if part of this chunk is overlapped by another
chunk.
## 1140
Is pool clobbered? : %% 1
1. If Check-Bits or Check-Words are set, the validity check will report if one chunk in the pool has
overlapped another’s boundaries.
OCOMM LEVEL = 0
## 1400
ocomm key variables
--------------------------
Heap device key : %% 1
Rtu to RTU station address : %% 3
Rtu to RTU system address : %% 4
Rtu to RTU Rxlo : %% 5
Rtu to RTU Rxhi : %% 5
INTRAC Rxlo : %% 6
INTRAC Rxhi : %% 6
Maximum time units for a frame to be in reception queue [sec]: %% 7
Repeater mode (Yes / No): %% 8
Control opcode to execute by transmit thread : %% 9
Answer of execution from receive thread : %% 9
Pointer to plug-in diagnostic buffer : %% 10
General: Ocomm is the module in charge of transmission and reception of wide MEIC MDLC and
INTRAC frames.
Type “OCOMM” in device name for general diagnostic.
Type “OCOMH” in device name for diagnostic of transmission heap.
Type “OCOMC” in device name for diagnostic of Channel Access.
1. The key to the heap from where buffers are taken for transmission.
2. The key to the physical layer that is used for transmission/reception (Adapter).
3. The Station Address of the unit in the wide MEIC MDLC network.
4. The System Address of the unit in the wide MEIC MDLC network.
5. The address range for wide MEIC MDLC frame reception.
6. The address range for INTRAC frame reception.
454
7. The amount of time a received frame (INTRAC or wide MEIC MDLC) can wait in the reception
queue. If the Ladder or C application does not retrieve it from there (by RxIntr function or by
RxWdth) the frame will be erased at the end of this time.
8. If Yes, then frames received by radio are transmitted to the line and vise versa.
9. The transmitting/receiving code to Piggyback used for configuration or diagnostics.
10. A pointer to the buffer received from Piggyback after being diagnosed (levels 41, 40 , 20).
## 1401 LEVEL = 1
ocomm key variables (continue)
---------------------------------------
Radio transmit queue pointer : %% 1
Radio transmit queue size [frames] : %% 2
Line transmit queue pointer : %% 3
Line transmit queue size [frames] : %% 4
Rtu to RTU reception queue pointer : %% 5
Rtu to RTU reception queue size [frames] : %% 6
INTRAC reception queue pointer : %% 7
INTRAC reception queue size [frames] : %% 8
Was RTU to RTU reception queue pulled ? (Yes / No): %% 9
Was INTRAC reception queue pulled ? (Yes / No): %% 10
Transmission state : %% 11
Will radio transmit queue be first ?(Yes / No) : %% 12
Is transmit thread at physical_transmit ( ) ? : %% 13
Is transmit thread at physical_wait ( ) ? : %% 13
Is transmit thread waiting for ack ? : %% 13
Was trunk radio configured : %% 14
Is trunk channel being warmed up with high priority ? : %% 15
1. The memory address of the radio transmission queue.
2. The number of frames in the radio transmission queue.
3. The memory address of the line transmission queue.
4. The number of frames in the line transmission queue.
5. The memory address of the wide MEIC MDLC frame reception queue.
6. The number of frames in the wide MEIC MDLC frame reception queue.
7. The memory address of the INTRAC frame reception queue.
8. The number of frames in the INTRAC frame reception queue.
9. Yes - The application called the RxWdth (in Ladder language)
10. Yes - The application called the RxIntr/UpIntr (in Ladder language).
11. The transmission state (to line, radio, piggyback or not at all).
12. Yes - The next time transmission will be to radio.

No - The next time transmission will be to line.
455
13. Waiting during transmission :

- During the transmission itself.
- Waiting for the end of transmission.
- Waiting for ACK from piggyback (while executing diagnostics or configuration)
14. If Yes, then working with trunk radio.
15. If working with trunk radio, Yes means access to trunk channel in high priority, if Low access to
trunk channel in low priority.
## 1410
The number of times the following operations were executed
LEVEL : 10 (zeros the counters after diagnostics)
LEVEL : 11 (does not zero the counters)
ocomm key error counters

--------------------------------
How many times did getting buffer fail ? : %% 1
How many times was a frame transmitted ? : %% 2
How many times did transmission fail ? : %% 3
How many times did warmup fail ? : %% 4
How many times was control frame received ? : %% 5
How many times was a frame received ? : %% 6
How many times was invalid frame received ? : %% 7
How many times was a frame with error status byte received : %% 8
How many times was a frame with invalid crc received ? : %% 9
How many times was a frame with irrelevant address received? : %% 10
How many times was received frames ignored ? : %% 11
How many times was received frames flushed ? : %% 12
How many times was transmit frame as a repeater failed : %% 13
1. The transmission was not carried out because there were no buffers in the transmission heap.
2. The number of times the frame was transmitted (to line/radio or piggyback).
3. The number of times the transmission failed.
4. The number of times warmup failed.
5. The number of times ACK (configuration/diagnostics) message or error was received from
piggyback.
6. The number of times frame was received from radio/line.
7. The number of times invalid frame was received from radio/line.
8. The number of received frames with hardware error.
9. The number of received frames without hardware error but with invalid CRC.
10. The number of received invalid frames with addresses out of range (which were erased).
11. The number of received frames with valid addresses that were erased, because the application did not
try to receive before that time.
456
12. The number of received frames with valid addresses, but were erased after timeout because the
application did not try to receive during this time.
13. The number of times the transmission of a received frame (in repeater mode) failed because the heap
was empty.
## 1420 LEVEL = 20
plug - in modem config. parameters
Pre - emphasize enable : %% 1
De - emphasize enable : %% 2
Radio channel monitor or txen polarity : %% 3
Radio indication or Rxen polarity : %% 4
Radio reception condition : %% 5
Radio gain level : %% 6
Line gain level : %% 7
Maximum received frame size : %% 8
A.g.c enable : %% 9
• FSK INTRAC Piggyback parameters :
1. Yes - Execute pre-emphasis in transmission.
2. Yes - Execute de-emphasis in reception.
3. Comm. radio - The Channel Monitor polarity; Trunk - The TxEn polarity.
4. Comm. radio - The RIND polarity; Trunk - The RxEn polarity.
5. Reception conditions :
Channel Monitor : Begin reception when C.M. active.
Tone Detect : Begin reception when there is a tone from the radio.
Channel Monitor and Tone Detect : Begin reception when both of the above occur.
(in use for regular radio).
RxEn and Tone Detect : Begin reception when there is an active RxEn and tone.
(in use for Trunk radio only)
6. Radio transmission level 0..7 (7 is maximum).
7. Line transmission level 0..7 (7 is maximum, 0 means disconnect).
8. The maximum length of a received frame. Longer frames are errors.
9. Yes - Operate AGC in reception from line.
## 1430
Failed to communicate with plug-in modem
A ToolBox message shown when piggyback (level 41, 40, 20) diagnostics fail. The message means that
communications with piggyback failed.
457
## 1431
Previous diagnostic operation to plug-in modem was not terminated - try again
A ToolBox message shown when piggyback diagnostics fail. The meaning of the message is that the
diagnostics failed (levels 20, 40, 41) because of current transmission (or access) to channel, radio or line.
Diagnostics will be allowed at the end of the current transmission.
## 1440
plug-in modem statistical information
Number of spikes received at last reception : %% 1
Total number of spikes received : %% 2
Number of illegal received frames (till 225) : %% 3
• Piggyback hardware statistics

LEVEL : 40 - Execute statistics and zero counters.
LEVEL : 41 - Execute statistics but do not zero counters.
1. The number of spikes received the last time reception was operated.
2. The total number of spikes received.
3. From piggyback version 1.2 and on, the size of the maximum transmission buffer of piggyback (up to
32 bits).
FSKADP : Channel Access to INTRAC FSK Piggyback. (The transmission of lateral

MDLC INTRAC frames to radio / line). The module is executed as a
result of transmission from OCOMM module and is found under UART.
Diagnostic operation : Operated by DEVICE NAME : OCOMM

LEVEL : 0 , 1 , 2 , 3 , 4 , 10 , 11
FSKADP (OCOMC)
## 1500 LEVEL = 0
Line Configuration parameters :
Override Time on busy line-channel mS : %% 1
Quiet Time on free line-channel mS : %% 2
Wait for Channel-Access Timeout Sec : %% 3
Line-channel warmup Time mS : %% 4
Transmission Timeout Sec : %% 5
Wait for Holdup Timeout Sec : %% 6
Line-channel Holdup Time mS : %% 7
Line-channel Shutup Time mS : %% 8
Current status of line :
Line-channel quiet time mS : %% 9
Line-channel busy time mS : %% 10
Line channel access parameters:
458
1. During transmission, if “Channel busy” is detected, this parameter will determine the waiting time (in
msec) before forcing transmission onto a channel (even if the channel is still busy). Setting this
parameter to "0", will terminate the option.
2. Quiet channel period (in msec) before transmission. Setting this parameter to "0", will terminate the
waiting time and transmission will start immediately after the "free channel" detection.
3. Maximum waiting time (in msec) for available channel for transmission. If at the end of this period,
the channel is not available, the system provides a failure notice and the transmission attempts will be
terminated.
4. Transmits a constant tone during this period (in msec), before data transmission starts.
5. The maximum time frame (in seconds) for data transmission. Transmission over this time will be
terminated, and a failure will be declared. The transmission always ends (normally or forced) with a
constant tone for holdup time.
6. During this period (in msec), the system allows the plug-in modem to transmit the contents of its
internal buffer, after the MOSCAD RTU has finished data transmission. It is not recommended to
7. The amount of time (in msec) a constant tone transmission is continued after the end of transmission.
8. The minimum waiting time (in msec) between one frame transmission and the next. It is measured
from the end of the constant tone of the last transmission.
• The receiving line status:
9. The amount of quiet time on the line (msec).
10. The amount of busy time on the line, meaning Line Tone Detect is active.
## 1501 LEVEL = 1
Radio Configuration parameters :
Override Time on busy radio-channel mS : %% 1
Quiet Time on free radio-channel mS : %% 2
Wait for radio-channel-access Timeout Sec : %% 3
Radio-channel warmup time mS : %% 4
Transmission timeout Sec : %% 5
Wait for Holdup timeout Sec : %% 6
Radio-channel Holdup Time mS : %% 7
Radio-channel Shutup Time mS : %% 8
Radio-channel is kept busy by : %% 9
Current status of radio :
Radio-channel quiet time mS : %% 10
Radio-channel busy time mS : %% 11
• Regular radio channel access parameters:
1. During transmission, if “Channel busy” is detected, this parameter will determine the waiting time (in
msec) before forcing transmission onto a channel (even if the channel is still busy). Setting this
parameter to "0", will terminate the option.
2. Quiet channel period (in msec) before transmission. Setting this parameter to "0", will terminate the
waiting time and transmission will start immediately after the "free channel" detection.
terminated.
459
9. To detect a busy channel:

Channel Monitor - The channel is busy when C.M. is active.
Tone Detect - The channel is busy when there is tone on the channel.
10. The amount of quiet time on the radio (msec).
11. The amount of busy time on the radio, meaning Radio Tone Detect is active.
## 1502 LEVEL = 2
Trunk Radio Configuration parameters :
Is trunk radio configured ? : %% 1
No trunk-channel time before requesting TxEn (Low) : %% 2
No trunk-channel time before requesting TxEn (High) : %% 3
Quiet Trunk-channel time before requesting TxEn (High) : %% 4
TxEn-request PTT active time mS : %% 5
TxEn-request PTT non-active time mS : %% 5
Wait for trunk-channel-access timeout Sec : %% 6
Warmup trunk-channel time mS : %% 7
Wait for holdup timeout Sec : %% 9
Trunk-channel holdup time mS : %% 10
Trunk-channel shutup time mS : %% 11
Current status of trunk :
Trunk-channel quiet time mS : %% 12
Trunk-channel busy time mS : %% 13
Channel does not exist time mS : %% 14
Is txen active ? : %% 15
Is PTT pressed and txen requested ? : %% 16
Time remaining for PTT pressing or reset mS : %% 17
1. YES - Trunk has been defined in configuration. Radio transmissions are via trunk.
NO - Trunk not used (regular radio transmission).
2. When the channel does not exist, this parameter determines the allotted time (in msec), to ask for
TxEn (transmit enable). This parameter is relevant if one of the functions, TxWdth or TxIntr was
called with Tx_Lnk=1 (Tx_Lnk=LoTrnk or Radio).
3. When the channel does not exist, this parameter determines the allotted time (in msec), to ask for
TxEn (transmit enable). This parameter is relevant if one of the functions, TxIntr or TxWdth was
called with Tx_Lnk=11.
460
4. When the channel exists and is quiet, this parameter determines the time (in msec) until asking for
TxEn (transmit enable). This parameter is relevant if one of the functions, TxWdth or TxIntr has been
called with Tx_Lnk=11 (Tx_Lnk=HiTrnk).
5. These two parameters, are used to determine the PTT active time (pressed) and PTT release time after
the transmit enable TxEn request (both in msec).
terminated.
12. Period (in msec) during which the trunk channel was quiet (RxEn but no tone),
13. Period (in msec) during which a transmission took place in trunk (both tone and RxEn).
14. Period (msec) during which a trunk channel was not available (no RxEn).
15. Whether the CPU is pressing TxEn now.
16. Whether PTT is pressed now and TxEn requested.
17. If TxEn is requested: The time (in msec) remaining for re-pressing/releasing the PTT. If TxEn was
not requested, the value is 0.
The access to trunk channel:
• In order to begin transmission, the user should request TxEn from central unit. This is done by
pressing PTT for 4 msec. and releasing it for 5 msec. If someone else is transmitting, this request
interrupts the transmission, and therefore should be avoided.
• Access to channel is available in low priority and then the waiting time is 1 msec during which there
is no channel (RxEn is not active and no one is transmitting) until requesting TxEn (for transmitting).
If during this time someone receives permission to transmit, RxEn will become active and again the
user should wait for it to become inactive.
• Access to channel is also available in high priority and then the waiting time is either 2 msec, as
before, during which RxEn is not active until requesting TxEn, or 3 msec during which RxEn is active
and the channel is quiet (there is no Tone) before requesting TxEn.
461
## 1503 LEVEL = 3
Control channel Configuration parameters:
Wait for control - channel - access timeout Sec : %% 1
Warmup control - channel time mS : %% 1
Wait for holdup timeout Sec : %% 1
Holdup control - channel time mS : %% 1
Shutup control - channel time mS : %% 1
Current status of control channel : 2
Is transmission enabled : %% : %% 2
1. The piggyback control channel access parameters used for its diagnostics and configuration. The
meaning of the parameters is the same as in Line, Radio or Trunk.
The piggyback control channel current status:
2. Yes - Transmitting to the control channel is enabled.
## 1504 LEVEL = 4
fskadp device - current state variables
Did plug - in modem fail test ? - %% 1
Is trunk radio configured ? - %% 2
Is channel monitor LED on ? - %% 3
Is driver waiting for CTS at grant state ? - %% 4
Is task suspended on Tx_start_1 ? - %% 5
Is task suspended on Tx_start_2 ? - %% 6
Is task suspended on hc11_end_of_Tx ? - %% 7
Current module state : %% 8
Time remaining for current state mS : %% 9
Current transmitted channel : %% 10
Current accessed channel : %% 11
Current channel quiet time mS : %% 12
Current channel busy time mS : %% 13
Trunk channel status :
How long does channel not exist mS : %% 14
Is transmission enabled ? (Is TxEn Active) : %% 15
Is PTT pressed when asking for TxEn : %% 16
How much time remains for PTT pressing or reset mS : %% 17
Next warmup will be performed on channel : %% 18
Next warmup will be performed with priority : %% 19
• General parameters of FSKADP (or DEVICE OCOM) module state. Notice that parameters related to
trunking are relavant if “ Is trunk radio configured” is set to “Yes”. :
1. Yes: Piggyback failed on first test; therefore cannot be transmitted to.
2. Yes: Radio trunk was defined in configuration.
3. Yes: LED, CM3 are on. (There is reception from one of the channels).
4. Yes: Waiting for CTS from piggyback, after completing Channel Access process, in order to begin
transmitting.
5. Yes: OCOMM module is waiting in transmission until descriptor is available (TxBD).
6. Yes: OCOMM module is waiting in transmission until current transmission is over.
462
7. Yes: OCOMM module is waiting for end of current piggyback transmission. (UART of CPU has
finished transmitting).
8. Transmission state: Init, Grant (executing Channel Access), Warmup (transmitting Tone) and so on.
9. The amount of timeout left for current state.
10. The name of the channel that is currently being transmitted to.
11. Current channel access priority.
12. The amount of time the current channel was quiet before transmission or channel access.
13. The amount of time the current channel was busy before transmission or channel access.
14. Period (msec) during which a trunk channel was not available (no RxEn).
15. Whether the CPU is pressing TxEn now.
16. Whether PTT is pressed now and TxEn requested.
17. If TxEn is requested: The time (in msec) remaining for re-pressing/releasing the PTT. If TxEn was not
requested, the value is 0.
18. Next warmup will be performed on this channel.
19. Access priority of the channel that will execute Channel Access the next time. When executing
Channel Access the channel has priority. That is because the access to trunk channel can be in high or
low priority. Therefore when accessing other channels the following priorities are available: Conv.
Radio, Line , Sci (internal). When not accessing channel, this field shows “No Channel Access”.
## 1510
Transmission failure error counters
Number of times CTS signal was stuck : %% 1
Number of times channel was busy and could not be accessed : %% 2
Number of times transmission timeout occurred : %% 3
Number of times ‘Wait for Holdup’ timeout occured : %% 4
• The transmission failure statistics:

LEVEL : 10 - zero counters after diagnostics.
LEVEL : 11 - do not zero counters.
1. The number of times a channel was available for transmission (Channel Access ended successfully),
but piggyback did not enable the beginning of transmission (did not execute CTS). This can occur
because of hardware difficulties or because the transmission buffer was full for too long.
2. The number of times transmission failed because the channel was busy (Channel Access failed).
3. The number of times the transmission was stopped because it was too long.
4. The number of times the waiting for the end of piggyback modem transmission was stopped because
it took too long.
463
GPS
## 1600
GPS module parameters
Heap key : %% 1
UART key : %% 2
Update System flags function pointer : %% 3
Read Ladder time offset function pointer : %% 4
Period to Get time from GPS [sec] : %% 5
Local offset to UTS time : %% mSec.%%:%%:%%6
Local offset time at Reserved Values Table : %% mSec 7
Last PPS occurred at : %% mSec.%%:%%:%% 8
Last PPS (before GPS - frame) occurred at : %% mSec.%%:%%:%%9
Time sent from GPS : %% mSec.%%:%%:%% 10
Date sent from GPS : %%...%%:%%:%% 11
Elapsed time from last PPS when saving it : %% mSec... %%:%%:%% 12
Time that GPS frame was encoded : %% mSec... %%:%%:%% 13
Current calculated local time : %% mSec... %%:%%:%% 14
Current calculated local date : %% :%%:%% 15
Is GPS connected to MOSCAD CPU ? : %% 16
Is GPS time valid ? : %% 17
Has GPS recovered from warm - restart : %% 18
The GPS module works with the GPS receiver, configures it, receives its satellite timings and updates the
DATE & TIME table accordingly. Works above UART.
For general diagnostics : Type GPS2 in name device.
For Heap diagnostics : Type GPS2H in name device.
For Uart diagnostics : Type GPS2P in name device.
1. Pointer to the Heap key for transmission and reception.
2. Pointer to the UART key that transmits and receives with GPS.
3. Pointer to the function that updates the System Flags table.
4. Pointer to the function that returns time offset from System Values.
5. Frequency (seconds) at which GPS time is received.
6. Satellite time offset from configuration.
7. Time offset from System Values table.
8. The MOSCAD time when there is an event 1pps (every second) from GPS.
9. When a frame is received, saves the last of the 1pps event time (what was in 8).
10. The time received from GPS.
11. The date received from GPS.
12. The amount of time that passed between frame receiving event to 9 (less than a second).
464
13. When the GPS frame was encoded and calculated in local time. Because it is correct for 9, 10 is to be
added.
14. The time calculated via GPS + offset.
15. The date calculated via GPS + offset.
16. Yes : GPS is connected to MOSCAD(always defaults to no).
17. Whether the time from GPS is valid.
18. Yes : Execute Warm Restart , meaning reconfigure GPS.
## 1601 LEVEL = 1
Current MOSCAD Time
Time in TICKS register : %% : %% : %% 1
Date in TICKS register : %% : %% : %% 2
Time in Real time Clock : %% : %% : %% 3
Date in Real time Clock : %% : %% : %% 4
Time in GPS receiver : %% : %% : %% 5
Date in GPS receiver : %% : %% : %% 6
Is GPS connected to MOSCAD CPU ? : %% 7
Is GPS time valid ? : %% 8
• The current GPS and MOSCAD times:
1. The MOSCAD time (updated only if clocks have been updated or the update is from GPS).
2. The MOSCAD date.
3. The time in RTC (updated from ToolBox , GPS).
4. The date in RTC.
5. Time that was received from GPS.
6. Date that was received from GPS.
7. Yes : GPS is connected to MOSCAD (See 9)
8. Whether GPS time is valid.
9. This is the flag that is set to YES whenever there is a 1pps interrupt from GPS. Subsequently
MOSCAD changes it to NO in order to diagnose whether GPS disconnected. If receiving reception
timeout of 2 sec and this flag is NO, the system knows that the GPS has been disconnected and will
wait for reconnection, and then it will reconfigure it. If a timeout occurred and the flag is set to YES,
GPS is connected and therefore will try to receive again. Therefore this flag varies according to
system needs and does not really indicate whether GPS is connected or not.
465
## 1610
GPS statistical information
How many 2 seconds timeout occurred during reception ? : %% 1
How many valid frames were received : %% 2
Number of invalid frames received (total) : %% 3
Number of received frames that got timeout in the middle : %% 4
Number of received frames with size less than 4 chars : %% 5
Number of received frames that got invalid 2 prefix bytes : %% 6
Number of received frames that got invalid 2 opcode bytes : %% 7
Number of received frames with length more than required : %% 8
Number of received frames that got invalid 2 suffix bytes : %% 9
Number of received frames that got invalid checksum : %% 10
Number of frames that were handled long time after pps : %% 11
How many valid frames were received with error status byte ? : %% 12
• The GPS module statistics:

LEVEL : 10 - zeroes counters after statistics
LEVEL : 11 -does not zero counters
1. The number of two second timeouts during which no frame was received from GPS.
2. The number of times a valid frame was received from GPS.
3. The number of times an invalid frame was received from GPS.
4. The number of times a timeout was received during reception of a frame.
5. The number of times the frame was too short.
6. The number of times the frame had an invalid prefix.
7. The number of frames that had an invalid opcode.
8. The number of frames that were too long.
9. The number of frames that had an invalid suffix.
10. The number of frames that had an invalid checksum.
11. The number of frames that were received after their 1pps time (more than a second).
12. The number of frames that were supposedly valid, but their status determined that they were not
satellite times.
CAPPL
## 1650 LEVEL = 0
The ‘C’ application Block ID : %% 1
The address of our jump-table to access the aplic : %% 2
Number of ‘C’ blocks in the flash (chain) : %% 3
Number of relevant ‘C’ blocks : %% 4
Number of expected ‘C’ functions : %% 5
Number of found ‘C’ functions : %% 6
1. The block number that is designed for programming the ‘C’ application, in this case 10. For every
type of item that is programmed into the site there is a set block ID.
466
2. The address of the Jumptable that coordinates between the ‘C’ application and the system services in
the RTU. The purpose of the Jumptable is to enable linkage during Runtime.
3. The number of ‘C’ blocks currently found in the flash.
4. The number of active ‘C’ blocks currently found in the flash.
5. The number of functions expected by the Ladder.
6. The number of functions that are currently found and with them linkage was executed in Runtime.
## 1651 LEVEL = 1
Expected Functions.
Func Func
Index Name
------ -----
• The list of functions expected by the Ladder and their names, as they appear in the flash after
download of the Ladder and/or C block.
## 1652 LEVEL = 2
List of the relevant blocks (starting from 1)
Block Num RAM Address
---------- ------------
• The list of the active blocks in the flash and their RAM addresses (all globals and statics).
## 1653 LEVEL = 3
Func Block Block Block Func
Addr RAM RAM Size Number Name
----- ----- -------- ------ -----
• The list of functions, their address in flash, the Block RAM beginning address, its size in RAM, the
block number and their names.
• In case the function is not found then it points to an empty function address in the system and is
marked block = 0. These values are useful when debugging the application.
## 1654 LEVEL = 4
Block Block Block Block Block User RAM RAM Lib
Cntr Ver Status Address len JT Size Address JT
----- ----- ------ ------- ----- ---- ---- ------- ---
• The list of all the blocks in flash (either active or not), the version of the block, the status of block
(active or not), the address of the block, and length of the block, (the size of the whole block without
the header). the address of the user’s Jumptable, and the amount of RAM needed by the block, address
of RAM needed and address of the library (system) Jumptable.
467
## 1655 LEVEL = 5
Func Block Func
Addr RAM Name
----- ------ ----
• The list of all of the functions expected by the Ladder including the memory address and the RAM
beginning address for each function. The global static variables are relative to the RAM beginning
address.
SFLASH (CPU 400 and above only)
## 1730 LEVEL = 0
Start of SFlash : %% 1
Last Flash address : %% 2
Num of segments : %% 3
Num of regions : %% 4
Max Prog Wait (mics) : %% 5
Max Erase Wait (mics) : %% 6
Max Suspend Time (mics): %% 7
Max Erase Time Secs : %% 8
Max Prog Time (mics) : %% 9
1. Start address of flash memory (CPU 400 - system and user, CPU420 User only).
2. Last address of Sflash.
3. Number of Segments.
4. Number of Regions.
5. Maximum time (# of microseconds) to wait until the flash memory is programmed.
6. Maximum time (# of microseconds) to wait until the flash memory is erased.
7. Maximum time (# of microseconds) to suspend the task which programs the flash memory.
8. Maximum time (# of seconds) required to erase the flash memory.
9. Maximum time (# of microseconds) required to program the flash memory.
## 1731 LEVEL = 1
Num of segments: %%
Start_Seg End_Seg Region Boot?
For all segments:
• Beginning address of the segment.
• End of segment (last address)
• In what region is the segment? (System region is 0 and User region is 1 - MOSCAD only).
468
• Is segment used for boot purposes or not?
## 1732 LEVEL = 2
Num of Regions: %% Chip Information
Num_ Chip_ Elt_ ID_ ID_
Chips Width Size Manu Dvc
For system software developers only.
## 1733 LEVEL = 3
Num of regions: %% Routines in RAM:
Erase Program Read_ID Busy_Wait_Micro
For system software developers only.
RxMyZ (MOSCAD-L only)

Where:
• R=Rack and x is the Rack number,
• M=Module and y is the Module number,
• Z corresponds to the I/O Module Type selected in Site Configuration, I/O, i.e. A (analog input), E
(electrically energized), M (mixed I/O), D (discrete input), R (relay ).
## 2000 LEVEL = 0
MOSCAD-L DI Init:
Digital Input initialization. For system software developers only.
## 2001 LEVEL = 0
MOSCAD-L RO Init:
Real IOutput initialization. For system software developers only.
## 2002 LEVEL = 0
MOSCAD-L AI : no_eoc_err_cnt : %%, is_normal_calibration : %%
Analog Input information. For system software developers only.
469
## 2003 LEVEL = 1
MOSCAD-L AI Init: verno : %%, ai_analog_range : %%,
ai_ioclk : %%, ai_filter_rank : %%, is_temperature : %%,
is_m20not4 : %%, is_ai_ref_val : %%
Analog Input information. For system software developers only.
## 2004 LEVEL = 0
MOSCAD-L MOD Init: dly : %%, freeze_input : %%, freeze_output : %%,
relays_1_8 : %%, relays_9_16 : %%
Initialization information. For system software developers only.
## 2005 LEVEL = 0
MOSCAD-L ALL Init: ac_range.max : %%, ac_range.min : %%,
ser_clk_div : %%, ro_wdt : %%, pw : %%, ref : %%,
io_frequency : %%, ac_div : %%
Initialization information. For system software developers only..
## 2006 LEVEL = 0
MOSCAD-L SPI Init: spi_mod : %%, idle : %%, rx_pol : %%,
tx_pol : %%, phase : %%
Initialization information. For system software developers only.
## 2007 LEVEL = 0
MOSCAD-L EE Contents:
Contents of Electrically Energized modules. For system software developers only.
CTRL (MOSCAD-L Only)
## 2013 LEVEL = 0
MOSCAD-L CTRL : batt_level (static) : %%
Static Battery level .
## 2014 LEVEL = 1
MOSCAD-L CTRL : batt_level (in hardware) : %%
Battery level in Hardware.
470
GAUART DEVICE = COMxA, RTUxA, LINxA
## 2020 LEVEL = 0
GAUart 's Hardware Internal Registers :-
------------------------------------------
General Status Register (GSR) : %% 2
General reset Register (GRR) : %% 3
Events Register (ER) : %% 4
Events Mask Register (EMR) : %% 5
Max idles Register (MX_IDL) : %% 6
Close Character : %% 7
baud rate read register low (BRR_L) : %% 8
baud rate read regiaster high (BRR_H) : %% 9
Mode register (MR) : %% 10
control 1 register (CC1) : %% 11
control 2 register (CC2) : %% 12
external pins register : %% 13
Receive Ready control Register(RR_x) : %% 14
Receive Status control Registe(RS_x) : %% 15
transmit control register (TC_x) : %% 16
Receive Ready control Register(RR_x) : %% 17
Receive Status control Registe(RS_x) : %% 18
transmit control register (TC_x) : %% 19
1. Device key.
2. General Status Register.
3. General reset Register.
4. Events Register.
5. Events Mask Register.
6. Max idles Register.
7. Close Character
8. Read register containing baud rate (low byte)
9. Read register containing baud rate (high byte)
10. Mode register.
11. Control 1 register.
12. Control 2 register.
13. External pins register.
14. Receive Ready control Register (1st buffer).
15. Receive Status control Register (1st buffer).
16. Transmit control bits (1st buffer).
471
17. Receive Ready control Register (2nd buffer).
18. Receive Status control Register (2nd buffer).
19. Transmit control bits (2nd buffer).
## 2021 LEVEL = 1
GAUART's Software descriptors :-
--------------------------------------
Head (offset) software receive descriptor: %% 1
tail (offset) software receive descriptor: %% 2
Head (offset) software transmit descriptor: %% 3
tail (offset) software transmit descriptor: %% 4
empty software receive descriptor: %% 5
ready software receive descriptor: %% 6
empty software transmit descriptor: %% 7
ready software transmit descriptor: %% 8
1. Where the processor will leave the next received data.
2. Where the software will take the next received data.
3. Where the software will leave the next data to be transmitted.
4. Where the processor will take the next data to be transmitted.
5. Number of empty software receive descriptors
6. Number of full software receive descriptors ready to be emptied.
7. Number of empty software transmit descriptors
8. Number of full software transmit descriptors ready to be emptied.
472
## 2022 LEVEL = 2
GAUART's Internal RAM data-Device Key :-
------------------------------------------
Current channel's name (CHAN_BACKUP): %% 6
Current channel's data (CHAN_DATA) : %% 7
Current channel's code (CHAN_CODE) : %% 8
Current heap's name (HEAP_BACKUP): %% 9
Current heap's name (HEAP_DATA) : %% 10
Current heap's data (HEAP_CODE) : %% 11
Current channel's port (GAUART_PORT): %% 12
Reception data head (RXBD_HEAD) : %% 15
Communication signals (GAUART_SIGNAL): %% 17
Communication buffers (GAUART_TYPE) : %% %% 18
Communication uart lock (GAUART_LOCK) : %% 19
Communication status (NOISY): %% 22
(QUIET): %% 23
Communication preset/timers (GRANT): %% %% 24
(QUIET): %% %% 25
1. Current working mode of the channel (synchronous, asynchronous, DTE, DCE).
3. Current synchronization character.
4. Not relevant.
6. Channel access name.
7. Current channel's device.
8. Current channel's pin table.
9. Heap name.
10. Heap device key.
11. Heap pin table.
12. The port number.
473
16. Offset for Tx descriptors for transmitting frame .
20. Not in use.
21. Coded time stamp of last received frame (in ticks)
## 2040 LEVEL = 0
Index Name Pointer
----- ----- -------
All saved names and pointers to blocks used until now. The names are created with the function
MOSCAD_bind_name()and pointers are created with MOSCAD_get_named_ptr() for the purpose of
keeping historical data on the block.
SITTBL
## 2060 LEVEL = 0
Dynamic Site-Table :
Index ID Link ComFal
----- ---- ---- ------
The Dynamic Site Table as determined by C functions such as init_site_table(), new_site_table(), and
Set_site_table(). Includes Site ID, Link ID, and status of the ComFal bit.
## 2061 LEVEL = 1
Static Site-Table :
Index ID Link ComFal
----- ---- ---- ------
The Site Table as defined in the Ladder of the Application Programmer. Includes Site ID, Link ID, and
status of the ComFal bit.
474
DCFi (for ‘C’ applications only)
## 2100 LEVEL = 0
Number of entries in the function table: %% 1
Address
1. The number of entries in the function table corresponds to the number of functions allocated for
this DCF device. This corresponds to the advanced parameter set in the Site Configuration (e.g.
Number of diagnostics functions for ‘C’ application for DCF6.)
Address The starting address of this DCF function table.
For each DCFi device used (where i = 1-9), a separate function table exists.
## 2101 LEVEL = 1
Index Func RAM Ptr Pres-Key ID Lock In-Use Stop
----- ---- --- --- -------- -- ---- ------ ----
Index The index into the function table.
Func The function address.
RAM The RAM address of the block to which the function is linked.
Ptr The user pointer.
Pres-Key The Presentation Device key (internal system structure.)
ID The function ID.
Lock An indication if this Table Entry has been locked for use or modification.
In-Use Is this entry in the function table in use?
Stop Use Indication: If this entry is to be removed, then stop calling the function. If the function
is not going to be removed, then it can continue be called (concerning the MOSCAD_set...
and MOSCAD_unset... for each of the DCF's functions.)
This table contains an entry for each function allocated for the DCFi device (where i = 1-9).
If the user application calls MOSCAD_set_diag_func(), user defined diagnostics can be viewed for the
DCF6 device, generally at Levels 20-50. For more information, see the Calling User Functions from the
MOSCAD Family System chapter of the ‘C’ Toolkit for MOSCAD Family RTUs User Guide.
475
IPLINK LINxL
## 2200 LEVEL = 0
Iplink device key
--------------------
Heap key : %% 1
Network key : %% 2
Network pin table : %% 3
Site ID : %% 4
Link ID : %% 5
IP port number : %% 6
IP address : %% 7
Enable RCP : %% 8
Port is in Fail : %% 9
Group IP address : %% 10
All RTU Simulation: %% 11
Enable IPModem : %% 12
Learn IP Address : %% 13
Check failed sites : %%14
Max echoes to send : %%15
Max sec between echoes: %%16
Max sec to check alive: %%17
Is GetSiteName exist : %%18
Enable time sync6 : %%19
Enable check sites : %%20
Ignore broadcasts : %%21
Parent Site ID : %%22
When Port is defined as MDLC Over IP (Astro, iDEN,Tetra, Terminal server or Standard Modem).
1. General Heap key for transmission and reception.
2. Network layer in the unit.
3. A pointer which allows “cabling” between two devices during run time.
4. Site ID.
5. Link ID.
6. Number of the IP Port as defined in Site Configuration.
7. IP Address as defined in Site Configuration.
8. Enable RCP- Yes or No
9. Status of Link.
10. IP address used for Group Call as defined in Site Configuration.
11. YES if the Addr. range response for 'All RTU simulation' (Network Layer Advanced Parameter) was
set to non zero.
12. YES if connected to iDEN.
476
13. YES if the port’s IP address will be retrieved during run time, e.g. from the iDEN modem.
14. YES if the sites that are failed will be checked before transmitting to them. If the site does not reply,
transmissions will be routed to an alternative path (if such exists.) A site is considered failed when
transmission to it results in an ICMP:Dest Unreach error message, or when the ‘check alive’ test fails.
Use of this parameter makes MLDC over IP more reliable when transmitting to failed sites.
15. If ‘Check failed sites’ is YES, this specifies the number of retries of the ‘check alive’ test to the failed
site, before the message is routed to an alternative path (if such exists) and asserting that it is still
failed.
16. If ‘Check failed sites’ is YES, this specifies the timeout in seconds between retries of the ‘check
alive’ test.
17. If ‘Check failed sites’ is YES, this specifies the timeout in seconds in which no message was received
from a site before declaring it as unknown. Any new transmission to the site will first cause a ‘check
alive’ test as explained above. This parameter is extends the ‘check alive’ test to sites which are not
failed, but have been idle for some time. If this parameter is set to 0, no ‘check alive’ test will be
performed for idle sites.
18. Not relevant.
19. Not relevant.
20. YES if sites paging enabled.
21. If YES, incoming broadcasts will be ignored.
22. Relevant for IP Interface. If not 0, it is the parent RTU's Site ID.
## 2201 LEVEL = 1
Iplink socket status
---------------------
Socket number : %%
Socket state : %%
Socket timeout : %%
Socket open latest result : %%
Socket send latest result : %%
Socket recv latest result : %%
Status of the socket on the link. For system software developers only.
477
## 2202 LEVEL = 2
Iplink status
--------------------------
Queue size : %%1
Is transmission thread waits for new buffer : %%2
If transmission thread waits for socket to be opened : %%3
Is transmission thread waits for socket to transmit data : %%4
Is reception thread waits for socket to received new data : %%5
Last transmitted site ID : %%6
Last transmitted IP address : %%7
Last received site ID : %%8
Last received IP address : %%9
Last site ID used when calling getsitename() : %%10
Last site name retreived from getsitename() : %%11
Last IP Address retrieved when calling gethostname() : %%12
Is Conversion Table locked : %%13
Task name locking conversion table : %%14
Last transmitted IP Port : %%15
Last received IP Port : %%16
1. Number of frames awaiting transmission.
2. Not relevant.
3. Not relevant.
4. Not relevant.
5. Not relevant.
6. Last Site ID to which the RTU transmitted.
7. Last IP address to which the RTU transmitted.
8. Last Site ID from which the RTU received transmission.
9. Last IP address from which the RTU received transmission.
10. Not relevant.
11. Not relevant.
12. Not relevant.
13. Not relevant.
14. Not relevant.
15. With firmware ≥ V9.24, the UDP port number can be learned upon reception from each site. In
earlier versions only the IP Address is learned. This diagnostic shows the last transmitted site ID
(field 6) IP address (field 7) and its UDP port number (this field).
16. With firmware ≥ V9.24, the UDP port number can be learned upon reception from each site. In
earlier versions only the IP Address is learned. This diagnostic shows the last received site ID (field
8) IP address (field 9) and its UDP port number (this field). When the RTU replies to this site, it will
use this IP Address and UDP port number.
478
## 2203 LEVEL = 3
Iplink conversion table
------------------------
Maximum entries allowed : %%1
Number of actual entries : %%2
Next entry for setcall : %%3
Num Echo Echo Ave Fail Check UDP

Site IP-address Status Fail Sent Rply Delay [sec] Hint In [Sec] Port
---- ---------- ------ ---- ---- ----- ------ ----- ---- -------- ----
1. Maximum number of entries allowed in IP Conversion Table.
2. Actual number of entries in IP Conversion Table.
3. Not relevant.
The contents of the IP Conversion Table is provided:
• Site ID
• IP Address
• Site Status OK/Fail/-- (Unknown) OK means the site is OK. Fail means that either a site
page failed or a transmission failed. -- means unknown.
• Number Failed Number of times site has become failed (either from OK or Unknown state).
• Echo Send Number of polls sent to site during check alive test or page.
• Reply Received Number of polls (pages) replied to by the site.
• Average Delay Average delay when transmitting to a site. Each poll bears the site timestamp.
When the site replies, an average delay is recalculated. The average depends on how many echoes
were sent.
• Failed Time[sec] Time in seconds from which the site was first declared as failed.
• Hint Not relevant.
• Check In If in the middle of paging, specifies how many echoes are left to check and when the next
one will be sent in seconds.
• UDP Port Shows the UDP Port number for the site. If -- it is the configured MDLC UDP port number
as in ##2200.
In MOSCAD >= V9.24, level 30 for this diagnostic clears the statistics information display in the IPLink
Conversion Table (level 3.)
## 2204 LEVEL = 3
Displays the contents of each row in ##2203.
479
## 2210 LEVEL = 10, 11

Iplink statistics
------------------
Number of times re-opened socket : %%1
Number of times transmitted successfully : %%2
Number of times failed transmission : %%3
Number of times failed get IP address before transmitting : %%4
Number of times failed set IP address after receiving : %%5
Number of times failed get buffer from heap : %%6
Number of times received a frame successfully : %%7
Number of times failed reception : %%8
Number of times received irrelevant frame : %%9
Number of times failed handle received control frame : %%10
Number of times failed handled received data frame : %%11
Number of times port has become failed : %%12
Number of times port has recovered : %%13
Error when failed pushing received datagram to network : %%14
Number of times tried a loop transmission : %%15
Number of ICMP:Host Unreach messages received : %%16
Last destination Site ID that caused ICMP:Host Unreachable: %%17
Number of unknown frames received from peer MOSCAD sites : %%18
Last MOSCAD site ID that sent an unknown frame : %%19
Number of times failed transmission because of full queue : %%20
Number of times transmitted sync frame : %%21
Number of times received sync frame : %%22
Number of times transmitted to non OK sites : %%23
Number of bytes transmitted : %%24
Number of bytes received : %%25
Number of echo rqst frames sent to other peer MOSCAD sites : %%26
Last MOSCAD site ID that sent an echo request to : %%27
Number of echo rply frames received from peer MOSCAD sites : %%28
Last MOSCAD site ID that sent an echo reply frame : %%29
Number of times failed obtain gethostbyname : %%30
Number of times got setip frame : %%31
Number of times got getip request : %%32
Number of times failed reply to getip request : %%33
Number of times sent setip frame : %%34
Number of times replied to sync frames : %%35
Number of times sent control frame : %%36
Number of times received control frame : %%37
1. Not relevant.
2. Number of successful transmissions.
3. Number of failed transmissions.
4. Not relevant.
5. Not relevant.
6. Not relevant.
7. Not relevant.
8. Number of time reception failed – invalid MDLC file.
9. Not relevant.
480
10. Number of times that a radio control frame could not be processed (Astro Spectra only).
11. Number of times that a radio data frame could not be sent to the network, usually because the network
is busy (Astro Spectra only).
12. Number of times the port went into failed mode.
13. Number of times the port recovered from failed mode.
14. Reason for failure to push received radio data frame to network (as in 11 above.)
15. Number of times transmission was attempted to a destination site with the same IP address as the
RTU. As a result, transmission failed.
16. Number of times an ICMP:Host Unreachable message was received after transmission. As a result,
destination site has become failed.
17. Last Site ID to become failed because of an ICMP:Host Unreachable message.
18. Number of valid MDLC frames received from peer MOSCAD sites that could not be processed by the
RTU. This is because of an MDLC version mismatch. The message has been reported back to the
peer site.
19. Last peer Site ID to have sent a message that could not be processed. The message has been reported
back to the peer site.
20. The number of times that transmission failed because the queue was full. This prevents over-
consuming MDLC heap resources when transmitting large blocks of data.
21. The number of times that synchronization was transmitted to all sites.
22. The number of times that synchronization was received.
23. The number of times that data was transmitted to a site which is either failed or its status is currently
unknown. Usually a site like this is polled before transmitting, but in order to free heap resources,
data was transmitted to it and may have been lost. (relevant only when Check failed sites is set to
YES in #2200 parameter 17)
24. Number of bytes transmitted. (includes both 2 and 26)
25. Number of bytes received. (includes both 7 and 28)
26. Number of polls sent to other sites. (includes both 2 and 24)
27. Site ID of the last MOSCAD that was polled.
28. Number of replies received. (includes both 7 and 25)
29. Site ID of the last MOSCAD that replied to a poll request.
30. Not relevant.
31. The number of times a SETIP control frame was received.
32. Not relevant.
481
33. Not relevant.
34. Number of times sent SETIP control frame. This is issued when RTU notifies all sites in the IP
Conversion Table of the IP address for the modem/radio.
35. Not relevant.
36. Number of control frames (such as SETIP, Echo request and Reply) that were sent.
37. Number of control frames received.
SLIP LINxSlp
## 2300 LEVEL = 0
Slip/ppp port parameters
---------------------
formater key : %%1
port mode : %%2
port rate : %%3
port from : %%4
port flow control : %%5
Is device down : %%6
Is char being received : %%7
Is driver wait during transmission: %%8
Char that is being received : %%9
Has device went up ? : %% 10
Is driver being stopped ? : %% 11
Is reception from port being held? : %% 12
Is driver PPP ? : %%13
Maximal no reception time to declare disconnect [sec]: %%14
Time elapsed since last Slip/PPP reception [sec] : %%15
Is driver being stopped : %%16
Is driver being started/connected : %%17
Last error when started driver (HEX) : %%18
Is disconnected driver on ? : %%19
Was AT response been received when driver was up ? : %%20
Send optional String : %%21
Is slip/ppp freezed ? : %%22
1. Not relevant.
2. Not relevant.
3. Baud rate of port, as defined in Site Configuration.
4. Not relevant.
5. Type of flow control (DTR/CTS) as defined in Site Configuration.
6. Not relevant.
7. Not relevant.
482
8. Not relevant.
9. Not relevant.
10. Has the SLIP device been activated?
11. Is transmission of IP datagrams through SLIP device currently paused?
12. Is reception of IP datagrams through SLIP device currently paused?
Note: 11 and 12 are YES when initializing modem (e.g. iDEN) using AT commands.
13. YES if driver is PPP; NO if it is SLIP.
14. Timeout in seconds in which no data was received and disconnecting/reactivating SLIP/PPP.
15. Time elapsed in seconds since the last received SLIP/PPP data from port.
16. Is PPP/SLIP driver in the process of being disconnected?
17. Is PPP/SLIP driver in the process of being connected?
18. Not relevant.
19. Not relevant.
20. Was an AT response noted when receiving data in SLIP/PPP mode? An AT response can be
ERROR, +CME ERROR, AT, ATH, etc. It indicates that the modem has moved to command mode
and therefore the driver needs to be disconnected.
21. Not relevant.
22. Not relevant.
483
## 2301 LEVEL = 1
PPP Status
---------------
LCP Layer Status: %%1
IPCP Layer Status: %%2
PAP Layer Status: %%3
CHAP Layer Status: %%4
PPP State
---------------
LCP Layer State: %%5
IPCP Layer State: %%6
PAP Layer State: %%7
CHAP Layer State: %%8
Terminate Configure Failure

--------- --------- -------
LCP Layer Retry: %%9 %%9 %%9
IPCP Layer Retry: %%10 %%10 %%10
PAP Layer Retry: %%11 %%11 %%11
CHAP Layer Retry: %%12 %%12 %%12
PPP Configuration My Their Negotiated

----------------- ------------ -------------- ----------
Asyncctl : %%13
Magic : %%14
Maxmtu : %%15
Auth protocol: %%16
Quality protocol: %%17
Protocol comp. : %%18
Address comp. : %%19
IP Address : %%20
Tcp Compressio : %%21
Tcp Comp Max slot: %%22
Tcp Comp slot : %%23
PPP Retry timeout in millisec : %%24
Echo send Interval in millisec : %%25
Echo send max number of retries : %%26
Echo fail Interval in millisec : %%27
Echo fail max number of retries : %%28
1. Status of LCP layer (up or down).
2. Status of IPCP layer (up or down).
3. Status of PAP layer (up or down).
4. Status of CHAP layer (up or down).
5. Not relevant.
6. Not relevant.
7. Not relevant.
8. Not relevant.
9. Number of retries to terminate or configure the LCP layer.
484
10. Number of retries to terminate or configure the IPCP layer.
11. Number of retries to terminate or configure the PAP layer.
12. Number of retries to terminate or configure the CHAP layer.
13. PPP Async option of myself/peer and negotiated one.
14. PPP Magic option of myself/peer and negotiated one.
15. PPP MaxMTU (maximal size of frame in bytes that can be received and sent) option of myself/peer
and negotiated one.
16. PPP Authentication protocol option of myself/peer and negotiated one.
17. PPP Quality protocol option of myself/peer and negotiated one.
18. PPP Protocol compression option of myself/peer and negotiated one. 1 if this is required.
19. PPP Address compression option of myself/peer and negotiated one. 1 if this is required.
20. IP Address option of myself, peer, and negotiated one.
21. TCP header compression protocol of myself, peer and negotiated one.
22. TCP header compression maximal slot of myself, peer and negotiated one.
23. TCP header compression slot of myself, peer and negotiated one.
24. PPP Configuration parameter: Timeout in milliseconds to retry PPP frame after not getting a
response.
25. PPP Configuration parameter: PPP Echo send interval in milliseconds. If 0, PPP echo is not issued.
26. PPP Configuration parameter: PPP Echo send max retries. If 0 PPP echo is not issued.
27. PPP Configuration parameter: Same as 25 but applicable after failure to transmit a PPP echo. Value is
0 if no PPP echo is issued.
485
## 2302 LEVEL = 2
PPP log information
-------------------
Last protocol received : %%1
LCP protocol received : %%2
LCP code received : %%3
LCP id received : %%4
LCP message length : %%5
LCP message received : %%6
Time received last LCP : %%7
Number of Nak received : %%8
Number of Rej received : %%9
IPCP protocol received : %%10

IPCP protocol received : %%11
IPCP code received : %%12
IPCP id received : %%13
IPCP message length : %%14
IPCP message received : %%15
Time received last IPCP: %%16
Number of Nak received : %%17
PAP protocol received : %%18

PAP code received : %%19
PAP id received : %%20
PAP message length : %%21
PAP message received : %%22
Time received last PAP: %%23
CHAP protocol received : %%24

CHAP code received : %%25
CHAP id received : %%26
CHAP message length : %%27
CHAP message received : %%28
Time received last CHAP: %%29
Number of 'Success' code : %%30
Number of 'Fail' code : %%31
Last protocol transmitted: %%32

LCP protocol transmitted : %%33
LCP code transmitted : %%34
LCP id transmitted : %%35
LCP message length : %%36
LCP message transmitted : %%37
Time transmitted last LCP: %%38
Number of Nak transmitted: %%39
Number of Rej transmitted: %%40
IPCP protocol transmitted : %%41

IPCP code transmitted : %%42
IPCP id transmitted : %%43
IPCP message length : %%44
IPCP message transmitted : %%45
Time transmitted last IPCP: %%46
Number of Nak transmitted : %%47
Number of Rej transmitted : %%48
PAP protocol transmitted : %%49

PAP code transmitted : %%50
486
PAP id transmitted : %%51

PAP message length : %%52
PAP message transmitted : %%53
Time transmitted last PAP: %%54
CHAP protocol transmitted : %%55

CHAP code transmitted : %%56
CHAP id transmitted : %%57
CHAP message length : %%58
CHAP message transmitted : %%59
Time transmitted last CHAP: %%60
Number of 'Success' codes : %%61
Number of 'Fail' codes : %%62
1. Last protocol received.
2. Not relevant.
3. Last LCP code received.
4. Last LCP id received.
5. Last LCP/IP message received.
6. Last LCP/IP message length in bytes.
7. Time the message was received.
8. Number of Nacks received for LCP.
9. Number of Rejects received for LCP.
10. Not relevant.
11. Last IPCP code received.
12. Last IPCP id received.
13. Last IPCP message received.
14. Last IPCP message length in bytes.
16. Number of Nacks received for IPCP.
17. Number of Rejects received for IPCP.
18. Not relevant.
19. PAP code received.
20. PAP id received.
21. PAP message length in bytes received.
22. Last PAP message length in bytes.
487
24. Not relevant.
25. CHAP code received.
26. CHAP id received.
27. Length of CHAP message received in bytes.
28. CHAP message received.
29. Time the CHAP message was received.
30. Number of ‘Success’ CHAP messages received.
31. Number of ‘Fail’ CHAP messages received.
32. Not relevant.
33. Not relevant.
34. Last LCP code transmitted.
35. Last LCP id transmitted.
36. Last LCP/IP message length in bytes.
37. Last LCP/IP message transmitted.
38. Time the last LCP/IP message was transmitted.
39. Number of Nacks transmitted to LCP.
40. Number of Rejects transmitted to LCP.
41. IPCP protocol transmitted.
42. IPCP code transmitted.
43. IPCP id transmitted.
44. Length in bytes of the last IPCP message transmitted.
45. Last IPCP message transmitted.
46. The last time an IPCP message was transmitted.
47. Number of Nacks transmitted for IPCP.
48. Number of Rejects transmitted for IPCP.
49. Not relevant.
50. PAP code transmitted.
51. PAP id transmitted.
488
52. Length in bytes of the last PAP message transmitted.
53. Last PAP message transmitted.
54. The last time an PAP message was transmitted.
55. Not relevant.
56. CHAP code transmitted.
57. CHAP id transmitted.
58. Length in bytes of the last CHAP message transmitted.
59. Last CHAP message transmitted.
60. The last time an CHAP message was transmitted.
61. Number of ‘Success’ CHAP messages transmitted.
62. Number of ‘Fail’ CHAP messages transmitted.
489
## 2310 LEVEL = 10, 11

Slip port statistics
---------------------
Number of succefull transmissions : %%1
Number of failed transmissions : %%2
Number of successfull bytes received : %%3
Number of times failed receiving byte: %%4
Number of pulled bytes by Fusion : %%5
Size of last transmitted frame : %%6
Number of transmitted rejected frames: %%7
Number of times driver was stopped : %%8
Number of times failed stop driver : %%9
Number of times got AT response during Slip/PPP session: %%10
Number of times disconnected by force : %%11
Number of timeouts when bringing device up : %%12
Number of timeouts when bringing device down : %%13
Number of times failed alloc LCP msg : %%14
Number of times failed alloc IPCP msg : %%15
Number of times got bad PPP frame with invalid size : %%16
Number of times got bad PPP frame with invalid frame : %%17
Number of times PPP failed authentication phase : %%18
Number of times PPP failed obtain IP address : %%19
Number of times got invalid ICMP message : %%20
Number of times bytes available in FUSION heap : %%21
Last Time received msg : %%22

Last msg received len : %%23
Last msg received : %%24
Last Time transmit msg : %%25
Last msg transmitted len: %%26
Last msg transmitted : %%27
Number of times got bad IP Address : %%28
Number of time disconnect because of idle timeout : %%29
Number of times failed get echo reply from radio : %%30
Number of times failed send echo request to radio : %%31
1. Number of frames successfully sent from the RTU to the Radio/Link over SLIP line.
2. Number of frames unsuccessfully sent from the RTU to the Radio/Link over SLIP line.
3. Number of bytes received.
4. Number of bytes received by the RTU which could not be processed.
5. Not relevant.
6. Size in bytes of the last transmitted datagram.
7. Number of rejected transmissions of datagrams when the driver was paused. The driver is paused
when initializing modem (e.g. iDEN) using AT commands.
8. Number of times the driver was paused.
9. Number of times failed to pause the driver.
10. Number of times got AT response (such as ERROR, +CME ERROR, AT, ATH) when Slip/PPP was
connected. This denotes a modem error, which forces RTU to disconnect Slip/PPP.
490
11. Number of times disconnected by force (for example when CD drops.)
12. Number of times timeout expired when trying to connect Slip/PPP.
13. Number of times timeout expired when trying to disconnect Slip/PPP.
14. Number of times failed alloc LCP message. Denotes lack of internal resources.
15. Number of times failed alloc IPCP message. Denotes lack of internal resources.
16. Number of bad PPP with invalid size received.
17. Number of times bad PPP frames with invalid CRC received.
18. Number of times failed authenticate PPP when connecting.
19. Number of times failed to obtain an IP Address from the modem when connecting.
20. Number of times got bad ICMP message from the modem (with source IP Address 0). (Tetra bug)
21. Number of bytes currently available in internal heap for TCP/IP stack (sockets/PPP, etc.)
22. Last time received Slip/PPP message from port. Relevant when driver is connected or trying to
connect.
23. Length of last Slip/PPP message received.
24. Last Slip/PPP message received.
25. Last time transmitted Slip/PPP message from port. Relevant when driver is connected or trying to
connect.
26. Length of last Slip/PPP message transmitted.
27. Last Slip/PPP message transmitted.
28. Number of times obtained bad IP Address (0.0.0.0) from radio/modem during PPP connect. As a
result, the PPP connection failed.
29. Number of times PPP or SLIP is disconnected because the idle timeout expired. Idle timeout is
"Maximal no reception time to declare disconnect [sec]" in 2300 (level 0). It can be set from the site
configuration or from a modem configuration file. This statistic shows how many time it has expired
with no data being received, causing the radio/modem to be disconnected and reconnected.
30. Number of times sent PPP echo request to modem/radio but got no reply.
31. Number of times failed to transmit PPP echo request to modem/radio.
## 2398
PPP is not created on this port
User has tried issue level 1 or 2 for SLIP port (##2301 or ##2302). Port is not PPP.
491
## 2399
PPP was not initialized yet try again later
User has tried issue level 1 or 2 for PPP port (##2301 or ##2302). Port is still initializing and cannot
provide data. Try again later.
IPLINK LINxL
## 2500 LEVEL = 100

RCP user parameters
--------------------
Radio IP address : %%1
RCP IP port : %%2
RTU sets radio in encrypted mode : %%3
Time to wait while diagnosing radio [millisec] : %%4
1. IP address of radio.
2. Should always be 469.
3. If radio is encrypted, this parameter will be Yes. If radio is in clear, this parameter will be No.
4. Radio diagnose reply timeout, as defined in Site Configuration.
## 2501 LEVEL = 101

Status of RCP
--------------
Is radio being configured : %%1
Has configuration of radio failed : %%2
RCP request of which configuration failed : %%3
Last request SDU tag number : %%4
Last request sent to radio : %%5
Is radio registered in infrastructure : %%6
Is data service not available : %%7
Is ICMP:Network unreachble received : %%8
Has radio failed transmission due to encryption problem : %%9
Last report received from radio : %%10
Is port in 'Fail' mode : %%11
1. If RTU is configuring radio (radio startup, RTU startup or when making connection), this will be yes.
In this case, the data will remain pending until it can be transmitted.
2. Whether the configuration of the radio has failed. If so, data cannot be transmitted by way of the
link/radio.
3. Describes which configuration message failed.
4. Sequential number of configuration message last sent to radio.
5. Indicates last type of operation.
6. Indicates whether radio succeeded in registering in the infrastructure.
492
7. Whether data service is unavailable (This might be the reason for failure to register in infrastructure.)
8. Whether network is unreachable (This might be the reason for failure to register in infrastructure.)
9. Not relevant.
10. The string which the radio returns (RF ACK).
11. Indicates whether port is in failed mode. (as in ## 2200)
## 2502 LEVEL = 102

RCP socket status
--------------------
Socket number : %%
Socket state : %%
Socket timeout : %%
Socket open latest result : %%
Socket send latest result : %%
Socket recv latest result : %%
Not relevant.
## 2503 LEVEL = 103

Radio configuration
--------------------
Encryption mode: %%
Indicates whether radio is in Encryption mode or not.
## 2504 LEVEL = 104

Radio information
-------------------
Radio's software version : %%
Radio's manufacturer : %%
Radio's current CAI logic link ID : %%
Radio's maximum transfer unit : %%
Radio's serial number : %%
Radio's registeration status : %%
Radio's channel quality : %%
Radio's signal strength : %%
Radio's battery level : %%
Basic information from radio.
493
## 2505 LEVEL = 105

Encryption failue info:
-----------------------
%%
RTU sets radio in encrypted mode: %%
Encryption mode of radio : %%
Indicates if there is a contradiction between the radio’s actual encryption mode and the encryption mode
according to the RTU.
## 2510 LEVEL = 110, 111

RCP statistics in RTU
----------------------
Number of requests issued to radio : %%1
Number of requests aborted by RTU : %%2
Number of relevant replies received from radio : %%3
Number of irrelevant replies received from radio : %%4
Number of reports received from radio : %%5
Number of irrelevant reports received from radio : %%6
Number of 'power up' reports received from radio : %%7
Number of 'not registered' reports received from radio : %%8
Number of 'data service' reports received from radio : %%9
Number of 'encryption state' reports received from radio : %%10
Number of 'encryption failed' reports received from radio: %%11
Number of invalid reports/replies received from radio : %%12
Number of ICMP Netowrk unreachable received from radio : %%13
Number of ACK reports received from the radio : %%14
Last Destination IP Address that received ACK for : %%15
1. Number of requests sent from the RTU to the radio.
2. Number of times the RTU aborted transmission of a request due to timeout.
3. Number of replies from the radio (should match the number of requests.)
4. Number of replies from the radio which were discarded.
5. Number of reports from the radio.
6. Number of reports from the radio which cannot be deciphered by the RTU.
7. Number of reports from the radio of type “data service”.
8. Number of reports from the radio of type “not registered”.
9. Number of reports from the radio of type “encryption state”.
10. Number of reports from the radio of type “encryption failed”.
11. Number of reports from the radio of type “encryption failed”.
12. Number of reports/replies received from radio which were illegal.
13. Number of messages received from radio that ICMP Network is unreachable.
14. Number of Acknowledgements from the infrastructure on message that were sent.
494
15. Last Destination IP Address for which an acknowledgement was received.
## 2520 LEVEL = 100

IPMODM user parameters
----------------------
Learn IP address from modem : %% 1
RTU IP address : %% 2
RTU's gateway IP address : %% 3
RTU Subnet mask : %% 4
DTE IP Address in modem : %% 5
DTE Subnet mask in modem : %% 6
Home Agent in modem : %% 7
Modem IP Address : %% 8
Modem version : %% 9
Getting "OK" timeout from modem [millisec]: %% 10
Time to wait for ATD to succeed [millisec]: %% 11
Time to wait for modem to be configured [millisec]: %% 12
Optional string to send before dialing : %% 13
Radio Sampling time for RALP prototol [millisec] : %% 14
Connect to : %%15
Disconnect on ICMP:Network Unreachable reception? : %%16
Is Abort Sequence supported in the modem ? : %%17
Ignore CD Signal ? : %%18
Maximal Rx Idle time to disconnect [seconds ] : %%19
Modem address (if exist) : %%20
Registration life time to disconnect [seconds] : %%21
Parameters for packet data modem (e.g. iDEN).
1. YES if the port’s IP address is to be retrieved during run time, e.g. from iDEN modem.
2. Current RTU’s IP address.
3. Current RTU’s default gateway.
4. Current RTU’s subnet mask.
5. The IP address of the modem’s configured RTU as stored in the modem.
6. The subnet mask address of the modem’s configured RTU as stored in the modem.
7. The home agent configured for the modem (to be used as the RTU’s default IP address.)
8. The IP address of the modem.
9. The OEM version of the modem (should be R35.01.00 or later).
10. Timeout in milliseconds for getting an OK response when sending an AT command.
11. Timeout in milliseconds to wait for the modem to succeed in registration (if needed) and go online.
12. Timeout in milliseconds to wait for the modem to be configured. To be used when transmitting while
the modem is being configured. If this time elapses, transmission will fail. Refer to Modem
configuration timeout parameter in the Site Configuration Advanced Link Layer.
495
13. Optional AT command string to send to modem before dialing. Used by the RTU to override default
settings in the modem. Refer to technical support if needed.
14. Radio sampling time in milliseconds that RALP will poll the radio registration status. Relevant only if
RALP is enabled.
15. Device to which the RTU is connected (iDEN,Tetra, Standard Modem, or Null Modem).
16. YES, if the RTU should disconnect Slip/PPP when getting an ICMP:Destination Unreach message.
17. YES, if the modem supports abort sequence. An abort sequence is +++ issued after a pause of 1
second and followed by another pause of 1second. If YES, the modem should switch to command
mode when this sequence is issued by the RTU. The modem may or may not disconnect from PD
channel. Tetra or Novatell (CDPD) for example do not support it, but most modems do (for example
iDEN or G18).
18. Never, if CD is being polled constantly. This includes the time while Slip/PPP is being connected and
when the connection is established. When CD drops, the modem will be disconnected by the RTU.
Always, if CD is never checked. It is assumed that it is active all the time, so its state does not denote
Slip/PPP state.
When connecting, if CD is ignored during Slip/PPP connection but polled when connection is
established.
19. Maximal Rx idle time to disconnect in seconds. If no data is received from the port for this period of
time, Slip/PPP will be disconnected. If this parameter is 0, it will never be checked.
20. The address of the modem which is read from the modem using an AT command during
configuration. (i.e. IMEI in iDEN, ISSI in TETRA, IMSI in GPRS, WUID in ASTRO IV&D)
21. Timeout in seconds to disconnect after registration life time expires. If 0 it is not relevant. This
parameter can be set by the user in the modem configuration file, or in the site configuration. For
iDEN, this parameter is automatically retrieved from the modem during connection.
496
## 2521 LEVEL = 101

IPMODM state
------------
Is modem being configured ? : %% 1
State of configuration task : %% 2
Is CD active ? : %% 3
Has modem configuration been aborted ? : %% 4
Is Modem registered in the system ? : %% 5
Cause for configuration failure : %% 6
Last command that was sent to Modem : %% 7
Response received from modem that caused failure : %% 8
Time it took to configure modem [millisec] : %% 9
Is port being locked ? : %%10
Last time started configure modem : %%11
Command sent to modem that caused failure : %%12
Is in transparent mode : %%13
Task that is locking port : %%14
Time to wait to begin modem configuration [milli]: %%15
Time it took to connect modem [millisec] : %%16
Maximal idle timeout to disconnect [millisec] : %%17
Registration life time to disconnect [millisec] : %%18 (%%19)
1. YES if modem is in the process of being configured. In this case, it operates in command mode, and it
cannot transmit data.
2. Connected and Registered should be displayed if the modem is online. In online mode, the modem
can transmit data.
3. YES if the CD pin is active. If YES, the modem is connected and is in online mode.
4. Internal use only.
5. YES if the packet data modem is registered in the system.
6. If last modem configuration failed, display the reason for the failure.
7. The last AT command which was sent to the modem when configuring it.
8. If modem configuration has failed, display the last response from the modem that caused this failure
(No Response if there was none).
9. Time in milliseconds that it took to configure the modem last time. Relevant only if modem
configuration has succeeded. Note that it does not denote the actual time the modem has been in
command mode, just the last cycle.
10. Should be YES when configuring the modem.
11. Marks the time that last started to configure the modem. Along with 9, this denotes the time Slip/PPP
has been reconnected.
12. The last command sent to the modem causing it to fail and issue parameter 6.
13. Transparent mode can be set by the application locking the port.
14. Internal use.
497
15. Time to wait before starting to configure modem. Usually when configuring it remotely, this is set to
5000 milliseconds.
16. The time it took to actually connect/register modem.
17. Configuration - Maximal idle timeout to disconnect modem. The RTU will monitor reception from
modem/radio, and if not received within that time it will disconnect and connect it again. As a result
the modem/radio will reconnect with the infrastructure. If set to 0, this parameter is ignored.
18. Timeout in milliseconds to disconnect after registration life time expires. If 0 it is not relevant. This
parameter can be set by the user in the modem configuration file, or in the site configuration. For
iDEN, this parameter is automatically retrieved from the modem during connection.
19. The number of milliseconds which have passed since the 'Registration life time to disconnect' timeout
started.
## 2522 LEVEL = 102

RALP State
----------
Diagnostic timeout : %% 1
IP Port Number : %% 2
IP Address : %% 3
Was RALP initiated : %% 4
Is Communication Enabled in Radio : %% 5
Is request being executed : %% 6
Current exectued group : %% 7
Current executed opcode : %% 8
Current expected opcode : %% 9
Pointer of response buffer : %% 10
Relevant for iDEN only.
1. Time in milliseconds to wait for a response from the iDEN modem to a RALP command. Refer to
Modem diagnose reply timeout parameter in the Site Configuration Advanced Link Layer.
2. IP port number of the RALP protocol.
3. IP Address of the modem for the RALP protocol.
4. YES if a RALP session has been initiated with the modem.
5. YES if the modem has enabled RALP communication with the RTU.
6. YES if the RTU expects a RALP response from the modem.
7. Currently executed RALP command group
8. Currently executed RALP opcode.
9. Currently executed RALP opcode.
498
## 2523 LEVEL = 103

iDEN Radio Status:
------------------
Radio status : %% 1
Radio substatus : %% 2
Radio services : %% 3
Radio mobile IP : %% 4
1. Modem status.
2. Modem substatus (Packet data registered).
3. Modem supported services (e.g. packet data).
4. Accept if modem is mobile IP capable.
## 2524 LEVEL = 104

iDEN Phone Information:
-----------------------
Ralp version : %% 1
Model type : %% 2
Model number : %% 3
Serial number : %% 4
IMEI number : %% 5
Codeplug version : %% 6
DSP ROM version : %% 7
RCE ROM version : %% 8
Software Type : %% 9
This information is obtained via RALP from the modem.
1. RALP version in the modem.
2. Modem type.
3. Modem model number.
4. Modem serial number.
5. Modem electronic number (IMEI).
6. Modem codeplug version.
7. Modem software version.
8. Modem software version.
9. Modem software type.
499
## 2525 LEVEL = 105

LAPi related statistics in iDEN modem:
--------------------------------------
Number of PRAP message expirations : %% 1
Number of Inbound I PDUs sent (not including retries) : %% 2
Number of Inbound All Block Retry I PDUs sent : %% 3
Number of Inbound Retry I PDUs sent : %% 4
Number of Outbound I PDUs received (not including retries) : %% 5
Number of Outbound Retry I PDUs received : %% 6
Number of PDUs lost when the LLC receives a Local Release : %% 7
Number of PDUs lost due to an error or connection loss : %% 8
Number of Inbound user bytes requested to be transmitted : %% 9
Number of Outbound user bytes received : %%10
Number of half duplex collisions detected by the LAPi LLC : %%11
Number of SABME received because of N(R) or timeout in peer : %%12
Number of unexpected UAs received : %%13
Number of unexpected DMs received : %%14
Number of retransmissions exhausted while connect/disconnect: %%15
Number of retransmissions exhausted while transmitting I PDU: %%16
Number of N(R)s received out of valid range : %%17
Number of N(S)s received out of valid range : %%18
Number of Retry I PDUs received without Original I PDU : %%19
Number of reliable datagrams from client too big to send : %%20
Number of unreliable datagrams from client too big to send : %%21
Number of PDUs received in a state when they were invalid : %%22
The number of invalid PDUs received from FNE : %%23
The number of multiple block I PDUs with an LLC FCS error : %%24
The parameters are obtained via RALP from modem. Only the important parameters are described below:
2. Number of messages sent over the air towards the MDG/iDEN system. Not including the number of
retries in #3 and 4.
3,4. Number of retries for messages sent over the air towards the MDG.
5. Number of messages received from the MDG. Not including the number of retries in #6.
6. Number of retries received from the MDG.
9. Number of bytes transmitted over the air towards the MDG.
10. Number of bytes received over the air from the MDG.
All other parameters denote communication problems over the air. Contact system
administrator/technical support if not 0.
Note: After executing diagnostics, these parameters are reset in the modem.
Refer to iDEN documentation such as iDEN Protocol Manual 68P81129E10-B for an explanation of the
LAPi protocol and meaning of parameters.
500
## 2526 LEVEL = 106

IP Related Statistics in iDEN modem:
------------------------------------
Total number of IP Datagrams received from DTE : %% 1
Total number of Total IP Datagrams received from FNE : %% 2
Number of Valid IP Datagrams received from DTE : %% 3
Number of Valid IP Datagrams received from FNE : %% 4
Number of IP Datagrams sent to DTE : %% 5
Largest IP Datagram sent to DTE (bytes) : %% 6
Largest IP Datagram sent to FNE (bytes) : %% 7
Number of ICMP Error Messages Sent : %% 8
Number of Valid UDP Datagrams received : %% 9
Number of received UDP datagrams discarded by the MS : %%10
Number of UDP Datagrams Sent : %%11
Number of successful MIP registrations by the MS : %%12
Number of rejected MIP registrations by the MS : %%13
Number of retries MIP Registrations Requests sent by the MS: %%14
1. Number of datagrams transmitted by the RTU to the modem including RALP/diagnostics of the
modem as well as over the air data.
2. Number of datagrams transmitted by the modem to the RTU as a response, including

RALP/diagnostics of the modem as well as over the air data.
3. Number of valid datagrams received over the air from the MDG.
4. Number of valid datagrams transmitted by the RTU to the modem including RALP/diagnostics of
modem as well as over the air data.
5. Number of datagrams sent over the air to the MDG.
6. Size of largest datagram sent to the RTU. Datagram may be either MDLC data or RALP diagnostics.
7. Size of largest datagram sent over the air to the MDG/iDEN system. (data only)
8. Number of ICMP errors sent to the RTU.
9. Number of valid UDP datagrams received in the modem from the RTU or from the MDG. This does
not include the RTU’s over the air data.
10. Number of valid UDP datagrams discarded by the modem. This does not include the RTU’s over the
air data.
11. Number of UDP datagrans sent by the modem (usually RALP) towards the RTU. This does not
include the RTU’s over the air data.
12,13,14. Number of times succeeded, denied, and retried mobile IP registration with the MDG.
Note: After executing diagnostics, these parameters are reset in the modem.
501
## 2527 LEVEL = 107

iDEN modem server description
-----------------------------
Normalized battery level : %% 1
Color code : %% 2
Carrier : %% 3
Carrier RSSI (dbm) : %% 4
Carrier SQE (db) : %% 5
Battery level : %% of %% 6
Signal strength : %% of %% 7
Obtained via RALP from modem.
1. Battery level 0 to 60.
2. Color code.
3. Carrier code.
4. RSSI, received signal strength, should be more than –100 dbm.
5. SQE, received signal strength in db.
6. Battery level from 1 to 6 (highest).
7. Signal strength from 1 to 6 (highest).
## 2530 LEVEL = 110,111

IPModem statistics:
--------------------
Number of times CD has dropped : %% 1
Number of times RTU powered up : %% 2
Number of times Registration failed : %% 3
Number of times configuration timeout occured : %% 4
Number of times modem configuration has succeeded : %% 5
Number of times modem configuration has failed : %% 6
Number of times detetected that modem is not packet data : %% 7
Number of times link failed because of registration : %% 8
Number of times re-registered modem : %% 9
Number of times restarted modem : %%10
Last reason for link failure : %%11
Number of times received icmpnetunreachable : %%12
Number of times lost connection with modem (PPP) : %%13
Number of times disconnect because there was no response : %%14
Number of times failed dialup : %%15
Number of times failed hangup : %%16
Number of times failed start slip/ppp : %%17
Number of times disconnect because of idle timeout : %%18
Number of times failed set PPP parameter : %%19
Number of times disconnect because of registration timeout: %%20
1. Number of times CD became inactive, e.g. the modem was disconnected or went offline (command
mode).
2. Number of times the RTU powered up (cold or warm restart).
3. Number of times the modem was online and got deregistered from the infrastructure.
502
4. Number of times the configuration timeout elapsed. This may happen when configuration takes
longer than the time specified by the user in the Modem configuration timeout parameter in the Site
Configuration Advanced Link Layer. If data was transmitted while the modem was being configured,
that data may have been lost.
5. Number of times that configuration succeeded.
6. Number of times that configuration failed. When failed, the RTU keeps reconfiguring the modem in
cycles until it succeeds. This number denote how many configuration cycles have failed.
7. Number of times the RTU failed to register the modem because it is not data packet capable. (The
modem is probably not registered in the infrastructure database.)
8. Not relevant (future use).
9. Number of times the RTU deregistered and reregistered the modem by force.
10. Number of times the RTU restarted the modem (usually because of registration problems).
11. Last event that caused the port to be failed: Modem configuration failed, or modem became
deregistered from the infrastructure.
12. Number of ICMP:Destination unreach messages received of type Network unreachable.
13. Number of times the PPP connection was dropped.
14. Number of times the Slip/PPP connection was disconnected because it failed to respond for RALP
requests. Relevant for iDEN.
15. Number of times failed to issue ATD (dialup) command to modem.
16. Number of times failed to issue ATH (disconnect) command to modem (there was no response).
17. Number of times failed to connect Slip/PPP.
18. Number of times the connection was disconnected because the idle timeout expired with no data
coming in from the modem/radio. This is relevant if (17) in @2521 (level 101) is not 0.
19. Number of times failed to set the PPP parameters.
20. Number of times the connection was disconnected because of the Registration life time parameter.
Note: Activating this message with level 110 will reset these parameters.
503
## 2531 LEVEL = 102, 103, 104

PDS Mib state
---------------
Wait for Context Timeout : %% 1
SNMP IP Port : %% 2
Trap IP Port : %% 3
MIB Name : %% 4
Is PDS Mib initiated ? : %% 5
Radio Context state : %% 6
Radio Registration state : %% 7
Is SNMP Session locked : %% 8
SNMP session locking Task name : %% 9
SNMP session state : %%10
Relevant for ASTRO IV&D only.
1. Configuration parameter in milliseconds. How long to wait until the ASTRO IV&D radio gets context
activated. If this time expires, the radio will be reconnected by the RTU. Sometimes it will even be
restarted (via AT command).
2. Configuration parameter - IP (UDP) Port for SNMP poll communication issued by RTU, when
reading radio state.
3. Configuration parameter - IP (UDP) Port for SNMP trap communication issued by radio to RTU,
when changing radio context activation state.
4. OID of MIB used to read the radio's context activation state. This is referred to as PDS (Packet Data
System) MIB.
5. If Yes, the MIB was initialized.
6. Internal RTU's state – Whether or not it is waiting for context to be activated.
7. Radio context activation state.
8. Not relevant.
9. Not relevant.
10. Shows the RTU's state in relation to reading radio status.
## 2532 LEVEL = 102, 103, 104

PDS Mib table
---------------
Table MIB OID: : %% 1
Last Last
Set Get Number Number Number
Subid Type Value Description Error Error Set Get Trap
---- ---- ----- ----------- ----- ----- --------- -------- ------
504
1. OID of MIB used to read the radio's context activation state. This is referred to as PDS (Packet Data
System) MIB.
Each row in the PDS MIB table represents a MIB variable.
Subid MIB Variable sub ID.
Type 2 – Integer.
Value This field depends upon the variable.
Description This field depends upon the variable.
The important variables are in row 2 and 4:
-In row 2 (subid 2.1.2) pdsDataregsts - should be 1.
Indicates whether the subscriber is registered on the packet data system (i.e. context activated).
If 1 it is context activated. If 2, a previous attempt to register failed.
-In row 4 (subid 2.1.4) pdsDataActivitySts - should be 1.
Indicates whether the subscriber is on the packet data channel or not. This variable is set to 1
(active) when the subscriber switches to the packet data channel and to 0 (inactive) when it is no
longer on the packet data channel.
Other variables are as follows:
In row 1 (subid 2.1.1) unitId - always 0.
In row 3 (subid 2.1.3) pdsDataRegRequest – The RTU sets it to 1 when it wishes to make a data
registration request (or context activation) on the packet data system. After it
has been completed this variable is set to 0 by the radio.
In row 5 (subid 2.1.5) pdsPPPLinkSts - Always 0.
Last Set error Shows the error code after fail to set a variable to the radio, usually 0.
Last Get error Shows the error code after fail to get a variable from the radio, usually 0.
Number Set Number of times set a variable in the radio in the form XX/YY.
XX - shows number of times succeed set a variable.
YY - shows number of times failed set a variable.
Number Get Number of times got a variable from the radio in the form XX/YY.
XX - shows number of times succeed get a variable.
YY - shows number of times failed set a variable.
Number Trap Number of times received traps from the radio for that variable
505
## 2533 LEVEL = 102, 103, 104

PDS SNMP State
---------------
Number of free PDUs : %% 1
Maximal number of free PDUs : %% 2
Number of free Vars : %% 3
Maximal number of Vars : %% 4
Last request ID sent : %% 5
Number of ASN1 parse errors : %% 6
Number of bad SNMP packets received : %% 7
Last error with SNMP operation : %% 8
1. Current number of free PDUs (packet data units) used for communication over SNMP with the radio.
2. Configuration parameter for number of PDUs (Packet data units) used for communication over
SNMP with the radio.
3. Current number of free entities used to represent SNMP MIB variables.
4. Configuration parameter for maximum number of free entities used to represent SNMP MIB
variables.
5. Last SNMP request ID sent to the radio.
6. Number of errors when parsing received frames in SNMP protocol (ASN1) from the radio.
7. Number of illegal SNMP frames received from the radio.
8. Last error code when doing a set/get SNMP operation with the radio.
## 2534 LEVEL = 210, 211

PDS MIB Statistics
-------------------
Number of times activate context sent : %% 1
Number of times activate context timeout : %% 2
Number of times activate context failed : %% 3
Number of times check registered : %% 4
Number of times check registered failed : %% 5
Number of times gained register : %% 6
Number of times lost register : %% 7
Number of times trap ignored : %% 8
Number of times received pdsmib trap : %% 9
Number of times ignored unexpected variable in trap : %% 10
Number of times ignored varibale in pdsmib trap : %% 11
Number of times got pdsmib variables through a trap : %% 12
1. Number of times RTU sent context activate request to the radio via SNMP.
2. Number of times RTU got timeout when trying to context activate the radio.
3. Number of times RTU failed to context activate the radio.
506
4. Number of times RTU checked if radio is still context activated.
5. Number of times RTU failed check radio state.
6. Number of times radio got context activated.
7. Number of times radio lost registration (became context deactivated).
8. Number of times RTU received a trap from the radio and ignored it.
9. Number of times RTU received a trap from the radio.
10. Number of variables RTU ignored when receiving a trap from the radio. This includes variables
which are legal, but are not supported.
11. Number of variables RTU ignored when receiving a trap from the radio. Unlike previous item, this
counts variables which are illegal.
12. Number of variables RTU received from the radio via traps.
## 2540 LEVEL = 210,211

RALP statistics:
----------------
Number of times failed lock RALP : %% 1
Number of times posted a request : %% 2
Number of times aborted request : %% 3
Number of times got response for requests : %% 4
Number of times got unsolicited alarms : %% 5
Group of last response received from radio : %% 6
Opcode of last response received from radio : %% 7
Last alarm received from radio : %% 8
Number of software alarms received from radio : %% 9
Last software alarm error : %%10
Last software alarm task name : %%11
Number of registration alarms received from radio : %%12
Last registration alarm code : %%13
Last registration alarm roaming : %%14
Last registration alarm domain : %%15
Number of times have got invalid alarm : %%16
Number of times have got invalid reponse (not alarms) : %%17
Number of times ignored responses : %%18
Number of times ignored alarms : %%19
Number of times got 'Failed execute' alarm : %%20
Relevant only if RALP is enabled.
2. Number of times a RALP request was sent to the modem.
3. Number of times aborted RALP when waiting for a reply from the modem.
4. Number of times a response was received for RALP requests from the modem.
5. Number of times unsolicited alarms weres received from the modem (registration/software etc).
6. Group of last RALP response received from the modem.

507
7. Opcode of last RALP response received from the modem.
8. Code of last alarm received from the modem.
9,10,11- Number of software alarms received from the modem, and specific parameters of the last one
received.
12,13,14,15. Number of registration alarms received from the modem, and specific parameters of the last
one received.
16. Number of times an alarm was received denoting that a RALP request was invalid.
17. Number of times invalid messages were received via RALP socket from the modem.
18. Number of times that responses which were received from the modem were ignored.
19. Number of times that alarms which were received from the modem were ignored.
20. Number of times the modem failed to execute a RALP request sent from the RTU.
## 2541 LEVEL = 220

Standard Modem state
--------------------
Block ID of file : %% 1
Has file been downloaded : %% 2
Number of seconds to wait for OK : %% 3
Number of seconds to wait while dialing : %% 4
Number of seconds to wait while diagnosing : %% 5
Number of seconds to wait before unset RTS : %% 6
Number of seconds to wait after unset RTS : %% 7
Last error when sending command to modem : %% 8
Number of times Toggled RTS : %% 9
Last error from modem : %% 10
Last command that transmitted to modem : %% 11
Last command that caused modem error : %% 12
Ignore CD ? : %% 13
Is abort sequence supported in modem ? : %% 14
Has last transmission to modem been aborted? : %% 15
Need to toggle RTS when entering command mode ? : %% 16
Has new file need to be initialized ? : %% 17
Standard modem name : %% 18
Number of milli seconds to Wait for quiet : %% 19
File version : %% 20
File features bit mask in hexa : %% 21
File current processed line : %% 22
Last AT response from modem : %% 23
1. Block id of file 42 is Port 1; Block id of file 43 is Port 2; Block id of file 44 is Port 3.
2. Has the modem configuration file been downloaded?
3. When sending an AT command to the modem, the time to wait for its reply.
4. Time to wait while dialing.
5. Time to wait while diagnosing the modem via AT command.
508
6. Time to wait before resetting RTS (turning off modem if applicable).
7. Time to wait after resetting RTS (turning on modem if applicable).
8. Internal use.
9. The number of times tried to reset modem because failed to configure it.
10. Internal use.
11. The last AT command that was sent to the modem.
12. The last AT command that failed.
13. Should the modem CD (DCD) signal be ignored when connecting?
14. Is the abort sequence (+++) supported by the modem? If YES, the modem supports the abort
sequence (+++) when moving from data to command mode.
15. Internal use.
16. Do we need to toggle RTS when entering command mode? If YES, each time move from data to
command mode, RTS will be turned off and on.
17. Internal use.
18. The name of the modem according to the modem configuration file.
19. Timeout (in milliseconds) to wait when expecting an AT response after getting a partial answer
(something received which is not the expected response.)
20. The modem configuration file version.
21. Internal use.
22. Current line processed in file.
23. Last AT response replied by modem.
## 2542 LEVEL = 102

Standard modem File variables
-----------------------------
Variable Value
-------- -----
When a Standard Modem is used, this level shows obtained variables as set in the downloadable IP
Modem file.
The Variable column shows the variable name, according to the file. The Value column shows its
contents, either initialized in the file or read from the modem.
509
## 2543 LEVEL = 103

%% times toggled RTS : %% 1
1. The number of times toggled RTS (tried to restart modem) because configuration failed.
## 2544 LEVEL = 104

Standard Modem %% : %% 1
1. The modem diagnostics according to the [Diag0] - [Diag7] sections in the modem configuration file.
## 2545 LEVEL = 105

Standard Modem File : %% 1
1. The modem configuration file that was downloaded and used when configuring the modem by the
system.
## 2597
Section %% not found in file
The Diag[n] section number related to the level does not appear in the modem configuration file.
## 2598
Failed communicate with radio
Indication that communication with radio has failed. (Occurs when response from the radio times out.)
## 2599
Communication with radio already in progress - please try again
Occurs when configuring modem, and it cannot be diagnosed using RALP over SLIP (SLIP has not been
initiated).
DMAP27 DEVICE = RADxD
## 2700 LEVEL = 0
Dmap27 information :
Partner site :%%1
Net key :%%2
Link key :%%3
Imap27 key :%%4
1. Other Site ID talked/talking to.
510
2. Network (upper) layer key address.
3. LINK (lower) layer key address.
4. IMAP27 layer key address.
## 2710 LEVEL = 10,11

Dmap27 counter information :
Number ok txframes :%%1
Number bad txframes :%%2
Number reject txframes :%%3
Number returned txframes :%%4
Number ok rxframes :%%5
Number bad rxframes :%%6
Last netpush err :%%7
1. Number of MDLC frames transmitted successfully by the LINK.
2. Number of MDLC frames not transmitted successfully by the LINK.
3. Number of MDLC frames rejected by the LINK.
4. Number of MDLC frames returned back from the LINK.
5. Number of MDLC frames received successfully.
6. Number of MDLC frames not received successfully by the LINK.
7. Last error number generated while calling net_push_frame.
511
MPT1327 (PHYSICAL MODULE) DEVICE = RADxP
## 2750 LEVEL = 0
**********************
* MPT1327 DEVICE KEY *
**********************
pointer to device key : %%0
---------------------------
sync part of the data table
---------------------------
sync_mode (hdlc mode) : %%1
sync_rate (data rate) : %%2
sync_chan_backup_ptr (pointer to channel device name): %%3
sync_chan_data_ptr (pointer to channel device data): %%4
sync_signal (sync communication signal) : %%5
sync_time_lock (sync SYNCRONIZATION latch lock): %%6
sync_time_data (sync SYNCRONIZATION latch data): %%7
sync_holdup_time (replaces the holdup parameter in the radio model):%%8
sync_max_tx_empty_wait (max time to wait until TXD_EMPTY will occur):%%9
sync_rts (sync RTS mode automatic "0" or on "1" ):%%10
sync_sync_delay (syncs Channels Delay in Msec Units): %%11
----------------------------
async part of the data table
----------------------------
async_rate (CONTROL RATE) : %%12
async_signal (async communication signal) : %%13
async_mode (ASYNC MODE) : %%14
async_tx_grant (ASYNC tx grant): %%15
------------------------------
general part of the data table
------------------------------
sync (Number of idles to close reception): %%16
working_mode (SYNC_MODE "1" or ASYNC_MODE "0" ) : %%17
channel_valid_flag (channel open "1" channel close "0"): %%18
heap_data_ptr (pointer of heap device data): %%19
mask_backup (mpt1327 communication device mask) : %%20
syst_backup (mpt1327 communication device syst) : %%21
unit_backup (mpt1327 communication device unit) : %%22
null_backup (mpt1327 communication device null) : %%23
user_backup (mpt1327 communication device user) : %%24
sync_max_rx_quiet (max rx quiet): %%25
0. Pointer to the memory address of the device key.
1. HDLC mode register values (later on downloaded to SCM1 (Mode register)).
2. HDLC rate register values (later on downloaded to SCON1 (rate register)).
3. Backup of channel device name.
4. Memory pointer to channel device data.
512
5. Signal parameter, contains the status of the system (HDLC mode).
6. Sync SYNCRONIZATION latch lock.
7. Sync SYNCRONIZATION latch data.
8. Sync holdup time. Replaces the holdup parameter in the radio model. Its purpose is to set holdup
time in the transmit mechanism.
9. Maximum time to wait until TXD_EMPTY occurs.
10. Sync RTS mode automatic "0" or on "1".
11. Sync Channel’s Delay in Msec units.
12. CONTROL RATE, MAP27 baud rate (9600 default).
13. Signal parameter, contains the status of the system (UART mode).
14. UART mode register values (later on downloaded to SCM1 (Mode register)).
15. ASYNC TX grant parameter (UART mode).
16. Number of idles to close reception.
17. Working mode of the model (SYNC_MODE="1" or ASYNC_MODE="0" ).
18. This parameter indicates if the voice channel is open or not (channel open="1" channel close="0").
19. Pointer of heap device data.
The following parameters are received from the link layer and stored here for backup; They are used in
the change mode routine.
20. MPT1327 communication device mask.
21. MPT1327 communication device system.
22. MPT 1327 communication device unit.
23. MPT 1327 communication device null.
24. MPT 1327 communication device user.
25. Maximum RX quiet time parameter.
513
## 2751 LEVEL = 1
******************************
* MPT1327 hardware registers *
******************************
CURRENT MODE (from device key) : %%1
ASYNC_MODE=0 , SYNC_MODE=1
SCON1 (Config register) : %%2

ASYNC_MODE = 00D6 h
SYNC_MODE = 30D6 h
SCM1 (Mode register) : %%3

ASYNC_MODE = 013D h
SYNC_MODE = 093C h
DSR1 (Data sync register) : %%4

ASYNC_MODE = 7E7E h
SYNC_MODE = 7E7E h
SCCE1 (Event register) : %%5

ASYN (CTS,CD,IDL,BRK,CCR,BSY,TX,RX)
SYNC (CTS,CD,IDL,TXE,RXF,BSY,TXB,RXB)
SCCM1 (Mask register) : %%6

ASYNC_MODE = 1F h
SYNC_MODE = 1F h
SCCS1 (Status register) : %%7

ASYNC_MODE = 07 h
SYNC_MODE = 06 h
*****************************
* PORT A REGISTERS (PORT 3) *
*****************************
PACNT (PORT A Control register) : %%8
ASYNC_MODE = 0373 h
SYNC_MODE = 0373 h
PADDR (PORT A DATA direction register): %%9

ASYNC_MODE = 1884 h
SYNC_MODE = 1884 h
PADAT (PORT A DATA register) : %%10

ASYNC_MODE = AB23 h
SYNC_MODE = AB23 h
The contents of each hardware register are shown. For each register, the preset value is
displayed for both ASYN (MAP27) and SYNC (HDLC) modes. The user should verify the
current state of the system (Async or Sync) before comparing the contents of the register to one
of the preset values.
1. CURRENT MODE of operation.(ASYNC_MODE=0 , SYNC_MODE=1)
2. SCON1 register parameters (See MC68302 Manual Pages 4-28,4-49)
3. SCM1 register parameters (See MC68302 Manual Pages 4-31,4-49)
514
4. DSR1 register parameters (See MC68302 Manual Page 4-119)
5. SCCM1 register parameters (See MC68302 Manual Page 4-44)
6. SCCE1 register parameters (See MC68302 Manual Page 4-44)
7. SCCS1 register parameters (See MC68302 Manual Page 4-44)
8. PACNT (PORT A Control register parameters) (See MC68302 Manual Page 3-33)
9. PADDR (PORT A Direction register parameters) (See MC68302 Manual Page 3-35)
10. PADAT (PORT A DATA register parameters)
## 2752 LEVEL = 2
********************************************
* MPT1327 SPECIFIC PARAMETERS (ASYNC MODE) *
********************************************
MAX_IDL (Maximum IDLE Characters (Receive)) : %%1
IDLC (Temporary Receive IDLE Counter) : %%2
BRKCR (Break Count Register (Transmit)) : %%3
---------------------------------------------------
PAREC (Receive Parity Error Counter) : %%4
FRMEC (Receive Framing Error Counter) : %%5
NOSEC (Receive Noise Counter) : %%6
BRKEC (Receive Break Condition Counter) : %%7
---------------------------------------------------
UADDR1 (UART ADDRESS Character 1) : %%8
UADDR2 (UART ADDRESS Character 2) : %%9
---------------------------------------------------
RCCR (Receive Control Character Register): %%10
CHARACTER1 (CONTROL Character 1) : %%11
See MC68302 Manual Pages 4-53 to 4-55.
1. Maximum IDLE Characters (Receive) (UART mode)
2. Temporary Receive IDLE Counter (UART mode)
3. Break Count Register (Transmit) (UART mode)
4. Receive Parity Error Counter (UART mode)
5. Receive Framing Error Counter (UART mode)
6. Receive Noise Counter (UART mode)
7. Receive Break Condition Counter) (UART mode)
8. UART ADDRESS Character 1 (UART mode)
515
9. UART ADDRESS Character 2 (UART mode)
10. Receive Control Character Register (UART mode)
11. CONTROL Character 1 (UART mode)
## 2753 LEVEL = 2
*******************************************
* MPT1327 SPECIFIC PARAMETERS (SYNC MODE) *
*******************************************
C_MASK_L (Constant see book) : %%1
C_MASK_H (Constant see book) : %%2
TCRC_L (Temp Trasmit CRC low) : %%3
TCRC_H (Temp Trasmit CRC High) : %%4
---------------------------------------------------
DISFC (Discard Frame Counter) : %%5
CRCEC (CRC Error counter) : %%6
ABTSC (Abort Sequence Counter) : %%7
NMARC (Nonmatching Address Received Counter : %%8
RETRC (Frame Retransmission Counter) : %%9
---------------------------------------------------
MFLR (Max Frame Length Register) : %%10
MAX_cnt (Max Length Counter) : %%11
---------------------------------------------------
HMASK (User-Defined Frame Address MASK) : %%12
HADDR1 (User-Defined Frame Address) : %%13
See MC68302 Manual Pages 4-81 to 4-83.
1. Constant see book (HDLC mode)
2. Constant see book (HDLC mode)
3. Temp Trasmit CRC low (HDLC mode)
4. Temp Trasmit CRC High (HDLC mode)
516
5. Discard Frame Counter (HDLC mode)
6. CRC Error counter (HDLC mode)
7. Abort Sequence Counter (HDLC mode)
8. Nonmatching Address Received Counter (HDLC mode)
9. Frame Retransmission Counter (HDLC mode)
10. Max Frame Length Register (HDLC mode)
11. Max Length Counter (HDLC mode)
12. User-Defined Frame Address MASK (HDLC mode)
13. User-Defined Frame Address (HDLC mode)
517
## 2754 LEVEL = 3
*******************************
* MPT1327 DESCRIPTORS STATUS *
*******************************
RECEIVE INDEX (RECEPTION INDEX) : %%1
TRANSMIT INDEX (TRASMITION INDEX) : %%2
-----------------------------------------------
RECEIVE ! STATUS ! LENGTH ! BUFFER
-----------------------------------------------
(RXBD0) : %% ! %% ! %%3
(RXBD1) : %% ! %% ! %%4
(RXBD2) : %% ! %% ! %%5
(RXBD3) : %% ! %% ! %%6
(RXBD4) : %% ! %% ! %%7
(RXBD5) : %% ! %% ! %%8
(RXBD6) : %% ! %% ! %%9
(RXBD7) : %% ! %% ! %%10
----------------------------------------------
-----------------------------------------------
TRANSMIT ! STATUS ! LENGTH ! BUFFER
-----------------------------------------------
(TXBD0) : %% ! %% ! %%11
(TXBD1) : %% ! %% ! %%12
(TXBD2) : %% ! %% ! %%13
(TXBD3) : %% ! %% ! %%14
(TXBD4) : %% ! %% ! %%15
(TXBD5) : %% ! %% ! %%16
(TXBD6) : %% ! %% ! %%17
(TXBD7) : %% ! %% ! %%18
----------------------------------------------
1. Current RECEIVE INDEX (RECEPTION INDEX)
2. Current TRANSMIT INDEX (TRANSMISSION INDEX)
3. #3-#10 Receive descriptors (See MC68302 Manual Pages 4-66 to 4-70, 4-88 to 4-91.)
4. #11-#18 Transmit descriptors (See MC68302 Manual Pages 4-71 to 4-80, 4-92 to 4-96.)
## 2760 LEVEL = 10,11

----------------------------------------
MPT1327 hardware/software last status :
----------------------------------------
Discard frame counter (DISFC) : %%1
Crc error counter (CRCEC) : %%2
Abort sequence counter (ABTSC) : %%3
Non matching address counter (NMARC) : %%4
Frame retransmit counter (RETRC) : %%5
Async receive descriptors full (counter): %%6
Async transmit descriptors full (counter): %%7
1. Number of times a frame was discarded.
2. Number of frames with a CRC error.
518
3. Number of Abort sequences.
4. Number of frames with non-matching addresses.
5. Number of frames which had to be retransmitted.
6. Counter which measures if the Async receive descriptors are full. This number should be zero. If
not, there might be a problem with the values of the radio’s timers. This should be checked
using the RSS of the radio)
7. Counter which measures if the Async transmit descriptors are full. This number should be zero. If
not, there might be a problem with the values of the radio’s timers. This should be checked
using the RSS of the radio)
IMAP27
## 2800 LEVEL = 0
Imap27 information :
Map27 state :%%1
IMap27 mode :%%2
Link ready :%%3
1. Map27 state: One of: “Idle", "OutCallWait", "Active", "WaitForDisconnect".
2. Map27 mode One of: “CONTROL", "DATA".
3. MAP27 link to the local radio indication.
## 2801 LEVEL = 1
Imap27 States information :
Map27 state :%%1
IMap27 mode :%%2
Init done :%%3
Initiator bit :%%4
Warmup done :%%5
New convtable :%%6
Link ready :%%7
Failed transmit frame:%%8
Last site id :%%9
Last imap27 addr :%%10
Max txpacket size :%%11
Last txpacket size :%%12
Initiator hang count :%%13
Responder hang count :%%14
Hang count :%%15
Retry hang count :%%16
Initiate dial count :%%17
Connect2Start tx wait:%%18
Last transmitted Map27 frame:19
1. Map27 state: One of : “Idle", "OutCallWait", "Active", "WaitForDisconnect".
519
2. Map27 mode: One of : “CONTROL", "DATA".
3. Indication that Initialization was done. (1 = yes, 0 = no)
4. Indication that this site is the initiator of the call. (1 = yes, 0 = no)
5. Indication that the IMAP27 warmup process was done (dialing). (1 = yes, 0 = no)
6. Indication that a new MAP27 (to Site ID) conversion table exists.
7. Indication that a MAP27 link to the local radio is exists.
8. Indication that the attempt to transmit a frame in MAP27 protocol has failed. (1 if failed, 0 if
succeeded)
9. Last Site ID that the RTU was talking to.
10. Last MAP27 address that the RTU was talking to.
11. Maximum size of frame transmitted in MAP27 protocol.
12. Size of last transmitted frame in MAP27 protocol.
13. Number of calls hung up by the call initiator.
14. Number of calls hung up by the call responder.
15. Total number of calls hung up.
16. Number of times needed to try to hang up.
17. Number of times tried to dial in order to initiate a call.
18. Time interval between “connected” message to the transmit begin, in order to overcome MPT1327
signaling delays.
19. Content of the last transmitted MAP27 frame.
## 2802 LEVEL = 2
Map27 address convert table:
Number of entries in table :%%1
Location of current entry :%%2
Site ID Ident Prefix
======= ===== ======
%%3 %%3 :%%3
1. Number of entries in the conversion table.
2. Location in the memory of the conversion table.
3. The table’s actual data.
520
## 2810 LEVEL = 10,11

Imap27 counter information :
Number ok txmapframes :%%1
Number bad txmapframes :%%2
Number rxmapbytes :%%3
Number ok txmdlcframes :%%4
Number bad txmdlcframes :%%5
Number ok rxmdlcframes :%%6
Number bad rxmdlcframes :%%7
Number failedcalls :%%8
Number outcalls :%%9
Number accepted incalls :%%10
Number ignored incalls :%%11
Number line was cleared :%%12
Number protocol info :%%13
Number radiobusy :%%14
Last protocol info reason :%%15
Failed get buf :%%16
1. Number of Map27 frames transmitted OK.
2. Number of Map27 frames transmitted not OK.
3. Number of received MAP27 bytes.
4. Number of MDLC frames transmitted OK.
5. Number of MDLC frames transmitted not OK.
6. Number of MDLC frames received OK.
7. Number of MDLC frames received not OK.
8. Number of calls that failed connecting.
9. Number of successful outgoing calls.
10. Number of accepted incoming calls.
11. Number of calls ignored by this unit.
12. Number of times the call (line) was cleared during the call or at the end.
13. Number of MAP27 protocol info messages received.
14. Number of times a MAP27 radio-busy message was received.
15. Reason for the last MAP27 protocol info message.
16. Number of times failed to get a new buffer for MAP27 protocol usage.
521
DESx
## 2900 LEVEL = 0
%%#1 %%#2
Encryption device information. Two strings will appear:
1. Denotes whether or not a certain DES instance is active.
2. DES serial number
## 2901 LEVEL = 1
Size of an encryption key alias: %%1
Number of encryption keys possessed: %%2
Currently active encryption key set: %%3
Number of encryption keys in each set:%%4
1. Encryption key alias size.
2. Number of encryption keys.
3. Encryption key set which is currently active.
4. Number of encryption keys in each set.
## 2902 LEVEL = 2
%%
Encryption device status messages. One of two messages will appear. Either:
• The specific encryption device whose serial number appears in ## 2900/Level 0 is not currently
active.
OR
• No encryption key aliases were defined. I.e. the encryption device is active, but the user has only
defined keys not aliases for that device.
## 2903 LEVEL = 2
Encryption key aliases:
Index Key Alias
===== =========
This information represents the list of key aliases that were defined by the user in the network
configuration for a given device. In order to identify the specific DES device, see Software Diagnostics
for AUSYNC Level 2 and get the Link Device Key for the relevant Link ID. Go to TMAUTH Level 1
and get the serial number associated with the Link Device Key. Next check all DESx Level 0 diagnostic
until you see the relevant serial number.
522
AUSYNC
## 3000 LEVEL = 0
Operation mode:
Is synchronized (1=YES, 0=NO): %%1
SYNC interval (seconds): %%2
Number of links (includes zones): %%3
Number of authenticated links: %%4
Server SiteID: %%5
Server LinkID: %%6
Server link index: %%7
Maximum drift (seconds): %%8
RX SYNC interval (seconds): %%9
TX SYNC REQUEST interval (seconds): %%10
TX AFTER RESTART retry (seconds): %%11
Maximum network delay (MSEC): %%12
RX SYNC timer (seconds): %%13
TX AFTER RESTART timer (seconds): %%14
TX SYNC REQUEST timer (seconds): %%15
Requested signals (HEX): %%16
Link device interface function (HEX): %%17
1. Is the RTU synchronized or not.
2. How frequently a SYNC message is to be sent.
3. The number of links (includes zones) attached to the RTU.
4. Number of authenticated links on the RTU.
5. Site ID of the Server RTU which provides synchronization.
6. Link ID through which the RTU is connected to the Server.
7. Server link index
8. Maximum number of seconds by which the timestamp of an incoming message can differ from the
RTU clock.
9. RX SYNC interval (seconds): %%9
10. TX SYNC REQUEST interval (seconds): %%10
11. TX AFTER RESTART retry (seconds): %%11
12. Number of milliseconds added to network delay (MSEC): %%12
13. RX SYNC timer (seconds): %%13
14. Number of seconds TX AFTER RESTART timer (seconds): %%14
15. Number of seconds TX SYNC REQUEST timer (seconds): %%15
16. Hexadecimal Requested signals (HEX): %%16
17. Hexadecimal Link device interface function (HEX): %%17
523
## 3001 LEVEL = 1
Device keys:
MiniSession device key (HEX): %%1
Stock device key (HEX): %%2
Heap device key (HEX): %%3
TimeAuth device key (HEX) : %%4
1. The MiniSession device key in Hexadecimal form.
2. The Stock device key in Hexadecimal form.
3. The heap device key in Hexadecimal form.
4. The TimeAuth device key in Hexadecimal form.
## 3002 LEVEL = 2
Link basis information
Index LinkID Flags Timer TX SYNC Link device key
===== ====== ===== ===== ======= ===============
Forms a table representing the link basis information.
## 3010 LEVEL = 10
Counters:
Number of requests arrived: %%1
Number of requests handled: %%2
Number of requests sent: %%3
Number of responses arrived: %%4
Number of invalid response: %%5
Number of SYNC arrived: %%6
Number of invalid messages: %%7
1. Count of the number of requests which have arrived.
2. Count of the number of requests which have been handled.
3. Count of the number of requests which have been sent.
4. Count of the number of responses which have arrived.
5. Count of the number of invalid responses which have been received.
6. Count of the number of SYNC which have arrived.
7. Count of the number of invalid messages which have which have been received.
Retrieving this diagnostic information sets all counters back to zero.
524
## 3011 LEVEL = 11
Counters:
Number of requests arrived: %%1
Number of requests handled: %%2
Number of requests sent: %%3
Number of responses arrived: %%4
Number of invalid response: %%5
Number of SYNC arrived: %%6
Number of invalid messages: %%7
1. Count of the number of requests which have arrived.
2. Count of the number of requests which have been handled.
3. Count of the number of requests which have been sent.
4. Count of the number of responses which have arrived.
5. Count of the number of invalid responses which have been received.
6. Count of the number of SYNC which have arrived.
7. Count of the number of invalid messages which have which have been received.
TMAUTH
## 3100 LEVEL = 0
Number of registered devices: %%1
Maximum number of registered device: %%2
AuthSync device key (HEX): %%3
1. Number of encryption devices registered for TMAUTH for this RTU.
2. Maximum number of allowed registered TMAUTH devices.
3. Identifier for the AUTHSYNC device which enables communication between the TMAUTH and
AUTHSYNC devices (in Hexadecimal format).
## 3101 LEVEL = 1
Encryption device basis information
Flags Device-key Link-key SerNum Stamp-interval Stamp-timer MaxDrift
StampInx NumOfENCFail NumOfRXAuthFail
This is a table representing an encryption device basis information.
525
DUART
## 3230 LEVEL = 0
Duart 's Hardware Internal Registers :-
------------------------------------------
Internal software data (key) (DATA) : %%1
DTR Register pointer (DTR) : %%2
DTR Mask (DTR Mask) : %%3
RTS Register pointer (RTS) : %%4
RTS Mask (RTS Mask) : %%5
CONTROL Register pointer (CONTROL) : %%6
RX Register pointer (RX) : %%7
TX Register pointer (TX) : %%8
MRBLR - Max RX Length (MRBLR) : %%9
CONTROL Register Data (*CONTROL) : %%10
DTR Register Data (*DTR) : %%11
RTS Register Data (*RTS) : %%12
RX Register Data (*RX) : %%13
TX Register Data (*TX) : %%14
Close Char (Close Char): %%15
Max idles Counter (MX_IDL) : %%16
1. Pointer to the UART Device key.
2. The address of DTR in the Hardware.
3. The Mask of DTR.
4. The address of RTS in the Hardware.
5. The Mask of RTS.
6. The address of the CONTROL REGISTER in the Hardware.
7. The address of RX REGISTER in the Hardware.
8. The address of TX REGISTER in the Hardware.
9. Maximum Receive Length.
10. The Data in the Control Register.
11. The Data in DTR Register
12. The Data in RTS Register
13. The Data in RX Register
14. The Data in TX Register
15. Close Character to close received buffer.
16. Maximum idle in msec units to close received frame.
526
## 3231 LEVEL = 1
Duart's Software descriptors :-
--------------------------------------
Head (offset) software receive descriptor: %%1
tail (offset) software receive descriptor: %%2
Head (offset) software transmit descriptor: %%3
tail (offset) software transmit descriptor: %%4
empty software receive descriptor: %%5
ready software receive descriptor: %%6
empty software transmit descriptor: %%7
ready software transmit descriptor: %%8
RX Descriptor[0].flag : %%9
RX Descriptor[0].p_buffer : %%10
RX Descriptor[0].offset : %%11
Tx Descriptor[0].length : %%33
Tx Descriptor[0].p_buffer : %%34
Tx Descriptor[0].offset : %%35
527
1. The next buffer to be handled by the Driver for received data.
2. The next buffer to be handled by the System for received data.
3. The next buffer to be handled by the Driver to transmit data.
4. The next buffer to be handled by the System to transmit data.
5. #9-#32 For each Receive buffer (0-7), a flag indicating if the buffer is in use, empty or has errors, a
pointer to the buffer, and the number of bytes that were received.
6. #33-#56 For each Transmit buffer (0-7) the number of bytes to be transmitted, a pointer to the buffer,
and the number of bytes that were transmitted by the driver so far.
## 3232 LEVEL = 2
Duart's Internal RAM data-Device Key :-
------------------------------------------
Current mode parameters (MODE_BACKUP): %%1
Current rate parameters (RATE_BACKUP): %%2
Current sync parameters (SYNC_BACKUP): %%3
Address mask parameters (MASK_BACKUP): %%4
Address data parameters (ADRS_BACKUP): %% %% %% %%5
Current channel's name (CHAN_BACKUP): %%6
Current channel's data (CHAN_DATA) : %%7
Current channel's code (CHAN_CODE) : %%8
Current heap's name (HEAP_BACKUP): %%9
Current heap's name (HEAP_DATA) : %%10
Current heap's data (HEAP_CODE) : %%11
Current channel's port (DUART_PORT) : %%12
Reception data head (RXBD_HEAD) : %%13
Transmission data tail (TXBD_TAIL) : %%14
Communication signals (DUART_SIGNAL): %%15
Communication buffers (DUART_TYPE) : %% %%16
Communication status (NOISY): %% 17
(QUIET): %% 18
Communication preset/timers (GRANT): %% %%19
(QUIET): %% %%20
1. The Uart's mode.
2. The Baud rate.
3. Contains the idle time to close received buffer.
4. Not relevant.
5. All the Legal addresses.
6. Pointer to Channel name.
7. Pointer to Channel device key.
8. Pointer to Channel Pin-Table.
9. Pointer to heap name.
10. Pointer to Heap device key.

528
11. Pointer to Heap Pin-Table.
12. The current port (1-3).
13. Next Reception data (0-7).
14. Communication Signal to identify TXD_END.
15. Next Transmit data (0-7).
16. Sign if formatted or unformatted buffer.
17. Not relevant.
18. Not relevant.
19. Time to occupy channel (preset, current).
20. Timer for Quiet (preset, quiet).
## 3233 LEVEL = 3
Duart's external dialup modem parameters :-
------------------------------------------
Functional Mode (FUNCTIONAL) : %%1
Reception Data lock (RXBD_LOCK) : %%2
Transmission Data lock (TXBD_LOCK) : %%3
Modem Command Lock (COMMAND_LOCK) : %%4
Incoming call Status (INCOMING_CALL) : %%5
Incoming call Counter (SECOND_COUNTER) : %%6
Get line lock Status (GET_LINE_LOCK) : %%7
Connection Status (LINE_LOCK) : %%8
1. The current functional mode (e.g. External modem).
2. Not in use.
3. Not in use.
4. Semaphore while modem is in command mode.
5. Flag for status of incoming call.
6. Counter while trying to dial.
7. Semaphore between dialing and receiving call.
8. Whether line is connected or not.
529
## 3234 LEVEL = 10
Duart's Diagnostic's Transmit/Receive :-
------------------------------------------
No. of Transmitted Frames : %%
No. of Received Frames : %%
No. of Received Frames with errors : %%
Mask of Error in the received frames : %%
3. The number of frames received that had errors.
4. The mask of the errors.
All counters are reset after this diagnostic is read.
## 3235 LEVEL = 11
Duart's Diagnostic's Transmit/Receive :-
------------------------------------------
The counters are not reset after reading this diagnostic.
530
DRS485
## 3245 LEVEL = 0
--------------------------------------
Internal software data (key) : %%1
Current channel port (CHAN_PORT) : %%5
Channel status mode (CHAN_MODE) : %%6
Channel driver lock (CHAN_LOCK) : %%7
Channel signals (CHAN_SIGNAL): %%8
Channel access type (CHAN_ACCESS): %%9
Physical tx_descriptorsize : %%10
DNP Min Random : %%11
DNP Max Random : %%12
DNP Master Bit : %%13
Channel driver type (CHAN_TYPE) : %%14
DNP random register : %%15
Channel Phys Key : %%16
Channel I2Phys Key : %%17
Time Driver Key : %%18
1. Pointer to the Device key of RS485.
2. The RS485's mode BACKUP.
3. Baud rate BACKUP.
4. Bit mask for staggering BACKUP.
5. The current port of RS485.
6. The RS485's mode.
7. Channel is busy.
8. Signals for MTE.
9. Channel access type.
10. Number of descriptors.
11. For DNP.
12. For DNP.
13. For DNP.
14. DATA Type.
15. For DNP.
16. Pointer to UART Device.
531
17. Pointer to i2phys device.
18. Pointer to Timer device key(10 ms).
## 3246 LEVEL = 1
--------------------------------------
PORT D Direction : %%
PORT D Data : %%
PORT D Pull up : %%
PORT D Select : %%
PORT F Data : %%
RTS Register : %%
Control Register : %%
RTS Data Register : %%
Control Data Register : %%
ALL are HARDWARE Registers.
## 3247 LEVEL = 2
--------------------------------------
Channel addresses (BASE/CHAN/NEXT/MASK) : %% %% %% %%1
Channel Ack Slot : %%2
Channel status (NOISY): %%3
(QUIET): %%3
Channel preset/timers (OVERRIDE): %% %%4
(RESOLUTE/QUIET): %% %%5
(SHUTUP): %% %%6
(GRANT): %% %%7
(WARMUP): %% %%8
(TRANSMIT): %% %%9
(HOLDUP): %% %%10
(RESPOND): %% %%11
1. All the legal addresses of the RTU.
2. Number of Slots for channel access.
3. Number of msecs that the channel identified quiet/noise.
4. Preset/Current timer to do override.
5. Time resolution of the channel.
6. Timer for Shutup.
7. Max Timer to try to occupy the Channel.
8. Preset/Current time for Warmup.
9. Preset/Current time channel is transmitted.
10. Preset/Current time for Holdup.
532
11. Preset/Current time for Respond.
DHDLC
## 3300 LEVEL = 0
Dhdlc 's Hardware Internal Registers :-
------------------------------------------
Internal software data (key) (DATA) : %%1
RTS Register pointer (RTS) : %%2
Interrupt Register pointer (INTP) : %%3
Receive Register pointer (RX) : %%4
Transmit Register pointer (TX) : %%5
Test Register pointer (TEST> : %%6
Control Register pointer (CONTROL) : %%7
Sample Register pointer (SAMPLE) : %%8
RTS Mask (RTS Mask) : %%9
Current mode parameters (MODE_BACKUP) : %%10
Current rate parameters (RATE_BACKUP) : %%11
Current sync parameters (SYNC_BACKUP) : %%12
Address mask parameters (MASK_BACKUP) : %%13
Address data parameters (ADRS_BACKUP) : %% %% %% %%14
Current channel's data (CHAN_DATA) : %%15
Current heap's name (HEAP_DATA) : %%16
Current channel's port (DHDLC_PORT) : %%17
RTS Register Data (RTS) : %%18
1. Pointer to the HDLC Device key.
2. The address of RTS in the Hardware.
3. The address of the INTERRUPT REGISTER in the Hardware.
4. The address of the RX REGISTER in the Hardware.
5. The address of the TX REGISTER in the Hardware.
6. The address of the TEST REGISTER in the Hardware.
7. The address of the CONTROL REGISTER in the Hardware.
8. The address of the SAMPLE REGISTER in the Hardware.
9. The mask of the RTS.
10. The HDLC Mode.
11. The Baud Rate.
12. Not relevant.
13. Not relevant.
15. Pointer to the Channel device key.
533
16. Pointer to the Heap name.
17. The current port (1-3).
18. . The Data in RTS Register.
534
## 3301 LEVEL = 1
Dhdlc's Software descriptors :-
--------------------------------------
Head (offset) software receive descriptor: %%1
tail (offset) software receive descriptor: %%2
Head (offset) software transmit descriptor: %%3
tail (offset) software transmit descriptor: %%4
empty software receive descriptor: %%5
ready software receive descriptor: %%6
empty software transmit descriptor: %%7
ready software transmit descriptor: %%8
535
1. The next buffer to be handled by the Driver for received data.
2. The next buffer to be handled by the System for received data.
3. The next buffer to be handled by the Driver to transmit data.
4. The next buffer to be handled by the System to transmit data.
5. Number of empty receive buffers.
6. Number of receive buffers in use.
7. Number of empty transmit buffers.
8. Number of transmit buffers in use.
9. #9-#32 For each Receive buffer (0-7), a flag indicating if the buffer is in use, empty or has errors, a
pointer to the buffer, and the number of bytes that were received.
10. #33-#56 For each Transmit buffer (0-7) the number of bytes to be transmitted, a pointer to the buffer,
and the number of bytes that were transmitted by the driver so far.
## 3302 LEVEL = 10
Dhdlc's Diagnostic's Transmit/Receive :-
------------------------------------------
No. of Transmitted Frames : %%1
No. of Received Frames : %%2
No. of Received Frames with errors : %%3
Mask of Error in the received frames : %%4
All counters are reset after this diagnostic is read.
## 3303 LEVEL = 11
Dhdlc's Diagnostic's Transmit/Receive :-
------------------------------------------

536
The counters are not reset after this diagnostic is read.
DRADIO
## 3310 LEVEL = 0
Dradio Channel Parameters :-
--------------------------------------
Internal software data (key) : %%1
Current channel port (CHAN_PORT) : %%5
Channel driver lock (CHAN_LOCK) : %%6
Channel signals (CHAN_SIGNAL): %%7
Channel access type (CHAN_ACCESS): %%8
1. Pointer to the Device key of DRADIO.
2. The RS485's mode BACKUP.
3. Baud rate BACKUP.
4. Bit mask for staggering BACKUP.
5. The current communication port of the RTU (1-3).
6. Channel is busy.
7. Signals for MTE.
8. Channel access type.
537
## 3311 LEVEL = 1
Dradio hardware control and status :-
--------------------------------------
RTS Register : %%1
Control Register : %%2
Interrupt Register : %%3
Modem Control0 Register : %%4
Modem Control1 Register : %%5
RTS Mask : %%6
Modem Control0 Mask : %%7
Modem Control1 Mask : %%8
Warmup type0 : %%9
Warmup type1 : %%10
Preamble type0 : %%11
Preamble type1 : %%12
Radio Default Channel : %%13
Modem type : %%14
Radio type : %%15
Is Internal : %%16
Cm_rssi : %%17
Tx_level : %%18
Is_Agc_on : %%19
Rxa_rssi : %%20
Tx_float : %%21
Diff_ptt_Tx : %%22
Diff_ptt_Rx : %%23
Rssi_level : %%24
Cm_polarity : %%25
1. Pointer to the RTS Hardware's Register.
2. Pointer to the Control Hardware's Register.
3. Pointer to the Interrupt Hardware's Register.
4. Contents of the register which contains Modem Control0 status. Modem Control0 is one of the
lines from the microprocessor (pin PK4) which control the output data from the FPGA's modem
to the radio.
5. Contents of the register which contains Modem Control1 status. Modem Control1 is one of the
lines from the microprocessor (pin PK3) which control the output data from the FPGA's modem
to the radio.
Each set of register values corresponds to a given status, as follows:
Status CTRL1\ CTRL0\ Notes

PK4 PK3
Transmitted 0 0
data
Automatic/ 0 1 Automatic mode - The FPGA performs a full channel
pseudo data access when the RTS line is reset from the
microprocessor . That means : 30mSec DC 10mSec
Sinus and at least 10mSec pseudo data after that it
transmits the data received from the processor or if
no data (all zeros) it continues transmitting pseudo
538
data.
Stop at DC 1 0 When the RTS line is asserted, the FPGA transmits
DC until the status of the control lines is changed.
Stop at sinus 1 1 When the RTS line is asserted the FPGA transmits
DC for 30mSec. Then it starts transmitting a sinus
wave until the RTS line is lowered.
6. The mask of the RTS.
7. Mask of Modem Control0.
8. Mask of Modem Control0.
9. Selects the transmit mode of Modem control 0, when performing warmup in channel access in
port 3.
10. Selects the transmit mode of Modem control 1, when performing warmup in channel access in
port 3.
11. Selects the transmit mode of Modem control 0, when performing preamble in channel access in
port 3.
12. Selects the transmit mode of Modem control 1, when performing preamble in channel access in
port 3.
13. When the MOSCAD-M is configured to work with an internal Mobat radio on Port 3, this
parameter indicates the default channel (1-7) that the radio is programmed to transmit and receive
from. This channel could be changed by the ‘C’ application or by downloading a new
configuration with a new default channel.
14. This indicates the type of modem that is downloaded to the FPGA. The type can be one of:
• Dual Binary 9600 bps modem

• DPSK 1200 bps modem
15. This indicates to the system what type of radio is connected to Port 3 of the MOSCAD-M. This
value can either be Internal Radio or a variety of external radios.
16. This indicates whether the radio connected to Port3 of the MOSCAD-M is an internal or external
radio.
17. This bit indicates the channel busy indication from the radio.
• 0 - CM is originated from RSSI signal of the radio

• 1 - CM is originated from Q_SQE of the radio.
18. This field determines the TxA signal Level (The analog signal from the modem to the radio). The
higher the number in this field, the higher the deviation will be. This is a 6 bit parameter.
19. Indicator from FPGA controlled in FPGA out train via SPI 2.
• 0 - AGC for external portables enabled.

• 1 - Direct receive path is selected.
539
20. This indicates which line from the internal radio connector is routed to the RSSI mechanism.
• 0 - The RxA line is routed to the RSSI mechanism.

• 1 - The RSSI line from the internal radio connector is routed to the RSSI mechanism.
21. This bit determines the input impedance of the Tx_Lines.
• 0 - GND is not connected to External Radio Tx line for external radios that require low
impedance between the TX_line and the ground in order to transmit.
• 1 - GND is connected to External Radio Tx line.
22. This bit determines the differential on the Tx_Line in Transmit mode when using external radios.
This will cause external radios that are sensitive to differential on their Tx line to start
transmitting.
• 1 - This line is always off. Full Tx Level to External radio.

• 0 -This line is connected to the PTT line and is ON/OFF according to the PTT. This means
that when transmitting there is low Impedance and low Tx level when using GRI portable
radios.
23. This bit determines the differential on TX Line in receive mode.
• 1 - OFF
• 0 - ON
24. This parameter determines the comparator level to the RSSI input from the radio.
25. This bit is programmed by the CPU according to the radio's CM polarity which is configured in
the site configuration. It affects both the translation of Carrier Squelch and RSSI / CM to the
CPU.
• 0 - CM polarity in site configuration was programmed to Active Low. That means that the
FPGA recognizes level low on RSSI/SQE as channel active. The signal is inverted in this
mode before being transferred to the CPU.
• CM polarity in site configuration was programmed to Active High. That means that the
FPGA recognizes level high on RSSI/SQE pin as channel active. This signal is NOT inverted
in this mode before being transferred to the CPU.
540
## 3312 LEVEL = 2
Dradio software control and status :-
--------------------------------------
Channel addresses (BASE/CHAN/NEXT/MASK) : %% %% %% %%1
Channel Ack Slot : %%2
Channel status (NOISY) : %%3
(QUIET) : %%3
Channel preset/timers (OVERRIDE) : %% %%4
(RESOLUTE/QUIET) : %% %%5
(SHUTUP) : %% %%6
(GRANT) : %% %%7
(WARMUP) : %% %%8
(TRANSMIT) : %% %%9
(HOLDUP) : %% %%10
(RESPOND) : %% %%11
(PREAMBLE): %% %%12
1. All the legal addresses of the RTU.
2. Number of Slots for channel access.
3. Number of msecs that the channel identified quiet/noise.
4. Preset/Current timer to do override.
5. Time resolution of the channel.
6. Timer for Shutup.
7. Max Timer to try to occupy the Channel.
8. Preset/Current time for Warmup.
9. Preset/Current time channel is transmitted.
10. Preset/Current time for Holdup.
11. Preset/Current time for Respond.
12. Preset/Current time for Preamble.
LOGFLAS
## 3360 LEVEL = 0
LOGFLASH status
---------------
Last completed operation: %%1
Chain ID: %%2
Block #: %%3
Result: %%4
1. The last operation performed on the logging flash which completed. One of: Erase (0) , Program (1)
or Disable (2).
541
2. The last chain (block type) handled out of the five possible block types that can be defined by the
user.
3. The last block number handled within the specified chain.
4. The result (return code) of the last operation.
## 3361 LEVEL = 1
LOGFLASH queue header
---------------------
start %%1
end %%2
head %%3
tail %%4
element size %%5
num elements %%6
free elements %%7
1. The beginning of the LOGFLASH operation queue.
2. The end of the LOGFLASH operation queue.
3. The head of the LOGFLASH operation queue (the next operation on the LOGFLASH queue to be
performed.)
4. The tail of the LOGFLASH operation queue (the last operation on the LOGFLASH queue to be
performed.)
5. The size of an element on the LOGFLASH queue.
6. The number of elements in the LOGFLASH queue.
7. The number of free elements in the LOGFLASH queue.
## 3362 LEVEL = 2
LOGFLASH queue elements
-----------------------
Operation Data Len ChainID Block_#
Operation The operation to be performed on the logging flash. One of: Erase (0) , Program (1) or
Disable (2).
Data The pointer to the data to be written to the logging flash if the operation is Program.
Len The length of the data in the queue element.
Chain ID The identifier of the chain (block type) on which the logging flash operation is to be
performed. Up to five block types can be defined by the user.
Block_# The block number within the chain on which the logging flash operation is to be
performed.
542
Error Messages
Error Logger Messages

This section lists the errors and warnings which may be generated by the Error Logger. The messages are
listed as they appear on the screen, with %% signs in the text to represent alphanumeric values provided
by the Error Logger.
The description which follows the error messages, provides one or more possible causes for the error and
possible solutions.
Error #20: Invalid Box in TX Queue – Device: %%

This message appears due to a fault memory overwrite in the Tx Queue in the
link layer. The 'Device' is the name of the link layer (referring to the port).
Consult product group.
Error #21: Invalid Box in Positive ACK Queue – Device: %%

This message appears due to a fault memory overwrite in the ACK Queue in the
link layer. The 'Device' is the name of the link layer (referring to the port).
Error #22: Invalid Box in Busy/Setcall Queue – Device: %%

This message appears due to a fault memory overwrite in the Busy/Setcall
Queue in the link layer. The 'Device' is the name of the link layer (referring to
the port). Consult product group.
Error #23: Can Not Get a New ACK Buffer, increase # of ACK Buffers – Device %%
For each link layer, 8 acknowledge buffers are defined. If all those buffers are
full and the link intends to prepare another acknowledgment for transmission,
this message is displayed and there will be a retry on behalf of the transmitting
side. Usually, this may occur in Nodes. Consult product group.
Error #24: ACk Buffer (Formatted) is too Small – Device: %%

For system software developers only. Consult product group.
Error #25: Can Not Get a New ACK Buffer, ACKs Buffer was corrupted – Device: %%
This message appears due to a memory overwrite in the heap of the
acknowledgments in the link layer.
Error #40: Illegal Operation Code For Configuration

Illegal operation code during configuration download.
543
Error Messages
Error #41: Low Byte Error When Using Flash Memory

This message appears during configuration download, while downloading the
flash. There is a problem in the flash.
Error #42: High Byte Error When Using Flash Memory

flash. There is a problem in the flash.
Error #43: Given address is not start address of flash memory

flash. This message indicates a software error in the Download program.
Error #44: Wrong number of bytes in flash memory

flash.
Error #45: Error After Send Struct

Communication problem during configuration download.
Error #46: Error After Get Struct

Communication problem during configuration download.
Error #47: Control error !!

May indicate system software error. Consult product group.
Error #60: Can Not Remove Slice – Device: %% , Size: %%

This message appears when receiving a MDLC communication buffer, that
passed a CRC check, but one of the communication layers ('Device') can not
understand its contents (due to a bug or a unique case of an illegal buffer
receive). This buffer will be dumped into the heap.
Error #61: Can Not Get Slice – Device: %% , Size: %%

Error #62: Can Not Push Block – Device: %% , Length: %%

Error #80: Fixed transaction Index (%%) is Out Of Range

This message indicates that a fixed transaction that can not be found in the
transaction table was received. It is an illegal transaction.
544
Error Messages
Error #81: No Fixed transactions Table Was Assigned To Slave

A fixed transaction was received but the fixed transaction table was not
downloaded into the slave.
Error #82: Bad transaction Format

Illegal transaction. For example: 'Z' (table number) does not exist.
Error #85: Trying To Comm. After Session Was Ended

Illegal communication. The transaction ended but data still arriving. This may
occur due to differences in the data structure of master and slave.
Error #86: Transaction Length Exceeds 256 Bytes

Transaction is too big.
Error #87: Bad transaction Flags: %%

Undefined bits are set in the flags area of the transaction.
Error #88: Data too long

Due to differences in the data structure between master and slave, spare data is
arriving.
Error #89: Data too short

Due to differences in the data structure between master and slave, only part of
the data has arrived.
Error #95: Queue in fram_seq is full

The Rev Seq queue is full and the application did not get the frames.
Error #96: Trouble in queue: %%

Illegal management of linked buffers.
Error #100: Trying to access illegal logical channel in transport layer

Illegal logic channel for the device.
Error #101: Illegal data in transport layer structure

Illegal data for the device.
Error #110: Illegal number of logical channels in transport multiplexer

The actual number of logical channels is bigger than the number defined during
the creation of the device.
545
Error Messages
Error #111: From Site : %%Link : %% can not communicate with current unit
Communication was initiated by a site which is not defined in the Site table.
Error #112: Trouble in queue: %%

Illegal management of linked buffers.
Error #113: Illegal control byte : %%

Memory overwrite in a buffer that passed a CRC check. The buffer is dumped
into the heap.
Error #114: Illegal buffer : %%

The Transport Multiplex layer can not understand a buffer that passed a CRC
check. This buffer is dumped into the heap.
Error #115: Application Id not exists : %%

Applying to an application that does not exist in the RTU. This may occur when
using a new version of Tool Box with new features to communicate with an
older RTU that is not familiar with those new features.
Error #116: Machine code illegal : %%

Due to a bug in the Transport Multiplex layer, the 'states machine' has reached
an illegal state.
Error #117: Can't talk with master because unit was not defined as Slave !! OR flag Master
is Set but Unit was not defined as Master !!
Error #120: Can not get characters from existing buffer

Error #121: Illegal compilation of SEND output

Indicates a software error in the Application Programmer. Consult product
group.
Error #140: Invalid Link ID, network layer: %%, Dest Site: %%,
Dest Link: %%, Dest Port: %%
The network layer in a RTU is asked to transfer a communication buffer to the
Dest Site, Dest Link & Dest port but the specific link is not known to this RTU
(since other links are defined).
546
Error Messages
Error #141: Can not find Link ID in network configuration, network layer: %% Dest Site: %%,
Dest Link: %%, Dest Port: %%
The network layer in a RTU is asked to transfer a communication buffer to the
Dest Site, Dest Link & Dest port but there is no route defined in the network
configuration, which the communication can be transferred through.
Error #142: Destination=Default Central, Network layer: %%, Dest Site: %%, Dest Link:
%%, Dest Port: %%
Network is trying to transfer a buffer to Default central before the last one
communicate with the transmitting site at least once.
Error #144: Transparent Network layer !! Can not route via other Link ID network layer: %%
Error #145: Formatted buffer is smaller than the received frame,

network layer: %%
Error #147: Mismatch between site_conf and network layer: Network direct_link_table,
while trying to reach site: %% / link %% using direct_link %%.
This error indicates mismatch between the site configuration and network
configuration files. The direct_link subsection of the network file does not
match the site configuration Links information.
Error #148: ECHO case (only available TX path is via the ‘FROM’ site).
Network layer: Network – STOCK table,
while trying to reach site: %%%% / link %%. Echo using ‘via link’: %%.
Probably mismatch between the network files at ‘from’ and ‘to’ RTUs.
The only link available for transmission is the link from which the frame was
received. The most common reason is an inconsistency in network definition
between the frame originator and this RTU.
Error #149: Could not transmit to CENTRAL/DEFAULT_CENTRAL, probably path is in fail,

Network layer: Network, desty link %%, dest site %%.
The frame to be transmitted to Central or to Default_central could not be
transmitted. Probably the link used for transmission is in fail. No alternative
path was chosen.
Error #160: Timer service is not activated since timer is defined with 0 time units, device:
%%
The data of the timers device is corrupted. Trying to operate a timers routine
with no time units.
547
Error Messages
Error #161: # of time units passed without activating timer service is %%, device: %%
The timers task can not start its operation in a time interval which is bigger than
the time interval that was allocated for it in the device creation. This message
may indicate either a long scan time (above 500 msec) or an infinite loop in the
user application.
Error #170: Illegal data in constant cyclic buffer structure

Error #171: Illegal data in variable cyclic buffer structure

Error #180: Illegal setting of date & time:

Seconds: %% Minutes: %% Hours: %%
Day : %% Date : %% Month: %% Year: %%
The date and time settings are not correct. This message appears when the user
application updates the time and date and one or more of the settings is
incorrect.
Error #181: Getting illegal date & time:

Seconds: %% Minutes: %% Hours: %%
Day : %% Date : %% Month: %% Year: %%
May indicate either system software error or incorrect real-time clock
component in the RTU. Consult product group.
Error #190: Corrupted heap data base:

device : %%
pointer to start chain : %%
pointer to current chain : %%
pointer to end chain : %%
# of buffers left in heap : %%
May indicate system software problem. Consult product group.
Error #191: Heap: buffer is allocated for too much time.

device : %%
buffer address : %%
allocated for more than %% minutes, it happened %% time(s).
Error #192: Buffer: %% is already free. Calling address is: %%

Error #200: Odd address of working area

For system software developers. Consult product group.
548
Error Messages
Error #201: Insufficient space in work area

Error #202: Corrupted device KEY

Error #203: Heap: %% is empty, device: %%

Empty heap. Consult product group.
Error #210: Corrupted Duty Cycle: %% or Gap Cycle: %%

Illegal percents (above 100% or negative) were assigned to the Duty Cycle in
the user application.
Error #212: Main process is running more than 1.2 seconds !!

The user application includes either an infinite loop or a loop that occupies the
CPU for a long time, and other tasks do not get CPU time.
Error #230: Bad table coordinate :%%

The 'Z' coordinate (table number) belongs to a table that does not exist in the
application, probably because of differences in the data structure between
master and slave.
Error #231: Bad row coordinate :%% in table #%%

The 'Y' coordinate (row number) does not exist in the table, probably because of
differences in the data structure between master and slave.
Error #232: Bad column coordinate :%% in table #%%

The 'X' coordinate (column number) does not exist in the table, probably
because of differences in the data structure between master and slave.
Error #233: No COS memory space was allocated to table #%%

There is no 'COS' column defined in the table.
Error #234: NOT enough Space for Differentiators (%% Bytes). Application DISABLED.
Each application needs at least 256 bytes, which are not available, for
differentiators.
Error #235: Warning: Short USER RAM: %% Bytes

In case the free space available for application is less than 2 Kbyte, the user is
notified that the running application is limited.
549
Error Messages
Error #236: Index is out of range : %% %%

The index in the user application has reached 256 or exceeded it.
Error #237: No application in FLASH memory or Application was stopped !!

Trying to get data from some table, while the application was not downloaded
or was stopped.
Error #238: Task '%%' does NOT exist !!

Error #239: No Delta COS Area Was Allocated To Column #%% in Table #%%
Trying to read COS of a column that does not have COS area. Improper use of
DB_Map application.
Error #240: Invalid Time Tag List: %% OR Events list: %%

error returned from sio_set_di_cos_en(): %%
Error #241: Txintrc or Rxintrc was called with invalid type %%

Invalid parameter type. See Intrac Protocols chapter in Advanced Features in
Error #242: Intrac/Meic port not created

The appropriate port must be defined in Site Configuration.
Error #243: One of the following calls: Txintrc, Txwidth, Rxintrc, Rxwidth, Rxiupd failed
getting pointer to value at intrac system table
Error #244: Txintrc was called with ITxStt=0 or Txwidth was called with Tx_len=0
Illegal value set in application.
Error #245: #the 'Load' option was used to download the application, however the number
of diffrentiators were changed.
You should use the 'Reset Load' option instead and then do Download.
Error #250: Cannot read module type at: %%

I/O module defined but physically missing.
Error #251: Module type does not match site configuration, module: %%
Incompatible module type. Configuration definition and physical module are
different.
550
Error Messages
Error #252: Module: %%, initial values are invalid.

There are no preset values in the control registers of the DO module gate array.
Error #253: Digital output module: %%, desired values in gate array are not equal to image
in memory.
The gate array data and the image in the RTU do not match.
Error #254: Digital output module: %%, actual values of relays are not equal to desired
values in gate array.
The gate array data and the image in the RTU do not match.
Error #255: I/O module: %% analog input not calibrated.

At least one of the analog input in the module is not calibrated.
Error #256: Cannot 'communicate' with module: %%

It is not possible to read data from the module; it is faulty.
Error #257: Some Failure In Module %%.

Faulty FIFO communication in the specified module.
Error #258: CLOCK fail flag in module %% is on.

The clock in the specified module is faulty.
Error #259: I/O module: %% EE memory problem.

All the channels are calibrated, but the inner EE is problematic.
Error #260: Analog input module: %% FIFO time-out.

The Analog Input module does not respond to the RTU CPU.
Error #261: Mixed I/O module: %% analog input problem

There is a problem in the specified analog input of the Mixed I/O module.
Error #262: I/O Module: %% analog output not calibrated.

The specified analog input of the Mixed I/O module is not calibrated.
Error #263: I/O module: %% analog input calib. succeeded with borderline input.
Calibration succeeded but one of the measurements is out of range.
Error #264: DI FAIL In Module %%.

The specified module (DI or Mixed I/O) is in FAIL.
551
Error Messages
Error #265: AI FAIL In Module %%.

The AI module is in FAIL.
Error #266: Relay Check Back (CB) FAIL In Module %%.

Incompatibility between desired and actual status in DSP outputs.
Error #267: Module %%, Scale Factor or Threshold Changed From User Requested Value.
Incompatibility between desired and actual status in AO.
Error #268: Module %%, DSP Not Ready.

The AC Analyzer module does not respond due to hardware or software
problems. Consult product group.
Error #269: Module %%, DSP Reset.

The AC Analyzer module has reset itself. Hardware or software problems.
Error #270: Incompatible Communication PROTOCOL on: PORT #%% CONTROL=%%

STATUS=%%
May indicate system software/hardware problem. Consult product group.
Error #271: Uncontrollable Communication PHYSICAL on: PORT #%% CONTROL=%%

STATUS=%%
Error #272: Unoperational Communication PHYSICAL on: PORT #%% CONTROL=%%

STATUS=%%
Error #273: Unoperational PHYSICAL Internal LOOP on: PORT #%% CONTROL=%%
STATUS=%%
When checking the port (HDLC or UART), the RTU turns into a self loop
mode, sends a frame and receives it. This message is displayed if the received
frame is not equal to the one that was sent, and the port is port3.
Error #274: Unoperational PHYSICAL External LOOP on: PORT #%% CONTROL=%%
STATUS=%%
When checking the port (HDLC or UART), the RTU turns into an internal loop
mode, sends a frame and receives it. This message is displayed if the received
frame is not equal to the one that was sent, and the ports are 1 or 2.
552
Error Messages
Error #275: Unsuccessful PHYSICAL Configuration on: PORT #%% COMMAND=%%

ANSWER=%%
Internal modem does not exist or illegal parameters were downloaded to this
modem.
Error #276: Uncontrollable PHYSICAL Configuration on: PORT #%% COMMAND=%%

DATA=%%
Problem in the internal modem.
Error #280: Incompatible Communication BOARD on: PORT #%% CONTROL=%%

STATUS=%%
Piggyback on port3 is illegal.
Error #281: Uncontrollable Communication CHANNEL on: PORT #%% CONTROL=%%

STATUS=%%
Programmable RS-232 was not defined and the CTS & RTS detectors are
defected.
Error #282: Unoperational Communication CHANNEL on: PORT #%% CONTROL=%%

STATUS=%%
The port is transferred to software mode. This message is displayed if CD is not
active.
Error #283: Unoperational CHANNEL Internal LOOP on: PORT #%% CONTROL=%%
STATUS=%%
Incompatibility between the frame that was sent and received by the internal
loop.
Error #284: Unoperational CHANNEL External LOOP on: PORT #%% CONTROL=%%
STATUS=%%
Incompatibility between the frame that was sent and received by the external
loop.
Error #285: Unsuccessful CHANNEL Configuration on: PORT #%% COMMAND=%%

ANSWER=%%
Internal modem does not exist or illegal parameters were downloaded.
Error #286: Uncontrollable CHANNEL Configuration on: PORT #%% COMMAND=%%

DATA=%%
Problem in the internal modem.
553
Error Messages
Error #287: No response from internal DPSK modem on: port #%% command=%%
data=%%
Problem in the internal modem-piggyback plug in Port Type unit for Port 3.
Error #288: An Incompatible piggyback was found.

The configuration was defined for Radio model: R%%
The installed piggyback ID is: %%
(see the table below for conversion)
The following table lists the available IDs:
Piggyback ID Description
1 Spread Spectrum (Aironet) R202
2 Spread Spectrum (Aironet) R100
3 Spread Spectrum (Aironet) R202 AND DPSK interface
4 Spread Spectrum (Aironet) R100 AND DPSK interface
Other Unknown, invalid or no piggiback
For Spread Spectrum radio only (MOSCAD-L only).
Error #289: Could not program the spread spectrum (aironet) radio successfully. The
readback registers value was different from the written ones.
Piggyback cannot be programmed. Switch or fix piggyback.
Error #290: A fault has occurred in the spread spectrum (aironet) radio. The system has
checked the radio registers and found that their values are different from the
expected ones. The system tried to correct the problem by reinitializing the radio
unsuccessfully. A power restart of the CPU and the radio may resolve the
problem.
Try to do a restart.
Error #300: MTE CRASH:

Error Code : %%
Problematic Thread : %%
Problematic Device : %%
Status Register (SR) : %%
Program Counter (PC) : %%
Current Task : %%
Candidate Task : %%
Error #301: MTE WARNING: The MTE_VLD Lowest Priority Task in The System Was Not
Reached For %% Ticks. System is Either Overloaded Or Some Process is in
Infinite Loop !!!! . Maximum Allowed Time At Which The Lowest Task May Not
Activate is %% Ticks.
A task is in infinite loop. Consult product group.
554
Error Messages
Error #302: %% CRASH:

R/~W : %%
~I/N : %%
Function Code : %%
Access Address : %%
Instruction Register : %%
Current Task : %%
Candidate Task : %%
Bus error or address error crash. May indicate system software problem. Consult
product group.
Error #303: %% CRASH:

Current Task : %%
Candidate Task : %%
Illegal instruction crash. May indicate system software problem. Consult
product group.
Error #304: MTE: The CONTROL procedure of devices was not started, because the type of
control parameter is out of range !!
Type of requested control was : %%
The last valid control entry is : %%
Internal error. May indicate system software problem. Consult product group.
Error #305: MTE: The MTE CONTROL procedure of devices failed !!!
Device Name : %%
Control Type : %%
Number of successive fails : %%
The control procedure of one of the devices has failed. May indicate system
software problem. Consult product group.
Error #350: Session layer: in function %% remove slice failed. Remove slice failed.
Error #351: Session layer: in function %% get slice failed. Get slice failed.
Error #352: Session layer: in function %% allocation of formatted buffer failed. Allocation of
a buffer failed.
555
Error Messages
Error #353: Session layer: in function %% buffer in RX is kept by lower layer.

Error #354: Session layer: in function %% no more room for error buffers.
Error #355: Session layer: in function %% received not error buffer, while in tx.
Error #356: Session layer: in function %% format error. Protocol found error.
Error #357: Session layer: in function %% unable to perform abort session.

Error #358: SESSION: In Function %% Illegal Password. Session Not Opened.

Illegal password. Session was not opened.
Error #400: Presentation layer: in function %% remove slice failed. Remove slice failed.
Error #401: Presentation layer: in function %% get slice failed. Get slice failed.
Error #402: Presentation layer: in function %% push byte in fbuf failed. Push byte failed.
Error #403: Presentation layer: in function %% pull byte from fbuf failed. Pull byte failed.
Error #404: Presentation layer: in function %% push block in fbuf failed. Push block failed.
Error #405: Presentation layer: in function %% pull block from fbuf failed. Pull block failed.
Error #406: Presentation layer: in function %% allocation of fbuf failed. Allocation problem.
Error #407: Presentation layer: in function %% the presentation is in aborted state

556
Error Messages
Error #408: Presentation layer: in function %% the presentation is not in tx state.

Error #409: Presentation layer: in function %% the presentation is not in rx state.

Error #410: Presentation layer: in function %% the len of tx structure is out of range.
Error #411: Presentation layer: in function %% general format error. Protocol format error.
Error #412: Presentation layer: in function %% format error, compression not supported.
Format error. Compression is not supported.
Error #413: Presentation layer: in function %% format error, encryption not supported.
Encryption and compression are not supported.
Error #414: Presentation layer: in function %% format error, control number out of range.
Protocol format error.
Error #415: Presentation layer: in function %% general synchronization error.

Error #416: Presentation layer: in function %% the rx applic, buffer size is too small.
Error #417: Presentation layer: in function %% no more rooms for error buffers.
Error #450: Stock set: the stock buffer is locked for too much time
Error #451: Stock get: the stock buffer is locked for too much time
557
Error Messages
Error #500: IOTEST: Invalid Option: %%

Applying to a non-existing option for I/O module testing in the RTU. This may
occur when using a new version of Tool Box with new features to communicate
with an older RTU that is not familiar with those new features.
Error #501: IOTEST: Bad Device Name %% for Service %%

Problem in getting device key & pin_table out of device name.
Error #520: Minisess: illegal box nr. %% , data problem !!!

Error #540: Time_tag rack module not exist: %%

Data was received for an I/O bit that exists in an I/O module, but not defined in
the user ROM.
Error #541: Time_tag->read %%> time_tag->write %%

Error #560: The MC68882 Coprocessor is connected, but is not OK.

All floating point and double precision calculations are emulated by software.
Error #561: The MC68882 device data is corrupted. Software problem.

Error #562: The check validity or test of MC68882 device failed due to MTE_TSTNSET
locking. Software problem.
Error #563: The MC68882 RAM jump table is too short !!! Software problem.
Error #564: The MC68882 Coprocessor is no more functioning.

All floating point and double precision calculations are emulated by software.
Error #565: Fatal !!!! The %% operation is not executed correctly !!!
Error #600: Unable to run %% from 2 different processes !!

Unable to run PPH from two different processes.
558
Error Messages
Error #601: The scan_discrete_in call in PPH module failed !!

Error #602: The call to prv_userrom_pph_timer from timer 10 ms is to late !!! PPH may have
lost pulses !!!!!!!!!
Error #603: The PPH structure is CORRUPTED !!! The PPH calculations may be wrong !!!
Error #604: Fatal !!! CPY Not Performed due to border problems !!!
Trying to use the CPY function with illegal parameters.
Error #605: Fatal !!! Division by 0 in rungs while performing the MODULO operation. The
result is undefined !!
Dividing by 0 in user application.
Error #606: Fatal !!! Division by 0 in rungs while performing the divide operation. The result
is undefined !!
Dividing by 0 in user application.
Error #620: Ticks disabled exceed allowed limit : SR=%% IPR/IMR=%% WRR/WCN=%%
Error #640: Fatal !!! Not enough work space for Monitor application !!
Available space transferred for the Monitor – %% bytes.
Minimum space required for Monitor – %% bytes.
Error #700: Invalid next version pointer : %%

Current version pointer : %%
Entry pointer of list : %%
Illegal linked list in the FLASH memory.
Error #701: Invalid data pointer : %%

Current version pointer : %%
Entry pointer of list : %%
Error #702: Start data pointer : %%

Length of data : %%
559
Error Messages
Error #730: Device TOPLC,Function %%, Port Name %% : Illegal Request from application.
Error #731: Device TOPLC,Function %%, Port Name %% : Unable To Unpack F-Buffer.
Error #732: Device TOPLC,Function %%, Port Name %% : ERR_LOCK In TX Physical.

Error #733: Device TOPLC,Function %%, Port Name %% : ERR_FULL In TX Physical.

Error #734: Device TOPLC,Function %%, Port Name %% : Unable to Push A Block In F-UF
Buffer. Push block failed.
Error #735: Device TOPLC,Function %%, Port Name %% : Unable To Alloc Uf Buffer.
Allocation problem.
Error #736: Device TOPLC,Function %%, Port Name %% : Unable To Unpack Uf Buffer.
Unpack Uf Buffer failed.
Error #737: Device TOPLC,Function %%, Port Name %% : Unable To Alloc Buffer.
Allocation problem.
Error #738: Device TOPLC,Function %%, Port Name %% : The Port to PLC is busy.
The port is busy.
Error #739: Device TOPLC,Function %%, Port Name %% : Not enough memory for the
application !!
Error #740: Device TOPLC,Function %%, Port Name %% FATAL, State EQ Waiting Control
but f_buf NE NULL !! Software problem.
Error #741: Device TOPLC, Function %%, Port Name %% : Fbuf Must Be NULL !!
560
Error Messages
Error #742: Device TOPLC,Function %%, Port Name %% : flashapp_get_block() has failed
!!
Error #743: Device TOPLC,Function %%, Port Name %% : flashapp_cur_burn() has failed !!
Error #744: Device TOPLC, Function %%, Port Name %% : Not found the loaded software
for the port. This port is not operational.
The third-party protocol port is not operational.
Error #745: Device TOPLC, Function %%, Port Name %%

The download of software for this port has failed.
Error #746: Device TOPLC, Function %%, Port Name %% Received a control from the
SWITCHER while there is no software loaded for the PLC port. The received
f_buf (control) has been freed.
The RTU has to switch frames while the protocol is not loaded in the FLASH
memory.
Error #760: Device TOSCADA, Function %% Port Name %% : Illegal Request from
application.
Error #761: Device TOSCADA, Function %% Port Name %% : Unable To Unpack F-Buffer.
Unpack F-Buffer failed.
Error #762: Device TOSCADA, Function %% Port Name %% : ERR_LOCK In TX Physical.

Error #763: Device TOSCADA,Function %% Port Name %% : ERR_FULL In TX Physical.

Error #764: Device TOSCADA, Function %% Port Name %% : Unable to Push a Block In F-
UF Buffer. Push block failed.
Error #765: Device TOSCADA, Function %% Port Name %% : Unable To Alloc Uf Buffer.
Allocation of buffer failed.
561
Error Messages
Error #766: Device TOSCADA, Function %% Port Name %% : Unable To Unpack Uf Buffer.
Unpack Uf Buffer failed.
Error #767: Device TOSCADA, Function %% Port Name %% : Unable To Alloc Buffer.
Allocation of buffer failed.
Error #768: Device TOSCADA, Function %% Port Name %% : The Port to SCADA is busy.
The port is busy.
Error #769: Device TOSCADA, Function %% Port Name %% : The f_buf is missing !!
Error #770: Device TOSCADA, Function %% Port Name %% : Cannot find site index and
port.
There is a problem in PLC table or site table definition.
Error #771: Device TOSCADA, Function %% Port Name %% : Not enough memory for the
application.
Memory problem. Consult product group.
Error #772: Device TOSCADA, Function %% Port Name %% : flashapp_get_block() has

failed !!
Error #773: Device TOSCADA, Function %% Port Name %% : flashapp_cur_burn() has

failed !!
Error #774: Device TOSCADA, Function %% Port Name %% :

Not found the loaded software for the port. This port is not operational.
PLC port connected to master is not operational. Consult product group.
Error #775: Device TOSCADA, Function %% Port Name %%

The download of software for the port failed.
Download of software for third party protocol has failed.
Error #776: Device TOSCADA, Function %% Port Name %%

Received a reply frame from the SWITCHER while there is no software loaded
for the port.
The received frame (reply) has been freed. No software loaded for third party
protocol port.
562
Error Messages
Error #820: Userrom Plc module, Function %%

Control Format Error !
Communication protocol format error. May indicate system software problem.

Pushbyte To fbuf Failed !

Pusblock To fbuf Failed !

Get_coldef_tab Failed !

Data Type Format Error In Protocol !
Communication format error. Consult product group.

Data Type Mismatch !
Data type error when accessing a column via PLC communication. Data type
mismatch.

Number of elements must be greater from 0

First Y – coord. out of range !
This message indicates that the SCADA accesses via PLC communication a row
which is out the range of defined rows.

Last Y – coord. out of range !
This message indicates that the SCADA accesses via PLC communication a row
which is out the range of defined rows.

Unpack of f_buf failed !
563
Error Messages

Scan failed. No rows in column !

Cannot allocate f-buf !

Reply Format Error !
Communication format error in the reply frame. May indicate system software
problem. Consult product group.

Cannot Find PLCStt !

Iolink definition problem of PLC column !

Some PLC address in not defined in PLC Table !
Define all PLC addresses in the PLC Table.

Illegal Data Type !

Reply ignored, when no application
This message may appear during an additional application download.

Reply Ignored, Not Waiting For Reply !

Reply Ignored due to unpack failure!
564
Error Messages

Reply Ignored, site index and port not as expected!

Reply Ignored, sequence number not as expected!
Timeout problems. Consult product group.

Reply Ignored, length is not as expected!

Reply Application Error %% !

Cannot Find PLC address %% in download process or userrom not OK.
Can not perform PLC communication while application not loaded or during
application download.

Failed to find PLC address %% in PLC Table.
Define all PLC addresses in PLC Table.

When referring RTU PLC from rungs, you must define in IOLINK only the (z,x,y)
coordinates !
The length of each coordinate must be 1 byte !
I/O link definition error in PLC type column.

Destination PLC IOLINK data type error !
When referring RTU PLC from rungs, the data type of the column in I/O Link
must be defined as one of the followings:
a) PLCBIT
b) PLCVAL
c) PLCFLT
Communication protocol format error. Consult product group.

The length of PLC column being scanned should not exceed 140 bytes !!!
Scan on PLC type column should not exceed 140 bytes.
565
Error Messages
Error #861: The phone connection was established, but the RTU doesn't respond
Different Site ID of the addressed phone number.
Error #862: ML_Dial: TX fail, probably the phone line was disconnected.
Can not transmit due to disconnected phone line.
Error #863: No phone Book in flash memory.

Can not dial without phone book.
Error #875: Status is 'wait for call' but the line is active.
The RTU software status and phone line status do not match; the line will be
disconnected.
Error #876: The TX thread did not hang up the phone line as the RX thread asked.
Error #877: Can not find Site Id – %% in phone book.

Can not dial a Site ID without it being defined in the phone book.
Error #878: Modem refuses to dial this phone number (too long, invalid command, or
answer mode only):
Invalid command (internal problem).
Error #879: Unsuccessful modem configuration (%%,%%)

Failed to configure modem for dialup.
The first %% - Indicates in what stage of configuration it failed:

Reset - Fail to reset modem - Probably wrong reset process; can be
changed in the .stm file.
AT - No response from the modem. - Probably a communication
problem.
File - Modem rejected AT commands from the .stm file. -
Probably wrong .stm file or section in file.
The second %% - Indicates which event caused the modem configuration

attempt.
Startup - Failure to configure modem at cold restart.
Warm reset - Failure to configure modem at warm restart.
Download file - Failure to configure modem after that a new .stm
file was downloaded.
Check that the modem is properly connected. If there is a modem configuration

(.stm) file, check that it is appropriate for the modem. Make sure the modem is
a type that is supported by the RTU.
566
Error Messages
Error #900: PLC Switcher module, Function %%

Fatal ! The SWITCHER Device is destroyed – CRC error !

Cannot allocate a formatted buffer !

Found in port table a logical port i.d with not expected direction
Third party protocol port definition problem.

Remove slice of formatted buffer failed !

Get slice of formatted buffer failed !

buf_f_init of formatted buffer failed !

Switcher format error of received frame !

Illegal direction parameter!! Getting of PLC port failed !
Third party protocol port definition error.

Cannot get the PIN Table !

Cannot find the key of a PLC port software from logical port i.d.!

Cannot find in switcher port table the key of PLC%% connected to %%
PLC table,site table or third party protocol port definition problem.
567
Error Messages

Pull Buffer from Head LIST Failed, although the list is not empty !!

Push Buffer to Head LIST Failed.
Fatal !! The Head List is corrupted !

Push Buffer to Head LIST Failed. Too many buffers in the head list!
The buffer was freed !!
Error #930: MODBUSTM module, Function %%

Illegal state !!

Not enough RAM memory for MODBUS load module connected to MASTER !!

Received the reply not in expected format
Timeout problems or system software problem. Consult product group.

The size of MODBUS format reply is too large or too small
The master should not send frames or poll for frames longer than 140 bytes.

The MODBUS reply frame CRC is not correct
CRC error in MODBUS reply frame.

The size of RTU PLC format reply is too large or too small

No support for broadcast. Frame ignored
The MODBUS module does not support broadcasts.
568
Error Messages

MODBUS to RTU PLC format translation of control failed !!
Unable to interpret MODBUS format frame. May indicate system software

RTU to MODBUS format translation of reply failed !!
Unable to combine MODBUS reply. May indicate system software problem.

The received frame is too long for the RX buffer of the module !!
The MODBUS master should not send frames or poll for frames longer than 140
bytes.

The size of translated to RTU PLC format control is too large for the buffer
The received MODBUS frame is too long.

The RTU PLC reply format buffer is less than 2 bytes!

The RTU PLC format NACK buffer is greater than 2 bytes!

The RTU PLC format spare field is not 0 !!

The box number of the reply is not as expected!!
Timeout problems. Consult product group.

The length of pure data in frame is not as expected!!

Can not pack in 1 byte the N_BYTES field in 1 byte.
The value of N_BYTES > 0xff.
569
Error Messages

The ACK reply received with data. Expecting ACK with no data !

Received a non supported function request
Received a request from MODBUS master that is not supported by the RTU.
Request is ignored.

Number of elements must be less from 0xff.
Received a request for more than 0xff elements.

The FLUSH function failed, but continuing

The Set Parameters function failed, but continuing
Error #970: MODBUSTS module, Function %%

Illegal state !!

Not enough RAM memory for MODBUS load module connected to PLC !!



The size of MODBUS format reply is too large or too small
570
Error Messages

MODBUS to RTU PLC format translation of reply failed !!

No support for broadcast. Frame ignored
No support for broadcast frames in MODBUS protocol.

The CRC of MODBUS control frame is not correct !

The control frame in MODBUS format is too long for the module or is too short !

The control frame in RTU PLC format is too long for the module or is too short !

Illegal opcode (command) in RTU PLC format control !

Pure data in Poll control. No data must appear in this control !!

The N_ELM field in poll control is zero !
It must be GE from 1.

Could not translate the RTU PLC to MODBUS because the MODBUS buffer is
too short

Could not translate the RTU PLC to MODBUS !
No support for the data type appearing in a poll control !
571
Error Messages

The length of pure data in send control is 0 !!
It must be GE from 1

The N_ELM field in send control is EQ 0 !

The length of pure data in send control is greater from 0xff !
It must be LE from 0xff !

The length of pure data does not fit to the data type and to the N_ELM field in
RTU PLC format frame !

No support for the data type in the send control frame !

The expected length of pure data reply is GT 0xff bytes. Modbus protocol does
not allow read of DATA the length of which is GT 0xff bytes

The length of exception reply is not as expected

The reply header contents is not as expected

The reply frame length is not as expected
572
Error Messages

RTU to MODBUS format translation of control has failed !!
Error #1000: ABTS module, Function %%

Illegal state !!

No support for non MOSCAD master in Allen Bradley protocol
No support for MOSCAD/MOSCAD-L as slave in Allen Bradley protocol.

The control frame in RTU PLC format is too long for the module or is too short !


Could not translate the RTU PLC to Allen-Bradley !
No support for the data type appearing in a poll control !

Number of bits must be a multiple of 16 !
The length of PLC_DI or PLC_DO column must be a multiple of 16.

Failed to build the reply or command in Allen Bradley format !

Pure data in Poll control. No data must appear in this control !!

573
Error Messages

The length of pure data in send control is 0 !!


No support for the data type in the send control frame !

The opcode in RTU PLC format is neither SEND nor POLL !

The expected reply length in RTU PLC format is too long !
There is no support for replies longer than 140 bytes. Do not scan columns
longer than 140 bytes.

Failed to decode the Allen-Bradley reply !

The size of Allen-Bradley format reply is too large or too small
The reply should not exceed 140 bytes.


Not enough RAM memory for Allen-Bradley load module connected to PLC !!

Allen-Bradley to RTU PLC format translation of reply failed !!
Internal communication protocol format error. Consult product group.
574
Error Messages
Error #1100: Invalid Destination Address : %%

X25 address is too short. Can not operate call request.
X.25 address is too short.
Error #1101: Local port #%% was not found. destination Address is : %%
X25 address contains unidentified port.
Can not switch since local port is not available.
Error #1102: Invalid router 'PROVIDER' Mode: %%

Invalid mode.
Error #1103: Router table #%%, Channel #%% – status is %%

Expected status is %%, Operation code is: %%
Incorrect operation according to the states table for a single logic channel. For
example, data transfer in an unopened channel.
Error #1104: Invalid Self Address : %%

Illegal RTU X25 address.
The X.25 address defined in the configuration is not correct.
Error #1105: Router table #%% does not contain logical channel #%%
Illegal logic channel.
The logic channel does not exist. May indicate system software problem.
Error #1107: Invalid Calling Address : %%

Illegal initiator's X25 address.
Error #1108: Number Of Slaves – %% is Greater Than Number of Sites – %%

The additional slaves that do not have corresponding sites are not useful.
Error #1109: Attempt To Use Slave With No Entry in Site table – %%

RTU defined as Master can not operate without Site table.
Error #1110: Self Site ID is not defined in X.25 Addresses Table. Please add it to your
Addresses Table.
Modify X.25 Addresses Table.
Error #1111: Call Request Aborted - UnKnown Site ID: %%

Check X.25 Addresses Table.
575
Error Messages
Error #1112: Call Request Aborted - UnKnown X.25 address: %%

Error #1113: Invalid Convert table X.25 address <--> site

Error #1150: Bad Primitive – Msg Id: %% Child Id: %% Msg Type: %% Child State: %%
The operation does not match the status table.
X25 MSG TYPE :
0xc000 Transmit request 0xc00a Call response

0x8001 Received packet 0xc00b Clear request
0xc002 Timeout 0xc00c Clear response
0x8004 Establish indication (L2) 0xc00d Interrupt request
0x8005 Establich confirmation (L2) 0xc00e Interrupt response
0x8006 Disconnect indication (L2) 0xc00f Reset request
0x8007 Disconnect confirmation 0xc010 Reset response
0xc009 Call request
LAPB MSG TYPE :
0xc000 Transmit request 0x8004 Establish request

0x8001 Receive frame 0xc005 Disconnect request
0xc002 Timeout
X25 STATE :
0 Ready 5 Clear request by upper

1 Waiting for peer 6 Flow control (connected)
2 Waiting for upper 7 Reset request by peer
3 Call collision 8 Reset request by upper
4 Clear request by peer
LAPB STATE :
0 Disconnected 3 Established (connected)

1 Awaiting for establish 4 Timer recovery
2 Awaiting for disconnect 5 FRMR condition
Operation does not exist in states table of X25/LAPB.
Error #1151: Invalid ID – Msg Id: %% Msg Type: %%

Illegal X25/LAPB channel ID.
Error #1152: Channel Not Init – Msg Id: %% Msg Type: %%

Uninitialized X25/LAPB channel.
Error #1153: Intr_ID: %% Code: %% Len: %% Params: %%

X25 internal errors.
CODE :
1 Rx frame discarded no header

2 Rx frame discarded inactive Intr.
3 Rx frame discarded Intr. not establish
4 Rx frame discarded packet too short
5 Rx frame discarded bad GFI
6 Rx frame discarded unassigned lcn
576
Error Messages
7 Bad interface state

8 Bad interface state
9 Bad lchan state
10 Rx a DL_DICS_IND from lower layer
11 Rx a DL_DICS_CNF from lower layer
12 Timeout when executing restart
13 Transmit t_frame failed
14 Received r_frame failed
15 Timeout when executing reset
16 Undefined packet type.
17 Inconsistent Qbit.
18 Dbit=0, Mbit=1, and not full
19 Can't split t_frame: No mem
20 Received a DIAGNOSTIC packet
21 Packet too long
22 No msg for packet copying
23 Rx DL_CONN_CNF without asking
24 No msg for Ind. to upper
25 Net congestion/operational
26 Received reg.cnf without Req.
27 Received a restart packet
28 Registration request timeout
Error #1154: LAPB ID: %% Code: %%

LAPB internal errors.
CODE :
1 Unsolicited S, F=1 (code A)

2 Unsolicited DM, F=1 (code B)
3 Unsolicited UA, F=1 (code C)
4 Unsolicited UA, F=0 (code D)
5 Unsolicited DM, F=0 (code E)
6 Peer initiated re-connect (code F)
7 SABME retry limit (code G)
8 DISC retry limit (code H)
9 Status enquiry retry limit (code I)
10 N(R) error (code J)
11 FRMR received (code K)
12 Unimplemented frame (code L)
13 I field not permitted (code M)
14 Frame with wrong size (code N)
15 N1 error (code O)
16 N(S) error
17 Cannot tx control: no memory
18 Cannot pass control to lower
19 Cannot pass I to lower
20 No confirmation from lower
21 Frame(s) in garbage queue
22 Cannot pass I to upper
23 Unexpected P/F bit in UI
24 Rx frame discarded (no header)
25 FRMR retry limit
Error #1230: Chnltest -RX task got err Frame When Called From Trnsintr.
buf_f_get() Returned: %%
Error #1231: Chnltest -Received tested frame too small. Length of frame is %%
Frame lacks its header.
577
Error Messages
Error #1232: Chnltest -Tx Task Could not get a new buffer from heap.
Ret: %%
No buffer for transmission.
Error #1233: Chnltest -Tx Task has Frame area too small for tested frame.
Frame Area Size is %%
Frame size is less than the user's definition in the test's setup. May indicate
system software problem. Consult product group.
Error #1234: Chnltest -Tx Task Failed Transmit Frame. trnsintr_tx_frame()

Returns : %%
Can not transmit a frame via Transport MUX. May indicate system software
Error #1235: Chnltest -Tx Task Failed Getting indx of tested_link in sites_table. Err code %%
Could not get tested link id's index in site table prior to transmitting a frame.
Error #1236: Chnltest -Cannot Handle Control Frame. Another Opcode Already Exist
Error #1237: Chnltest -Received Control Frame (pres_get_struct) too small to decode.
Length of Frame is %%
Error #1238: Chnltest -Control Frame too Small for answer. Length is %%
Error #1239: Chnltest -Received aplic structure with invalid size. Size is %% Length bigger
than buffer or Length small to contain opcode.
Error #1260: Tmrevent: Events/Timers Buffer is Full.

No more buffers for DI events and their related timers. Number of buffers can
be increased in expert screen in configuration.
Error #1261: Tmrevent: Events/Timers were Ignored – NO 'Get Event' for %% msec
DI events and/or related timers were not checked (by GtEvnt function in rungs)
during a time interval longer than the maximum time that was defined in the
expert screens, and therefore were ignored.
578
Error Messages
Error #1450: Ladder or C application needs I/O modules with DI, but Configuration I/O
modules do not have the expected amount of DI
Define more DI modules in Site Configuration.
Error #1500: ‘TxIntrc’ was called with invalid address ‘ITxStn’ %%

This error occurs when you call the TxIntrc function with the wrong StnAck
variable. See Intrac Protocols chapter in Advanced Features in the Application
Programmer manual.
Possible range: 0-2047.
Error #1501: ‘TxIntrc’ was called with invalid group ‘ITxGrp’ %%

This error occurs when you call the TxIntrc function with the wrong ITxGrp
Programmer manual.
Error #1502: ‘TxIntrc’ was called with invalid direction ‘ITxDir’ %%

This error occurs when you call the TxIntrc function with the wrong ITxDir
Programmer manual).
Error #1503: ‘TxIntrc’ was called with invalid value ‘ITxDat’ %%

This error occurs when you call the TxIntrc function with the wrong ITxDat
Programmer manual.
Possible ranges: Analog from -512 to 511.

Counter 0-999
Bits 0-255
Error #1504: ‘TxIntrc’ was called with invalid subgroup ‘ITxSub’ %%

This error occurs when you call the TxIntrc function with the wrong ITxSub
Programmer manual.
Possible range: 0-3
Error #1505: ‘TxIntrc’ or ‘ TxWdth’ was called with invalid link ‘Tx_Lnk’ %%
This error occurs when you call the TxIntrc or TxWdth functions with the
wrong Tx_Lnk variable. See Intrac Protocols chapter in Advanced Features in
Possible ranges: Radio (1)
579
Error Messages
Line (2)
LOTrnk (1)
HiTrnk (11)
Error #1506: ‘TxWdth’ was called with invalid address ‘TxTo’ %%

This error occurs when you call the TxWdth function with the wrong TxTo
Programmer manual.
Possible range: 0-8191
Error #1509: Received frame with invalid length %% from INTRAC/MEIC port
In the INTRAC case, the frame length is 4 bytes. In the MEIC case the frame
length is 5-16 bytes. Any other length is invalid.
Error #1545: INTRAC modem piggyback has error %%

The error message ID (%%) may be one of the following:
ID Description
160 Piggyback got control frame from 68302 with invalid opcode
161 Piggyback got characters from 68302 not between 0A and 0D
162 Piggyback got from 68302 control frame too large
163 Piggyback got from 68302 overrun byte in rxsci
164 Piggyback got from 68302 character when cyclic buffer full
165 Piggyback tried to close frame with invalid framelength
166 Piggyback has buffer with invalid ID
167 Piggyback has buffer with invalid temporary length
168 Piggyback has pulled empty buffer which is not last in frame
169 Piggyback has watchdog reset
170 Piggyback has clock fail reset
171 Piggyback has a spike
172 Piggyback has idle line
173 Piggyback got from 68302 frame error
174 Piggyback got from 68302 noise error
175 Piggyback Config register not programmed properly
Error #1553: Failed configuring or diagnosing INTRAC modem (ID = %%)

ID Description
100 RTU received irrelevant config/diagnostics ACK from piggyback
101 RTU received irrelevant config/diagnostics ACK from piggyback
102 Piggyback failed to write parameters to its internal eeprom
103 RTU did not receive answer about config/diagnostics from piggyback
580
Error Messages
Error #1555: Cannot operate repetition, Heap is empty

Heavy transmission traffic not necessarily on the INTRAC/MEIC only, but
because the heap serves the other MDLC channels.
Error #1557: INTRAC system table: invalid station address (StnAdr) %%

Invalid StnAdr value in the INTRAC system tables (database builder).
Possible range: 0-8191
Error #1563: INTRAC system table: invalid repeater mode (RptMod) %%

Invalid RptMod value in the INTRAC system tables (database builder).
Possible range: 0-1
Error #1564: Transmission failed: %% channel at INTRAC/MEIC port (ID = %%)

The first variable in this message is the channel name. The second (ID) may be
one of the following:
ID Description
0 0comm module failed physical_transmit()
1 0comm module failed physical_wait(EOTX)
10 Fskadp could not transmit because CTS signal is stuck. It means that the
piggyback internal buffer is full.
11 Fskadp could not transmit because the channel was busy
12 UART transmission timeout occurred at Fskadp module
13 ‘Wait for Holdup’ transmission timeout occurred af Fskadp
14 fskadp_warmup() was called with illegal piggyback
Error #1601: Could not identify INTRAC Modem piggyback

Problem with identifying the modem board. Possible hardware problem.
Error #1602: Failed testing INTRAC modem piggyback (CTS signal)

Hardware problem in modem.
Error #1638: INTRAC system table: invalid radio warmup time (R_Ptt) %%
Invalid R_Ptt value in the INTRAC system tables (database builder).
Possible range: 10-60000 msec.
Error #1639: INTRAC system table: invalid radio override time (ROvrid) %%
Invalid ROvrid value in the INTRAC system tables (database builder).
581
Error Messages
Error #1640: INTRAC system table: invalid radio quiet time (RQuiet) %%
Invalid RQuiet value in the INTRAC system tables (database builder).
Error #1641: INTRAC system table: invalid line warmup time (L_Ptt) %%
Invalid L_Ptt value in the INTRAC system tables (database builder).
Error #1642: INTRAC system table: invalid line override time (LOvrid) %%
Invalid LOvrid value in the INTRAC system tables (database builder).
Error #1643: INTRAC system table: invalid line quiet time (LQuiet) %%
Invalid LQuiet value in the INTRAC system tables (database builder).
Error #1700: Failed initiating GPS port

Port 2, connected to GPS, cannot be initialized, because of hardware problem.
Error #1701: Transmission failure to GPS

Transmission to GPS failed because of hardware problem.
Error #1750: Insufficient dynamic memory. Needed: %%

Cannot allocate memory for “C” block because the size indicated in Site
Configuration is insufficient.
Error #1751: Invalid block

Invalid “C” block loaded to the RTU. Its calculated CRC does not match that of
the loaded block. Reload the “C” block.
Error #1752: User Application Error:

Occurs as a result of MOSCAD_error function usage in one of the “C” blocks
loaded to the RTU.
Error #1763: 'C' Block version is higher than system 'C' application version.
582
Error Messages
Error #1764: 'C' block no. %% contain invalid name %% in the user_jumptable.
Check the function names entered in the user_jumptable. An invalid name is
one whose length is more than six characters or one which contains a blank or
other invisible character.
Error #1770: The Downloadable "C" function is running too long. Could not delete it from
table.
Occurs as a result of error in one of the “C” blocks loaded to the RTU.
Error #1790: Socket Opening failed.

Communication problem with MDLC over IP.
Error #1791: Socket Connection failed.

Communication problem with MDLC over IP.
Error #1810: Could not abort the master sessions. The master channels are not stopped.
Problem with C master session during Download.
Error #1900: Cannot push into queue - it has reached maximal size
Error in MDLC over IP. Buffers for transmission are coming into queue faster
than port can take them. Up to 255 messages may be stored in transmission
queue prior to transmission from SLIP line. This error occurs if trying to
transmit more than this.
Error #1904: Destination site ID %% not supported

Error in MDLC over IP. Site ID does not appear in the IP Conversion Table.
Check if Site has IP address or if Site ID is correct.
Error #1905: Sync transmission is not supported

Error in MDLC over IP. RTU cannot send Sync frames through this link. Error
is obsolete.
Error #1906: Invalid conversion table in Flash

Error in MDLC over IP. IP Conversion Table which was downloaded could not
be read or is invalid. There may be a problem with the Flash or with the IP
Conversion Tool. Consult product group.
Error #1907: IP address in conversion table for this CPU is %% instead of the configured %%
Error in MDLC over IP. Mismatch in IP Conversion Table between the IP
address of this RTU and the one configured in the table. Correct either the table
or the Site ID.
583
Error Messages
Error #1908: Configured IP address (%%) of this CPU is in use by site %%

Error in MDLC over IP. Error in IP addresses. This error is obsolete.
Error #1909: Failed configuring radio in encryption mode.

Error in MDLC over IP for Astro radio. Problem with radio configuration.
Relevant for encryption mode only.
Error #1910: Failed transmission to Site %% because its IP address is myself.

RTU tried to transmit to a destination site with the same IP address as the RTU.
As a result, transmission failed. Check IP address conversion table for the
specified site; it will have the same IP address as that of the RTU. Correct IP
address.
Error #1911: User configured RTU IP address as %% instead of modem’s configuration %%

Future use. This error will occur when connecting to a non-iDEN packet data
modem with Learn IP Address as NO. When the IP addresses configured in the
modem and RTU differ, the RTU has not learned the address from the modem.
Reconfigure RTU IP address or consult product group.
Error #1912: Modem not configured for Packet data properly (error code %%)
Modem packet data parameters are not appropriate, e.g. no Home Agent IP
address, or no RTU IP address as expected by the infrastructure.
Error #1913: Failed connect IPMODM to Timer key.

Internal use; should not occur. Denotes SLIP port configuration failure.
Error #1914: Got alarm %% from iDEN modem

Got unexpected software alarm from modem (which is not software or
registration.) Denotes a problem with the modem software. Consult product
group.
Error #1915: Unsupported 'connect to' %% device in MDLC over IP port

‘Connect to’ parameter is not supported by this system. This is provided for
future configuration having new drivers that will be downloaded to older
systems that does not support them.
Error #1916: MDLC Compression not supported in Slip/PPP port

This error is set when future configurations that support MDLC compression on
Slip/PPP will be downloaded to older systems that do not support it.
584
Error Messages
Error #1917: MDLC confirmed link not supported in Slip/PPP port

This error is set when future configurations that support MDLC link capability
between adjacent sites on Slip/PPP will be downloaded to older systems that
does not support it.
Error #1918: Dial operation not supported in Slip/PPP port

This error is set when future configurations that support dial operation on
Slip/PPP will be downloaded to older systems that do not support this feature.
Dial operation is a qualifier specifying when RTU needs to connect and initiate
Slip/PPP. When not used or not supported RTU is always connected.
Error #1919: Dial number not supported in Slip/PPP port

This error is set when future configurations that support dial numbers on
Slip/PPP will be downloaded to older systems that do not support it. Dial
number is an alternate string (such as phone number) used when connecting to
modem instead of common ATD. Even though not supported, user can still
specify this string and others by using a Standard Modem configuration through
a downloaded IP Modem file.
Error #1920: %%
This error is set when there was a problem reading/executing a command from
the IP Modem file. The IP Modem file is read when configuring a Standard
Modem for Slip/PPP port.
Error #1921: Failed set PPP parameter %% as %%

The specified PPP parameter in the configuration file could not be set to the
specified value. Enter a valid value for this variable according to the MDLC
over IP description in the Toolbox documentation (modem configuration file
section).
Error #1922: Failed configure %% %% times for %% seconds

The RTU failed to configure, connect or context activate a packet data
modem/radio after the specified amount of time. Check the connection with the
radio/modem, and check with the operator why radio/modem failed to connect
with infrastructure. To increase the timeout from the specified value, modify it
in the Site Configuration or in the max_failedtime variable in the modem
configuration file.
Error #1923: IP Conversion table is full cannot add site ID %%

The RTU could not add a new, learned site ID to the IP conversion table.
Therefore, it could not reply to this unregistered site ID. Increase the maximum
size of the IP Conversion Table in the Site Configuration.
585
Error Messages
Error #1940: Port connection type changed to slip

This error is set when a PPP configuration was downloaded into a system that
does not support PPP (such as systems with small FLASH). Slip is used instead
of PPP.
Error #1950: Failed to push buffer to the reception queue of the dowloaded protocol driver
Error #1951: Failed to get character(s) from the reception queue of the dowloaded protocol
driver
Error #1952: The reception queue of the dowloaded protocol driver is full
Driver of second protocol is not emptying frames from queue fast enough.
Error #2000: No SYNC server list was found in flash. Authentication was not activated.
An Authentication information table should be defined in the Network
Configuration tool.
Error #2001: An invalid SYNC server list was found in flash. Authentication was not activated.
A new Authentication information table should be defined in the Network
Configuration tool.
Error #2002: Warning: Link ID %% was denoted as an authenticated one but an error
occurred while trying to use authentication on this Link.
Authentication was not possible on the specified Link ID. Recheck the network
configuration and the port.
Error #2003: Number of Links reported to AuthSync does not match the number of Links
known to the Network layer.
Recheck the network configuration and the ports.
Error #2004: Warning: User has denoted to activate authentication but this could not be done
due to invalid parameters.
Be aware that Authentication is not currently active. Check Authentication
parameters in the Network Configuration tool.
Errors #3000-3999 are used for MOSCAD NFM.
Error #4030: Invalid access code to logging flash %%.

May indicate system software error. Consult product group
586
Error Messages
Error #4031: Logflash operation (%%) failure: %%.

Operation to the logging flash has failed. See error codes in the ‘C” Toolkit for
MOSCAD Family RTUs manual.
Error #4200: Failed to deregister application sockets after %% ms.

PureIP only – For internal use.
Errors #5000-6999 are used for IP Gateway (MCP-T).
Errors #7000-9999 are used for C Applications.
Errors #10000-12999 are used for IP Gateway (MCP-M/T).
587
Error Messages
Compiler Error List

This section lists and explains the errors and warnings which may appear at the end of compilation.
Error #1 Failed to allocate compiler space

Not enough memory on the PC.
Error #2 Disk error

Error #3 Not enough memory

Error #4 Free memory error

Error #5 Compiler does not support this application version. Please upgrade.
For example, under the compiler option ≥ V3.70 you cannot compile an
application that has been developed under ToolBox version V1.61.
Error #6 <Element> cannot be used in this application version. Please upgrade: <rung
name>.
For example compiler version < 3.70 does not support CALC. The solution is to
upgrade to a version above 3.70 and to use the option above 3.70.
Error #7 <Element> is not supported by this compiler: <rung name>

For example, An application created under ToolBox < 3.70 does not support
CALC. You must upgrade the application to a version above 3.70.
Error #8 Cannot create application file

Creation of the application file has failed (in version <3.70 srecord file,
otherwise a binary file). Try closing applications that open files.
Error #9 Cannot create rungs map

Creation of map file produced by the compiler for monitoring has failed. Try
closing applications that open files.
Error #10 Cannot create DB map

588
Error Messages
Error #11 Cannot create timers map

Error #12 Cannot create RAM map

Creation of file that includes the necessary RAM during download has failed.
Try closing applications that open files.
Error #13 RAM overflow

RAM overflow. In versions < 3.70 RAM is limited to 64Kbytes.
Error #14 Error: PPM list overflow

The memory allocated to PPM during compilation is full.
Error #15 Error: Time-tag list overflow

The memory allocated to Time-tag during compilation is full.
Error #16 Error: Application space overflow. Only <# of bytes> were allocated.
Not enough memory for compiling the application.
Error #17 Data type FLASH/RAM overflow
Error #18 Bit not in byte boundary: <symbol name> <rung name>
The operation requires this bit to be in the beginning of the byte.
Note: B,0 or B,1 as a byte notation is applicable only for the MOVE/MOVH
functions. In any other bit function, B,0 is identified as the first bit in a series,
bit B,1 as the second, and so forth. Bit,8 is the first bit in the second byte.
Error #19 JMP is valid only in the same process <rung name>
JMP is allowed only between rungs within the same process.
Error #20 JSP-RUNP is valid only to a process <rung name>

JSP-RUNP is allowed only to a process that appears in the process list.
Error #21 JMP-JSP-RUNP Missing symbol name <rung name>

The variable is not defined as a rung name/process name.
Error #22 JMP-JSP-RUNP to rung which does not exist: <rung name which does not
exist> <rung name>
JMP-JSP-RUNP outputs are allowed to existing rungs/processes.
589
Error Messages
Error #23 JMP-JSP-RUNP longer than 32K bytes is not supported in this compiler option.
Try to relocate Rungs/Process or to upgrade <rung name>
Error #24 Cannot change a constant variable <rung name>

Constant value cannot be changed.
Error #25 Missing symbol name <rung name>

The variable is not defined in a rung name.
Error #26 Differentiator requires index

It is not allowed to use differentiators without an index variable in case indexed
elements exist in the rung.
Error #27 Cannot use more than 1024 differentiators up/down <rung name>
This error happens when executing compilation in version < 3.70.
Error #28 Differentiator requires input on the left side <rung name>
This element cannot appear at the beginning of a rung.
Error #29 Missing CALL name <rung name>

The CALL function is not defined. Enter the CALL output operator and select
the appropriate function allowed from the available possibilities.
Error #30 Error: Missing or invalid UCALL function name

The first parameter of UCALL, which is the function name, is missing.
Error #31 Cannot use timer ON&OFF in same timer: <symbol name><rung name>
It is not allowed to use DON and DOF operators on the same timer.
Error #32 Index value is too large: <symbol name> <rung name>
The defined index value (<IN,18>, for example) is greater than the last index
row in the multiple-column table. Correct the last index row or the rung.
Error #33 Bad mapping: <map symbol name> index value is too large: <map destination>
row in the multiple-column table. Correct the last index row or the rung.
Error #34 Cannot change index using another index: <rung name>
It is not allowed to move one index variable to another. For example, to define:
MOVE,I to J (where I and J are defined as index variables).
590
Error Messages
Error #35 Cannot mix bit & value operands in OR, XOR, AND operators: <rung name>
It is not allowed to mix bit and value data types in Boolean operations: AND,
OR, and XOR.
Error #36 Cannot use indexed bit operand in this operation: <rung name>
It is not allowed to use an indexed bit variable (BIT,I for example) in this
operation.
Error #37 Output column length must be as long as input column length: <rung name>
Input(s) column length(s) should be as long as the output column length (for
example, in order to carry out MOVE operation of BIT1 and BIT2 to BIT3,
column index rows of BIT1, BIT2, and BIT3 should be the same).
Error #38 Index or indexed operand cannot mix with bit in this operation: <rung name>
In this operation it is not allowed to mix a symbol name which is an index or an
indexed symbol name with bits. For example, to MOVE bit to I, or IN,I to bit.
Error #39 Use MOVE (instead of MOVH) in bit to bit & value to value operations: <rung
name>
Use MOVE output operator (and not MOVH) to MOVE bit to bit, and value to
value operations.
Error #40 Cannot mix bit & float operands in this operation: <rung name>
It this operation it is not allowed to mix float and bit operands.
Error #41 Cannot mix value & float operands in this operation: <rung name>
It this operation it is not allowed to mix float and value operands.
Error #42 Cannot move float to index <rung name>

It is not allowed to MOVE from a float operand to an index operand.
Error #43 Cannot operate on empty table <rung name>

This operation cannot be carried out when the table is empty.
Error #44 Error: Cannot CPY to index <rung name>

You cannot copy into the index.
Error #45 Error: Cannot use float or bit operand as length in CPY
The length parameter cannot be of float or bit type.
Error #46 Use site name only as an input <rung name>

It is not allowed to use Site Names (defined in the Site table) as outputs.
591
Error Messages
Error #47 Cannot use port with no matching line in ports table
Using one of the CALL functions on a row that does not exist in the User Ports
table.
Error #48 Scan in valid only in I/O columns <rung name>

SCAN output operators can be activated only on I/O columns.
Error #49 Fetch/Store requires at least nn bytes space: <rung name>
Error #50 Fetch/Store - illegal parameter data type: <rung name>
Error #51 Incompatible depts between duplicate & source columns: <column name>
<Table number>
Error #52 Cannot call AGA3 function - AGA3 tables missing

Error #53 Cannot call AGA7V function - AGA7V tables missing
Error #54 Cannot call AGA7M function - AGA7M tables missing
The indicated functions cannot be called because the corresponding tables are
missing.
Error #55 Cannot call PID function - PID tables missing

The indicated function cannot be called because the corresponding table is
missing.
Error #56 Constant index is required <rung name>
Error #57 Cannot open configuration file

It is impossible to compile without assigning configuration file.
Error #58 Error: In SEND – Index does not exist: <Index name> <rung name>
The index variable is not defined. For example, when using <IN,I> symbol
name, I is not defined. Return to the index table to define the index variable and
then compile.
Error #59 Error: In CALC - Cannot handle so many functions in a formula: <rung name>
Error #60 Error: In SEND – Name does not exist: <symbol name> <rung name>
Variable name is not defined in data base tables (IN, for example). Return to
data base builder to define the symbol name and then compile.
Error #61 Error: In CALC - Cannot handle so many symbols in a formula: <rung name>
Error #62 Error: In SEND – Simple table with index: <symbol name> <rung name>
It is not allowed to use a variable of a single-column table with index. Use
multiple-column table and define the symbol name.
592
Error Messages
Error #63 Error: In CALC - Cannot use float operands with logic operation: <rung name>
Error #64 Error: In SEND – Index value too large: <symbol name> <rung name>
row in the multiple-column table. Correct the last index row and then return to
the rung.
Error #65 Error: In CALC - Empty formula: <rung name>
Error #66 Error: In SEND – Number exceeds size of vector: <rung name>
When the SEND operator uses the following format: '100<IN>, it means that
100 values should be sent under <IN> vector. This operation is not allowed if
the last index row in the multiple-column table is less than 100.
Error #67 Error: In CALC - Cannot CALL into an index: <rung name>
Error #68 Error: In SEND – Cannot operate on bits vector: <rung name>
SEND operator (in ASCII) is not applicable for a data base table of bits.
Error #69 Error: In CALC - Missing symbol name: <rung name>
Error #70 Error: In SEND - Cannot use more than 10 variable strings in message: <rung
name>
Up to 10 string variables can be used in SEND.
Error #71 Error: In SEND – Cannot Operate On Constants: <rung name>

With the SEND operator it is not allowed to use constants (only variables may
be used).
Error #72 Error: In SEND - Not enough space for message: <rung name>
Not enough memory to process all the text in SEND.
Error #73 Error: In I/O link - Fail to open I/O link, reoperate I/O link phase
Problem in I/O link file open (*.L4). Try closing applications that open files.
Error #74 Error: In I/O link - Application does not match I/O link file, reoperate I/O link
phase
Recreate the I/O link file.
Error #75 Error: In I/O link - Not enough memory, reoperate I/O link phase
Error #76 Error: In I/O link - Error while reading I/O link file, reoperate I/O link phase
The I/O link file is corrupted. Recreate the file.
593
Error Messages
Error #77 Error: In I/O link - Fail to count I/O times, reoperate I/O link phase
The I/O link file is disrupted. Recreate the file.
Error #78 Internal error in in rung - re-write the rung <rung name>
Earlier versions contained an infrequent bug, and the new version of the
compiler checks for it. If this message appears, just re-write the rung.
Error #79 Error: In I/O link - Fail to load modtype.txt, reoperate I/O link pahse
The modtype.txt file is missing. Reinstall ToolBox.
Error #80 Error list was truncated – cannot display more errors
This error appears when the list exceeds 1,000 errors.
Corrupted Database Errors

The following is caused by a corrupted database:
1 Cannot get column type: <table number> <column number>
2 Cannot get table information: <table number>
3 Cannot get include file: <file name>
4 Cannot get rung: <rung name>
5 Error: In SEND - Cannot get table type: <rung name>
6 Cannot find process to which rung belongs: <rung name>
7 Cannot process rung elements
9 Cannot get constant value: <rung name>
10 Cannot find constant value: <rung name>
11 Branch stack empty: <rung name>
12 Branch stack full: <rung name>
13 Branch rung: <rung name>
14 Unknown JMP/JSR/RUNP element: <rung name>
15 Invalid rung: <rung name>
16 Internal error in disassembly
Warning List
1 Warning: JMP to same rung: <rung name>
2 Warning: JSP to same process: <rung name>
3 Warning: Undefined I/O LINK value
4 Warning: Undefined mapped field: table #<TAB NUMBER> column #<COL
NUMBER>
5 Warning: This function is not implemented yet: <rung name>
6 Warning: No SCAN operation
594
Error Messages
7 Warning: Use MOVE to change element in Time & Date Table

8 Warning: Compiler ignores rungs without output element: <rung name>
9 Warning: The same UCALL function uses different parameters
NUMBER/ORDER/TYPE: <function name> <rung name>
10 Warning: DON without input is not an effective operation: <rung name>
595

Application Programmer

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Application Programmer

Hochgeladen von

Copyright:

Verfügbare Formate

Application Programmer

Programming ToolBox for

MOTOROLA and the Stylized M Logo are registered in the U.S.

Copyright © Motorola 2005 All Rights Reserved

This warranty is void if:

b. the product has been subject to misuse, accident neglect or damage;

This warranty applies only within the United States.

COMPUTER SOFTWARE COPYRIGHTS

ACCESSING DATABASE VARIABLES VIA COORDINATES ........................................................................................ 204

SOFTWARE DIAGNOSTICS OUTPUT ....................................................................................................................... 368

• The user-oriented database is easy to understand, define, and modify.

The following figure illustrates a single-column table:

All variables in a specific column share the same data type.

The following figure illustrates a multiple-column table:

Single- and Multiple-Column Tables: A Comparison

The symbolic constants provide the following:

The following figure illustrates a system constant table:

• Discrete – Internal Bit (bit)

Discrete – Internal Bit (bit)

Integer Value – Internal Integer Value (int)

Real Value – Internal Real Value (real)

Integer Parameter – Internal Integer Parameter (iprm)

Real Parameter – Internal Real Parameter (rprm)

Discrete Input (d-i)

Discrete Output (d-o)

Value Input (v-i)

Value Output (v-o)

Scaled Analog Input (sAI) )

Scaled Analog Output (sAO) )

Mapped Discrete (mbit)

Mapped Value (mval)

Hours Timer (Hr:Mn)

Minutes Timer (Mn:Sc)

Seconds Timer (Sc:Ms)

Pulses Per Hour (pph) )

Programmable Ladder Controller (plc_vi, plc_vo, plc_di, plc_do, plc_ri, plc_ro)

“Inputs” and “Outputs”

Ladder Diagram Elements

• Elements that define relations to “inputs” (“input operator”)

• Elements that define an operation to be performed on an “output” according to the “result”

“Normally-Open (N.O.) Contact” Element

• Discrete (internal bit)

“Relay On” Element

• Discrete (internal bit)

HeatSw LvLSw Heater

In Boolean algebra, the rung above represents an AND operation:

Heater is “on” when: HeatSw is “on” AND LvlSw is “on”

In notation form: Heater = HeatSw⋅LvlSw

“Normally-Closed (N.C.) Contact” Element

• Discrete (internal bit)

HeatSw LvLSw Valve Heater

2. A motor (MOTOR) is to be switched on when at least one of three push-buttons

PB1 EMRG MOTOR

3. Let us also consider a more complex function:

“Relay Off” Element

• Discrete (internal bit)

For example, suppose that device C is to be stopped on the operation of device A or B:

In Boolean algebraic notation this may be expressed as a NOR operation: C = A + B or

Or in Boolean algebraic notation: C = A⋅ B

• Integer Value, Real Value

The rung performing the required control function is described below:

HeatSw LvlSw Valve TEMP Heater

HeatSw LvlSw Valve TEMP Heater

The condition greater-or-equal to and smaller-or-equal to should be written as follows: