CP30/G30/MC31 Firmware Version 3100 Known Issues

Transcription

1 CP30/G30/MC31 Firmware Version 3100 Known Issues Introduction This document lists issues that have been identified with firmware version 3100 for the Kingfisher CP30/G30/MC31 modules. Where possible, workarounds are described. The issues are categorised as follows, although note there is some overlap: Protocols issues relating to a particular protocol such as DNP3, Modbus, etc. Ports issues relating to a particular port type such as Ethernet, RS232, etc. Event logging issues with logging and return of event data Redundancy issues concerning operation of redundant processor systems Function blocks issues with particular function blocks I/O modules issues involving backplane I/O modules System general issues with system operation The number in the title of each issue is an internal defect tracking number. Within each category, issues are listed in reverse chronological order with respect to the date they were identified. CP30/G30/MC31 Firmware 3100 Known Issues 1

2 Contents Introduction... 1 Contents... 2 Protocols... 4 #1409 DNP3 master does not confirm multi fragment slave responses... 4 #1408 SNMP replies sent to wrong port number when polled by RTU master... 4 #1357 DNP3 Disable Unsolicited messages sent to devices that don t support this... 4 #1165 DNP3 secure connection is not re-established after master reset... 4 #1128 Default DNP3 event buffer setting can cause CP30 reset... 4 #1056 Possible slow boot time, depending on numbering of DNP3 points... 5 #945 DNP3 IIN event bits not set properly... 5 #941 Pending flag set for reply CONFIRM messages sent by DNP3 master... 5 #884 RTU stops responding to DNP3 messages if protocol changed from UDP to TCP... 5 #748 Modbus writes can be performed to standby processor... 5 #548 Possible restart when reading events using Kingfisher protocol on serial port... 5 #481 Unsolicited events only sent to one master on startup... 6 #439 Incorrect response when polled by multiple DNP3 masters with same IP address... 6 #432 Slave RTU attempts to establish connection to master... 6 #376 VIA field in new Kingfisher messages is always #252 Incorrect response when MC31 port polled by multiple Modbus masters with same IP address... 6 #211 Erroneous reply packet sent if Modbus Unit ID doesn t match RTU address... 6 #187 Indirect Kingfisher protocol poll over DNP3 serial port fails... 7 #185 Incorrect responses when different DNP3 qualifiers used in same message... 7 #52 KF_GET_PENDING does not always work properly with Modbus... 7 Ports... 7 #1331 MC30 ports configured as RS422 do not work... 7 #876 Possible RTU restart with rapid PSTN polling... 7 #727 Ethernet discovery may list incorrect IP addresses... 7 #362 MC31 stops responding if serial option card not present... 8 #340 Incorrect subnet mask setting can cause RTU restart... 8 #256 Serial downloads at 115k are very slow and may fail... 8 Event Logging... 8 #1061 Duplicate events recorded on G30 when SOE inputs mapped to DNP #784 Oversize event log definition causes RTU to fail to restart properly... 8 #537 Incorrect event log timestamps... 9 #415 Cannot log long variable names using KF_ EVENT_LOG... 9 Redundancy... 9 #827 Duplicate DNP3 events may be reported following redundant changeover... 9 #810 Duplicate and erroneous events if changeover during initial synchronisation... 9 #644 Cannot access standby CP30 if active processor is not configured... 9 #451 Delay in scanning in redundant system if many variables change #208 Duplicated events in redundant processor Function Blocks #1033 KF_GET_MODULE_OK function block doesn t work on G CP30/G30/MC31 Firmware 3100 Known Issues 2

3 #919 Some function blocks do not support the full RTU address range #491 REBOOT function block is not usable in FBD program I/O Modules #1492 Analog scaling does not work for PS-1x/2x modules #1394 RTU reads and writes I/O modules even if incorrect type installed #1036 IO-4 analog values not read correctly System #1342 Toolbox PLUS+ may fail to reconnect during upgrade #1253 Service log upload may fail under heavy load #845 Variable boot time for large projects #412 Real time clock set to random value if battery disconnected #166 MC31 does not always accept configuration changes without restart #143 On startup CP30 and MC31 operate briefly using default IP address CP30/G30/MC31 Firmware 3100 Known Issues 3

4 Protocols #1409 DNP3 master does not confirm multi fragment slave responses When the RTU operates as a DNP3 master, and the slave RTU responds to a poll with a multifragment response, then the master may not update the relevant variables nor send a confirmation to the slave. Workaround: Ensure that the slave is polled frequently enough so that events do not build up to the point of requiring a multi-fragment response. #1408 SNMP replies sent to wrong port number when polled by RTU master When the RTU operates as an SNMP master and polls a second slave RTU, the slave sends the reply to port 161 rather than the source port used in the request. This causes the master to ignore the response. Note that this problem does not occur when the slave RTU is polled by some other SNMP master (not an RTU), e.g. an SNMP client running on a PC. #1357 DNP3 Disable Unsolicited messages sent to devices that don t support this When operating as a DNP3 master, the RTU sends a Disable Unsolicited Messages message when connecting to a slave device. However if the slave does not support unsolicited messaging then it may reply with the bad function IIN bit set. The RTU ignores this and continues to send further Disable Unsolicited messages. This does not stop normal polling from proceeding, but it is a waste of bandwidth. #1165 DNP3 secure connection is not re-established after master reset When operating as a DNP3 master with DNP security enabled, the RTU successfully establishes communications with a DNP3 slave device. If the RTU is then restarted, or the route to the slave is changed, then attempts to set digital outputs on the slave fail because the master does not reauthenticate. Workaround: Set a session key timeout on the slave. This causes the slave to request a new session key after a period of time. Once this request is made, the master will successfully reconnect and digital outputs can be set. #1128 Default DNP3 event buffer setting can cause CP30 reset When operating as a DNP3 slave, the DNP3 event buffer depth setting specifies the maximum number of unreported events to retain for each point type, for each DNP3 master. This is set in Toolbox PLUS+ using the Event buffer control on the DNP3 Edit Protocol dialog ( Events tab). The default value (10000) can cause the CP30 to run out of memory in some circumstances, e.g. where a large number of events are generated, and multiple DNP3 masters successfully connect to the RTU but then do not poll for the required classes of events. CP30/G30/MC31 Firmware 3100 Known Issues 4

5 Workaround: Reduce the Event buffer setting in Toolbox PLUS+, e.g. to Ensure that all DNP3 masters are correctly configured to poll for events at an appropriate rate. #1056 Possible slow boot time, depending on numbering of DNP3 points In systems with a large number of DNP3 points, if the DNP3 points of a given type are numbered such that there is a gap at the start then the RTU boot time can be significantly longer. For example, having points numbered DNPAI100-DNPAI5100 results in a longer boot time, compared to having points numbered DNPAI0-DNPAI5000. Workaround: Renumber DNP3 points, or add dummy points, so that the point numbers start at 0 and increment with no gaps. #945 DNP3 IIN event bits not set properly When the RTU receives a DNP3 Class 0 poll, and has class 1 or 2 events stored, then it does not set the appropriate CLASS_n_EVENTS bits in the response IIN field. The bits are set if the poll requested class 1/2/3 events, and there are further events that were not reported in the response. Workaround: Periodically poll for class 1/2/3 events (or use unsolicited reporting); do not rely on the IIN bits in class 0 responses. #941 Pending flag set for reply CONFIRM messages sent by DNP3 master If the RTU receives unsolicited DNP3 data from a slave and then sends a CONFIRM response then the KF_GET_PENDING flag is set, and remains set until the timeout occurs. This is incorrect: the Pending flag should only be set for messages initiated by the RTU, not for CONFIRM responses. #884 RTU stops responding to DNP3 messages if protocol changed from UDP to TCP If the transport protocol (TCP/UDP) used by a DNP3 master is changed during operation then the RTU will stop responding to DNP3 polls until the RTU is restarted. Workaround: Restart the RTU after reconfiguring the transport protocol on the DNP3 master. #748 Modbus writes can be performed to standby processor When operating as a DNP3 slave, the RTU ignores attempts to write data to the standby processor. However for Modbus it is possible to write to variables on the standby, which can result in an inconsistent state in the RTU. Workaround: Ensure that the master system is configured such that it does not attempt to write Modbus data to the standby processor s IP address. #548 Possible restart when reading events using Kingfisher protocol on serial port When the KF_RX_UPDATE_SINGLE function block is used to retrieve event logs from a slave RTU, the Kingfisher protocol handler may fail under some circumstances, causing the RTU to restart. This is generally only seen when using a serial port. Workaround: Consider using DNP3 protocol to retrieve events from the slave RTU. CP30/G30/MC31 Firmware 3100 Known Issues 5

6 #481 Unsolicited events only sent to one master on startup If DNP3 unsolicited events are enabled to 2 masters, and events available on startup, then the events will only be sent to the first Master to open a connection to the RTU. Events will not be sent to the second master until it first polls the RTU. Workaround: Configure the master to perform a poll immediately after it connects to the RTU. #439 Incorrect response when polled by multiple DNP3 masters with same IP address Run two or more instances of a DNP3 master process (each configured with a different DNP3 master address) on the same computer. The RTU responds to class polls sent by the second and subsequent instances using the connection established by the first instance. Workaround: Each DNP3 master should have a unique DNP3 address and a unique IP address. #432 Slave RTU attempts to establish connection to master If a DNP3/Modbus master is set up to poll the RTU, and the connection fails such that the RTU is not able to send a response, then the RTU will attempt to establish a connection to the master. This will normally fail, as the establishment of a connection is the responsibility of the master. Workaround: The master system should normally be configured to automatically re-establish the connection if it detects that the connection to the RTU has been lost. #376 VIA field in new Kingfisher messages is always 0 When using Kingfisher Protocol to initiate a message from an RTU (e.g. KF_TX_DATA / KF_RX_DATA), the VIA parameter is always 0. This can cause any Series 2 processors on the network to re-transmit the same message to the destination device, which can cause extra traffic on the network. #252 Incorrect response when MC31 port polled by multiple Modbus masters with same IP address Run two or more instances of a Modbus master process on the same computer. The RTU responds to polls sent by the second and subsequent instances using the connection established by the first instance. This issue is only seen when communicating via an MC31 Ethernet port; the CP30 main Ethernet port is OK. Workaround: Each Modbus master should have a unique IP address. #211 Erroneous reply packet sent if Modbus Unit ID doesn t match RTU address If a Modbus request is sent to the RTU s IP address, and the Modbus Unit ID is not set to the RTU s address, then the RTU will reply with an invalid response. It should either ignore the request or forward it to a connected serial device. Workaround: Ensure that the Modbus master is configured to set the Unit ID correctly. CP30/G30/MC31 Firmware 3100 Known Issues 6

7 #187 Indirect Kingfisher protocol poll over DNP3 serial port fails PC is connected to RTU1 via Ethernet; RTU1 is connected to RTU2 via serial port, which is configured for DNP3 protocol. If Toolbox PLUS+ then polls RTU2 via RTU1 s IP address then RTU1 correctly forwards the message to RTU2 but the reply does not make it back to the PC. #185 Incorrect responses when different DNP3 qualifiers used in same message If a DNP3 poll message containing requests with different qualifiers is received (e.g. Class 1 Qualifier 7 Count 20, and Class 2 Qualifier 6) then an incorrect response may be sent by the RTU, e.g. it may not report any Class 2 data when there are data available. Workaround: Configure the master system to avoid mixing qualifiers in the same message. #52 KF_GET_PENDING does not always work properly with Modbus In some cases the KF_GET_PENDING function block output is cleared before the reply message has been received from the remote device. This is more likely to occur if the KF_GET_PENDING function block is executed immediately after the MODBUS function block. Workaround: Execute the KF_GET_PENDING function block once, at the start of the logic cycle. Then make at most one call to the MODBUS function block during the cycle. Ports #1331 MC30 ports configured as RS422 do not work If a port on an MC30 module is configured for RS422 then communications on this port will not function. MC31 ports are not affected. Workaround: Configure the port for RS485 instead. This will still work even if the port is wired for RS422. #876 Possible RTU restart with rapid PSTN polling The RTU is a master, and is set up to poll an Option D (PSTN modem) port at a rapid rate (e.g. every 100ms), using Kingfisher protocol. This may cause the RTU to restart after a short time. Workaround: When creating logic, ensure that protocol function blocks are not called every cycle. Protocol function blocks should be called at a reasonable rate, or the KF_GET_PENDING function block should be used to ensure that a new poll is not started until the previous one has completed. #727 Ethernet discovery may list incorrect IP addresses If two or more Ethernet ports on a CP30 or MC31 module are connected and accessible, and the Discovery button is pressed in Toolbox PLUS+, then the same IP address will be reported for all ports on that module. Workaround: When performing Ethernet Discovery, only connect one of the Ethernet ports on a given module at a time. CP30/G30/MC31 Firmware 3100 Known Issues 7

8 #362 MC31 stops responding if serial option card not present Create a configuration where one or more option I (serial) ports are defined on an MC31 and download to RTU. If the MC31 does not have at least one serial option card installed then it will not start up properly: the MC31 does not appear in the list of detected modules, and all MC31 ports (including port 1) are inoperative. Workaround: Either install the correct option cards on the MC31, or download a configuration that does not define any serial ports on the MC31. #340 Incorrect subnet mask setting can cause RTU restart For Ethernet ports, the subnet mask setting should be set to a value that (when represented as a single 32-bit value) consists of a single string of 1 bits followed by a string of 0 bits. For example, is valid but is not. If an invalid value is entered then this may cause the RTU to repeatedly restart. Workaround: Reset the configuration to default by removing the link at the rear of the CP30 and waiting 5 minutes. Then correct the subnet mask setting and download the configuration. #256 Serial downloads at 115k are very slow and may fail If the PC is connected to the RTU via a serial cable and the port is configured for bps then the port works (e.g. status can be returned in Toolbox PLUS+) but downloading configuration or firmware is very slow and may fail. Workaround: Set the serial port to bps Event Logging #1061 Duplicate events recorded on G30 when SOE inputs mapped to DNP3 On the G30, if Sequence of Events (SOE) is enabled on an IO-MX2/3/4 card digital input, and the input is mapped to a DNPBI point, then two events may be logged for each input transition. One event is the SOE event detected by the IO-MX card, the other is detected by the G30 processor when it checks the state of the DNP point at the end of each cycle. (On a CP30 system with a DI-10, the latter event is suppressed and not logged.) If the input pulse widths are always longer than the cycle time then the SOE feature can be disabled. #784 Oversize event log definition causes RTU to fail to restart properly In Toolbox PLUS+ you can specify the size of the event log in the RTU (i.e. the number of events to store). If this is set to a very high value then the event log will not be created and the RTU may not restart correctly. In particular you may not be able to connect to the RTU in Toolbox PLUS+. The recommended maximum setting for this parameter is 100,000 events (default is 10,000 events). Workaround: Do not set this parameter higher than 100,000 events. If the RTU is not restarting properly because it has previously been configured with an oversize event log, it can be recovered as follows: CP30/G30/MC31 Firmware 3100 Known Issues 8

9 1. Set the event log size to 100,000 or less and download this configuration to the RTU. Use the SSH protocol for the download (which is the default). After the download completes and the RTU reboots, Toolbox PLUS+ may fail to reconnect, and report an error. This can be ignored. 2. Download the current firmware to the RTU. This will reinitialise the event log. After the download completes and the RTU reboots, Toolbox PLUS+ should be able to reconnect normally. #537 Incorrect event log timestamps In some circumstances the timestamp for a logged event may be recorded incorrectly. Typically it is offset by 1 second. #415 Cannot log long variable names using KF_ EVENT_LOG If the variable name passed to the KF_ EVENT_LOG function block is longer than 16 characters then it will not be logged. Workaround: Ensure that variable names are 16 characters or less. For automatically generated names e.g. SL08DI10DI14.value you can drop the.value part when passing it as a parameter to the KF_ EVENT_LOG function block. Redundancy #827 Duplicate DNP3 events may be reported following redundant changeover In a redundant processor system, a DNP3 master polls the active CP30 for a particular class of events, then a processor changeover occurs, then it polls the newly active CP30 for the same class of events. In response, the RTU may return events that were previously returned by the formerly active CP30. This can occur if there are unreported events of a different class and type. Workaround: If possible, configure the SCADA system to eliminate the duplicate events. Also ensure that polling rates for the different event classes are sufficient so that events do not remain unreported for too long. #810 Duplicate and erroneous events if changeover during initial synchronisation In a redundant processor system, if the active processor fails or is removed during the initial synchronisation period (a short time window following startup of the standby processor), then invalid or duplicated events may be returned when polled by a DNP3 master. This persists for a period of time then returns to normal. Note however that in practice this issue will only occur in the event of a double failure, i.e. a replacement of the standby CP30 followed immediately by a failure of the active CP30. #644 Cannot access standby CP30 if active processor is not configured In a redundant processor system, protocol drivers on the standby CP30 do not start up if the active CP30 is not properly configured. This prevents firmware on either module being updated, because a firmware upgrade involves multiple resets, which will cause the active CP30 to become the standby processor. CP30/G30/MC31 Firmware 3100 Known Issues 9

10 Workaround: Either (a) upgrade firmware on the CP30s by plugging them in one at a time, or (b) download a valid configuration to each processor before attempting a firmware upgrade. Ensure that the CP30 slot numbers are set correctly in the configuration. #451 Delay in scanning in redundant system if many variables change In a redundant processor system, if a large number of variables change their value then this can cause a delay in logic processing due to the time taken to synchronise the changes to the standby processor. For example if 1000 variables change value then the delay could be seconds. #208 Duplicated events in redundant processor In a redundant processor system, a large number of events are being generated, and one or more processer changeovers have occurred. If the events are now retrieved, then in some cases you may occasionally find a block of 8 duplicated events. Workaround: If possible, configure the master system to eliminate the duplicate events. Function Blocks #1033 KF_GET_MODULE_OK function block doesn t work on G30 The KF_GET_MODULE_OK function block always returns FALSE on the G30. Workaround: Use the KF_GET_MODULE_TYPE function block and use logic to compare the output with the expected card type. #919 Some function blocks do not support the full RTU address range The following function blocks return an error if the RTU address parameter is greater than 249: KF_RX_DATA, KF_TX_DATA, KF_NW_RX_DATA, KF_NW_TX_DATA, KF_RX_UPDATE_SINGLE. They should allow addresses up to Workaround: Assign RTU addresses in the range if using these function blocks. Alternatively, DNP3 protocol provides similar functionality. #491 REBOOT function block is not usable in FBD program When the REBOOT function block is used in a Function Block Diagram (FBD) program, the block has no input or output and is never executed. Workaround: Create a function using Ladder Diagram (LD), containing a call to REBOOT. Then call this function from your FBD program. I/O Modules #1492 Analog scaling does not work for PS-1x/2x modules Scaling parameters entered in Toolbox PLUS+ for PS-1x/2x module analog inputs are ignored in Isagraf debug mode raw values ( ) are shown. CP30/G30/MC31 Firmware 3100 Known Issues 10

11 Workaround: Apply the required scaling using logic. #1394 RTU reads and writes I/O modules even if incorrect type installed If an installed I/O module does not match the configuration then a warning message is added to the system log, but the CP30 continues to read and write to the module. This may cause unexpected outputs to be asserted and unexpected data to be read. Workaround: Ensure that installed modules match the configuration defined in Toolbox PLUS+. #1036 IO-4 analog values not read correctly Analog values read from an IO-4 module appear frozen: the SLnnIO4AIx variables do not update, nor do the bar graphs in the Toolbox PLUS+ module status window. IO-4 digital inputs and outputs work correctly. Analog inputs on all other module types (IO-3, IO-5, AI-1, AI-10) work correctly. Workaround: If possible use a different IO module type (e.g. IO-3). System #1342 Toolbox PLUS+ may fail to reconnect during upgrade If Toolbox PLUS+ is connected to the RTU via a router (that is, the Toolbox PLUS+ PC and the RTU are on different Ethernet networks), then Toolbox PLUS+ may fail to reconnect after downloading a configuration or firmware file. In the case of a firmware upgrade, this causes a download failure to be reported. If you subsequently reconnect to the RTU (e.g by pressing Status in Toolbox PLUS+) then the connection is successful. Workaround: Change network configuration so that PC and RTU are on the same network (connected via a cross-over cable or via a switch). If this is not possible then open the firmwarennnn.tgz file and extract the three files therein: fwnnnn_1.tgz, fwnnnn_2.tgz and fwnnnn_3.tgz. Then perform three separate firmware upgrades, specifying each of these files in turn. #1253 Service log upload may fail under heavy load If the RTU is heavily loaded then a timeout may occur when you request a service log upload in Toolbox PLUS+, which prevents the upload from completing. #845 Variable boot time for large projects For projects with a large number (thousands) of DNP3 points defined, the time taken for the RTU to start up can vary significantly depending on the ordering of the points in the dictionary files generated by Toolbox PLUS+. In redundant CP30 systems, this may cause the secondary (odd slot) CP30 to start up as the active processor. Workaround: Use Toolbox PLUS+ version or later to download configuration and logic. This version sorts the dictionary so that the ordering of points is consistent. CP30/G30/MC31 Firmware 3100 Known Issues 11

12 #412 Real time clock set to random value if battery disconnected If the link at the rear of the module is removed (in order to reset the configuration to the default) then the real time clock will be set to a random value. Workaround: After resetting the configuration using the battery link (or installing a brand new CP30), be sure to reset the RTU real time clock using the Date & Time tab on the RTU Status dialog in Toolbox PLUS+. #166 MC31 does not always accept configuration changes without restart If the configuration of an MC31 port is changed and the new configuration downloaded to the CP30, then the MC31 may not operate correctly using the new settings until it is reset. Workaround: Power cycle the RTU (including MC31) after changing MC31 configuration. #143 On startup CP30 and MC31 operate briefly using default IP address During the period between about 15s and 30s after reset or power up, the CP30 and MC31 advertise their IP address as , rather than their configured address. This may cause problems on some local area networks. Workaround: If possible, configure the LAN so that the address is tolerated. CP30/G30/MC31 Firmware 3100 Known Issues 12