Foxboro™ SCADA

FoxRTU Station
User’s Guide

*B0780AF* *M*

B0780AF, Rev M

May 2020

https://www.se.com
Legal Information
The Schneider Electric brand and any trademarks of Schneider Electric SE and its subsidiaries referred to
in this guide are the property of Schneider Electric SE or its subsidiaries. All other brands may be
trademarks of their respective owners.

This guide and its content are protected under applicable copyright laws and furnished for informational
use only. No part of this guide may be reproduced or transmitted in any form or by any means (electronic,
mechanical, photocopying, recording, or otherwise), for any purpose, without the prior written permission
of Schneider Electric.

Schneider Electric does not grant any right or license for commercial use of the guide or its content,
except for a non-exclusive and personal license to consult it on an "as is" basis. Schneider Electric
products and equipment should be installed, operated, serviced, and maintained only by qualified
personnel.

As standards, specifications, and designs change from time to time, information contained in this guide
may be subject to change without notice.

To the extent permitted by applicable law, no responsibility or liability is assumed by Schneider Electric
and its subsidiaries for any errors or omissions in the informational content of this material or
consequences arising out of or resulting from the use of the information contained herein.
Contents FoxRTU Station User's Guide

Contents
Preface ......................................................................................................................... 13
Revision Information .................................................................................................. 13
Related Documents ................................................................................................... 13
Global Customer Support .......................................................................................... 13
We Welcome Your Comments .................................................................................. 13
Chapter 1: Introduction.................................................................................................. 14
SCD2200 RTUs......................................................................................................... 14
FoxRTU Station ......................................................................................................... 14
System Requirements ............................................................................................ 14
Firmware ................................................................................................................... 15
Chapter 2: Software Installation .................................................................................... 16
Full Install .................................................................................................................. 16
Software Updates ...................................................................................................... 18
Release Notes ........................................................................................................... 18
Chapter 3: Navigation ................................................................................................... 19
Software Layout ........................................................................................................ 19
Menu Bar ................................................................................................................... 20
File Menu ............................................................................................................... 20
Edit Menu............................................................................................................... 21
Tools Menu ............................................................................................................ 21
Help Menu ............................................................................................................. 23
Multiple Ways to Select a Menu................................................................................. 23
Workspace ................................................................................................................ 24
Chapter 4: Projects, Groups, and RTUs ........................................................................ 26
Overview ................................................................................................................... 26
Creating a Project ...................................................................................................... 26
Grouping RTUs ......................................................................................................... 27
Adding RTUs ............................................................................................................. 27
Renaming .................................................................................................................. 27
Project Properties ...................................................................................................... 28
Chapter 5: RTU Configuration ....................................................................................... 29
Overview ................................................................................................................... 29
Add Modules ............................................................................................................. 29
Backplanes and Racks........................................................................................... 29
Adding Modules ..................................................................................................... 30
Example ................................................................................................................. 31

B0780AF, Rev M 3
FoxRTU Station User's Guide Contents

RTU Properties.......................................................................................................... 32
Protocols ................................................................................................................... 33
FoxRTU Protocol ................................................................................................... 35
Modbus .................................................................................................................. 35
DNP3 ..................................................................................................................... 37
P6008 .................................................................................................................... 43
Allen Bradley DF-1 ................................................................................................. 46
SNMP .................................................................................................................... 47
HART ..................................................................................................................... 48
User Defined .......................................................................................................... 48
NTP ....................................................................................................................... 48
HTTP ..................................................................................................................... 50
Terminal Server ..................................................................................................... 51
Ports .......................................................................................................................... 55
Ethernet ................................................................................................................. 57
Serial (RS232/422/485).......................................................................................... 58
Serial (Fiber Optic) ................................................................................................. 60
Dual Serial ............................................................................................................. 60
Dialup .................................................................................................................... 60
Line ........................................................................................................................ 61
HART ..................................................................................................................... 62
Spread Spectrum Radio ......................................................................................... 63
Routes ....................................................................................................................... 64
RTU Networking..................................................................................................... 64
Indirect Routing ...................................................................................................... 67
Relaying Radio Messages ..................................................................................... 68
Dynamic Route Changes ....................................................................................... 69
IP Routes ............................................................................................................... 69
Phone Numbers ........................................................................................................ 70
Programs................................................................................................................... 71
Redundancy Settings ................................................................................................ 73
Module Properties ..................................................................................................... 74
PS-1x/2x ................................................................................................................ 74
CP-3 ...................................................................................................................... 74
MC-31 .................................................................................................................... 75
AI-10 ...................................................................................................................... 75
AO-2/3 ................................................................................................................... 76
IO-3/5..................................................................................................................... 76
DO-1/2/6 ................................................................................................................ 77

4 B0780AF, Rev M
Contents FoxRTU Station User's Guide

DI-10 ...................................................................................................................... 78
DI-5 ........................................................................................................................ 79
Chapter 6: Dictionary .................................................................................................... 80
Variables ................................................................................................................... 80
ISaGRAF ............................................................................................................... 80
Dictionary Workspace ............................................................................................ 81
Adding Variables ....................................................................................................... 82
Variable Names ..................................................................................................... 82
Creating a Single Variable ..................................................................................... 82
Creating Multiple Variables .................................................................................... 84
Creating DNP3 Variables ....................................................................................... 85
Editing Variables ....................................................................................................... 86
Exporting and Importing Variables ............................................................................. 89
Chapter 7: Maps ........................................................................................................... 90
Viewing RTU Locations ............................................................................................. 90
Positioning an RTU.................................................................................................... 91
Finding an RTU ......................................................................................................... 92
Chapter 8: ISaGRAF ..................................................................................................... 93
ISaGRAF Overview ................................................................................................... 93
Function Blocks ......................................................................................................... 94
Getting Started .......................................................................................................... 94
Defining a Program ................................................................................................ 94
Entering Logic ........................................................................................................ 97
Downloading to the RTU ...................................................................................... 100
Debugging with ISaGRAF .................................................................................... 101
ISaGRAF Dictionary ............................................................................................. 103
How Logic is Executed ............................................................................................ 104
ISaGRAF Tips ......................................................................................................... 105
ISaGRAF Variable Types ........................................................................................ 106
Standard Variable Types...................................................................................... 106
Other Variable Types ........................................................................................... 107
IOPOINT Types ................................................................................................... 108
ISaGRAF Constants ................................................................................................ 109
ISaGRAF Reserved Names..................................................................................... 110
ISaGRAF Licensing Details ..................................................................................... 111
Chapter 9: ISaGRAF Function Blocks ......................................................................... 112
FoxRTU Protocol ..................................................................................................... 115
FOX_RX_DATA ................................................................................................... 115
FOX_TX_DATA ................................................................................................... 116

B0780AF, Rev M 5
FoxRTU Station User's Guide Contents

FOX_NW_RX_DATA ........................................................................................... 117

FOX_NW_TX_DATA ........................................................................................... 118
FOX_RX_UPDATE_SINGLE ............................................................................... 118
FOX_GET_VARIABLE ......................................................................................... 119
FOX_SET_VARIABLE ......................................................................................... 120
FOX_RX_EVENT_LOGS ..................................................................................... 121
FOX_TX_EVENT_LOGS ..................................................................................... 122
DNP3 Protocol......................................................................................................... 124
DNPM_CLASS_POLL.......................................................................................... 124
DNPM_INTEGRITY_POLL .................................................................................. 125
DNPM_READ_GROUP ....................................................................................... 125
DNPM_ANALOG_16BIT_COMMAND ................................................................. 126
DNPM_ANALOG_32BIT_COMMAND ................................................................. 127
DNPM_ANALOG_FLOAT_COMMAND ............................................................... 127
DNPM_BINARY_COMMAND .............................................................................. 128
DNPM_FREEZE_COUNTERS ............................................................................ 129
DNPM_UNSOL_ENABLE .................................................................................... 129
DNPM_UNSOL_DISABLE ................................................................................... 129
DNPM_COLD_RESTART .................................................................................... 130
DNPM_WARM_RESTART .................................................................................. 130
DNPM_CLEAR_RESTART .................................................................................. 130
DNPM_LINK_RESET........................................................................................... 131
DNPM_TIME_SYNC ............................................................................................ 131
DNPS_NEED_TIME ............................................................................................ 131
DNPS_UNSOL_ENABLE..................................................................................... 131
DNPS_UNSOL_DISABLE.................................................................................... 132
Modbus Protocol ..................................................................................................... 133
MODBUS ............................................................................................................. 133
Allen Bradley DF1 Protocol...................................................................................... 135
ABDF1_RX .......................................................................................................... 135
ABDF1_TX........................................................................................................... 136
HART Protocol ........................................................................................................ 137
HART ................................................................................................................... 137
SNMP Client Protocol .............................................................................................. 139
SNMP_GET_INT ................................................................................................. 139
SNMP_GET_UINT ............................................................................................... 140
SNMP_GET_STRING .......................................................................................... 140
SNMP_GET_OBJID............................................................................................. 141
SNMP_GET_BULK .............................................................................................. 141

6 B0780AF, Rev M
Contents FoxRTU Station User's Guide

SNMP_SET_INT .................................................................................................. 142

SNMP_SET_UINT ............................................................................................... 142
SNMP_SET_STRING .......................................................................................... 143
SNMP_SET_OBJID ............................................................................................. 143
SNMP_SET_VALUE ............................................................................................ 144
SNMP Trap Protocol................................................................................................ 145
SNMP_GET_TRAP.............................................................................................. 145
SNMP_SEND_TRAP ........................................................................................... 146
User Defined Protocol ............................................................................................. 147
USER_TX ............................................................................................................ 147
USER_RX ............................................................................................................ 147
USER_RX_BYTES .............................................................................................. 148
General Communications ........................................................................................ 148
FOX_GET_COMM_STATS.................................................................................. 148
FOX_RESET_COMM_STATS ............................................................................. 149
FOX_GET_PORT_STATS ................................................................................... 150
FOX_RESET_PORT_STATS .............................................................................. 150
FOX_GET_PENDING .......................................................................................... 151
FOX_GET_ROUTE.............................................................................................. 152
FOX_SET_ROUTE .............................................................................................. 153
Event Logging ......................................................................................................... 154
FOX_EVENT_LOG .............................................................................................. 154
FOX_CLEAR_EVENT_LOGS .............................................................................. 154
FOX_GET_EVENT_LOG_COUNT ...................................................................... 155
RTU System Data ................................................................................................... 156
FOX_GET_ADDRESS ......................................................................................... 156
FOX_GET_FIRMWARE ....................................................................................... 156
FOX_GET_RTU_TYPE........................................................................................ 156
FOX_GET_SYSTEMID ........................................................................................ 157
FOX_GET_PROCESSOR ................................................................................... 157
FOX_GET_MODULE_TYPE ................................................................................ 157
FOX_GET_MODULE_OK .................................................................................... 158
FOX_RESET_MODULE ...................................................................................... 158
REBOOT.............................................................................................................. 158
FOX_GET_RTC ................................................................................................... 159
FOX_SET_RTC ................................................................................................... 159
FOX_GET_TIME.................................................................................................. 159
FOX_SET_TIME .................................................................................................. 160
GET_BP12V ........................................................................................................ 161

B0780AF, Rev M 7
FoxRTU Station User's Guide Contents

GET_LOWBATT .................................................................................................. 161

SET_BPFIELD ..................................................................................................... 161
SET_BPAUX........................................................................................................ 162
Math and Logic ........................................................................................................ 163
INCREMENT ....................................................................................................... 163
DECREMENT ...................................................................................................... 163
ChangeDetect ...................................................................................................... 163
MulDiv .................................................................................................................. 164
MULDIV_INT ....................................................................................................... 164
BCD_TO_BINARY ............................................................................................... 164
BINARY_TO_BCD ............................................................................................... 165
FPACK ................................................................................................................. 165
FUNPACK............................................................................................................ 165
F64PACK ............................................................................................................. 166
F64UNPACK ........................................................................................................ 166
U32PACK ............................................................................................................ 167
U32UNPACK ....................................................................................................... 167
U64PACK ............................................................................................................ 168
U64UNPACK ....................................................................................................... 168
NBIT .................................................................................................................... 169
NCBT ................................................................................................................... 169
NOBT................................................................................................................... 169
PID Controller .......................................................................................................... 171
FOX_PID ............................................................................................................. 171
Gas Flow Calculations ............................................................................................. 173
FOX_AGA3 .......................................................................................................... 173
FOX_AGA5 .......................................................................................................... 175
FOX_AGA7 .......................................................................................................... 176
FOX_AGA8_G ..................................................................................................... 178
FOX_AGA8_D ..................................................................................................... 180
FOX_NX19 .......................................................................................................... 182
Obsolete Function Blocks ........................................................................................ 183
IMAGE ................................................................................................................. 183
TRIO .................................................................................................................... 183
FOX_CLEAR_PENDING ..................................................................................... 183
DNPM_LINK_RESET........................................................................................... 183
CURRENT_ISA_DATE ........................................................................................ 183
AS_AE ................................................................................................................. 183
FC_GET_STAT.................................................................................................... 183

8 B0780AF, Rev M
Contents FoxRTU Station User's Guide

MATRIX ............................................................................................................... 183

Chapter 10: ISaGRAF Logic Examples ....................................................................... 184
Detecting Modules ................................................................................................... 184
Scaling .................................................................................................................... 184
Hours ON ................................................................................................................ 185
Counting Pulses ...................................................................................................... 185
Flow Totalization ..................................................................................................... 185
Daily Totals ............................................................................................................. 186
Exception Reporting Digitals.................................................................................... 187
Monitoring a Single Bit ......................................................................................... 187
Monitoring Multiple Bits ........................................................................................ 187
Sending the Exception Report.............................................................................. 188
Exception Reporting Analog Variables..................................................................... 188
Event Logging ......................................................................................................... 189
Logging FoxRTU Variables .................................................................................. 189
Logging DNP Variables ........................................................................................ 189
Logic Examples – Polling......................................................................................... 190
Basic Polling ........................................................................................................ 190
Polling After Data Has Expired ............................................................................. 191
Modbus Protocol ..................................................................................................... 192
Setting up an RTU to be a Modbus Slave ............................................................ 192
Setting up an RTU to be a Modbus Master .......................................................... 192
Allen Bradley Protocol ............................................................................................. 194
Communicating with an Allen Bradley SLC500 PLC ............................................ 194
Chapter 11: Redundancy ............................................................................................ 196
Redundant Processors ............................................................................................ 196
Overview .............................................................................................................. 196
Active and Standby Processor Operation ............................................................. 196
Configuring Redundant Processors...................................................................... 197
Detecting Status in Logic ..................................................................................... 199
Shared IP Address ............................................................................................... 200
Downloading Configurations ................................................................................ 200
Redundant Power Supplies ..................................................................................... 200
Redundant Communications ................................................................................... 201
Redundant PCs ....................................................................................................... 202
Chapter 12: Security ................................................................................................... 204
Overview ................................................................................................................. 204
Security Policies ...................................................................................................... 204
Project Tamper Detection ........................................................................................ 206

B0780AF, Rev M 9
FoxRTU Station User's Guide Contents

Security Policy Distribution Scenarios...................................................................... 207

Securing an RTU ................................................................................................. 207
Project Copies on Same PC................................................................................. 208
RTU Connections................................................................................................. 209
Securing a Project ................................................................................................... 210
Unsecuring a Project ............................................................................................... 211
Role Based Access Control ..................................................................................... 212
Roles and Permissions ............................................................................................ 213
Managing Users ...................................................................................................... 214
Adding a User ...................................................................................................... 214
Deleting a User .................................................................................................... 216
Managing Roles ...................................................................................................... 216
Adding a Role ...................................................................................................... 216
Deleting a Role .................................................................................................... 218
Managing a Secured RTU ....................................................................................... 218
Securing an RTU ................................................................................................. 218
Connecting to a Secured RTU ............................................................................. 219
Unsecuring an RTU ............................................................................................. 220
Maintaining Security ................................................................................................ 220
Passwords ........................................................................................................... 220
Other Considerations ........................................................................................... 221
Chapter 13: Local Backups ......................................................................................... 222
Overview ................................................................................................................. 222
Making a Backup ..................................................................................................... 222
Deleting a backup .................................................................................................... 224
Restoring a Project .................................................................................................. 225
Chapter 14: Connecting to an RTU ............................................................................. 226
Cables ..................................................................................................................... 226
LAN Port Setup ....................................................................................................... 227
Connection Parameters ........................................................................................... 229
Discovery ................................................................................................................ 230
Ethernet ............................................................................................................... 230
Serial ................................................................................................................... 231
RTU Restart ............................................................................................................ 232
Factory Reset .......................................................................................................... 233
CP-3/MC-31 – Version 2 Hardware ...................................................................... 233
CP-3/MC-31 – Version 1 Hardware or Old Firmware ........................................... 233
Chapter 15: Download ................................................................................................ 234
Overview ................................................................................................................. 234

10 B0780AF, Rev M
Contents FoxRTU Station User's Guide

Downloading Configurations .................................................................................... 234

Firmware Compatibility......................................................................................... 234
Connection........................................................................................................... 235
Download ............................................................................................................. 236
Reconnection ....................................................................................................... 236
Downloading via a SCADA System ...................................................................... 237
Downloading Firmware ............................................................................................ 237
Overview .............................................................................................................. 237
Connection........................................................................................................... 238
Download ............................................................................................................. 238
Upgrading Redundant Processor Systems........................................................... 239
Downloading Firmware via SCADA ...................................................................... 239
Chapter 16: Viewing Data ........................................................................................... 240
Status ...................................................................................................................... 240
Event Logs .............................................................................................................. 244
Viewing Event Logs ............................................................................................. 244
Event Log Buttons................................................................................................ 245
Event Log Parameters ......................................................................................... 245
Event Log Filter .................................................................................................... 246
Web Interface .......................................................................................................... 247
Overview .............................................................................................................. 247
Using the Web Interface....................................................................................... 247
RTU Status .......................................................................................................... 248
ISaGRAF Variables .............................................................................................. 249
RTU Configuration ............................................................................................... 251
RTU Time Zone ....................................................................................................... 252
Communications...................................................................................................... 254
Comms Analyzer.................................................................................................. 254
Wireshark............................................................................................................. 256
Appendix A: Glossary.................................................................................................. 259
Appendix B: Creating Variables Using Excel ............................................................... 260
Exporting Variables ................................................................................................. 260
Importing Variables.................................................................................................. 260
Spreadsheet Format ................................................................................................ 261
Spreadsheet Parameters ......................................................................................... 262
Appendix C: Protocol Support ..................................................................................... 264
Modbus Slave.......................................................................................................... 264
Modbus Master........................................................................................................ 265
DNP3 Master and Slave .......................................................................................... 265

B0780AF, Rev M 11
FoxRTU Station User's Guide Contents

Appendix D: RTU Variables ........................................................................................ 266

SCD2200 Modular RTU I/O Modules ....................................................................... 266
AI-10 .................................................................................................................... 266
AO-2 .................................................................................................................... 267
AO-3 .................................................................................................................... 267
DI-5 ...................................................................................................................... 268
DI-10 .................................................................................................................... 268
DO-1 .................................................................................................................... 269
DO-2/DO-6........................................................................................................... 269
IO-3...................................................................................................................... 270
IO-5...................................................................................................................... 270
PS-1x or PS-2x .................................................................................................... 271
FoxRTU Register Variables ..................................................................................... 272
Modbus Variables .................................................................................................... 272
DNP3 Variables ....................................................................................................... 273
DNP3 Internal Indication Register............................................................................ 273

12 B0780AF, Rev M
Preface FoxRTU Station User's Guide

Preface
The FoxRTU Station User Guide describes about the FoxRTU Station Version 2.3.3, a
Windows-based software application used to configure and monitor the SCD2200 RTU.
Refer to System Requirements for information on this version of FoxRTU Station.

This version of FoxRTU Station should be used with CP-3 processors running firmware
Version 6793 or later. For additional information, see Firmware.

Revision Information
This revision of the document includes these changes:

Chapter 3 • Updated Upload>Configuration in Tools Menu

Chapter 15 • Updated Download section

Related Documents
• EcoStruxureTM Foxboro SCADA SCD2200 Hardware User's Guide (B0780AE)

Find the latest version of these documents on the Global Customer Support

(GCS) website.

Global Customer Support

For support, visit https://pasupport.schneider-electric.com (registration required).

We Welcome Your Comments

We want to know about any corrections, clarifications, or further information

you would find useful. Send us an email at systemstechpubs@se.com

B0780AF, Rev M 13
FoxRTU Station User's Guide Chapter 1: Introduction

Chapter 1: Introduction
SCD2200 RTUs
A Remote Telemetry Unit (RTU) is a device that contains
processing and communications equipment and is often
located in a remote place. SCD2200 RTUs can interface to
switches, relays and sensors, and connect to other
intelligent devices via a wide range of supported protocols.

SCD2200 RTU features include:

• A wide range of modular analog and digital I/O
• Non-volatile event logging
• Support for diverse communications media – data radios, dialup and cellular
modems, leased line, Ethernet and more…
• PLC-like logic processing utilizing all IEC 61131-3 languages
• Live logic debugging
• Support for multiple protocols in the same installation: FoxRTU, Modbus,
DNP3 (with secure authentication), SNMP, Allen Bradley DF1 and more.
• Support for redundant power supplies, redundant processors and redundant
communications – to maximize system availability

FoxRTU Station
This manual describes FoxRTU Station Version 2.3.3. FoxRTU Station is a Windows based
software application used to configure and monitor the modular SCD2200 RTUs using the
CP-3 processor.

The manual also covers the basic usage of ISaGRAFTM, which is used for logic entry and
debugging. Further details may be found in the ISaGRAF on-line help.

System Requirements
FoxRTU Station is supported on the following PC operating systems:

Operating System 32-bit 64-bit

Windows 10 Professional Not tested Supported and tested
Windows 8.1 Professional Supported and tested Supported and tested
Windows 7 Professional SP1 Supported and tested Supported and tested
Windows XP and earlier Not supported Not supported
Windows Server 2008-2012 Not tested Not tested

14 B0780AF, Rev M
Chapter 1: Introduction FoxRTU Station User's Guide

Firmware
Firmware is the software that is built into the RTU processor modules. FoxRTU Station and
the RTU firmware work closely together, so it is important that compatible versions are used.

This version of FoxRTU Station should be used with CP-3 processors running firmware
Version 6793 or later.

It may also be used with RTU processors with earlier firmware, subject to the restrictions
outlined under Firmware Compatibility. Be aware that some of the firmware features
described in this manual may not be supported in earlier firmware, or may work differently.

Certain features described in this manual may require firmware that is later than version
6793. These are identified by the note: “(requires recent firmware)”.

Firmware updates are available from the Global Customer Support website
(https://pasupport.schneider-electric.com), and may be installed using FoxRTU Station (see
Downloading Firmware). Check the firmware release notes to determine whether the feature
you require is implemented in that release.

Note: A firmware release contains all the changes and features described in its Release
Notes, including those made in preceding versions and also listed in the Release Notes.
Parallel firmware release streams may exist from time to time, which means that a
chronologically later firmware release (one with higher version number) may not necessarily
contain all the changes and fixes made in a release with a lower version number. For any
release, only those changes listed in its Release Notes are included.

B0780AF, Rev M 15
FoxRTU Station User's Guide Chapter 2: Software Installation

Chapter 2: Software Installation

Full Install
FoxRTU Station, ISaGRAF Workbench, and various other files and utilities are normally
supplied on a USB flash drive or CD. If you purchased an ISaGRAF license then you should
also have received a USB license key, or “dongle”. (ISaGRAF can be used in trial mode for
up to 30 days without the license key.)

It is recommended that you close all other programs before starting the installation. You may
also need to temporarily disable anti-virus programs.

During installation, you may be prompted to restart your computer. This can be delayed until
after all applications have been installed.

Insert the FoxRTU Station USB flash drive or

CD into the PC.

Open the drive in Windows Explorer and

double click on the file: autorun.exe

The installation menu should be displayed.

Click the Sentinel USB Driver button on the

installation menu and follow the prompts to
install it on your computer.

This driver provides support for the

ISaGRAF USB protection key.

16 B0780AF, Rev M
Chapter 2: Software Installation FoxRTU Station User's Guide

Click the ISaGRAF button on the installation

menu and follow the prompts to install it on
your computer.

ISaGRAF allows you to develop logic

programs to run on the RTU.

Click the ISaGRAF 5.13.309 update button

in the installation menu and follow the
prompts to install it on your computer.

Click the FoxRTU Station button in the

installation menu and follow the prompts to
install it on your computer.

Installation is now complete. If you were requested to restart your computer, do so now.
If you have an ISaGRAF USB protection key, insert it into a USB port on your computer.
You can now try out FoxRTU Station!

B0780AF, Rev M 17
FoxRTU Station User's Guide Chapter 2: Software Installation

Software Updates
Keep your copy of FoxRTU Station up to date by downloading and installing updates as they
become available.

The latest version of FoxRTU Station can be downloaded from the Global Customer Support
website (https://pasupport.schneider-electric.com). Note that the download package contains
FoxRTU Station software only; you will need to already have installed ISaGRAF 5.13.309
from a FoxRTU Station USB flash drive or CD.

To install an update, simply double click on the downloaded executable file. This will start the
FoxRTU Station installer.

New releases of FoxRTU Station will normally be installed alongside the previous release,
so you can have versions 2.2.0 and 2.1.0 installed at the same time, for example. If desired,
the older version can be uninstalled via Windows Control Panel. Minor updates will normally
replace the installed version, e.g. Version 2.2.1 would replace 2.2.0.

Release Notes
Release notes are supplied with each FoxRTU Station release. These describe the changes
made in each version, and any other special instructions that may be required. Be sure to
read these before installing or using FoxRTU Station.

18 B0780AF, Rev M
Chapter 3: Navigation FoxRTU Station User's Guide

Chapter 3: Navigation
Software Layout
FoxRTU Station employs a layout similar to many Windows applications. The Workspace
and many of the menus are contextual meaning the display will vary according to what is
currently selected.

Legend
The title bar displays the name of the active project (if open) and the FoxRTU Station
A program version

B The menu bar allows access to the FoxRTU Station commands.

The tool bar allows access to all FoxRTU Station commands.
C Note: Some commands are only available when an RTU is selected in the navigation
pane.
The stacked menu bar selects between broad categories of information to be
D displayed in the Workspace.

E The status bar displays information about the progress or result of an action.
Workspace displays variable information depending on the currently selected items in
F the navigation pane and stacked menu bar. This may include system configuration,
modules, variables and event logs.
The navigation pane displays the hierarchy of projects, groups and RTUs. Clicking on
G an item displays relevant information in the Workspace; double clicking allows the
item’s properties to be viewed and edited.

B0780AF, Rev M 19
FoxRTU Station User's Guide Chapter 3: Navigation

Menu Bar
The commands available from the Menu bar options – File, Edit, Tools and Help are
described below. Some commands can be accessed using shortcut keys. These are listed
alongside the Menu Bar commands shown below.

File Menu

New: Allows a new project, group, RTU,

module, FTA server or variable to be created.

Note the menu items are disabled if not

applicable to the current selection.

Open: Opens an existing project.

Close: Closes selected project

Save: Saves selected project

Save As: Allows project to be saved with a

new name and in a new location.

Export: Allows an entire project to be

migrated to another computer using the To
File or To Email option, or the projects
dictionary and symbol information to be
exported to Excel for editing.

Import: Allows dictionary variables to be

imported from an Excel spreadsheet. The
format of the spreadsheet must be the same
as the spreadsheet created using the Export
To Excel function above.

Recent Projects: Recently opened projects

are listed here.

Exit: Closes FoxRTU Station program.

20 B0780AF, Rev M
Chapter 3: Navigation FoxRTU Station User's Guide

Edit Menu

Cut: Copies the selected RTU configuration

and then deletes it from the project.

Copy: Copies the selected RTU configuration.

Paste: Pastes the last copied RTU

configuration into the selected group or
project.

Rename: Allows the name of a project, group

or RTU to be changed. Names can include
spaces, hyphens ( - ), underscores ( _ ),
commas ( , ) and periods ( . ).

Delete: Deletes the selected group, RTU or

module (modules are selected in the
workspace). Note projects cannot be deleted,
only closed. If you wish to delete a project,
Windows Explorer is required.

Properties: Allows the settings for a project,

group, RTU or module to be changed.

Tools Menu

Connection: Contains settings for how to

communicate with the selected RTU. Only
available when a project, group or RTU is
selected. See Connection Parameters.

Discovery: Detects all RTUs on the same

subnet as the PC Ethernet port(s), or
connected to the PC’s serial port.

ISaGRAF: Launches the ISaGRAF logic

editor for the selected RTU.

Build: Compiles the configuration and

ISaGRAF programs for the selected RTU.
This provides a way to check the configuration
and logic for errors.

Build and Export: Compiles the configuration

and ISaGRAF programs for the selected RTU,
with the option to save the resulting output
file. This file can then be downloaded and
activated via DNP3 file transfer, using a
SCADA system.

B0780AF, Rev M 21
FoxRTU Station User's Guide Chapter 3: Navigation

Download: Downloads the compiled

Configuration and/or Logic (and optionally the
complete project for later retrieval) to the
selected RTU. FoxRTU Station will
automatically compile the configuration and/or
logic if required before downloading. See
Download for more details.

Download > Firmware: Downloads new CP-

3 or MC-31 firmware. See Download for more
details.

Upload > Configuration: Retrieves the

current configuration from the connected RTU
and creates a new project from it. This project
will contain module definitions and settings,
but not any user logic running on the RTU. If
you chose the Configuration, Logic and
Project option when the configuration was
downloaded to the RTU, the user logic will
also be uploaded, but it will not be loaded
automatically. The package containing the
user logic will be saved to a specific folder as
prompted by the dialog box below:

Copy the package file project.zip to a

suitable folder, unzip it, and open it in FoxRTU
Station. The entire project including
configuration and logic will be loaded.

Upload > Service Report: Requests the RTU to prepare a diagnostic service report
(requires firmware version 2918 or later). If you encounter a problem with the RTU, our
support team may ask you to email the service report that the problem can be diagnosed
more quickly.

Restart: Restarts the selected RTU.

Advanced > Download MC-3 firmware: Used to download firmware to an MC-3 module.

Status: Displays live status information for the selected RTU. Multiple module status
windows can be viewed at the same time for the one RTU.

22 B0780AF, Rev M
Chapter 3: Navigation FoxRTU Station User's Guide

Help Menu

FoxRTU Station help: Displays the FoxRTU

Station online help.

Show FoxRTU Station log files: Opens the

folder where FoxRTU Station stores
diagnostic logs during operation. If you
encounter a problem using FoxRTU Station,
our support team may ask you to email the
files in this folder so that the problem can be
diagnosed more quickly.

About FoxRTU Station: Displays FoxRTU

Station version number and other information.

Multiple Ways to Select a Menu

In many cases there are multiple ways to select commonly used functions. The examples
below show different ways to edit the RTU properties.

Via Menu Bar: Select the RTU name in the

navigation pane.

Then select Edit  Properties.

Via Right-click menu: Right-click the RTU

name in navigation pane.

Then select Properties.

Via Double-click: Double-click the RTU

name in the navigation page

Via Keyboard Shortcut: Select the RTU

name in the navigation pane and press
Alt+Enter.

B0780AF, Rev M 23
FoxRTU Station User's Guide Chapter 3: Navigation

Workspace
The workspace area is context-specific, meaning that it will change according to what is
currently selected in the navigation pane and stacked menu bar.

The various Workspace displays are shown below:

Default View

Displayed when FoxRTU Station is first

started or Projects is selected in the
navigation pane.

The Recent Projects that were opened in the

past can be opened again.

View RTUs

When a project name is selected in the

navigation pane, the RTUs and RTU groups in
that project are displayed in the workspace.

View Modules

When an RTU name is selected in the

navigation pane, the RTU’s modules are
displayed in the workspace.

This view allows module properties to be

configured (double-click on any module).

For more information please see the topic

RTU Configuration - Module Properties.

24 B0780AF, Rev M
Chapter 3: Navigation FoxRTU Station User's Guide

View Dictionary

When an RTU name is selected in the

navigation pane, the RTU’s dictionary is
displayed in the workspace.

This view allows variables to be edited

(double-click on an existing variable) or
created (select the New button).

For more information see Dictionary.

Event Log

When an RTU name is selected in the

navigation pane, the RTU’s event log is
displayed in the workspace.

This view allows event logs to be retrieved

from an RTU, filtered, exported (saved) and
cleared.

For more information see Viewing Event Logs.

Comms Analyzer

When an RTU name is selected in the

navigation pane, a list of received and
transmitted communications messages is
displayed in the workspace.

This is useful for diagnosing communications

issues. See Comms Analyzer.

Map

When an RTU name is selected in the

navigation pane, the workspace displays the
RTU location on a map, if it has been set.

For more information see Maps.

B0780AF, Rev M 25
FoxRTU Station User's Guide Chapter 4: Projects, Groups, and RTUs

Chapter 4: Projects, Groups, and RTUs

Overview
In FoxRTU Station, a system is organized into the following hierarchy:
• A project contains all settings for the entire system. This may encompass many
RTUs spread across multiple sites.
• The project may optionally define groups of RTUs which share something in
common, e.g. they might be located at the same site.
• An RTU represents a physical RTU – a rack of modules, including at least one
CP-3 processor. The RTU has various properties that can be set, and various
status items that can be viewed.
• An RTU consists of the configured set of modules. Like RTUs, individual modules
have properties that can be set, and status items that can be viewed.

Projects and groups are only used by FoxRTU Station to organize how the information is
displayed and saved. Project and group names are not downloaded into the RTU.

All settings for a project (including details for any RTUs defined therein) are saved to a
project folder on the PC’s file system. The name and location of this folder is specified
when you first save the project.

Creating a Project
A new project must be created before any RTU configurations can be created.

Create New Project

Select New  Project

Alternatively, right click on Projects in the navigation pane and

select New Project.

You can also create a project by clicking on the Start a new project
link on the default workspace screen.

26 B0780AF, Rev M
Chapter 4: Projects, Groups, and RTUs FoxRTU Station User's Guide

Grouping RTUs
When configuring multiple RTUs, they can be kept in groups. Grouping similar RTUs can
simplify large project layouts, for example, outstations and master RTUs may be grouped.

Create New Group

Select the project name in the navigation pane, then select New 
Group.
Alternatively, right-click on the project name and select New Group.

Adding RTUs
RTUs can be added directly into a project or added into a project group.

Create New RTU

Select the project or group name in the navigation pane, then select
New  RTU

Alternatively, right-click on the project or group name and select

New RTU.

Select a numeric address for the RTU (1-65520, remaining

addresses are reserved) and click OK. A minimal RTU configuration
will be created containing power supply and processor
modules/cards.

Renaming
The new project, group and RTUs can be renamed.

Rename Project, Group or RTU

Select the project, group or RTU in the navigation pane, then select
Edit  Rename.
Alternatively, right-click on the name and select Rename.

B0780AF, Rev M 27
FoxRTU Station User's Guide Chapter 4: Projects, Groups, and RTUs

Project Properties
A project has certain properties that can be set. These relate to the overall project, and do
not affect the operation of any RTU.

View/Edit Project Properties

Right-click on the name and select Properties (or just

double-click the Project name).

Name: (up to 255 characters) a descriptive name for the

project can be entered here.
Names can include spaces, hyphens (-), underscores (_),
commas (,) and periods (.). Other special characters are
not permitted.
If no name is entered then you will be prompted for one
when the project is saved to disk.
Location: This link will open the project folder in
Windows Explorer.
Note: This link is for reference only. Do not change or
open any files in the project folder.

28 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Chapter 5: RTU Configuration

Overview
The primary function of FoxRTU Station is to configure one or more SCD2200 RTUs so that
they can perform the required functions. This involves specifying:
• Types of power supply, processor, I/O and communications modules
• Communications protocols to use (Modbus, DNP3, etc.)
• Routes, which specify the ports to use to communicate with other RTUs or devices
• Protocol and I/O points of the required types (boolean, integer, etc.)
• Logic processing functions, which are entered using ISaGRAF (ladder logic,
structured text, etc.)
• Other settings and options (addresses, timeouts, security, etc.)

These settings are saved to a project file on the PC, then compiled into a form which can be
downloaded to each RTU’s processor module.

Add Modules

Backplanes and Racks

Physically, all modules in a modular RTU are installed on a backplane. A backplane has 2,
4, 6 or 12 slots.

An RTU’s backplanes are organized into between one and four linked racks. Each rack
supports up to 16 modules and may contain either one or two linked backplanes. Therefore,
the maximum number of modules per RTU is 64.

The slot numbers for a given backplane depend on the type of backplane and the rack
number. The rack number is configured using DIP switches on the backplane. Rack #1
always contains slots 1-16, Rack #2 contains slots 17-32, Rack #3 contains slots 33-48 and
Rack #4 contains slots 49-64.

Rack #1 will normally consist of one of the following backplane configurations:

Backplane Type Rack #1 Slot Numbers
2-slot powered 1 2
4-slot powered 1 2 3 4
6-slot powered 1 2 3 4 5 6
4-slot 13 14 15 16
4-slot 1 2 3 4
6-slot 1 2 3 4 5 6
12-slot 1 2 3 4 5 6 7 8 9 10 11 12
12-slot + 4-slot 1 2 3 4 5 6 7 8 9 10 11 12  13 14 15 16

B0780AF, Rev M 29
FoxRTU Station User's Guide Chapter 5: RTU Configuration

To accommodate additional modules, up to three further racks can be connected. For

example, Rack #2 would normally consist of one of the following backplane configurations:
Backplane Type Rack #2 Slot Numbers
4-slot  29 30 31 32
4-slot  17 18 19 20
6-slot  17 18 19 20 21 22
12-slot  17 18 19 20 21 22 23 24 25 26 27 28
12-slot + 4-slot  17 18 19 20 21 22 23 24 25 26 27 28  29 30 31 32

Note that:
• The powered backplanes (BP-x) include an integrated power supply, so a PS-xx
power supply module is not required. (An external 12V DC supply is required.)
These backplanes are intended for small, single-rack systems, although additional
passive backplanes (xBPLN) can still be connected.
• The 4-slot passive backplane version 3.3 and higher can be configured (via DIP
switches) to have slot numbers 1-4 or 13-16. Earlier revisions have slots numbered
13-16.
• The  symbol denotes a cable link between backplanes.

FoxRTU Station does not distinguish between physical backplanes – it treats the RTU as a
single unit with 64 slots, numbered 1-64. It is important, however that each module’s slot
number be entered correctly. For example, in a small RTU with a single early revision 4-slot
passive backplane, the entered slot numbers should be in the range 13-16, not 1-4.
Likewise, if two 12-slot backplanes are chained together, the available slot numbers will be
1-12 and 17-28, not 1-24.

For more information, refer to the SCD2200 Hardware Manual, available for download from
the Global Customer Support website.

Adding Modules
When you first create an RTU in FoxRTU Station, it will contain two modules by default: a
power supply module in backplane slot 1 and a processor module in slot 2.

Modules can now be added or moved to build up the desired RTU layout.

For a modular RTU, module types that can be added include:

• Power supply modules (PS-1x/PS-2x). Multiple power supplies can be included to
provide redundancy.
• Processor modules (CP-3). At least one CP-3 must be present. A second CP-3 can
be included, for redundancy. If two CP-3s are used then one must be in an even
slot and the other in an odd slot.
• Communications modules (MC-31, or its predecessor, MC-3). These provide
additional Ethernet or serial communications ports (up to 3 ports per module)
• I/O modules (AI-10, AO-2, AO-3, DI-10, DI-5, DO-1, DO-2/6, IO-3, IO-5), which
provide analog/digital inputs and outputs.

FoxRTU Station will automatically create variables in the dictionary corresponding to all the
I/O points in each power supply or I/O module.

30 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Add New Module

Verify that Projects is selected in the stacked menu bar.

Select the RTU name in the navigation pane, then select

New  Module

Alternatively, right click on the RTU name and select

New Module.

Following the selection, the module type and slot number

can be selected, and module properties can be changed.

The slot number is automatically incremented by the

software as modules are added and tested for validity.

Example
In the following example project, two RTUs have been defined. Details are displayed for
RTU #17 (“Pump room”). This RTU consists of a single 4-slot rack (slots 13-16), which
contains a power supply, CP-3 processor, digital output module and a communications
module.

B0780AF, Rev M 31
FoxRTU Station User's Guide Chapter 5: RTU Configuration

RTU Properties
The RTU Properties menu allows the global settings of each RTU to be modified. The
settings are grouped into several tabs.

The General tab contains descriptive settings (name, location, etc.) and protocol addressing
information.

Edit RTU Properties

Right-click on the name and select Properties (or

just double-click the Project name).

Address: (1-65520) Each RTU must have a unique

address.

System ID: (00 to FF Hex) The communications sync

character used to screen incoming FoxRTU protocol
messages. An RTU will only respond to messages that
have the same sync character as this System ID. Use the
AE default except when configuring an RTU to relay radio
messages as detailed in the topic RTU Configuration -
Routes, Relaying Radio Messages.

Enable ISaGRAF debugging: If checked, online

ISaGRAF debugging will be enabled. Otherwise, it will be
blocked, which improves system security.

Name: (0 to 64 characters) Name of the RTU.

Description: (0 to 255 characters) Description of the RTU.

Time zone: (optional) If a time zone is selected, all date

and time values received from the RTU will be displayed
using this time zone. If set to “unspecified”, RTU times are
not assumed to be in any particular time zone, and no
corrections will be applied. See RTU Time Zone for more
information.

Longitude, Latitude: (optional) RTU location, see Chapter

7: Maps.

Maximum Event Logs: (0-100,000; default = 10,000) The

maximum number of event logs to maintain in Flash
memory. Once the maximum limit is reached, the oldest
events are overwritten. If the limit set is greater than 200,
then the value will be rounded up to the next multiple of
200.

32 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Protocols
A protocol is a set of communication commands used to communicate with a device. The
RTU supports the following protocols:

Protocol Type Purpose Port type

FoxRTU slave, master RTU configuration and management Ethernet, serial
Data point status and event transfer
Modbus/TCP slave, master Data point status transfer Ethernet
Modbus/RTU slave, master Data point status transfer Serial
Modbus/ASCII slave, master Data point status transfer Serial
DNP3 slave, master Data point status and event transfer Ethernet, serial
P6008 slave Data point status transfer Serial
Allen Bradley master Data point status transfer Serial
SNMP Client master Retrieve RTU status information Ethernet
SNMP Slave slave Report RTU status information Ethernet
SNMP Trap slave, master Send or receive RTU status notifications Ethernet
User Defined peer Send or receive raw serial messages Serial
HART master Data point status transfer HART option card
NTP master Set RTU time from NTP server Ethernet
HTTP slave Web access to RTU status Ethernet (CP-3 ports
only)
Terminal server peer Allow arbitrary data to be transparently Ethernet, serial (COM I
passed between an Ethernet and a serial only)
port

In the above table, if the RTU implements a “master” protocol then it can initiate messages
to another device. These messages are typically triggered when appropriate ISaGRAF
custom function blocks are executed. Conversely, when the RTU acts as a “slave” it
responds to incoming requests.

In the above table, a “serial” port type refers to any serial-based option card, including
RS232/422/485 (COM I), Fibre (COM F), Dialup (COM D), Line (COM L) and Spread
Spectrum Radio (COM R2/R3/R4).

For Ethernet (TCP/IP) based protocols, multiple protocols can generally operate
simultaneously on the same physical Ethernet port. Messages are distinguished using the
TCP or UDP “port numbers” built into TCP/IP. For example, DNP3 messages are normally
directed to TCP/UDP port 20000, while Modbus/TCP messages use TCP port 502.

B0780AF, Rev M 33
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Serial ports can only be configured for a single protocol.

By default, only the FoxRTU protocol is enabled. To set up other protocols, you need to:
• Add the protocol to the RTU configuration. This causes the required driver software
to be started when the configuration is downloaded to the RTU.
• Assign the protocol to the required ports. FoxRTU Station validates all selections,
and prevents you from assigning two different protocols to a serial port, for
example. Note that the HART protocols do not need to be assigned to a port as
they operate using fixed ports.

Add, Remove or Edit Protocol

Right-click on the RTU name and select Properties (or just
double-click the RTU name).
Select the Protocols tab
Select the Add button to add a protocol OR select an
existing protocol to edit or remove and then select the Edit
or Remove button
Note: multiple protocols can be selected and added at the
same time by using the CTRL or SHIFT keys and selecting
the relevant protocol(s) with the mouse.

The following sections briefly describe the available protocols:

34 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

FoxRTU Protocol
Overview
FoxRTU Protocol is the “native” protocol for SCD2200 RTUs. By default, it is enabled on all
Ethernet and serial ports.

This protocol allows data to be transmitted through multi-level networks. That is, messages
to a remote RTU can be automatically forwarded via intermediate RTU(s).

The protocol supports the transfer of event logs (historical data), as well as real-time data.

FoxRTU Protocol is also used by FoxRTU Station for querying the status of an RTU, e.g.
checking firmware version, number of logged events, etc.

The RTU implements both the slave and master ends of the protocol, so an RTU can be set
up as a concentrator, which can poll outstation RTUs for events and then be polled by
FoxRTU Station or a SCADA system. When operating as a master, the RTU generates
FoxRTU messages using custom ISaGRAF function blocks.

FoxRTU Variables
To transfer data using the FoxRTU Protocol, registers must be manually created in the
Dictionary to hold the data:
• To store local data where they can be polled by another system, Local FoxRTU
Registers need to be created. These have names of the form FOXRn.
• To store data that have originated from another RTU, Network FoxRTU Registers
should be created. These have names of the form FOXrRn, where r is the RTU
from which they originated.

The FoxRTU Protocol supports two types of polling (In this example RTU1 is polling RTU2):
• Direct polling: The FOX_RX_DATA function block will copy RTU2’s local registers
FOXRn into network registers FOX2Rn on RTU1.
• Indirect polling: The FOX_NW_RX_DATA function block will copy RTU2’s network
registers FOX3Rn and FOX4Rn (assuming RTU2 is set up to poll RTU3 and RTU4)
into RTU1’s matching network registers FOX3Rn and FOX4Rn.

Port Types
The FoxRTU protocol is supported on all port types, except the HART option card.

For Ethernet ports, FoxRTU protocol uses UDP ports 473 and 4058.

Modbus
Overview
Modbus is a simple, widely used protocol which can transfer integer and boolean values.
Modbus does not support the transfer of historical event data. The SCD2200 RTU supports
three Modbus variants:
• Modbus/RTU is used on serial lines, e.g. RS232, RS485
• Modbus/ASCII is also used on serial lines but it uses ASCII encoding, which is less
efficient but can be easier to deal with in some systems

B0780AF, Rev M 35
FoxRTU Station User's Guide Chapter 5: RTU Configuration

• Modbus/TCP uses Ethernet to transport the Modbus packets over a TCP/IP

network. By default, TCP port 502 is used.

For each of these, the RTU supports both the master end (where the RTU initiates a request
when the MODBUS custom ISaGRAF function block is executed), and the slave end (where
the RTU responds to incoming requests).

For serial ports, the Modbus slave functionality can be disabled if desired in the serial port
settings.

For more details on the specific Modbus functions supported by the RTU, refer to the tables
in the Protocol Support section.

Data Types
Modbus defines four types of data points:
• Coils are single bit outputs
• Discretes are single bit inputs
• Holding registers are 16-bit output registers
• Input registers are 16-bit input registers

Points are addressed using a 16-bit index (0-65535). Each point type has a separate
address space, so the maximum quantity of each type of point is 65536.

Modbus Variables
To transfer data using Modbus, variables must be created in the Dictionary to hold the data:
• To store local data where they can be polled by another system, Local Modbus
Registers need to be created. These have names of the form MODCn (coil),
MODDn (discrete), MODHn (holding) or MODIn (input).
• To store data that have originated from another RTU, Network Modbus Registers
should be created. These have names of the form MODrCn (coil), MODrDn
(discrete), MODrHn (holding) or MODrIn (input), where r is the RTU from which they
originated.

Extended Addresses
Note that Modbus addresses are 8 bits long (1-254). When accessing Modbus variables on
an RTU with an address greater than 255, be aware that only the least significant byte (lower
8 bits) of the RTU address will be used in Modbus messages.

For example, if you have slave RTUs with address 20 (0014h) and address 276 (0114h) on
the same multi-drop network (e.g. Ethernet or RS-485), then you will not be able to poll both
of them using Modbus, because the least significant byte of each address is the same. To
rectify this you would need to change one of the addresses, or use different physical ports.

36 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Modbus Settings
Modbus/TCP has some additional settings that can be adjusted:

Modbus/TCP Settings
Right-click on the RTU name and select Properties
(or just double-click the RTU name).
Select the Protocols tab
Select Modbus TCP from the protocols list and click
Edit (or just double-click on Modbus TCP)

TCP port number: (1-65535, default=502) These

settings allow the TCP port number used by
Modbus/TCP to be changed. Different port numbers
can be selected for master and slave operation.

DNP3
Overview
Distributed Network Protocol version 3 (DNP3) is a widely used telemetry protocol. It is more
sophisticated than Modbus in that it supports:
• Polling for events (state changes) as well as current values (Class 0 data)
• Optional unsolicited reporting of state changes from slave to master, which reduces
the amount of polling required
• Grouping events into classes (Class 1, 2 or 3) which can be selectively retrieved
• A richer set of data object types

B0780AF, Rev M 37
FoxRTU Station User's Guide Chapter 5: RTU Configuration

A SCD2200 RTU can act as a DNP3 Slave, a DNP3 Master, or both. The RTU can respond
to DNP3 messages (DNP3 Slave), initiate DNP3 messages using DNP3 function blocks
(DNP3 Master) or forward DNP3 messages. DNP3 has various protocol settings that can be
edited as detailed below.

Data Types
The following DNP3 data types are supported:
• Analog inputs are 32-bit integer (variations 1 and 3), 16-bit integer (variations 2
and 4) or 32-bit floating point (variation 5) input registers
• Analog outputs are 32-bit integer (variation 1) or 16-bit integer (variation 2) or 32-
bit floating point (variation 3) output registers
• Binary inputs are single bit inputs (variations 1 and 2)
• Binary outputs are control outputs (variations 1 and 2). Single bit pulse on/off and
latch on/off operations are supported, as well as paired trip/close operation, where
one physical output “trips” the device (turns it off) and the other “closes” it (turns it
on)
• Binary counters are 32-bit integer (variations 1 and 5), 16-bit integer (variations 2
and 6) counter inputs
• Frozen counters are copied from the associated binary counter when a DNP3
“freeze” command is received

DNP Variables
To transfer data using DNP3, variables must be created in the Dictionary to hold the data:
• To store local data where they can be polled by another system, Local DNP3
Registers need to be created. These have names of the form DNPAIn (analog
input), DNPAOn (analog output), DNPBIn (binary input), DNPBOn (binary output),
DNPBCn (binary counter) or DNPFCn (frozen counter).
• To store data that have originated from another RTU, Network DNP3 Registers
should be created. These have names of the form DNPrAIn (analog input),
DNPrAOn (analog output), DNPrBIn (binary input), DNPrBOn (binary output),
DNPrBCn (binary counter) or DNPrBCn (frozen counter), where r is the RTU from
which they originated.

Note that for DNP3, another way to create a specified number of variables is by adjusting the
settings on the DNP3 Protocol settings General tab (such as Number of Binary Inputs).

If the RTU only needs to forward DNP3 messages, DNP3 variables do not need to be
configured. DNP3 messages will be forwarded if a route has been configured for the target
RTU and the DNP3 protocol is enabled on that port. The communication timeout and retry
parameters associated with this route are applied to the DNP3 messages forwarded through
the RTU.

Port Types
DNP3 is supported on all port types, except the HART option card.

For Ethernet ports, DNP normally uses TCP port 20000. It can also be configured to use
UDP port 20000, or an alternative TCP/UDP port number.

38 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

DNP Settings
DNP3 has several additional settings that can be adjusted:

DNP3 Settings
Right-click on the RTU name and select Properties
(or just double-click the RTU name).
Select the Protocols tab
Select DNP3 from the protocols list and click Edit (or
just double-click on DNP3)

DNP3 variables for the local RTU can be

automatically created in the Dictionary (or deleted)
according to the settings on the General tab.

If you change one of these values and press OK,

then a consecutive sequence of variables of the
specified type will be created. This may cause
existing variables to be deleted or renumbered.

If binary counters are defined, you can also create

frozen counter variables (DNPFCn) for some or all of
them, using the Dictionary. (Binary Counter values
are copied into the corresponding Frozen Counters
following the appropriate DNP3 “freeze counters”
command.)

TCP/UDP port number: (1-65535, default=20000)

This specifies the TCP or UDP port number to be
used by DNP3. Different port numbers can be
selected for master and slave operation.

Defaults: This button allows you to specify the

settings to use (e.g. class and variation) for any new
DNP3 variables that are created.

B0780AF, Rev M 39
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Maximum Transmit Fragment: (14-2048,

default=2048) This only needs to be changed if the
destination device cannot handle large transmit
fragments (as detailed in the DNP3 device profile
documents).

Maximum Transmit Frame: (14-292, default=292)

Multiple frames are used to transmit one fragment. This
setting only needs to be changed if the communications
device has a message size or frame limitation.

Link Layer Confirmation: (default=Never) If this

setting is enabled then each transmitted DNP3 frame
will be marked as needing to be acknowledged by the
receiver; if an acknowledgment is not received within
the timeout period then the frame will be automatically
retried.

Link Layer Confirmation is useful where DNP3 is used

on an “unreliable” link, i.e. one where there is no
underlying error detection or flow control protocol. This
includes serial connections, and UDP connections over
Ethernet. Link Layer Confirmation is not required for
TCP based links (which are the default when DNP3 is
used over Ethernet).

Note: If Link Layer Confirmation is enabled, verify that

the overall link layer timeout (Link confirmation timeout
multiplied by Maximum Retries+1) is less than the
application timeouts, namely the Route timeout (see
RTU Properties – Routes) and the Application Layer
Confirmation Timeout (see below).

Link confirmation timeout (milliseconds): (1-65535,

default=10000ms) Only used if Link Layer Confirmation
is enabled.

Maximum Retries: (0-65000, default=3) Number of

retries if a link layer confirmation timeout occurs.

Permit multi-fragment responses: (default=enabled).

Require application confirmations for non-final

fragments: (default=disabled)

Suppress DNP3 Forwarding: (default=disabled, i.e.

message forwarding is enabled) If a DNP3 message
addressed to a different RTU is received, it will be
automatically forwarded if the target RTU exists in the
route table. In some cases this is not desirable, e.g. in
multi-drop systems where each RTU receives all
messages, in which case DNP3 forwarding should be
suppressed by enabling this option.

Note: DNP3 message forwarding is automatically

suppressed on multi-drop RS485 links.

40 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

The following settings apply when the RTU is operating

as a DNP3 slave.

Timer Poll (milliseconds): (1-65535, default=100ms)

Specifies how often to check the static value of every
DNP3 variable for change. Events are created for any
variable that has changed and has a class assignment
of 1, 2 or 3.

Note: The default settings for the Timer Poll and the
ISaGRAF cycle time are both 100ms. This means that if
a DNP point is toggled in logic every cycle then it is
possible that some transitions may not generate an
event. If this is unacceptable then the Timer Poll setting
should be reduced (which may impact system
performance), or the ISaGRAF cycle time should be
increased.

Application layer confirmation timeout

(milliseconds): (1-65535, default=10000ms) Specifies
how long to wait for a confirmation that event data has
been received by the master.

Note: If Link Layer Confirmation is enabled, this

parameter should be set to a value greater than the
overall link layer timeout (Link Layer Confirmation
Timeout multiplied by Max Retries+1)

Select timeout (milliseconds): (1-65535,

default=10000) Specifies how long to wait for an
Operate command after receiving a Select command.

The following settings apply when the RTU is

operating as a DNP3 slave.

DNP3 Master Addresses: (0-65535) A comma

separated list of DNP3 master addresses (see
below).

Limit event reporting to only DNP3 master

addresses specified: (default=disabled) If enabled,
events will only be reported to the specified list of
DNP3 masters. Status responses and static variable
values will still be reported to any master.

Enable unsolicited reporting: (default=disabled)

When enabled, the RTU will automatically send an
unsolicited report if there are new Class 1, 2 or 3
events (when enabled respectively). These will be
sent to the specified list of master addresses.

If unsolicited reporting is enabled here, it may still be

disabled during operation by a request from the
DNP3 master, or by executing the
DNPS_UNSOL_DISABLE function block.

B0780AF, Rev M 41
FoxRTU Station User's Guide Chapter 5: RTU Configuration

If unsolicited reporting is disabled here, unsolicited

reports will never be sent to any master.

Event buffer: Not used.

Update static points with event data:

(default=disabled) If enabled, the RTU will update its
static DNP3 variables based on event data.

Require authentication for critical functions:

(default=disabled) The RTU supports DNP3 Secure
Authentication v2. This is used for DNP3 Slave RTUs
when security is required. When enabled, an Update
key can be entered (consisting of 16 hexadecimal
bytes). This Update key must then be provided by a
DNP3 master device before it can request a critical
function.
For a DNP Master RTU, authentication is configured
for each route that is used to communicate with a
Secure DNP3 Slave RTU.
Critical functions requiring authentication (according
to the DNP3 Secure Authentication v2 standard) are:
Write; Select; Operate; Direct Operate; Direct
Operate No Acknowledgement; Cold restart; Warm
Restart; Initialize Application; Start Application; Stop
Application; Enable Unsolicited Messages; Disable
Unsolicited Messages; Record Current Time;
Authenticate; and Activate Configuration.

Session key timeout: (0-99999 minutes) The

Update key is used to create an initial session key.
The session key is automatically changed each
Session Key Timeout interval to help protect against
“replay” attacks.

Authentication reply timeout: (2-600 seconds) How

long to wait for a reply to the initial authentication
message.

42 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Mapping is useful for data concentration. DNP3 objects

obtained from remote RTUs can be stored as if they are
objects in the local RTU.
To help prevent local and remote objects clashing,
objects from the remote RTU are given a numeric offset.
For example, if the offset for a given RTU address is set
to 1000 then all objects read from that address will be
copied to local objects with indexes offset by 1000.

Select the Add button to add a new mapping or select

an existing mapping and then select Edit or Remove.

Data Concentration Using Mapping

Data concentration involves an intermediate RTU polling several outstation RTUs, and then
itself being polled by a DNP3 master. It will then return its own data, plus data read from the
outstations.

The steps required to achieve this are:

• On the intermediate RTU, configure a mapping (numeric offset) for each outstation.
• Define logic on the intermediate RTU to poll the outstations.
• Define DNP3 points on the intermediate RTU to hold the values read from the
outstations. For example, if an outstation has 5 binary input points (DNPBI0-4) and
its offset is set to 1000 then you would need to create 5 binary input points
DNPBI1000-1004.

If the intermediate RTU is now polled by a DNP3 master, the RTU will return any events and
static values previously read from the outstations, in addition to its own local points.

P6008
Overview
P6008 is a proprietary protocol that enables monitoring and control of the RTU’s I/O via a
control system. The protocol is half duplex and operates over serial option card interfaces.

An SCD2200 RTU can act as a P6008 slave only.

Unlike DNP3 and Modbus, variables are not created in the ISaGRAF dictionary for P6008
points. Thus, only physical I/O points can be accessed using P6008 – it is not possible to
read values generated by logic.

P6008 uses a 6-bit address field. The RTU address must therefore be set in the range 1-62
to be able to be addressed using P6008. Address 63 is used as a broadcast address.

B0780AF, Rev M 43
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Port Types
P6008 is supported on certain serial port types, as indicated in the following table:
RTU Module Option Card Supported
SCD2200 CP-3 or MC-31 COM-I isolated serial yes
COM-I2 dual isolated serial yes
COM-D dialup modem yes
COM-L 2/4 wire line yes
other -
MC-3 any -

I/O Addressing
P6008 defines six I/O point types: digital inputs, momentary and permanent digital outputs,
analog inputs, analog outputs and counters. Each type has its own separate address space,
except permanent digital and analog outputs, which share the same address space.

Points are addressed using one of two addressing schemes:

• Addressing type 1 can access one point per command. This is used for counters,
analog inputs, analog outputs and momentary outputs. Points are numbered
consecutively from zero.
• Addressing type 2 can access a group of up to 8 points per command. This is
used for digital inputs and permanent digital outputs. A point is defined by
specifying a group number a bit number, both starting from zero.

The following table summarizes the P6008 point types:

Point Type Address Space Addressing Type
MO – digital momentary output MO 1 (point number)
PO – digital permanent output PO/AO 2 (group number, bit number)
AO – analog output PO/AO 1 (point number)
AI – analog input AI 1 (point number)
DI – digital input DI 2 (group number, bit number)
CI – counter input CI 1 (point number)

In the SCD2200 RTU, the assignment of P6008 addresses, for a given point address space,
starts at 0 with the first I/O module that has points of the specified type. The numbering then
proceeds consecutively through that module’s points, then the next module, and so on. (The
first I/O module is the one with the lowest slot number.)

For modules containing both AO and PO points (which share the same address space), the
AOs precede the DOs in the point numbering sequence.

Power supply modules are not considered to be I/O modules, and their points are not
addressable using P6008.

By default, an I/O module’s digital outputs will be allocated as PO points. They may
alternatively be treated as MO points by setting an option in the module settings dialog. It is
not possible for some points within a module to be configured as POs and some as MOs.

44 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Example
The following table shows how P6008 point addresses, as seen by the P6008 master, would
be assigned for a typical RTU configuration.
Point Slot 3 Slot 6 Slot 7 Slot 12
Type IO-3 DO-2 DO-2 [MO] DI-10
MO 0 - 15
PO 1 (b0-3) 2 (b0-7), 3 (b0-7)
AO 0
AI 0-3
DI 0 (b0-3) 1 (b0-7), 2 (b0-7)
CI 0-6

In this example, the P6008 Momentary Outputs option (see DO-1/2/6 Module Properties)
has been set for the slot 7 DO-2 module only.

For points using type 2 addressing, the point address notation “1 (b0-3)” in the above table
indicates “group 1, bits 0-3”.

Note that because AOs and POs share the same address space, the IO-3 analog output is
assigned address 0, and is then followed by the digital outputs at address (group) 1.

B0780AF, Rev M 45
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Settings
P6008 has several additional settings that can be adjusted:

P6008 Protocol Settings

Right-click on the RTU name and select Properties (or
just double-click the RTU name).
Select the Protocols tab
Select P6008 from the protocols list and click Edit (or
just double-click on P6008)

Communication Type: (Binary/ASCII) The protocol

supports two types of message format. The format
should be selected to match the Master control system.

Short Pulse Duration (seconds): (0.1-19.9, default

0.3) When a Short Pulse Momentary Output command
is received by the RTU, the commanded digital output
will be set active for the configured duration.

Long Pulse Duration (seconds): (0.2-20.0, default 1.6)

When a Long Pulse Momentary Output command is
received by the RTU, the commanded digital output will
be set active for the configured duration.

Allen Bradley DF-1

This protocol allows serial communications with an SLC500 PLC using the DF-1 protocol in
half duplex slave mode. The data format is 8 data bits, 1 stop bit and no parity. The RTU
always operates as the master – messages are generated using custom ISaGRAF function
blocks.

Data read using the Allen Bradley protocol are transferred using a block of local FoxRTU
registers (FOXRnn).

46 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

SNMP
Simple Network Management Protocol or SNMP is supported on the processor Ethernet
ports. The RTU supports the following modes of operation:
• The RTU can be an SNMP Manager (master), and can send query messages to
other devices using custom ISaGRAF function blocks.
• The RTU can be an SNMP Agent (slave), where it responds to incoming queries.
• The RTU can send or receive SNMP Trap messages (asynchronous notifications)
using ISaGRAF custom function blocks.

Note that each of the above is treated as a separate protocol, and must be added and
enabled separately.

When operating as a slave, the RTU makes available certain configuration and status
information. These are defined in the RTU MIB (Management Information Block) document,
which is available on the Global Customer Support website. The SNMP object identifier
(OID) codes for SCD2200 RTUs are in the range 1.3.6.1.4.1.3833.2.n.n.n. These data
include:
• RTU address and name
• Event log information
• Network interface and traffic information

The SNMP Slave Daemon has the following protocol settings that can be edited. To bring up
this dialog, double click on SNMP Daemon (Slave) in the RTU Properties protocol list.

Public community name: (default=”public”)

Private community name: (default=”private”)

These are effectively passwords that can be used to

restrict access to the information that the RTU makes
available via SNMP. Data will be made available if the
client specifies either of the configured passwords.

Note: For security reasons, we recommend that you

change the default SNMP community names.

B0780AF, Rev M 47
FoxRTU Station User's Guide Chapter 5: RTU Configuration

HART
The HART protocol can only be used with a HART option board and is automatically added
to the RTU when a HART port is added to the RTU configuration.

The RTU supports the master end of this protocol. Messages can be initiated by the RTU
using the HART function block, which is based on Revision 5 of the HART protocol.

HART data are stored in a block of integer and floating point FoxRTU network variables
(FOXrRn and FOXrFn), where r is user-specified and not necessarily the same as the
device’s HART address.

User Defined
The User Defined ISaGRAF function blocks can be used to send and receive arbitrary serial
messages. This allows simple serial protocols to be implemented in the ISaGRAF logic
program.

NTP
The Network Time Protocol (NTP) allows the RTU time to be periodically synchronized with
a network time server. This is done by having the RTU send request messages to UDP port
123.

NTP can operate using any Ethernet port: either the CP-3/MC-31 main Ethernet port, or a
port fitted with a T3/A3 option card. As with other protocols, NTP needs to be enabled on the
required port before it can be used.

As with other master protocols, the destination IP address (i.e. the address of the time
server) and the Ethernet port to use are specified by defining a route. The route’s “Target
RTU” address may be set to any unused address – this number is not used by the protocol
itself, but it can be used in logic for updating the route target IP address (using
FOX_SET_ROUTE) or querying communication statistics (FOX_GET_COMM_STATS).

Unlike other master protocols, there is no function block defined for NTP. NTP requests are
sent automatically, at the configured rate. (If requested by the server, the RTU may increase
the interval between polls to reduce server load.)

The time supplied by an NTP server is an absolute time, in UTC. This implies that the RTU’s
system time must also operate using UTC. If NTP is used, you should configure a time zone
for the RTU (see RTU Time Zone). This allows times to be displayed in local time (or UTC, if
you prefer), while internally the RTU’s clock runs on UTC.

48 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

The following NTP settings are available:

NTP Settings
Right-click on the RTU name and select Properties (or
just double-click the RTU name).
Select the Protocols tab

Select Network Time Protocol from the protocols list and

click Edit (or just double-click on Network Time Protocol)

Update Interval (seconds): (60-999999, default=600)

How often to check and update the RTU time.

As noted above, the NTP server IP address is specified

by creating a route.

B0780AF, Rev M 49
FoxRTU Station User's Guide Chapter 5: RTU Configuration

HTTP
If the Hyper Text Transfer Protocol (HTTP) is enabled, certain RTU status information will be
accessible using a standard web browser. The RTU web server will listen for requests on
selected CP-3 Ethernet ports (not MC-31 ports).

For more details, see Web Interface.

The following HTTP settings are available:

HTTP Settings
Right-click on the RTU name and select Properties (or
just double-click the RTU name).
Select the Protocols tab

Select HTTP from the protocols list and click Edit (or just
double-click on HTTP)

TCP listener port number: (1-65535, default=80)

By default, the HTTP server will listen for connections on

TCP port 80, in which case you can access the web
server without specifying a port number, e.g.

http://192.168.0.1

If a different port number is chosen, then it will need to

be specified when you type the RTU address into your
web browser. For example, if the port is set to 8001,
then you might enter

http://192.168.0.1:8001

to access the web server.

50 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Terminal Server
Overview
The Terminal Server protocol is used to transparently route data between an Ethernet port
and a serial port. This means that software which normally uses a serial port to talk directly
to a device can, with the help of a serial to Ethernet converter, communicate with the device
remotely via an IP network.

For example, consider a device with an RS232 interface which may be configured by
connecting a serial cable from a local PC workstation to the device and then running
configuration software on the workstation, as shown below.

Workstation
Device

Device serial RS232/485

configuration Serial Serial
software port port

This function may be performed remotely by enabling the Terminal Server protocol on the
RTU. The following diagram shows a typical configuration.

Workstation

Device serial
configuration Virtual COM
software port software

Ethernet
port

IP network

RTU

Ethernet Pass-through
port route Device
(Terminal
Serial
server RS232/485
port
protocol) Serial
(Terminal
port
server
protocol)

B0780AF, Rev M 51
FoxRTU Station User's Guide Chapter 5: RTU Configuration

In this case, virtual COM port software (e.g. TCP-COM, by PC Micro) is run on the
workstation. Any commands sent by the device configuration software to the virtual COM
port are forwarded to the RTU’s IP address via the IP Ethernet network.

Alternatively, an external serial-to-Ethernet converter (e.g. Moxa NPort 5110) may be used
instead of the virtual COM port software.

The RTU performs a similar function when configured for the Terminal Server protocol –
commands received via the Ethernet port are forwarded to an RTU serial port and thence to
the device. Responses from the device are returned to the configuration software in a similar
way.

Note that while the terminal server protocol supports bidirectional data transfer, all
connections must be initiated by the workstation. It is therefore most suitable for poll-
response protocols where the workstation sends a command to the device and the device
responds. If unsolicited serial data is sent by the device then it will be discarded, until a
connection is made from the workstation to the RTU. Once a connection has been
established, any subsequent data sent by the device will be forwarded to the workstation.

Configuring the Workstation

The first step is to configure workstation software:
• Verify that the serial configuration (COM port number, baud rate etc.) specified for
the device configuration software matches the settings for the virtual COM port
software or external serial-to-Ethernet converter.
• Configure the virtual COM port software or external serial-to-Ethernet converter to
connect to the RTU’s IP address. By default, port 4000/TCP is used, although this
can be changed, as described below.

Configuring the RTU

Now the RTU can be configured. The first step is to enable the Terminal Server protocol,
which is done in the same way as any other protocol:
• Add the Terminal Server protocol to the configuration, on the RTU Properties
dialog, Protocols tab.
• Add the Terminal Server protocol to one Ethernet and one serial port. These may
be local CP-3 ports or MC-31 ports.

The next step is to define a pass-through route between the Ethernet port and the serial
port. This is done using the Pass Throughs tab on the RTU Properties dialog.

Note: Since the terminal server can be enabled for all RTU supported protocols, it is
recommended to use only DNP3 Secure..

52 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

If no pass through routes have been defined then

there will be nothing to display on this tab. Press
Add to define a new route.

If the Add button is disabled, check that you have

enabled the Terminal Server protocol on both an
Ethernet port and a serial port.

Serial port: Select the required serial port. Only

those ports that have Terminal Server protocol
enabled will be listed.

Ethernet port: Select the required Ethernet port.

Port number: (1-65535) The Ethernet port will

listen for connections on this TCP/UDP port
number.

Buffer time: (0-60000) The serial port will buffer

received characters for this amount of time (in
ms) before sending a packet to the Ethernet port.
This can improve efficiency on the IP network.
See Time Interval Control.

Type: (TCP or UDP) This specifies the type of IP

connection to listen for. Note that UDP does not
guarantee delivery of data so if this setting is used
then the serial protocol being transported over the
link must include its own error detection and retry
mechanisms.

B0780AF, Rev M 53
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Once the pass through route has been added, the

details will be listed on the Pass throughs tab.

Further pass through routes can now be defined,

if desired. Each route needs to use a separate
serial port, but they can share the one Ethernet
port.

Note: If an Ethernet port is shared by more than

one pass through route then each route must
have a distinct TCP/UDP port number. For a
given Ethernet port, the default port number is
4000 for the first route defined, 4001 for the
second, and so on.

To remove a pass through route, simply click on it

and then click Remove.

Note: In a non-mirrored redundant processor

configuration, pass through routes should be
defined on the primary processor only. They will
be automatically duplicated onto the secondary
processor.

54 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Ports
The Ports tab on the RTU Properties dialog is used to configure the physical
communications ports in the RTU. These include Ethernet and serial ports, and include ports
on the processor module (CP-3) and on communications modules (MC-31).

An SCD2200 RTU can address up to 192 ports (although performance is not guaranteed
and users need to consider bandwidth limitations and practice common sense with high port
counts). A single CP-3 or MC-31 module supports one fixed Ethernet port, plus up to two
additional Ethernet ports or up to four additional serial ports.

CP-3 and MC-31 Module

Port 1 – Ethernet

Option Board Slot 2

(Serial or Ethernet)

Option Board Slot 3

(Serial or Ethernet)

The Ports tab will initially show a list of all fixed ports, i.e. the Ethernet port (Port 1) on the
CP-3 and each defined MC-31 module. If option card ports are present, you can add these
by clicking the Add button.

Add a Port

Select the Add button to add an option card

port.

If you want to change the type or location of

an existing option card port, click Remove,
then re-add it.

B0780AF, Rev M 55
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Select Port Type

Define the type and location of the option

card.

Module: Select the CP-3 or MC-31 module

containing the option card.

Type: Select the type of option card. The

various types of port are described below.

Number: Specify the option card slot number

within the CP-3 or MC-31 module: 2 (upper
slot) or 3 (lower slot)

Once the required ports have been added, most will require various settings to be
configured. These are described in the following sections.

56 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Ethernet
A twisted pair 10/100BaseT Ethernet port is included as Port 1 on the CP-3 and MC-31.
Additional Ethernet ports may be added to the RTU by installing T3 (twisted pair) or A3 (fiber
optic) option cards in Ports 2 or 3 of a CP-3 or MC-31.

To configure Ethernet, double click on the required Ethernet port in the port list on the Ports
tab on the RTU Properties dialog (or click Edit). The following settings are available:

IP Address: (default=192.168.0.1) Each Ethernet port

must be assigned a valid IP (internet protocol) address
which is suitable for the network to which it is connected
(check with your network administrator). The assigned
IP address must be unique on the local network. In most
cases the RTU will be connected to a private LAN, in
which case the IP address will be allocated from one of
the private address ranges: 10.x.x.x, 172.16-31.x.x or
192.168.x.x

Note: If there are multiple Ethernet ports on a CP-3 or

MC-31 module, then each port must be set to a different
subnet, which usually means they must be connected to
physically separate networks. For example, if Port 1
uses the default IP address and subnet mask
(192.168.0.1/255.255.255.0) then Port 2 or 3’s IP
address cannot be set to 192.168.0.x (192.168.1.x
would be OK). If the subnet mask was instead set to
255.255.255.252 then each subnet would now only
contain 4 addresses, so port 1 and 2 could, for example,
be set to 192.168.0.1 and 192.168.0.4, as these
addresses would now be on different subnets.

It is also possible to connect a PC directly to an RTU

Ethernet port, using a cross-over cable. In this case, the
RTU can be set to any address, provided that the PC’s
IP address is set to a different address on the same
subnet (e.g. if the RTU Ethernet port is left on the default
setting of 192.168.0.1 then the PC could to be set to,
say, 192.168.0.2).

Subnet Mask: (Default=255.255.255.0) This should be set to the correct subnet mask for
the network to which the RTU is connected (check with your network administrator). The
subnet mask defines which part of the IP address is used to identify the network (or
“subnet”) and which part is used to identify a particular device on the network. With the
default setting, the first three numbers in the IP address specify the subnet and the last one
specifies one of 256 devices connected to that subnet.

Gateway: (Default=0.0.0.0, i.e. no gateway) This specifies the IP address of a device on the
local subnet which can forward messages to other networks, or the Internet. If not set then
the RTU will only be able to communicate with devices that are connected to the local
subnet.

B0780AF, Rev M 57
FoxRTU Station User's Guide Chapter 5: RTU Configuration

If required, each Ethernet port can be assigned its own separate gateway. For example,
multiple gateways would be required in applications where the RTU had, for redundancy
purposes, two diverse methods for connecting to the outside world. For example, the primary
link could be an ADSL modem connected to Port 1 on the CP-3, which would be configured
with the ADSL modem’s IP address as the gateway address. The backup link might be a 3G
modem connected to Port 1 of the MC-31, which would be configured with its gateway set to
the 3G modem’s IP address.

Ethernet ports on different modules (as in the above example) can have independent
gateways configured. It is also possible for Ethernet ports in the same module (e.g. ports 1
and 2 of a CP-3) to have independent gateways. See also IP Routes.

Protocols: Protocols which have already been added to the RTU are assigned to the
Ethernet port by ticking the appropriate box(es). Note that MC-31 Ethernet ports only support
FoxRTU, DNP3, Modbus/TCP, NTP and Terminal Server protocols. CP-3 Ethernet ports
support any Ethernet based protocols.

Serial (RS232/422/485)
Serial ports may be added to the RTU by installing COM I (isolated serial) or COM I2 (dual
isolated serial) cards in a CP-3 or MC-31 module. The following electrical standards are
supported:
• RS232 uses single-ended signaling and provides point-to-point communication over
relatively short distances (typically up to 15m, depending on baud rate). The link is
full-duplex (separate wires for each data direction). RTS and CTS signals are
available on the connector and can be used for flow control.
• RS422 uses differential signaling to provide point-to-point or multi-drop
communication over longer distances (typically up to 1000m, depending on baud
rate). The link is full-duplex (separate pairs for each data direction). The RTS signal
is used to enable the transmitter.
• RS485 also uses differential signaling, but is half-duplex. A single pair of wires is
used to connect multiple devices in a multi-drop configuration. Protocols used over
RS485 must verify that only one device transmits at a time. The RTS signal is used
to enable the transmitter.

58 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

To change the serial port settings, double click on the port in the port list on the Ports tab.

Type: (default=RS232) Specifies the electrical standard

(RS232/422/485).

Bits per second: The speed at which the RTU will send
or receive messages (75-115200bps).

Data Bits: Number of data bits transmitted per byte.

Must be 8 for any protocol that transmits 8-bit data.

Parity: Specifies whether even, odd or no parity is used.

Stop Bits: Specifies whether 1 or 2 stop bits are used.

Verify that the above settings match those of the device

with which you are communicating. Note also that for
Modbus/ASCII protocol, these settings will be ignored
and the following fixed settings used: 7 data bits, Even
parity, 1 stop bit.

Protocols: A protocol already added to the RTU can be

enabled on the port. Only one protocol can be enabled
for serial ports.

Master Only: For Modbus/RTU and Modbus/ASCII

protocols, selecting this option will limit the protocol to
master operation only. The RTU will be able to initiate
requests to downstream devices, but it will ignore any
requests received from another Modbus master.

Pre-Transmission delay (milliseconds): (default=0)

Specifies how long the RTS signal is asserted for before
data is sent. Typically set to zero for RS232 or 10 ms for
RS485 and RS422.

Post-Transmission delay (milliseconds): (default=0)

Specifies how long RTS is asserted for after the data
has been sent

Quiet time (milliseconds): (default=0) The RTU will

wait until the line has been quiet (no received
messages) for the specified time before sending a
message.

B0780AF, Rev M 59
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Enable external modem support: (default=disabled)

When enabled, allows an external PSTN modem to be
connected to the serial port. Modem settings can then
be configured as for a Dialup port as detailed below.

Serial (Fiber Optic)

The COM F card is the same as the serial (COM I) card, except that a fiber optic physical
interface is used. This allows transmission over distances up to 4km.

Dual Serial
The COM I2 card supports two independent isolated serial ports, each of which is identical to
that on the COM I card.

The ports are identified using a two part notation: slot.port, where slot is the option card slot
number (2 or 3) and port is the port number within the card (1 or 2). Thus if two COM I2
cards are installed in a module, the four serial ports would be numbered as follows, from top
to bottom: 2.1, 2.2, 3.1, 3.2.

This notation can be used with ISaGRAF function blocks that take a port number as a
parameter, such as FOX_GET_PORT_STATS. For example, if an MC-31 in slot 15 has a
COM I2 card installed in the lower option card slot then you would specify its ports as
‘15:3.1’ and ’15:3.2’.

When a COM I2 card is added, two serial ports are automatically added to the port list (e.g.
port 2.1 and port 2.2). These can then be configured independently. Note however that if
either port is subsequently deleted, both ports will be removed.

Dialup
The Dialup option board (COM D) incorporates a 33.6 kbps PSTN modem.

The basic serial port settings on the Settings tab are the same as for the Serial option cards
– you need to specify the baud rate and other serial parameters, and select the protocol
(only one) that is assigned to the port.

For a PSTN modem, the settings on the Transmission tab are not relevant and should
normally all be left on zero.

The Modem tab contains settings relating to the modem. These are also used when
connecting to an external modem using a serial option card.

60 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Initialization string: (default: AT&FTE0V0S0=2&W)

These characters are sent to the modem to initialize it
after start-up, after disconnection, and if a dial attempt is
unsuccessful. The default string will load factory default
settings (&F), select tone dialing (T), switch off
command echo (E0), select numeric response codes
(V0), enable auto-answer (S0=2) and then save the
settings (&W)

Note: X3 (disable dial tone detection) can be added to

the default string if the modem is unable to recognize
the dial tone or is experiencing problems establishing a
connection i.e. AT&FTE0V0S0=2X3&W

Dial timeout (seconds): (0-10000) The time to wait

from the time when dialing begins until a Carrier Detect
indication is received. When dialing a GSM modem, the
Dial Timeout should be set to at least 45 seconds.

Inactivity timeout (seconds): (0-10000) The RTU will

disconnect after this amount of time has elapsed since
the last message was received. A value of 0 disables
the function.

Hang-up timeout (seconds): (0-10000) The RTU will

disconnect after this amount of time has elapsed after
connection or after sending the last message. A value of
0 disables this function.

Remaining Online
To remain online after connection, set Inactivity timeout to 0 and Hang-up timeout to 0 in
both RTUs in the dialup link. If the line is disconnected, the RTU will reconnect when the
next TX or RX message is initiated from ladder logic.

Dialing a Paging Service

If experiencing problems, error correction may need to be disabled by including '\N0' i.e.
AT&FE0V0S0=2\N0&W. If experiencing problems when using an MC module and a Dial
option board, the baud rate may need to be limited to 9600 by including F8 in the
initialization string i.e. AT&FE0V0S0=2F8&W.

Line
The Line option card (COM L) is used to connect to a private line or analog radio. The board
is optically isolated, operates at 1200 bps and provides FSK CCITT V.23 modulation.

The basic serial port settings under the Settings tab are the same as the Serial option cards.
The baud rate is fixed at 1200 bps but you can set the other serial parameters and the
protocol.

The transmit timing parameters under the Transmission tab may need to be adjusted when
using the Line option card:

B0780AF, Rev M 61
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Pre-Transmission delay (milliseconds): How long the

carrier and RTS are transmitted for before data is sent.
Analog radios typically require a Pre-Transmission delay
of 300 ms while private lines use 50 to 100 ms.

Post-Transmission delay (milliseconds): How long

the carrier and RTS are transmitted for after the data
has been sent. Analog radios typically require a Post-
Transmission delay of 100 ms while 50 ms is used for
private lines.

HART
The HART option board provides a Bell 202 interface to devices supporting the HART
protocol. Each HART option board can communicate with up to 15 HART devices.

The basic serial parameters (Settings tab) are fixed at 1200 baud for the HART option card.
The HART protocol is the only one supported on this port type, so it will be selected
automatically.

The transmit timing parameters (Transmission tab) may need to be adjusted when using the
HART option card:

Pre-Transmission delay (milliseconds): How long the

carrier and RTS are transmitted for before data is sent.
Set to 10 ms or greater to suit the particular HART
device.

Post-Transmission delay (milliseconds): How long

the carrier and RTS are transmitted for after the data
has been sent. Set to 15ms or greater to suit the
particular HART device.

62 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Spread Spectrum Radio

There are three types of Spread Spectrum radio option boards available for the CP-3 and
MC-31 modules:
Country Option Board Carrier Frequency Baud
USA R4 900 MHz 9600
International R3 2400 MHz 19200
Australia R2 900 MHz 9600

The basic serial parameters (Settings tab) are fixed at the baud rate indicated above. The
desired protocol will still need to be selected.

The parameters on the Transmission tab are not applicable for the SSR option card.

The settings on the Radio tab are as follows:

Point to point mode: Selects Point to Point or Point to

Multipoint operation.

Vendor ID: (16-32767, default=13106) Sets the ID

number of the Spread Spectrum radio. All radios on the
same network need to have the same Vendor ID to
communicate with each other. It is recommended that
Vendor ID be changed to avoid interference with other
radio networks.

Destination address: (0-65535, default=65535) Sets

the Destination address of the Spread Spectrum radio.
All radios on the same network need to have the same
Destination Address to communicate with each other. It
is recommended that Destination Address be changed
to avoid interference with other radio networks.

Hopping pattern: (0-6, default=0) Sets the Hopping

pattern of the Spread Spectrum radio. All radios on the
same network need to have the same Hopping pattern
to enable them to communicate. To minimize
interference from another RTU using a spread
spectrum radio, a hopping pattern number that is
different to the offending radio should be used.

In standard configurations the Vendor ID, Hopping Pattern and Destination Address fields do
not need to be modified as the addressing is performed transparently via the RTU
addressing system.

It is good practice when implementing a system in a build-up area to not use the default
radio settings even if the system is expected to function well. This will help to remove
interference with other radio devices in the area.

B0780AF, Rev M 63
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Routes

RTU Networking
An RTU network consists of two or more RTUs that can communicate with each other in
some way. The communication path is called a route.

This example shows RTU1 as the master RTU and RTUs 2-4 as the remote RTUs. RTU3
also stores and then forwards messages between RTU1 and RTU4.

Each RTU has a “route table” that is referred to when communicating with other RTUs or
devices in the network. Routes only need to be configured for RTUs that are initiating
messages. If an unsolicited message is received from a new RTU, the new RTU route
information will be automatically added to the working route table configuration.

In the above scenario, RTU1 is set up to poll the three slave RTUs. It therefore needs to
have routes defined which tell it how to access each of the slaves.

In particular, it needs to know:

• The address of the target RTU, which will be used as the “destination” field inside
the FoxRTU, Modbus or DNP3 messages
• Whether it can send messages directly to the target RTU (a “direct route”), or
whether they need to be forwarded by an intermediary (an “indirect route”). In the
above example, all messages for RTU4 need to be sent to RTU3, which will then
forward them on, so this would be set up as an indirect route.
• The physical port to use to send the message, which may be Ethernet or serial, and
may be on the CP-3 or on an MC-31 communications module
• The physical address to send the message to. For a point-to-point serial
connection, this is implicit as the cable can only be connected to one other RTU.
For a multi-drop, serial connection (e.g. RS485), the physical address is generally
the same as the RTU address. For Ethernet, the physical address is the IP address.

RTU3 will also need a route set to tell it how to reach RTU4.

64 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

To configure routes, select the Routes tab on the RTU

Properties dialog.

This shows a summary of all defined routes.

To add a new route, click Add; to edit an existing route

double click the route, or select it and click Edit.

On the General tab:

Target RTU: (0-65520) The address of the destination

RTU to communicate with. Address 0 is only valid for the
DNP3 protocol.

Modbus ID: When sending a message using the

Modbus protocol, only the lower 8 bits of the destination
RTU address will be used. This field indicates the
equivalent 8-bit Modbus address for the given target
address.

System ID: (00 to FF Hex, default=AE) This is the

communications sync character used at the start of
outgoing FoxRTU messages. An RTU will only respond
to FoxRTU messages that begin with the same System
ID as the RTU's own System ID (as configured in the
RTU Properties General tab). It is recommended that AE
be used for all SCD2200 RTUs except when relaying
radio messages as detailed in the topic below Routes -
Relaying Radio Messages. System ID is not used by
other protocols.

Route: (Direct or Indirect) Direct means the RTU is

directly connected to the target RTU (e.g. via a private
line or radio link). Indirect means the RTU must
communicate via one or more other intermediate RTUs
to access the target RTU. When an RTU receives a
message that is not for itself, it will forward the message
to the target RTU if it has a route configured for that
target RTU.

Port / Via RTU: For a Direct connection, this is the local

port number to be used to communicate with the target
RTU. For an Indirect connection, this is the directly

B0780AF, Rev M 65
FoxRTU Station User's Guide Chapter 5: RTU Configuration

connected RTU address to which the message must be

sent to reach the target RTU.

IP Address: If the target RTU is connected via Ethernet,

its IP address should be set here.

Protocols: This specifies the protocol(s) that will use

this route. Protocols must first be added to the RTU
configuration and then enabled on the port before they
can be used on a route (please see the topic RTU
Properties - Protocols).

On the Advanced tab:

Timeout: (0-1000000ms, default 5000ms) The time that

an RTU will wait for a reply to its first message. If Retries
(see below) is set to 1 or greater and a reply is not
received, the RTU will send the message again after the
timeout has expired.

Note: As discussed in the DNP3 Settings section, if link

layer confirmations are enabled, then the overall link
layer timeout (Link confirmation timeout multiplied by
Maximum Retries+1) should be set to a value which is
less than the Route timeout.

Retries: (0-999) The number of times the RTU will retry

sending a message to the target RTU if the previous
attempts have been unsuccessful. The maximum
number of attempts is one more than the Retries setting.
E.g. if Retries is 3, the RTU will have up to 4 attempts at
sending a message.

Retries are generally only useful when using a serial or

UDP-based protocol. TCP already includes a retry
mechanism so in this case Retries should be set to 0.

In applications where the RTU is regularly polling a

slave device, retries should normally only be used if the
polling rate is relatively low. For fast poll rates, there is
no point retrying a poll if the next poll is going to occur
within a few seconds anyway.

For DNP3, if retries are required (e.g. because a

serial/UDP link is used) then DNP3 Link Layer
Confirmations should be enabled. In fact, if the route
uses DNP3 then the route Retries setting will be
disabled and forced to 0.

Note: when dialing an RTU, the RTU will dial the

primary phone number up to Retries+1 times and then
will dial the Secondary phone number up to Retries+1
times until the PSTN modem successfully connects or
all the dial retries have been unsuccessful.

66 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

If the route uses DNP3, the following settings are available:

Permit UDP communications: By default, DNP3 uses the TCP protocol, which provides
detected error checking and flow control. If this option is enabled then UDP will be used
instead. UDP is a connectionless protocol, and is somewhat similar to using a serial link.

Note: This setting will be ignored if the route is assigned to an MC-31 Ethernet port. For MC-
31 ports, only TCP is supported for outgoing connections.

Enable DNP3 Secure Authentication: The RTU supports DNP3 Secure Authentication v2.
Use this option when the local RTU is a DNP3 Master and is communicating with a DNP3
Slave which requires authentication. When enabled, an Update key can be entered, which
must match that defined on the slave device.

Session key timeout: The Update key is used to create an initial session key. The session
key is automatically changed each Session Key Timeout interval to help protect against
“replay” attacks.

Authentication reply timeout: How long to wait for a reply to the initial authentication
message.

The following sections discuss the route setup for some typical applications.

Indirect Routing
In this example, RTU 1 has serial connections to RTU 2 and RTU 3. RTU 3 has a serial
connection to RTU 4.

The route configuration described below would allow the master to poll any slave, and any
slave to initiate a communication to the master.
RTU Route Target Route
RTU 1 RTU 2 Direct via Port 2
RTU 3 Direct via Port 3
RTU 4 Indirect via RTU 3
RTU 2 RTU 1 Direct via Port 2

B0780AF, Rev M 67
FoxRTU Station User's Guide Chapter 5: RTU Configuration

RTU 3 RTU 1 Direct via Port 2

RTU 4 Direct via Port 3
RTU 4 RTU 3 Direct via Port 2
RTU 1 Indirect via RTU 3

If the system is purely master/slave, i.e. RTU 2-4 do not need to initiate communications to
the master, then the route configuration could be simplified. RTU1 would still need three
routes so it can reach RTU 2, 3 and 4. However the only other route required would be the
direct route from RTU 3 to RTU 4.

Relaying Radio Messages

For the radio system below, RTU1 communicates with RTU3 by sending a message to
RTU2. RTU2 then forwards the message to RTU3. Due to the radio setup, it is sometimes
possible for RTU3 to receive the indirect message that is sent to RTU2. This can cause
errors to be detected since RTU3 will respond to the message at the same time RTU2 is
attempting to forward the message.

To help prevent both RTU2 and RTU3 responding at the same time, RTU2 and RTU3 are
configured with unique system IDs as shown below. RTU1 sends the indirect message to
RTU2 with a System ID of A1. RTU3 will only respond to messages with a system ID of A2
and so ignores the message. When RTU2 forwards the message to RTU3, the message is
sent with a System ID of A2. RTU3 then responds to the message.

Note: System IDs 00, AC, A5 and FF are reserved. Do not use them.
RTU Route Target Route Sys ID Route
RTU 1 RTU 2 A1 Direct via Port 2
RTU 3 A2 Indirect via RTU 2
RTU 2 RTU 1 AE Direct via Port 2
RTU 3 A2 Direct via Port 2
RTU 3 RTU 2 A1 Direct via Port 2
RTU 1 AE Indirect via RTU 2

68 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Dynamic Route Changes

The preceding sections discussed the static configuration of routes in FoxRTU Station.
Routes can also be added and changed dynamically during operation. There are two main
cases:
• When the RTU is operating as a slave, an incoming poll from a master will
automatically add or update the route to that master. This is done by recording the
port and/or IP address from which the request came.
• The FOX_SET_ROUTE function block can be used to explicitly change an existing
route – for example to make it use an alternative port. This is often used in a
system with redundant communications links, to switch traffic to an alternative link
when a communications failure is detected. Note that an existing route to the
destination RTU must already exist; this function block cannot be used to create a
new route.

The general rule is that a route should be statically configured in FoxRTU Station if the RTU
needs to initiate messages to a remote RTU (e.g. it is configured as a master, or it needs to
forward messages to another RTU, or it needs to be able to send unsolicited DNP3
messages before any poll messages have been received). If the RTU is acting purely as a
slave device then entering a static route to the master is not necessary.

Dynamic route updates do not actually change the RTU configuration. This means that if the
RTU restarts then it will revert to its statically configured routes. Also, if you upload the
configuration to FoxRTU Station during operation, any dynamic routes will not be visible.

Be aware that a route set dynamically using one of the above two methods may be
subsequently overridden by the other method being triggered, which can sometimes cause
surprising results.

For example, suppose logic similar to that described in Redundant Communications is used
to switch routes when a communications failure is detected. Then if the cable is removed,
the route will switch to the alternative port. If the cable is then restored within a minute or
two, buffered messages in the remote device may be retransmitted and received by the
RTU, which will cause the route to be updated (i.e. restored to the original port).

IP Routes
When sending a poll or response message via an Ethernet port, IP (Internet Protocol)
routing rules are used by the CP-3 or MC-31 module to determine which of its Ethernet ports
to use, if it has more than one.

This decision is based on the destination IP address to which the message is being sent.
Normally, the rule is simple: if the destination is on the same subnet as one of the module’s
Ethernet ports, then that port is used. Otherwise, if a gateway address is defined for one
port, then that port is used.

Note that IP routing rules may override route settings configured in the RTU route table. For
example, suppose Port 1 and Port 2 on a CP-3 have IP addresses 192.168.0.1 and 10.0.0.5
respectively. If you were to define an RTU route that specifies Port=1, Address=10.0.0.7
then the “Port=1” setting would be ignored. Port 2 would be used because the destination
address’s subnet matches that of Port 2.

What if more than one of a module’s ports has a gateway address defined? The following
rules apply:

B0780AF, Rev M 69
FoxRTU Station User's Guide Chapter 5: RTU Configuration

• When operating as a slave, a CP-3 or MC-31 module will always transmit the
response to a poll via the Ethernet port on which the poll message was received.
• If an RTU route which uses a CP-3 port is set or updated then an IP route is
automatically set, to verify that the configured CP-3 port is used for sending
outgoing request messages.

Phone Numbers
If an RTU uses a PSTN port to communicate with remote RTU(s) then the phone number of
each remote RTU is configured on the Phone tab on the RTU Properties dialog.

Add, Remove or Edit Phone Number

Select the Add button to add a phone number, or

select an existing phone number in the list and then
select the Edit or Remove button

Target RTU: (1-65520) The address of the

destination RTU to dial.

Primary phone number: The initial phone number

to dial. If connection is unsuccessful, the RTU will
dial the Primary phone number again, up to number
of retries configured for the port. Spaces used in
the phone number will be ignored by the modem.

Secondary phone number: The backup phone

number to dial if the Primary phone number is
unsuccessful in making the connection.

70 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Programs
One or more programs can be added to the RTU to provide logic processing capability.
When editing a program, FoxRTU Station launches the ISaGRAF Workbench editor.
Programs or function blocks can also be imported from other RTU configurations or projects.

Programs can be added in the following IEC61131 languages:

Functional Block Diagram (FBD) is a graphic language. It allows the programmer to build
complex procedures by taking existing functions from the standard library or from the
function or function block section.

Ladder Diagram (LD) is a graphic representation of Boolean equations, combining Contacts

(input arguments) with Coils (output results). The LD language enables the description of
tests and modifications of Boolean data by placing graphic symbols into the program chart.
LD graphic symbols are organized within the chart exactly as an electric Contact diagram.
LD diagrams are connected on the left side and on the right side to vertical Power Rails.
Please see the topic ISaGRAF – Logic Examples for Ladder Diagram examples.

Sequential Function Chart (SFC) is a graphic language used to describe sequential

operations. The process is represented as a set of well-defined Steps, linked by Transitions.
A Boolean Condition is attached to each Transition. A set of Actions are attached to each
Step. For programs, Conditions and Actions are detailed using three other languages: ST,
IL, or LD. For function blocks, Conditions and Actions are detailed using only two other
languages: ST or LD. From Conditions and Actions, any Function or Function Block in any
language can be called.

Structured Text (ST) is a high level structured language designed for automation
processes. This language is mainly used to implement complex procedures that cannot be
easily expressed with graphic languages. ST language can be used for the description of the
actions within the Steps and conditions attached to the Transitions of the SFC or the Actions
and Tests of the FC language.

Flow Chart (FC) is a graphic language used to describe sequential operations. A Flow Chart
diagram is composed of actions and tests. Between actions and test are oriented links
representing data flow. Actions and tests can be described with ST, LD or IL programs.
Functions and Function blocks of any language (except SFC) can be called from actions and
tests. A Flow Chart program can call another Flow Chart program. The called FC program is
a sub-program of the calling FC program.

Instruction List (IL) is a low level language. Instructions always relate to the current result
(or IL register). The operator indicates the operation that must be made between the current
value and the operand. The result of the operation is stored again in the current result.

The Programs tab lists all currently defined logic programs:

B0780AF, Rev M 71
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Add, Remove or Edit Logic Programs

Select the Add button to add a program OR select

an existing program in the list and then select the
Edit or Remove button.

Pressing Edit will open the program in the ISaGRAF

workbench.

Create New Program: This option is used to create

a new program. You need to specify a name for the
program and the desired language.

Import existing program of function block: If you

have an existing ISaGRAF program or function
block saved as a “.STF” file then this function allows
you to import it into the project.

Note that programs can be created and edited by one of two methods:
• You can use the buttons on Programs tab on the RTU Properties dialog, as
described above. This will launch ISaGRAF and automatically open the editor for
the selected program.
• Or you can click the ISaGRAF button on the toolbar to run the ISaGRAF
Workbench. You can then select the required program from the tree navigator
within ISaGRAF, or create a new program.

Any programs created from within ISaGRAF will be reflected in the list in the RTU Properties
dialog, and vice versa.

72 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

Redundancy Settings
An RTU can have a second CP-3 processor module to provide processor redundancy in
case one processor is unsuccessful.

As described in Configuring Redundant Processors, redundant CP-3 modules can either use
a mirrored configuration (an identical configuration is loaded into the primary and secondary
processors), or independent configurations.

If independent configurations are used, the two processors can be configured to share a
common IP address. Only the currently active processor responds to messages directed to
the shared IP address.

The Redundancy tab is enabled if you have configured a redundant processor RTU (two CP-
3 modules), and mirror mode is switched off (i.e. the CP-3s each have their own
configuration).

To adjust redundancy settings, first verify that Mirror mode is switched off, then double click
on the RTU name in the navigation pane to open the RTU Properties dialog. Click on the
Redundancy tab.

Enable Shared IP Address: The Shared IP Address

allows the SCADA software to communicate with an
RTU regardless of which processor module is active.

The Shared IP Address is in addition to each

processor’s actual IP address, as defined in the Ethernet
port settings. Only the currently active processor will
respond to messages directed to the shared IP address.

B0780AF, Rev M 73
FoxRTU Station User's Guide Chapter 5: RTU Configuration

Module Properties
Modules and cards have properties that can be configured after the module or card has
been added to the RTU configuration.

To edit a module’s properties, first verify that the list of modules is displayed (select the
Projects workspace), then double click on the desired module. This will display the Edit
Module dialog.

This dialog has a General tab, plus other tabs which vary according to module type. The
following sections describe the available settings for each module type.

On the General tab, you can change the module’s slot number. If you want to change the
type of module then it is necessary to delete the module from the configuration and then add
a new one.

For technical information about the various module types, refer to the SCD2200 Hardware
Manual, available for download from the Global Customer Support website.

PS-1x/2x

On the Configuration tab:

Battery: The capacity of the installed backup battery.

CP-3

On the Ports tab:

The CP-3’s communications ports can be added,

removed or edited, as described in RTU Properties -
Ports.

On the Advanced tab (only visible when the Mirror

button is switched OFF):

Trigger Execution Timeout (ms): For firmware version

2981 or later this setting is no longer used and will be
ignored.

74 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

MC-31

On the Ports tab:

The MC-31’s communications ports can be added,
removed or edited, as described in RTU Properties -
Ports.

AI-10

On the Configuration tab:

Channel Range: The current or voltage input range for

that channel. Each channel can be configured
individually.

The available ranges are:

• 4 – 20 mA (default)
• 0 – 20 mA
• +/- 10 mA or +/- 2.5V
• +/- 20 mA or +/- 5V
• +/- 10V

For the 0 – 20 mA or 4 – 20 mA ranges, the input will

return zero if the current is negative or below 0 or 4 mA
respectively.

AI-10 version 1.x modules may be ordered as current

input (AI-10) or voltage input (AI-10-V). For AI-10
version 2.x modules, selecting between current and
voltage can be done using jumper links.

For AI-10 version 1.x modules, the hardware default

channel range setting is 0-20mA, while on version 2.x
modules it is 4-20mA. This is only relevant if the module
is unconfigured, e.g. if it is plugged into a random slot
and manipulated using Module Status

B0780AF, Rev M 75
FoxRTU Station User's Guide Chapter 5: RTU Configuration

On the Scaling tab:

The minimum and maximum set-points allow an analog

input (with a raw range of 0 – 32767 for unipolar,
or -32768 – 32767 for bipolar) to be scaled to a defined
range. The scaled value will be stored in the analog
input variable.

Minimum: The desired variable value when the raw

value is 0.

Maximum: The desired variable value when the raw

value is maximum (32767).

Note: For inputs configured with a bipolar range (i.e. +/-

2.5V, +/- 5V or +/- 10V), the Minimum set-point should
normally be set to 0. The scaling is symmetrical about
the minimum value, e.g. if Minimum=0 and
Maximum=100 then a raw value of 32767 will produce a
scaled value of 100, and a raw value of -32768 will
produce a scaled value of -100.

Note: The scaled value will be a 32-bit integer.

AO-2/3

On the Scaling tab:

Minimum: The variable value that will produce a

minimum raw output value (0).

Maximum: The variable value that will produce a

maximum raw output value (32760).

IO-3/5

On the Configuration tab:

Failsafe Outputs: If enabled and there is no

communications activity between the processor and any
module on the backplane for 10 seconds the module
assumes that the processor has been unsuccessful and
sets the outputs OFF (open). If not enabled (default), all
digital outputs will hold their last value.

P6008 Momentary Outputs: If enabled, all digital

outputs in the module will be designated as momentary

76 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

(pulsed) outputs when used with the P6008 protocol. If

not enabled (default) all digital outputs will be treated as
permanent (latched) outputs.

On the Scaling tab:

For analog inputs:

Minimum: The desired variable value when the raw

value is 0.

Maximum: The desired variable value when the raw

value is maximum (32760).

Note: The scaled value will be a 32-bit integer.

For analog outputs:

Minimum: The variable value that will produce a

minimum raw output value (0).

Maximum: The variable value that will produce a

maximum raw output value (32760).

DO-1/2/6

On the Configuration tab:

Failsafe Outputs: If enabled and there is no

communications activity between the processor and any
module on the backplane for 10 seconds the module
assumes that the processor has been unsuccessful and
sets the outputs OFF (open). If not enabled (default), all
digital outputs will hold their last value.

P6008 Momentary Outputs: If enabled, all digital

outputs in the module will be designated as momentary
(pulsed) outputs when used with the P6008 protocol. If
not enabled (default) all digital outputs will be treated as
permanent (latched) outputs.

B0780AF, Rev M 77
FoxRTU Station User's Guide Chapter 5: RTU Configuration

DI-10

On the Configuration tab:

Channel Inversion: (Tick to enable each channel or

select Ch Inv button to enable/disable all channels)

By default, when a voltage level is applied to an input

channel, a logical 1 is recorded in the input register and
the channel LED is set ON. If the channel inversion
option is selected then an input voltage will result in a
logical 0 being recorded in the input register and the
channel LED will be set OFF.

Sequence-of-Events: (Tick to enable each channel or select Seq of Ev button to enable all
channels)

When SOE is enabled, any change of state of the input channel (an event) is recorded in the
event log to an accuracy of 1 millisecond. The DI-10 has an internal buffer with enough
space for 1000 event logs. This means that a DI-10 can cope with bursts of up to 1000
events at a time. Events are uploaded into the processor module at a maximum rate of 100
events per second allowing the DI-10 to cope with events at a sustained rate of 100 events
per second. Events are stored in a circular buffer - which causes the oldest event to be
overwritten with the newest event when the buffer is full.

De-bounce Filters: (None, 1ms, 3ms, 10ms, 30ms, 100ms, 250ms and AC Filter) The value
in the digital input register will not update until the input channel has been at the new state
continuously for the De-bounce Filter time. This is useful when connecting to mechanical
relay or switch contacts. De-bounce filters are applied to groups of 4 channels as shown
above. 'AC Filter' is used when connecting AC inputs to the DI-10 module.

Counter Inputs: (Frequency, Pulse or Quadrature) The DI-10 can have up to 7 counter
inputs which are stored as 16-bit unsigned integer values. Counters can be used on any
input channel(s). Quadrature counting works on pairs of input channels. Channel pairs are
1&2, 3&4, 5&6, 7&8, 9&10, 11&12, 13&14 and 15&16. So, selecting Quad Count on channel
1 will actually work with quadrature on channels 1 and 2. Selecting Quad Count on channel
2 will also work with quadrature on channels 1 and 2, but will reverse the phase of the
inputs. The same applies to the other channel pairs used for quadrature inputs.

S-O-E Protocol: Specifies whether events should be recorded as FoxRTU or DNP3 protocol
events. This is only applicable for inputs where SOE events are enabled.
• If FoxRTU is selected then SOE events (i.e. events with millisecond-accurate
timestamps) of the form SLssDI10Din will be recorded in the RTU event log.
• If DNP3 is selected, then SOE events will be recorded for any DNP3 variables
which are mapped to SOE-enabled inputs.

78 B0780AF, Rev M
Chapter 5: RTU Configuration FoxRTU Station User's Guide

If a DNP3 variable is mapped to a DI-10 input but the input is not SOE-enabled, or the
protocol is set to FoxRTU, then “normal” events (generated by the CP-30 polling the current
state of the input at the end of each logic cycle) will be recorded.

User Type (1-31) and Priority (0-7): These are applied to event logs generated for channels
enabled for Sequence-Of-Events logging. User Type can be used to filter similar types of
logs within the event log list. For example, SOE logs could be type 1 while analog input logs
could be type 2. It will then be possible to only upload type 1 SOE logs or type 2 analog input
logs instead of having to upload all the event logs together. This setting is not applicable if
DNP3 is selected for the SOE protocol.

DI-5
The DI-5 module does not require any configuration.

B0780AF, Rev M 79
FoxRTU Station User's Guide Chapter 6: Dictionary

Chapter 6: Dictionary
Variables
The RTU uses variables to store and access data and these are kept in the Dictionary.
These variables are also used by ISaGRAF Workbench logic programs. Variables are also
sometimes referred to as symbols.

View RTU Variables

Select the RTU name in the navigation pane

Select Dictionary in the Stacked Menu Bar.

When the Dictionary workspace is selected, new variables can be created and existing
variables can be edited or deleted.

If an I/O module is added to an RTU, FoxRTU Station automatically adds variables to the
dictionary for all the data that are available from that I/O module. For example, if you add a
DI-10 module to the project then 23 variables will be automatically created for that module’s
16 digital inputs and 7 counters. See RTU Variables for details on the variables associated
with each module type.

If desired, some or all these automatically created variables may be deleted if not required.
As noted in ISaGRAF Licensing Details, your ISaGRAF license may be limited to a certain
number of symbols (variables), so it may be necessary to delete unused variables to fit your
application under the variable limit.

ISaGRAF
The Dictionary is shared between FoxRTU Station and ISaGRAF Workbench. All variables
automatically or manually created in FoxRTU Station will appear in the ISaGRAF dictionary

list (press in ISaGRAF Workbench) and may be used in logic programs. Likewise, all
global variables created in ISaGRAF will appear in the FoxRTU Station dictionary.

80 B0780AF, Rev M
Chapter 6: Dictionary FoxRTU Station User's Guide

Dictionary Workspace
An example Dictionary view for an RTU with various types of variables is shown below.

As can be seen in the above example, the Dictionary variables are grouped into categories,
or groups. This process is largely automatic. The ‘+’ and ‘-‘ buttons can be used to expand
and collapse each group.

For each variable, the following information is shown:

• Variable name. Automatically generated variables have particular naming
conventions, e.g. DNPAI1 is DNP analog input register #1, and SL01PS11DO3 is
digital output #3 on the PS-1x/2x module in slot 1. User defined variables (e.g.
MyCounter) can have any name.
• Variable Type. Each variable has a particular data type. For example: 16- bit integer
(INT), 32-bit integer (DINT). Some variables have a compound type, e.g.
IOPOINT_B, which as well as the actual value (a Boolean value in this case) also
contains other details such as a timestamp and data quality flags.
• The Description is simply a free text description of the variable. For automatically
generated variables a suitable description is also generated.
• Initial value. For user defined variables an initial value can also be specified.

The Dictionary workspace includes some features to make it easier to deal with what can be
very long lists of variables:
• Filter button. The Dictionary can be filtered so that only variables that contain the
characters specified in the filter are displayed. Enter a few characters from the
name you are looking for and click Filter. Press Clear to clear the filter and show all
variables.
• Sort. By default, variables are sorted by group. By clicking on the column headings
the list can be sorted by the contents of those columns.

B0780AF, Rev M 81
FoxRTU Station User's Guide Chapter 6: Dictionary

Adding Variables

New Variable

Select the RTU name in the navigation pane

Select Dictionary in the Stacked Menu Bar.

Select the New button (located above the variable list). The New
Variable dialog will be displayed. This allows you to create either a
single variable, or a block of automatically generated variables.

Variable Names
There are certain requirements on variable names:
• Variable names must start with a letter.
• Only the first 16 characters of variable names are event logged.
• Variable names may only contain alphanumeric characters (A-Z, a-z, 0-9) and the
underscore character (_).
• Variables starting with the underscore character are reserved and must not be
used.
• Reserved ISaGRAF keywords (e.g. “FALSE”) cannot be used as variable names
(see ISaGRAF - Reserved Variable Names for a complete list).

If the variable name matches the required naming convention (see RTU Variables) then it
will be recognized as a FoxRTU, Modbus or DNP3 protocol variable, and will be displayed
with the corresponding symbol (e.g. for DNP3 variables). User variables that are not
recognized by FoxRTU Station are displayed with the symbol.

Creating a Single Variable

The Single tab on the New Variable dialog is used to create a single variable.

Note: If the variable is to be mapped to a protocol (i.e. FoxRTU, Modbus, DNP3) it is better
to use the Multiple tab (see below), as this enforces the required naming convention for
these types of variable.

82 B0780AF, Rev M
Chapter 6: Dictionary FoxRTU Station User's Guide

Name: (1-127 characters) The variable name. See

Variable Names for requirements.

Group: Variable groups are purely an aid to keeping a

project organized – the group to which a variable is
assigned does not affect its function. I/O module and
protocol variables will be automatically assigned to
appropriate groups. The “…” button can be used to
create new group names.

Initial value: The initial value of the variable, which will

be set after the configuration is downloaded and after
any RTU restart (unless the Retain variable across
system restarts option is set). If not specified then
0/FALSE will be used.

Type: The data type of the variable. ISaGRAF supports

a wide range of data types as detailed in the topic
ISaGRAF – Variable Types.

Comment: Free text field, for documenting the variable’s function.

Retain value: If this option is set then the variable value will be saved to non-volatile
memory after each logic cycle. If the RTU restarts for any reason then the last value will be
restored when logic execution resumes. Note that if this option is enabled then an initial
value cannot be set.

B0780AF, Rev M 83
FoxRTU Station User's Guide Chapter 6: Dictionary

Creating Multiple Variables

A range of variables can be automatically created by selecting the Multiple tab. As the
various fields are set, the names of the variables that will be created are displayed at the
bottom of the dialog. The following parameters can be specified:

Format: If DNP3, Modbus or FoxRTU is selected,

the variable prefix will be set to DNP, MOD or FOX
respectively and the Type field will be
appropriately constrained to suit the protocol.
Prefix: The initial characters of the variable
names. This can only be modified if Format is set
to Free.

Group: The name of the Dictionary group to

display the variable in. To create a new group,
select the “…” button.

RTU Address: (1-65520) The source of the

variables. Use the local RTU address to create
registers for locally generated data. Use the
address of a remote RTU to create variables for
data received from that remote RTU.

Type: The characters to insert in the variable name between the RTU address and the
register number. This will vary depending on the selected format:
• DNP Types: AI (Analog Input), AO (Analog Output), BC (Binary Counter), FC
(Frozen Counter), BI (Binary Input) and BO (Binary Output).
• Modbus Types: C (Coil), D (Discrete), H (Holding) and I (Input).
• FoxRTU Types: R (Local Register) and F (Floating Point Register – used with
HART protocol only)
• Free format: Any string can be entered here

Register Range: The register numbers to use for the variables. For Modbus and FoxRTU
formats, registers are numbered from 1. For DNP3, registers are numbered from 0.

Data Type: This will be set automatically according to the selected Type value. For free
format variables, a data type can be selected from the list. See ISaGRAF – Variable Types.
The Description at the bottom of the window shows the range of variables that will be
created when OK is selected.

84 B0780AF, Rev M
Chapter 6: Dictionary FoxRTU Station User's Guide

Creating DNP3 Variables

DNP3 variables created using the New button, as described above, will have default settings
(Class 0, variation 1). If you wish to change the class or variation of the new variables then
you can do so by double clicking on each variable individually, as described in Editing
Variables. However, this can be tedious if you have more than a few variables.

An alternative method of creating arrays of DNP3 variables with non-default settings is as

follows:

Open the DNP3 Edit Protocol dialog, as described in

DNP3 Settings. This dialog will show the number of
currently defined DNP3 variables of each type.

Adjust each of these controls to the desired number of

variables.

Note: If you reduce these numbers then existing

variables will be deleted.

Click Defaults to open the DNP Variable Settings dialog.

On each tab, select the desired class, variation and any

other settings (e.g. high/low limits and dead band for
analog inputs) See Editing Variables for more details.

After pressing OK to close all dialogs, the required

variables will be created.

B0780AF, Rev M 85
FoxRTU Station User's Guide Chapter 6: Dictionary

Editing Variables
To delete a variable, select it in the Dictionary workspace and press the DEL key (or right
click and select Delete).

To edit a variable, double click on it (or right click and select Edit). This will open the Edit
Variable dialog:

The General tab contains settings common to all

variable types. These are described in Creating a Single
Variable.

For Modbus variables:

Map to I/O channel: This allows an I/O channel to be

mapped to a Modbus variable. Only those I/O channels
whose type is appropriate to the type of Modbus variable
will be available for selection.

For example, a MODDn (discrete input) Modbus variable

can only be mapped to digital input channels, and only
to channels which are not already mapped to another
variable.

For analog input channels, the value stored in the

variable will be the scaled value, i.e. after applying the
I/O module’s defined scaling factors.

86 B0780AF, Rev M
Chapter 6: Dictionary FoxRTU Station User's Guide

For DNP3 variables:

Class: DNP3 event class (None, 1, 2, 3). If set to None

(class 0) then events (changes in value) will not be
logged for this variable. The current value of the variable
will still be reported.

Classes 1-3 are arbitrary categories to which variables

and the events they generate can be assigned. These
classes can then be polled at different rates (for
example).

Default static variation: Specifies the data format to

use when reporting or requesting this variable’s current
value.

Default event variation: Specifies the data format to

use when reporting or requesting historical events for
this variable. Not applicable if Class is set to None.

Map to I/O channel: This allows an I/O channel to be

mapped to a DNP3 variable (similar to Modbus, as
described above).

For DNP3 analog input variables:

High Limit: If the scaled variable value is above this limit (specified either as an absolute
value or a percentage of the maximum value) then the point value will be set to the High
Limit and the DNP3 Over Range flag will be set.

Low Limit: If the scaled variable value is below this limit then the point value will be set to
the Low Limit and the DNP3 Over Range flag will be set.

Deadband: An event will only be recorded if the variable’s scaled value changes by at least
this amount. Not applicable if Class is set to None.

Note: If a DNP3 analog input variable is mapped to an AI-10 input which is configured with a
bipolar range (i.e. +/- 2.5V, +/- 5V or +/- 10V), the Low Limit should normally be set to 0. The
limits are symmetrical about the low limit, e.g. if Low Limit=0 and High Limit=1000 then a
scaled value above 1000 or below -1000 will set the Over Range flag.

B0780AF, Rev M 87
FoxRTU Station User's Guide Chapter 6: Dictionary

A DNP3 binary output variable may be mapped to a

digital output, which will then be switched on or off to
mirror the state of the DNP3 variable.

DNP3 also supports trip/close operation, where a single

binary output variable is mapped to two digital outputs.
When a DNP3 Close command is received, the
variable’s mapped Close digital output will be pulsed on.
This will typically trigger an external control system to
turn some device on. Likewise, a DNP3 Trip command
will pulse the mapped Trip output in the same way,
which will normally result in the device being turned off.

If trip/close operation is desired, use the Controls tab

(see below) to enable it, then select the required Trip
and Close digital outputs.

For a DNP3 binary output variable, the Controls tab

specifies which types of DNP3 output commands will be
accepted.

Pulse on: Enable DNP3 Pulse On command, which

turns the variable on for a fixed time period.

Pulse off: Enable DNP3 Pulse Off command, which

turns the variable off for a fixed time period.

Latch on: Enable DNP3 Latch On command, which

turns the variable on.

Latch off: Enable DNP3 Latch Off command, which

turns the variable off.

Paired operation – trip/close: Enable DNP3 trip/close

operation, where one digital output is driven when a
Close command is received, the other when a Trip
command is received.

Note: If a Trip or Close command is received, the

operation type specified in the command is ignored – the
operation performed is always Pulse On.

88 B0780AF, Rev M
Chapter 6: Dictionary FoxRTU Station User's Guide

Exporting and Importing Variables

If you need to create or modify a large number of variables then it may be easier to export
the dictionary to an Excel spreadsheet file, edit it in Excel, then re-import it.

To export the dictionary, select the required RTU, then File  Export  To Excel…,

When editing the variables in Excel, be sure not to modify the format. Create new rows by
copying existing rows.

Column definitions in the exported spreadsheet are described in Spreadsheet Format.

To import the dictionary, select the required RTU, then File  Import  From Excel…,

B0780AF, Rev M 89
FoxRTU Station User's Guide Chapter 7: Maps

Chapter 7: Maps
Viewing RTU Locations
The Map workspace allows the geographic locations of the defined RTUs to be visualized.

To view the RTU locations, select a project or RTU name in the navigation pane, then click
Map in the Stacked Menu Bar.

Legend
A The drop-down displays the name of the provider that retrieves the map data.
In the Search box, you can enter the name of the place you want to search for and
B view on the map.

C The Save button helps save the map.

D The scroll bar helps to view the entire length of the map.

E The pin points to the location that you have searched for.

The map can be scrolled by dragging with the mouse, and zoomed using the slider on the
right hand edge.

The configured locations of the RTUs in the current project are shown as “push pins” on the
map. The pin for the selected RTU is highlighted in red.

By default, the Google Maps service is used to retrieve the map data. However, alternative
providers can be selected using the control at the top of the workspace. Note that an internet
connection is required to load map data. A system message may be displayed in the map
workspace if web access is unavailable, or there is a problem with the map provider server.

90 B0780AF, Rev M
Chapter 7: Maps FoxRTU Station User's Guide

You can also search for place names by entering them in the Search field, and clicking Find.

Finally, map displays can be saved (e.g. as a JPG file) by clicking the Save button. These
files can then be reviewed in any image editing application, or inserted into a word processor
document, for example.

Positioning an RTU

Positioning an RTU on the Map

Select the RTU name in the navigation pane, then select

Map in the Stacked Menu Bar

Enter the address (or closest landmark) of where the new

RTU will be located and click the Find button

Once the location has been found, right click on the

desired location and select Place RTU Here.

To move the selected RTU on the map, simply repeat the

above procedure.

Manually positioning RTU

An alternative method is to directly enter the latitude and

longitude in decimal degrees (negative for Southern or
Western hemispheres) on the RTU Properties dialog.

B0780AF, Rev M 91
FoxRTU Station User's Guide Chapter 7: Maps

Finding an RTU
Once an RTU’s geographical position has been saved in the project, you can then display its
position on a map, as follows:

Select the RTU name in the navigation pane

Right click on the RTU and select Locate. The Map workspace will
open and indicate the location of the RTU.

92 B0780AF, Rev M
Chapter 8: ISaGRAF FoxRTU Station User's Guide

Chapter 8: ISaGRAF
ISaGRAF Overview
ISaGRAF™ provides the logic processing for each RTU. ISaGRAF allows logic to be
created in any of the IEC 61131 control languages: ladder diagram (LD), structured text
(ST), function block diagram (FBD), sequential function chart (SFC) or instruction list (IL).
The flow chart (FC) language can also be used. See RTU Properties – Programs for more
details about the various languages.
The ISaGRAF editor (called Workbench) is used to create and edit logic programs. As noted
in RTU Properties – Programs, ISaGRAF may be launched either by:
• Selecting the required RTU, then clicking the ISaGRAF toolbar button. The required
logic program can then be selected from inside ISaGRAF.
• Right-clicking on the required RTU and selecting Properties, then selecting the
Programs tab, then selecting the required program, then clicking Edit.
ISaGRAF and FoxRTU Station are separate applications, but are closely integrated. Both
share a common database so that variables created in ISaGRAF are visible in FoxRTU
Station, and vice versa.
The following diagram illustrates how FoxRTU Station interacts with ISaGRAF and the RTU
during the process of configuring the RTU.

Workstation RTU

Config FoxRTU
database Station
edit modules
and settings Compiled download Compiled
build config and config and
logic logic

Dictionary ISaGRAF
and logic
database edit logic
Firmware

When you define and configure modules in FoxRTU Station, these settings are saved to a
configuration database. Variables, whether created automatically when a module was added
or manually, are saved to the dictionary, which is part of the ISaGRAF logic database. These
two databases are linked by the overall FoxRTU Station project, which may also contain
configuration and logic databases for other related RTUs.
Before the configuration settings entered in FoxRTU Station and the logic entered in
ISaGRAF can be used by the RTU, they need to be “compiled” or “built”. This can be done
by clicking the Build toolbar button in FoxRTU Station, or it can be done automatically when
a configuration is downloaded to the RTU.

B0780AF, Rev M 93
FoxRTU Station User's Guide Chapter 8: ISaGRAF

The final step is to download the compiled configuration and logic to the RTU, which is done
by clicking the Download toolbar button in FoxRTU Station. You will be prompted to rebuild
the configuration and/or logic if FoxRTU Station detects that they have changed since the
last time they were built. Once the download is complete, the RTU will restart and the
firmware will then begin processing the newly loaded configuration and logic.
Note that while ISaGRAF is running, most functions in FoxRTU Station are disabled. These
will be re-enabled once all ISaGRAF windows are closed.

Function Blocks
Most of the work in a logic program is carried out by function blocks. Programming consists
of selecting the appropriate function blocks and tying them together using the desired
language, e.g. ladder diagram, structured text, etc. Most function blocks have input
parameters which specify the data to operate on and/or option settings.

ISaGRAF provides many built in function blocks, which are divided into several categories,
e.g. arithmetic, process control, signal generation, logical operations, and so on. All are
documented in the ISaGRAF Workbench on line help. You can also create user-defined
function blocks.

Several custom function blocks have been developed to support the operation of SCD2200
RTUs. In ISaGRAF, these are listed in the “FoxRTU” category. Most of these function blocks
relate to communications protocols, event logging or system parameters. Foxboro function
blocks are documented in this manual – see ISaGRAF Function Blocks.

The section ISaGRAF - Logic Examples includes several practical logic fragments for
performing real world tasks.

Getting Started
This section provides a brief tutorial on how to enter, compile and run a simple logic
program.

Note: Some familiarity with Ladder Diagram programming is assumed in this tutorial.

Defining a Program
The first step is to define the modules that make up the RTU. In this example, the 4-slot RTU
described in RTU Configuration - Example is used. Once the RTU has been defined, verify
that the correct RTU is selected in the navigation pane, then press the ISaGRAF toolbar
button to start ISaGRAF.

Note: If you have an ISaGRAF license key, verify that it is plugged into a USB port on your
computer before starting ISaGRAF. See ISaGRAF Licensing Details for more information.

94 B0780AF, Rev M
Chapter 8: ISaGRAF FoxRTU Station User's Guide

The ISaGRAF Workbench will now load. By default, this will show the Link Architecture
screen.

While ISaGRAF provides its own project-related features (represented by the tree view on
the left), these are not used in a SCD2200 RTU environment. Projects (collections of RTUs)
are instead managed by FoxRTU Station. Each RTU defined within a FoxRTU Station
project is associated with its own independent ISaGRAF project.

B0780AF, Rev M 95
FoxRTU Station User's Guide Chapter 8: ISaGRAF

In ISaGRAF, something that can execute logic is called a resource. In a SCD2200 system,
the ISaGRAF project contains exactly one resource: the RTU itself. The window labelled res
lists the logic programs and function blocks (collectively referred to as POUs, or program
organization units) which have been defined for the RTU.

In this example, no logic has been defined yet. We will now create a new program using the
Ladder Diagram language. Right click on Programs, then select Add Program and LD:
Ladder Diagram.

Enter a name for the program:

Now double click on the program name. The appropriate editor for the selected language
(Ladder Diagram in this case) will then open:

96 B0780AF, Rev M
Chapter 8: ISaGRAF FoxRTU Station User's Guide

Entering Logic
In this example, the following display settings have been changed to improve legibility:
• Switch off the grid (Options menu > Layout, then uncheck Display grid)

• Expand the spacing horizontally (click button twice)

Most functions in the Ladder Diagram editor can be performed using toolbar buttons. The
bottom row contains buttons to insert ladder diagram elements such as contacts (Boolean
inputs), coils (Boolean outputs) and function blocks.

In this simple example, we will create a single rung of logic which will flash one of the LEDs
on the digital output module. A series contact will allow the flashing to be stopped.

Begin by clicking the toolbar button to insert a function block. Because nothing is selected, a
new logic rung will be created, consisting of an unnamed function block and coil. (In Ladder
Diagram, every rung must contain an output, or “coil”.)

B0780AF, Rev M 97
FoxRTU Station User's Guide Chapter 8: ISaGRAF

Double click on the function block to select the required block. In this case, the one we want
is called BLINK, which is in the Signal generation category. Select the category, then the
function block name, then click OK. If you want to learn more about this function block, click
Help.

The ladder diagram will now be updated to contain the name of the function block.

The BLINK function block has one output and two inputs:
• Q is a Boolean output which will switch between true and false at the configured
rate.
• RUN is a Boolean input. If true, then the Q output will oscillate as described above.
• CYCL is a time input, which sets the oscillation period.

We now need to enter the desired time period. Double click the space to the left of the CYCL
label to display the Select variable dialog. Here you can enter a constant value, create a new
variable or select an existing variable.

In this case the time period is constant, so just enter t#1s then click OK. Time interval
constants consist of t#, followed by an integer, followed by a unit (ms, s, m, h or d).

98 B0780AF, Rev M
Chapter 8: ISaGRAF FoxRTU Station User's Guide

Now we need to associate the coil with an output (say output #1) on the digital I/O module in
slot 15. Double click on the coil to again bring up the Select variable dialog.

ISaGRAF variables for each of the module’s output points were automatically created by
FoxRTU Station when the module was added. Note however that I/O points are not just
simple Boolean variables; they are compound structures which contain timestamp and flag
values in addition to the actual data value.

First verify that the Type field is set to All Types. Then scroll down the list of variables to find
SL15DO5DO1 (“slot 15, DO-2/6 module, digital output 1”). Click the “+” icon to expand the
sub-fields within the variable, then select SL15DO5DO1.value and press OK.

B0780AF, Rev M 99
FoxRTU Station User's Guide Chapter 8: ISaGRAF

Because the RUN input to the BLINK function block is connected directly to the left hand
“power rail”, the function block will be permanently active, so the LED will start flashing as
soon as the logic is loaded onto the RTU. Just for fun, we will now add a contact in series
with the function block which will allow us to stop the flashing during operation.

Start by clicking once on the BLINK function block to select it, then clicking the leftmost
toolbar button, which will insert a contact on the left of the selected object.

In this case we will then change the contact to an “inverted” or “normally closed” contact by
clicking the toolbar button once so that a diagonal line symbol is displayed inside the
contact.

Finally, we can create a new variable to control the contact by double clicking on the contact
and then entering a name, say stop into the Select variable dialog. By default, the newly
created variable will be of type BOOL (Boolean), and will have global scope, meaning it can
be used in any program within the RTU.

Because the contact is inverted, when we set the stop variable to TRUE the contact will
open and the function block will be disabled.

Logic entry is now complete so you can close all ISaGRAF windows and return to FoxRTU
Station. You will be prompted to save the ISaGRAF project.

Downloading to the RTU

The process of downloading a new configuration to the RTU is largely automatic. Simply
click the Download toolbar button then select Configuration and Logic. You may be
prompted to first rebuild the ISaGRAF project. Once the required files have been built they
will be transferred to the RTU, normally via an Ethernet network connection. The RTU will
then update its configuration then automatically restart.

Following the restart, you should see LED 1 on the digital output module start flashing,
indicating that the logic has been successfully loaded.

100 B0780AF, Rev M

Chapter 8: ISaGRAF FoxRTU Station User's Guide

Note: To download a new configuration to the RTU you will need to know the current IP
address of the CP-3. If this is not the same as the address you have set in the port
configuration then you need to tell FoxRTU Station to use the existing address by clicking
the Connection toolbar button and entering the existing address.

If you don’t know the existing IP address then you have a couple of options:
• If the CP-3 is connected to the local Ethernet network then you can click Discovery,
which will attempt to automatically detect the CP-3.
• You can reset the CP-3 to the factory default address of 192.168.0.1 by performing
a Factory Reset.

Debugging with ISaGRAF

Once a logic program has been downloaded to the RTU, ISaGRAF Workbench can then
establish a debug connection to an Ethernet port on the CP-3. The debug connection allows
you to view and modify the state of variables in real time, which can be very useful for
checking that the logic is operating as expected.

The ISaGRAF debug connection uses the IP address configured in the Connection dialog –
by default, the IP address of Ethernet Port 1 on the CP-3. If you want to establish a debug
connection via Ethernet Port 2 or 3 on the CP-3 then you would need to set the appropriate
IP address here.

Note: To use ISaGRAF debugging, verify that it has been enabled in the current RTU
configuration (see RTU Properties dialog).

After the logic has been downloaded and has started running, click the ISaGRAF button to
start ISaGRAF Workbench.

Double click on the name of your program to open the Ladder editor. Then click the Debug
Target button, as shown below.

B0780AF, Rev M 101

FoxRTU Station User's Guide Chapter 8: ISaGRAF

After a short pause, the logic will be re-displayed, but this time the rungs will be color coded
according to their current state – red for on (true), blue for off (false).

In this case the input to the function block is red (on), and the output will be flashing red and
blue, mirroring the flashing of the LED on the digital output module. (There will always be a
small amount of “lag” due to the time taken to communicate the states over the Ethernet
network, so for fast changing logic some transitions may not be visible in the ISaGRAF
window.)

To modify a value, double click the stop contact, which will cause a status window to pop up:

102 B0780AF, Rev M

Chapter 8: ISaGRAF FoxRTU Station User's Guide

This shows that the current state of the stop variable is FALSE, which, because the contact
is inverted, causes the input to the function block to be true. If you now click TRUE, the
variable’s state will be changed and you should observe that the LED on the digital output
module stops flashing.

The Lock button allows you to force a variable to a particular state, overriding anything that
might be setting it in the logic program. An asterisk is displayed next to any variable that is
currently locked.

To end a debugging session, click (Stop Debug Target), or close the ISaGRAF windows.

Note: To successfully debug in ISaGRAF, the logic shown in ISaGRAF Workbench must
exactly match that which is running on the RTU. If it doesn’t then ISaGRAF will display a
system message. In particular, if you change any logic or variables in ISaGRAF then to
debug it you will need to first exit ISaGRAF, then download the logic to the RTU using
FoxRTU Station.

ISaGRAF Dictionary

To display a list of all defined variables, click (Dictionary) to display the ISaGRAF
dictionary.

Note: If you click the Dictionary toolbar button an editor window (e.g. Ladder Editor),
ISaGRAF may not automatically switch to the main window containing the Dictionary display.

Click the button on the Windows task bar to switch to the main window.

To filter the display so that only a certain group of variables (e.g. Modbus variables) are
displayed, click the group name in the left hand pane.

This window may also be used during a debugging session, in which case the current
variable values will be displayed.

B0780AF, Rev M 103

FoxRTU Station User's Guide Chapter 8: ISaGRAF

How Logic is Executed

The RTU repeatedly evaluates the configured logic program(s) according to a regular cycle:
• Read data from I/O modules
• Evaluate logic
• Process received communications messages
• Write data to I/O modules and send outgoing communications messages
• Save retained variables (Using the ISaGRAF Dictionary window, variables may be
designated as “retained”. Such variables will then keep their value even if the RTU
is restarted.)

The above cycle is normally triggered at a fixed rate. By default, the RTU will attempt to
execute a new cycle every 100ms.

Note however that in projects with a substantial amount of logic defined, the above tasks
may take longer than 100ms – in which case the logic cycles will be executed back to back,
as quickly as possible.

To make heavily loaded systems more deterministic, the cycle trigger period can optionally
be increased in ISaGRAF Workbench. On the main ISaGRAF screen, select the Resource
window (normally labelled “res”) and right click the title bar. Select Properties to bring up the
Resource Properties window, then click the Settings tab.

For example, if you know that your logic takes about 250ms to execute then you could set
the Cycle Timing control to 300ms.

During an ISaGRAF debugging session, you can determine the current approximate cycle
time by selecting the Resource window, then clicking the Debug menu and selecting

104 B0780AF, Rev M

Chapter 8: ISaGRAF FoxRTU Station User's Guide

Diagnosis. The Timing tab will show the current and maximum cycle execution time. These
figures should, however, only be used as a rough guide.

ISaGRAF Tips
For more information about using ISaGRAF, explore the online help within ISaGRAF
workbench.

The following general tips may also be useful:

• In Ladder Diagram and Structured Text programs, descriptive comments can (and
should) be inserted between (* and *) delimiters. In Function Block Diagrams,
comment blocks can be used to insert comments.
• Function block parameters are configured by double-clicking outside the function
block, next to the parameter name.
• The parameter’s data type must match that expected by the function block. Check
the documentation of the function block carefully – for RTU specific functions see
ISaGRAF Function Blocks in this manual; for standard ISaGRAF functions refer to
the ISaGRAF online help.
• A function block parameter may be either:
• A constant (e.g. 24, ‘5:1’, 1.0 and t#5s are sample integer, string, real and
time constants, respectively)
• A variable (e.g. SL05DO5DO9.value, pump_on, rxdata.4 – the latter format
specifies bit 4 within the integer variable rxdata)
• A defined word (e.g. PROTOCOL_DNP3) These are simply named constants
– see ISaGRAF Defined Words.
• New variables can be added to the dictionary in several different ways:
• Implicitly, when a module is added in FoxRTU Station
• In FoxRTU Station, by clicking New on the Dictionary page
• From within an ISaGRAF logic editor, e.g. by double clicking on a contact in a
ladder diagram
• From within the ISaGRAF dictionary window, by double clicking on the “…” at
the bottom of the table
• If you need to create or modify a large number of variables then it may be easier to
export the dictionary to an Excel spreadsheet file, edit it in Excel, then re-import it.
This is done in FoxRTU Station, see File Menu.

• The (Search) toolbar button can be used to locate where variables are used, or
globally rename all references to a variable.

• A program can be checked while ISaGRAF is running by clicking (Build).

ISaGRAF will report 0 errors and 0 warnings when the program is OK. If there are
detected errors (as shown below), double-click on the detected error in the Output
window and ISaGRAF will highlight where the detected error has occurred.

B0780AF, Rev M 105

FoxRTU Station User's Guide Chapter 8: ISaGRAF

• FoxRTU Station is locked while ISaGRAF is running, and most toolbar buttons are
disabled. To continue using FoxRTU Station, ISaGRAF must first be shut down.
• See ISaGRAF - Logic Examples for sample logic to implement several common
applications.

ISaGRAF Variable Types

Standard Variable Types

The following IEC 61131 variable types are supported by ISaGRAF.
Type Description Data Range Size (bytes)
BOOL Logic (true or false) 1 = True, 0 = False 1
SINT Signed 8-bit integer -128 to +127 1
USINT, BYTE Unsigned 8-bit integer 0 to 255 1
INT Signed 16-bit integer -32768 to 32767 2
UINT, WORD Unsigned 16-bit integer 0 to 65535 2
DINT Signed 32-bit integer -2,147,483,648 to 4
+2,147,483,647
UDINT, DWORD Unsigned 32-bit integer 0 to 4,294,967,295 4
LINT (*) Signed 64-bit integer -9,223,372,036,854,775,808 to 8
9,223,372,036,854,775,807
ULINT, LWORD Unsigned 64-bit integer 0 to 8
(*) 18,446,744,073,709,551,615
REAL 32-bit floating point value (7 significant digits) 3.4E-37 to 3.4E+37 4
LREAL (*) 64-bit floating point value (15 significant digits) 1.7E-308 to 1.7E+308 8
TIME Unsigned 32-bit time value (milliseconds) 0 to 4,294,967,294 ms 4
(1193h2m47s294ms)
DATE Unsigned 32-bit date/time value (seconds since 0 to 4,294,967,294 s 4
0:00UTC 1-Jan-1970) (1-Jan-1970 to 19-Jan-2038)
STRING (*) Character string with a defined maximum size. Up to 255 characters maxlen + 3
When defining a string, the maximum size is
specified in parentheses e.g. MyString(12)

(*) Note: 64-bit and string variables may be used in ISaGRAF logic, but event logging and
returning of these types via protocols such as DNP3 are not currently supported.

106 B0780AF, Rev M

Chapter 8: ISaGRAF FoxRTU Station User's Guide

Other Variable Types

The following array and structure types are also supported
Type Definition Description Size (bytes)
TIMESTRUC DINT seconds High resolution date/time value, consisting of seconds since 8
0:00UTC 1-Jan-1970, plus a millisecond value (0-999)
INT millisecond
IOPOINT_B BOOL value Structure type for holding a BOOL I/O point value, plus 16
additional details such as timestamp and flags. See also
TIMESTRUC
IOPOINT types.
timestamp
USINT flags
USINT datatype
IOPOINT_D DINT value Structure type for holding a DINT I/O point value, plus additional 16
details such as timestamp and flags. See also IOPOINT types.
TIMESTRUC
timestamp
USINT flags
USINT datatype
IOPOINT_R REAL value Structure type for holding a REAL I/O point value, plus 16
additional details such as timestamp and flags. See also
TIMESTRUC
IOPOINT types.
timestamp
USINT flags
USINT datatype
INT_ARRAY Array of 32 INT Used for specifying FoxRTU register numbers or RTU 64
variables addresses when using FOX_RX_DATA, FOX_TX_DATA,
FOX_NW_RX_DATA and FOX_NW_TX_DATA function blocks.
EVENT_FILTER DINT value Used for specifying a filter when retrieving event logs using 8
FOX_RX_UPDATE_SINGLE and FOX_RX_EVENT_LOGS
BOOL all
function blocks:
BOOL If all is set then all events are retrieved. Otherwise, if
greater_equal_than greater_equal_than is set then select events where the
BOOL parameter >= value. Otherwise, if less_equal_than is set then
less_equal_than select events where the parameter <= value. Otherwise, if equal
is set then select events where the parameter = value.
BOOL equal
DATA_TYPE USINT rtunet_usint Used for specifying a data value when using 296
FOX_SET_VARIABLE function block. Only one of these fields
SINT rtunet_sint
should be set.
UINT rtunet_uint Note: rtunet_lreal is not implemented
INT rtunet_int
UDINT rtunet_udint
DINT rtunet_dint
REAL rtunet_real
LREAL rtunet_lreal
STRING(255)
rtunet_string
DATE rtunet_date
TIME rtunet_time

Note that some structure definitions may include padding bytes between certain elements,
resulting in the overall structure size, as indicated in the above table, being greater than the
sum of its elements.

B0780AF, Rev M 107

FoxRTU Station User's Guide Chapter 8: ISaGRAF

IOPOINT Types
Data values originating from an I/O module or DNP3 are represented using IOPOINT_x
types (IOPOINT_B for BOOL variables, IOPOINT_D for DINT and IOPOINT_R for REAL).
These structures contain the following fields:
• value – the current value
• timestamp – (internal use only)
• datatype – (internal use only)
• flags – a set of 8 DNP3-format status bits. For I/O points (e.g. SL12DI10DI3), or
DNP3 points which are mapped to I/O points, bits 0, 5, 6 and 7 will be set
automatically by the RTU:
Bit Name Description
0 ONLINE Set if I/O module is present and working correctly
1 -
2 -
3 -
4 -
5 OVER_RANGE Set if value is over-range (analog input points only)
6 SELECTED Set when a DNP3 SELECT command is received, and cleared when
an OPERATE command is received or a Select timeout occurs
(binary output points only)
7 STATE Copy of I/O point value (binary input or output points only)

For DNP3 points which are not mapped to I/O, bits 6 and 7 will be set automatically
by the RTU:
Bit Name Description
0 ONLINE
1 RESTART
2 COMM_LOST
3 REMOTE_FORCED
4 LOCAL_FORCED
5 OVER_RANGE /
CHATTER
6 REF ERROR / Set when a DNP3 SELECT command is received, and cleared
DISCONTINUITY / when an OPERATE command is received or a Select timeout
SELECTED occurs (binary output points only)
7 STATE Set to the value written when a WRITE or OPERATE command is
received (binary output points only)

When operating as a slave, the RTU may set the STATE and SELECTED bits, as
indicated above. When the RTU is a master, if status information was returned by
the downstream device then all bits will be copied to the flags field.

Note: If you set the value field of a DNP3 variable in logic, then by default all other fields will
be zero. This means that when the master system polls the variable, it will generally mark
the value as “bad” or “offline”, because the ONLINE bit is not set. To rectify this, set the flags
field in logic as well. For example:

108 B0780AF, Rev M

Chapter 8: ISaGRAF FoxRTU Station User's Guide

Alternatively, the initial value of the ONLINE flag can be set by exporting the configuration to
an Excel spreadsheet, then setting the DnpDefaultOnline column to 1 for the required points.

ISaGRAF Constants
Constant values should be specified as follows:
Type Sample Constants Description
BOOL TRUE, FALSE Boolean value
Integer types 0, -5, 20000 Decimal (base 10) value
16#2CFF Hexadecimal (base 16) value
2#0011_1110 Binary (base 2) value
DNP_CLASS_1, ROUTE_DIRECT Defined words representing particular integer
values (refer to function block definitions)
Floating point 0.0, 3.1415, -2.0 Decimal format, must include decimal point
(Real) types
1.0E-3, 9.222e6, -2.1e+8 Exponential format, must include decimal point
TIME T#0s, T#1m30s, T#90m, T#800ms Time unit symbols are: d, h, m, s, ms
DATE D#2013-3-28 Year-month-day
STRING 'cats and dogs' Enclose strings in single quotes
'dollar$$ and newline$N' Prefix special characters with $:
'tab$09' $$ – $ character
$N – newline (CR,LF)
$T – tab character
$’ – apostrophe character
$nn – ASCII character nn (hexadecimal)
Note: String constants entered in the Ladder
Diagram editor will be converted to uppercase.

The following Defined Words (symbolic constants) can be used instead of numeric
constants.
Defined Word Value Used for Function Blocks
PROTOCOL_KINGFISHER 1 FOX_GET_ROUTE, FOX_SET_ROUTE,
FOX_GET_PENDING, FOX_CLEAR_PENDING
PROTOCOL_DNP3 8
PROTOCOL_SNMPC 12
PROTOCOL_MODBUS_ASCII 14
PROTOCOL_MODBUS_RTU 15
PROTOCOL_MODBUS_TCP 16
PROTOCOL_AB 18
PROTOCOL_HART 19
DNP_CLASS_0 1 DNPM_CLASS_POLL,
DNP_CLASS_1 2 DNPM_UNSOL_ENABLE, DNPM_UNSOL_DISABLE,
DNPS_UNSOL_ENABLE, DNPS_UNSOL_DISABLE
DNP_CLASS_2 4
DNP_CLASS_3 8

B0780AF, Rev M 109

FoxRTU Station User's Guide Chapter 8: ISaGRAF

DNP_CTRL_PULSE_ON 1 DNPM_BINARY_COMMAND
DNP_CTRL_PULSE_OFF 2
DNP_CTRL_LATCH_ON 3
DNP_CTRL_LATCH_OFF 4
DNP_AUTO_NONE 0 DNPM_BINARY_COMMAND,
DNPM_ANALOG_16BIT_COMMAND,
DNP_AUTO_OPERATE 1
DNPM_ANALOG_32BIT_COMMAND,
DNP_AUTO_FEEDBACK 2 DNPM_ANALOG_FLOAT_COMMAND
DNP_FC_SELECT 3 DNPM_BINARY_COMMAND,
DNPM_ANALOG_16BIT_COMMAND,
DNP_FC_OPERATE 4
DNPM_ANALOG_32BIT_COMMAND,
DNP_FC_DIRECT 5 DNPM_ANALOG_FLOAT_COMMAND
ROUTE_DIRECT 0 FOX_GET_ROUTE, FOX_SET_ROUTE
ROUTE_INDIRECT 1
SNMP_BOOLEAN 1 SNMP_SET_VALUE
SNMP_INTEGER 2
SNMP_BITSTRING 3
SNMP_OCTETSTRING 4
SNMP_NULL 5
SNMP_OBJECTID 6
SNMP_IPADDRESS 64
SNMP_COUNTER 65
SNMP_GAUGE 66
SNMP_TIMETICKS 67
SNMP_OPAQUE 68
SNMP_NSAP 69
SNMP_UINTEGER 71

ISaGRAF Reserved Names

Listed below are the names that are reserved by ISaGRAF 5.xx and so cannot be used as
variable names. In addition, all names beginning with the underscore character are reserved.
A ABS, ACOS, ADD, ANA, AND, AND_MASK, ANDN, ARRAY, ASIN, AT, ATAN
BCD_TO_BOOL, BCD_TO_INT, BCD_TO_REAL, BCD_TO_STRING, BCD_TO_TIME, BOO, BOOL,
B
BOOL_TO_BCD, BOOL_TO_INT, BOOL_TO_REAL, BOOL_TO_STRING, BOOL_TO_TIME, BY, BYTE
C CAL, CALC, CALCN, CALN, CALNC, CASE, CONCAT, CONSTANT, COS
D DATE, DATE_AND_TIME, DELETE, DINT, DIV, DO, DT, DWORD
ELSE, ELSIF, EN, END_CASE, END_FOR, END_FUNCTION, END_IF, END_PROGRAM, END_REPEAT,
E
END_RESOURCE, END_STRUCT, END_TYPE, END_VAR, END_WHILE, ENO, EQ, EXIT, EXP, EXPT
F FALSE, FIND, FOR, FUNCTION
G GE, GFREEZE, GKILL, GRST, GSTART, GSTATUS, GT
I IF, INSERT, INT, INT_TO_BCD, INT_TO_BOOL, INT_TO_REAL, INT_TO_STRING, INT_TO_TIME
J JMP, JMPC, JMPCN, JMPN, JMPNC
L LD, LDN, LE, LEFT, LEN, LIMIT, LINT, LN, LOG, LREAL, LT, LWORD
M MAX, MID, MIN, MOD, MOVE, MSG, MUL, MUX
N NE, NOT
O OF, ON, OR, OR_MASK, ORN
R, READ_ONLY, READ_WRITE, REAL, REAL_TO_BCD, REAL_TO_BOOL, REAL_TO_INT,
P REAL_TO_STRING, REAL_TO_TIME, REPEAT, REPLACE, RESSOURCE, RET, RETAIN, RETC, RETCN,
RETN, RETNC, RETURN, RIGHT, ROL, ROR
S, SEL, SHL, SHR, SIN, SINT, SQRT, ST, STN, STRING, STRING_TO_BCD, STRING_TO_BOOL,
S STRING_TO_INT, STRING_TO_REAL, STRING_TO_TIME, STRUCT, SUB, SUB_DATE_DATE,
SYS_ERR_READ, SYS_ERR_TEST, SYS_INITALL, SYS_INITANA, SYS_INITBOO, SYS_INITTMR,
SYS_RESTALL, SYS_RESTANA, SYS_RESTBOO, SYS_RESTTMR, SYS_SAVALL, SYS_SAVANA,

110 B0780AF, Rev M

Chapter 8: ISaGRAF FoxRTU Station User's Guide

SYS_SAVBOO, SYS_SAVTMR, SYS_TALLOWED, SYS_TCURRENT, SYS_TMAXIMUM,

SYS_TOVERFLOW, SYS_TRESET, SYS_TWRITE, SYSTEM
TAN, TASK, THEN, TIME, TIME_OF_DAY, TIME_TO_BCD, TIME_TO_BOOL, TIME_TO_INT,
T
TIME_TO_REAL, TIME_TO_STRING, TMR, TO, TOD, TRUE, TYPE
U UDINT, UINT, ULINT, UNTIL, USINT
V VAR, VAR_ACCESS, VAR_EXTERNAL, VAR_GLOBAL, VAR_IN_OUT, VAR_INPUT, VAR_OUTPUT
W WHILE, WITH, WORD
X XOR, XOR_MASK, XORN

ISaGRAF Licensing Details

To use ISaGRAF workbench beyond the 30 day trial period, a Sentinel USB license key is
required (pictured left). This should be plugged into a USB port on
your computer before starting ISaGRAF.

The license keys differ in cost and functionality based on the

number of usable I/O points. Options include 64, 256, 1024 or
unlimited I/O points, or a restricted personal maintenance key that
cannot compile programs.

When purchasing a license key, the size of the RTU to be

implemented needs to be considered.

The I/O point limit effectively constrains the number of readable and settable registers
available to FoxRTU Station and ISaGRAF. Note that unused variables can be deleted from
the dictionary to save on license I/O slots.

For example, a system comprising of a PS-1x, CP-3 and an IO-3 uses 31 I/O points, as
follows:
Module I/O Type I/O Function No. Of Variables
PS-1x Analog Inputs 1 to 7 Current and Voltage 7
measurement
Digital Inputs 1 to 8 Charge States and Flags 8
Digital Outputs 1 to 3 Power Control 3
IO-3 Analog Inputs 1 to 4 Misc. Analog Input 4
Analog Output 1 Misc. Analog Output 1
Digital Inputs 1 to 4 Misc. Digital Inputs 4
Digital Outputs 1 to 4 Misc. Digital Output 4
Total: 31

If this system was not required to monitor any power usage or facilitate a backup battery, the
variables assigned to the PS-1x can be removed, freeing up 18 I/O points.

For additional information on specific variables on each module, see RTU Variables.

B0780AF, Rev M 111

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Chapter 9: ISaGRAF Function Blocks

Several protocols and special functions have been implemented using custom ISaGRAF
function blocks as detailed below.
Category Function Block Description
FoxRTU protocol FOX_RX_DATA Read FoxRTU registers from a remote RTU
FOX_TX_DATA Send FoxRTU registers to a remote RTU
FOX_NW_RX_DATA Read FoxRTU network registers from a remote RTU
FOX_NW_TX_DATA Send FoxRTU network registers to a remote RTU
FOX_RX_UPDATE_SINGLE Read data/events from a Series 2 RTU
FOX_GET_VARIABLE Read a variable from a remote RTU
FOX_SET_VARIABLE Update a variable on a remote RTU
FOX_RX_EVENT_LOGS Read events from a remote RTU
FOX_TX_EVENT_LOGS Send events to a remote RTU
DNP3 protocol DNPM_CLASS_POLL Read data (selected classes) from slave device
DNPM_INTEGRITY_POLL Read data (all classes) from slave device
DNPM_READ_GROUP Read data (selected types) from slave device
DNPM_ANALOG_16BIT_COMMAND Set analog value on slave device
DNPM_ANALOG_32BIT_COMMAND Set analog value on slave device
DNPM_ANALOG_FLOAT_COMMAND Set analog value on slave device
DNPM_BINARY_COMMAND Set binary value on slave device
DNPM_FREEZE_COUNTERS Record snapshot of counter values on slave device
DNPM_UNSOL_ENABLE Enable unsolicited reporting by slave device
DNPM_UNSOL_DISABLE Disable unsolicited reporting by slave device
DNPM_COLD_RESTART Restart slave device
DNPM_WARM_RESTART Restart slave device
DNPM_CLEAR_RESTART Clear Device Restart IIN bit on slave device
DNPM_LINK_RESET Reset comms link
DNPM_TIME_SYNC Set time in slave device
DNPS_NEED_TIME Set Need Time IIN bit
DNPS_UNSOL_ENABLE Enable unsolicited reporting
DNPS_UNSOL_DISABLE Disable unsolicited reporting
Modbus protocol MODBUS Read/write data to/from slave Modbus device
Allen Bradley DF1 ABDF1_RX Read data from Allen Bradley PLC
protocol
ABDF1_TX Write data to Allen Bradley PLC
HART protocol HART Read/write data to/from slave HART device
SNMP Client SNMP_GET_INT Read integer from remote device
protocol
SNMP_GET_UINT Read unsigned integer from remote device
SNMP_GET_STRING Read string from remote device
SNMP_GET_OBJID Read OID string from remote device
SNMP_GET_BULK Read multiple values from remote device
SNMP_SET_INT Write integer to remote device
SNMP_SET_UINT Write unsigned integer to remote device
SNMP_SET_STRING Write string to remote device
SNMP_SET_OBJID Write OID string to remote device
SNMP_SET_VALUE Write value of any type to remote device
SNMP Trap protocol SNMP_GET_TRAP Read received trap message
SNMP_SEND_TRAP Send trap message
USER_TX Send bytes to remote device

112 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

User Defined USER_RX Read bytes received from remote device

protocol
USER_RX_BYTES Return number of received bytes
General FOX_GET_COMM_STATS Get comms statistics for one or all RTUs
Communications
FOX_RESET_COMM_STATS Clear comms statistics for one or all RTUs
FOX_GET_PORT_STATS Get comms statistics for a physical port
FOX_RESET_PORT_STATS Clear comms statistics for a physical port
FOX_GET_PENDING Indicates whether a message is in progress
FOX_CLEAR_PENDING Clear the message pending flag
FOX_GET_ROUTE Get information about the route to a remote RTU
FOX_SET_ROUTE Modify the route to a remote RTU
Event Logging FOX_EVENT_LOG Store an event log
FOX_CLEAR_EVENT_LOGS Clear all event logs on local or remote RTU
FOX_GET_EVENT_LOG_COUNT Get event log count on local or remote RTU
RTU System Data FOX_GET_ADDRESS Return RTU address
FOX_GET_FIRMWARE Return RTU firmware version
FOX_GET_RTU_TYPE Return RTU type
FOX_GET_SYSTEMID Return system ID byte
FOX_GET_PROCESSOR Return processor backplane slot
FOX_GET_MODULE_TYPE Return module type in specified slot
FOX_GET_MODULE_OK Check whether slot contains expected module
FOX_RESET_MODULE Reset/reconfigure module
REBOOT Reboot processor module
FOX_GET_RTC Get current time as integer
FOX_SET_RTC Set current time as integer
FOX_GET_TIME Get current time as separate components
FOX_SET_TIME Set current time as separate components
GET_BP12V Return 12V rail voltage
GET_LOWBATT Return Li battery low voltage status
SET_BPFIELD Control I/O field power
SET_BPAUX Control powered backplane AUX output
Math & Logic INCREMENT Increment a value
DECREMENT Decrement a value
ChangeDetect Detect change in a value
MulDiv Scale a floating point value
MULDIV_INT Scale an integer value
BCD_TO_BINARY Convert BCD to integer
BINARY_TO_BCD Convert integer to BCD
FPACK Join two integers to make floating point value
FUNPACK Split floating point value into two integers
F64PACK Join four integers to make a 64-bit floating point value
F64UNPACK Split 64-bit floating point value into four integers
U32PACK Join two 16-bit integers to make a 32-bit value
U32UNPACK Split 32-bit value into two 16-bit integers
U64PACK Join four 16-bit integers to make a 64-bit value
U64UNPACK Split 64-bit value into four 16-bit integers
NBIT Set/clear single bit
NCBT Test single bit for 1
NOBT Test single bit for 0
PID Controller FOX_PID Proportional Integral Derivative Controller
FOX_AGA3 Calculate gas mass flow

B0780AF, Rev M 113

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Gas Flow FOX_AGA5 Calculate gas heating value

Calculations
FOX_AGA7 Calculate gas volumetric flow
FOX_AGA8_G Calculate gas compressibility
FOX_AGA8_D Calculate gas compressibility
FOX_NX19 Calculate gas super compressibility

These function blocks are shown in Ladder Diagram form. However they can be used in any
of the languages supported by ISaGRAF.

Note: The EN (Enable) and ENO (Enable Out) parameters on each function block are only
present when the block is used in a Ladder Diagram program. The function block will be
executed every cycle, while the EN input is true. The state of EN is copied to the ENO
output.

See ISaGRAF - Logic Examples for some practical examples of using these function blocks.

Note that there are some function blocks listed in ISaGRAF which are no longer supported
and must not be used. See Obsolete Function Blocks for more details.

114 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FoxRTU Protocol
The following function blocks are used to initiate FoxRTU protocol operations.

A FoxRTU register variable must be created in the Dictionary for every point that you wish to
transfer using FoxRTU protocol.

If the RTU is operating as a slave device then it is not necessary to call these function
blocks. Simply load the required values into local FoxRTU registers (FOXRn), either by
mapping them to I/O module points or by setting them in logic.

FOX_RX_DATA

Polls a remote RTU for up to 32 FoxRTU register values.

Registers FOXRn on the remote RTU#r will be transferred to
registers FOXrRn on the local RTU.

This is typically used where a master RTU periodically polls an

outstation.

Parameter Type Description

RTU UINT Address of RTU from which to read data (1-249)
REG INT_ARRAY Array of up to 32 INT values specifying the register numbers (1-2048) to
read.
NBR USINT Number of registers to read (1-32)
 ERR DINT Status output (0=OK, -34=one or more parameters out of range)

For example, to update registers FOX10R1, FOX10R2 and FOX10R75 (by polling RTU
#10), then you would set RTU=10, NBR=3 and then create an INT_ARRAY variable to
specify the three register numbers. This is done from the ISaGRAF Dictionary page. Set the
initial values of the array elements as follows:

Then specify the name of the array (RTU10regs in this example) for the function block REG
parameter.

B0780AF, Rev M 115

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_TX_DATA

Sends up to 32 FoxRTU local register variables to a remote RTU.

Registers FOXRn on the local RTU will be transferred to registers
FOXrRn on the remote RTU (where r is the address of the local
RTU).

This is typically used for exception reporting, where an outstation

reports values to a master when it detects that a change has
occurred. It may also be used by a master to update control
values on an outstation.

Parameter Type Description

RTU UINT Address of RTU to send to (1-249)
REG INT_ARRAY Array of up to 32 INT values specifying the register numbers (1-2048) to
send.
NBR USINT Number of registers to send (1-32)
 ERR DINT Status output (0=OK, -34=one or more parameters out of range)

For example, to send the values of registers FOXR1, FOXR2 and FOXR75 to an RTU with
address 10, you would set RTU=10, NBR=3 and then create an INT_ARRAY variable to
specify the three register numbers, as described in FOX_RX_DATA.

116 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_NW_RX_DATA

Polls a remote RTU for up to 32 FoxRTU register values, which

may have originated from other RTUs. Registers FOXrRn on the
remote RTU will be transferred to registers FOXrRn on the local
RTU.

This is typically used where a master RTU periodically polls a

concentrator RTU, which in turn polls various outstation RTUs.

Parameter Type Description

RTU UINT Address of RTU from which to read data (1-249)
REG INT_ARRAY Array of up to 32 INT values specifying the register numbers (1-2048) to
read.
NRTU INT_ARRAY Array of up to 32 INT values specifying the source RTU (1-249) for each
of the registers to read.
NBR USINT Number of registers to read (1-32)
 ERR DINT Status output (0=OK, -34=one or more parameters out of range)

For example, suppose RTU #10 is set up to poll RTU #2 and RTU #3. To read and update
network registers FOX2R1, FOX2R2, FOX2R42, FOX3R1 and FOX3R101 (by polling RTU
#10) you would set RTU=10 and NBR=5.

Then create an INT_ARRAY variable to specify the five register numbers, and another
INT_ARRAY to specify the source RTU address for each of these five registers. This is done
from the ISaGRAF Dictionary page. Set the initial values of the array elements as follows:

Then specify the names of the arrays (RTU10regs and RTU10addresses in this example) for
the function block REG and NRTU parameters.

B0780AF, Rev M 117

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_NW_TX_DATA

Sends up to 32 FoxRTU network register variables to a remote

RTU. Registers FOXrRn on the local RTU will be transferred to
registers FOXrRn on the remote RTU.

This is typically used for exception reporting, where a

concentrator RTU reports values received from one or more
outstations to a master RTU.

Parameter Type Description

RTU UINT Address of RTU to send to (1-249)
REG INT_ARRAY Array of up to 32 INT values specifying the register numbers (1-2048) to
send.
NRTU INT_ARRAY Array of up to 32 INT values specifying the source RTU (1-249) for each
of the registers to send.
NBR USINT Number of registers to send (1-32)
 ERR DINT Status output (0=OK, -34=one or more parameters out of range)

For example, to send the network registers FOX2R1, FOX2R2, FOX2R42, FOX3R1 and
FOX3R101 to RTU #1 you would set RTU=1 and NBR=5.

Then create an INT_ARRAY variable to specify the five register numbers, and another
INT_ARRAY to specify the source RTU address for each of these five registers, as
described in FOX_NW_RX_DATA.

FOX_RX_UPDATE_SINGLE

Retrieves data or event logs from a remote RTU.

Note however that DNP3 is normally a better option for

communicating events to/from SCD2200 RTUs.

118 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Parameter Type Description

RTU UINT Address of RTU from which to retrieve data (1-249)
REG STRING(16) String containing the name of a global integer variable (e.g.
‘ControlReg’). The value of this variable is interpreted as follows:
• 0 or 1: The current state of all defined FoxRTU registers on
the target RTU will be read, which will then update the
corresponding FoxRTU network registers on the local RTU.
• 2: Logged events that match the filter settings will be
retrieved from the target RTU.
• 4: The clock on the target RTU will be synchronized to that
on the local RTU.
MAX UINT Maximum number of events to retrieve (if control register = 2)
PRI EVENT_FILTER Retrieve events where the Priority field matches the filter (if control
register = 2)
TYPE EVENT_FILTER Retrieve events where the Type field matches the filter (if control
register = 2)
 ERR DINT Status output (0=OK, -34=one or more parameters out of range)

FOX_GET_VARIABLE

Retrieves a variable by name from a remote SCD2200 RTU.

B0780AF, Rev M 119

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Parameter Type Description

RTU UINT Address of RTU from which to retrieve variable (1-65520)
TYP USINT Data type of variable:
1=USINT, 2=SINT, 3=UINT, 4=INT, 5=UDINT, 6=DINT, 7=REAL,
9=STRING, 10=DATE, 11=TIME.
NAM STRING(16) Name of global variable on remote RTU to retrieve.
DEST STRING(16) Name of global variable on local RTU to write value to.
 ERR DINT Status output (0=OK, -34=one or more parameters out of range)

FOX_SET_VARIABLE

Sets the value of a variable on a remote SCD2200 RTU.

Parameter Type Description

RTU UINT Address of RTU to write to (1-65520)
TYP USINT Data type of variable:
1=USINT, 2=SINT, 3=UINT, 4=INT, 5=UDINT, 6=DINT, 7=REAL,
9=STRING, 10=DATE, 11=TIME.
NAM STRING(16) Name of global variable on remote RTU to set.
VAL DATA_TYPE Value to set
 ERR DINT Status output (0=OK, -34=one or more parameters out of range)

120 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_RX_EVENT_LOGS

Retrieves event logs that occurred over a specific time period

from a remote RTU. It will keep polling event logs until it has
received the maximum limit of logs or until the end of the event
log list is reached.

Note however that DNP3 is normally a better option for

communicating events to/from SCD2200 RTUs.

B0780AF, Rev M 121

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Parameter Type Description

RTU UINT Address of RTU from which to retrieve logs (1-65520)
STAT STRING(16) String containing the name of a global integer variable (e.g.
‘StatusReg’). Will be updated, but not with anything useful.
TIME UDINT Start time of the first event log to receive (minutes before now).
PRD UDINT Time period of event logs to receive (minutes).
MAX UINT Maximum number of event logs to retrieve
FRTU UINT If non-zero, only events matching the event filters below will be
returned.
PRI EVENT_FILTER Retrieve events where the Priority field matches the filter
UTYP EVENT_FILTER Retrieve events where the Type field matches the filter
 ERR DINT Status output (0=OK, non-zero if error is detected)

Note: If the remote RTU address is less than 256 then a “Series 2” event log request is
performed. This will only return events relating to FoxRTU registers and I/O module points. If
the RTU address is greater than or equal to 256 then a “Series 3” request is sent, which will
return all event logs.

FOX_TX_EVENT_LOGS

Sends event logs to a remote RTU.

Note however that DNP3 is normally a better option for

communicating events to/from SCD2200 RTUs.

122 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Parameter Type Description

RTU UINT Address of destination RTU (1-65520)
EPTR STRING(16) String containing the name of a global integer variable (e.g.
‘EventPtr’). This variable contains the index of the first event log to
send, and will be automatically updated on completion of the
function block.
STAT STRING(16) String containing the name of a global integer variable (e.g.
‘StatusReg’). Set to 128 if an error is detected, set to 1 when
transmission is complete.
NBR UINT Maximum number of event logs to send.
 ERR DINT Status output (0=OK, non-zero if parameter error is detected)

Note: If the remote RTU address is less than 256 then a “Series 2” event log request is
performed. Only events relating to FoxRTU registers and I/O module points will be sent. If
the RTU address is greater than or equal to 256 then a “Series 3” request is sent, which will
send all event logs.

B0780AF, Rev M 123

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

DNP3 Protocol
The following function blocks are used to initiate DNP3 protocol operations.

Function blocks with names beginning with DNPM_ are used when the RTU is operating as
a DNP3 master, while DNPS_ function blocks are used when the RTU is operating as a
DNP3 slave.

A DNP3 variable must be created in the Dictionary for every point that you wish to transfer
using the DNP3 protocol.

If the RTU is operating as a slave device then it is not necessary to call these function
blocks. Simply load the required values into local DNP3 registers (DNPBIn, DNPAIn etc.),
either by mapping them to I/O module points or by setting them in logic.

DNPM_CLASS_POLL

Polls a remote DNP3 device for static values (class 0 data) and/or
events (class 1/2/3 data).

Returned object data will be stored in the local RTU if DNP3

variables (e.g. DNPrBIn for binary inputs) have been created in
the Dictionary.

Parameter Type Description

ADDR UINT Address of slave device from which to read data (1-65535)
MASK USINT Bitmask specifying class(es) of data to read (0-15):
bit0=Class 0, bit1=Class 1, bit2=Class 2, bit3=Class 3.
If a single class is being read then the defined words DNP_CLASS_0,
DNP_CLASS_1, DNP_CLASS_2 or DNP_CLASS_3 may also be used.

For example, to read the current states of all DNP3 variables (i.e. class 0 data) and all class
1 events from a DNP3 device with address 3008 then you would set ADDR=3008 and
MASK=3. If a variable DNP3008BI22 was defined on the local RTU then its value would be
updated (assuming that DNP Binary Input #22 was defined on the slave device). If the
variable was defined as class 1, then any events received from the device relating to this
variable would be logged.

Any received static (class 0) data for which DNP3 variables are not defined will be
discarded.

Note: The DNP3 protocol does not transmit class information along with each event. When
DNP3 events are received and logged by the RTU, the event logs will each be tagged with
the lowest event class number that was requested (1, 2 or 3). This means that if multiple
classes of DNP3 events are requested simultaneously, then the class number that will be
attached to the event logs will not necessarily match that of the original point on the remote
source RTU.

This can be important where the RTU is operating as a concentrator, i.e. polling slave DNP3
devices and in turn being polled by a DNP3 master.

124 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

For example, suppose a remote slave device contains two DNP3 points DNPBI101 (class 1)
and DNPBI102 (class 2). If the RTU performs a Class 1+2 poll (MASK=6) then all events for
both these points will be logged as Class 1 events. If a master system then issues a Class 2
poll to the RTU, events for DNPBI102 will not be returned.

If you wish to preserve the original point’s class in the event log then separate class 1, 2 and
3 polls should be performed. Likewise, the DNPM_INTEGRITY_POLL function block (which
performs a Class 0+1+2+3 poll) must not be used.

DNPM_INTEGRITY_POLL

Polls a remote DNP3 device for static values (class 0 data) and
events (class 1/2/3 data). Equivalent to calling
DNPM_CLASS_POLL with MASK=15.

Parameter Type Description

ADDR UINT Address of slave device from which to read data (1-65535)

Note: Events logged by the RTU using this function block will all be marked as Class 1
events, which may not be desirable in situations where the RTU is in turn being polled by a
master system. See DNPM_CLASS_POLL for more information.

DNPM_READ_GROUP

Polls a remote DNP3 device for static values (class 0 data) of a

particular type.

Parameter Type Description

ADDR UINT Address of slave device from which to read data (1-65535)
GRP USINT Data type group to poll:
1=binary inputs, 10=binary outputs, 20=binary counters, 21=frozen
counters, 30=analog inputs, 40=analog outputs
 ERR UINT Status output (0=OK, 65535=one or more parameters out of range)

For example, if ADDR is set to 205 and GRP is set to 30 then analog input variables
(DNP205AInn) would be updated.

B0780AF, Rev M 125

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

DNPM_ANALOG_16BIT_COMMAND

Sets a 16-bit (UINT) DNP3 variable on a slave device.

Parameter Type Description

ADDR UINT Address of slave device containing the variable to set (1-65535)
FC USINT Specifies the function to perform:
3=Select, 4=Operate, 5=Direct Operate
The defined words DNP_FC_SELECT, DNP_FC_OPERATE and
DNP_FC_DIRECT may also be used.
See DNP3 Select and Operate for more information.
AUTO USINT Specifies whether the above function should be automatically followed by
the appropriate confirmation function.
0=None, 1=Automatic Operate after Select, 2=Automatic Feedback Poll
after Operate
The defined words DNP_AUTO_NONE, DNP_AUTO_OPERATE and
DNP_AUTO_FEEDBACK may also be used.
See DNP3 Select and Operate for more information.
OPER UDINT If an automatic feedback poll is selected, this parameter specifies the
delay (ms) between the Operate and the feedback poll.
PNT UINT DNP3 analog point number (0-65535)
VAL UINT Value to set

DNP3 Select and Operate

The DNP3 protocol provides an option to set control outputs using a two stage confirmation
process. First, a Select message is sent which specifies the desired state(s). If a valid
acknowledgement is received from the slave then an Operate message containing identical
data is sent, which the slave will then action.

If this confirmation procedure is not required then a single Direct Operate message can be
used. The master can then optionally poll the outputs to verify that they were set.

The following combinations of the FC and AUTO function block parameters may be used:

126 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FC AUTO Action
DNP_FC_SELECT DNP_AUTO_NONE Send Select message
DNP_FC_SELECT DNP_AUTO_OPERATE Send Select message. If valid response from slave then send Operate
message.
DNP_FC_OPERATE DNP_AUTO_NONE Send Operate message
DNP_FC_OPERATE DNP_AUTO_FEEDBACK Send Operate message. Wait for specified delay, then send Feedback
Poll message.
DNP_FC_DIRECT DNP_AUTO_NONE Send Direct Operate message
DNP_FC_DIRECT DNP_AUTO_FEEDBACK Send Direct Operate message. Wait for specified delay, then send
Feedback Poll message.

DNPM_ANALOG_32BIT_COMMAND

Sets a 32-bit (UDINT) DNP3 variable on a slave device.

Same as DNPM_ANALOG_16BIT_COMMAND, apart from

the type of the VAL parameter.

DNPM_ANALOG_FLOAT_COMMAND

Sets a 32-bit floating point (REAL) DNP3 variable on a slave

device.

Same as DNPM_ANALOG_16BIT_COMMAND, apart from

the type of the VAL parameter.

B0780AF, Rev M 127

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

DNPM_BINARY_COMMAND

Sets a binary (BOOL) DNP3 variable on a slave device.

Parameter Type Description

ADDR UINT Address of slave device containing the variable to set (1-65535)
FC USINT Specifies the function to perform, as per
DNPM_ANALOG_16BIT_COMMAND
AUTO USINT Specifies the automatic confirmation function, as per
DNPM_ANALOG_16BIT_COMMAND
OPER UDINT Specifies the delay before performing an automatic feedback poll, as per
DNPM_ANALOG_16BIT_COMMAND
PNT UINT DNP3 binary point number (0-65535)
CTRL USINT Binary control function to perform:
1=Pulse On, 2=Pulse Off, 3=Latch On, 4=Latch Off, 65=Close, 129=Trip
The defined words DNP_CTRL_PULSE_ON, DNP_CTRL_PULSE_OFF,
DNP_CTRL_LATCH_ON and DNP_CTRL_LATCH_OFF may also be
used.
ON UDINT If Pulse On is selected, this specifies the pulse on time (ms).
OFF UDINT If Pulse Off is selected, this specifies the pulse off time (ms).

128 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

DNPM_FREEZE_COUNTERS

Freezes the counters in a slave device, i.e. takes a snapshot of

their current count values. Additionally, it allows the counters to be
cleared after being frozen.

Parameter Type Description

ADDR UINT Address of slave device containing the counter variables (1-65535)
CLR BOOL If true then the counters will be cleared after being frozen.

DNPM_UNSOL_ENABLE

Commands a slave device to enable unsolicited responses.

Parameter Type Description

ADDR UINT Address of slave device (1-65535)
MASK USINT Bitmask specifying class(es) of data for which to enable unsolicited
responses (0-7):
bit0=Class 1, bit1=Class 2, bit2=Class 3.

DNPM_UNSOL_DISABLE

Commands a slave device to disable unsolicited responses.

Parameter Type Description

ADDR UINT Address of slave device (1-65535)
MASK USINT Bitmask specifying class(es) of data for which to disable unsolicited
responses (0-7):
bit0=Class 1, bit1=Class 2, bit2=Class 3.

B0780AF, Rev M 129

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

DNPM_COLD_RESTART

Commands a slave device to perform a cold restart.

Note that a slave SCD2200 RTU does not distinguish between

cold and warm restarts: both requests will cause a reboot.

Parameter Type Description

ADDR UINT Address of slave device (1-65535)

DNPM_WARM_RESTART

Commands a slave device to perform a warm restart.

Note that a slave SCD2200 RTU does not distinguish between

cold and warm restarts: both requests will cause a reboot.

Parameter Type Description

ADDR UINT Address of slave device (1-65535)

DNPM_CLEAR_RESTART

Resets the DEVICE_RESTARTED bit in a slave device’s Internal

Indications (IIN) register.

Parameter Type Description

ADDR UINT Address of slave device (1-65535)

130 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

DNPM_LINK_RESET

Sends a RESET_LINK_STATES message to a slave device. This

will reset the data link layer of the DNP3 protocol.

Parameter Type Description

ADDR UINT Address of slave device (1-65535)

DNPM_TIME_SYNC

Sends a DNP3 time synchronization command to a slave device, i

to synchronize the remote device’s time to that of the RTU.

Parameter Type Description

ADDR UINT Address of slave device (1-65535)

DNPS_NEED_TIME

Sets the NEED_TIME bit in the local RTU’s Internal Indications

(IIN) register. When next polled by the master device, the RTU’s
clock will be synchronized to that of the master.

DNPS_UNSOL_ENABLE

Enables the sending of unsolicited data by the local RTU.

Parameter Type Description

MASK USINT Bitmask specifying class(es) of data for which to enable unsolicited
responses (0-7):
bit0=Class 1, bit1=Class 2, bit2=Class 3.

B0780AF, Rev M 131

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

DNPS_UNSOL_DISABLE

Disables the sending of unsolicited data by the local RTU.

Parameter Type Description

MASK USINT Bitmask specifying class(es) of data for which to disable unsolicited
responses (0-7):
bit0=Class 1, bit1=Class 2, bit2=Class 3.

132 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Modbus Protocol
The following function blocks are used to initiate Modbus protocol operations.

A Modbus variable must be created in the Dictionary for every point that you wish to transfer
using the Modbus protocol.

If the RTU is operating as a slave device then it is not necessary to call this function block.
Simply load the required values into local Modbus registers (MODCn, MODIn etc.), either by
mapping them to I/O module points or by setting them in logic.

MODBUS

This function block either:

• Retrieves data from a remote device r and updates
Modbus network registers (MODrCn, MODrDn, MODrHn,
MODrIn), or
• Writes data in local Modbus registers (MODCn, MODHn)
to remote device r.

Parameter Type Description

ADDR UINT Address of the Modbus slave device (1-254). If the device is an RTU
(address 1-65520) then only the lower 8 bits of the address will be used.
FC USINT Function code. See Supported function codes.
SRC UINT First source Modbus register (1-65535). For read operations this will be
a register in the slave device; for writes it will be an RTU Modbus
register.
DST UINT First destination Modbus register (1-65535). For read operations this will
be an RTU Modbus register; for writes it will be a register in the slave
device.
NUM USINT Number of registers to transfer. See Supported function codes.
 ERR DINT Status code. 0=OK, non-zero indicates a problem with one or more
parameters

Note: In some systems, the type of Modbus point is identified by adding a digit on the front
of the register number, as follows:
• Coils are numbered 000001-065535 (or 00001-09999)
• Discrete inputs are numbered 100001-165535 (or 10001-19999)
• Input registers are numbered 300001-365535 (or 30001-39999)
• Holding registers are numbered 400001-465535 (or 40001-49999)

B0780AF, Rev M 133

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

The value specified for the SRC and DST parameters must not include this initial digit, e.g.
to specify the first holding register use the value 1, not 40001. (The type of register is implied
by the function code.)

Supported Function Codes

The following function codes are supported:
FC NUM Description
1 1-128 Read coils – update RTU variables MODrCn (r=ADDR, n=DEST to DEST+NUM-1)
2 1-128 Read discrete inputs – update RTU variables MODrDn
3 1-120 * Read holding registers – update RTU variables MODrHn
4 1-120 * Read input registers – update RTU variables MODrIn
5 1 Write coil – copy from RTU variable MODCn (n=SRC)
6 1 Write holding register – copy from RTU variable MODHn
15 1-128 Write multiple coils – copy from RTU variables MODCn (n=SRC to SRC+NUM-1)
16 1-120 * Write multiple holding registers – copy from RTU variables MODHn

* Valid range is 1-50 for Modbus/ASCII protocol

134 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Allen Bradley DF1 Protocol

The following function blocks are used to initiate Allen Bradley DF-1 protocol operations.

ABDF1_RX

Reads up to 100 consecutive data registers from a remote Allen

Bradley PLC using the DF1 protocol.

The returned status code and data values will be stored in local
FoxRTU variables (FOXRnn), which must have been created in
the Dictionary.

Parameter Type Description

ADDR DINT Station address (1-249) configured in the Allen Bradley PLC. An Allen
Bradley PLC is treated like another RTU in the network, which means
that the station address must be different to all the other addresses in
the RTU's Route list.
PLC USINT Not used (set to 0)
NUM USINT Number of registers to read (1-100)
SRC STRING(20) Source address in the Allen Bradley PLC from which to read, e.g.
‘N10:1’
DEST DINT Starting FoxRTU register number. A status code (0=OK) is stored in the
first register, followed by the NUM data values.
 ERR USINT Not used (always 0)

For example, if you set NUM=5 and DEST=100 then the status code would be stored in the
variable FOXR100 and the data values would be stored in FOXR101 through FOXR105,
assuming these variables have been created in the Dictionary.

B0780AF, Rev M 135

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

ABDF1_TX

Transmits up to 100 consecutive FoxRTU registers to a remote

Allen Bradley PLC using the DF1 protocol.

Parameter Type Description

ADDR DINT Station address (1-249) configured in the Allen Bradley PLC.
PLC USINT Not used (set to 0)
NUM USINT Number of registers to send (1-100)
SRC DINT Starting FoxRTU register number.
DEST STRING(20) Destination address in the Allen Bradley PLC where data is to be written,
e.g. ‘N10:1’
 Err USINT Not used (always 0)

136 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

HART Protocol
The following function blocks are used to initiate HART protocol operations.

HART

Sends or receives data in FoxRTU network registers (FOXrRn or

FOXrFn) to/from a slave HART device. This requires the use of a
HART communications option board.

Parameter Type Description

DEV USINT The HART device address (0-15). Address 0 is only used for point to
point installations.
CMD USINT The HART command (or function code) to perform (0-108). See
Supported HART Commands.
RTU USINT Data are stored in integer and floating point FoxRTU network registers
(FOXrRn and FOXrFn), where r is specified by this parameter (1-249). It
need not be the same as the actual device address (DEV parameter).
EXT UINT Specifies the first of three consecutive FoxRTU registers used to store
the HART device’s 38-bit extended address, which is retrieved using the
Read Unique Identifier command (CMD=0).
For example, if RTU=7 and EXT=3 then the extended address would be
stored in FOX7R3, FOX7R4 and FOX7R5.
SRC UINT Specifies the first in a block of consecutive FoxRTU registers which hold
the data to be sent when performing a Write operation. The number of
registers sent and their meanings will vary depending on the selected
command.
It is recommended that a block of at least 10 integer FoxRTU registers
(FOXrRn) be created for HART Write operations.
DREG UINT Specifies the first in a block of consecutive FoxRTU registers which will
be updated when performing a Read operation. The number of registers
updated and their meanings will vary depending on the selected
command.
It is recommended that a block of at least 10 integer FoxRTU registers
(FOXrRn) and 10 floating point registers (FOXrFn) be created for HART
Read operations.
SREG UINT Specifies a FoxRTU register which will be updated with a status code
following each command.
 STAT DINT Not used (always 0)

B0780AF, Rev M 137

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Supported HART Commands

The following function codes are supported:
CMD Description
0 Read Unique Identifier
1 Read PV [primary variable]
2 Read Current and % of range
3 Read Current and 4 Dynamic Variables
6 Write Polling Address
11 Read Unique Identifier with Tag
12 Read Message
13 Read Tag, Descriptor, Date
14 Read PV Sensor Information
15 Read [PV] Output Information
16 Read Final Assembly Number
17 Write Message
18 Write Tag, Descriptor, Date
19 Write Final Assembly Number
33 Read Transmitter Variables
34 Write [PV] Damping Value
35 Write [PV] Range Values
36 Set [PV] Upper Range Value
37 Set [PV] Lower Range Value
38 Reset Configuration Changed Flag
39 EEPROM Control
40 Enter/Exit Fixed Current Mode
41 Perform Transmitter Self Test
42 Perform Master Reset
43 Set PV Zero
44 Write PV Units
45 Trim [PV Current] DAC Zeros
46 Trim [PV Current] DAC Gain
47 Write [PV] Transfer Function
48 Read Additional Transmitter Status
49 Write PC Sensor Serial Number
50 Read Dynamic Variable Assignments
51 Write Dynamic Variable Assignments
52 Set Transmitter Variable Zero
53 Write Transmitter Variable Units
54 Read Transmitter Variable Info
55 Write Transmitter Variable Damping Value
56 Write Transmitter Variable Sensor Serial No
108 Read All Dynamic Variables

138 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

SNMP Client Protocol

The following function blocks are used to send SNMP request messages. These are used to
retrieve the values of specific data objects in the remote device. Objects are specified by
their object identifier (OID) which is a dotted numeric string e.g. ‘1.3.6.1.4.1.3833.2.1.1.1’.

SNMP_GET_INT

Retrieves an integer object value from a remote device and stores

it in a DINT variable.

First create a DINT variable to receive the object value, then

specify a string containing the variable’s name, e.g. ‘MYVAL’, as
the OUT parameter.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) from which to read.
NAME STRING(255) The community name to use in the request message.
OBJ STRING(255) The object identifier in the remote device.
OUT STRING(128) Name of a global DINT variable in which to store the retrieved value.
STAT STRING(128) Name of a global DINT variable in which to store a status value: 0 if
success, non-zero if error is detected.

Note: In the ISaGRAF Ladder Diagram editor, all string constants are converted to upper
case. This means that if you specify ‘public’ as the community name then it will be
transmitted to the device as ‘PUBLIC’. A workaround to allow lower case to be specified is to
create a string variable and set its initial value to the required string. Then specify the string
variable name rather than a string constant as the function block parameter.

B0780AF, Rev M 139

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

SNMP_GET_UINT

Retrieves an unsigned integer object value from a remote device

and stores it in a DINT variable.

Parameters are as for SNMP_GET_INT.

SNMP_GET_STRING

Retrieves a string object value from a remote device and stores it

in a STRING variable.

Parameters are as for SNMP_GET_INT (except that OUT should

be the name of a STRING variable).

140 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

SNMP_GET_OBJID

Retrieves an OID object value from a remote device and stores it

in a STRING variable.

Parameters are as for SNMP_GET_INT (except that OUT should

be the name of a STRING variable).

SNMP_GET_BULK

Retrieves a range of SNMP object values from a remote device

and stores them in variables with names based on the target
address and the object identifier (OID).

Individual ISaGRAF variables must be created to store the

returned values. These must follow the naming convention
described below, and the variable type must match the object
being retrieved.

For example, if ADDR=500 and the returned OID is

1.3.6.1.4.1.2566.1.2.168, then the ISaGRAF variable
SNMP500_1_3_6_1_4_1_2566_1_2_168 must be created to
store the returned value.

If the required variable does not exist for a particular object then
the object value will be discarded.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) from which to read.
NAME STRING(255) The community name to use in the request message.
OBJ STRING(255) The starting object identifier value, e.g. ‘1.3’, or ‘1.3.6.1.4.1.2566’. The
device will then return values starting from the next available object
identifier.
NUM UINT Maximum number of objects to read from the destination device. The
device may return fewer values.
STAT STRING(128) Name of a global DINT variable in which to store a status value: 0 if
success, non-zero if error is detected.

B0780AF, Rev M 141

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

SNMP_SET_INT

Writes an integer value to a remote device.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) to which to write.
NAME STRING(255) The community name to use in the request message. (See note under
SNMP_GET_INT)
OBJ STRING(255) The object identifier in the remote device.
IN DINT Value to write
STAT STRING(128) Name of a global DINT variable in which to store a status value: 0 if
success, non-zero if error is detected.

SNMP_SET_UINT

Writes an unsigned integer value to a remote device.

Parameters are as for SNMP_SET_INT (except that the IN

parameter is now UDINT).

142 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

SNMP_SET_STRING

Writes a string value to a remote device.

Parameters are as for SNMP_SET_INT (except that the IN

parameter is now STRING).

SNMP_SET_OBJID

Writes an OID value to a remote device.

Parameters are as for SNMP_SET_INT (except that the IN

parameter is now STRING).

B0780AF, Rev M 143

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

SNMP_SET_VALUE

Writes a value of any type to a remote device.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) to which to write.
NAME STRING(255) The community name to use in the request message. (See note under
SNMP_GET_INT)
OBJ STRING(255) The object identifier in the remote device.
TYPE DINT The ASN.1 type code for the object, e.g. 2 for integer, 66 for gauge
type. See ISaGRAF Constants for a list of defined words that may be
used to specify the object type.
INT DINT For integer types (Boolean, Integer, Counter, Gauge, Time Ticks and
Unsigned Integer), the value to write is specified here.
STR STRING(255) For OID objects, the value to write is specified as a dotted numeric
string, e.g. ‘1.3.6.1.123’. For all other non-integer types, the data in the
string will be written directly to the SNMP object.
STAT STRING(128) Name of a global DINT variable in which to store a status value: 0 if
success, non-zero if error is detected.

144 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

SNMP Trap Protocol

The following function blocks are used to send or receive SNMP Trap messages
(asynchronous notifications).

SNMP_GET_TRAP

When a trap message is received, details associated with the

message are stored in a queue. This function block returns details
about the oldest trap message in the queue (if any).

Parameter Type Description

 ERR INT Status code. 0=message details successfully returned. Non-zero
indicates that there is no trap message in the queue, or other error
condition is detected.
 COM STRING(128) The community string specified in the trap message. Note: there is no
validation of the received community string.
 IP STRING(16) The IP address of the agent that sent the trap message.
 OID STRING(255) The object identifier associated with the trap message.
 GTRP UINT The generic trap value of the trap message. The permissible values for
this parameter are defined in RFC 1157: A Simple Network
Management Protocol (SNMP).
 STRP UINT The specific trap value of the trap message. This value is device
specific.
 TIME UDINT Message timestamp (seconds since 1-Jan-1970)

If no trap messages have been received then an empty string is returned for COM, IP and
OID, and 0 is returned for GTRP, STRP and TIME.

B0780AF, Rev M 145

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

SNMP_SEND_TRAP

Sends a trap message containing the value of a particular SNMP

object to a remote device.

When generating this message, the IP address of the default

Ethernet port of the CP-3 processor is used for the agent address
and the current time is used for the time stamp parameter of the
trap message.

Parameter Type Description

ADDR DINT Address of the RTU (1-65520) to which to send trap message.
COM STRING(128) The community name to use in the trap message.
GTRP UINT The generic trap value to use in the trap message. The permissible
values for this parameter are defined in RFC 1157: A Simple Network
Management Protocol (SNMP).
STRP UINT The specific trap value to use in the trap message.
OID STRING(255) The object identifier to use in the trap message.
VAL DINT Value of the object

146 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

User Defined Protocol

The following function blocks are used to send and receive arbitrary communications
messages. These can be used to implement simple protocols.

USER_TX

Sends up to 255 bytes to a remote device.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) to which to send the data.
DATA STRING(255) Data bytes to send

USER_RX

Reads up to 255 bytes from an internal buffer containing data

received from a remote device.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) from which to read data.
CNT UINT Maximum number of bytes to read (1-255)
 DATA STRING(255) Received data bytes. If no data have been received this will be an
empty string.

B0780AF, Rev M 147

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

USER_RX_BYTES

Returns the number of bytes that have been received from the
remote device, but not yet read (using USER_RX).

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) to check for received data.
 CNT UINT Number of bytes available to read.

General Communications
These function blocks return information about the status of the various communications
links managed by the RTU.

FOX_GET_COMM_STATS

Returns communications statistics for the link between the local

RTU and a particular remote RTU (or all RTUs).

See Interpreting communications statistics for more details on the

meanings of the various statistics.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) for which to return communications
statistics. Set to 0 to return statistics for all remote RTUs.
 ERR BOOL TRUE if a detected error occurred, or if no communications with the
selected RTU have been attempted.
 TXS UDINT Number of messages successfully transmitted to the selected RTU (or
all RTUs if ADDR=0).
 TXE UDINT Number of messages that were not able to be transmitted to the
selected RTU (or all RTUs if ADDR=0).
 RXS UDINT Number of messages successfully received from the selected RTU (or
all RTUs if ADDR=0).
 RXE UDINT Number of messages for which a valid response was not received from
the selected RTU (or all RTUs if ADDR=0)

Interpreting Communications Statistics

The meaning of the various statistics varies somewhat depending on the protocol and
whether the RTU is operating as a slave or a master.

148 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

When the RTU is a slave:

• RXS is the number of valid messages received.
• RXE is not used. Invalid messages and messages not addressed to the RTU are
ignored.
• TXS is the number of messages sent. For Modbus, this includes exception
responses (e.g. where the requested data are not available).
• TXE is the number of reply messages that could not be sent, or DNP3 unsolicited
messages where the RTU cannot connect to master.

When the RTU is a master:

• TXS is the number of messages sent.
• TXE is the number of times where it was not possible to connect to the slave
(Ethernet only). It also includes cases where there is no route defined for the slave
address (except Modbus protocol).
• RXS is the number of valid messages received.
• RXE is the number of times an exception/detected error response was received, or
where no response was received within the timeout period.

Furthermore:
• If a retry count is set then each attempt counts as a message.
• For DNP3, the message counts are really message fragment counts.

FOX_RESET_COMM_STATS

Resets communications statistics for the link between the local

RTU and a particular remote RTU (or all RTUs).

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) for which to reset communications
statistics. Set to 0 to reset statistics for all remote RTUs.
 ERR BOOL TRUE if a detected error occurred, or if no communications to the
selected RTU have been attempted.

B0780AF, Rev M 149

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_GET_PORT_STATS

Returns communications statistics for a physical RTU port.

See Interpreting communications statistics for more details on the

meanings of the various statistics.

Parameter Type Description

PORT STRING(8) Port identifier. This is a string of the form ‘s:p’, where s is the slot
number (1-64, or 0 for the active CP-3) and p is the port number (1, 2,
3, 2.1, 2.2, 3.1 or 3.2).
 ERR BOOL TRUE if a detected error occurred, or if no communications on the
selected port have been attempted.
 TXS UDINT Number of messages successfully transmitted on the selected port.
 TXE UDINT Number of messages that were not able to be transmitted on the
selected port.
 RXS UDINT Number of messages successfully received on the selected port.
 RXE UDINT Number of messages sent on the selected port for which a valid
response was not received.

For example, to retrieve statistics for the built-in Ethernet port on the CP-3 you would set
PORT=’0:1’. To specify port 3.2 (bottom port on a COM I2 card in option card slot 3) on an
MC-31 in slot 22, use PORT=’22:3.2’.

FOX_RESET_PORT_STATS

Resets communications statistics for the specified port

Parameter Type Description

ADDR STRING(8) Port identifier. This is a string of the form ‘s:p’, where s is the slot
number (1-64, or 0 for the active CP-3) and p is the port number (1, 2,
3, 2.1, 2.2, 3.1 or 3.2).
 ERR BOOL TRUE if a detected error occurred, or if no communications on the
selected port have been attempted.

150 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_GET_PENDING

Indicates whether a message is pending (awaiting reply), either

for a particular remote RTU, or a particular protocol, or globally.

This is typically used to help prevent further messages being

initiated until the previous one has completed or timed out.

Parameter Type Description

ADDR UINT Address of the RTU (1-65520) to check for pending messages. Set to 0
to check for pending messages for all remote RTUs.
PROT USINT Protocol to check for pending messages. Set to 0 to check for pending
messages for all protocols. See ISaGRAF Constants for a list of defined
words that may be used to specify the protocol..
 ERR BOOL TRUE if a detected error occurred.
 PEND BOOL TRUE if there is an outstanding message for which no reply has been
received, for the specified remote RTU address and/or protocol.

B0780AF, Rev M 151

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_GET_ROUTE

Returns information about a communications route. A route

specifies the port (and possible intermediate RTU) to use to send
a message to a particular RTU address using a particular
protocol.

Routes may be created in FoxRTU Station, or may be added

dynamically (e.g. when a slave RTU is polled by a master), or
may be modified in logic (using FOX_SET_ROUTE).

Parameter Type Description

DEV UINT Address of the RTU (1-65520) for which route information is to be
returned.
PROT USINT Protocol for which route information is to be returned. See ISaGRAF
Constants for a list of defined words that may be used to specify the
protocol..
 ERR BOOL TRUE if a detected error occurred.
 TYPE DINT Returns type of route: 0=direct (messages can be sent directly to the
destination RTU), 1=indirect (messages must be sent via an
intermediate RTU).
 PORT STRING(8) For direct routes, returns the port to use to communicate with the
destination RTU. This is a string of the form ‘s:p’, where s is the slot
number (1-64, or 0 for the active CP-3) and p is the port number (1, 2, 3,
2.1, 2.2, 3.1 or 3.2).
 ADDR STRING(16) For direct routes using an Ethernet port, returns IP address of
destination RTU, e.g. ‘192.168.0.42’
 VIA UINT For indirect routes, returns the address (1-65520) of the intermediate
RTU through which messages are to be sent.

152 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_SET_ROUTE

Allows an existing communications route to be modified.

This can be used to change the port that is used to communicate

with a particular RTU – for example, if a fault is detected.

Parameter Type Description

DEV UINT Address of the RTU (1-65520) for which route information is to be
modified.
PROT USINT Protocol for which route information is to be modified. See ISaGRAF
Constants for a list of defined words that may be used to specify the
protocol..
TYPE DINT Sets type of route: 0=direct (messages can be sent directly to the
destination RTU), 1=indirect (messages must be sent via an
intermediate RTU).
The defined words ROUTE_DIRECT and ROUTE_INDIRECT may also
be used.
PORT STRING(8) For direct routes, sets the port to use to communicate with the
destination RTU. This is a string of the form ‘s:p’, where s is the slot
number (1-64, or 0 for the active CP-3) and p is the port number (1, 2, 3,
2.1, 2.2, 3.1 or 3.2).
ADDR STRING(16) For direct routes using an Ethernet port, sets IP address of destination
RTU, e.g. ‘192.168.0.42’. For routes using a serial port this should be set
to an empty string ‘’, or ‘0.0.0.0’.
VIA UINT For indirect routes, sets the address (1-65520) of the intermediate RTU
through which messages are to be sent.
 ERR BOOL TRUE if a detected error occurred.

B0780AF, Rev M 153

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Event Logging
The following function blocks are used to create and manage event logs on the local RTU, or
a remote RTU.

FOX_EVENT_LOG

Logs the current value of any global ISaGRAF variable, along with
timestamp and other information.

Timestamps are logged accurate to one second, except for

variables mapped to DI-10 or IOD-MX2/3/4 SOE inputs, which
can be logged accurate to within a few milliseconds.

Class 1/2/3 DNP3 variables will be automatically logged whenever

their value changes. However, this function block can be used to
create additional log entries by logging variables even when they
haven’t changed (e.g. periodically).

Parameter Type Description

REG STRING(16) Name of a global variable to log, e.g. ‘DNPAI3’ or ‘SL05IO3DI1’ or
‘MYVAR’. Note that for IOPOINT variables (DNP3 or I/O module points)
it is not necessary to include the ‘.value’ suffix.
UTYP USINT For DNP3 variables, this is the event variation (1-7).
For other variables, this is a user type code (0-31) which can optionally
be used to filter events when uploading.
PRI USINT For DNP3 variables, this is the event class (1-3).
For other variables, this is a user priority code (0-7) which can optionally
be used to filter events when uploading.
DTYP USINT Not used (set to 0)
 ERR DINT 0 if OK, non-zero if a detected error occurred.

FOX_CLEAR_EVENT_LOGS

Clears all event logs on the local or a remote RTU.

Parameter Type Description

RTU UINT Address of remote RTU (1-65520) on which to clear event logs. Set to 0
to clear event logs on the local RTU.
 ERR DINT 0 if OK, non-zero if a detected error occurred.

154 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_GET_EVENT_LOG_COUNT

Returns the number of event logs currently stored on the local or

a remote RTU.

First create a DINT variable to receive the count value, then

specify a string containing the variable’s name, e.g. ‘MYCOUNT’,
as the DES parameter.

Parameter Type Description

RTU UINT Address of remote RTU (1-65520) from which to obtain event log count.
Set to 0 to return the number of event logs on the local RTU.
DES STRING(16) Name of a global DINT variable in which to store the event log count.
 ERR DINT 0 if OK, non-zero if a detected error occurred.

B0780AF, Rev M 155

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

RTU System Data

FOX_GET_ADDRESS

Returns the address of the local RTU.

Parameter Type Description

 RTU UINT Address of local RTU (1-65520)

FOX_GET_FIRMWARE

Returns the local RTU firmware version.

Parameter Type Description

 NBR UDINT Firmware version number

FOX_GET_RTU_TYPE

Identifies the type of processor module

Parameter Type Description

 TYPE USINT Processor type: 1=CP-3

156 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_GET_SYSTEMID

Returns the configured system ID byte (FoxRTU protocol

message prefix) for the local RTU.

Parameter Type Description

 ID INT System ID byte (normally 174)

FOX_GET_PROCESSOR

Identifies the backplane slot containing the active processor

module.

Parameter Type Description

 SLOT UINT Active processor slot number (1-64)

FOX_GET_MODULE_TYPE

Identifies the module type installed in the specified backplane slot.

Parameter Type Description

SLOT UINT Slot number (1-64)
 TYPE UINT Detected module type (1-255):
6=DI-5, 7=DO-1, 8=DO-2/DO-6, 9=DI-10, 12=IO-3, 15=AO-3, 19=AI-10,
31=PS-1x/PS-2x, 48=MC-3, 50=IO-5, 60=CP-3, 88=MC-31, 255=No
module installed

B0780AF, Rev M 157

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_GET_MODULE_OK

Compares the module/card detected in a backplane slot with the

module configured in the RTU’s configuration.

Parameter Type Description

SLOT UINT Slot number (1-64)
 ERR BOOL Set TRUE if the specified slot number is invalid.
 STAT BOOL Module status. Set TRUE if a module is present in the specified slot, and
its type matches that specified in the RTU’s configuration.

FOX_RESET_MODULE

Reset/reconfigure the module in the specified backplane slot.

For MC-3/MC-31 modules, a full reboot will be performed, after

which the module will be re-detected and its configuration
reloaded.

For I/O modules, the CP-3 internally marks the module as absent,
after which the module will be re-detected and its configuration
reloaded.

Parameter Type Description

SLOT USINT Slot number (1-64)
 ERR BOOL Set TRUE if the specified slot number is invalid.

REBOOT

Reboots the local processor module.

Note: This function block has no input or output parameters, so it is not directly usable in
Function Block Diagram (FBD) programs. You can, however, create a small Ladder Diagram
function that calls REBOOT, then call that function from a FBD program.

158 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_GET_RTC

Returns the current RTU date/time, expressed as a single integer.

Parameter Type Description

 SEC DINT Current RTU time: seconds since 0:00 1-Jan-1970

FOX_SET_RTC

Sets the current RTU date/time, expressed as a single integer.

Parameter Type Description

SEC DINT New RTU time: seconds since 0:00 1-Jan-1970

FOX_GET_TIME

Returns the current RTU date/time, expressed as separate time

components

B0780AF, Rev M 159

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Parameter Type Description

 SEC DINT Seconds (0-59)
 MIN DINT Minutes (0-59)
 HOUR DINT Hours (0-23)
 DAY DINT Day of month (1-31)
 MON DINT Month (1-12)
 YEAR DINT Years since 1900 (0-170)
 WDAY DINT Day of week (1=Sun, 7=Sat)

FOX_SET_TIME

Sets the current RTU date/time, expressed as separate time

components

Parameter Type Description

SEC DINT Seconds (0-59)
MIN DINT Minutes (0-59)
HOUR DINT Hours (0-23)
DAY DINT Day of month (1-31)
MON DINT Month (1-12)
YEAR DINT Years since 1900 (0-170)
WDAY DINT Ignored (may be set to any value 1-7)
 ERR DINT Returns non-zero if parameter error is detected.

160 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

GET_BP12V

Measures the voltage on the backplane 12V rail. Requires CP-3

hardware version 2 or later.

This is useful when using a BP-x powered backplane. For a

passive backplane the SLssPS11AI1 variable can also be used to
read the equivalent data from the power supply module (see PS-
1x or PS-2x).

Parameter Type Description

 V12 REAL 12V rail voltage in volts

GET_LOWBATT

Returns TRUE if the CP-3’s internal Lithium battery low voltage is

detected while the system was last powered off, which may have
resulted in data loss (e.g. retained variables, data and time).

Once the battery has been replaced, this flag will be cleared after
the next power cycle.

Parameter Type Description

 LOW BOOL TRUE if battery was low during last power off.

SET_BPFIELD

Enable or disable I/O module field power control (PCON signal).

By default, field power is ON.

Requires CP-3 hardware version 2 or later. For hardware version

1, the field power is always ON.

Parameter Type Description

ON BOOL Set TRUE to turn field power on, FALSE to turn it off.

B0780AF, Rev M 161

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

SET_BPAUX

Enable or disable AUX power output on a BP-x powered

backplane (CSR signal). By default, AUX power is ON.

Requires CP-3 hardware version 2 or later. For hardware version

1, the AUX power is always ON.

Parameter Type Description

ON BOOL Set TRUE to turn AUX power on, FALSE to turn it off.

162 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Math and Logic

The following function blocks provide a few additional capabilities beyond those provided by
the standard ISaGRAF library.

INCREMENT

Adds one to an integer variable.

Parameter Type Description

INP DINT Input variable
 OUT DINT Output variable. May be the same as the input variable.

DECREMENT

Subtracts one from an integer variable.

Parameter Type Description

INP DINT Input variable
 OUT DINT Output variable. May be the same as the input variable.

ChangeDetect

Detects change in an integer variable.

Parameter Type Description

INP DINT Input variable
 OUT DINT Set to 1 if the input value has changed since the last time the function
block was executed, 0 otherwise

B0780AF, Rev M 163

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

MulDiv

Scales a floating point variable by multiplying it by an integer

value then dividing by another value. The result is a floating point
value.

Parameter Type Description

INP REAL Input variable
MUL DINT Multiplier
DIV DINT Divisor
 OUT REAL Output variable. May be the same as the input variable.

MULDIV_INT

Scales an integer variable by multiplying it by a value then

dividing by another value. The result is an integer.

Parameter Type Description

INP DINT Input variable
MUL DINT Multiplier
DIV DINT Divisor
 OUT DINT Output variable. May be the same as the input variable.

BCD_TO_BINARY

Converts a variable from Binary Coded Decimal to a normal

integer value.

BCD uses each group of 4 bits to represent a decimal digit.

164 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Parameter Type Description

BCD DINT Input variable (16#000000-16#999999)
 BIN DINT Output variable (0-999999). May be the same as the input variable.

BINARY_TO_BCD

Converts an integer variable to Binary Coded Decimal.

BCD uses each group of 4 bits to represent a decimal digit.

Parameter Type Description

BIN DINT Input variable (0-999999)
 BCD DINT Output variable (16#000000-16#999999). May be the same as the input
variable.

FPACK

Converts two 16-bit integer values to a floating point value.

Typically used when reading floating point values using the

Modbus protocol, which splits floating point values across two 16-
bit registers.

Parameter Type Description

W1 UINT First integer variable (bits 15:0)
W2 UINT Second integer variable (bits 31:16)
 FLT REAL Floating point output variable

FUNPACK

Converts a floating point value into two 16-bit integers.

Typically used when writing floating point values using the

Modbus protocol, which splits floating point values across two 16-
bit registers.

B0780AF, Rev M 165

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Parameter Type Description

FLT REAL Floating point variable
 W1 UINT First integer output variable (bits 15:0)
 W2 UINT Second integer output variable (bits 31:16)

F64PACK

Converts four 16-bit integer values to a long floating point value.

Typically used when reassembling a long floating point value read

from Modbus. (The Modbus protocol splits 64-bit values across
four 16-bit registers).

Parameter Type Description

W1 UINT First integer variable (bits 15:0)
W2 UINT Second integer variable (bits 31:16)
W3 UINT Third integer variable (bits 47:32)
W4 UINT Fourth integer variable (bits 63:48)
 F64 LREAL 64-bit floating point output variable

F64UNPACK

Converts a floating point value into four 16-bit integers.

Typically used when transmitting a long integer value using

Modbus. (The Modbus protocol splits 64-bit values across four 16-
bit registers).

166 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Parameter Type Description

F64 LREAL 64-bit floating point variable
 W1 UINT First integer output variable (bits 15:0)
 W2 UINT Second integer output variable (bits 31:16)
 W3 UINT Third integer output variable (bits 47:32)
 W4 UINT Fourth integer output variable (bits 63:48)

U32PACK

Converts two 16-bit integer values into a 32-bit integer.

Typically used when reassembling a long integer value read from

Modbus. (The Modbus protocol splits 32-bit values across two 16-
bit registers).

Parameter Type Description

W1 UINT First integer variable (bits 15:0)
W2 UINT Second integer variable (bits 31:16)
 U32 UDINT 32-bit integer output variable

U32UNPACK

Converts a 32-bit integer value into two 16-bit integers.

Typically used when transmitting a long integer value using

Modbus. (The Modbus protocol splits 32-bit values across two 16-
bit registers).

Parameter Type Description

U32 UDINT 32-bit integer variable
 W1 UINT First integer output variable (bits 15:0)
 W2 UINT Second integer output variable (bits 31:16)

B0780AF, Rev M 167

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

U64PACK

Converts four 16-bit integer values into a 64-bit integer.

Typically used when reassembling a long integer value read from

Modbus. (The Modbus protocol splits 64-bit values across four 16-
bit registers).

Parameter Type Description

W1 UINT First integer variable (bits 15:0)
W2 UINT Second integer variable (bits 31:16)
W3 UINT Third integer variable (bits 47:32)
W4 UINT Fourth integer variable (bits 63:48)
 U64 ULINT 64-bit integer output variable

U64UNPACK

Converts a 64-bit integer value into four 16-bit integers.

Typically used when transmitting a long integer value using

Modbus. (The Modbus protocol splits 64-bit values across four 16-
bit registers).

Parameter Type Description

U64 ULINT 64-bit integer variable
 W1 UINT First integer output variable (bits 15:0)
 W2 UINT Second integer output variable (bits 31:16)
 W3 UINT Third integer output variable (bits 47:32)
 W4 UINT Fourth integer output variable (bits 63:48)

168 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

NBIT

Set/clear a single bit in an integer variable.

Parameter Type Description

IN UINT Input variable
DATA BOOL TRUE=set bit, FALSE=clear bit
BIT USINT Bit number to set/clear (1-16)
 OUT UINT Output variable. May be the same as the input variable.

NCBT

Tests whether a single bit in an integer variable is closed (set).

Parameter Type Description

IN UINT Input variable
BIT USINT Bit number to test (1-16)
 OUT BOOL TRUE if bit is set (logic 1).

NOBT

Tests whether a single bit in an integer variable is open (clear).

B0780AF, Rev M 169

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Parameter Type Description

IN UINT Input variable
BIT USINT Bit number to test (1-16)
 OUT BOOL TRUE if bit is clear (logic 0).

170 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

PID Controller
The proportional-integral-derivative (PID) function block calculates the difference (or
detected error value) between a measured process value and a desired setpoint and
attempts to minimize this difference by adjusting the output variable. The PID calculation
takes into account:
• A proportional component which calculates a response proportional to the current
detected error value
• An integral component which calculates a response based upon accumulated error
detected
• A derivative component which calculates a response based upon the rate of change
of the detected error value.

FOX_PID

Given a measured process value and a desired set-point,

calculates the appropriate output value based on a Proportional-
Integral-Derivative control formula.

The following formula is used by the PID function block:

Evaluated from 0 to t, where:

Kp = Proportional constant

Ki = Integral constant

Kd = Derivative constant

t = Sample interval

en = Process error for current sample

en-1 = Process error for previous sample, etc.

B0780AF, Rev M 171

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Parameter Type Description

AUTO BOOL Automatic/manual mode.
If TRUE (automatic mode), the function block will calculate an output
value based on proportional, integral and derivative components of the
detected error value. If FALSE (manual mode), the function block output
value will simply track the manual set-point value (XMAN) without
calculation.
PV REAL Measured process value
SP REAL Desired set-point for the process value
XMAN REAL Manual output value. In manual mode, output will be set equal to this
value.
KP REAL PID proportional constant.
TI REAL PID integral time constant.
TD REAL PID derivative time constant.
TS UDINT Time interval (ms) between sampling the process variable.
This must be greater than the ISaGRAF cycle time.
XMIN REAL Minimum allowable output value.
XMAX REAL Maximum allowable output value.
 ERR BOOL Not used.
 XOUT REAL Output value.

172 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Gas Flow Calculations

These function blocks perform various standard American Gas Association (AGA) gas
calculations.

FOX_AGA3

Performs flow rate calculation according AGA Report No. 3 Orifice

metering of natural gas and is only valid for orifice meters
equipped with a flange tap. This function block implements the
flow equations, algorithms and methods illustrated in part 3 and
part 4 of the report: Method 1, Part 3, Method 2, Part 3 and
Analytical Method, Part 4.

AGA3 Function block input and output parameters representing

physical values are expressed in US units.

With reference to AGA 3 Report nomenclature, FLWS, FLWB and

QM correspond to Qv, Qb and qm respectively

Gas compressibility factors (ZFLW, ZSTD and ZBAS) and gas

densities (ROTP and ROB) must be obtained in advance using
another function block that computes Z factors and densities as a
function of flowing conditions and actual gas composition
according to AGA Report No. 8 (see AGA8 below).

B0780AF, Rev M 173

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

Parameter Type Description

ODIA REAL Orifice diameter at 68°F (inches)
TDIA REAL Meter tube internal diameter at 68°F (inches).
OALF REAL Linear coefficient of thermal expansion for orifice plate (inches per inch-
°F)
TALF REAL Linear coefficient of thermal expansion for meter tube (inches per inch-
°F)
SPEC REAL Real gas relative density or specific gravity.
DP REAL Average differential pressure (inches of water at 60°F)
PFLW REAL Absolute static pressure at flowing conditions (psia)
TFLW REAL Temperature at flowing conditions (°F)
PBAS REAL Contract base pressure (psia).
TBAS REAL Contract base temperature (°F)
KISO REAL Isentropic exponent.
VISC REAL Dynamic viscosity (cP, centipoise).
METH USINT Selects the algorithm/method to execute (1-3):
1=method 1, part 3; 2=method 2, part 3; 3=method in part 4
UPST BOOL TRUE means that PFLW is taken upstream (referring to the meter) and
FALSE means PFLW is downstream.
ZFLW REAL Gas compressibility factor at flowing conditions.
ZSTD REAL Gas compressibility factor at standard conditions (14.73 psia and 60°F)
ZBAS REAL Gas compressibility factor at contract base conditions.
ROTP REAL Gas density at flowing conditions.
ROB REAL Gas density at base conditions.
 FLWS REAL Calculated volume flow rate (in cubic feet/hour) computed with reference
to the standard conditions of Ps=14.73 psia and Ts=60°F, as stated in
Part 3.
 FLWB REAL Calculated volume flow rate (in cubic feet/hour) computed at user base
conditions Pb and Tb (called also contract conditions) specified by two
input parameters to the block. Flow correction equation is:
FLWB = FLWS * (Ps / Pb) * (Tb / Ts) * (Zb / Zs)
 QM REAL Mass flow rate (in lbm/hour) at standard conditions, which could be
useful for further energy calculations (see AGA5 below)
 ERR BOOL Set TRUE when input parameters are invalid or their value led to an
inconsistent algorithm result

174 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

FOX_AGA5

AGA Report No. 5 identifies gas energy metering based on both

volume and mass flow. These flows must be calculated in
advance, according to other AGA reports, for instance AGA 3 for
orifice meter is used or AGA 7 for turbine meters. AGA5 Function
Block implements both volume approach and mass approach
algorithms, as described in AGA Report No. 5

Parameter Type Description

FLOW REAL Volume or Mass flow value at standard conditions (14.73 psia and 60°F)
SPEC REAL Relative density of gas (specific gravity).
CO2 REAL Weight % or volume % of Carbon Dioxide.
N2 REAL Weight % or volume % of Nitrogen.
O2 REAL Weight % or volume % of Oxygen.
He REAL Weight % or volume % of Helium.
CO REAL Weight % or volume % of Carbon Monoxide.
H2S REAL Weight % or volume % of Hydrogen Sulphide.
H2O REAL Weight % or volume % of Water vapor.
H2 REAL Weight % or volume % of Hydrogen.

B0780AF, Rev M 175

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

VLMS BOOL FALSE means FLOW value is in volume. TRUE means FLOW value is
in mass.
WGVL BOOL FALSE means compound percentages are in weight %. TRUE means
compound percentages are in volume %
WMUT USINT FLOW units:
If VLMS = FALSE: 1=cubic feet, 2=cubic meters, 3=liters, 4=MCF.
If VLMS = TRUE: 1=lb (gas pounds), 2=ounces, 3=kilograms, 4=grams.
ENUT USINT ENGY units:
1=BTU, 2=Therm, 3=dekaTherm, 4=Kilowatt Hour, 5=Megajoule
 ENGY REAL Energy in units specified by ENUT
 ERR BOOL Set TRUE when input parameters are invalid or their value led to an
inconsistent algorithm result.

FOX_AGA7

AGA Report No. 7 describes volume flow rate computation using

turbine meters. These meters give a series of pulses
proportional to the gas volume flow. Counting these pulses at
specified time intervals and knowing the meter factor (the
number of pulses per volume unit), it’s easy to calculate the flow
rate in volume per time units at flowing conditions. This value
must then be corrected to the specified base (contract)
conditions. The AGA7 Function Block performs these
computations and gives both flow rates at base and flowing
conditions. The AGA7 function block can operate in two modes:
• Fixed time interval: time interval used by function
block to count pulses is fixed by the user
• Pulses change detection: function block detects
changes in pulse counter and uses time interval
between two consecutive changes to perform pulse
integration. This method is useful for “slow” turbine
meters, when use of “fixed time interval” mode could
force the function block to perform calculations at very
long time intervals.

176 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Parameter Type Description

CNTR UDINT Count value of pulses coming from turbine meter
WRAP UDINT Counter wrap value, i.e. maximum value of CNTR input. Typical values
are 16#7FFF for a 15-bit counter, 16#FFFF for 16-bit, 16#FFFFFFFF for
32-bit
KFCT UDINT Meter K factor as stated in AGA7: the number of pulses per volume unit.
TSAM TIME Selects pulse mode and time value:
If TSAM < 50: selects pulse change detection mode and this value is a
multiplier factor of the last time interval used for calculation: if no pulses
are counted for a period greater than (TSAM x last used time interval)
then flow rate values are set to 0.
If TSAM > 50: selects fixed time interval mode and this value is the time
interval value (in milliseconds).
The value of TSAM cannot exceed the time interval needed by the
counter to perform a full counting cycle when operating at maximum
frequency (that is, at maximum flow rate).
PFLW REAL Flowing absolute static pressure (psia)
TFLW REAL Flowing temperature (°F)
PBAS REAL Contract base pressure (psia)
TBAS REAL Contract base temperature (°F)
ZBZF REAL Ratio Zb/Zf between compressibility factor Zb at base conditions and
compressibility factor Zf at flowing conditions.
 QB REAL Calculated volume flow rate (volume units/hr) at contract conditions.
 QF REAL Calculated volume flow rate (volume units/hr) at flowing conditions.
 ERR BOOL Set TRUE when input parameters are invalid or their value led to an
inconsistent algorithm result

B0780AF, Rev M 177

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_AGA8_G

Performs computations described in the Gross Characterization

Method of AGA Report No. 8. These computations are carried on
according to two methods that depend on the parameters used to
describe gas composition. One input to the block selects the
method to use.

The Gross Characterization Method implies an aggregate or gross

knowledge of natural gas composition, given by heating value
and/or relative density, and diluent content information to compute
the compressibility factor.

Parameter Type Description

PFLW REAL Flowing absolute static pressure (psia)
TFLW REAL Flowing temperature (°F)
METH USINT Selects method to apply (1 or 2)
HV REAL Volumetric gross heating value (in BTU/cubic feet), only for method 1
TH REAL Reference temperature for heating value (°F), only for method 1
GR REAL Relative density of gas (specific gravity)
TGR REAL Reference temperature for specific gravity (°F)
PGR REAL Reference pressure for specific gravity (psia)
TD REAL Reference temperature for molar density (°F), only for method 1
PD REAL Reference pressure for molar density (psia), only for method 1

178 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

N2 REAL Nitrogen mole %

CO2 REAL Carbon Dioxide mole %, only for method 2
PBAS REAL Contract base pressure (psia)
TBAS REAL Contract base temperature (°F). Typically, reference conditions for
heating value, relative density (specific gravity) and molar density are
14.73 psia and 60°F.
 ZFLW REAL Calculated compressibility factor at flowing conditions
 ZSTD REAL Calculated compressibility factor at standard conditions (14.73 psia and
60°F)
 ZBAS REAL Calculated compressibility factor at contract base conditions.
 ROTP REAL Calculated density (lbm/ft3) at flowing conditions (TFLW, PFLW)
 ROB REAL Calculated density (lbm/ft3) at base conditions (TBAS, PBAS)
 FPV REAL Calculated supercompressibility factor
 ERR USINT Error status: 0=all parameters within range, non zero=one or more
parameters out of range.

B0780AF, Rev M 179

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_AGA8_D

Performs computations described in the Detail Characterization

Method of AGA Report No. 8. The Detail Characterization Method
implies a detailed knowledge of natural gas composition (up to 21
components) to compute the compressibility factor.

180 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Parameter Type Description

PFLW REAL Absolute static pressure at flowing conditions
TFLW REAL Temperature at flowing conditions
METH REAL Molar percentage of methane
N2 REAL Molar percentage of nitrogen
CO2 REAL Molar percentage of carbon dioxide
ETHN REAL Molar percentage of ethane
PRPN REAL Molar percentage of propane
H2O REAL Molar percentage of water
H2S REAL Molar percentage of hydrogen sulphide
H2 REAL Molar percentage of hydrogen
CO REAL Molar percentage of carbon monoxide
O2 REAL Molar percentage of oxygen
IBUT REAL Molar percentage of i-butane
NBUT REAL Molar percentage of n-butane
IPET REAL Molar percentage of i-pentane
NPET REAL Molar percentage of n-pentane
NHEX REAL Molar percentage of n-hexane
NHEP REAL Molar percentage of n-heptane
NOCT REAL Molar percentage of n-octane
NNON REAL Molar percentage of n-nonane
NDEC REAL Molar percentage of n-decane
HE REAL Molar percentage of helium
AR REAL Molar percentage of argon
PBAS REAL Contract base pressure (psia)
TBAS REAL Contract base temperature (°F)
 ZFLW REAL Calculated compressibility factor at flowing conditions
 ZSTD REAL Calculated compressibility factor at standard conditions (14.73 psia and
60°F)
 ZBAS REAL Calculated compressibility factor at contract base conditions
 ROTP REAL Calculated density (lbm/ft3) at flowing conditions (TFLW, PFLW)
 ROB REAL Calculated density (lbm/ft3) at base conditions (TBAS, PBAS)
 FPV REAL Calculated supercompressibility factor
 ERR DINT Error status: 0=all parameters within range, non zero=one or more
parameters out of range.

B0780AF, Rev M 181

FoxRTU Station User's Guide Chapter 9: ISaGRAF Function Blocks

FOX_NX19

AGA Report NX-19 describes the determination of super

compressibility factor (FPV) for natural gas.

The NX19 Function Block performs FPV calculation according to

the analytical method, giving also the Zb/Zf ratio, which is most
used in flow rate correction formulas.

Parameter Type Description

PFLW REAL Flowing static pressure from instrument (psig)
TFLW REAL Flowing temperature (°F)
GR REAL Real gas relative density (specific gravity)
CO2 REAL Molar percentage of carbon dioxide
N2 REAL Molar percentage of nitrogen
PBAS REAL Contract base pressure (psia)
TBAS REAL Contract base temperature (°F)
NADJ BOOL If TRUE, PFLW and TFLW are not internally adjusted and are directly
used to compute FPV. This is used only for algorithm testing purposes.
In normal operation, NADJ must be set to FALSE.
 ZBZF REAL Calculated ratio Zb/Zf, between compressibility factor Zb at base
conditions and compressibility factor Zf at flowing conditions.
 FPV REAL Calculated supercompressibility factor at standard conditions (14.73
psia, 60°F).
 PADJ REAL Adjusted value of PFLW according NX-19
 TADJ REAL Adjusted value of TFLW according NX-19

182 B0780AF, Rev M

Chapter 9: ISaGRAF Function Blocks FoxRTU Station User's Guide

Obsolete Function Blocks

The following function blocks currently appear in the ISaGRAF selection list, but are obsolete
or not supported. These function blocks must not be used.

IMAGE
This function block is not supported.

TRIO
This function block is not supported.

FOX_CLEAR_PENDING
This function block is not supported.

DNPM_LINK_RESET
This function block is not supported.

CURRENT_ISA_DATE
This function block is not supported.

AS_AE
This function block is not supported.

FC_GET_STAT
This function block is not supported.

MATRIX
This function block is not supported.

B0780AF, Rev M 183

FoxRTU Station User's Guide Chapter 10: ISaGRAF Logic Examples

Chapter 10: ISaGRAF Logic Examples

A FoxRTU Station project containing all the Ladder Diagram logic examples below is
available from the Global Customer Support website.

Detecting Modules
The logic below uses the FOX_GET_MODULE_OK function block to confirm that the
modules detected in slots 1, 2 and 3 match the configuration loaded in the RTU.

Scaling
The logic below uses the MULDIV_INT function block to convert an analog input
(SL03IO3AI1.value) into engineering units. The input has a raw range of 0-32760. The input
is divided by 32760 and then multiplied by 10000 to convert it to a range of 0-10000. This
value can then be displayed as 0-1000.0 or 0-100.00 L/s in SCADA software. FlowLperSec
is a DINT variable.

184 B0780AF, Rev M

Chapter 10: ISaGRAF Logic Examples FoxRTU Station User's Guide

Hours ON
Every 3600 milliseconds (3.6 seconds or 1/1000th of an hour) the logic below checks if
SL03IO3DI1.value is ON and if it is, HrsRun (a DINT variable) is incremented. HrsRun then
contains the number of 0.001 hour intervals that the input is ON i.e. 0 to 999,999 = 0 to
999.999 Hrs.

Counting Pulses
I/O inputs are sampled once per ISaGRAF logic cycle (nominal rate 100ms). This means
that low speed pulses (up to 5 pulses per second) can be counted using logic.

The actual pulse rate that the RTU can count depends on how fast the logic and I/O are
processed. The nominal cycle time can be longer than 100ms if there is a large amount of
logic or communications to process.

To count higher pulse rates (up to 10 kHz), a DI-10 or DI-5 digital input module can be used.
These modules have dedicated hardware counters and do not rely on the logic cycle time to
count pulses.

The logic below shows how to count pulses using a positive (rising) edge trigger contact (“P’
indicator in the contact symbol). Every time there is a new pulse, PulsesToday (a DINT
variable) is incremented.

Flow Totalization
The following example shows how to accumulate a flow volume from a flow-rate analog input
(SL03IO3AI1.value). For this example, the flow-rate engineering units are 4-20mA=0-1000
L/s. Each second, the number of liters that have flowed (FlowLastSec [a DINT variable]) is
calculated by dividing the analog input by 32760 (the raw analog input range) and then
multiplying by 1000 (the high limit of the engineering units). This number of liters is then
added to the FlowToday total (a DINT variable).

B0780AF, Rev M 185

FoxRTU Station User's Guide Chapter 10: ISaGRAF Logic Examples

Daily Totals
Daily totals are created by rolling over current totals at midnight. The current totals are
copied to yesterday totals and then the current totals are reset.

In the example below, CurrentDAY and SavedDAY are DINT variables and Rollover is a
BOOL variable. The FOX_GET_TIME function block is used to check the current time. When
the value for CurrentDAY changes at midnight, SavedDAY is updated and Rollover is set
TRUE for one logic scan.

When Rollover is TRUE, the PulsesToday total is copied to PulsesYesterday and then zero
is copied to PulsesToday.

186 B0780AF, Rev M

Chapter 10: ISaGRAF Logic Examples FoxRTU Station User's Guide

Exception Reporting Digitals

An exception report can be generated when a single digital bit changes state or when any of
the bits in a variable change state.

Note that if the DNP3 protocol is used then no logic is required – simply map DNP variables
onto the required I/O points and enable unsolicited reporting. This section describes how to
achieve this using FoxRTU protocol.

Monitoring a Single Bit

In the example below, a single digital input variable from an IO-3 module
(SL03103DI1.value) is monitored for change. If the input changes, an exception report flag is
set (ExReport).

Monitoring Multiple Bits

In the example below, the four digital inputs from an IO-3 module (SL03IO3DI{1-4}.value)
are copied to FoxRTU register 1 (FOXR1). If this variable changes (i.e. if any bit changes),
then NewValue (DINT) will be set to 1, causing an exception report flag to be set.

B0780AF, Rev M 187

FoxRTU Station User's Guide Chapter 10: ISaGRAF Logic Examples

Sending the Exception Report

The logic below first uses FOX_GET_PENDING to determine whether there are any
outstanding FoxRTU protocol messages. If not, and an exception report needs to be sent,
then FOX_TX_DATA is used to transmit the list of registers specified by LocalRegisters to
RTU 7. The ExReport flag is then cleared.

In this case the LocalRegisters array need only contain one element, and that element
should be the value 1 (to indicate that register FOXR1 should be sent).

Exception Reporting Analog Variables

The example below shows how to trigger an exception report when an analog input
(SL03IO3AI1.value) changes by 5% (of the full analog range) from the last reported value.
This is done by using two DINT variables (AI1HiLimit, AI1LoLimit) and a constant. The
variables are used to store the last reported value plus the constant and the last reported
value minus the constant. When the analog value moves above or below these values, an
exception report is triggered and the thresholds are updated (as illustrated below).

The constant to use is calculated as percentage of the analog or register range. For analog
inputs which have a range of 0-32760 (32767 for an AI-10), a 1% change is represented in
the RTU by a change of about 328 (0.01 x 32760). Similarly, a 5% change is represented in
the RTU by a change of 1638 (0.05 x 32760).

188 B0780AF, Rev M

Chapter 10: ISaGRAF Logic Examples FoxRTU Station User's Guide

To send the new analog value (that was copied to FOXR2 in the logic above) to another
RTU, use the same method as for Sending The Exception Report above.

Event Logging
The RTU can keep a record of variables and their values over time. FoxRTU or DNP3
variables can be logged on change or periodically. The maximum number of event logs that
an RTU will keep is configured in the RTU Properties, General tab. By default, the RTU will
keep up to 10,000 event logs.

Logging FoxRTU Variables

The example below uses FOX_EVENT_LOG to create an event log whenever digital input 1
(SL03IO3DI1.value) changes state.

Logging DNP Variables

The example below creates periodic event logs (every 60 seconds) for DNP Analog Input
DNPAI0, with a priority of 2 (class 2 data), using event variation 1.

B0780AF, Rev M 189

FoxRTU Station User's Guide Chapter 10: ISaGRAF Logic Examples

Logic Examples – Polling

Polling is usually performed by the master RTU to get a regular update of remote RTU data
and to determine if communications to the remote RTUs have been unsuccessful.

Basic Polling
The logic below polls RTU7 Local Register Variables 1, 2 and 100 every 60 seconds. If the
poll is successful then registers FOX7R1, FOX7R2 and FOX7R100 on the local RTU will be
updated.

RTU7Registers is an INT_ARRAY variable containing three elements: 1, 2, 100.

190 B0780AF, Rev M

Chapter 10: ISaGRAF Logic Examples FoxRTU Station User's Guide

Polling After Data Has Expired

If a remote RTU has exception reported to the master RTU recently, it is not necessary to
poll the remote RTU until the data is older than X minutes (where X is ideally a SCADA set-
point with a default value of say 10 minutes). If exception reports are generated frequently, it
may never be necessary to poll the remote RTU. This minimizes the required
communications volume.

The logic below polls RTU7 Local Register Variables 1, 2 and 100 when the data is too old.
The maximum age of data (in minutes) is set in the variable MaxDataAge (DINT). If a
message is received from RTU7 or a poll has occurred, the RTU7QuietTimer (DINT) is reset
to 0.

B0780AF, Rev M 191

FoxRTU Station User's Guide Chapter 10: ISaGRAF Logic Examples

Modbus Protocol
SCD2200 RTUs can be configured to behave as a Modbus master or slave. The following
examples outline both configurations.

Setting up an RTU to be a Modbus Slave

In this example, the RTU is being polled by an Operator’s Panel using Modbus/RTU over a
serial link. This would be configured as follows:
• Add the Modbus RTU protocol to the RTU (RTU Properties - Protocols).
• Add serial port 2 to the RTU configuration (RTU Properties - Ports)
• Edit serial port 2. From the Settings tab of port 2, set Bits per second to suit the
device and enable the Modbus RTU protocol.
• Create local Modbus variables to be polled by the Modbus Master device (Adding
Variables). Example: MODH71 - Modbus Holding register 71. See Modbus
Variables for Modbus variable formats and addressing details.
• Add an ISaGRAF logic program to copy data into the Modbus variables as required.
Alternatively, I/O channels can be directly mapped to Modbus variables (Editing
Variables)
• Download the Configuration and Logic to the RTU.

Note that Modbus addresses are 8 bit, so if the RTU’s address is greater than 255 then only
the lower 8 bits should be specified when configuring the master device. See Modbus
Extended Addresses for more details.

Setting up an RTU to be a Modbus Master

In this example, the RTU is polling a remote slave RTU (address 7) using Modbus/RTU over
a serial link. This would be configured as follows:
• Add the Modbus RTU protocol to the RTU.
• Add serial port 2 to the RTU configuration
• Edit serial port 2. From the Settings tab of port 2, set Bits per second to suit the
remote RTU and enable the Modbus RTU protocol.
• Add a route (direct, using serial port 2) for address 7 to the RTU’s route list (RTU
Properties – Routes).
• Create Modbus Variables to store the data polled from the Modbus Slave device
(Adding Variables). Example: MOD7H1001 to MOD7H1002 (Modbus device 7,
Holding Registers 1001 to 1002).
• Create local Modbus variables that correspond to the registers to be written to the
Modbus Slave device. Example: MODH1010 (Modbus Holding register 1010). To
read or write floating point values using the Modbus protocol, please see the
FPACK and FUNPACK function blocks.
• Configure a MODBUS function block in an ISaGRAF logic program, using the
appropriate variables or constants for the inputs and output. An example is shown
below.
• Download the Configuration and Logic to the RTU.

192 B0780AF, Rev M

Chapter 10: ISaGRAF Logic Examples FoxRTU Station User's Guide

The logic below polls Modbus holding registers 1001 and 1002 from RTU7 using the Modbus
protocol every 10 seconds. The data are stored in MOD7H1001 and MOD7H1002. Modbus
function code 3 (Read Holding Registers) is used.

Also, when the SetData variable is set the local holding register MODH1 will be written to
holding register 1010 on the slave device. Modbus function code 6 (Write Holding Register)
is used; if more than one register needs to be written then function code 16 (Write Multiple
Holding Registers) can be used.

B0780AF, Rev M 193

FoxRTU Station User's Guide Chapter 10: ISaGRAF Logic Examples

Allen Bradley Protocol

Communicating with an Allen Bradley SLC500 PLC

To configure the RTU to poll an Allen Bradley PLC:
• Add the Allen Bradley DF1 protocol to the RTU (RTU Properties - Protocols).
• Add a serial port to the RTU configuration (RTU Properties - Ports)
• Edit the serial port. From the Settings tab of port 2, set Bits per second to suit the
remote device and enable the Allen Bradley DF1 protocol.
• Add a route (direct, using the desired serial) for the PLC’s station address to the
RTU’s route list (RTU Properties – Routes).
• Create one or more FoxRTU Local Register variables to send to the PLC or to store
data from the PLC.
• Configure ABDF1_RX and/or ABDF1_TX function blocks in an ISaGRAF logic
program.
• Download the Configuration and Logic to the RTU.

The logic below polls 50 registers starting at N10:1 from an Allen Bradley PLC (station
address 26) every 10 seconds and stores the data in FOXR10 to FOXR60.

194 B0780AF, Rev M

Chapter 10: ISaGRAF Logic Examples FoxRTU Station User's Guide

Note 1: The simplest way to connect between an RTU serial port and an Allen Bradley PLC
is to use an RS232 null modem cable (can use the ADP-05 adaptor and an RJ45 to RJ45
patch lead). An Allen Bradley SLC5/03 CPU has a DB9 male port while the SLC5/02 CPU
has an RS485 RJ45 port and may need to have a communications module installed for
RS232 (RS485 can be used instead).

Note 2: If a 1785-KE interface module is used between the PLC and the RTU, the 1785-KE
station number must also be configured in the Route list. The PLC should then be configured
as an indirect link via the 1785-KE station address.

B0780AF, Rev M 195

FoxRTU Station User's Guide Chapter 11: Redundancy

Chapter 11: Redundancy

Redundancy allows RTUs installed in critical applications to continue operating normally
when a power supply, a processor or a communications link failure is detected. Each RTU
can also be monitored and controlled by two or more PCs running SCADA software as
detailed in the topic Redundant PCs.

Redundant Processors

Overview
To configure a redundant processor, simply add a second CP-3 module to the RTU. The
second CP-3 will act as a backup and will automatically take over if the primary processor
failure is detected.

One CP-3 processor must be installed in an even-numbered slot of the RTU backplane and
one processor must be installed in an odd-numbered slot of the backplane. The processor
installed in the even-numbered slot is called the primary processor, while the processor
installed in the odd-numbered slot is the secondary processor.

Initially, the primary processor operates in active mode: it scans the I/O, runs the logic, and
initiates and responds to communication messages. The secondary processor remains in
standby mode ready to switch to active mode if the primary processor failure is detected.
The standby processor ports still respond to communications messages, but it does not run
its logic or initiate messages, and will reject any write requests.

To keep the standby processor up to date, logic information, event logs and communication
indices are regularly updated in the standby processor while the active processor is running.

The F3 LED indicates active or standby mode of each processor:

• When steady on, the processor is in active mode. All data have been synchronized
to the standby processor.
• When flashing (0.5 Hz), the processor is in standby mode.
• If the LED is off then the processor is in active mode, but not all data (symbol
values, event logs) have been synchronized to the standby processor. When the
standby processor is first detected by the active, it is normal for the F3 LED to
switch off for a period of time, which could be up to a few minutes if a large number
of events have been logged. It may also switch off momentarily during normal
operation if there is a burst of events. Note that if the active processor failure is
detected before synchronization is complete (i.e. while the F3 LED is off) then the
standby will still take over control, but some logged events may be lost.

The processor modules do not need to be installed physically next to each other. They just
need to be in odd and even-numbered slots somewhere on the RTU backplane.

Active and Standby Processor Operation

In a single processor system, the CP-3 is responsible for scanning input modules,
processing logic, updating output modules and initiating and responding to communications
messages. In a redundant processor system, the active processor still does all this, but also
regularly updates the standby processor with the following items:

196 B0780AF, Rev M

Chapter 11: Redundancy FoxRTU Station User's Guide

• ISaGRAF symbols (dictionary variables) that were modified during the last cycle of
logic execution. This includes function block parameters.
• FoxRTU and DNP3 event logs. The values, flags and time stamps as recorded in
the active processor module are all copied.
• DNP3 event list indices
• Time is synchronized every second. Note: protocols are only enabled on the
standby processor after receiving the first time synchronization from the active
processor. This verifies that I/O points have been read from the hardware modules
before the protocol is enabled.

Note: Variables (e.g. arrays) which are larger than 1000 bytes will not be synchronized. You
should structure your logic such that no variable or array is larger than this size. See
ISaGRAF Variable Types for information on the sizes of various data types. For example, an
IOPOINT_D variable is 16 bytes long, so to be synchronized, an array of these variables
should contain no more than 62 elements.

Note: If all the event logs are cleared in the active processor during operation (e.g. using
logic, or command from FoxRTU Station), then the event logs in the standby processor will
also be cleared.

The standby processor’s responsibilities include:

• Receiving the above data from the active processor and updating its local copy of
variable values and event logs.
• Responding to incoming communications read requests. Requests to write data to
the RTU will be rejected, as will requests to read DNP3 events. DNP3 static values
(class 0 data) will be returned.
• Monitoring backplane activity. If no activity is seen for 500ms then it is concluded
that the primary processor has detected failed. The standby processor will then
become the active processor.

When a CP-3 starts up, it first monitors backplane activity for a period of time. It will only
decide to become the active processor if no activity is detected. This initial timeout is 500ms
for the primary (even slot) processor, and 10,000ms for the secondary. This asymmetric
setting verifies that when both are powered up simultaneously, it will be the primary
processor that initially becomes active.

Note that apart from this bias on initial startup, the primary and secondary processors are
otherwise treated equally. For example, if the primary CP-3 is removed (causing the
secondary to become active) and then replaced, the secondary will continue to operate as
the active processor. The primary will only become active if the secondary is unsuccessful.

Configuring Redundant Processors

Verify that one processor is installed in an even slot on the backplane and the other
processor is installed in an odd slot.

In FoxRTU Station, after creating a new CP-3 RTU configuration, add a second CP-3
module to the RTU. FoxRTU Station will automatically label the processors “Primary” and
“Secondary”.

B0780AF, Rev M 197

FoxRTU Station User's Guide Chapter 11: Redundancy

In a redundant processor configuration, you can either:

• Use an identical configuration for both the primary and the secondary CP-3s, which
is referred to as “mirrored mode”, or
• Use independent configurations for the primary and secondary CP-3s.

By default, a single mirrored configuration will be created. This can then be downloaded to
the primary and secondary processors in turn.

A mirrored configuration is simpler to manage, however sometimes independent primary and

secondary configurations will be required. For example, if the two CP-3s need to be
accessible via Ethernet (which is a common requirement), then they will need independent
IP addresses and therefore separate (non-mirrored) configurations.

To create independent primary and secondary configurations, it is necessary to switch off

mirrored mode, by clicking the Mirror toolbar button.

Mirror mode on – same configuration for primary and

secondary processors.

Mirror mode off – independent configurations for

primary and secondary processors.

With mirror mode switched off, FoxRTU Station will maintain two separate configurations. At
any one time, you will be editing either the Primary or the Secondary configuration. The
configuration being edited is indicated by:
• One of the CP-3 modules being highlighted in the module list, and

198 B0780AF, Rev M

Chapter 11: Redundancy FoxRTU Station User's Guide

• “Primary” or “Secondary” indicator in the status bar, and

• “Primary” or “Secondary” in the title bar of the RTU Properties dialog.

It is important to keep track of which configuration you are editing!

In non-mirrored mode, there are now two additional toolbar buttons:

• Duplicate: This copies the primary processor configuration, with the exception of
the Port 1 Ethernet settings, to the secondary processor.
• Switch: This button switches between editing the primary and secondary
configurations. There is also a Switch button on many of the RTU Properties pages
which performs the same function.

If mirrored mode is subsequently re-enabled, the secondary configuration will effectively be

erased; the primary configuration will be what is used on both processors.

Detecting Status in Logic

When the standby processor takes over control, the transition is largely seamless. Logic
execution and I/O processing will continue; normally the only indication that a changeover
has occurred is a short delay while the failure is detected (500ms) and the standby initializes
I/O scanning.

However, often it is useful to record when changeovers occur, and possibly perform different
actions depending on whether the primary or secondary processor is active.

The FOX_GET_PROCESSOR function block is useful here. This returns the slot number of
the currently active processor. By comparing this to the configured slot numbers of the
primary and secondary processor you can determine which is running, and then trigger any
actions that may be required.

Another useful function block is FOX_GET_MODULE_OK, which can be used to verify that
the standby processor is still functional, and raise an alarm if it is not.

B0780AF, Rev M 199

FoxRTU Station User's Guide Chapter 11: Redundancy

Shared IP Address
It is often desirable to be able to address each CP-3 individually for maintenance purposes,
yet have a SCADA system address the RTU as a whole without necessarily knowing which
CP-3 is active.

This can be achieved by using the CP-3’s shared IP address feature.

The primary and secondary CP-3s are configured with individual IP address (say,
192.168.0.1 and 192.168.0.2). A third IP address (e.g. 192.168.0.10) is then configured via
the RTU Properties dialog – see RTU Properties – Redundancy.

The currently active processor will then respond to any requests received on its actual IP
address or the shared IP address. The standby processor will ignore the shared IP address,
at least until it takes over control.

The SCADA system should be configured to poll the shared IP address. A maintenance tool
such as FoxRTU Station can access the individual CP-3s (e.g. to load a new configuration)
using their individual IP addresses.

Downloading Configurations
For a mirrored configuration, the procedure for downloading the configuration to the RTU is
as follows:
1. Connect Ethernet or serial cable to the primary CP-3.
2. Connect to the RTU in FoxRTU Station and download configuration.
3. Connect Ethernet or serial cable to the secondary CP-3.
4. Connect to the RTU in FoxRTU Station and download configuration.

For a non-mirrored configuration, the procedure is as follows (assuming an Ethernet

connection):
5. Select the Primary configuration in FoxRTU Station
6. Connect to the RTU in FoxRTU Station (which will use the primary CP-3’s IP
address) and download configuration
7. Select Secondary configuration in FoxRTU Station
8. Connect to the RTU in FoxRTU Station (which will use the secondary CP-3’s IP
address) and download configuration

For more information on downloading configurations see Downloading Configurations.

Redundant Power Supplies

Two PS-xx power supplies can be plugged into a backplane and both will run normally,
sharing the power load. If one power supply is removed or detected fails, the other power
supply will supply the complete power load. An ISaGRAF program is not required to manage
the power supplies.

When two power supplies are present on the backplane, one power supply can be hot
swapped while the RTU is still running. This does not cause any interruption to the processor
or inputs and outputs.

200 B0780AF, Rev M

Chapter 11: Redundancy FoxRTU Station User's Guide

To determine the Total Current supplied by both power supplies to the RTU modules and
batteries, the current load for each power supply (SLssPS11AI3.value) can be read and the
two figures are totaled.

Redundant Communications
It is possible to change the port and/or route used to communicate with a remote RTU if
there is a communications failure detected.

Note: Communications ports on the standby processor cannot be used for redundant
communications, since communications with these ports are restricted while the processor is
in standby mode (see Active and Standby Processor Operation).

The example below shows how to use CP-3 port 2 as the active port and CP-3 port 3 as the
redundant port. Initially RTU1 is configured with a direct route to RTU7 using port 2. The
ladder diagram below shows how to swap ports after 11 detected failed communication
attempts to RTU7. The configuration will keep switching between ports if communications
continue to fail detected.

Active
RTU1 RTU7

Redundant

Several custom function blocks are used below. Please see the topic ISaGRAF Function
Blocks for function block details and parameter types. In this example, the DNP3 protocol is
used; however, the technique is equally applicable other protocols.

B0780AF, Rev M 201

FoxRTU Station User's Guide Chapter 11: Redundancy

In this example, traffic was switched from one port to another if a failure was detected. The
same method could also be used to switch from a direct to an indirect route. For example, if
a direct radio link between two distant RTUs was not available then the sending RTU could
fall back to forwarding traffic via an intermediate RTU. This application would use very
similar logic, but would change the TYPE and VIA parameters to FOX_SET_ROUTE, rather
than PORT.

Redundant PCs
Two or more PCs running SCADA or FoxRTU Station software can be connected to the one
RTU as illustrated below. All the PCs can poll the same data and set the same outputs. If
one PC fails detected, the other PCs will continue to operate normally.

202 B0780AF, Rev M

Chapter 11: Redundancy FoxRTU Station User's Guide

Each PC can be assigned its own RTU port or all the PCs can share one Ethernet port by
using an Ethernet Network. Note: a CP-3/MC-31 Ethernet port can handle communications
with up to four devices or RTUs simultaneously.

All the PCs can run the same SCADA software configurations with one exception. Each PC
must be assigned a unique RTU address in the range 65521-65535 to prevent
communication conflicts. To configure this, click the Connection toolbar button. The example
below configures FoxRTU Station to use address 65534. FoxRTU Station uses address
65535 by default.

Note: While migrating redundancy projects that are corrupted, it is recommended to turn on
“Mirrored” and migrate the projects to the latest versions of FoxRTU Station.

B0780AF, Rev M 203

FoxRTU Station User's Guide Chapter 12: Security

Chapter 12: Security

Overview
This section describes the facilities provided by FoxRTU Station for restricting access to
projects and RTUs.

Good security practice dictates that a user be restricted to the minimum set of system
features necessary to perform their role. To this end, FoxRTU Station supports role based
access control.

By default, a FoxRTU Station project is unsecured, and has no access restrictions. If you
choose to make a project secured then one or more user names may be created, assigned
roles and saved. Thereafter, the project can only be opened or edited if a valid user name
and password are specified, and the user’s defined role allows the requested operation.

If a secured project is loaded and a connection is made to an RTU, the RTU itself will
become secured. This means that:
• To access the RTU (check status, download new configuration, etc.) you need to
enter a valid user name and password.
• Only the original project, or one derived from it, may be downloaded to the RTU.
• The only way to return the RTU to its original unsecured state is to perform a
factory reset.

Security Policies
Each secured project includes a security policy, which is essentially a list of authorized
user names, passwords, and their assigned role(s).

If you create a brand new project and secure it, then it will have its own security policy, which
is unique to it. However, any project copies or variants derived from a secured project will
share the same security policy. If you create and secure “Project A”, then save a copy called
“Project A1”, then make some changes and save the result as “Project A2” then all three
projects will share the same security policy, as they are all derived from the same original
project. If you create a new project, “Project B”, from scratch then it will have its own
separate security policy.

204 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

Thus, while in some respects the security policy can be thought of as just another group of
configuration settings within a project, it does have some special properties. In particular, a
project’s security policy is “permeative”. This means that changes to the policy (such as
adding users or changing passwords) can automatically “permeate” through the system –
between different copies or variants of the project and between different RTUs.

Copies of a project’s security policy may exist in several different physical locations:
• Within the project folder itself (along with all the other configuration settings)
• In the PC’s policy store (a special location on the PC’s local hard disk)
• On the RTUs defined by the project

Changes made to one copy of the security policy will be automatically merged with other
copies at the first opportunity. “Merging” means that the most recent change to a particular
setting will be automatically applied to all accessible copies. This merging of security policies
occurs:
• When a secured project is opened – the policy in the project is merged with the
policy in the PC policy store
• When you connect to a secured RTU – the policy in the project is merged with the
policy read from the RTU

In both cases, the resulting merged security policy is then used to authenticate the user.

B0780AF, Rev M 205

FoxRTU Station User's Guide Chapter 12: Security

The practical upshot of this is that:

• If you change a project’s security policy and save the project, then when you
subsequently open the project, or any other copies or variants on the same PC,
then the new security policy will apply.
• If you download the changed project to an RTU, then when you subsequently
connect to the RTU from any PC then the new security policy will apply.

See Security Policy Distribution Scenarios for more information on how security policies are
updated in several common scenarios.

Project Tamper Detection

When opening a project, FoxRTU Station will check whether any project files have been
altered or deleted since the project was last opened. This applies to all projects, both
secured and unsecured. If an altered file is detected, the project’s security policy will be
removed and the project can be opened as an unsecured project. This has no consequence
if the project was already unsecured. If the project was secured, then it can still be viewed
and edited, but it cannot be used with any previously secured RTUs.

To avoid this system message being triggered:

• Do not copy a project folder while the project is open in FoxRTU Station.
• Do not add, remove, or edit files in a project folder.
• Do not attempt to open the project’s database (.mdb) files using an external
database application.

206 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

Security Policy Distribution Scenarios

This section provides some examples of how security policies are transferred between
project copies and RTUs.

Securing an RTU
In this scenario, a project is created and secured. The RTU is currently unsecured (it has no
security policy), and is not connected to FoxRTU Station.

A connection is then made to the RTU (e.g. to check status, or in preparation to download
configuration). The user is notified that the RTU will be secured, and if they agree then it will
become so. Note that only the informed security policy on the RTU has changed at this
point; it is still running its original configuration.

The configuration is then downloaded to the RTU.

An unrelated project is then opened in FoxRTU Station. Any attempt to connect to the RTU
is rejected, because the security policy does not match.

B0780AF, Rev M 207

FoxRTU Station User's Guide Chapter 12: Security

Project Copies on Same PC

In this scenario, a secured project is once again created and saved. Behind the scenes, a
copy of the policy is automatically saved to the PC’s policy store.

A copy is then made of Project A, and Project A is closed. In the new copy, the configuration
is edited and an additional user is added to the security policy. Note that the copy of the
security policy in the PC’s policy store is automatically updated.

The new project is then closed and Project A reopened. Its security policy is automatically
updated with the second user’s details, so that user will now be able to open Project A.

208 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

RTU Connections
In this scenario PC1 and PC2 each has a copy of secured Project A. One of these PCs has
previously connected to the RTU and downloaded the configuration (and security policy).

Then Project A is opened on PC1 and a second user is added.

PC1 now connects to the RTU, which causes the RTU’s copy of the policy to be updated. It
now contains two users.

The project is then opened on PC2. At this point the policy on PC2 still only contains one
user, so that user’s credentials must be entered to open the project.

A connection is then made to the RTU, which causes the security policy on PC2 to be
updated. If the project is subsequently opened on this PC, either user’s credentials may now
be used.

B0780AF, Rev M 209

FoxRTU Station User's Guide Chapter 12: Security

Alternatively, you could connect to the RTU from PC2 without any project loaded. In this
case you would be prompted for credentials, and you could enter either user name, because
the RTU policy contains both users. Once the connection has been successfully established
the PC2 policy would be updated and the project can now be opened using either user
name.

Securing a Project
By default, projects are unsecured, which means they have no security policy and can be
opened by anyone. To help prevent unauthorized access, projects should be secured using
the following procedure.

Select the Security node in the tree

view. The security pane will appear
on the right.

Click the Make this project secured

link.

Enter a password for the default

“Admin” user, re-enter it, and press
OK.

The OK button will only be enabled if

the password is long enough and the
two password fields match exactly.

210 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

See Passwords for important information about password selection.

Once a project has been secured, additional users and roles can be added, as described in
Managing Users and Managing Roles.

Unsecuring a Project
An administrator can make a secured project unsecured so that it no longer requires user
login.

Note that this will not unsecure any RTUs that have already been loaded with the secured
project. The only way to unsecure an RTU is to perform a factory reset.

Furthermore, once you unsecure a project, you will no longer be able to use that project to
connect to an already secured RTU. If you re-secure the project it will effectively become a
new project, and you will not be able to connect to any RTUs secured using the “old” project.

To unsecure a project:

Verify that you are logged in as an

administrator.

Select the Security node in the tree

view. The security pane will appear on
the right.

Click the Make this project unsecured

link.

Take note of the system message,

especially the part about the project no
longer being able to connect to any
already secured RTUs.

Press Continue.

B0780AF, Rev M 211

FoxRTU Station User's Guide Chapter 12: Security

Enter the password for the currently

logged in administrator, and press OK.

Role Based Access Control

Role Based Access Control (RBAC) allows an administrator or manager to create new users
and specify what they can do with a project. This feature is enabled when a project is
secured.

Users are people that are authorized to access the project and/or the RTU. Each user has a
user name and a password. When a project is secured, one user is automatically created,
called Admin. This user has full control over the project and RTU, and cannot be deleted.
Any number of additional users can be created.

Roles are the functions performed by particular users. Each user can be assigned one or
more roles. By default, four roles are created: Administrator, Manager, Engineer and
Maintenance. The latter three roles may be deleted if desired, and new roles may be added.

Permissions are particular functional areas to which access can be permitted or denied.
Each permission generally covers several specific operations. For example, the Download
permission covers opening ISaGRAF, downloading new configuration and logic, and
downloading new firmware. Three permissions are currently defined: Manage Users,
Configure and Download.

A user name and password must be entered whenever a secured project is opened. This is
also required if you attempt to connect to a secured RTU with no project selected in FoxRTU
Station.

212 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

Roles and Permissions

Permissions are not assigned directly to users. Instead, each role implies a particular set of
permissions, so that when you assign a role to a user you are granting them a particular set
of permissions. The following table summarizes the permissions associated with each of the
default roles:

Download
Configure
Manage
users
Role A user having this role…

Administrator    …can do anything. This role cannot be deleted

Manager  - - …can add/remove users and roles
Engineer -   …can create/edit/test/download configuration and logic, and
download firmware
Maintenance - -  …can download existing configuration, logic or firmware
(no roles) - - - …can view project and check RTU status

It is possible to delete, or change the permissions associated with, any of the above roles,
apart from Administrator. It is also possible to define new roles.

The following table spells out in more detail which operations are allowed for each
permission:
Open ISaGRAF
Upload service

Save project
View project

Add/remove
config/logic

config/logic
users/roles
RTU status

Download

Download

Unsecure
firmware
Change

project
report

Permission

Manage users    -  - - -  
Configure     -  - -  -
Download    - -    - -
(none)    - - - - - - -

It is not possible to change the permitted operations assigned to each of the above
permissions.

B0780AF, Rev M 213

FoxRTU Station User's Guide Chapter 12: Security

Managing Users
When a project is secured, a User’s node will appear in the tree view. Selecting this will
display a list of all currently defined users. Initially, this list will have only one entry: Admin,
the default administrator.

Adding a User

Right click on the Users node and select

New User.

If Users is not visible in the tree, make

sure that the project has been secured
and that you are logged in as Admin or a
user with the Manage Users permission.

Enter a user name. This can either be the

user’s full name, or some abbreviation. It
will need to be entered each time that the
user opens the project. Press OK.

A random initial password will be

generated for the user. The Copy link will
copy the password to the clipboard, so it
can then be forwarded to the user.
Alternatively, the user’s initial password
can be set manually, using the User
Details pane, as described below.

The Users pane contains a list of all defined users, which should now contain the newly
created user. Note that the user has also been added to the tree view.

214 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

Click on the link in the User name column to edit the user’s details. This will bring up the
user details pane:

On this screen, you can:

• Enter a description and/or email address for the user. These are for information
only and are not used by FoxRTU Station.
• Select the role(s) for the user, using the checkboxes on the right. As you select
these, the Permissions section will change to reflect the permissions that the user
will have. Note that the role for the default Admin user cannot be changed.
• Set a password for the user, using the Change password link. It is necessary to re-
enter your administrator password before entering and user’s new password.
• Control if the user must change their password when they first open the project.
This option is enabled by default for users other than Admin.

B0780AF, Rev M 215

FoxRTU Station User's Guide Chapter 12: Security

Deleting a User
An administrator or manager may delete users from a project. The default Admin user
cannot be deleted.

Note: Once a user has been deleted, the same user name may not be used again for this
project.

To delete a user from a project:

Right click on the user to delete and select Delete

User (or press the Del key).

You will be asked to confirm the deletion.

Managing Roles
Adding and deleting roles is much the same as adding and deleting users. An administrator
or manager may edit or delete the default roles (except Administrator), and may add new
roles.

Adding a Role
To add a new role:

Right click on the Roles node and select

New Role.

If Roles is not visible in the tree, make

sure that the project has been secured
and that you are logged in as Admin or a
user with the Manage Users permission.

Enter a name for the role. Press OK.

216 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

The Roles pane contains a list of all defined roles, which should now contain the newly
created role. Note that the role has also been added to the tree view.

Click on the link in the Name column to edit the role. This will bring up the role details pane:

On this screen you can:

• Enter a description for the role. This is for information only and is not used by
FoxRTU Station.
• Select the permission(s) that users with this role will have.
• View or select the users (other than Admin) that have this role, using the
checkboxes on the right.

B0780AF, Rev M 217

FoxRTU Station User's Guide Chapter 12: Security

Deleting a Role
An administrator or manager may delete roles from a project. The Administrator role cannot
be deleted.

To delete a role from a project:

Right click on the role to delete and select Delete

Role (or press the Del key).

You will be asked to confirm the deletion.

Managing a Secured RTU

Securing an RTU
If you load a secured project and then connect to a previously unsecured RTU, the RTU will
become secured. This means that:
• A copy of the project’s security policy will be stored on the RTU, and will be updated
any time a connection is attempted.
• The RTU is now tied to that particular project. Only the configuration and logic
defined in that project, or one derived from it (e.g. using Save As), will be able to be
downloaded.
• If you connect to the RTU with no project loaded, you will be prompted for
username and password.
• The only way to return an RTU to its original unsecured state is to perform a factory
reset.

In other words, several restrictions come into force once you secure an RTU. A system
message will therefore be displayed when you first attempt to connect to an unsecured RTU:

218 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

If you select Yes, the RTU will become secured, even if you don’t actually download the
project’s configuration to it. This can be used to secure a new RTU processor, which can
then be placed in stock. This can be used to help prevent any unauthorized firmware
downloads.

Connecting to a Secured RTU

Connecting to a secured RTU is much the same as connecting to an unsecured RTU. First,
open the correct project. Being a secured project, you will be prompted for username and
password. Once the project has loaded you can perform the desired function as you would
normally, e.g. get status or download configuration.

If the project file is not available, you can still check the status of an RTU or download
firmware by connecting to it with no project selected in FoxRTU Station. In this case you will
be prompted for username and password, which will be validated against the policy stored
on the RTU.

If you connect to the RTU while a project is loaded, FoxRTU Station will verify that the
security policy on the RTU came from the currently loaded project, or a variant of it. If not, a
detected error is displayed and the requested function is not performed:

At this point, in order to connect to the RTU your options are:

• Locate and open the original project used to secure the RTU. You don’t need the
exact same version, but the project must have been derived from the original
project. (Note that a project that has been unsecured, then resecured, is treated as
an entirely new project.)
• Connect to the RTU with no project selected. You will be prompted for username
and password, as described above.
• Perform a factory reset on the RTU, which will return it to the unsecured state.

The following table summarizes the restrictions which will be enforced when you connect to
an RTU, depending on the state of the selected project in FoxRTU Station, and the state of
the RTU.

Selected project RTU Action

None Not secured  Connection allowed
Not secured Not secured  Connection allowed
Secured Not secured  Secures RTU (user is prompted)

B0780AF, Rev M 219

FoxRTU Station User's Guide Chapter 12: Security

None Secured Prompt for username and password

Not secured Secured  Connection denied
Secured (policy A) Secured (policy A)  Connection allowed
Secured (policy A) Secured (policy B)  Connection denied

As noted in Security Policies, when you connect to a secured RTU the three copies of the
project security policy (on the RTU, the PC policy store and the project folder) will be
merged. For each entry in the policy (e.g. each user) the most recent details will be selected.
The updated policy is then automatically written back to the policy store and the RTU.

Thus, even a “get status” operation may cause the policy on the RTU to be updated, if the
policy details on the PC are more recent than those on the RTU.

Unsecuring an RTU
The only way to unsecure an RTU is to perform a factory reset. This verifies that only a
person with physical access to the RTU can unsecure an RTU.

Maintaining Security

Passwords
In a secured project, every user must have a password. Passwords secure the system and
must be kept secret.

As noted above, a project’s security policy (which contains all user names and passwords)
may exist in three different places: the project folder, the PC policy store, and the RTU. In
each case the policy details are encrypted, and are never transmitted in plaintext form.
Within the policy, passwords are further encrypted.

However, encryption is only as good as the password used. If a password can be guessed
then an attacker will be able to impersonate an authorized user and may gain access to the
project and associated RTUs.

This is particularly important because the PCs on which projects are stored, and on which
FoxRTU Station is run, may not always be secure.

The primary defense against this is to use a strong password. Passwords should:
• Have at least 8 characters, preferably more
• Not be a word or name which might be found in a dictionary – including words with
zero substituted for ‘O’ and similar common tricks
• Have a mix of upper case, lower case, numbers, and punctuation

One method of creating strong memorable passwords is to create an acronym, e.g.

“Ih1Bd&1Gc!” (“I have one black dog and one ginger cat!”) will be quite resistant to password
cracking.

FoxRTU Station gives an indication of password strength when you enter a new user
password. Using passwords rated less than “good” is not recommended.

Note that it is not possible to recover a forgotten password. It is possible to reset the
password on a project, but you will need to contact our support team.

220 B0780AF, Rev M

Chapter 12: Security FoxRTU Station User's Guide

Other Considerations
As well as using strong passwords, there are several other considerations when securing a
system. The following list is not exhaustive.
• Verify that physical access to the RTU is restricted to help prevent unauthorized
module replacement or factory reset.
• Don’t create more users than you need. Each additional password in the policy file
increases the chance of an attacker guessing one. Be especially frugal in creating
users with Administrator role.
• Encourage users to change their password regularly. In FoxRTU Station an
administrator can set an option to force a user to change their password on next
login.
• Restrict access to copies of project files – centralize storage rather than having
copies on many PCs. In any case, this is desirable from the point of view of version
control.
• If contractors require temporary access to projects or RTUs, give them unique user
names (don’t just give them the Admin password!) and verify that they are removed
promptly once the work is complete. The automatic and “permeative” policy updates
help in this regard – if the policy on an RTU is updated to remove a user then they
will no longer be able to connect to it, even though they may still be listed in the
policy within their copy of the project.
• Do not connect the RTU local network to the outside world. If remote wide area
access is required, then verify that a suitable firewall is in place to block all
incoming connection attempts other than from specifically authorized computers or
networks.
• Use DNP3 Secure for telemetry (see Require authentication for critical functions
setting in DNP3 protocol settings).

B0780AF, Rev M 221

FoxRTU Station User's Guide Chapter 13: Local Backups

Chapter 13: Local Backups

Overview
When working on a large project it is recommended to save backup copies periodically. This
helps reduce the amount of work lost in the event of project corruption due to power loss or
other cause. It also provides a form of basic version control, allowing you to roll back to an
earlier version if required.

The Local Backup feature in FoxRTU Station makes it easy to save and restore project
backups.

Project backups are complete copies of the project, including configuration settings, logic
and security policy. They are stored in a special area of the PC’s local hard disk.

To view a list of currently stored backups, click on Local backups in the tree view.

Making a Backup
To create a backup of the currently loaded project:

Right click on the project name and select Backup.

Alternatively, select File  Backup Project from

the main menu bar.

Enter a description for the backup (optional) and

press OK.

222 B0780AF, Rev M

Chapter 13: Local Backups FoxRTU Station User's Guide

If the project has unsaved changes, you will be

prompted to save it, which you can do by clicking
Save.

If you now select the Local backups tree node, the new backup should be visible:

For each stored backup, this table indicates:

• Whether the project is secured
• The name of the project
• The date the backup was made
• The version of FoxRTU Station in use when the backup was mode
• If the project was secured, the user that opened the project and created the backup
• The user-entered description of the backup

B0780AF, Rev M 223

FoxRTU Station User's Guide Chapter 13: Local Backups

When a project is saved, FoxRTU Station may sometimes suggest that a backup be made:

If you click Yes then a backup will be made, as described above.

Deleting a backup
To delete unwanted backup files:
1. Close FoxRTU Station.
2. Using Windows Explorer, navigate to the folder:
C:\Users\username\AppData\Local\Foxboro\FoxRTU Station\Backups\User
This folder will contain folders named B.001, B.002, etc.
3. To delete all backups, simply delete the above folder.
4. To selectively delete a particular backup (expert users only), open the file
manifest.xml in a text editor. This file identifies the backups contained in the B.xxx
folders.
5. Identify the backup you wish to delete and delete the folder referenced by the id
attribute in the XML file.
6. Delete the entire point node for the backup in question from the XML file and save
the file.
7. Restart FoxRTU Station and confirm that the backup is no longer visible under
Local backups.

224 B0780AF, Rev M

Chapter 13: Local Backups FoxRTU Station User's Guide

Restoring a Project
To restore a project from a backup, right click on the backup from the table on the Local
backups pane, and select Restore:

The project will now be saved and opened, with a suffix added to the name (e.g. “Wizzo
Energy - 1") so that it doesn’t overwrite the original project. If the project is secured (see
Security), you will be prompted for a username and password, the same as if you were
opening the file normally.

When a project is restored, its security policy will also be restored. As is the case when any
project is opened, its policy will be merged with that in the PC’s policy store, which may
cause the restored project’s policy to be updated (see Project Copies on Same PC). For
example, if you create a backup, then change your password, then later restore the backup,
then the restored project’s security policy will contain your updated password.

The restored project will be saved to the FoxRTU Station default project directory, which is
under the current Windows user’s Documents folder.

You also have the option to export the backup as a zip file, which can be saved to any folder.

B0780AF, Rev M 225

FoxRTU Station User's Guide Chapter 14: Connecting to an RTU

Chapter 14: Connecting to an RTU

Cables
To connect a PC directly to an RTU, an Ethernet crossover cable is normally required as
illustrated below, although some modern PCs may also work with a straight through cable. If
connecting to an Ethernet hub or switch, a straight through cable or a crossover cable can
be used.

By default, the IP address of the RTU’s main Ethernet port is set to 192.168.0.1. This may
not be suitable for connecting via an existing Ethernet network – check with your network
administrator. If this is the case then you will need to perform the initial setup using a direct
crossover cable connection (or a local Ethernet switch, not connected to the main network).
The CP-3 must not be connected to the existing Ethernet network until it has been
configured with an IP address that is compatible with the network.

If required, the CP-3 can be reset it to its factory settings (including setting its IP address to
192.168.0.1) by performing a factory reset.

The above cables are industry standard and are readily available. Once a cable is installed,
the PC’s LAN port needs to be setup as detailed in the LAN Port Setup.

If the RTU has a Serial option port and the port has already been configured (by first using
Ethernet communications), then FoxRTU Station can use Serial communications to the RTU.

226 B0780AF, Rev M

Chapter 14: Connecting to an RTU FoxRTU Station User's Guide

Both the RTU and the PC are DTE (Data Terminal Equipment) devices, so a serial cross-
over (or null modem) cable will be required.

The easiest option is to use a standard straight through Ethernet cable, along with an ADP-
05 serial adapter (optional accessory), as shown in the diagram below. This adapter has a
female RJ-45 socket on one side and a female DB9 connector on the other (wired to suit a
PC serial port). If your computer does not have a serial port then a USB to serial adapter can
be used.

LAN Port Setup

To initially communicate with the RTU, the PC’s LAN port must be enabled and setup to
communicate with the RTU’s default IP address (192.168.0.1) as detailed below.

For Windows 7: Open Control Panel, select Network and

Sharing Center, then Change adapter settings.

This will show a list of the available network adapters in

your PC. Identify the one corresponding to the RTU
connection and confirm that it is enabled. If it is marked
“Disabled”, right click and select Enable.

B0780AF, Rev M 227

FoxRTU Station User's Guide Chapter 14: Connecting to an RTU

Once the LAN port is enabled, right-click the LAN port

again and select Properties.

Select Internet Protocol (TCP/IPv4) and then click

Properties.

Set the IP address and subnet mask as shown. Note that

any unused address in the range 192.168.0.2 to
192.168.0.254 can be used for the PC.

Press OK to save the settings.

228 B0780AF, Rev M

Chapter 14: Connecting to an RTU FoxRTU Station User's Guide

Verify the connection by starting a Windows command

window and typing: ping 192.168.0.1

The results should indicate that replies are being received

from the RTU. If not, check your cables and LAN settings.

Connection Parameters
The Connection toolbar button is used to define how FoxRTU Station will communicate with
the RTU.

Normally, FoxRTU Station will use the selected RTU’s configured Port 1 Ethernet IP
address. However, sometimes you will need to override this – e.g. if you have changed the
IP address in the configuration then you will need to tell FoxRTU Station to connect using
the old address to load the new configuration.

If the Port 1 IP address is not selected, the button label will no longer read “Connection”, but
will indicate the selected connection method, e.g. if an alternative IP address is selected
then the IP address will be displayed.

Pressing the Connection button will display the Connection to RTU dialog, which has the
settings listed below

Use RTU IP address information: When selected,

FoxRTU Station uses the IP address configured for the
processor Port 1.

Use the following IP address information: When

selected, FoxRTU Station uses the specified IP
address.

Use the following serial port information: When

selected, FoxRTU Station uses the specified serial port
(COM1, COM2 …) and speed (9600, 19200, 38400,
57600 or 115200 bps) to communicate with the RTU
using the FoxRTU protocol.

Note: If the CP-3’s IP address is unknown then it can be reset to the factory default of
192.168.0.1, as described in Factory Reset.

The Advanced tab contains additional settings:

B0780AF, Rev M 229

FoxRTU Station User's Guide Chapter 14: Connecting to an RTU

Network Address: (1-65535) Because the PC is

treated like another RTU in the network, it must have its
own unique address. Addresses 65521 to 65535 are
reserved for FoxRTU Station. If two or more PCs
running FoxRTU Station are connected to the same
RTU, each PC should have its own unique address to
avoid communication conflicts.

Via address: (0-65535) When using a network of RTUs,

this is the address of the first RTU to communicate
through. Address 0 [default] disables this function.

Timeout (ms): The time to wait for the RTU to respond

to messages. This setting may need to be lengthened
when communicating using a slow serial link (e.g. a
setting of at least 4000ms when using 1200 bps baud)

Retries: The maximum number of attempts (after the first attempt) FoxRTU Station will
make at sending a message to the RTU if the previous attempts were not successful.

Repeat Rate: This allows a delay to be inserted between message attempts.

Always use FoxRTU protocol for file transfers: When enabled, FoxRTU Station uses the
FoxRTU protocol when downloading firmware and configurations over Ethernet or serial
connections. When disabled, FoxRTU Station uses the SSH internet protocol, which is
significantly faster.

Using the SSH protocol is normally preferable. However, FoxRTU protocol will need to be
used if:
• A serial connection is used to connect to the RTU
• A configuration or firmware is being downloaded to a CP-3 via an MC-31 Ethernet
port
• A configuration or firmware is being downloaded to a CP-3 via another RTU

Discovery
The Discovery toolbar button tells FoxRTU Station to try to locate the RTU on the local
Ethernet or serial network.

Ethernet
For Ethernet, FoxRTU Station will send out a broadcast packet on the local subnet and
collect any replies from RTUs.

Press Search to initiate the discovery process. The RTU address and IP address will be
displayed for all RTUs that were found.

230 B0780AF, Rev M

Chapter 14: Connecting to an RTU FoxRTU Station User's Guide

Note that this will only work if the RTU’s current IP address is set to a value which is
compatible with the local subnet. For example, if the RTU and your PC are connected to the
192.168.0.x LAN, but the RTU’s IP address is set to 10.2.3.12, then it will not be detected.

Once the RTU’s IP address and RTU address have been determined, the Status button can
be used to check that communications are working. See Status for more details.

Serial
Select the Serial tab to search for RTUs connected via a serial cable.

First select the desired PC port in the control on the left, or choose All Ports to scan all
available PC serial ports. Then click Search.

B0780AF, Rev M 231

FoxRTU Station User's Guide Chapter 14: Connecting to an RTU

FoxRTU Station will now attempt to connect to the RTU, trying several different baud rates.
Note that FoxRTU protocol must be enabled on the RTU serial port in question in order for
the detection to succeed.

If one or more RTUs are found, their details (address, serial port and baud rate) will be
displayed. As with Ethernet, clicking Status will display more details about the selected RTU.

RTU Restart
By default, restarting the RTU resets all variables to their initial values, although individual
variables can be configured to retain their value during a restart. Event logs, firmware, logic
and RTU configuration settings are all retained across a restart.

An RTU restart occurs:

• following a firmware, logic or configuration download
• if power is lost
• if a Restart command is issued in FoxRTU Station (select the required RTU, then
select Tools  Restart)
• if the REBOOT function block is executed
• if a DNP3 Cold Restart or Warm Restart command is received
• if a serious firmware fault is detected

If an RTU restart occurs then the DEVICE_RESTART bit will be set in the DNP3 IIN register.

232 B0780AF, Rev M

Chapter 14: Connecting to an RTU FoxRTU Station User's Guide

Factory Reset
The procedure described in this section will reset a CP-3/MC-31 module to its factory default
settings. That is:
• Main Ethernet port IP address is set to 192.168.0.1, subnet mask 255.255.255.0
• All other configuration settings are reset to defaults.
• All logic is cleared.
• All security settings are removed, i.e. the RTU will become unsecured.
• All event log entries and retained variables are cleared.
• System clock setting may be cleared (depending on reset method used).
• System diagnostic log is retained.

Note that upgrading firmware does not perform a factory reset (although it will clear any
logic).

The factory reset procedure depends on the module type and hardware version. For CP-3/
MC-31 modules, you may have version 1 or version 2 hardware. Version 2 hardware can be
identified by the presence of a 2-pin link header on the front edge of the module, just below
the LED display.

CP-3/MC-31 – Version 2 Hardware

To factory reset a version 2 module (requires firmware 3314 or later):
1. Switch off power to the RTU rack, or remove module from rack.
2. Short together the 2-pin link header on the front edge of the module, using a metal
screwdriver or a jumper link.
3. With the pins still shorted together, turn on the RTU power (or re-insert module).
4. Remove the screwdriver or link.

CP-3/MC-31 – Version 1 Hardware or Old Firmware

The following procedure is used to factory reset a version 1 module, or a version 2 module
with firmware older than 3314. Note that this method will cause the system time to be reset.
1. Remove the module from the rack
2. Remove the jumper link from the header on the rear edge of the module (adjacent
to the backplane connector)
3. Wait at least 5 minutes
4. Replace the jumper link and return the module to the rack.

Note: If you remove the battery or battery link then after replacing it the module should be
plugged into a backplane and powered up for at least one second. Being unable to do this
may result in much shorter battery life.

B0780AF, Rev M 233

FoxRTU Station User's Guide Chapter 15: Download

Chapter 15: Download

Overview
FoxRTU Station can be used to create a configuration for an RTU while “offline”, i.e. without
actually having the RTU connected. Ultimately, however, it is necessary to connect to the
RTU to download the newly created configuration and logic programs to the RTU.

The general workflow when configuring an RTU is as follows:

1. Define configuration in FoxRTU Station (define module layout, adjust settings)
2. Define logic programs in ISaGRAF Workbench
3. “Build” the configuration and logic. The result is a set of files which the RTU can
understand. This will be done automatically prior to download if the configuration or
logic have changed. It can also be triggered manually, using the Build toolbar
button, or the Build and Export menu item. See also ISaGRAF Overview.
4. Download these compiled files to the RTU.
5. Restart the RTU (this will happen automatically)

Note that it is not possible to make online changes to the configuration of a running RTU.
Any configuration change needs to be built, downloaded and the RTU restarted, as noted
above.

FoxRTU Station can also be used to download new firmware to the RTU.

Downloading Configurations

Firmware Compatibility
As noted in Firmware, it is important to be aware of any potential compatibility issues
between FoxRTU Station and the RTU’s firmware.

The current version of FoxRTU Station can be used to download configuration and logic files
as follows:

RTU Firmware Version Configuration/logic download

Earlier than 2874 Not supported (use an earlier version of FoxRTU Station)
2874 or later Existing projects only
2981 or later Existing or new projects. Some function blocks or other features
described in this manual may not be supported, or may work
differently. Check firmware release notes.
6793 or later Existing or new projects. All features except those marked “requires
recent firmware” are supported. Check firmware release notes.

Note that this version of FoxRTU Station can read the status from an RTU with any firmware
version. It can also upgrade the RTU firmware from any version (subject to any special
procedures described in the firmware release notes).

234 B0780AF, Rev M

Chapter 15: Download FoxRTU Station User's Guide

Connection
To download a new configuration, the required project must be open in FoxRTU Station, and
the required RTU selected.

Main CP-3 Ethernet port

The simplest and fastest method of downloading a configuration to the CP-3 is to use the
main Ethernet port on the CP-3.

Before attempting to download the configuration, verify that the connection parameters are
set correctly. In particular:
• If the main port IP address set in the configuration is the same as the CP-3’s
current IP address then select Use RTU address information. If the new
configuration will change the main port IP address then select Use the following IP
address information, and enter the CP-3’s current IP address.
• On the Advanced tab, verify that the Always use FoxRTU protocol checkbox is not
ticked. The SSH protocol will then be used.

For redundant processor systems, the configuration needs to be downloaded to each CP-3
module separately. See Downloading Configurations for more details.

Other CP-3 Ethernet ports

It is also possible to update a CP-3’s configuration via a connection to a T3 Ethernet option
card (installed as port 2 or 3 on a CP-3). The CP-3 must have been previously configured to
enable the additional port and set its IP address.

Before attempting to download the configuration, verify that the connection parameters are
set correctly. In particular:
• Select Use the following IP address information, and enter the current IP address of
the T3 Ethernet port.
• On the Advanced tab, verify that the Always use FoxRTU protocol checkbox is not
ticked. The SSH protocol will then be used.

Other Connection Options

With some caveats, it is also possible to update a CP-3’s configuration via an MC-31 port, or
a serial connection, or via another RTU. The CP-3 must have been previously configured to
enable the port and set its IP address or serial parameters.

Note: It is not possible to change the RTU’s address using these connection methods. The
address (1-65520) set in the RTU Properties dialog must match the RTU’s current address.

Before attempting to download the configuration, verify that the connection parameters are
set correctly. In particular:
• If connecting to an MC-31 Ethernet port, select Use the following IP address
information, and enter the current IP address of the MC-31 port.
• If connecting to a serial port, select Use the following serial port information and
enter the current baud rate set for the serial port. (Note that the serial configuration
downloads are only supported if the RTU port is configured for 8 data bits, no parity,
1 stop bit.)

B0780AF, Rev M 235

FoxRTU Station User's Guide Chapter 15: Download

• If connecting via an intermediate RTU, be sure to use the IP address or serial baud
rate of the intermediate RTU (not the destination RTU) for the above settings. On
the Advanced tab, set the Via address field to the address of the intermediate RTU.
• On the Advanced tab, verify that the Always use FoxRTU protocol checkbox is
ticked. The FoxRTU (FOX) protocol will then be used.

Download

To download a new configuration to the RTU, click the

Download toolbar button, then Configuration and Logic.

This command will download the RTU configuration

(module definition and settings), and any logic programs
(including Dictionary variables).

(It is also possible to download just the configuration, or

just the logic, but this is generally not useful unless you
are connected via a very slow communications link.)

The following operations will then occur automatically:

1. If necessary, the configuration and/or logic will be rebuilt.
2. The configuration files will be downloaded to the RTU
3. The RTU will extract and process the files
4. The RTU will restart
5. FoxRTU Station will reconnect to the RTU and confirm that the update was
successful (although see Reconnection below).

It is also possible to download the entire project file to the RTU, by selecting Configuration,
Logic and Project. The project can then be retrieved from the RTU (using the Upload
Configuration option on the Tools menu) later, where it can be viewed or modified.

When the project file is saved to the RTU, Upload Configuration will upload a package file
including both configuration and logic programs, but the logic programs will not be loaded in
FoxRTU Station automatically. The package file will be saved to a specific folder, as
indicated by the displayed message. Copy the file project.zip to a suitable folder, unzip it,
and open the project in FoxRTU Station. The entire project including configuration and logic
will be loaded.

The downside of storing the project file on the RTU is that it can be quite large, so it will use
up space on the RTU and increase the time taken to download new configurations.

Reconnection
If the newly downloaded configuration has changed the communications settings on the RTU
(e.g. IP address, serial port baud rate) then FoxRTU Station will not attempt to monitor
progress or reconnect.

If this is the case then the following will be displayed once the files have been downloaded
and the update process has commenced:

236 B0780AF, Rev M

Chapter 15: Download FoxRTU Station User's Guide

Wait for 1-2 minutes for the update to complete.

To verify the new configuration, click the Connection toolbar button then select the Use RTU
address information option. Then press the Status toolbar button to check that you can
communicate with the RTU using the new settings.

Note: If ISaGRAF logic is rebuilt and downloaded then any existing retained variables will be
cleared.

Downloading via a SCADA System

It is also possible to use FoxRTU Station build configuration files offline, and then use a
SCADA system to download the files to the RTU via existing DNP3 communications
infrastructure.

The precise procedure is dependent on the SCADA package in use, and is outside the
scope of this manual. In general terms, the workflow is:
• Use the Build and Export command on the FoxRTU Station Tools menu to generate
and save a downloadable configuration file.
• Transfer this file to the SCADA system and issue the required SCADA commands
to write the file to the path config/myfile.tgz on the RTU, where myfile.tgz is the
name of the exported file. (The “config/” part of the path is required.)
• Issue the required SCADA command to “activate” the configuration. This will trigger
the normal upgrade process, the same as if the file had been downloaded directly
from FoxRTU Station. Once the upgrade is complete, the RTU will restart.

Downloading Firmware

Overview
Firmware can be downloaded into a processor or communications module to upgrade
functionality. The firmware version that is currently in the CP-3 or MC-31 can be checked
using the Status command.

Note that the CP-3 and MC-31 use identical firmware.

When upgrading firmware, all CP-3 and MC-31 modules in an RTU should be upgraded to
the same version. Upgrade CP-3 modules first, then any MC-31 modules (reverse order if
downgrading).

Upgrading firmware will preserve the current RTU configuration and ISaGRAF logic.
However, all retained variables and event logs will be cleared.

B0780AF, Rev M 237

FoxRTU Station User's Guide Chapter 15: Download

Important: Firmware releases are always supplied with release notes, which describe the
changes made and any special upgrade procedures which may be required. It is vital that
you read the release notes before attempting any firmware upgrade.

Important: The process of upgrading firmware can take several minutes. To help ensure
that the upgrade is successful, , firmware upgrades should be performed using a reliable
communications link (e.g. Ethernet) and with a stable power supply to the RTU.

Connection
The simplest and fastest method of downloading firmware to a CP-3 or MC-31 is to use an
Ethernet port – normally the main Ethernet port, but you can also use port 2 or 3 if you have
a T3 Ethernet option card installed. The RTU must have been previously configured to
enable the port and set its IP address (unless the main port is being used with its factory
default IP address).

It is also possible to update a CP-3’s firmware via an MC-31 port, or a serial connection, or
via another RTU. Note that this method will be significantly slower, and it is not possible to
update MC-31 firmware using this method.

For MC-31, a direct Ethernet connection is required, and the SSH protocol must be used
(verify that on the Always use FoxRTU protocol checkbox is not ticked).

Before attempting to download the firmware, verify that the connection parameters are set
correctly, as described in Downloading Configurations.

Download
Before starting a firmware upgrade, be sure to read the release notes supplied with the new
firmware. You should also determine the firmware version that you are upgrading from.
Special procedures may be required when upgrading from very old versions (earlier than
version 2874), or when downgrading from recent versions – check the release notes for
details.

Note: An MD5 checksum is published on the support website for each firmware package. To
verify the integrity of the downloaded firmware package, its checksum should be calculated
and compared to the listed value. Any standalone or online MD5 generator can be used for
this purpose (e.g. http://onlinemd5.com).

The process for upgrading firmware on a CP-3 or MC-31 is as

follows:

If no project is loaded then the Connection To RTU window will

appear. Specify the IP address of the Ethernet port that firmware
will be downloaded to. If a project is loaded then verify that the
correct RTU is selected.

The Select Firmware File window will appear. Select the firmware
file to download into the CP-3 or MC-31. This will have a name
such as CP30_MC31_firmware_v6793.tgz.

The following operations will then occur automatically:

1. The firmware package will be downloaded to the RTU
2. The RTU will extract and process the files, then restart

238 B0780AF, Rev M

Chapter 15: Download FoxRTU Station User's Guide

3. FoxRTU Station will reconnect to the RTU and confirm that the update was
successful.

Assuming an Ethernet link, this process will typically take around 5 minutes to complete.

Note: If you are upgrading or downgrading to an older firmware version (earlier than 4165)
then the procedure is the same, but you may notice that the RTU restarts multiple times.

Note: While upgrading the RTU (CP-3) firmware to FW4408 or later you may observe the
MC-31 reboot in non – redundant RTU configurations.

If your only connection to the RTU is via an MC-31, then the CP-3 firmware can still be
upgraded by selecting the FoxRTU protocol (if you use SSH then you will actually upgrade
the MC-31 firmware).

Upgrading Redundant Processor Systems

For a system with redundant CP-3 processors, you will need to upgrade the firmware for
each processor separately.

When upgrading firmware using the default SSH protocol, the upgrade will occur regardless
of whether the processor you are upgrading is currently the active or standby processor. In
fact, if the CP-3 is the active processor then when it restarts after processing the first part of
the upgrade it will come up as the standby, because the other CP-3 will have taken over
during the restart. This must not affect the upgrade process.

Before starting the download, verify that you are connected to the correct processor. The
procedure is the same as for configuration download, see Downloading Configurations.

Note: If you are upgrading or downgrading a CP-3 in a redundant processor system to an

older firmware version (earlier than 4165), and doing so via an MC-31 port, it is essential that
the other CP-3 is removed from the RTU during the upgrade. Otherwise, after the first part of
the upgrade the other CP-3 will assume control, and the second part of the upgrade package
will be directed to it (as the active RTU processor) rather than the CP-3 that is being
upgraded. This will cause the upgrade to fail.

Downloading Firmware via SCADA

As well as RTU configuration, it is also possible to download and install new RTU firmware
via a SCADA system and existing DNP3 communications infrastructure. Contact support for
more details on using this method.

B0780AF, Rev M 239

FoxRTU Station User's Guide Chapter 16: Viewing Data

Chapter 16: Viewing Data

Status
The Status command reads the following information from the selected RTU:
• Basic details including RTU address and firmware version
• Current RTU Date and Time. This can also be set.
• Status of all detected I/O modules
• Communications statistics

Note that in order for the status request to be successful:

• The connection parameters (IP address or serial baud rate) must match the current
actual settings in the RTU, and
• The RTU address in the configuration must match the RTU’s current actual
address.
• If the RTU has been secured then either the correct project must be open in
FoxRTU Station, or you must enter valid username and password when prompted
by the RTU.

If the RTU’s IP address or RTU address are not known then the Discovery command may be
used. Failing that, the CP-3 can be reset to factory settings (address 1, IP 192.168.0.1) as
described in Factory Reset.

To perform a status request, click the Status toolbar button. If no RTU is selected then you
will be prompted for the IP address to use.

On the General tab:

RTU Address: The address of the currently

connected RTU (1-65520)

Build Number: Firmware version number

User Flash Free (KB): The amount of free non-

volatile memory available in the RTU

Installed components: Not used.

Refresh: Re-reads the information from the RTU.

240 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

On the Date & Time tab:

Current RTU Time: The current RTU time is

displayed here, updated once per second, in the
configured RTU time zone (if set).

Current PC Time: The current PC local time is

displayed here, updated once per second.

Custom Time: A custom date/time may be

entered here. Click on the required time
component, then type a new value or use the
up/down arrow buttons. The entered time is
assumed to be in the RTU’s time zone.

Set RTU to PC Time: If Current PC Time is

selected, this will set the RTU time to the current
PC time (allowing for any time zone difference),
which should immediately update the Current
RTU Time field (see note below).

Set RTU to Custom Time: If Custom Time is

selected, this will set the RTU time to the
specified time, which should immediately update
the Current RTU Time field (see note below).

Note: The time zone indicators (e.g.

“UTC+10:00”) will only be displayed if the RTU
time zone has been set.

Note: If the RTU time is changed by less than 10

seconds then the RTU will not change the time
immediately; rather, it will very gradually adjust
the time over the next few hours. This avoids
sudden time steps in logged events.

B0780AF, Rev M 241

FoxRTU Station User's Guide Chapter 16: Viewing Data

On the Modules tab:

Slot: Slot number (1-64) containing a detected

module.

Module: Module type

Version: Module firmware version

Details: Displays context specific details of the

currently selected module. The information
presented will depend on the type of module.

Refresh: Re-scans the RTU for additional

modules. After installing or removing a module,
allow several seconds for the firmware to detect
the change, before pressing Refresh.

Sample module details display:

For an IO-3 module, the module status display

shows the state of the 4 digital inputs, current
readings for the 4 analog inputs, and provides
buttons for toggling the 4 digital outputs and a
field for setting the analog output level.

242 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

On the RTU Statistics tab:

This shows communications statistics recorded

by the selected RTU. The statistics are the same
as those reported by the
FOX_GET_COMM_STATS function block.

RTU Addresses: Statistics will be shown for

communications attempted between the selected
RTU and each RTU address in this list. An
address of 0 will return aggregate statistics
across all RTUs.

Find: Update displayed statistics.

Continuous: Continuously update displayed

statistics.

B0780AF, Rev M 243

FoxRTU Station User's Guide Chapter 16: Viewing Data

Event Logs
Events allow the RTU to record time and date stamped data. An event is recorded when:
• The FOX_EVENT_LOG function block is executed.
• A class 1, 2 or 3 DNP3 variable changes in value. For analog inputs, the change
must exceed the configured dead band.
• DNP3 events are received from another RTU, e.g. in response to a DNP3 class
1/2/3 poll request.
• Other events are received from another RTU, e.g. in response to a FoxRTU
protocol event log request
• Events are read from a digital input module that supports Sequence-Of-Events
recording (e.g. DI-10)

The number of events that can be recorded in the RTU memory is configurable on the RTU
Properties dialog (max. 100,000 events).

Events stored in the RTU can be retrieved and viewed using FoxRTU Station (as described
below). DNP3 events can also be retrieved by a DNP3 master device, using the DNP3
protocol. The RTU can track event retrieval and confirmation for up to 4 different DNP3
master addresses.

Viewing Event Logs

To retrieve and view event logs:
• Select the RTU name in the navigation pane
• Select Event Log in the Stacked Menu Bar
• Select the Retrieve button
• Specify whether to retrieve All Events or the number of newest events to retrieve

244 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

Event Log Buttons

Apply Filter: Applies the configured filter settings when retrieving event logs, so that only
those matching the filter will be retrieved.

Count: Queries the number of event logs currently stored in the RTU and displays the result
(to the right of the Cancel button).

Filter: Configures the filter settings

Retrieve: Retrieves event logs from the RTU. This can retrieve all events or a configurable
number of events.

Export: Saves the uploaded event logs into a CSV file (can be opened using Microsoft
Excel).

Clear: Clears all the event logs in the RTU.

Cancel: Only available while retrieving event logs. Stops the uploading of event logs.

Event Log Parameters

Retrieved event logs are listed in column format, e.g.:

The various parameters that make up an event log are listed below.

Id: Unique index assigned to each event log by the RTU.

Timestamp: Date and time of the event log.

RTU: Address of the RTU that created the event log.

Name: Name of the variable that was logged.

Value: Value of the variable when logged.

Flags: Additional information available when using DNP3.

Type: Configured type of the event log. For DNP3, this is the event variation.

Priority: Configured priority of the event log. For DNP3, this is the event class.

B0780AF, Rev M 245

FoxRTU Station User's Guide Chapter 16: Viewing Data

Event Log Filter

To configure the Event Log Filter
• Select the RTU name in the navigation pane
• Select Event Log in the Stacked Menu Bar
• Select the Filter button
• Specify the General settings of the event logs to upload
• Select the Date Range tab to specify time and date settings of the event logs to
upload
• Enable the filter by ticking Apply Filter.
• Select the Retrieve button to upload event logs that correspond to the filter settings

The event filter settings are shown below:

Max Number: (0 – 65535) Maximum number of

event logs to retrieve (0=all)

RTU: (1-65520) Only event logs created by this

RTU will be retrieved (0=all).

Type: (0-31) Only event logs matching this Type

setting will be retrieved.

Priority: (0-7) Only event logs matching this

Priority setting will be retrieved.

Range Start: The date and time of the oldest

event log to retrieve.

Range Finish: The date and time of the newest

event log to retrieve.

246 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

Range Start/Range Finish:

Setting these dates allows users to isolate a time
period. Users can select a date in the calendar,
then select the buttons to update the start/finish
date.

Clear Current:
Sets the selected range to the start of the event
log index

Update Current:
Sets the selected rage to the current date

Range Start/Range Finish

These textboxes are the summary of the
requested period. Values of “01.01.1970” indicate
“any date”.

Web Interface

Overview
The RTU supports a simple web interface. This can be useful in situations where FoxRTU
Station and/or ISaGRAF are not available. Using a standard web browser, you can:
• View RTU status information
• Retrieve a service report
• View selected ISaGRAF variable values
• View a summary of the RTU configuration

Note that the web interface provides a read-only view of the RTU. It is not possible to
change any RTU settings via this interface.

Note: The web interface does not support encryption or user authentication, so it is
recommended that it only be enabled and used on a secure network.

Using the Web Interface

The web interface will only be accessible if the HTTP protocol is enabled on one or more
CP-3 Ethernet ports (MC31 ports are not supported).

Note also that JavaScript must be enabled in your web browser (it will normally be enabled
by default).

B0780AF, Rev M 247

FoxRTU Station User's Guide Chapter 16: Viewing Data

For Internet Explorer users, please note the following:

• IE version 10 and earlier are not supported
• In IE version 11, go to Settings / Compatibility View Settings and uncheck the
Display intranet sites in Compatibility View option.

To view the web interface, verify that your computer has a network connection to the CP-3,
then enter the RTU IP address (and TCP port number, if set to something other than 80) into
a web browser, as follows: http://ip-address:tcp-port.

The web interface comprises three information pages which are accessed by clicking the
“tabs” at the top of the web page.

When you first connect to the RTU the RTU Status page should be displayed.

RTU Status
This page displays some useful details about the current state of the RTU:

248 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

This page shows:

• The type and hardware revision of the processor module
• Backplane slot number (1-64) of the processor module
• Firmware version number
• Current date/time, and configured time zone offset
• Time since last restart (uptime)
• In a redundant processor system, whether the CP-3 is currently operating in Active
or Standby mode
• The number of events that have been logged
• Amount of free space in memory (RAM)
• Amount of free space in the file system (flash memory)
• A list of currently detected modules. Note that any module placed in an
unconfigured slot will not be detected, as unconfigured slots are not scanned.

Click the Refresh RTU Status button to update all displayed values.

Click the Retrieve Service Report button to download a full diagnostic service report. This is
the same as the one which can be downloaded using the Tools menu in FoxRTU Station.

The service report will be downloaded as a text file (UNIX format). The browser will normally
offer the option of saving this file or opening it in a text editor.

ISaGRAF Variables
The ISaGRAF Variables page provides a snapshot of current ISaGRAF variable values.

The set of variables to display is controlled by the Query field at the top of the page. By
default, this is set to “*”, which will select all available variables.

Press Submit to display the current values of the selected variables.

B0780AF, Rev M 249

FoxRTU Station User's Guide Chapter 16: Viewing Data

The table shows the variable name, value and, in some cases, a status indicator. The status
is shown for IOPOINT_x variables, including DNP3 and I/O module points. “OK” indicates
that the ONLINE flag bit is set. For I/O module points this indicates that the module is
physically present.

Query strings can include the “?” and “*” wildcard characters. A “?” represents one character,
which can have any value, while “*” represents any string of zero or more characters.

Multiple query strings can be entered, separated by a space.

For example:
• To display all DNP analog input variables enter: DNPAI*
• To display all Modbus variables and all variables for the I/O module in slot 7, enter:
MOD* SL07*
• To display variables PUMP1_STAT ,PUMP2_STAT and PUMP3_STAT, enter
PUMP?_STAT
• To display all variables, enter: *

To refresh the displayed values, simply press Submit again.

250 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

Note that:
• Only global variables will be displayed
• Variables with complex types (e.g. arrays, or structures other than IOPOINT_x) will
not be displayed.
• ISaGRAF variable names are not case sensitive – all variable names will be
displayed in upper case.

Use the Dictionary screen in ISaGRAF online/debug mode to view live values for any
variable.

RTU Configuration
This page gives a summary of the RTU configuration settings.

This page shows:

• Configured RTU/DNP3 address
• Configured RTU name
• Configured ISaGRAF cycle time
• Configured storage size for events

B0780AF, Rev M 251

FoxRTU Station User's Guide Chapter 16: Viewing Data

• Details for all configured modules. Note that this page shows all modules that have
been defined in the configuration, whereas the list on the RTU Status page shows
the list of modules that were actually detected.

RTU Time Zone

The RTU incorporates a battery backed real time clock (RTC), which keeps track of the
current calendar time. This is used to timestamp events, and may also be tested in logic to
perform actions at particular times of day.

The RTU time can be set using the Date & Time tab on the RTU Status window, or via a
DNP3 message from a SCADA system. It can also be synchronized to an NTP (Network
Time Protocol) server or a GPS receiver connected to a DI-10-GPS module.

By default, the RTU time is not assumed to be in any particular time zone – that is, the time
zone is “unspecified”. This means that:
• If you set the RTU time using FoxRTU Station, the current local PC time will be sent
to the RTU unmodified.
• Events written to the event log, or transmitted via DNP3, will be timestamped using
the current RTU time. When viewing events in FoxRTU Station or a SCADA
system, the user needs to be aware of what time zone was used when the RTU
time was set.
• If the RTU is configured to synchronize it’s time to an absolute time reference (e.g.
NTP, GPS), the RTU time will need to operate using UTC (Coordinated Universal
Time, which is essentially equivalent to Greenwich Mean Time). All event
timestamps will then be displayed in UTC.
To help prevent any ambiguity when interpreting timestamps, it is recommended that a time
zone be configured for the RTU, using the RTU Properties dialog. If a time zone is set:
• The RTU system time will internally operate in UTC. All events (including DNP3
events) will therefore be stored and transmitted with UTC timestamps.
• If you set the RTU time using FoxRTU Station, the current local PC time (or the
custom time that you enter) will be automatically converted to UTC before being
sent to the RTU.
• When setting the RTU time using FoxRTU Station, the current RTU time will be
displayed using the configured RTU time zone.
• In FoxRTU Station, event timestamps will be displayed using the configured RTU
time zone.
• Times displayed on the Date & Time tab and in the event log will include a time
zone indicator, e.g. “UTC+10:00” (which indicates that the time zone is 10 hours
ahead of UTC).
• An absolute time reference (e.g. NTP, GPS) may be used to correct the RTU time.
This will not affect how times are displayed in FoxRTU Station.
• The FOX_GET_TIME function block will return the current time in the RTU’s
configured time zone.
• The FOX_GET_RTC function block returns the number of seconds since 00:00
UTC, 1 Jan 1970. This is therefore not affected by the RTU time zone setting.

252 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

Note that the configured RTU time zone is always a fixed offset from UTC. That is, it
represents standard time; no adjustment will be made for daylight saving. Keep this in mind
when viewing event timestamps, and if you use FOX_GET_TIME to trigger actions at
particular times of day.

If the firmware of the currently connected RTU does not support the timezone feature,
FoxRTU Station will ignore the configured RTU time zone and treat it as if it were set to
“unspecified”.

Note: If you change an RTU’s configuration from one where the timezone is unspecified to
one where it is specified, it is likely that the RTU system time will appear to be incorrect after
the change. This is because the internal system time (previously set to local time) is now
being interpreted as UTC. To correct this, simply set the time using FoxRTU Station, as
described above.

B0780AF, Rev M 253

FoxRTU Station User's Guide Chapter 16: Viewing Data

Communications
When troubleshooting RTU systems, it is frequently very helpful to be able to capture the
actual message packets that are being sent and received. If a problem with the RTU is
suspected the capture files can be forwarded to our support team for analysis.

Two main tools are generally used for this purpose:

• FoxRTU Station Comms Analyzer feature
• Wireshark – a free and widely used packet capture PC application.

In general terms, Wireshark is more powerful, but Comms Analyzer can be used in a wider
range of scenarios.

Comms Analyzer
Overview
The FoxRTU Station Comms Analyzer works as follows:
1. The selected RTU is instructed to start capturing communications messages on a
particular port.
2. From that point on, each time a message is sent or received, the information is
returned to FoxRTU Station, using a separate RTU port to the one being
monitored.
3. FoxRTU Station saves the received packets and allows them to be viewed.

The main limitations of Comms Analyzer are:

• It is not possible to capture traffic on the physical RTU port that is being used to
connect to FoxRTU Station
• Only basic packet decoding is performed (Wireshark’s packet decoding is much
more extensive)
• There is a performance impact on the RTU being monitored and on the
communications link between that RTU and FoxRTU Station, while capture is
enabled.

Using Comms Analyzer

To use Comms Analyzer, first select the RTU in the navigation pane, then click Comms
Analyzer in the Stacked Menu Bar.

The controls for the Comms Analyzer are at the top of the workspace:

Port: This contains a list of all defined ports in the RTU. Select the one for which you want
to capture traffic. Remember that it is not possible to capture traffic on the port that FoxRTU
Station is using to communicate with the RTU.

Start: Start capture on the selected port. This button changes to Stop while capture is in
progress.

254 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

Export: Saves some or all the captured packets in CSV format. The generated file can then
be opened in a text editor or spreadsheet application.

Clear: Deletes all captured packets.

Options: Allows several settings to be adjusted:

The following tabs are available:

Capture File: If Enable file capture is ticked then

packet data will be continuously saved to capture
files. This is useful if you need to leave the Comms
Analyzer running for a long period of time to capture
a rare event.

Columns: Allows some of the columns to be hidden

Message: Specifies how the various components

listed in the Message column are separated

Hexadecimal: Specifies how the hexadecimal

message data is formatted

Alphanumeric: Specifies how the alphanumeric

message data is formatted

Other: Various other cosmetic display adjustments

To start capturing, click Start. Note that while capture is active an animated overlay is shown
on the RTU’s icon in the navigation pane.

A typical Comms Analyzer display is shown below:

This shows:
• An entry indicating the time at which capture was started, and the port being
monitored
• Two incoming DNP3 polls from a master (address 111) to the local RTU (address
1), and the responses sent by the RTU.

B0780AF, Rev M 255

FoxRTU Station User's Guide Chapter 16: Viewing Data

The Message column provides a basic decode of the message. Note that it does not
necessarily list everything you need to know about the message. For example, for a DNP3
message it lists the header fields and the first data object only.

The yellow highlight indicates that the packet is selected. By clicking on rows in conjunction
with the Shift and Ctrl keys, you can select a range of packets, which can then be exported
using the Export button.

Wireshark
Overview
Wireshark is a PC-based application which can capture all traffic sent or received by the
PC’s Ethernet interfaces. It has extensive packet filtering capabilities, and can decode many
different protocols.

256 B0780AF, Rev M

Chapter 16: Viewing Data FoxRTU Station User's Guide

The main limitations of Wireshark are:

• It can only capture Ethernet traffic.
• It can only capture traffic that is received or sent by the PC. Normally this means
that it can only capture traffic sent to or by the PC. However, by using an Ethernet
hub it is possible for the PC to “snoop” on Ethernet traffic sent from one RTU to
another.

Snooping
In a modern Ethernet network, each device (PC, RTU, etc.) is normally connected to an
Ethernet switch or router. The switch or router examines each packet that passes through it
and directs it to the appropriate destination device. This means that if two RTUs and a PC
are all connected to an Ethernet switch or router, then the communications between the two
RTUs will be invisible to the PC, which means that Wireshark will not be able to capture
them.

However, there is an older technology which can be used to connect devices on an Ethernet
network, called a hub. Hubs broadcast each received packet to all connected devices. The
devices will normally discard anything not addressed to them, with the exception of tools
such as Wireshark, which can capture them.

The following diagram shows how a hub can be temporarily added to a network to allow
Ethernet traffic sent between two RTUs to be captured.

RTU 1 RTU 2

Ethernet Switch

RTU 1 RTU 2

Ethernet Switch Non-switching HUB

In the top diagram, RTU1 and RTU2 are connected via an Ethernet switch, so the PC will not
receive (and will therefore not be able to capture) any traffic except that addressed to it.

In the bottom diagram, RTU1 has been unplugged from the switch and plugged into a hub
instead. The hub is also connected to the PC and to rest of the network via the switch. In this
configuration, anything sent to or from RTU1 (including traffic directed to RTU2) will be
visible to the PC and will be able to be captured by Wireshark.

B0780AF, Rev M 257

FoxRTU Station User's Guide Chapter 16: Viewing Data

Using Wireshark
Download Wireshark from www.wireshark.org and install on your PC, then start it as you
would any application.

The Wireshark website includes extensive documentation and tutorials. In general terms,
however the procedure is to first select the correct Ethernet interface (if your computer has
more than one) from the list on the Wireshark home screen, then press Start.

A typical Wireshark display is shown below:

This shows, from top to bottom:

• A list of all received or transmitted packets
• Details of the selected packet, with each protocol layer decoded (if possible)
• The raw data in the packet

258 B0780AF, Rev M

Appendix A: Glossary FoxRTU Station User's Guide

Appendix A: Glossary
A group of 8 bits. Each bit can be a 0 (off) or a 1 (on) allowing up to 256
Byte combinations.
Processor module. Runs the Linux operating system and supports
CP-3 ISaGRAF.
Set of variables available for use in logic programs or to be polled by a
Dictionary remote RTU.
A sporadic message initiated by a slave RTU to another RTU (usually to the
Exception report master) to report new data or a significant event.
A block of code that can be executed by an ISaGRAF logic program.
Examples of function blocks include AGA gas calculations, hardware
Function block
configuration and communication messages.
Input/Output
I/O
The device that is responsible for the collection, concentration and ultimate
reporting of information from local and remote devices. The Master device
Master
may be an RTU or a PC running SCADA software. The master device is
usually responsible for initiating communications with slave devices (polling)
but may also accept unsolicited messages from local and remote devices.
A periodic message initiated by the master RTU to get the latest data and
Poll check the state of communications to a remote RTU.
A physical connection or socket on an RTU used for communications
Port
A number which identifies a particular protocol or service provided over a
TCP/IP network. For example, a DNP3 slave will respond to connections to
Port (TCP/IP)
port 20000.
Refers to the format of messages that may be passed to, from and through
an RTU in communication with local and remote devices. Communications
Protocol may use one or more RTU ports. Examples of protocols used within
telemetry include FoxRTU, Modbus and DNP3.
Remote Telemetry Unit. A system of processor, communication and I/O
modules that monitor and control of hardware and devices in remote
RTU
locations.
A device that is responsible for the collection of I/O and other information.
This data can then be polled or exception reported to a master device. A
Slave
slave may be an RTU or another device.
Transmission Control Protocol / Internet Protocol. A networking protocol
used when communicating via Ethernet. Many telemetry protocols e.g.
TCP/IP FoxRTU, Modbus/TCP and DNP3 can use TCP/IP as the basic transport
mechanism.

B0780AF, Rev M 259

FoxRTU Station User's Guide Appendix B: Creating Variables Using Excel

Appendix B: Creating Variables Using Excel

Dictionary variables in an RTU configuration can be exported to a Microsoft Excel
spreadsheet. Variables can then be edited and created using Excel. When the changes are
complete, the spreadsheet is imported back into the RTU configuration, overwriting any
existing variables. This method can be very useful for creating large quantities of variables
with custom settings.

Exporting Variables
Select the RTU name in the navigation pane containing the
variables to export

Select File  Export  To Excel

Select a folder and filename to export the variables to

Importing Variables

Select the RTU name in the navigation pane to store the

imported variables in

Select File  Import  From Excel

Select the Excel spreadsheet (<Filename>.xls) to import the

variables from.

Note: the spreadsheet must have the same columns as the

spreadsheet created by the Export function above.

Importing Notes:
• Before importing variables from an Excel spreadsheet into an RTU configuration,
FoxRTU Station extensively checks the spreadsheet for detected errors. If there are
any detected errors, all variables will not be imported.
• When importing I/O variables, the corresponding I/O module must already exist in
the RTU configuration. If an I/O variable is assigned to a slot or channel that is not
already defined in the RTU configuration, variables will not be imported.
• When detected errors are displayed, the row number in the spreadsheet is also
displayed so that the detected error can be located. Examples:

260 B0780AF, Rev M

Appendix B: Creating Variables Using Excel FoxRTU Station User's Guide

Rows containing a blank SymbolName (variable name) are ignored.

Spreadsheet Format
The spreadsheet is divided into four sections of columns as follows:

The white columns (A to M) contain basic variable parameters

The orange, yellow, green and light blue columns (N to X) contain optional I/O point
parameters if the variable is to be linked to an I/O Point

The blue columns (Y to AH) contain optional parameters for DNP3 variables.

The green column (AI) is not used. Columns AJ onwards will be ignored when the
spreadsheet is imported back into FoxRTU Station.

B0780AF, Rev M 261

FoxRTU Station User's Guide Appendix B: Creating Variables Using Excel

Spreadsheet Parameters
Parameter Description Notes
SymbolName The variable name See Variable Names. Any rows with
blank SymbolName will be ignored on
import.
Comment A comment for the variable Max 128 characters
SymbolType The data type Must be a valid type name, see
ISaGRAF Variable Types
Scope Describes where this variable The text must be either:
is available for use The word Global, which indicates that
the variable can be used in all
Functions, Function Blocks and
Programs, or the name of a specific
Function, Function Block or Program
that the Variable can only be used in
StringSize The maximum number of If the variable is not a String, the value
characters in a String variable must be 0
Attribute A Read Only, Write Only or Must be: Read, Write or Free (read and
Read and Write variable write)
Direction Describes the flow of I/O data If this is not attached to an I/O Point, the
value must be Internal. Otherwise, the
value must be Input or Output
Group The dictionary Group Max 128 characters. If the Group does
not already exist, a new Group will be
created.
Retain Retain variable value after a Set Retain to 1 to retain the variable
reboot value after a reboot of the RTU.
Otherwise set to 0.
InitialValue An initial value for the variable The format of InitialValue depends on
its SymbolType. Array values are
entered as values separated by
commas – example: 2, 3, 4. Strings are
entered as text in single quotations –
example: ‘This is a string’
Array Array variables Allows multidimensional arrays to be
specified
Alias not used
Library ISaGRAF Library Allows reference to ISaGRAF library
variables
IOType The type of I/O Point For I/O points, must be: AI, AO, DI, or
DO, blank if not an I/O point
Controls Output control bits DNP3 binary output control settings
(bitmask), or -1 if not DNPBO variable
Slot The slot of the I/O Point 1-64, or -1 if not an I/O point
module
Card The number of the Option Card 1 for I/O point, -1 for other variable
on the Module
Channel The I/O channel number For I/O points, channel number within
I/O module, -1 if not an I/O point
SlotTrip

262 B0780AF, Rev M

Appendix B: Creating Variables Using Excel FoxRTU Station User's Guide

CardTrip Selects I/O point to perform Only for DNPBO variables configured
ChannelTrip ‘trip’ operation for paired (trip/close) operation.

SlotClose Selects I/O point to perform Only for DNPBO variables configured
CardClose ‘close’ operation for paired (trip/close) operation.

ChannelClose
DnpClass The Class of the DNP variable 0-3, or -1 if not a DNP variable
DnpFrozenClass Frozen Class 0-3, or -1 if not a DNP variable
DnpStaticVariation Static Variation 1-6 (depending on type), or -1 if not a
DNP variable.
DnpFrozen- Frozen Static Variation 1, 2, 5, 6, 9, 10, or -1 if not a DNPBC
StaticVariation variable
DnpEventVariation Event Variation 1-7 (depending on type), or -1 if not a
DNP variable.
DnpFrozen- Frozen Event Variation 1, 2, 5, 6, or -1 if not a DNPBC variable
EventVariation
DnpDeadband The change in value required Either a percentage value or a raw
to trigger an Event value depending on setting of
DnpHighLimit Highest value allowed for this DnpRawLimits
variable
DnpLowLimit Lowest value allowed for this
variable
DnpRawLimits Percentage or Raw values 0 = Percentage, 1 = Raw.
DnpDefaultOnline Initial state of the DNP3 online 0 = offline, 1 = online
flag Ignored for hardware-mapped points
IecGroup not used

B0780AF, Rev M 263

FoxRTU Station User's Guide Appendix C: Protocol Support

Appendix C: Protocol Support

This section describes the extent to which certain communication protocols are supported by
the RTU.

Modbus Slave
The following table lists the commands that a slave RTU will accept. Unless otherwise noted,
these are applicable for Modbus/TCP, Modbus/RTU and Modbus/ASCII protocols.
Code Function Notes
1 Read coils Returns values of MODCn variables
2 Read discrete inputs Returns values of MODDn variables
3 Read holding registers Returns values of MODHn variables
4 Read input registers Returns values of MODIn variables
5 Write single coil Writes to one MODCn variable
6 Write single register Writes to one MODHn variable
8 Diagnostics (requires recent firmware)
See below for supported sub-functions
15 Write multiple coils Writes to multiple MODCn variables
16 Write multiple registers Writes to multiple MODHn variables
22 Mask write register Writes to specific bits within a MODHn variable
23 Read/write multiple registers Write to multiple MODHn variables, then read from
multiple MODHn variables

Diagnostic (function code 8) sub-functions are supported as detailed below:

Code Function Notes
0 Echo received data Returns exact copy of request
1 Restart comms Cancels listen-only mode
2 Return diagnostic register Returns 0
3 Change ASCII delimiter Set Modbus/ASCII delimiter (default LF)
4 Force listen only Do not respond to any further messages, except
Restart Comms
10 Clear all stats counters Clears all stats counters
11 Get bus message count Returns RX message count
12 Get bus error count Returns CRC error count
13 Get bus exception count Returns RX message count
14 Get slave message count Returns RX message count
15 Get slave no-response count Returns no-response count
16 Get slave NAK count Returns exception response count
17 Get slave busy count Returns 0
18 Get bus overrun count Returns 0
20 Clear overrun count Clears all stats counters

264 B0780AF, Rev M

Appendix C: Protocol Support FoxRTU Station User's Guide

Modbus Master
When the RTU is operating as a Modbus master, the MODBUS function block is used to
send requests to a slave device. The supported message function codes are listed in the
Supported function codes table. These functions are supported for the Modbus/TCP,
Modbus/RTU and Modbus/ASCII protocols.

DNP3 Master and Slave

Refer to the document DNP Device Profile CP-30, available for download from the Global
Customer Support website.

B0780AF, Rev M 265

FoxRTU Station User's Guide Appendix D: RTU Variables

Appendix D: RTU Variables

All data in SCD2200 RTUs are stored as named variables. Space is automatically allocated
in RTU memory according to the number of variables that are created and the size of each
variable. The set of defined variables is called the dictionary.

ISaGRAF programs can use any variables that have been created in the dictionary.

Variables fall into one of three categories:

• Variables which are automatically created when an I/O module is added to the
RTU. The following sections describe the variables which are created for each of
the various I/O module types.
• Manually created variables which follow a particular naming convention. These
variables can be transferred to and from other systems using particular
communications protocols.
• Manually created user variables, for holding temporary values and performing
calculations.

SCD2200 Modular RTU I/O Modules

When an I/O module is added to an RTU, variables are automatically created in the
dictionary that correspond to each input, output and data register (e.g. counter) available
from that module.

These variables are named: SLssmmmmttnn, where:

• SL is a fixed prefix (“slot”)
• ss is the slot number (01-64)
• mmmm is the module type, e.g. AI1, DI10
• tt is the type of I/O point, e.g. AI for analog inputs, DO for digital outputs
• nn is the I/O point number (1, 2, 3…)

The following sections list the automatically created variables for each I/O module type.

All I/O variables have either IOPOINT_B (for digital inputs/outputs) or IOPOINT_D (for
analog inputs/outputs and counters) data type.

AI-10
8 channel bipolar analog input module with over range flags
Data Description Variable Name R/W Notes
Analog Input Ch1 SLssAI10AI1 R Raw scale: -32768 to +32767
Analog Input Ch2 SLssAI10AI2 R
Analog Input Ch3 SLssAI10AI3 R
Analog Input Ch4 SLssAI10AI4 R
Analog Input Ch5 SLssAI10AI5 R
Analog Input Ch6 SLssAI10AI6 R

266 B0780AF, Rev M

Appendix D: RTU Variables FoxRTU Station User's Guide

Analog Input Ch7 SLssAI10AI7 R

Analog Input Ch8 SLssAI10AI8 R
Ch1 Under Range Flag SLssAI10DI1 R Set to TRUE when input current or
Ch2 Under Range Flag SLssAI10DI2 R voltage is below the minimum value.

Ch3 Under Range Flag SLssAI10DI3 R

Ch4 Under Range Flag SLssAI10DI4 R
Ch5 Under Range Flag SLssAI10DI5 R
Ch6 Under Range Flag SLssAI10DI6 R
Ch7 Under Range Flag SLssAI10DI7 R
Ch8 Under Range Flag SLssAI10DI8 R
Ch1 Over Range Flag SLssAI10DI9 R Set to TRUE when input current or
Ch2 Over Range Flag SLssAI10DI10 R voltage is above the maximum value.

Ch3 Over Range Flag SLssAI10DI11 R

Ch4 Over Range Flag SLssAI10DI12 R
Ch5 Over Range Flag SLssAI10DI13 R
Ch6 Over Range Flag SLssAI10DI14 R
Ch7 Over Range Flag SLssAI10DI15 R
Ch8 Over Range Flag SLssAI10DI16 R

AO-2
4 channel analog output module
Data Description Variable Name R/W Notes
Analog Output Ch1 SLssAO2AO1 R/W Raw scale 0-32760 = 0-100%
Analog Output Ch2 SLssAO2AO2 R/W
Analog Output Ch3 SLssAO2AO3 R/W
Analog Output Ch4 SLssAO2AO4 R/W

AO-3
4 channel analog output modules with open loop detection
Data Description Variable Name R/W Notes
Analog Output Ch1 SLssAO3AO1 R/W Raw scale 0-32760 = 0-100%
Analog Output Ch2 SLssAO3AO2 R/W
Analog Output Ch3 SLssAO3AO3 R/W
Analog Output Ch4 SLssAO3AO4 R/W
Ch1 Open Loop SLssAO3DI1 R 1 = Open Loop
Ch2 Open Loop SLssAO3DI2 R
Ch3 Open Loop SLssAO3DI3 R
Ch4 Open Loop SLssAO3DI4 R

B0780AF, Rev M 267

FoxRTU Station User's Guide Appendix D: RTU Variables

DI-5
16 channel digital input / 4 counter module
Data Description Variable Name R/W Notes
Digital Input Ch1 SLssDI5DI1 R The first 4 channels interface to
Digital Input Ch2 SLssDI5DI2 R hardware counters.
Channels 1 and 2 up to 10kHz.
Digital Input Ch3 SLssDI5DI3 R Channels 3 & 4 up to 255Hz.
Digital Input Ch4 SLssDI5DI4 R
Digital Input Ch5 SLssDI5DI5 R If the maximum pulse rate is exceeded
on channels 3 and 4 (>255 Hz), each
Digital Input Ch6 SLssDI5DI6 R counter will contain the lowest 8 bits of
Digital Input Ch7 SLssDI5DI7 R the actual pulse rate. Results are
Digital Input Ch8 SLssDI5DI8 R unpredictable at pulse rates greater than
1 kHz
Digital Input Ch9 SLssDI5DI9 R
Digital Input Ch10 SLssDI5DI10 R
Digital Input Ch11 SLssDI5DI11 R
Digital Input Ch12 SLssDI5DI12 R
Digital Input Ch13 SLssDI5DI13 R
Digital Input Ch14 SLssDI5DI14 R
Digital Input Ch15 SLssDI5DI15 R
Digital Input Ch16 SLssDI5DI16 R
Ch1 Total Pulses SLssDI5AI1 R/W
Ch2 Total Pulses SLssDI5AI2 R/W
Ch3 Total Pulses SLssDI5AI3 R/W
Ch4 Total Pulses SLssDI5AI4 R/W
Ch1 Pulse Rate Hz SLssDI5AI5 R/W
Ch2 Pulse Rate Hz SLssDI5AI6 R/W
Ch3 Pulse Rate Hz SLssDI5AI7 R/W
Ch4 Pulse Rate Hz SLssDI5AI8 R/W

DI-10
16 channel digital input / 7 counter module with event time-stamping
Data Description Variable Name R/W Notes
Digital Input Ch1 SLssDI10DI1 R Has configurable Frequency or Pulse or
Digital Input Ch2 SLssDI10DI2 R Quadrature counting and Sequence-of-
Events recording (using event logs).
Digital Input Ch3 SLssDI10DI3 R
Digital Input Ch4 SLssDI10DI4 R Counters 1-7 can count Frequency (0-
Digital Input Ch5 SLssDI10DI5 R 10kHz max.) or Total Pulses (0-65535) or
Quadrature Count (0-65535) for any
Digital Input Ch6 SLssDI10DI6 R configured channel(s) (as configured
Digital Input Ch7 SLssDI10DI7 R using FoxRTU Station)
Digital Input Ch8 SLssDI10DI8 R
Digital Input Ch9 SLssDI10DI9 R

268 B0780AF, Rev M

Appendix D: RTU Variables FoxRTU Station User's Guide

Digital Input Ch10 SLssDI10DI10 R

Digital Input Ch11 SLssDI10DI11 R
Digital Input Ch12 SLssDI10DI12 R
Digital Input Ch13 SLssDI10DI13 R
Digital Input Ch14 SLssDI10DI14 R
Digital Input Ch15 SLssDI10DI15 R
Digital Input Ch16 SLssDI10DI16 R
Counter 1 SLssDI10AI1 R/W
Counter 2 SLssDI10AI2 R/W
Counter 3 SLssDI10AI3 R/W
Counter 4 SLssDI10AI4 R/W
Counter 5 SLssDI10AI5 R/W
Counter 6 SLssDI10AI6 R/W
Counter 7 SLssDI10AI7 R/W

DO-1
8 channel digital output module
Data Description Variable Name R/W Notes
Digital Output Ch1 SLssDO1DO1 R/W NA
Digital Output Ch2 SLssDO1DO2 R/W
Digital Output Ch3 SLssDO1DO3 R/W
Digital Output Ch4 SLssDO1DO4 R/W
Digital Output Ch5 SLssDO1DO5 R/W
Digital Output Ch6 SLssDO1DO6 R/W
Digital Output Ch7 SLssDO1DO7 R/W
Digital Output Ch8 SLssDO1DO8 R/W

DO-2/DO-6
16 channel digital output modules
Data Description Variable Name R/W Notes
Digital Output Ch1 SLssDO2DO1 R/W DO-2 has relays in the module
Digital Output Ch2 SLssDO2DO2 R/W DO-6 has transistor outputs for driving
an external relay board.
Digital Output Ch3 SLssDO2DO3 R/W
Digital Output Ch4 SLssDO2DO4 R/W
Digital Output Ch5 SLssDO2DO5 R/W
Digital Output Ch6 SLssDO2DO6 R/W
Digital Output Ch7 SLssDO2DO7 R/W
Digital Output Ch8 SLssDO2DO8 R/W
Digital Output Ch9 SLssDO2DO9 R/W
Digital Output Ch10 SLssDO2DO10 R/W
Digital Output Ch11 SLssDO2DO11 R/W

B0780AF, Rev M 269

FoxRTU Station User's Guide Appendix D: RTU Variables

Digital Output Ch12 SLssDO2DO12 R/W

Digital Output Ch13 SLssDO2DO13 R/W
Digital Output Ch14 SLssDO2DO14 R/W
Digital Output Ch15 SLssDO2DO15 R/W
Digital Output Ch16 SLssDO2DO16 R/W

IO-3
4 digital input / 4 digital output / 4 analog input / 1 analog output module
Data Description Variable Name R/W Notes
Digital Input Ch1 SLssIO3DI1 R Analog raw scale 0-32760 = 0-100%
Digital Input Ch2 SLssIO3DI2 R
Digital Input Ch3 SLssIO3DI3 R
Digital Input Ch4 SLssIO3DI4 R
Digital Output Ch1 SLssIO3DO1 R/W
Digital Output Ch2 SLssIO3DO2 R/W
Digital Output Ch3 SLssIO3DO3 R/W
Digital Output Ch4 SLssIO3DO4 R/W
Analog Input Ch1 SLssIO3AI1 R
Analog Input Ch2 SLssIO3AI2 R
Analog Input Ch3 SLssIO3AI3 R
Analog Input Ch4 SLssIO3AI4 R
Analog Output Ch1 SLssIO3AO1 R/W

IO-5
4 digital input / 4 digital output / 4 analog input / 4 counter module
Data Description Variable Name R/W Notes
Digital Input Ch1 SLssIO5DI1 R NA
Digital Input Ch2 SLssIO5DI2 R
Digital Input Ch3 SLssIO5DI3 R
Digital Input Ch4 SLssIO5DI4 R
Digital Output Ch1 SLssIO5DO1 R/W
Digital Output Ch2 SLssIO5DO2 R/W
Digital Output Ch3 SLssIO5DO3 R/W
Digital Output Ch4 SLssIO5DO4 R/W
Analog Input Ch1 SLssIO5AI1 R Analog raw scale 0-32760 = 0-100%
Analog Input Ch2 SLssIO5AI2 R
Analog Input Ch3 SLssIO5AI3 R
Analog Input Ch4 SLssIO5AI4 R
Digital Input Counter SLssIO5AI5 R NA
1

270 B0780AF, Rev M

Appendix D: RTU Variables FoxRTU Station User's Guide

Digital Input Counter SLssIO5AI6 R

2
Digital Input Counter SLssIO5AI7 R
3
Digital Input Counter SLssIO5AI8 R
4

PS-1x or PS-2x
Power supply modules
Data Description Variable Name R/W Notes
Supply Voltage SLssPS11AI1 R Raw Scale= 0-32736, Eng. Units=0 to 32.27V
The DC voltage supplied to the RTU modules on the
backplane (typically 12V) and used to charge the
battery. This voltage is sourced from the battery if
there is no input supply present.
Battery Current SLssPS11AI2 R Raw Scale=-32768 to 32736 (+4..+8,-8..+4 A)
Amps = ((raw+81936) mod 65536) * 16/65536 – 8
Positive = battery charging, negative = discharging
Total Current SLssPS11AI3 R Raw Scale=-32768 to 32736 (+4..+8,-8..+4 A)
Amps = ((raw+81936) mod 65536) * 16/65536 – 8
Total current supplied by the power supply to the
RTU modules and battery (always positive).
Battery SLssPS11AI4 R Raw Scale=-32768 to 32736 (+80..+140,-60..+80 °C)
Temperature °C = ((raw+78640) mod 65536) * 200/65536 – 60
Battery Type SLssPS11AI5 R 0 = Default, 1 = Lead-Acid, 2 = Ni-Cad
Battery Size SLssPS11AI6 R Battery Size (x 0.1AH) 0 to 250 = 0 to 25.0 AH Max.
Module SLssPS11AI7 R Raw Scale=-32768 to 32736 (+80..+140,-60..+80 °C)
Temperature °C = ((raw+78640) mod 65536) * 200/65536 - 60
Status (PS-x2 only) SLssPS11AI8 R Power supply status bits (requires recent firmware)
Bit 12 (mask 16#1000): 1 = Backplane +5V detected
fault
Other bits are reserved.
Power ON SLssPS11DI1 R 1 = AC (PS-1x) or DC (PS-2x) Power ON
AUX 24V Fail SLssPS11DI2 R 1 = Auxiliary 24V failure or not present
Battery Low SLssPS11DI3 R 0 = Battery low. Note: Active low.
This bit does not indicate if a battery is present as
Battery Low is cleared whenever the input supply is
active. If the input supply is OFF (i.e.
SLssPS11DI1=0), a battery is present if the RTU is
still running!
Power Supply Type SLssPS11DI4 R 1 = PS-2x, 0 = PS-1x
Float State SLssPS11DI5 R 1 = float state
Charge State SLssPS11DI6 R 1 = charge state
Boost State SLssPS11DI7 R 1 = boost state
Temperature SLssPS11DI8 R 1 = sensor error
Sensor Error
Manual Power SLssPS11DO1 R/W 0 = automatic control (default)
Control 1 = manual control. Allows manual control of Radio
and 24V power
Radio power OFF SLssPS11DO2 R/W 1 = radio OFF (if SLssPS11DO1=1)

B0780AF, Rev M 271

FoxRTU Station User's Guide Appendix D: RTU Variables

Aux 24V OFF SLssPS11DO3 R/W 1 = 24V OFF (if SLssPS11DO1=1)

FoxRTU Register Variables

FoxRTU local register variables are used to store 16-bit data values to be transferred
between RTUs using the FoxRTU, Allen Bradley DF1 or HART protocols.

Variables must be manually created in the Dictionary before they can be used in logic or
transferred via a protocol.

FoxRTU register variable names have the format: FOXrRn, where

• r is the address of the RTU from which the variable originated. If the variable
belongs to the local RTU then this is blank.
• n is the register number (1-2048)

Floating point FoxRTU registers (type REAL) may also be created, which are named
FOXrFn. These are only supported by the HART protocol, however.

In summary:
Variable Name Type Description
FOXrRn DINT FoxRTU integer register #n on RTU r
FOXrFn REAL FoxRTU floating point register #n on RTU r

For example, local FoxRTU register #315 would be named FOXR315, while register #210
retrieved from RTU 17 would be FOX17R210.

Modbus Variables
Modbus variables are used to store 1-bit or 16-bit data values to be transferred between
RTUs using the Modbus protocol.

Variables must be manually created in the Dictionary before they can be used in logic or
transferred via Modbus.

Modbus variable names have the format: MODrTn, where

• r is the address of the RTU from which the variable originated. If the variable
belongs to the local RTU then this is blank.
• T is the type of Modbus variable (see below)
• n is the register number (1-65535)

The following variable types may be created:

Variable Name Type Description
MODrCn BOOL Modbus coil #n on RTU r
MODrDn BOOL Modbus discrete input #n on RTU r
MODrHn DINT Modbus holding register #n on RTU r
MODrIn DINT Modbus input register #n on RTU r

For example, the variable for Modbus coil #22 on the local RTU would be named MODC22,
while Modbus input register #2 read from RTU 39 would be MOD39I2.

272 B0780AF, Rev M

Appendix D: RTU Variables FoxRTU Station User's Guide

Note that only the least significant byte of the RTU address (r) will be used in Modbus
messages. This means that two RTUs whose addresses have the same least significant
byte (e.g. addresses 3 and 259) cannot be connected on the same network if Modbus is to
be used.

Note also that some device documentation or SCADA systems identify the type of Modbus
point by adding a numeric prefix, e.g. holding registers are in the range 40001-49999 or
400001-465535. The point number (n) specified in the variable name must not include this
prefix digit, e.g. point 40006 would correspond to variable MODH6.

DNP3 Variables
DNP3 variables are used to store data values to be transferred between RTUs using the
DNP3 protocol.

Variables must be manually created in the Dictionary before they can be used in logic or
transferred via Modbus.

DNP3 variable names have the format: DNPrTn, where:

• r is the address of the RTU from which the variable originated. If the variable
belongs to the local RTU then this is blank.
• T is the type of DNP3 variable (see below)
• n is the register number (0-65535)

The following variable types may be created:

Variable Name Type Description
DNPrBIn IOPOINT_B Binary input #n on RTU r
DNPrBOn IOPOINT_B Binary output #n on RTU r
DNPrBCn IOPOINT_D Binary counter #n on RTU r
DNPrFCn IOPOINT_D Frozen counter #n on RTU r
DNPrAIn IOPOINT_D or Analog input #n on RTU r
IOPOINT_R
DNPrAOn IOPOINT_D or Analog output #n on RTU r
IOPOINT_R

For example, the variable for DNP3 binary input #0 on the local RTU would be named
DNPBI0, while DNP3 analog input #21 read from RTU 909 would be DNP909AI21.

DNP3 variables use the IOPOINT_x structure types, which include timestamp and flag
information as well as the actual data value.

DNP3 Internal Indication Register

The DNP3 protocol defines a 16-bit Internal Indication (IIN) register, which is used to return
status information as part of every response message sent by a slave device.

For reference, the IIN bit definitions are shown below:

B0780AF, Rev M 273

FoxRTU Station User's Guide Appendix D: RTU Variables

Bit Name Notes

15 (IIN1.7) DEVICE_RESTART Set ON following an RTU restart

14 (IIN1.6) DEVICE_TROUBLE Not set by RTU

13 (IIN1.5) LOCAL_CONTROL Not set by RTU
12 (IIN1.4) NEED_TIME Set ON when time synchronization is required from the
master. The bit is cleared when the master sets the time.
11 (IIN1.3) CLASS_3_EVENTS Set ON when the RTU has one or more Class 3 events to
report. Once all points of the class have been read by the
master, the bit will be reset.
10 (IIN1.2) CLASS_2_EVENTS Similarly for Class 2 events.
9 (IIN1.1) CLASS_1_EVENTS Similarly for Class 1 events.
8 (IIN1.0) ALL_STATIONS Set ON when an all stations (broadcast) message is
received
7 (IIN2.7) Reserved Not set by RTU
6 (IIN2.6) Reserved Not set by RTU
5 (IIN2.5) CONFIG_CORRUPT Not set by RTU
4 (IIN2.4) ALREADY_EXECUTING Not set by RTU
3 (IIN2.3) EVENT_BUFFER_OVERFLOW Set ON if an event that has not yet been confirmed by the
master has been overwritten.
2 (IIN2.2) PARAMETER_ERROR Set ON if a requested parameter is invalid or out of range
1 (IIN2.1) OBJECT_UNKNOWN Set ON If the requested object is not found by the driver
0 (IIN2.0) NO_FUNC_CODE_SUPPORT Set ON if the requested function code is not implemented

274 B0780AF, Rev M

Schneider Electric Systems USA, Inc.
38 Neponset Avenue
Foxboro, Massachusetts 02035–2037
United States of America

Global Customer Support: https://pasupport.schneider-electric.com

As standards, specifications, and design change from time to time, please ask for confirmation of the information given in this publication.

© 2018-2020 Schneider Electric. All rights reserved.

B0780AF, Rev M