EXPERION PKS

RELEASE 516

Serial Interface Module Implementation Guide

EPDOC-X123-en-516A
August 2020
Disclaimer
This document contains Honeywell proprietary information. Information contained herein is to be
used solely for the purpose submitted, and no part of this document or its contents shall be
reproduced, published, or disclosed to a third party without the express permission of Honeywell
International Sàrl.
While this information is presented in good faith and believed to be accurate, Honeywell disclaims
the implied warranties of merchantability and fitness for a purpose and makes no express
warranties except as may be stated in its written agreement with and for its customer.
In no event is Honeywell liable to anyone for any direct, special, or consequential damages. The
information and specifications in this document are subject to change without notice.

Copyright 2020 - Honeywell International Sàrl

-2-
Contents 3
Chapter 1 - About This Document 1
Chapter 2 - Serial Interface Module Purpose 2
2.1 About the SIM 2
2.2 Function block support for serial interface 4
2.3 SIM processing characteristics 5
Chapter 3 - SIM Planning and Design 7
3.1 General Planning References 7
3.2 General MODBUS Protocol References 7
3.3 Identifying Serial Interface Module Components 7
3.4 SIM implementation considerations and restrictions 8
Chapter 4 - SIM Installation and Upgrades 10
4.1 SIM Installation Declarations 10
4.2 Installing Serial Interface Module 11
4.3 Installing power adapter to be used with SIM 12
4.4 Installing MODBUS FTA 15
4.4.4 Guidelines for Wiring Modbus FTA to Modbus Devices 17

4.5 Installing ALLEN-BRADLEY FTA 19

4.5.5 Guidelines for wiring A-B FTA to Allen-Bradley Devices 22

4.6 Upgrading SIM Firmware 22

4.7 Converting Limited Range Modbus FTA to Extended Range
Modbus FTA 22
4.8 About Using Limited Range Modbus FTA with R301.1 Control
Builder 23
4.9 About Using Extended Range Modbus FTA with Pre R301.1
Control Builder 23
Chapter 5 - SIM Configuration 24
5.1 Adding SIM (TC_MUX021) Block to Project 24
5.2 Adding serial interface I/O channel to Control Module 26
5.3 Assigning SIM to Execution Environment 30
5.4 Loading configuration data to the SIM 33
Chapter 6 - SIM Operation 36

-3-
 6.1 SIM Front Panel Display and Indicators 36
6.1.1 Typical startup, runtime, and firmware load SIM display indications 36

6.1.2 Typical channel activity LED indications 37

6.1.3 Typical health LED indications 37

6.2 Monitoring Serial Interface Functions through Station

Displays 37
6.2.1 About Using Station Detail displays 37

6.2.2 About Using Station Event Summary display 38

6.3 Monitoring Serial Interface Functions through Monitoring

Tab in Control Builder 38
6.3.1 Activating/inactivating SIM 38
6.3.2 SIM block icon appearances 38

6.3.3 Monitoring/Interacting with given component/block 39

Chapter 7 - SIM Maintenance 40

7.1 Periodic Checks 40
7.2 Recommended Spare Parts 40
7.3 SIM Removal and Installation Under Power 40
7.4 Replacing Failed SIM T C- or TK-MUX021 41
7.5 Replacing Failed Power Adapter TC-/TK-SMPD01 or TC-/TK-
SMPC01 42
7.6 Replacing Failed Serial Interface FTA 42
Chapter 8 - SIM Troubleshooting 43
8.1 Fault Classifications 43
8.2 Initial Checks 44
8.2.1 Checking Control Builder error code reference 44

8.2.2 Checking front panel display and LEDs 44

8.2.3 Viewing error codes through serial interface block form 44
8.2.4 Viewing flash log 44

8.2.5 Viewing release information log 45

8.2.6 Viewing trace log 45
8.2.7 Checking version and revision log 45
8.2.8 Checking server point build log 45
8.2.9 Using NetworkTools to view SIM statistic data 45
8.2.10 Checking server point build error log 45
8.2.11 Checking error log 46

8.2.12 Using NetworkTools to capture chassis information 46

-4-
 8.3 SIM Self-Test Diagnostic Codes 46
8.4 Fixing Common Problems 51
8.4.1 Loss of power 51
8.4.2 Poweron Self-Test Fault 52
8.4.3 Fatal ECC error 52
8.4.4 Background Diagnostic failure 53

8.5 Getting Further Assistance 53

8.5.1 Other troubleshooting sources 53
8.5.2 Guidelines for requesting support 54

Chapter 9 - Allen-Bradley Interface Reference 55

9.1 Array Channel Block Configuration for Allen-Bradley Interface 55
9.1.1 AUXDATA parameter configuration for Allen-Bradley interface 55
9.1.2 AUXDATA[6] parameter setting details 57
9.1.3 DEVADDR parameter configuration 59

9.1.4 STARTINDEX and number of elements parameters configuration 59

9.1.5 Report by Exception requirements 60
9.1.6 Performance considerations when Array Channel Block is configured for Allen-
Bradley Interface 60
9.1.7 Array Channel block execution state when Array Channel Block is configured
for Allen-Bradley Interface 61
9.1.8 Write processing considerations when Array Channel Block is configured for
Allen-Bradley Interface 62
9.1.9 Diagnostic procedures and data configuration 63
9.1.10 Time-Out gate configuration 64
9.1.11 Status and error checking when Array Channel Block is configured for Allen-
Bradley Interface 64

9.1.12 Error messages when Array Channel Block is configured for Allen-Bradley
Interface 65
9.1.13 Special FTA to KE/KF cabling considerations 66
9.1.14 FTA direct to PLC-5 RS-232 Port cable considerations 66
9.1.15 Reference Specifications when Array Channel Block is configured for Allen-
Bradley Interface 67

Chapter 10 - MODBUS Interface Reference 69

10.1 Array Channel Block Configuration for Generic MODBUS
Interface 69
10.1.1 AUXDATA parameter configuration 69

10.2 Extended range versus limited range Modbus FTA 71

10.3 Starting element index value differences 71
10.3.1 Modbus loopback diagnostic 74

-5-
10.3.2 Performance considerations when Array Channel Block is configured for
Generic MODBUS Interface 74
10.3.3 Array Channel block execution state when Array Channel Block is configured
for Generic MODBUS Interface 75
10.3.4 Write processing considerations when Array Channel Block is configured for
Generic MODBUS Interface 76
10.3.5 Status and error checking when Array Channel Block is configured for
Generic MODBUS Interface 76
10.3.6 Error messages when Array Channel Block is configured for Generic
MODBUS Interface 77
10.3.7 Special Modbus slave FTA implementation 78
10.3.8 Reference Specifications when Array Channel Block is configured for Generic
MODBUS Interface 79

-6-
 CHAPTER

1 ABOUT THIS DOCUMENT

Provides information about interfacing devices with your Experion system through the Serial
Interface Module in a C200 Controller chassis.

1.1 Revision history

Revision Date Description
A August 2020 Initial release of the document.

-1-
 CHAPTER

2 SERIAL INTERFACE MODULE PURPOSE

l About the SIM

l Function block support for serial interface
l SIM processing characteristics

2.1 About the SIM

The Serial Interface Module (SIM) is a double-width I/O module that mounts in a standard
Experion chassis (or rack). It functionally serves as a communications ' bridge ' between an
Experion C200 or C300 Controller, and a field device connected to the SIM through a Field
Termination Assembly (FTA).
The SIM supports two serial ports for bi-directional communication with two FTAs through a single
FTA power adapter. It does not store or maintain any field device I/O configuration or real-time
data. It only transfers these data elements between the Experion Controller and the connected
field devices.
The FTA features a plug-in module that adapts I/O requirements to the specific serial interface for
a given field device. The following three models are available as standard products.
l The limited range Modbus FTA model MU-TSIM12 provides a point-to-point Modbus RTU EIA-
232 (RS232) or EIA-422/485 (RS422/485) multi-drop communications interface with address
support up to 9,999.
l The extended range Modbus FTA model MU-TSIM13 provides a point-to-point Modbus RTU
EIA-232 (RS232) or EIA-422/485 (RS422/485) multi-drop communications interface with
address support up to 99,999.
l The Allen-Bradley (A-B) FTA model MU-TSIA12 provides a single EIA-232 (RS-232)
communications interface to A-B PLC-2, PLC-3, or PLC-5 devices using the DF1 protocol.

-2-
Chapter 2 - Serial Interface Module Purpose

Figure 2.1 Typical SIM topology with C200 Controller

Figure 2.2 Typical SIM topology with C300 Controller

-3-
 Chapter 2 - Serial Interface Module Purpose

2.2 Function block support for serial interface

The IOMODULE library in Control Builder includes a SIM IOM function block that is labeled TC-
MUX021 or TK-MUX021. The SIM block supports the configuration and assignment of a SIM to a
C200 or C300 Controller. After a SIM block is assigned to a Control Execution Environment and
loaded to a Controller, communications between the SIM and the controller are established, but
not necessarily between the SIM and the field devices. To establish communications with field
devices, you must configure, assign and load Serial Interface (SI) Array Channel function blocks
through a Control Module in Control Builder.
The IOCHANNEL library in Control Builder includes the following SI Array Channel function blocks.
l Numeric (SINUMARRCH)
l Flag (SIFLAGARRCH)
l Text (SITEXTARRCH)

These blocks provide the application link between the control strategy and the data associated with
a serial device. You establish the signal path and specify device specific parameters through the
configuration forms for the SI Array Channel blocks in Control Builder.
The following figure provides a block diagram overview of the communications path between a
serial interface field device and an SI Array Channel block.

-4-
 Chapter 2 - Serial Interface Module Purpose

Figure 2.3 Signal Path between Serial Field Device and Serial Interface Array Channel Function Block.

2.3 SIM processing characteristics

The periodic execution of an active SIM block takes care of processing the following three primary
actions.
l Load SI Array Channel block configurations to the SIM.
l Send Array Channel block write requests to the SIM.
l Monitor status of the SIM and report any diagnostics.

These three actions are processed once during every SIM 250 milliseconds publication period.
Imaging of the data configured in the SI Array Channel block is done as part of the Channel block's
execution and not as part of the SIM block's execution. But, the Channel block cannot access the
imaged data, when the SIM block is inactive. In this case, the Channel block sets its data to the
applicable default value.

-5-
 Chapter 2 - Serial Interface Module Purpose

The SIM block collects the writes for each Channel and sends them to the SIM every 250
milliseconds. It is possible that a write to a Channel block is rejected because the SIM block's write
list is full. The following table summarizes the maximum number of writes a SIM block supports per
Channel per 250 milliseconds period.

SI Array Channel Block Data Maximum number of writes supported per Channel per 250 ms
Type period
Numerics 8
Flags 16
8-Character Strings 8
16-Character Strings 4
32-Character Strings 2
64-Character Strings 1

Writes to the Channel blocks can also be rejected because the SIM is not keeping up with the
writes being sent by the SIM. The SIM uses a write sequence number on a per channel basis for
each write command to the SIM. Upon receipt of the write command, the SIM echoes back the last
write sequence number processed. When the sequence numbers get too far apart, the Channel
block rejects further writes.
Note that writes can degrade read performance to as little as one array update per second. Actual
performance depends on Baud Rate and Device Protocol as well as responsiveness of the field
device. You can check read/write performance and overrun statistics by viewing SIM details
through the Network Tools (NTOOLS) application provided with Experion Engineering Tools. See
the Using NetworkTools to capture chassis information section for more information.
The SIM block non-alarming parameters FTAAOVRNFL and FTABOVRNFL indicate write overruns.
You can monitor these parameters through the SIM Detail display in Station. To alarm on the
overrun condition, connect the overrun parameter to a FLAG block, which can generate an
OffNormal alarm.

-6-
 CHAPTER

3 SIM PLANNING AND DESIGN

l General Planning References

l General MODBUS Protocol References
l Identifying Serial Interface Module Components
l SIM implementation considerations and restrictions

3.1 General Planning References

Refer to the following documents for planning and design details for the Experion system in
general and the Fault Tolerant Ethernet supervisory network. For the sake of brevity, this Guide
does not repeat the applicable general guidelines, considerations, cautions, and so on that are
covered in these other Guides.
l Control Hardware Planning Guide
l Server and Client Planning Guide
l Fault Tolerant Ethernet Overview and Implementation Guide

3.2 General MODBUS Protocol References

Please refer to the Modbus web site for references to general information about the MODBUS
protocol.

3.3 Identifying Serial Interface Module Components

The following table identifies the SIM components needed to provide a serial device interface to a
C200 or C300 Controller in an Experion system. The model numbers beginning with the prefix ' TK
' or ' MC ' are for the coated version of the component.

Component Description Honeywell Model Number

Serial Interface Module (SIM) Double-wide module mounts in TC-MUX021
Controller or Remote I/O chassis.
TK-MUX021
Serves as a ' bridge ' between the
qualified third-party serial device
and Experion Controller using the
MODBUS protocol.
SIM FTA Power Adapter Accepts 24 Vdc or 85 to 265 Vac input
to power the SIM FTA. Mounts on a
DIN rail or flat surface
24 Vdc input model TC-SMPD01

TK-SMPD01
85 to 265 Vac input model TC-SMPC01
TK-SMPC01

-7-
 Chapter 3 - SIM Planning and Design

Component Description Honeywell Model Number

SIM to Power Adapter Cable Connects SIM to Power Adapter TC-KSM003
mounted up to 10 m (32 ft) away.
3 m (10 ft) TC-KSM003
5 m (16 ft) TC-KSM005
10 m (32 ft) TC-KSM010
Power Adapter to FTA Cable Connects Power Adapter to FTA
mounted in a cabinet or outside.
Internal Cabinet Cable
33 cm (1 ft) MU-KLAM01
66 cm (2 ft) MU-KLAM02
100 cm (3 ft) MU-KLAM03
200 cm (6 ft) MU-KLAM06
External Cable
30 m (100 ft) MU-KSX030
152 m (500 ft) MU-KSX152
305 m (1000 ft) MU-KSX305
Limited Range Modbus FTA1 Supports standard MODBUS remote MU-TSIM12
terminal unit (RTU) RS232 or
RS422/485 communications with
address support up to 9,999.
Extended Range Modbus Supports standard MODBUS remote MU-TSIM13
FTA2 terminal unit (RTU) RS232 or
RS422/485 communications with MC-TSIM13
address support up to 65,535
(99,999).
Allen-Bradley DF1 Modbus Supports Allen-Bradley DF1 serial MU-TSIA12
FTA1 protocol over RS232 only with
address support up to 65535.
1MU-TSIM12 and MU-TSIA12 use industry standards to support many industrial devices. Contact
your Honeywell representative for support of non-standard protocols. Note that protocols
developed under the Honeywell TPS, PM/APM/HPM Serial Device Interface protocol or the
Smart Transmitter Interface (STI) protocol are not supported.
2MU/MC-TSIM13 requires Experion R301.1 or greater version of Control Builder for extended
address range support. Otherwise, this FTA is functionally equivalent to the limited range MU-
TSIM12 model. Contact your Honeywell representative for support of non-standard protocols.
Note that protocols developed under the Honeywell TPS, PM/APM/HPM Serial Device Interface
protocol or the Smart Transmitter Interface (STI) protocol are not supported.

3.4 SIM implementation considerations and restrictions

The following is a list of things to consider when planning to implement a serial interface
application.
l The Serial Interface Module can be installed in any available chassis slot pair excluding slot
zero.
l A Controller with CEE-50ms can support up to three SIMs, or only one SIM with CEE-5ms. This
corresponds to support for up to 64 IOM connections for CEE 50ms or only 12 IOM connections
for CEE 5ms.
l The fastest update rate supported by the SIM is 250 milliseconds.
l A remote I/O chassis power supply will support up to three SIMs.
l A Controller chassis power supply will support up to two SIMs, since the C200 CPM consumes

-8-
 Chapter 3 - SIM Planning and Design

roughly the same power as a SIM.

l The SIM supports up to two serial ports or two FTAs with up to 16 serial devices per FTA.
l A SIM supports a maximum of 32 SI Array Channel blocks through a SIM block with no
restrictions on the mix of Array Channel block data types.
l A Serial Interface NUMERIC Array Channel block supports up to 64 numeric process variables.
l A Serial Interface FLAG Array Channel block supports up to 512 process variable flags.
l A Serial Interface TEXT Array Channel block supports up to 64 Unicode characters.
l Each SI Array Channel block is mapped to a single serial device. (Note that multiple SI Array
Channel blocks can be mapped to a single serial device.)
l Every four SI Array Channel blocks associated with a given SIM block are equivalent to using
one traditional analog/discrete IOM. A single rack-mounted SIM can represent from 1 to 8
traditional IOMs, in terms of the maximum IOM capacity, based on a ratio of four Array Channel
blocks equal one traditional IOM.
l The 32 Array Channel blocks associated with a SIM block are allocated to the two FTAs as
follows.
o Channels 0 to 15 to FTA ' A '
o Channels 16 to 31 to FTA ' B '

l When only one FTA is used, it must be configured as FTA ' A ' and channels 0 to 3 must be used
for at least one connection.
l For the most efficient use of Controller I/O connections, assign channels consecutively starting
from channel 0. If high throughput is required, especially high write throughput, assign fewer
arrays to each I/O connection.
l An FTA serial port operates at a data rate of up to 19.2 kilobaud.
l Communication between the SIM and the FTA operates at 38.4 kilobaud.
l The FTA to Power Adapter cable can be up to 300 meters (1000 feet) long.
l The Power Adapter to SIM cable can be up to 10 meters (32 feet) long.
l Be sure the 24Vdc power supply that is used to power the TC/TK-SMPD01 SIM FTA Power
Adapter is dedicated to powering only that Power Adapter and is not used to power any other
equipment. The power supply must also be a floating power source, such as a DIN rail-
mounted Phoenix Contact (MCR-PS-24DC/24DC/200) power supply with floating 24Vdc output.

-9-
 CHAPTER

4 SIM INSTALLATION AND UPGRADES

l SIM Installation Declarations

l Installing Serial Interface Module
l Installing power adapter to be used with SIM
l Installing MODBUS FTA
l Installing ALLEN-BRADLEY FTA
l Upgrading SIM Firmware
l Converting Limited Range Modbus FTA to Extended Range Modbus FTA
l About Using Limited Range Modbus FTA with R301.1 Control Builder
l About Using Extended Range Modbus FTA with Pre R301.1 Control Builder

4.1 SIM Installation Declarations

ATTENTION
This equipment shall be installed in accordance with the requirements of the National
Electrical Code (NEC), ANSI/NFPA 70, or the Canadian Electrical Code (CEC), C22.1. It is
intended to be mounted within an enclosure or suitable environment acceptable to the
local authority having jurisdiction, as defined in the NEC, or authorized person as defined in
the CEC.

WARNING
Electrostatic discharge can damage integrated circuits or semiconductors if you touch
connector pins or tracks on a printed wiring board. Follow these guidelines when you
handle any electronic component:
l Touch a grounded object to discharge static potential,
l Wear an approved wrist-strap grounding device,
l Do not touch the wire connector or connector pins,
l Do not touch circuit components inside a component,
l If available, use a static safe workstation,
l When not in use, keep the component in its static shield box or bag.

WARNING
Unless the location is known to be non-hazardous, do not:

- 10 -
 Chapter 4 - SIM Installation and Upgrades

l connect or disconnect cables,

l install or remove fuses, terminal blocks, and so on,

while the component is powered.

4.2 Installing Serial Interface Module

You must review the SIM implementation considerations and restrictions section in this document,
prior to installing SIM.

4.2.1 Prerequisites
l You have the SIM and associated components on hand.
l You have installed the chassis and taken steps to minimize Electrostatic Discharge (ESD).
l Check that no power is applied to the chassis.

4.2.2 To install SIM in chassis

1. Position the module at the planned chassis slot location. For example, slots 3 and 4.
(Remember that slot numbering is zero-based and the left most slot is number ' 0 ' .)
2. Align the module's circuit board with the top and bottom chassis guides.

3. Slide the module into the chassis until the module tabs ' click: into position.

- 11 -
 Chapter 4 - SIM Installation and Upgrades

4. Connect the SIM to Power Adapter cable assembly.

5. Go to the next section Installing the Power Adapter.

4.3 Installing power adapter to be used with SIM

4.3.1 Prerequisites
l You have installed the SIM in the chassis per the previous procedure.
l You have determined if your power adapter is to be DIN Rail mounted or mounted directly to a
flat surface.
l You have taken steps to minimize Electrostatic Discharge (ESD).

CAUTION
Be sure the 24Vdc power supply that you use to power the TC/TK-SMPD01 SIM FTA Power
Adapter is dedicated to powering only that Power Adapter and is not used to power any other
equipment. The power supply must also be a floating power source, such as a DIN rail-
mounted Phoenix Contact (MCR-PS-24DC/24DC/200) power supply with floating 24Vdc

- 12 -
 Chapter 4 - SIM Installation and Upgrades

output. Otherwise, voltage transients on the user-supplied 24Vdc to the Power Adapter may
damage the associated TC/TK-MUX021 SIM in the chassis. You can also use the ac-
powered TC/TK-SIMPC01 SIM FTA Power Adapter instead of the dc-powered version, as an
alternative.

l You have a Philips screwdriver and a drill, if you are mounting the power adapter on a flat
surface.
l If you are mounting the power adapter on a flat surface, observe the following precautions:

CAUTION
l Do not drill holes for a Power Adapter above an already installed chassis. Debris
from the drilling can damage or short the chassis backpanel, and short the
backpanel card-edge connectors.
l If the Power Adapter does not lay flat before the screws are tightened, use additional
washers as shims. This will ensure that the circuit board is not warped or cracked by
tightening the screws. Warping a Power Adapter could cause a malfunction and
prevent proper operation.

l If you are mounting the power adapter on a DIN rail, you are responsible for supplying and
installing the DIN rails.

4.3.2 To mount power adapter on a flat surface

1. Position the Power Adapter on the mounting surface. While holding it in place, use a pencil or
center punch to mark the four mounting hole locations on the surface.
2. Remove the Power Adapter and drill tap holes at the marked locations.

3. Using the screws provided, mount the Power Adapter to the surface.

- 13 -
 Chapter 4 - SIM Installation and Upgrades

4. Connect the SIM-to-Power Adapter cable to terminal connector J1 on the Power Adapter.

For Vdc model, connect leads from 24 Vdc power supply to J5 terminals on the adapter,
observing polarity.

For Vac model, connect leads from 120/240 Vac line to J4 terminals L1, L2, and GND.
5. Go to the next section Installing Modbus FTA or Installing Allen-Bradley FTA, as applicable.

- 14 -
 Chapter 4 - SIM Installation and Upgrades

4.4 Installing MODBUS FTA

You can mount the Modbus FTA on a standard FTA Mounting Channel, DIN rail (35 x 7.5 mm top
hat rail), or flat surface.
Do not expose the FTA to the weather. It is designed for mounting in a cabinet or a controlled
environment.
Be sure the FTA is grounded either directly or through the mounting means.
Overall Modbus interface connections
The following figure shows the typical component connections associated with a Modbus FTA
installation for reference.

Figure 4.1 Typical Modbus Serial Interface connections

4.4.1 Prerequisites
You have the applicable Modbus FTA and associated cables on hand.
l Limited-Range Modbus FTA model MU-TSIM12, or
l Extended-Range Modbus FTA model MU/MC-TSIM13

- 15 -
 Chapter 4 - SIM Installation and Upgrades

4.4.2 Mounting Modbus FTA

1. Locate the mounting holes in each corner.
2. To mount on a DIN rail, you must attach the DIN rail adapter to the bottom of the FTA using
the hardware supplied.
3. To mount on an FTA channel, attach to the Mounting Channel standoffs.
4. To mount on a flat surface, mark the location of the four mounting holes, drill holes and use
screws and non-metallic spacers to attach the FTA to the flat surface/wall.

4.4.3 To wire Modbus FTA to Power Adapter

1. Is the Modbus FTA mounted in a cabinet with the Power Adapter?
If the answer is Yes, be sure you have the appropriate number and length of Honeywell
internal cable MU-KLAMxx on hand. Go to the next Step.
If the answer is No, be sure you have the appropriate number and length of Honeywell
external cable MU-KSXxxx on hand. Go to the next Step.
(Note that the cable must have two individually shielded, twisted pairs.)
2. On one twisted pair mark one lead P- and the other P+ at both ends of the cable. On the other
twisted pair mark one lead S- and the other S+ at both ends of the cable. Repeat this for other
cables, as applicable.
3. Locate the J2 (CHANNEL A), 6-pin connector on the Power Adapter. Observing polarity,
connect the cable lead marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR.
Connect the shield wire for this pair to pin 3 SHD. Observing polarity, connect the cable lead
marked S- to pin 4 - SER and lead marked S+ to pin 5 + SER. Connect the shield wire for this
pair to pin 6 SHD. See the connection diagram in the following Figure for reference.
(Note that the shield wires are connected to ground at the Power Adapter end only.)
4. Locate the J1, 4-pin connector on the FTA ' A ' . Observing polarity, connect the cable lead
marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR. Trim the shield wire for
this pair close to the cable insulation. Observing polarity, connect the cable lead marked S- to
pin 3 - SER and lead marked S+ to pin 4 + SER. Trim the shield wire for this pair close to the
cable insulation. See the connection diagram in the following Figure for reference.
5. Do you have a second FTA to be connected to the Power Adapter?
If the answer is Yes, continue with Step 6.
If the answer is No, exit this procedure and go to the next section Wiring Modbus FTA to
Modbus devices.
6. Locate the J3 (CHANNEL B), 6-pin connector on the Power Adapter. Observing polarity,
connect the cable lead marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR.
Connect the shield wire for this pair to pin 3 SHD. Observing polarity, connect the cable lead
marked S- to pin 4 - SER and lead marked S+ to pin 5 + SER. Connect the shield wire for this
pair to pin 6 SHD. See the connection diagram in the following Figure for reference.
(Note that the shield wires are connected to ground at the Power Adapter end only.)
7. Locate the J1, 4-pin connector on the FTA ' B ' . Observing polarity, connect the cable lead
marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR. Trim the shield wire for
this pair close to the cable insulation. Observing polarity, connect the cable lead marked S- to
pin 3 - SER and lead marked S+ to pin 4 + SER. Trim the shield wire for this pair close to the
cable insulation. See the connection diagram in the following Figure for reference.

- 16 -
 Chapter 4 - SIM Installation and Upgrades

8. Go to the next section Wiring Modbus FTA to Modbus devices.

Figure 4.2 Power Adapter to Serial Interface FTA Wiring

l Guidelines for Wiring Modbus FTA to Modbus Devices

4.4.4 Guidelines for Wiring Modbus FTA to Modbus Devices

To make EIA-232 (RS-232) connections

You will need a null modem cable with a 25-pin, male connector to connect the EIA-232 Modbus
device to the J2, DB-25 type connector on the FTA. Use the J2 connector pinout data in the
following Figure to construct the EIA-232 interface cable. Since individual Modbus device
connections may vary, be sure to modify the common EIA-232 pinouts shown in the following
Figure, so that the FTA Transmit Data pin (2) connects to the Modbus device Receive Data pin and
the FTA Receive Data pin (3) connects to the Modbus device Transmit Data pin. Be sure the length
of the EIA-232 interface cable does not exceed 15 meters (50 feet).

- 17 -
 Chapter 4 - SIM Installation and Upgrades

Figure 4.3 Pins common to RS-232 25-pin connector and FTA J2, DB-25 type connector.

To Make EIA-422/485 connections

You will need appropriate cable, such as Belden Corporation type 9271 twin axial, to connect up to
15 EIA-422/485 Modbus devices in multidrop fashion to the J3, 5-pin connector on the FTA. Use
the connection details shown in the following Figure and the following guidelines to configure a
multidrop EIA-422/485 interface.
The recommended maximum length for the interface cable is 300 meters (1000 feet). However,
this can be extended up to 1220 meters (4000 feet) with the appropriate cable (Belden type 9182).
Please consult with your Honeywell representative for the recommended cable.
To avoid potential ground loops, connect the shield for the interface cable to ground at the FTA end
only. See the following Figure for details.
To minimize signal reflections, connect a 120 ohm, +/- 10%, 1/2 Watt resistor across J3 pins 1 and
5 and across the Data + and Data - terminals on the last device in the link. (Note that the resistor
value may be different based on the requirements of the actual cable used.)

The FTA includes two 1/4 Ampere fuses (F1 and F2) to protect it from excessive current on the data
lines.

- 18 -
 Chapter 4 - SIM Installation and Upgrades

Figure 4.4 Modbus FTA EIA-422/485 connections.

4.5 Installing ALLEN-BRADLEY FTA

ATTENTION
Connections and options are subject to change by Allen-Bradley without notice to or from
Honeywell. Please Contact Allen-Bradley for the latest interface.

You can mount the Allen-Bradley FTA on a standard FTA Mounting Channel, DIN rail (35 x 7.5 mm
top hat rail), or flat surface.
Do not expose the FTA to the weather. It is designed for mounting in a cabinet or a controlled
environment.
Ensure that the FTA is grounded either directly or through the mounting means.

4.5.1 Overall Allen-Bradley interface connections

n The following figures show the typical component connections associated with an Allen-Bradley
FTA installation for reference.

- 19 -
 Chapter 4 - SIM Installation and Upgrades

Figure 4.5 Typical connection of Allen-Bradley devices to the SIM.

Figure 4.6 Typical Allen-Bradley Serial Interface connections.

- 20 -
 Chapter 4 - SIM Installation and Upgrades

4.5.2 Prerequisites
n You have the Allen-Bradley FTA and associated cables on hand.

4.5.3 Mounting Allen-Bradley FTA

1. Locate the mounting holes in each corner.
2. To mount on a DIN rail, you must attach the DIN rail adapter to the bottom of the FTA using
the hardware supplied.
3. To mount on an FTA channel, attach to the Mounting Channel standoffs.
4. To mount on a flat surface, mark the location of the four mounting holes, drill holes and use
screws and non-metallic spacers to attach the FTA to the flat surface/wall.

4.5.4 To wire Allen-Bradley FTA to Power Adapter

1. Is the A-B FTA mounted in a cabinet with the Power Adapter?
If the answer is Yes, be sure you have the appropriate number and length of Honeywell
internal cable MU-KLAMxx on hand. Go to the next Step.
If the answer is No, be sure you have the appropriate number and length of Honeywell
external cable MU-KSXxxx on hand. Go to the next Step.
(Note that the cable must have two individually shielded, twisted pairs.)
2. On one twisted pair mark one lead P- and the other P+ at both ends of the cable. On the other
twisted pair mark one lead S- and the other S+ at both ends of the cable. Repeat this for other
cables, as applicable.
3. Locate the J2 (CHANNEL A), 6-pin connector on the Power Adapter. Observing polarity,
connect the cable lead marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR.
Connect the shield wire for this pair to pin 3 SHD. Observing polarity, connect the cable lead
marked S- to pin 4 - SER and lead marked S+ to pin 5 + SER. Connect the shield wire for this
pair to pin 6 SHD. See the connection diagram in the previous Figure 2Figure for reference.
(Note that the shield wires are connected to ground at the Power Adapter end only.)
4. Locate the J1, 4-pin connector on the FTA ' A ' . Observing polarity, connect the cable lead
marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR. Trim the shield wire for
this pair close to the cable insulation. Observing polarity, connect the cable lead marked S- to
pin 3 - SER and lead marked S+ to pin 4 + SER. Trim the shield wire for this pair close to the
cable insulation. See the connection diagram in the previous Figure 2Figure for reference.
If the answer is Yes, continue with Step 6.
If the answer is No, exit this procedure and go to the next section Wiring A-B FTA to Allen-
Bradley devices.
5. Do you have a second A-B FTA to be connected to the Power Adapter?
6. Locate the J3 (CHANNEL B), 6-pin connector on the Power Adapter. Observing polarity,
connect the cable lead marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR.
Connect the shield wire for this pair to pin 3 SHD. Observing polarity, connect the cable lead
marked S- to pin 4 - SER and lead marked S+ to pin 5 + SER. Connect the shield wire for this
pair to pin 6 SHD. See the connection diagram in the previous Figure 2Figure for reference.
(Note that the shield wires are connected to ground at the Power Adapter end only.)
7. Locate the J1, 4-pin connector on the FTA ' B ' . Observing polarity, connect the cable lead
marked P- to pin 1 - PWR CUR and lead marked P+ to pin 2 + PWR CUR. Trim the shield wire for
this pair close to the cable insulation. Observing polarity, connect the cable lead marked S- to
pin 3 - SER and lead marked S+ to pin 4 + SER. Trim the shield wire for this pair close to the

- 21 -
 Chapter 4 - SIM Installation and Upgrades

cable insulation. See the connection diagram in the previous Figure 2Figure for reference.
8. Go to the next section Wiring A-B FTA to Allen-Bradley devices.

l Guidelines for wiring A-B FTA to Allen-Bradley Devices

4.5.5 Guidelines for wiring A-B FTA to Allen-Bradley Devices

You will need a null modem cable with a 25-pin, male connector to connect the EIA-232 Allen-
Bradley device to the J2, DB-25 type connector (female) on the FTA. Use the J2 connector pinout
data in the previous Figure 1Figure to construct the EIA-232 interface cable. Since individual A-B
device connections may vary, be sure to modify the common EIA-232 pinouts shown in the Figure,
so that the FTA Transmit Data pin (2) connects to the A-B device Receive Data pin and the FTA
Receive Data pin (3) connects to the A-B device Transmit Data pin. Refer to the pinout description
in the Allen-Bradley device manual and the Special FTA to KE/KF cabling considerationsin the
Allen-Bradley Interface Reference section. Observe the following general cabling guidelines.
l The FTA, J2 connector, Transmit pin 2 must connect to the A-B device Receive pin.
l The FTA, J2 connector, Receive pin 3 must connect to the A-B device Transmit pin.
l Never connect the Chassis and Signal grounds together.
l The A-B device may require other pins to be jumpered, refer to the A-B device manual and the
FTA direct to PLC-5 RS-232 Port cable considerationsin the Allen-Bradley Interface Reference
section..
l When connecting to an A-B PLC, usually through a KE or KA module, be sure the device has
the latest firmware available from Allen-Bradley.
l Be sure the length of the EIA-232 interface cable does not exceed 15 meters (50 feet).

4.6 Upgrading SIM Firmware

Please refer to the Upgrading boot and personality images in chassis-based components section in
the Control Hardware and I/O Module Firmware Upgrade Guide for information about upgrading
firmware in a Serial Interface Module.

4.7 Converting Limited Range Modbus FTA to Extended

Range Modbus FTA
The following procedure outlines how to convert an existing limited range Modbus FTA to an
extended range one given that specified prerequisites are met.

4.7.1 Prerequisites
l You are running Control Builder version R301.1 or greater.
l The existing Programmable Logic Controller is capable of larger addresses and had been used
to access lower address (<9,999) registers through a limited range FTA.
l You have logged on with sufficient security level to make changes in a control strategy in
Control Builder.
l You need to provide SIM flag point access to the read/write bit flag value at an extended
address (for example 33, 000) in an existing Programmable Logic Controller.

ATTENTION
If you are running pre R301.1 Experion software, the Control Execution Environment (CEE)
will not accept loads of array blocks with STARTINDEX values above 99,999.

- 22 -
 Chapter 4 - SIM Installation and Upgrades

CAUTION
We recommend that you proceed with extreme caution whenever replacing any component
in a control system. Be sure the system is offline or in a safe operating mode.
Component replacements may also require corresponding changes in the control strategy
configuration through Control Builder, as well as downloading appropriate data to the
replaced component.

4.7.2 To convert limited range Modbus FTA to extended one

1. Replace limited range Modbus FTA model MU-TSIM12 with extended range Modbus FTA
model MU-TSIM13or MC-TSIM13. See the previous Installing MODBUS FTAsection for more
information.
2. In Project tree in Control Builder, reconfigure all existing serial interface I/O channel blocks
assigned to the SIM channels associated with the replaced limited range Modbus FTA to
change the most significant digit of the Starting Element Address (STARTINDEX) so it agrees
with the extended address format. And, reconfigure the AUXDATA [5] parameter entry to
65535.0 to enable the extended addressing mode on the extended range Modbus FTA.
3. Re-load modified control strategies in Project to the Controller.
4. This completes the procedure. Resume normal operation.

4.8 About Using Limited Range Modbus FTA with R301.1

Control Builder
You can use a limited-range Modbus FTA with a R301.1 or greater Control Builder as long as you
only need to access addresses in the range of 1 to 9,999. If you need to access addresses above
9,999, you need to convert to an extended range Modbus FTA as outlined in the previous section.

4.9 About Using Extended Range Modbus FTA with Pre

R301.1 Control Builder
You can use an extended range Modbus FTA with a pre R301.1 Control Builder as long as you only
need to access addresses in the range of 1 to 9,999. In this case, you must configure the AUXDATA
[5] parameter value as NaN to disable the extended addressing mode on the extended range
Modbus FTA. If you need to access addresses above 9,999, you will need to upgrade your Experion
system to R301.1 to get the expanded features of the R301.1 Control Builder. In this case, you must
configure the AUXDATA[5] parameter value as 65535.0 to enable the extended addressing mode
on the extended range Modbus FTA.

- 23 -
 CHAPTER

5 SIM CONFIGURATION

l Adding SIM (TC_MUX021) Block to Project

l Adding serial interface I/O channel to Control Module
l Assigning SIM to Execution Environment
l Loading configuration data to the SIM

5.1 Adding SIM (TC_MUX021) Block to Project

You can only view SIM (TC_MUX021) blocks in the Project tab set for Assignment view. The
Assignment view shows the relationship among all blocks while the Containment view only shows
templates that contain other templates or Control Modules (CM), Sequential Control Modules
(SCM), and basic blocks. To toggle the view, right-click in an open area of the tab window and
select Assignment View or Containment View from the list, as applicable.
Each TC_MUX021 block is automatically assigned a unique default tag name when it is created. If
your system will include multiple SIM blocks, you may want to adopt a more structured syntax for
naming them.
The block tag or module name can be up to 40 characters long and must contain at least on letter
(A-Z). It must not contain an embedded space or leading space, and dots are allowed in parameter
naming only.
The item name can be up to 40 characters long and must contain at least one letter (A-Z). It is a
name by which an entity is known within the context of the enterprise model. The Item name
must be unique among children of the same containment parent in the Enterprise Model Builder
hierarchy and should conform to the standard convention names within the system.
The module description text can be up to 132 characters long and appears on both detail and
group displays.

5.1.1 Prerequisites
l You have started Configuration Studio and launched the Control Builder application.
l You have logged on with sufficient privileges to create control strategies using Control
Builder.
l If applicable, you have configured the applicable IP addresses when you set up your FTE
network.

- 24 -
 Chapter 5 - SIM Configuration

5.1.2 To add SIM block to Project

1. On the File menu, click New > I/O Modules > IOMODULE > TC-MUX021 - Serial Interface, 32
ch. Calls up the TC_MUX021 Block parameters configuration form Main tab with cursor in the
Item Name field, as shown in the following sample illustration.

2. If you want to change the default module name, double-click the Module Name box to
highlight it and key in the desired module name. Click the cursor in the Item Name box.
Otherwise, go to Step 3.
3. With cursor in the Item Name box, Key in the name of the item this object will be associated
with in the Enterprise Model Builder hierarchy.
4. Click the Module Description box and key in the desired descriptive text to be used on displays.
5. Double-click the IOM Slot Number box and key in the number of the first slot the SIM occupies
in the chassis.
6. If the SIM is installed in a remote Series A I/O chassis, double-click the Remote IO Chassis
MAC Address box and key in the MAC address of the uplink ControlNet Interface (CNI) module
installed in the remote chassis.
7. If the SIM is installed in a C200 Controller chassis, you can skip this step.
8. If the SIM is installed in a remote Series A I/O chassis, double click the ControlNet Module Slot
Number (connected to IO Chassis) box and key in the number of the slot the downlink CNI
module occupies in the C200 Controller chassis.
9. If the SIM is installed in a C200 Controller chassis, you can skip this step.
10. Click the Module Configuration tab to display it.
11. Be sure the check box for the Alarming Enabled function is checked, if you want alarm
reporting enabled. A blank check box means that the alarm reporting function is disabled.
12. Click the Server History tab to display it.

- 25 -
 Chapter 5 - SIM Configuration

13. Use this tab to configure desired history parameters and create or edit server scripts. See the
Control Building Guide and/or the online help for more information.
14. Click the Server Displays tab to display it.
15. Use this tab to configure parameters associated with Station displays. See the Control Building
Guide and/or the online help for more information.
16. Click the Control Confirmation tab to display it.
17. Use this tab to configure parameters for control confirmation associated with the licensed
Electronic Signature option. See the Control Building Guide and/or the online help for more
information.
18. Click the Identification tab to display it
19. Use this tab to configure parameters associated with the licensed template option. See the
Control Building Guide and/or the online help for more information.
20. When you completed entering configuration data, click the OK button to close the
configuration form and add the icon for the SIM to the Project tab.
21. This completes the procedure. Go to the next section.

5.2 Adding serial interface I/O channel to Control Module

The following procedure adds a Serial Interface Numeric Array channel block to a CM and assigns
a channel to a SIM for example purposes only. You can easily adapt this procedure to apply to
another Serial Interface Array channel block.
Each IOCHANNEL block is automatically assigned a unique default tag name when it is created. If
your system will include multiple IOCHANNEL blocks, you may want to adopt a more structured
syntax for naming them.
The channel name can be up to 16 characters long and must contain at least on letter (A-Z). It
must not contain an embedded space or leading space, and dots are allowed in parameter naming
only.
All illustrations used in the following procedure are for example purposes only.

5.2.1 Prerequisites
l You have started Configuration Studio and launched the Control Builder application.
l You have logged on with sufficient privileges to create control strategies using Control Builder.
l You have added a SIM block to the Project tab.
l You have created a Control Module in the Project tab.

- 26 -
 Chapter 5 - SIM Configuration

5.2.2 To add serial interface channel block to CM

1. In the Project tab, double-click the icon for the Control Module that is to include a serial
interface I/O channel block to open it in the Control Drawing pane, as shown in the following
sample illustration.

2. In the Library tab, scroll to the IOCHANNEL icon and click the plus sign to expand the tree.
3. Click and drag the icon for the SINUMARRCH block to the open CM in the Control Drawing to
add the block to the CM, as shown in the following sample illustration.

- 27 -
 Chapter 5 - SIM Configuration

4. Double-click the SINUMARRCHA block to open its configuration parameters form.

5. Accept the highlighted default Channel Name or key in a new one.

6. Double-click the Execution Order in CM box and key in the desired number in multiples of 10
to define the execution order of the block in the CM.
7. Click the down arrow in the Module Name box and select the SIM to be associated with this
channel. Once the SIM is selected, the Module Type and Channel Number fields are
automatically updated, as shown in the following sample illustration.

8. In the Channel Number list box, click the desired FTA channel number this channel block is to
be assigned to. Channel 0 is the default selection.

- 28 -
Chapter 5 - SIM Configuration

9. Click the Assign Channel Block button to assign this channel to the selected FTA channel
number. The Channel Name field and the Assigned to … fields are automatically updated, as
shown in the following sample illustration.

10. Click the Serial Device tab to display it.

11. Click the down arrow in the Access Lock box and select who can change the block's value or
state based on signon privileges. Press the Tab key to move the cursor to the Serial Link
Device Address box.
12. Key in the address that identifies the serial link device connected to this FTA channel. Press
the Tab key to move the cursor to the Starting Element Index box.

- 29 -
 Chapter 5 - SIM Configuration

13. Key in the value to identify the start of the contiguous array in the serial device. See the Allen-
Bradley Interface Reference or MODBUS Interface Reference section, depending on the
communications interface protocol being used, for more information. Press the Tab key to
move the cursor to the Number of Numeric Values box.
14. Key in the number that represents the number of numeric values in the array of data from the
serial device.
15. Click the down arrow in the Write Option box and select how the Array Channel block will
handle writes to its ' data ' parameter.
16. Double-click the 0 row in the Auxiliary Config Data list box. Key in value to define
communications interface for Allen-Bradley Interface or MODBUS Interface. The default value
is NaN (Not a Number) if parameters are not being used with a specified interface. See the
Allen-Bradley Interface Reference or MODBUS Interface Reference section, depending on the
communications interface protocol being used, for more information
17. Repeat Step 17 for the other (1 to 7) rows in the Auxiliary Config Data list box, as applicable.
18. Click the Identification tab to display it
19. Use this tab to configure parameters associated with the licensed template option. See the
Control Building Guide and/or the online help for more information.
20. Click the Block Pins tab to display it.
21. Use this tab to configure the pins you want to expose for this block. See the Control Building
Guide and/or the online help for more information.
22. Click the Configuration Parameters tab to display it.
23. Use this tab to configure the parameters to be displayed on the block in the Project mode. See
the Control Building Guide and/or the online help for more information.
24. Click the Monitoring Parameters tab to display it.
25. Use this tab to configure the parameters to be displayed on the block in the Monitoring mode.
See the Control Building Guide and/or the online help for more information.
26. Click the Block Preferences tab to display it.
27. Use this tab to configure the viewing preferences for the block. See the Control Building Guide
and/or the online help for more information.
28. If you have a template license, click the Template Defining tab to display it.
29. Use this tab to select which parameters are to be template defining. See the Control Building
Guide and/or the online help for more information.
30. When you completed entering configuration data, click the OK button to close the
configuration form and save the data.
31. This completes the procedure. Go to the next section.

5.3 Assigning SIM to Execution Environment

If you assign a SIM to a CEEC300 block, you must configure the name of the FTE Bridge block that
represents the FTEB mounted in the Series A I/O chassis to identify the communications path to
the SIM on its configuration form. The following illustration shows an excerpt of the FTE Bridge
Name field that appears on the TC_MUX021 Block configuration form when the SIM is assigned to
a CEEC300 block.

- 30 -
 Chapter 5 - SIM Configuration

All illustrations used in the following procedure are for example purposes only.

5.3.1 Prerequisites
l You have started Configuration Studio and launched the Control Builder application.
l You have logged on with sufficient privileges to create control strategies using Control Builder.
l You have created a C200 and/or C300 Controller block in the Project tab.
l You have added a SIM block to the Project tab.

- 31 -
 Chapter 5 - SIM Configuration

5.3.2 To assign SIM to CEE

1. On the Edit menu, click Execution Environment Assignment; or click the Execution

Environment Assignment button on the toolbar to call up the Execution Environment

Assignment dialog, as shown in the sample illustration below.

2. If the IOMs tab is not on display in the Available modules list box, click the tab to display it.
Click the SIM module to be assigned to select it.
3. In the Assign To list box, click the CEE block that the SIM is to be assigned to select it.
4. Click the Assign -> button to assign the selected module to the given CEE block.
5. Check that the SIM block now appears in the Assigned Modules list box for the given CEE
block, as shown in the sample illustration below.

Note that the equal symbol prefix means that the block has been assigned and the down

arrow symbol prefix means that the block has been loaded to the Controller.

- 32 -
 Chapter 5 - SIM Configuration

6. Click the Close button to exit the dialog and save the assignments.
7. This completes the procedure. Go to the next section.

5.4 Loading configuration data to the SIM

The following procedure is based on doing an initial load of a block from the Project tab. You can
also initiate a reload of a block from the Monitoring tab.
All the illustrations used in the procedure are for example purposes only.

CAUTION
The load operation is still an offline function. The Load Dialog box provides the ability to
automatically inactivate a component during a load and then return the component to its
active state. Do not use this automatic inactivate/activate function, if your process cannot
tolerate the load disruption and consequent delay in activation. In this case, you must
manually toggle the component state through the Monitoring tab in Control Builder.

5.4.1 Prerequisites
l You have started Configuration Studio and launched the Control Builder application.
l You have logged on with sufficient privileges to create control strategies using Control Builder.
l You have loaded the Controller and its execution environment.
l You have assigned the SIM block to the loaded Execution Environment

- 33 -
 Chapter 5 - SIM Configuration

5.4.2 To load SIM block

1. In the Project tab, click the plus signs to expand the tree hierarchy for the Controller, CEE, and
I/O icons, as required.

2. Right-click the SIM icon and select Load from the menu to call up the Load dialog.

a. Be sure the check box in the Load column is checked.

b. Click the down arrow in the Post Load State column to select another state.
c. Check the check box at the bottom of the dialog to automatically change the state of the
SIM to the selected Post Load State after the load is completed.

- 34 -
Chapter 5 - SIM Configuration

3. Click the OK button to initiate the load and track progress through the Load Monitor dialog.
4. After load completes, check that the SIM icon now appears in the Monitoring tab tree
hierarchy.
5. This completes the procedure. Go to the next section.

- 35 -
 CHAPTER

6 SIM OPERATION

l SIM Front Panel Display and Indicators

l Monitoring Serial Interface Functions through Station Displays
l Monitoring Serial Interface Functions through Monitoring Tab in Control Builder

6.1 SIM Front Panel Display and Indicators

As shown in the illustration below, the SIM has one four-character alphanumeric display and
three two-color LEDs on its front panel. From left to right, the LEDs provide Channel A Activity,
Channel B Activity, and module health status, respectively.

Figure 6.1 SIM front panel display and indicators

l Typical startup, runtime, and firmware load SIM display indications

l Typical channel activity LED indications
l Typical health LED indications

6.1.1 Typical startup, runtime, and firmware load SIM display

indications
The following table lists some typical display indications and what they mean.

If Display Then, It Means That . . .

Is . . .
Tnnn SIM is in its self-test mode and nnn equals the current test sequence number.
TEST Factory Test Mode has either been entered on command or because the backplane
test signal was asserted.
PASS Completed Self-Test - attempting to execute Boot image.
ALIV SIM is running without a personality image. You need to load the firmware to restore
the personality image.
RDY SIM is running but the personality image is shut down. You can load the firmware.
LOAD SIM is running with an open loader connections. This usually indicates that a
firmware download is in progress.

- 36 -
 Chapter 6 - SIM Operation

If Display Then, It Means That . . .

Is . . .
BOOT SIM has completed its selftest and is attempting to execute its personality image.
Wait SIM is attempting to program flash ROM. (The Health LED is red during the actual
programming.)
Stop SIM is shutting down. This is a transitional state.
OK SIM is running its personality image and will alternately display its channel states.
A ok Channel is operating normally, communicating with FTA, and FTA is communicating
with attached device.
B ok
Aerr Channel cannot communicate with FTA.
Berr
A sf Channel can communicate with FTA but FTA is reporting a soft failure.
B sf
Acfg Channel is being configured. This is normally a transient display. If it stays on display,
the configuration is bad.
Bcfg

6.1.2 Typical channel activity LED indications

If LED Is . . . Then, It Means That . . .
Off There is no channel activity.
Flashing Green Channel transmit or receive is in progress, but not normal
continuous communications.
Brief Green Flash every 0.5 FTA is not present or not communicating - a retry is performed every
second 0.5 second.
Solid Green Normal continuous communications with FTA are in progress.

6.1.3 Typical health LED indications

If LED Is . . . Then, It Means That . . .
Off No power; significant fault.
Solid Red l During a load, it means programming the Flash ROM.
l Selftest is in progress or failed - accompanied by a test number in the
alphanumeric display, hardware fault, unrecoverable WDT timeout.
Flashing Red All I/O connections are lost, or fail state, running under software control.
Alternating SIM is in factory test mode.
Red/Green
Solid Green SIM is OK - At least one I/O data connection is active.
Flashing l During a load, SIM is getting ready to program Flash ROM.
Green
l During run, no active I/O connection since power up.

6.2 Monitoring Serial Interface Functions through Station

Displays
l About Using Station Detail displays
l About Using Station Event Summary display

6.2.1 About Using Station Detail displays

The Experion Server Station application includes pre-configured Detail displays for the SIM

- 37 -
 Chapter 6 - SIM Operation

function blocks. These displays are the default entries for the Point Detail Page parameter on the
Server Displays tab of the configuration form. Once you establish communications with a SIM you
can begin monitoring the status of any component that has been loaded as part of a Control
Strategy to an Experion Controller with points registered in the Experion Server. The Detail
displays let you quickly view the component's current state, fault status, and pertinent
configuration data.

6.2.2 About Using Station Event Summary display

Like the Detail displays, the Alarm and Event Summary displays support the integration of SIM
generated notifications and events. It is integrated with Experion component data and is for the
most part self-explanatory. Use this display to get a quick review of recent actions that have been
initiated within the system.

6.3 Monitoring Serial Interface Functions through

Monitoring Tab in Control Builder
l Activating/inactivating SIM
l SIM block icon appearances
l Monitoring/Interacting with given component/block

6.3.1 Activating/inactivating SIM

Use the following procedure to change the state of a SIM through the Monitoring tab in Control
Builder.
Activating a SIM generates a state event change and resumes the module's normal periodic
processing.
Inactivating a SIM generates a state event change; blocks channel access to flag, numeric, and
string data from the SIM; and sets channel data to NaN, Off, and ' ' , as well as setting associated
statuses to Bad.

Prerequisites

l You have logged on with sufficient privileges to make changes in a control strategy.
l You have loaded a control strategy to the Controller and can view the SIM through the
Monitoring tab of Control Builder.

To activate or inactivate a SIM

1. Right-click the SIM icon (green) and click Inactivate > Selected Item(s) on the menu Or right
click the SIM icon (blue) and click the Activate > Selected Item(s) on the menu.
2. Click the Yes button to confirm the action in the Change State dialog.
3. Wait for SIM icon to turn blue/inactive Or Wait for SIM icon to turn green/active.
This completes the procedure. Go to the next section.

6.3.2 SIM block icon appearances

The following table summarizes the various appearances that a SIM block icon in Control Builder
can assume based on configuration, view, and current SIM operating state and status.

If Icon is . . . Then, it represents . . . And, Module

State Is. . .
Project Tab
SIM configured for operation in Project. N/A

- 38 -
 Chapter 6 - SIM Operation

If Icon is . . . Then, it represents . . . And, Module

State Is. . .
(gray)
Monitoring Tab
SIM is loaded, but not monitoring N/A

(gray)
SIM is inactive Idle

(blue)
SIM is Active Run

(green)
SIM with communication failure Offnet

(red/black exclamation)
Failed SIM Offnet

(red/red exclamation)

6.3.3 Monitoring/Interacting with given component/block

Once you download a Controller and its contents, you can use the Monitoring tab to interact with
the components including the function blocks in the Control Module.
You simply double-click the desired component/block icon in the hierarchy tree menus under the
Controller icon to call up the associated Configuration form or open the Control Module in the
Control Drawing to double-click blocks contained in the CM. Click the given Configuration form tab
to view the current status of the related block data. Both the SIM and CM function blocks must be
active to view on-line data. The data can be viewed either by name or parameter reference by not
checking or checking the Show Parameter Names check box at the bottom of each tab.
Please refer to the Control Building Guide sections in On-Line Monitoring Using Control Builder for
detailed information:
l Setting the CEE Inactive
l Changing Parameters while Monitoring

- 39 -
 CHAPTER

7 SIM MAINTENANCE

l Periodic Checks
l Recommended Spare Parts
l SIM Removal and Installation Under Power
l Replacing Failed SIM T C- or TK-MUX021
l Replacing Failed Power Adapter TC-/TK-SMPD01 or TC-/TK-SMPC01
l Replacing Failed Serial Interface FTA

7.1 Periodic Checks

The following table identifies checks that you should make periodically (every 3 to 6 months) to
keep the SIM in good working condition.

Check . . . Possible Corrective Action . . .

That all segments of the 4-character If segment or LED is not lit or has dimmed, you must
display and the light emitting diodes replace the SIM, since front-panel indicators and LEDs
(LED) on SIM are working. are not field replaceable.
That all connections are secure. Secure connections, as needed.
That cable insulation is not worn or Replace cables, as required.
cracked.
That SIM is secure. Fully seat SIM in chassis.

7.2 Recommended Spare Parts

The following table provides a list of parts that you may want to keep on hand for backup, as
applicable to your given application.

Part Name Part Number Description Quantity per 10/100

SIM TC- or TK-MUX021 Serial Interface Module 1/5
Power Adapter TC- or TK-SMPD01 24 Vdc SIM FTA Power Adapter 1/2
TC- or TK-SMPC01 85 to 265 Vac SIM FTA Power Adapter 1/2
Modbus FTA MU-TSIM12 Limited Range Modbus FTA 1/2
MU-TSIM13 Extended Range Modbus FTA 1/2
MC-TSIM13
Allen-Bradley FTA MU-TSIA12 Allen-Bradley DF1 Modbus FTA 1/2

7.3 SIM Removal and Installation Under Power

Please review the Removal and Insertion Under Power (RIUP) Function Guidelines in the Control

- 40 -
 Chapter 7 - SIM Maintenance

Hardware Installation Guide before you RIUP any module.

7.4 Replacing Failed SIM T C- or TK-MUX021

Ensure that the system is offline or in a safe operating mode and power is removed from the
chassis. Also ensure that you take ESD hazard precautions when handling the SIM. See the SIM
Installation Declarations section for more information.
Use the following procedure as a guide for replacing a failed SIM.

CAUTION
We recommend that you proceed with extreme caution whenever replacing any component
in a control system. Be sure the system is offline or in a safe operating mode.
Component replacements may also require corresponding changes in the control strategy
configuration through Control Builder, as well as downloading appropriate data to the
replaced component.

7.4.1 Prerequisites
You have logged onto Control Builder with sufficient security level to make control strategy
changes.
The SIM icon is red with red exclamation point in the Monitoring tab of Control Builder.

7.4.2 To replace a failed SIM

1. Unplug the SIM to Power Adapter cable assembly from the SIM.
2. Push in the top and bottom locking tabs on the SIM.

3. Pull the SIM out of the chassis.

4. Reverse Steps 1 to 3 to install the replacement SIM.
5. Check that the SIM passes its powerup self-test and assumes an OK operating condition.
6. If SIM display shows ALIV, see the Upgrading SIM Firmware section for more information.
7. Download the SIM block from the Project tab in Control Builder. See the Loading
configuration data to the SIM for more information.
8. This completes the procedure. Resume normal operation.

- 41 -
 Chapter 7 - SIM Maintenance

7.5 Replacing Failed Power Adapter TC-/TK-SMPD01 or

TC-/TK-SMPC01
Ensure that you take ESD hazard precautions when handling the SIM power adapter. See the SIM
Installation Declarations section for more information.
Use the following procedure as guide to replace a failed SIM power adapter.

7.5.1 Prerequisites
l You have inactivated the SIM through the Monitoring tab in Control Builder.
l You have reviewed the previous CAUTION note.
l You have logged onto Control Builder with sufficient security level to activate/inactivate
components.

7.5.2 To replace SIM power adapter

1. Turn Off the power source.
2. Remove power cable leads from ac or dc power connector.
3. Disconnect the SIM-to-Power Adapter, and the Power Adapter-to-FTA cables.
4. Remove the screws that hold the Power Adapter to the surface. Be sure you are holding the
Power Adapter when you remove the last screw Or Grasp both rail mount adapters on the
tapered side and pull forward slightly to pop the Power Adapter off the DIN rail. Be sure you
hold onto the Power Adapter, so it does not fall on the floor.
5. Reverse Steps 2 to 4 to mount the replacement power adapter.
6. Turn On the power source
7. This completes the procedure. Activate the SIM and resume normal operation.

7.6 Replacing Failed Serial Interface FTA

Refer to the previous applicable Modbus or Allen-Bradley FTA installation data and just reverse the
instructions to remove the failed FTA and follow them to install the replacement FTA.

- 42 -
 CHAPTER

8 SIM TROUBLESHOOTING

This section offers some general data about fault classifications, initial checks, and SIM self-test
diagnostic codes that may help you isolate the cause of a problem.
If you have observed a specific symptom and/or identified an error code, go to the Fixing Common
Problems section to see if you can find a matching topic.
l Fault Classifications
l Initial Checks
l SIM Self-Test Diagnostic Codes
l Fixing Common Problems
l Getting Further Assistance

8.1 Fault Classifications

The following table lists some possible ways for classifying faults along with some identifying
characteristics.

Fault Classification Characteristics

Hard Failure Failure detected by hardware; operation cannot continue. If the fault does
not prevent software processing the problem, the affected node will be
rebooted under software control into the FAIL State.
l If failure occurs on Primary node, it triggers a switchover to
synchronized Secondary node.
l If failure occurs on Secondary node, it results in loss of synchronization
and reduced availability until the problem is resolved.
l If failure occurs on non-redundant node, it results in loss of control and
loss of view.
Severe Failure Failure detected by software; operation cannot continue. The affected node
will be rebooted under software control into the FAIL State.

The failure scenarios are as listed in the row above for the Hard Failure.
Soft Failure Failure detected by software; operation continues with full control and full
view. Soft failures are alarmed to the operator. FTE will be monitored by the
FTE System Management Tool.
l If failure occurs on Primary node, it does not trigger a switchover to
synchronized Secondary node.
l If failure occurs on Secondary node, it does not result in loss of
synchronization.
l If failure occurs on non-redundant node, it does not result in loss of
control and loss of view.
Installation/Startup Detected by software. Node may not become operational.
Failure
l This failure does not apply to synchronized Primary node, since
installation and startup must be successful to reach synchronized
Primary state.

- 43 -
 Chapter 8 - SIM Troubleshooting

Fault Classification Characteristics

l If failure occurs on Secondary node, it results in the inability to
complete the initial synchronization and to view the node on the
network.
l If failure occurs on non-redundant node, it results in the inability to
commence control and to view the node on the network.
Communication Communication errors between peer nodes and/or I/O devices, including
Fault Tolerant Ethernet Bridge (FTEB), do not cause any node state change.

8.2 Initial Checks

This section offers some checks that you can make to help isolate the problem. The checks are
arranged in no particular order.
l Checking Control Builder error code reference
l Checking front panel display and LEDs
l Viewing error codes through serial interface block form
l Viewing flash log
l Viewing release information log
l Viewing trace log
l Checking version and revision log
l Checking server point build log
l Using NetworkTools to view SIM statistic data
l Checking server point build error log
l Checking error log
l Using NetworkTools to capture chassis information

8.2.1 Checking Control Builder error code reference

An indication of a problem may be in the form of an error dialog that includes an error message
and possibly an error code in Control Builder.
The syntax for a typical Control Builder error message is as follows:

Connection to device is not open EPKS_E_CL_NOCONN(6L.101.3326)

In this syntax, the error code is the last four digits in the message or 3326.
Please refer to the Control Builder Error Codes Reference book for applicable error code information.

8.2.2 Checking front panel display and LEDs

Check the SIM 4-character display and light emitting diodes (LEDs) indications and compare
results with data in the SIM Front Panel Display and Indicators section of this book.

8.2.3 Viewing error codes through serial interface block form

You can view the current Detailed Error Code (ERRCODE) parameter field value on the serial
interface block's configuration form Status/Data tab through the Monitoring tab in Control Builder.
The ERRCODE value may also be visible on the face of the serial interface block in the contained
Control Module in the Monitoring mode. Refer to the Error Messages section in the Error messages
when Array Channel Block is configured for Generic MODBUS Interface or the Error messages
when Array Channel Block is configured for Allen-Bradley Interface for more information.

8.2.4 Viewing flash log

The Flash.txt log provides a list of firmware updates that have been initiated.

- 44 -
 Chapter 8 - SIM Troubleshooting

To view the log, navigate to this file location on the server: C:\Program Files\Honeywell\Experion
PKS\Engineering Tools\system\bin\Flash.txt.

8.2.5 Viewing release information log

The ReleaseInfo.txt log provides a list of Experion software releases that have been installed on the
computer.
To view the log, navigate to this file location on the server: C:\Program Files\Honeywell\Experion
PKS\Engineering Tools\system\bin\ReleaseInfo.txt.

8.2.6 Viewing trace log

The TraceLogRs.txt log provides a list of definitions for strings associated with breadcrumbs data for
given hardware components. The breadcrumbs provide a way to trace operations leading up to an
event.
To view the log, navigate to this file location on the server: C:\Program Files\Honeywell\Experion
PKS\Engineering Tools\system\bin\TraceLogRs.txt.

8.2.7 Checking version and revision log

The ver_rev.txt log provides a list of components by model number with software version/revision
along with compatible Experion software release(s).

To check the log, navigate to this file location on the server: C:\Program Files\Honeywell\Experion
PKS\Engineering Tools\system\bin\ver_rev.txt.

8.2.8 Checking server point build log

The SvrPtBld_servername.txt log provides list of process (CB) points built in the server database.
To check the log, navigate to this file location on the server: C:\Program Files\Honeywell\Experion
PKS\Engineering Tools\temp\SvrPtBld_servername.txt.

8.2.9 Using NetworkTools to view SIM statistic data

Please refer to the Viewing SIM statistics in NetworkTools section in the Control Hardware
Troubleshooting and Maintenance Guide for more information.
The Network Tools (NTools) application lets you view additional SIM diagnostic information by
selecting the SIM Module in its chassis view and making the appropriate Device menu selection.
Keep the following considerations in mind.
l An informational string is returned by the FTA to help diagnose the cause of soft failures. See
the Allen-Bradley Interface Error messages when Array Channel Block is configured for Allen-
Bradley Interface or MODBUS interface Error messages when Array Channel Block is
configured for Generic MODBUS Interface for more information.
l The statistics are a continuously updating display of the one-second-sampled, 15-second
running average statistics, collected by the SIM.
l When Control Module Array Channel block communication has failed and all the failed devices
have been set inactive, the NTools SIM status display will show the FTA revision and the FTA
communication settings.

If every Control Module Array Channel block connected to an FTA is set inactive, the NTools SIM
status display will show the FTA revision and the text ‘No Array Points are configured to this FTA '.

8.2.10 Checking server point build error log

The svrptblderr_servername.txt log provides list of any errors associated with process (CB) points
built in the server database
To check the log, navigate to this file location on the server: C:\Program Files\Honeywell\Experion
PKS\Engineering Tools\temp\svrptblderr_servername.txt.

- 45 -
 Chapter 8 - SIM Troubleshooting

8.2.11 Checking error log

The Errlog_n.txt log provides a running list of Control Builder detected errors in chronological
order. The n represents any number that is assigned to the most recent log.
To check the log, navigate to this file location on the server: C:\ProgramData\Honeywell\Experion
PKS\ErrLog_n.txt.
Prior to R400, the Errlog_n.txt file was stored in the following location on the server: C:\Documents
and Settings\All Users\Application Data\Honeywell\Experion PKS\Errlog_n.txt.

8.2.12 Using NetworkTools to capture chassis information

Please refer to the Capturing chassis information using NetworkTools section in the Control
Hardware Troubleshooting and Maintenance Guide for more information.

8.3 SIM Self-Test Diagnostic Codes

The following table lists the self-test diagnostic codes that the SIM steps through upon power up. If
a test fails, you must replace the SIM.
The LED indications are as follows during the test.
l The Module Health LED turns Red during the self-test and then Green upon successful
completion of the self-test.
l The Channel Activity LEDs turn Red until the completion of the Alphanumeric Display Test and
then Green until the completion of the ROM test.

The Test Sequence Numbers (Codes) are first sent to the factory test port and then to the
alphanumeric display.

Test Target Device Failure Function

Code (s) Modes
T000 Alphanumeric Hardware Steps through horizontal/vertical bars, and then flashes all
Display and control segments of the display through stages of brightness. For this
LED Test registers are test to work, CPU, Flash ROM, address bus, data bus, and some
not writable, I/O ports must be working.
CPU PLD
The firmware version is briefly displayed after this test.
T001 CPU Type and Wrong CPU This test is done before the ROM tests, because a wrong CPU
Version Check chip installed could appear to work, but might fail timing tests. The CPU
version is also displayed as E40+ or E41+ for 630e Rev 4.0 or
4.1, 100 MHz. Or, R for 603r, 150 MHz.
T010 Flash ROM Flash chip For each ROM line (8 bytes) of the 1 MB boot image area, the
Parity Scan data is read and the expected parity is computed and
compared with the actual parity. The test is timed.
T011 Flash ROM Instruction The time needed to perform the above test is checked for
Parity Scan Cache, MEM reasonability. This test detects 603 Instruction Cache failure
Time PLD wait and/or ROM wait state problems.
states
T012 Flash ROM Flash chip The checksum of the boot personality in ROM is computed and
Checksum verified.
T013 Flash ROM Flash chip The checksum of the boot personality's Flash ROM loader is
Loader computed and verified.
Checksum
T015 XILINX DRAM Hardware This bit is asserted if the XILINX did not power up properly.
Controller Status
ASIC Ready Register
Check chips,
XILINX
T016 XILINX DRAM MEM PLD The XILINX configuration file is written one bit at a time to the

- 46 -
 Chapter 8 - SIM Troubleshooting

Test Target Device Failure Function

Code (s) Modes
Controller chip.
ASIC Load
T017 XILINX DRAM Hardware This bit is asserted if the XILINX did not configure properly.
Controller Status
ASIC Error Register
Check chips,
XILINX,
MEM PLD
T018 XILINX DRAM XILINX, The XILINX configuration file is read back 32 bits at a time, and
Controller MEM PLD compared to the image in ROM. A read-back mask is used to
ASIC Read- determine which bits of the stream are not to be compared for
Back Verify one reason or another.
T020 RAM Path RAM, Verifies that RAM can be read/written as 32-bit words. This is
XILINX, the first and simplest way to access RAM. It is also the only way
buffers, to know if the XILINX was configured properly.
MEM PLD
T021 RAM Parity RAM, Writes two 8-byte patterns and verifies that parity byte was set
Path XILINX, correctly, even and odd.
buffers,
MEM PLD
T022 RAM Word RAM, Verifies that word patterns can be written and read including
Access XILINX, three cases of miss-aligned transfer.
buffers,
MEM PLD
T023 RAM Byte RAM, Verifies that writing a string of 8 bytes can be read back as two
Access XILINX, correct words, and as 8 bytes.
buffers,
MEM PLD
T024 RAM Half RAM, Verifies that half words can be read.
Access XILINX,
buffers,
MEM PLD
T025 RAM Byte RAM, Verifies that bytes can be written correctly.
Write XILINX,
buffers,
MEM PLD
T026 RAM Half RAM, Verifies that half words can be written correctly.
Write XILINX,
buffers,
MEM PLD
T027 RAM Half RAM, Verifies that half-words can be written and ready when miss-
Align XILINX, aligned.
buffers,
MEM PLD
T028 RAM Word RAM, Verifies that words can be written and ready when miss-
Align XILINX, aligned.
buffers,
MEM PLD
T029 RAM Double RAM, Verifies that the floating point unit can write and read a
Access XILINX, double-word value, and the same value is correctly stored as
buffers, two words.
MEM PLD
T030 EDAC RAM, Verifies that any single-bit error can both be detected and
Correction XILINX, corrected, in data or check bits, in high or low word. One bit at a
buffers, time is changed and walked through one line of RAM.
MEM PLD

- 47 -
Chapter 8 - SIM Troubleshooting

Test Target Device Failure Function

Code (s) Modes
T031 EDAC Error RAM, Verifies that a double-bit error can be detected, in both high
Test XILINX, and low word.
buffers,
MEM PLD
T032 Stuck Hardware After verifying that no machine check source is active in the
Machine Status Hardware Status Register, unmasks the exception. No
Check Register interrupt is expected.
Interrupt chips, CPU
PLD, MEM
PLD
T033 Data Parity Parity Verify that the data parity error detection is working by
Interrupt buffers, enabling data parity checking and the machine check
parity circuit exception, then walking through an area of ROM which has
been programmed with bad parity. There are eight 8-byte lines,
each with a parity error in a different byte, such that all byte
lanes are covered.
T034 RAM Parity Destructive The RAM is read two words at a time until end or until a
Sweep RAM Test multiple-bit error is detected. Single bit errors are counted, and
written back for correction. Parity errors (SRAM) or Multi-bit
Errors (DRAM) force destructive testing in RAM.
T035 RAM Single- RAM self- The number of single-bit errors is compared against a
Bit Error refresh threshold. High temperatures may cause a number of single-
Threshold control very bit errors.
Test high temp
T036 RAM Parity Instruction The time needed to perform the above test is checked for
Sweep Time Cache, MEM reasonability, using the PPC 630 decremented. This test
PLD wait detects 603 Instruction Cache failure and/or RAM wait-state
states problems. Note that the time is not measured (zero) if a parity
error / Multi-bit Error is detected and memory is flushed.
T037 EDAC XILINX chip, Verifies that a double-bit error will generate the correct
Interrupt Hardware machine check exception.
Status
Register
chips, MEM
PLD, CPU
PLD
T040 RAM Memory Battery low The magic numbers are checked to see if the data in RAM may
Retention still be valid. In the absence of parity errors, RAM is considered
Test valid at the boot level. It passes test, bumps power cycle
counter and skips destructive test and flush.
T041 RAM XILINX, RAM Checks address and data lines by writing a non-repeating
Destructive chip, MEM pattern over the whole memory, then verifying it. Runs with
Pattern Test PLD data parity enabled and fatal. Two starting patterns are used
for better coverage.
T042 Flush RAM XILINX, RAM Write zeros to all locations and verify. Data parity is enabled
Data Zeros chip, MEM during this test. Runs with data parity enabled and fatal.
PLD
T043 Flush RAM RAM chip, Verify that Flush RAM Data Zeros test forced parity byte to ones
Parity Ones XILINX, (check bits to correct value). Data parity disabled during this
Parity/check test, but enabled permanently after the test completes. Runs
bit buffers with data parity disabled. Sets magic number to show memory
is initialized.
T050 CPU I-Cache Compare how many times a loop runs in one clock tick with I-
Active Test Cache disabled and enabled.
T055 CPU D-Cache CPU Enable cache and execute a RAM write/verify loop. Verify that it
Active Test runs faster than it would if the cache were broken or disabled.

- 48 -
 Chapter 8 - SIM Troubleshooting

Test Target Device Failure Function

Code (s) Modes
Flush/disable cache and verify that the data was written to
RAM correctly. Only uses the memory test area, so just shows
that the data cache is enabled and at least partially functional.
T056 CPU D-Cache CPU The checksum of the boot code is repeated with Data Cache
Function Test enabled. The test is timed. If the data cache is not working
properly, the checksum will fail or the test will take too long.
T060 Hardware Hardware Verifies that the Hardware Status Register appears to be
Status Status readable without generating a machine check exception.
Register Register
Access Test chips, CPU
PLD
T062 Hardware Backplane, Verifies that the DC FAIL/SRESET status is not asserted.
Status P/S
Register DC
FAIL Test
T064 Hardware IC PASIC Verifies that the ICP_INT status is not asserted.
Status
Register ICP_
INT Test
T065 Hardware Dev Card Verifies that the DEV_INT (Interrupt from development board)
Status DUART, Dev status is not asserted.
Register DEV_ Card PLD,
INT Test CPU PLD
T066 Hardware XILINX, Verifies that the MEM_INT (interrupt from memory board)
Status MEM PLD status is not asserted.
Register
MEM_INT
Test
T067 Hardware CUP PLD, Verifies that the SYS_FAIL status is not asserted for longer
Status backplane, than a specified period, to accommodate other module's tests.
Register SYS_ other
FAIL Test modules
T068 Hardware PLD, WDT Verifies that the WDT_PENDING status is not asserted.
Status chip
Watchdog
Timer
Timeout
Pending Test
T069 Hardware DUART Verifies that the FTA DUART interrupt status is not asserted.
Status
Register FTA_
INT Test
T070 Hardware ICP ASIC Verifies that the ICP-FAULT status is not asserted. This would
Status indicate that the IC PASIC had failed to come out of reset.
Register ICP_
FAULT Test
T071 IC PASIC ICP ASIC Enables interrupts to make sure that there is no interrupt
Release and stuck in the asserted state. Because the Hardware Status
Stuck Register has been tested for potential interrupt sources, no
Interrupt Test interrupt is expected.
T072 SYS_FAIL CPU PLD, Verifies that SYS_FAIL system controls assert and de-assert
Assert Test backplane, the SYS_FAIL condition. Uses timeouts to prevent conflicts with
other other modules under test on the same backplane. No SYS_
modules FAIL interrupt test. This test will fail if another module leaves
STS_FAIL asserted.

- 49 -
Chapter 8 - SIM Troubleshooting

Test Target Device Failure Function

Code (s) Modes
T073 Watchdog CPU PLD, Verifies that the WDT does not expire when hit for 500 msec,
Timer Test WDT chip, based on Hardware Status Register and interrupt. Uses the
ICP ASIC, WDT Test mode to show that the WDT will time out and
ICP generate an SMI interrupt in more than 195 msec but less
Oscillator than 210 msec. The interrupt routine disables WDT Test Mode
to clear the interrupt. Disables WDT after test.
T080 FTA DUART CPU PLD Verifies that the DUART can be initialized.
Register
Access Test
T081 FTA DUART DUART Check the DUART clock against the CPU timebase register to
Clock Crystal make sure they are running at the same relative rates. The
Compare Test test is run for 2048 DUART ticks (8.8888 msec) which
corresponds to 55555 CPU ticks +/- 54.
T082 FTA DUART CPU PLD Verifies that the DUART can generate an interrupt. The
Interrupt Test counter which had expired from the previous test is used. The
interrupt is verified in the DUART ISR, then enabled through
the DUART IMR and verified in the Hardware Status Register;
finally exceptions are enabled to make sure that the interrupt
occurs.
T083 FTA DUART Transceivers Verifies that data cannot be transmitted or received if either
Channel A transceiver is disabled, but data can be transmitted and
Transceiver received when both are enabled.
and Loopback
Test
T084 FTA DUART Transceivers Verifies that data cannot be transmitted or received if either
Channel B transceiver is disabled, but data can be transmitted and
Transceiver received when both are enabled.
and Loopback
Test
T085 FTA Local A Transceivers Verifies that transmitter can be enabled.
Enable
T086 FTA Local B Transceivers Verifies that transmitter can be enabled.
Enable
T100 ICP Shared Shared RAM Checks address and data lines by writing a non-repeating
RAM chip, buffers, pattern over the whole memory, then verifying it. Runs with
Destructive arbitration data parity enabled and fatal. Two starting patterns are used
Pattern Test for better coverage.
T101 ICP Shared Shared RAM Verify that 603 data parity error did not occur during previous
RAM chip, buffers, test. Runs with data parity enabled and fatal.
Destructive arbitration
Pattern Parity
Interrupt
Check
T102 ICP Shared Shared RAM Verified. This must be done before writing to the ASIC control
RAM chip, buffers, registers. Runs with data parity enabled and fatal.
Initialization arbitration
to Force
Correct Odd
Parity
T111 ICP ASIC ICP ASIC, The hardware setup parameters having been written to the
Register ASIC-RAM ASIC some time earlier, access to the ICP ASIC registers is
Access Test I/F verified, and the error register is verified as zero. The ECHO_
REV operation is used to make the ASIC write its version
register to a designated location in Shared RAM. This value is
saved in RAM. The rest of Shared RAM is verified to make sure
that only the designated location was written.

- 50 -
 Chapter 8 - SIM Troubleshooting

Test Target Device Failure Function

Code (s) Modes
T112 IC PASIC IC PASIC, Correct access to the ICP shared RAM from the ASIC is verified
Unique ASIC-RAM through the Echo Test, by asking the ASIC to write each
Address Echo I/F location's address at that address. This test is performed once
Test for the address and once for the complement of the address.
Coverage is not 100% because only the 17 LS address bits are
supported by ASIC.
T113 ICP Bus Lock Bus lock or Verify that the IC PASIC can be locked out of its Shared RAM by
Test arbitration the 603. This is accomplished with the ASIC Echo_REV Test by:
circuit (CPU locking the bus, telling the ASIC to write to a specified address,
PLD) ICP looking at the address, unlocking the bus, and looking at the
ASIC address to see that it changed and the correct data was
written.
T114 ICP Clock Run IC PASIC Verifies that ICP clock is running. `
Test Oscillator
T115 ICP Clock 603 Check the ASIC clock against the 603 clock to make sure they
Compare Test Oscillator, are running at the same relative rates. The IC PASIC read
ICP ASIC timer command is used to write the Internal Timer to shared
Oscillator RAM where it is read by the 603. The test is run for 20 msec
and +/- 0.016 msec error is allowed at this time.
T116 ICP ASIC Hardware The IC PASIC timer interrupt is enabled, along with the CPU
Interrupt Test Status external interrupt, to see if the interrupt generation and
Register recognition works and the Hardware Status Register ICP_INT
chips, ICP is asserted. The ASIC timer is disabled, and the CPU interrupt
ASIC inhibited, after the test.
T130 Personality No A parity interrupt scan is performed of the 3 MB personality
Parity Check Personality, area.
bad
personality
load
T131 Personality Bad flash If the previous test indicated a parity error, the 3 MB
Area Erase chip personality are is erased and verified.
T132 Personality Bad If the previous test indicated no parity error, and a personality
Checksum personality is present, the personality checksum is verified. If no errors, a
load key is written in RAM to indicate that the personality is valid.
T255 PCM Signals The Module Health LED turns Green. Depending on various
End of Self- state flags and whether RAM was flushed, self-test will exit to
Test the Alive/Fail executive or start the personality. Displays BOOT
when starting the personality and PASS when starting the
Alive executive.

8.4 Fixing Common Problems

This section identifies some common problems and describes how you might fix them.
l Loss of power
l Poweron Self-Test Fault
l Fatal ECC error
l Background Diagnostic failure

8.4.1 Loss of power

The power supply has failed or the main power source has been shut down or is experiencing a
brownout or blackout condition.

Diagnostic check

- 51 -
 Chapter 8 - SIM Troubleshooting

l The 4-character display and LEDs on the SIM are off.

l In the Monitoring tab, the SIM icon turns red.

Cause

Main power source has been disconnected or shut down either manually or temporarily by
brownout or blackout condition.

Solution

Reconnect the main power source or turn it On or wait for temporary brownout or blackout
condition to pass.

Cause

The 24 Vdc or 120/240 Vac chassis power supply failed or power cable has been disconnected or
failed.

Solution

Replace the chassis power supply or reconnect/replace the power cable.

8.4.2 Poweron Self-Test Fault

The SIM poweron selftest has detected a fault.

Diagnostic check

A self-test diagnostic code remains on display and the poweron selftest does not continue.

Cause

The SIM poweron selftest has detected a failure that does not allow operation to continue.

Solution

Try cycling power to the SIM. Replace the SIM, if fault persists. See Replacing Failed SIM T C- or
TK-MUX021 for details.

8.4.3 Fatal ECC error

The SIM software has detected a fatal Error Checking and Correction (ECC) condition that can be a
multiple-bit error or excessive single bit errors in main Random Access memory (RAM).

Diagnostic check

l The 4-character display on the SIM displays FAIL.

l In the Monitoring tab, the SIM icon turns red.

Cause

The SIM software has detected a failure that does not allow operation to continue. There can be
many causes for a failure including hardware, use the NetworkTools function to capture a crash
block for the device to determine the possible cause before proceeding.

- 52 -
 Chapter 8 - SIM Troubleshooting

Solution

Try cycling power to the SIM. If error persists, replace the SIM. See Replacing Failed SIM T C- or
TK-MUX021 for details.
Check the Trace log for breadcrumbs that occurred prior to the event. See Viewing trace log and
Using NetworkTools to capture chassis information for more information. Provide the results of the
trace log to our Technical Assistance Center (TAC) for analysis.

8.4.4 Background Diagnostic failure

The SIM detects failure in system integrity checks, such as Watch Dog Timer (WDT), error detection
circuits, readback, microprocessor static configuration registers, and Read Only Memory (ROM)
checksum.

Diagnostic check

l The 4-character display on the SIM displays FAIL.

l In the Monitoring tab, the SIM icon turns red.

Cause

The SIM software has detected a background diagnostic failure that does not allow operation to
continue.

Solution

Try cycling power to the SIM. If error persists, replace the SIM. See Replacing Failed SIM T C- or
TK-MUX021 for details.
Check the Trace log for breadcrumbs that occurred prior to the event. See Viewing trace log and
Using NetworkTools to capture chassis information for more information. Provide the results of the
trace log to our Technical Assistance Center (TAC) for analysis.

8.5 Getting Further Assistance

l Other troubleshooting sources
l Guidelines for requesting support

8.5.1 Other troubleshooting sources

The following table lists other documents and sections that contain troubleshooting information
for other Experion subsystems.

Document/Section Comments
Experion Rxxx > Reference There is a separate interface reference for each
type of controller other than the Process
Controller; for example, the ASEA Interface
Reference.
Most of these references contain an interface-
specific troubleshooting section.
Experion Rxxx > Reference > Control Builder Describes error codes generated from within
Error Codes Reference Control Builder.
Experion Rxxx > Troubleshooting and The main repository for troubleshooting,
Maintenance > Control Hardware maintenance and repair of Process Controllers.
Troubleshooting and Maintenance Guide

- 53 -
 Chapter 8 - SIM Troubleshooting

Document/Section Comments
Experion Rxxx > Configuration > DeviceNet Describes error codes generated from DeviceNet
Implementation Guide > Troubleshooting Interface Board.
DeviceNet Status Failures
Experion Rxxx > Installation and Upgrades > Troubleshooting FTE bridges.
Fault Tolerant Ethernet Bridge
Implementation Guide > Service >
Troubleshooting
Experion Rxxx > Installation and Upgrades > Troubleshooting FTE nodes.
Fault Tolerant Ethernet Installation and
Service Guide > Troubleshooting FTE Nodes
Experion Rxxx > Reference > Honeywell TDC Troubleshooting TDC 3000 Hiway problems.
3000 Data Hiway Interface Reference > TDC
error codes and Troubleshooting
Experion Rxxx > Configuration > Qualification Troubleshooting QVCS.
and Version Control System User Guide >
QVCS Troubleshooting
Experion Rxxx > Operations > SafeView User's Describes the meaning of SafeView configuration
Guide > Appendix D - SafeView Error errors.
Messages
Experion Rxxx > Reference > Server Scripting Describes the meaning of error messages in the
Reference > Server scripting error messages server log specific to server scripting.
Experion Rxxx > Reference > System Describes the meaning of System Management
Management Configuration Guide > Configuration errors.
Troubleshooting System Management
Experion Rxxx > Reference > System Describes the meaning of SES Configuration
Management Configuration Guide > errors.
Troubleshooting SES
Experion Rxxx > Reference > System Describes the meaning of SPS Configuration
Management Configuration Guide > errors.
Troubleshooting SPS
Experion Rxxx > Planning and Design > Troubleshooting workstation nodes used in
Planning, Installation, and Service for WS360 Experion and TPN.

8.5.2 Guidelines for requesting support

If you cannot resolve a problem using this guide, you can request support from your Honeywell
Solution Support Center.
When requesting support, please supply as many relevant details as possible, including:
l Short summary of the problem
l Product Name and release.
l Recent changes, such as upgrades/service packs, to Experion software, Windows or other
applications.
l Subsystem and its version/build, if the problem relates to a particular subsystem, such as
Station or Quick Builder. If the problem relates to Display Builder, please specify whether it is
HMIWeb Display Builder (for HMIWeb displays) or Display Builder (for DSP displays).
l Operating system, variant and service pack, for example ' Windows 2000 Server, SP5 ' .
l Instructions on how to reproduce the problem. If the problem is reproducible, please supply
step-by-step instructions - the more detailed the steps the better.
l Diagnostic package which contains any relevant logs.

- 54 -
 CHAPTER

9 ALLEN-BRADLEY INTERFACE REFERENCE

l Array Channel Block Configuration for Allen-Bradley Interface

9.1 Array Channel Block Configuration for Allen-Bradley

Interface
The Serial Interface Array Channel function blocks communicate with Allen-Bradley
Programmable Logic Controllers (PLC) through the Serial Interface I/O Module (SIM).
The SIM communicates with the Allen-Bradley (A-B) FTA. The A-B FTA communicates with the
Allen-Bradley KE/KF Computer Interface Module (CIM) using EIA-232-D protocol at 19,200 baud
with even parity. The KE/KF module communicates with PLCs on an Allen-Bradley Data Highway
or Data Highway Plus using DF1 protocol with embedded responses. Direct connection to the
PLC-5 RS-232 port is also supported. Refer to Allen-Bradley Data Highway protocol manuals for
details.
The Allen-Bradley PLC families supported are PLC-2, PLC-3, and PLC-5. The PLC-5 family
consists of the 5/10, 5/15, 5/25, 5/40, and 5/60 models.
l AUXDATA parameter configuration for Allen-Bradley interface
l AUXDATA[6] parameter setting details
l DEVADDR parameter configuration
l STARTINDEX and number of elements parameters configuration
l Report by Exception requirements
l Performance considerations when Array Channel Block is configured for Allen-Bradley
Interface
l Array Channel block execution state when Array Channel Block is configured for Allen-Bradley
Interface
l Write processing considerations when Array Channel Block is configured for Allen-Bradley
Interface
l Diagnostic procedures and data configuration
l Time-Out gate configuration
l Status and error checking when Array Channel Block is configured for Allen-Bradley Interface
l Error messages when Array Channel Block is configured for Allen-Bradley Interface
l Special FTA to KE/KF cabling considerations
l FTA direct to PLC-5 RS-232 Port cable considerations
l Reference Specifications when Array Channel Block is configured for Allen-Bradley Interface

9.1.1 AUXDATA parameter configuration for Allen-Bradley interface

The following table summarizes the AUXDATA parameter configuration that defines Serial
Interface Array Channel block communications with the Allen-Bradley PLC.

- 55 -
Chapter 9 - Allen-Bradley Interface Reference

ATTENTION
When the AUXDATA[0…7] parameters are not being used with a Allen-Bradley interface, they
should be set to the default value of NaN (Not a Number).

Parameter Function Description

AUXDATA These parameters Set these parameters to NaN when communicating with an Allen-
[0] to are not applicable Bradley PLC.
AUXDATA to an Allen-
[3] Bradley interface.
AUXDATA Specifies the Use the following setting for a given PLC type.
[4] Allen-Bradley PLC
l 2.0 for PLC-2 type
family type.
l 3.0 for PLC-3 type
l 5.0 for PLC-5 type

You can access different PLC family types through the same FTA
by using multiple Serial Interface Array Channel blocks with the
desired family type setting specified for each Array Channel block's
AUXDATA[4] parameter. You can access PLC-3 or PLC-5 type
controllers using PLC-2 emulation by setting the AUXDATA[4]
parameter value to 2.0.

For diagnostic related Array Channel blocks, you must set the
AUXDATA[4] parameter to ' 0 ' for a Computer Interface Module or '
NaN ' for a loopback test. See the following section Diagnostic data
configuration for details.
AUXDATA Specifies the Use the following setting for a given PLC type.
[5] Allen-Bradley PLC
file number. l NaN for PLC-2 type
l 0 to 999 for PLC-3 or PLC-5 type

For diagnostic related Array Channel blocks, you must set the
AUXDATA[5] parameter to ' -1 ' for a Computer Interface Module or
PLC type, or ' -3 ' for a loopback test. See the following section
Diagnostic data configuration for details.
AUXDATA Specifies the data See the paragraph following this table for details about making
[6] type for Allen- AUXDATA[6] settings for a given PLC type.
Bradley PLC -2 or
PLC-5 type or the Different settings are required for diagnostic related Array
Channel blocks. See the following section Diagnostic data
section ID for a
PLC-3 type. configuration for details.

AUXDATA Specifies the Each Array Channel block can have a different scan rate. The
[7] Allen-Bradley PLC Allen-Bradley interface supports either polling or Report by
scan rate. Exception (RBE) independent of the scan rate. Use the following
setting for a given scan rate.
l 0 to scan the channel as fast as possible
l 1 to 255 to scan the channel once every 1 to 255 seconds
l 256 to scan the channel once after configuration or after link
or device failure recovery (then only Report by Exception)

Notes:
1. Use higher priority scanning for time-critical data, and
slower scanning or RBE for lower priority channels where
data changes infrequently.

- 56 -
 Chapter 9 - Allen-Bradley Interface Reference

Parameter Function Description

2. If all channels are set for very fast scan (0 to 2 seconds),
actual performance may be less than one update per
second, especially when writes are used.
3. A setting greater than 256 causes a POL FREQ error.
4. If more than one Array Channel block is configured to map
the same PLC memory area, only one of the blocks will be
updated with RBE data.
5. After the first scan is completed with a setting of 256, Array
data is updated when RBE data is received for that channel
or after any communication error (but not after
configuration errors).
6. The RBE feature is independent of the scan rate. See the
section Report by Exception requirements for details.

9.1.2 AUXDATA[6] parameter setting details

The following tables list the AUXDATA[6] parameter settings required for a given data type and A-B
PLC type. It also lists the Array Channel block associated with a given data type as well as the data
range and maximum number of elements.

WARNING
An unexpected write may take place when changing AuxData[6] (data type) online, in the
following scenario:
1. Data Type was 4 or 5 (read only unsigned).
2. An online value change was attempted. The change is ignored.
3. Data Type is changed to other writable numeric type.

The previously-attempted change is now accepted and passed to the PLC.

l PLC-2 type settings:

Data Type AUXDATA[6] Array Channel Data Range Max. No. Elem.
Setting Function Block
Output 0 SIFLAGARRCH ON/OFF 512
Input 1 SIFLAGARRCH ON/OFF 512
Status 2 SIFLAGARRCH ON/OFF 512
Bit 3 SIFLAGARRCH ON/OFF 512
Integer 4,5 SINUMARRCH 0 to 65535 32
(unsigned 16 Bit)
Floating Point 6 Unsupported _ _
(VAX F Format)
Integer 7 SINUMARRCH -32768 to 32767 32
(signed 16 Bit)
Floating Point 8 SINUMARRCH -34E38 to 34E38 16
(IEEE Single
Precision)
ASCII 9 SITEXTARRCH Printable 8 of 8
Characters
4 of 16

- 57 -
Chapter 9 - Allen-Bradley Interface Reference

Data Type AUXDATA[6] Array Channel Data Range Max. No. Elem.
Setting Function Block
2 of 32
1 of 64
Note: The PLC-2 controller only recognizes status or integer data types. The interface handles
other data types by requesting single or multiple elements for integer data according to the
AUXDATA[6] setting. The SIM does not support the VAX F format.

l PLC-3 type settings:

Data Type AUXDATA[6] Array Channel Data Range Max. No. Elem.
Setting Function Block
Output 1 SIFLAGARRCH ON/OFF 512
Input 2 SIFLAGARRCH ON/OFF 512
Integer 5 SINUMARRCH -32768 to 32767 32
(signed 16 Bit)
Floating Point 6 Unsupported _ _
(VAX F Single
Precision)
Binary 8 SIFLAGARRCH ON/OFF 512
ASCII 9 SITEXTARRCH Printable 8 of 8
Characters
4 of 16
2 of 32
1 of 64
Status 13 SIFLAGARRCH ON/OFF 512
Notes:
1. The setting for AUXDATA[6] corresponds to the PLC-3 controller Section Identifier.
2. The PLC-3 controller does not support these data types: timers, counters, decimal, high
order (two word) integers, and pointers.
3. The SIM does not support the VAX F format.

l PLC-5 type settings:

Data Type AUXDATA[6] Array Channel Data Range Max. No. Elem.
Setting Function Block
Output 0 SIFLAGARRCH ON/OFF 512
Input 1 SIFLAGARRCH ON/OFF 512
Status 2 SIFLAGARRCH ON/OFF 512
Bit 3 SIFLAGARRCH ON/OFF 512
Integer *4,5 SINUMARRCH 0 to 65535 32
(unsigned 16 Bit)
Integer 7 SINUMARRCH -32768 to 32767 32
(signed 16 Bit)
Floating Point 8 SINUMARRCH -34E38 to 34E38 16
(IEEE Single
Precision)
ASCII 9 SITEXTARRCH Printable 8 of 8
Characters
4 of 16

- 58 -
 Chapter 9 - Allen-Bradley Interface Reference

Data Type AUXDATA[6] Array Channel Data Range Max. No. Elem.
Setting Function Block
2 of 32
1 of 64
*These Allen-Bradley file types are read only and writes to them are ignored.
Notes:
1. The setting for AUXDATA[6] corresponds to the PLC-5 controller file type, except 9 is
assigned for string data. Configure the PLC-5 file to use data type ‘A‘ (ASCII), not data type
‘ST‘ (string).
2. Timers/counters require three words per timer/counter. Presets and accumulated values
are read only. They can only be modified in ladder logic.
3. The following restrictions also apply for PLC-5:

l If the AUXDATA[5] setting is 0, then AUXDATA[6] must be set to 0 (output data).

l If the AUXDATA[5] setting is 1, then AUXDATA[6] must be set to 1 (input data).
l If the AUXDATA[5] setting is 2, then AUXDATA[6] must be set to 2 (status).

9.1.3 DEVADDR parameter configuration

You configure the device address (DEVADDR) parameter to specify the Node Address for the A-B
PLC in octal. For example, if the PLC Node Address is 758, enter 75 as the device address setting in
the Array Channel block configuration form. More than one Array Channel block can have the
same device address.
The valid Node Address range is 08 to 3768. (Note that the FTA firmware does the octal to decimal
conversion automatically, so do not convert the octal address to decimal.)

9.1.4 STARTINDEX and number of elements parameters

configuration
The value configured for the STARTINDEX parameter in a given Array Channel block determines
the PLC data table location and function. Only one type of external data (Flag, Numeric, or String)
can be accessed per Array Channel block. The following paragraphs describe the setting
considerations for a given PLC type.
l PLC-2 Type: Use the appropriate octal address within the PLC-2 data table. For example, if the
octal address is 1768, enter 176 as the start index setting in the Array Channel block
configuration form.
l PLC-3 Type: Use either the word part of the PLC-3 address or the structure value for the
floating point data. For all data types except input/output (I/O), the decimal range is 0 to
999910. For I/O data, enter the start index setting in the Array Channel block configuration
form as an octal number. The range for actual I/O is 08 to 3778 and the range for storage
locations is 4008 to 77778.
The PLC-3 Context and External Data Tables are only supported to the extent that Context is
fixed equals 1 (current context) and the External Data Table is always equal to E3.
l PLC-5 Type: Use the file start index depending on the type of data (Flag, Numeric, String).
For flag data, the start index setting represents the word address within the file. If the AUXDATA
[6] setting is 0 (Output) or 1 (Input), enter the start index for a Flag Array Channel block as an
octal number in the range of 0008 to 1778. A non-octal digit or an out-of-range value causes a
STARTIDX error.
Specify all other start index settings as integers, including flag array data except as noted above
for input or output data type. The SIM does not check file size.

- 59 -
 Chapter 9 - Allen-Bradley Interface Reference

The number of elements parameter (NFLAG, NNUMERIC, or NSTRING) in a Flag Array, Numeric
Array, or Text Array Channel block determines the number of flags, numerics, or strings in a given
data array. The tables in AUXDATA[6] parameter setting details section list the maximum number of
elements for a given data type for reference.

9.1.5 Report by Exception requirements

Before an FTA will accept RBE data, the following conditions must be true.
l The corresponding Array Channel block must be configured.
l The channel must have been scanned at least once.
l The sending device's source address (SRC) must match the Array Channel block's configured
device address (DEVADDR) parameter.
l The quantity of the data received by the FTA in an RBE request must match the quantity of the
data configured for the destination Array Channel block.
l The command code (CMD) and the function number (FNC) in the Allen-Bradley communication
messages must be as specified in the following table.
l An RBE_FULL error results if even one RBE message is rejected without indication back to the
device that generated the message.
l RBE data is rejected by any Array Channel block configured to map diagnostic counter data, or
run a diagnostic loop, or by any PLC-5 configured for Timer/Counter data.
l For a PLC-5 controller, the Data Type (AUXDATA[6]) parameter must match the file type start
index configured for the destination Array Channel block.

Note that configuring more than one Array Channel block to map the same PLC memory area
results in only one of the Array Channel blocks being updated with RBE data.

Function PLC-2 PLC-3 PLC-5

Data Read by SIM from Basic Command Set: ' Specific command ' Specific command '
PLC Unprotected Read ' Word Range Read ' Word Range Read '
(All Data Types) CMD: 01 CMD:0F CMD:0F

FNC: N/A FNC: 01 FNC: 01

Data Write by SIM to Basic Command Set: ' Specific command ' Bit Specific command '
PLC Unprotected Bit Write ' Write ' Read-Modify-Write '

(Flag Data Type) CMD: 05 CMD:0F CMD:0F

FNC: N/A FNC: 02 FNC: 26
Data Write by SIM to Basic Command Set: ' Specific command ' Specific command '
PLC Unprotected Write ' Word Range Write ' Word Range Write '
(Other Data Types) CMD: 08 CMD:0F CMD:0F
FNC: N/A FNC: 00 FNC: 00
Data Write by PLC to Basic Command Set: ' Specific command ' Specific command '
SIM (RBE) Unprotected Write ' Word Range Write '
Typed Write '
(All Data Types) CMD: 08 CMD:0F
CMD:0F
FNC: N/A FNC: 00
FNC: 67
*These functions must use the Logical Binary Addressing format or the RBE message is rejected
by the SIM. Other formats including PLC-3 Symbolic and PLC-5 Logical ASCII will be rejected.

9.1.6 Performance considerations when Array Channel Block is

configured for Allen-Bradley Interface

ATTENTION

- 60 -
 Chapter 9 - Allen-Bradley Interface Reference

l Since the Serial Interface I/O Module (SIM) bandwidth is limited, the Array Channel
blocks only process writes which change the current process value. This eliminates
unnecessary repeated writes.
l In Experion systems with redundant Controller configurations, the writes are not
guaranteed during a failover. The store attempt may occur in the Primary Controller,
but it may not reach the SIM before the failover occurs. The Secondary Controller
does not attempt to resend the data.

An active SIM function block processes the following actions once per its publication period of 250
milliseconds. The publication rate is the same whether the SIM block is assigned to a 5ms-CEE or a
50ms-CEE type.
l Load Serial Interface Array Channel block configurations to the SIM.
l Send Array Channel block write requests to the SIM.
l Monitor status of the SIM, and report diagnostics, as applicable.

Of course, these actions are not performed when the SIM block is inactive. When the SIM block is
inactive, the Array Channel blocks set their data to applicable default values.
The SIM block collects the writes for each array channel and sends them to the SIM every 250ms.
The following table lists the maximum number writes a SIM block supports per channel in every
250ms cycle. If the SIM block's write list becomes full, it rejects a write to the array channel block.

Array Channel Block Maximum Number of Writes (Channel/250ms)

SINUMARRCH 8
SIFLAGARRCH 16
SITEXTARRCH (STRLEN = 8) 8
SITEXTARRCH (STRLEN = 16) 4
SITEXTARRCH (STRLEN = 32) 2
SITEXTARRCH (STRLEN = 64) 1

Writes to Array Channel Blocks can also be rejected because the SIM is not keeping up with the
writes being sent by the SIM block. Write overruns are indicated by the SIM block FTAAOVRNFL and
FTABOVRNFL parameters. To provide an overrun condition alarm, connect the overrun
parameters to a FLAG function block configured to generate an OffNormal alarm.

For an Allen-Bradley interface, all configured Array Channel blocks scan the PLC devices in a
circular sequence at the specified scan rate with the read data requests. A write data request
preempts the read requests (and/or response to any RBE requests). The number of consecutive
write data requests is limited to eight (8), after which a Report by Exception request or scan read
request is serviced. If outputs, RBE requests, and scan read requests are stacked continuously, the
RBE requests and scan read requests are alternately serviced after every eight outputs. This slows
data acquisition considerably.
Channels with a scan frequency of 3 to 255 seconds are scanned once upon block activation and
then at the configured scan rate. RBE messages reset the scan interval timer, therefore frequent
RBE messages can prevent unnecessary scanning.
There is a limit to the number of write requests per second that can be serviced before read
response is significantly affected. Because of the time ladder logic takes to execute the maximum
number of write requests per second to a PLC running ladder logic should be limited even further.
Your Honeywell representative can provide test data and reports on PLC modules certified to date.

9.1.7 Array Channel block execution state when Array Channel Block
is configured for Allen-Bradley Interface
The Array Channel block uses the Execution State (EXECSTATE) and Execution Period (PERIOD)
parameter settings for the Control Module that contains it. When the Control Module is activated,

- 61 -
 Chapter 9 - Allen-Bradley Interface Reference

the Array Channel block sends its configuration to the SIM function block for loading in the
SIM/FTA. Inactivating and activating the Control Module/Array Channel block, reloads the
configuration.

CAUTION
It may take a few seconds after the Array Channel block is activated for the configuration to
be loaded to the SIM/FTA and good data to be imaged from the device to the Array Channel
block. During this time, short duration BADPV alarms may occur on blocks that are accessing
the channel's array data.

The following actions are taken to prevent delay in communications to Arrary Channel blocks that
are active and communicating without error due to an inactive Array Channel block with
communication errors, requests, retries, or timeouts to a bad or out-of-service device in the FTA.

Execution State Action Additional Reference Information

When the CEE state is set When the CEE state is set to IDLE or when the EXECSTATE of the
to IDLE or when the Array Channel block is set to inactive, the CEE sends a NULL array
EXECSTATE of the Array database for the associated Array Channel block to the SIM and FTA to
Channel block is set to stop the associated communication requests. However, all the
inactive, the Array Channel Controller to SIM connections will be maintained.
block clears/disables
SIM/FTA communications. When the CEE is set to IDLE or all Array Channel blocks to a device
are set inactive, the FTA foreign device communications stops. Once
When the CEE state all the Control Module Array Channel blocks communicating to a
transitions from IDLE to particular failed device are set to inactive, the communication to that
RUN and when the Array device is stopped by both the SIM and FTA(s). Communication to other
Channel block is active, the error-free device adresses will no longer be delayed for requests,
channel block retries, or timeouts to the bad or out-of-service device in the FTA
initializes/enables
SIM/FTA communications.
When the EXECSTATE of When the EXECSTATE of at least one Control Module Array Channel
the Array channel block block configured for a particular device is set active, the configuration
transitions from inactive to will be downloaded to the FTA and the communication gets
active and if the CEE is in established again, if the device is healthy.
RUN, the Array Channel
block initializes/enables
SIM/FTA communications.

9.1.8 Write processing considerations when Array Channel Block is

configured for Allen-Bradley Interface
The Array Channel block array data can be written to either through a one-time store from a
Sequential Control Module, an operator, or continually through a wired connection.
Upon receiving a store request, the Array Channel block forwards the requested store to the SIM
block. The SIM block forwards the store request to the SIM and FTA. The stored value is not saved
in the Array Channel block. The Array Channel block value does not change until the imaged value
shows the new value, indicating that the store really made it to the end device.

ATTENTION
We recommend using a read-back check to verify that a write is successful in reaching the
external device. A read-back check reads the parameter just written and compares it to the
value written. When the compared values are equal, it guarantees that the write was
successful all the way to the serial device. The feedback time varies based on SIM, FTA, and
device performance.

- 62 -
 Chapter 9 - Allen-Bradley Interface Reference

9.1.9 Diagnostic procedures and data configuration

Diagnostic data is stored as single or double bytes of information in the Allen-Bradley Highway
module. The various PLC modules hold diagnostic information in different forms and in different
RAM locations. This data is referred to as the Diagnostic Counters.
The Allen-Bradley diagnostic commands supported by the procedures that follow are:
Diagnostic Status
Diagnostic Read
Diagnostic Counters Reset
Only modules whose diagnostic information address is returned as a reply to a Diagnostic Status
Command in the seventh and eighth bytes are supported (PLC-5 returns 0). This address is added
to the value specified in the STARTINDEX as an offset, and a Diagnostic Read collects data into the
SIM. Therefore, you do not need to know the starting address for diagnostic data.
Because of differences between modules, you must be familiar with the equipment to properly
configure an Array Channel block for diagnostic purposes. It is also up to you to interpret the
diagnostic data returned. The software automatically reformats data from diagnostic counters for
easier interpretation.
You can cause a Diagnostic Counters Reset by executing a write to any element of the diagnostic
array counters. Note that a write to any one diagnostic counter resets all the diagnostic counters in
the module.
Use the settings in the following table to configure a Numeric Array Channel block to acquire
diagnostic information from an Allen-Bradley KE/KF Computer Interface Module (CIM). Numeric
data is used for diagnostic counters.

Parameter Setting for Diagnostic Data

DEVADDR The node address (specified in octal)
AUXDATA[4] 0 (indicates CIM)
AUXDATA[5] -1 (indicates diagnostic counter)
AUXDATA[6] 11 for up to 32 values of 2-byte data
7 for up to 32 values of 2-byte data

20 for up to 64 values of single-byte data

AUXDATA[7] Scan frequency
STARTINDEX Offset into Allen-Bradley Diagnostic Table*
NNUMERIC Number of diagnostic words/bytes
* You must know which CIM is used because each model can have different meanings for its
offset values.

Use the settings in the following table to configure a Numeric Array Channel block to acquire
diagnostic information from an Allen-Bradley PLC. Numeric data is used for diagnostic counters.

Parameter Setting for Diagnostic Data

DEVADDR The node address (specified in octal)
AUXDATA[4] 2, 3, or 5 (indicates PLC type)
AUXDATA[5] -1 (indicates diagnostic counter)
AUXDATA[6] 11 for up to 32 values of 2-byte data

7 for up to 32 values of 2-byte data

20 for up to 64 values of single-byte data
AUXDATA[7] Scan frequency
STARTINDEX Offset into Allen-Bradley Diagnostic Table*
NNUMERIC Number of diagnostic words/bytes

- 63 -
 Chapter 9 - Allen-Bradley Interface Reference

Parameter Setting for Diagnostic Data

* You must know which PLC model is used because each model can have different meanings for
its offset values.

Use the settings in the following table to configure a Text Array Channel block to set up a
diagnostic loop. A repetitive diagnostic loop can be set up to check the integrity of transmissions
over the communications link. It works by transmitting a message of a certain length from the FTA
which causes the A-B device to reply by transmitting the same data back to the FTA. String data is
used for this purpose.

Parameter Setting for Diagnostic Data

DEVADDR The node address (specified in octal)
AUXDATA[4] NaN
AUXDATA[5] -3
AUXDATA[6] NaN
AUXDATA[7] Scan frequency (but not 256)
STARTINDEX 1
STRLEN 64 characters
NSTRING 1

Counters check the attempted/successful transactions and when the block is active, monitor data
block.str[1] should contain the message:
Loopback Test: Attempted - xxxxx Pass - xxxxx
Where xxxxx is a pass/failure count.
Any communication errors are displayed, but the BADPVFL is not set for a diagnostic loop.
Note that the loopback test can run along with other Array Channel block scans, but doing so
adversely affects performance.

9.1.10 Time-Out gate configuration

The time-out gate feature checks for communication between the FTA and the Allen-Bradley
device. This lets the PLC know that the Serial Interface is working.
By configuring an Array Channel block for a periodic write (such as every 10, 20 or 30 seconds), the
PLC issues a Report by Exception message. This causes the FTA to return a status message that
the ladder logic can monitor and react to.
If the FTA fails, the PLC receives a status code 2016 and/or a timeout occurs indicating to the PLC
that the host is not communicating. When the FTA recovers, the condition clears and the normal
00 status (message was successful) returns.

9.1.11 Status and error checking when Array Channel Block is

configured for Allen-Bradley Interface
Several Array Channel block and SIM block parameters provide status reporting. Error information
appears in the form of a detailed code or status flag. If configured, Error information appears on
the Array Channel block in the Monitoring tab in Control Builder (CB) or the Channel and SIM
block detail displays. You should periodically check these block parameters.
BADPVFL/ERRFL: Provides overall status of array data (ON = bad). The overall status is bad when
there are communication problems or the SIM block is inactive.
INITREQ: Tied to ERRFL status. It always equals the status of the ERRFL. This parameter is
provided for the sake of consistency with other function blocks to indicate if the block can be stored
to at the current time.
ERRCODE: When ERRFL is ON, provides a detailed 8-character string. Refer to the following Error
Messages section for more information.

- 64 -
 Chapter 9 - Allen-Bradley Interface Reference

9.1.12 Error messages when Array Channel Block is configured for

Allen-Bradley Interface
The following table lists some possible Serial Interface and Allen-Bradley communication errors for
reference. You may also need to refer to the Allen-Bradley documentation for error messages
specific to the PLC.

ERRCODE Description
String
Serial Interface Error Codes
# ELEMNT Number of elements is out of range for the given Array Channel block.
ARR INIT Array Channel block is configured, but no valid data has been received.
AUXMATCH AUXDATA[2] and AUXDATA[3] configuration settings do not match the other
channels in the FTA. All channels must agree.
BAUD/PAR The Baud Rate/Parity setting in AUXDATA[3] is not a valid setting.
CEE Idle The CEE is Idle, so the function blocks are executing.
CFG_WAIT The SIM is waiting for valid communications from the FTA before attempting to send
the slot configuration.
CFG LOAD SIM is loading configuration to FTA.
ChCfgErr Array Channel block configuration error exists. Check block configuration carefully.
Ch Inctv Control Module containing the Array Channel block is inactive.
CONFIG Can not load configuration to the SIM. Check all configuration data carefully.
DataCond Array Channel block does not understand Data Conditioner (internal value) sent by
the FTA.
DataType Array Channel block is not supported or out of range for this device.
DEV ADDR Configured device address is out of range.
Fac Test A factory test diagnostic is in progress.
FTA COMM SIM can not communicate with the FTA.
Inv Resp An invalid field device response has occurred.
IO Comm There is an I/O communications problem between the CPM and the SIM.
KPA ADDR Keep Alive coil address in out of range.
MAX CONF “Catch All ' configuration error.
Md Inctv The SIM function block is inactive, so the Array Channel block can not get new array
data.
NO CONF No configuration (Channel is not viewable at the operator Station).
No Conn The Array Channel block can not get data because a proper connection does not
exist between the CPM and the SIM.
No Data Transient condition that occurs when the Control Module containing the Array
Channel block is activated. Condition clears once ERRFL is set OFF or ON.
No SIMFB Array Channel block can not locate its assigned SIM block. Be sure the SIM block is
loaded to the CEE.
PLC TYPE PLC type is not supported.
POL FREQ Polling frequency is out of range.
SIG/MOD AUXDATA[2] setting is not valid.
Startidx The STARTINDEX address is out of range.
STR LEN Illegal string length for diagnostic loop channel type.
TMOT VAL Message timeout value is out of range.
Allen-Bradley Communication Error Codes
ABEXT_mm Allen-Bradley remote station specific EXT STS error (refer to Allen-Bradley
documentation).
ABSTS_nn Allen-Bradley local/remote station specific STS error (refer to Allen-Bradley

- 65 -
 Chapter 9 - Allen-Bradley Interface Reference

ERRCODE Description
String
documentation)
ACKTMOUT Timed out waiting for ACK from CIM device.
ARR INIT Point configured, but no valid data received yet.
CHECKSUM Incorrect BCC detected on the last received message.
CIM_NAK Received a NAK from the CIM device.
INV RESP Invalid response received from the Allen-Bradley device.
MAXMSGST “Catch all ' Serial Interface error.
MSGTMOUT Timed out waiting for the Allen-Bradley device to reply to the last request.
OK_POLL No errors exist against the Array Channel block whose poll rate is within 0 to 255.
OK_RBE No errors exist against the Array Channel block whose poll rate is 256.
PARITY Incorrect parity on at least one character in the last received message.
RBE_FULL RBE buffer full due to too many Report by Exception requests from the PLC devices.

9.1.13 Special FTA to KE/KF cabling considerations

As previously mentioned, an Allen-Bradley KE/KF Computer Interface Module (CIM) is usually
used to communicate with an A-B FTA. The recommended KE/KF CIM configuration is full duplex,
even parity, BCC, embedded response disabled, 19,200 baud, and diagnostic pass-through. A
special cable with 25-pin (male) to 15-pin (male) connectors and wired as shown below is required
to connect the KE/KF CIM to the A-B FTA.

9.1.14 FTA direct to PLC-5 RS-232 Port cable considerations

To make a direct connection between the FTA and a PLC-5, you must configure the PLC-5 serial
port as RS-232, full duplex, even parity, 19,200 baud, and diagnostic pass through, ignore duplicate
messages. Do not configure the port as RS-422 or RS-485. You will need a null modem cable with
25-pin male connections to connect the PLC-5 to the A-B FTA. The cable connections are shown
below for reference.

- 66 -
 Chapter 9 - Allen-Bradley Interface Reference

9.1.15 Reference Specifications when Array Channel Block is

configured for Allen-Bradley Interface
The following table lists some general specifications relevant to the Serial Interface function.

Function Description
Serial Interface Array Channel
FTA Channel Capacity Up to 16 channels per SI FTA
SIM Channel Capacity Up to 32 channels per SIM (2 FTAs)
Data capacity per Array Channel (contiguous 512 Flags (Boolean/coils), or
data in PLC)
64 Numerics (8-Bit integers), or
32 Numerics (integers), or
16 Numerics (reals), or

1 string of 64 characters, or

2 string of 32 characters, or
4 string of 16 characters, or
8 string of 8 characters
Reads per Port * Up to 2048 Booleans/second, or

Up to 128 integers/second, or
Up to 64 reals/second, or
Up to 4, 64-character strings/second, or
Weighted combinations of the above
Writes per Port* 10 channels/second
* Read and write performance is sensitive to a number of variables, including the PLC type, scan
time, PLC network configuration and traffic, amount of data access from other devices, and the
overall health of the PLC network. For best results, a direct PLC connection is recommended. The
ratings listed do not represent best performance figures. Read performance degrades with
increased writes.
Allen-Bradley Serial Interface
Model Numbers
A-B SI FTA MU-TSIA12

- 67 -
Chapter 9 - Allen-Bradley Interface Reference

Function Description
SIM TC-MUX021
SIM FTA Power Adapter TC-SMPD01 (24 Vdc, 18-36 Vdc, 0.4A maximum)
TC-SMPC01 (85 to 265 Vac, 47-63 Hz, 12W
maximum)
General
Interface Type EIA-RS232-D
Number of Serial Ports 2 per SIM, 1 per FTA
Power Adapter to FTA Distance 300 meters (984 feet)
Baud Rate 19,200 baud
Serial Data Format 8 data Bits with even parity
Common Mode Operation 250 Vrms (continuous)
ESD Protection IEEE SWC 472-1974
EIA-RS232-D Support
Interface Type Serial asynchronous
Lines Supported TXD, RXD, Logic GND, Protectiv GND
(Compatible with CCIT V.24; CCIT V.28)
FTA to Device Distance 15 meters (49 feet)
Allen-Bradley Specific
Protocol Full duplex Allen-Bradley DF1 with embedded
responses
Transmission Mode Character oriented
Serial Line Mode RS232
Parity Even
Number of Stop Bits 1
Modem Control Support Off
ACK Timeout 3.2 seconds
FTA Message Response Timeout 4.0 seconds
Data Format Supported Booleans, Reals, Signed/Unsigned Integers,
ASCII Strings
CIM Communications Options Pass-through diagnostic requests
Ignore handshaking
Accept duplicate message
BCC error check
PLC Types Supported PLC-2

PLC-3 (Native Mode and PLC-2 Mode)

PLC-5, except PLC-5/20 (Native Mode and PLC-
2 Mode)

- 68 -
 CHAPTER

10 MODBUS INTERFACE REFERENCE

l Array Channel Block Configuration for Generic MODBUS Interface

l Extended range versus limited range Modbus FTA
l Starting element index value differences

10.1 Array Channel Block Configuration for Generic

MODBUS Interface
Many devices that use the AEG Modicon Modbus RTU protocol can communicate with the
Experion system through the Array Channel blocks for the SIM. Refer to Modbus documentation
for a description of the Modbus protocol.
l AUXDATA parameter configuration

10.1.1 AUXDATA parameter configuration

The following table summarizes the AUXDATA parameter configuration that defines Serial
Interface Array Channel block communications with the Generic Modbus. It also defines the
optional entries for parameters to request the extended range addressing of the Modbus
interface STARTINDEX through the Control Builder application as well as the additional
parameters included to control the retries of Modbus device communications.

ATTENTION
l When the AUXDATA[0…7] parameters are not being used with a Generic Modbus
interface, they should be set to the default value of NaN (Not a Number).
l If the chip revision level of you Modbus SI FTA is H or above, you can configure
AUXDATA[4] to increase the delay between messages sent to the Modbus device.

TIP
Use the NetworkTools (NTools) utility to check the revision level of the installed Modbus SI
FTA through the detail pane display for the SIM. See the ' Tools and Utilities ' section in the
C200 Hardware Troubleshooting and Maintenance Guide for more information.

Parameter Function Description

AUXDATA Specifies the Keep This parameter tells the Modbus system that the Experion
[0] Alive Address for a subsystem is functioning. It can be configured separately on
Modbus coil. each array channel block, but no two array channel blocks
should write to the same coil. The coil address must be within
the range 00001 to 09999 for limited range FTA or 000001 to
099999 for extended range FTA.

- 69 -
Chapter 10 - MODBUS Interface Reference

Parameter Function Description

Note: When this parameter is NaN, the Keep Alive function is
inactive. If you want to check the Keep Alive coil, you must
program the Modbus device to do so.
AUXDATA Specifies the time If a valid response is not received after three tries (original
[1] interval in seconds to plus two retires), a MSGTMOUT error results. The range is
wait before attempting 0.25 to 5 seconds on NaN. If NaN is specified, the default
a message retry. timeout is 1.5 seconds. A timeout value can be configured
separately for each array channel block.
AUXDATA Specifies the signaling The first valid array channel block loaded to the Controller
[2] protocol and modem with values in AUXDATA[2] and AUXDATA[3] sets the mode
control in an and baud rate for the FTA communications. This means that
integer/decimal AUXDATA[2] AUXDATA[3] must contain the same value for all
format: array blocks configured through the same FTA. If array blocks
loaded later to that FTA have different AUXDATA[2]/[3] values,
mmm.n an AUXMATCH error results.
Where mmm is the The modem control feature switches the following signals:
signaling protocol and RTS, CTS, DSR, DTR, and DCD. When AUXDATA[2] is NaN, the
n is the modem control protocol is EIA-232 and modem control is OFF.
(0 = OFF and 1 = ON).

For example, 232.1

indicates EIA-232 with
modem control ON.
The other choices are
232.0 and 485.0. EIA-
232 permits use of an
external modem.
AUXDATA Specifies the baud rate The legal baud rates are 19200, 9600, 4800, 2400, and 1200.
[3] in an integer/decimal NaN (dashes) results in a default value of 19200 baud with
format: odd parity.
bbbbb.n
Where bbbbb is the
baud rate and n is the
parity (0 = None, 1 =
Odd, 2 = Even).
AUXDATA When Modbus SI FTA Set this parameter to NaN when communicating with a
[4] chip revision is G or Modbus.
below:
This parameter is not
applicable to a Generic
Modbus interface.
When Modbus SI FTA The range is 0 to 10000 milliseconds (0 to 10 seconds).
chip revision is H or
Default is 0, if AUXDATA[4] = NaN.
above:
It defines the delay in milliseconds between the end of the
Lets you increase the
sub-system reply and the new SI-FTA request (FTA delay), as
delay between
shown in the following illustration.
messages sent to the
Modbus device. This parameter is equivalent to the AB_DATA1 parameter in
the APM/HPM Serial Interface.

- 70 -
 Chapter 10 - MODBUS Interface Reference

Parameter Function Description

AUXDATA Lets you To enable extended range addressing, enter 65535.0 for this
[5] enable/disable the parameter on the Serial Device tab of I/O Channel block
extended range configuration form in Control Builder. To disable extended
addressing for this FTA range addressing, leave the default entry of NaN for this
slot. parameter on the configuration form.
This parameter is equivalent to the AB_DATA2 parameter on
the APM/HPM Serial Interface, but this feature is not valid for
APM/HPM. See the previous Converting Limited Range
Modbus FTA to Extended Range Modbus FTA section to
migrate from limited range addressing to extended range
addressing.
AUXDATA Specifies the number Setting range is 0 to 1,000.
[6] of default retries for
the array slot. Using the default entry of NaN leaves the retry value at 2.
This parameter is equivalent to the AB_DATA3 parameter on
APM/HPM Serial Interface and this feature is valid with
APM/HPM.
AUXDATA Specifies the wait time Setting range is 0 to 10,000 seconds.
[7] in seconds before this
slot retries the failed Using the default entry of NaN leaves the value at 0.
communications. This parameter is equivalent to the AB_DATA4 parameter on
APM/HPM Serial Interface and this feature is valid with
APM/HPM.

10.2 Extended range versus limited range Modbus FTA

The extended range serial interface FTA can address lower Modbus addresses as well as addresses
above 9,999. The Experion R301.1 or later version of Control Builder is compatible with this
extended range FTA, since it supports Starting Element Index (STARTINDEX) parameter values up
to 99,999. The FTA defines the extended address protocol handling and contains the starting
element index mapping, not the SIM.
The existing limited range serial interface FTA supports a maximum address of 9, 999 and uses
different starting element index values. Otherwise, the FTAs are functionally equivalent.

TIP
The maximum extended range address of 99,999 more than supports the maximum Modbus
address of 65,535. The address range of 65,536 to 99,999 will not be usable by the Modbus
standard protocol.

10.3 Starting element index value differences

You specify the Starting Element Index (STARTINDEX) parameter through the Serial Devicetab on

- 71 -
Chapter 10 - MODBUS Interface Reference

the configuration form for the given serial interface IOCHANNEL block in Control Builder. This
parameter defines the Modbus address map.
The value configured for the STARTINDEX parameter in a given Array Channel block determines
the Modbus Start Index and function. Only one type of external data can be accessed per Array
Channel block.
The STARTINDEX parameter specifies the Modbus data type and a Modbus address up to 9,999 for
the limited range FTA or up to 99,999 for the extended range FTA. The most significant digit
identifies the Modbus function. For example, read coil status as noted in the following tables. The
lower four digits for limited range FTA or five digits for extended range FTA define the starting
address to access data for the given Modbus function. For example, the extended range FTA
address ranges 2xxxxx, 4xxxxx, 5xxxxx, 7xxxxx, 8xxxxx, and 9xxxxx all address the same xxxxx
registers in the programmable logic controller, but with different data formats. The same is true for
the limited range FTA xxxx registers in the PLC. When multiple numeric data types are used, you
must configure the STARTINDEX for each array to avoid overlapping arrays.
The following tables show the relationship between Modbus functions, the STARTINDEX
parameter range, and number of elements for a limited range FTA (Table 1) or extended range FTA
(Table 2). The maximum number of elements specifies the maximum number of flags (NFLAG),
numerics (NUMERIC), or strings (NSTRING) that can be configured for a given STARTINDEX range
and IOCHANNEL block type. All of the specified elements are read in a single transaction.

Table 10.1 Start index ranges for limited range FTA

Start Index Modbus Function Read FC Array Channel Function Data Range Max. No.
Ranges Write FC Block Elem.
00001 - Read Coil Status 01 SIFLAGARRCH ON/OFF 512
09999
Force Single Coil 05 Read/Write Bit Flags
10001 - Read Input 02 SIFLAGARRCH ON/OFF 512
19999 Status
Read Only Bit Flags
Not Applicable N/A
20001 - Read Holding 03 SINUMARRCH -34E38 to 16
299991 Registers 34E38
Word Swapped IEEE FI.Pt
Preset Multiple 162 Read/Write
Registers
30001 - Read Input 04 SINUMARRCH -32768 to 32
39999 Registers 32767
Signed Integer Words
Not Applicable N/A Read only
40001 - Read Holding 03 SINUMARRCH -32768 to 32
49999 Registers 32767
Signed Integer Array
Preset Single 06 Read/Write
Register
50001 - Read Holding 03 SITEXTARRCH Printable 8 of 8
599991 Registers Characters
ASCII Encoded Bytes 4 of 16
Read/Write
2 of 32
1 of 64
Preset Single 06
Register
600001 Loopback 08 SITEXTARRCH None 1 of 64
Diagnostics
Loopback Test
70001 - Read Holding 03 SINUMARRCH -34E38 to 16
79999 Registers 34E38
IEEE Floating Point
Preset Multiple 162 Read/Write
Registers
80002 - Read Holding 03 SINUMARRCH -34E38 to 16

- 72 -
 Chapter 10 - MODBUS Interface Reference

Start Index Modbus Function Read FC Array Channel Function Data Range Max. No.
Ranges Write FC Block Elem.
899991 Registers IEEE FI. Pt in Addr-1 34E38
Preset Multiple 162 Read/Write
Registers
90001 - Read Holding 03 SINUMARRCH 0 to 65535 32
99999 Registers
Unsigned Integer Words
Preset Single 06 Read/Write
Register
1These ranges are extensions to the Modbus protocol specifications to support certain Modbus
devices.
2Function Code 16 is used to write a multiword data type in one transaction.

Table 10.2 Start index ranges for extended range FTA

STARTINDEX Modbus Read FC IOCHANNEL Block Data Range Maximum
Ranges Function Number
Write FC Elements
000001 - Read Coil 01 SIFLAGARRCH ON/OFF 512
099999 Status
Read/Write Bit Flags
Force Single 05
Coil
100001 - Read Input 02 SIFLAGARRCH ON/OFF 512
199999 Status
Read Only Bit Flags
Not Applicable N/A
200001 - Read Holding 03 SINUMARRCH -34E38 to 16
2999991 Registers 34E38
Word Swapped IEEE
Preset Multiple 162 FI.Pt Read/Write
Registers
300001 - Read Input 04 SINUMARRCH -32768 to 32
399999 Registers 32767
Signed Integer Words
Not Applicable N/A Read only
400001 - Read Holding 03 SINUMARRCH -32768 to 32
499999 Registers 32767
Signed Integer Array
Preset Single 06 Read/Write
Register
500001 - Read Holding 03 SITEXTARRCH Printable 8 of 8
5999991 Registers Characters
ASCII Encoded Bytes 4 of 16
Read/Write
2 of 32
1 of 64
Preset Single 06
Register
6000001 Loopback 08 SITEXTARRCH None 1 of 64
Diagnostics
Loopback Test
700001 - Read Holding 03 SINUMARRCH -34E38 to 16
799999 Registers 34E38
IEEE Floating Point
Read/Write
Preset Multiple 162
Registers
800002 - Read Holding 03 SINUMARRCH -34E38 to 16
8999991 Registers 34E38
IEEE FI. Pt in Addr-1

- 73 -
 Chapter 10 - MODBUS Interface Reference

STARTINDEX Modbus Read FC IOCHANNEL Block Data Range Maximum

Ranges Function Number
Write FC Elements

Preset Multiple 162 Read/Write

Registers
900001 - Read Holding 03 SINUMARRCH 0 to 65535 32
999999 Registers
Unsigned Integer
Preset Single 06 Words Read/Write
Register
1These ranges are extensions to the Modbus protocol specifications to support certain Modbus
devices.
2Function Code 16 is used to write a multiword data type in one transaction.

l Modbus loopback diagnostic

l Performance considerations when Array Channel Block is configured for Generic MODBUS
Interface
l Array Channel block execution state when Array Channel Block is configured for Generic
MODBUS Interface
l Write processing considerations when Array Channel Block is configured for Generic MODBUS
Interface
l Status and error checking when Array Channel Block is configured for Generic MODBUS
Interface
l Error messages when Array Channel Block is configured for Generic MODBUS Interface
l Special Modbus slave FTA implementation
l Reference Specifications when Array Channel Block is configured for Generic MODBUS
Interface

10.3.1 Modbus loopback diagnostic

The loopback test consists of sending a test message to the Modbus device and waiting for the
proper response. To do this, configure a TEXT array channel block as follows. Note that this
example is based on using a limited range FTA but it can be easily adapted to an extended range
FTA by changing the STARTINDEX to 600000.

l STARTINDEX = 60000 (loopback test address)

l NSTRING = 1
l STRLEN = 64

When the block is active, the monitor data block.str[1] should contain the message:
Loopback Test: Attempted - xxxxx Pass - xxxxx
Where xxxxx is a pass/failure count.
(Note that the loopback test can run along with other Array Channel block scans, but doing so
adversely affects performance.)

10.3.2 Performance considerations when Array Channel Block is

configured for Generic MODBUS Interface

ATTENTION

- 74 -
 Chapter 10 - MODBUS Interface Reference

l Since the Serial Interface I/O Module (SIM) bandwidth is limited, the Array Channel
blocks only process writes which change the current process value. This eliminates
unnecessary repeated writes.
l In Experion systems with redundant Controller configurations, the writes are not
guaranteed during a failover. The store attempt may occur in the Primary Controller,
but it may not reach the SIM before the failover occurs. The Secondary Controller
does not attempt to resend the data.

An active SIM function block processes the following actions once per its publication period of 250
milliseconds. The publication rate is the same whether the SIM block is assigned to a 5ms-CEE or a
50ms-CEE type.
l Load Serial Interface Array Channel block configurations to the SIM.
l Send Array Channel block write requests to the SIM.
l Monitor status of the SIM, and report diagnostics, as applicable.

Of course, these actions are not performed when the SIM block is inactive. When the SIM block is
inactive, the Array Channel blocks set their data to applicable default values.
The SIM block collects the writes for each array channel and sends them to the SIM every 250ms.
The following table lists the maximum number writes a SIM block supports per channel in every
250ms cycle. If the SIM block's write list becomes full, it rejects a write to the array channel block.

Array Channel Block Maximum Number of Writes (Channel/250ms)

SINUMARRCH 8
SIFLAGARRCH 16
SITEXTARRCH (STRLEN = 8) 8
SITEXTARRCH (STRLEN = 16) 4
SITEXTARRCH (STRLEN = 32) 2
SITEXTARRCH (STRLEN = 64) 1

Writes to Array Channel Blocks can also be rejected because the SIM is not keeping up with the
writes being sent by the SIM block. Write overruns are indicated by the SIM block FTAAOVRNFL and
FTABOVRNFL parameters. To provide an overrun condition alarm, connect the overrun
parameters to a FLAG function block configured to generate an OffNormal alarm.

10.3.3 Array Channel block execution state when Array Channel Block
is configured for Generic MODBUS Interface
The Array Channel block uses the Execution State (EXECSTATE) and Execution Period (PERIOD)
parameter settings for the Control Module that contains it. When the Control Module is activated,
the Array Channel block sends its configuration to the SIM function block for loading in the
SIM/FTA. Inactivating and activating the Control Module/Array Channel block, reloads the
configuration.

It may take a few seconds after the Array Channel block is activated for the
CA- configuration to be loaded to the SIM/FTA and good data to be imaged from the
UTI- device to the Array Channel block. During this time, short duration BADPV alarms
ON may occur on blocks that are accessing the channel's array data.

The following actions are taken to prevent delay in communications to Arrary Channel blocks that
are active and communicating without error due to an inactive Array Channel block with
communication errors, requests, retries, or timeouts to a bad or out-of-service device in the FTA.

- 75 -
 Chapter 10 - MODBUS Interface Reference

Execution State Action Additional Reference Information

When the CEE state is set When the CEE state is set to IDLE or when the EXECSTATE of the
to IDLE or when the Array Channel block is set to inactive, the CEE sends a NULL array
EXECSTATE of the Array database for the associated Array Channel block to the SIM and FTA to
Channel block is set to stop the associated communication requests. However, all the
inactive, the Array Channel Controller to SIM connections will be maintained.
block clears/disables
SIM/FTA communications. When the CEE is set to IDLE or all Array Channel blocks to a device
are set inactive, the FTA foreign device communications stops. Once
When the CEE state all the Control Module Array Channel blocks communicating to a
transitions from IDLE to particular failed device are set to inactive, the communication to that
RUN and when the Array device is stopped by both the SIM and FTA(s). Communication to other
Channel block is active, the error-free device adresses will no longer be delayed for requests,
channel block retries, or timeouts to the bad or out-of-service device in the FTA
initializes/enables
SIM/FTA communications.
When the EXECSTATE of When the EXECSTATE of at least one Control Module Array Channel
the Array channel block block configured for a particular device is set active, the configuration
transitions from inactive to will be downloaded to the FTA and the communication gets
active and if the CEE is in established again, if the device is healthy.
RUN, the Array Channel
block initializes/enables
SIM/FTA communications.

10.3.4 Write processing considerations when Array Channel Block is

configured for Generic MODBUS Interface
The Array Channel block array data can be written to either through a one-time store from a
Sequential Control Module, an operator, or continually through a wired connection.
Upon receiving a store request, the Array Channel block forwards the requested store to the SIM
block. The SIM block forwards the store request to the SIM and FTA. The stored value is not saved
in the Array Channel block. The Array Channel block value does not change until the imaged value
shows the new value, indicating that the store really made it to the end device.

ATTENTION
We recommend using a read-back check to verify that a write is successful in reaching the
external device. A read-back check reads the parameter just written and compares it to the
value written. When the compared values are equal, it guarantees that the write was
successful all the way to the serial device. The feedback time varies based on SIM, FTA, and
device performance.

10.3.5 Status and error checking when Array Channel Block is

configured for Generic MODBUS Interface
Several Array Channel block and SIM block parameters provide status reporting. Error information
appears in the form of a detailed code or status flag. If configured, Error information appears on
the Array Channel block in the Monitoring tab in Control Builder (CB) or the Channel and SIM
block detail displays. You should periodically check these block parameters.
BADPVFL/ERRFL: Provides overall status of array data (ON = bad). The overall status is bad when
there are communication problems or the SIM block is inactive.
INITREQ: Tied to ERRFL status. It always equals the status of the ERRFL. This parameter is
provided for the sake of consistency with other function blocks to indicate if the block can be stored
to at the current time.
ERRCODE: When ERRFL is ON, provides a detailed 8-character string. Refer to the following Error
Messages section for more information.

- 76 -
 Chapter 10 - MODBUS Interface Reference

10.3.6 Error messages when Array Channel Block is configured for

Generic MODBUS Interface
The following table lists some possible Serial Interface and Modbus communication errors for
reference. You may also need to refer to the Modbus documentation for error messages specific to
the serial device.

ERRCODE Description
String
Serial Interface Error Codes
# ELEMNT Number of elements is out of range for the given Array Channel block.
ARR INIT Array Channel block is configured, but no valid data has been received.
AUXMATCH AUXDATA[2] and AUXDATA[3] configuration settings do not match the other
channels in the FTA. All channels must agree.
BAUD/PAR The Baud Rate/Parity setting in AUXDATA[3] is not a valid setting.
BYPASS Wait time specified in seconds before slot retries failed communications for
AUXDATA[7] parameter exceeds the legal range of 0 to 10,000 seconds.
CEE Idle The CEE is Idle, so the function blocks are executing.
CFG LOAD SIM is loading configuration to FTA.
CFG_WAIT The SIM is waiting for valid communications from the FTA before attempting to send
the slot configuration.
ChCfgErr Array Channel block configuration error exists. Check block configuration carefully.
Ch Inctv Control Module containing the Array Channel block is inactive.
CONFIG Can not load configuration to the SIM. Check all configuration data carefully.
DataCond Array Channel block does not understand Data Conditioner (internal value) sent by
the FTA.
DataType Array Channel block is not supported or out of range for this device. (Most significant
digit of STARTINDEX does not match the array channel point. Extended Modbus
addressing has a larger address range.)
DELAYVAL The frame delay setting is out of range (0 to 10000). If AUXDATA[4} is less than 0 or
greater than 10000, when Modbus SI FTA chip revision is H or above.
DEV ADDR Configured device address is out of range.
EXT ADDR Value for AUXDATA[5] is not NaN or 65535.0. Defines whether extended range
addressing is enabled (65535.0) or not (NaN). This defines how the user
STARTINDEX parameter is interpreted on this array point slot. FTA slots must have a
STARTINDEX value that matches the AUXDATA[5] setting or DATATYPE/STARTIDX
errors may occur.
Fac Test A factory test diagnostic is in progress.
FTA COMM SIM can not communicate with the FTA.
Inv Resp An invalid field device response has occurred.
IO Comm There is an I/O communications problem between the CPM and the SIM.
KPA ADDR Keep Alive coil address in out of range.
MAX CONF “Catch All ' configuration error.
Md Inctv The SIM function block is inactive, so the Array Channel block can not get new array
data.
NO CONF No configuration (Channel is not viewable at the operator Station).
No Conn The Array Channel block can not get data because a proper connection does not
exist between the CPM and the SIM.
No Data Transient condition that occurs when the Control Module containing the Array
Channel block is activated. Condition clears once ERRFL is set OFF or ON.
No SIMFB Array Channel block can not locate its assigned SIM block. Be sure the SIM block is
loaded to the CEE.

- 77 -
 Chapter 10 - MODBUS Interface Reference

ERRCODE Description
String
PLC TYPE PLC type is not supported.
POL FREQ Polling frequency is out of range.
RETRY The number of default retries specified for slot AUXDATA[6] exceeds the legal range
of 0 to 1,000.
SIG/MOD AUXDATA[2] setting is not valid.
Startidx The STARTINDEX address is out of range. The address portion has a maximum of
9,999 for limited range addressing or 65,535 for extended range addressing.
STR LEN Illegal string length for diagnostic loop channel type.
TMOT VAL Message timeout value is out of range.
Modbus Communication Error Codes
CHECKSUM Incorrect checksum received.
Ex or xx Modbus device error codes (Hex). Refer to device documentation.
NO CTS Modem did not respond with Clear To Send within the message timeout time.
NO DSR Modem is not asserting Data Set Ready as expected.
Parity A Modbus device communication error has occurred.
Checksum

MSGTMOUT
ChrTmout
RX OVFLO A receive buffer overflow occurred on a message response received from the
Modbus device.

10.3.7 Special Modbus slave FTA implementation

The following table summarizes the tasks and information associated with implementing a Modbus
Slave FTA. The Modbus Slave FTA is available as a repeatable special product (hardware part
number 51191029-Tab, documentation part number 51191030).

Task/Information Action/Reference
Restrictions l Must pair only one Master and one Slave.
l Since the Slave responds to all addresses, no other multidrop devices are
permitted.
l To avoid the Ex-2 error, configure and load the Slave FTA first.
l You can configure different device addresses for each Array Channel pair,
but only addresses 1 to 15 are legal.
Configuration
l In each Master and Slave Array Channel pair, configure the identical
settings for the device address (DEVADDR) and start index (STARTINDEX)
parameters.
l Configure identical, non-overlapping data areas in Master and Slave Array
Channel pairs. For example, if Array 1 is 32 integers with a STARTINDEX of
90001, then Array 2 must have a STARTINDEX of 00033. If Array 1 is 512
Booleans with a STARTINDEX of 00000 and Array 2 is 16 floating points,
then Array 2 must have a STARTINDEX of 70513 and Array 3 must have a
STARTINDEX of x00001 + 512 +16 = 529.
l In all Slave Array Channels, set AUXDATA[4] parameter to a non-zero
value (1.0) to enable the Remote Terminal Unit (RTU) protocol.
l In all Master Array Channels, set AUXDATA[1] parameter to recommended
3.0 second timeout.
l In all Master and Slave Array Channel pairs, configure the identical
settings for AUXDATA[2] and AUXDATA[3] parameters.

- 78 -
 Chapter 10 - MODBUS Interface Reference

Task/Information Action/Reference
l For short distances, the default is RS-232 direct connection with
NaN settings for both AUXDATA[2] and AUXDATA[3] parameters.
l For long distance, use RS485 connection with a 485.0 setting for
the AUXDATA[2] parameter and a 19200.1 setting for the
AUXDATA[3] parameter.
Common Errors l If the Master accesses a device address that does not match an existing
Slave Array configuration, the Slave responds with an Ex-2 error and
freezes. After the Master address is corrected, you must restart or
reconfigure the Slave.
l If the Slave Array is configured with overlapping data areas between
arrays, it returns the STRTINDX error code.
l If the Slave Array is configured with a conflicting device address, it returns
the DEV ADDR error code.
l If the Slave is configured for a STARTINDEX address of 8xxxx, it causes an
Ex-2 error code in the Master. The 8xxxx address (IEEE Float at address -
1) is not supported.

10.3.8 Reference Specifications when Array Channel Block is

configured for Generic MODBUS Interface
The following table lists some general specifications relevant to the Serial Interface function.

Function Description
Serial Interface Array Channel
FTA Channel Capacity Up to 16 channels per SI FTA
SIM Channel Capacity Up to 32 channels per SIM (2 FTAs)
Data capacity per Array Channel (contiguous 512 Flags (Boolean/coils), or
data in PLC)
64 Numerics (8-Bit integers), or

32 Numerics (integers), or
16 Numerics (reals), or

1 string of 64 characters, or

2 string of 32 characters, or
4 string of 16 characters, or
8 string of 8 characters
Reads per Port * Up to 2048 Booleans/second, or
Up to 128 integers/second, or
Up to 64 reals/second, or

Up to 4, 64-character strings/second, or
Weighted combinations of the above
Writes per Port * 10 channels/second
* Read and write performance is sensitive to a number of variables, including the PLC type, scan
time, PLC network configuration and traffic, amount of data access from other devices, and the
overall health of the PLC network. For best results, a direct PLC connection is recommended. The
ratings listed do not represent best performance figures. Read performance degrades with
increased writes.
MODBUS Serial Interface
Model Numbers

- 79 -
Chapter 10 - MODBUS Interface Reference

Function Description
Limited Range MODBUS SI FTA MU-TSIM12
Extended Range MODBUS SI FTA MU-TSIM13
MC-TSIM13
SIM TC-MUX021
SIM FTA Power Adapter TC-SMPD01 (24 Vdc, 18-36 Vdc, 0.4A maximum)
TC-SMPC01 (85 to 265 Vac, 47-63 Hz, 12W
maximum)
General
Interface Type EIA-RS232-D or EIA-485
Number of Serial Ports 2 per SIM, 1 per FTA
Power Adapter to FTA Distance 300 meters (984 feet)
Protocol Modbus
Transmission Mode RTU
Serial Line Mode RS232 or RS485
Selectable Baud Rates 1200, 2400, 4800, 9600, 19200 bps
Serial Data Format 8 data bits with programmable ninth bit (parity)
Selectable Parity None, odd, or even
Common Mode Operation 250 Vrms (continuous)
ESD Protection IEEE 801.2
Surge Protection IEEE SWC 472-1974
Number of Stop Bits 1
Modem Control Support Selectable On/Off
Keep Alive Cell Write Configurable address
Message Response Timeout Time Configurable timeout
Inter-Message Stall Time 3.5 Character Time minimum
Data Formats Supported Boolean, Real, ASCII Strings, Signed Integers,
Unsigned Integers
Exception Errors Reported Keep Alive, Message Response Timeout,
Signaling Mode/Modem Support, Baud Rate,
Parity
EIA-RS232-D Support
Interface Type Serial asynchronous
Lines Supported TXD, RXD, RTS, CTS, DSR, DTR (Compatible with
CCIT V.24; CCIT V.28)
FTA to Device Distance 15 meters (49 feet) (Cable capacitance = 2500 pF
maximum.)

EIA-485 Support
Interface Type Serial asynchronous half duplex only
Lines Supported Two wire differential pair: DATA+, DATA-, Protective GND (shield)
Number of Transceivers 15 drops maximum
FTA to Device Distance 1.2 Km (4000 ft) maximum

- 80 -
 Chapter 10 - MODBUS Interface Reference

Notices
Trademarks
Experion®, PlantScape®, SafeBrowse®, TotalPlant®, and TDC 3000® are registered trademarks of
Honeywell International, Inc.
ControlEdge™ is a trademark of Honeywell International, Inc.
OneWireless™ is a trademark of Honeywell International, Inc.
Matrikon® and MatrikonOPC™ are trademarks of Matrikon International. Matrikon International is
a business unit of Honeywell International, Inc.
Movilizer® is a registered trademark of Movilizer GmbH. Movilizer GmbH is a business unit of
Honeywell International, Inc.

Other trademarks
Microsoft and SQL Server are either registered trademarks or trademarks of Microsoft Corporation
in the United States and/or other countries.
Trademarks that appear in this document are used only to the benefit of the trademark owner,
with no intention of trademark infringement.

Third-party licenses
This product may contain or be derived from materials, including software, of third parties. The
third party materials may be subject to licenses, notices, restrictions and obligations imposed by
the licensor. The licenses, notices, restrictions and obligations, if any, may be found in the
materials accompanying the product, in the documents or files accompanying such third party
materials, in a file named third_party_licenses on the media containing the product, or at
http://www.honeywell.com/ps/thirdpartylicenses.

Documentation feedback
You can find the most up-to-date documents on the Honeywell Process Solutions support website
at: http://www.honeywellprocess.com/support
If you have comments about Honeywell Process Solutions documentation, send your feedback to:
[email protected]
Use this email address to provide feedback, or to report errors and omissions in the
documentation. For immediate help with a technical problem, contact your local Honeywell
Process Solutions Customer Contact Center (CCC) or Honeywell Technical Assistance Center
(TAC).

How to report a security vulnerability

For the purpose of submission, a security vulnerability is defined as a software defect or weakness
that can be exploited to reduce the operational or security capabilities of the software.
Honeywell investigates all reports of security vulnerabilities affecting Honeywell products and
services.
To report a potential security vulnerability against any Honeywell product, please follow the
instructions at:
https://www.honeywell.com/product-security

Support

- 81 -
Chapter 10 - MODBUS Interface Reference

For support, contact your local Honeywell Process Solutions Customer Contact Center (CCC). To
find your local CCC visit the website, https://www.honeywellprocess.com/en-US/contact-
us/customer-support-contacts/Pages/default.aspx.

Training classes
Honeywell holds technical training classes that are taught by process control systems experts. For
more information about these classes, contact your Honeywell representative, or see
http://www.automationcollege.com.

- 82 -