Funk Electronic Piciorgros TMO-100 800 MHZ TETRA RADIO User Manual TMO 100 2017

Funk-Electronic Piciorgros GmbH 800 MHZ TETRA RADIO TMO 100 2017

User Manual

TMO-100 User Guide Integrated TETRA Modem, Router, Mini-RTU January 2017 Funk-Electronic Piciorgros GmbH Claudiastrasse 5 51149 Cologne Germany
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 2 of 112 1INTRODUCTION ...................................................................................................................... 51.1Overview .................................................................................................................................. 51.2Safety Precautions .................................................................................................................... 51.3Disclaimer ................................................................................................................................. 51.4Rules for using the TMO-100 in the USA or in Canada .......................................................... 61.4.1Labeling 61.4.2Outside Label ......................................................................................................................... 61.4.3Changes and Modifications ................................................................................................... 61.4.4Label on the backside of the TMO-100 (USA) ..................................................................... 71.4.5Label on the backside of the TMO-100 (Canada) ................................................................. 71.4.6Label on the backside of the TTS-2000 (USA) ..................................................................... 81.4.7FCC RF exposure compliance ............................................................................................... 91.4.8FCC Part 15.19 Warning Statement ...................................................................................... 91.4.9FCC Part 15.21 Warning Statement ...................................................................................... 91.4.10FCC Part 15.105(b) Warning Statement ........................................................................... 101.4.11IC RSS-GEN, Sec 8.4 Warning Statement- (Required for license-exempt devices) ........ 101.4.12IC RSS-GEN, Sec 8.3 Warning Statement- (Required for Transmitters w/ detachable antennas) ............................................................................................................. 101.4.13IC RSS-102, Sec 2.6 Warning Statement Requirements ................................................... 111.5Labeling for the Kingdom of Thailand ................................................................................... 131.6Functions and Features ........................................................................................................... 141.7Hardware Options ................................................................................................................... 151.8Software Options .................................................................................................................... 171.8.1Packet Data .......................................................................................................................... 171.8.2Multi Slot Packet Data ( MSPD) ......................................................................................... 171.8.3Secondary Control Channel (SCCH) ................................................................................... 171.8.4Authentication ..................................................................................................................... 171.8.5Air Interface Encryption ...................................................................................................... 171.8.6Voice (PA-feature) .............................................................................................................. 171.8.7PicoLogo – embedded User Application Interface ............................................................. 181.9Software Versions .................................................................................................................. 192CONNECTIONS AND HARDWARE INSTALLATION .................................................... 202.1Mechanical Details ................................................................................................................. 202.1.1Dimensions .......................................................................................................................... 202.1.2Mounting 212.1.3Dismounting ........................................................................................................................ 212.2Electrical Connections ............................................................................................................ 222.2.1Power Supply Input ............................................................................................................. 222.2.2Serial Interfaces ................................................................................................................... 232.2.3Secondary Serial Interface (AUX Interface) ....................................................................... 242.2.4Ethernet Interface ................................................................................................................ 252.2.5Voice Interface (Optional) ................................................................................................... 252.2.6Extension Port for additional I/O modules (only devices with embedded I/O) .................. 262.2.7Connecting the I/O (TMO-100/DAx types only) ................................................................ 272.2.8Connecting the Antenna ...................................................................................................... 292.3LED Functions ........................................................................................................................ 302.3.1OK LED: Blink Pattern Error Indication ............................................................................. 322.3.2Start Up Indication using the RF-LED Chain ..................................................................... 322.4Reset to factory default ........................................................................................................... 332.4.1General Reset of the Device to Factory Default .................................................................. 33
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 3 of 112 2.4.2Resetting the Ethernet Parameter ........................................................................................ 342.5Configuration of the TMO using the embedded web server .................................................. 352.5.1Navigation using the Menu ................................................................................................. 362.5.2Requesting Restart of the Device ........................................................................................ 373DATA COMMUNICATION OVER TETRA NETWORKS ............................................... 383.1Data Communication by SDS ................................................................................................ 403.1.1Use of the TMO-100 as master modem .............................................................................. 413.1.2Using the TMO-100 as Slave Modem ................................................................................. 433.1.3Data Compression using the LZ77 algorithm ..................................................................... 443.2Sending and receiving SDS- and Status Messages using the Hash (#) Command Sequence ............................................................................................................................. 453.3Processing MMI Commands sent by a TMO-100, Terminal, Mobile or Dispatcher ............. 473.3.1Submitting MMI commands using a TMO-100 .................................................................. 483.3.2Sending MMI commands by a TETRA terminal or dispatcher .......................................... 503.3.3List of MMI commands ....................................................................................................... 513.4Packet Data (IP) Communication ........................................................................................... 553.4.1IP Assignment in the TETRA Network ............................................................................... 553.4.2IP Assignment for the Ethernet Interface ............................................................................ 563.4.3Router Function of the TMO-100 ........................................................................................ 573.4.4NAT - IP Address Screening ............................................................................................... 633.4.5MTU (Maximum Transfer Unit) Size ................................................................................. 643.4.6Data Compression using Packet Data .................................................................................. 643.4.7Transmission of Serial Data using Packet Data Mode ........................................................ 643.5Special TETRA features ......................................................................................................... 653.5.1Prefer or avoid TETRA cells ............................................................................................... 653.6IP Application Interface ......................................................................................................... 703.6.1Operating modes .................................................................................................................. 713.6.2Address detection and routing ............................................................................................. 723.6.3Configuring the IP link ........................................................................................................ 733.6.4IP link status information .................................................................................................... 744PROTOCOLS ........................................................................................................................... 754.1Layer one Protocols between TMO-100 and the external device, connected via serial interface .............................................................................................................................. 754.1.1Timeout Protocol ................................................................................................................. 754.1.23964R Protocol .................................................................................................................... 754.2Serial Protocols (RS-232 or RS-485/RS-422) ........................................................................ 764.2.1Modbus RTU ....................................................................................................................... 774.2.2ROC protocol ....................................................................................................................... 774.2.3DNP3 774.2.4IEC 60870-5-101 ................................................................................................................. 774.2.5PakBus 774.2.6BSAP 774.2.7User-Protocol ....................................................................................................................... 784.2.8Transparent Data Communication without Protocol Filter (User Defined) ........................ 784.2.9Hart-Protocol ....................................................................................................................... 784.3IP based Communication Protocols ........................................................................................ 794.3.1Modbus/IP ........................................................................................................................... 794.3.2DNP3/IP 794.3.3IEC 60870-5-104 ................................................................................................................. 794.3.4HSE-Field bus Foundation .................................................................................................. 79
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 4 of 112 5CONFIGURING THE TMO-100 ........................................................................................... 805.1Configuring the TMO-100 through the Integrated Web Server ............................................. 805.2Configuring the TMO-100 using MODBUS Protocol ........................................................... 815.2.1Access through the Serial Interface ..................................................................................... 815.2.2Access through the Ethernet Interface ................................................................................. 815.2.3Access over the TETRA Network ....................................................................................... 826AUXILIARY FUNCTIONS .................................................................................................... 836.1Sending Restart (Reset) and Ok-Messages ............................................................................. 836.2Monitoring the Receive Field Strength using a Status Message ............................................ 846.3Remote device restart using a Status Message ....................................................................... 856.4Speech Communication (Voice Function) ............................................................................. 866.4.1Configuration of the voice feature ....................................................................................... 876.4.2Voice target selection with the speaker handset .................................................................. 896.4.3Voice Alarm Feature ........................................................................................................... 906.4.4Recording of messages ........................................................................................................ 90For security reasons the ISSI of the terminal / dispatcher which is allowed to record messages must be entered in the field "Authorized SSI for recording". This SSI must match the SSI which is seen when the recording device makes a PTT call toward the TMO-100. ... 906.4.5Backup and clone a set of messages .................................................................................... 926.5Control and Measurement I/O (RTU Functionality) .............................................................. 936.5.1Accessing I/Os using the MODBUS Protocol ..................................................................... 946.5.2MODBUS Coil- and Input commands ................................................................................ 966.5.3Supported MODBUS commands ........................................................................................ 976.6Accessing the I/O using the IEC60870 protocol .................................................................... 986.6.1Native (internal) IEC60870 support for the basic I/O's ....................................................... 986.7Setting the RTU-Parameter (Device with Embedded I/O) ..................................................... 996.8Master Modem for MODBUS Protocol ............................................................................... 1036.8.1Modbus Protocol with unsolicited Messaging .................................................................. 1037PICOLOGO® USER APPLICATION INTERFACE ......................................................... 1058START-UP / TROUBLESHOOTING ................................................................................. 1068.1Brief Instructions .................................................................................................................. 1068.1.1Configuring the TETRA Network Parameters .................................................................. 1068.1.2Antenna 1068.1.3Power Supply and Power-Up Sequence ............................................................................ 1068.1.4Power up Indication using a PPP Link (Packet Data Connection) .................................... 1078.1.5Failure to Register on the TETRA Network ...................................................................... 1078.2TMO-100 Firmware update procedure ................................................................................. 1088.2.1Preparation and setup ........................................................................................................ 1088.2.2Update procedure ............................................................................................................... 1088.2.3Connecting the TMO-100 .................................................................................................. 1098.2.4Update using the Windows command line client .............................................................. 1099SPECIFICATIONS ................................................................................................................ 111
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 5 of 112 1 Introduction 1.1 Overview This document contains information about installation, settings, and operation of the TMO-100 TETRA Radio Modem. Additional information is also available over the Internet, at the website www.TETRAModem.com, in the FAQ pages. This includes practical guidance relating to antenna selection and installation, operating range, extension modules, software support, etc. 1.2 Safety Precautions This equipment transmits radio waves in the frequency range 350 to 470 MHz or -800 MHz. Under certain circumstances, these radio waves could be harmful to any living being or electronic equipment near it. Care should be taken to ensure that the radio and antenna systems are installed and commissioned only by trained persons. This radio equipment should not be used in life support systems or in safety systems without our prior written permission. 1.3 Disclaimer We have carefully checked the contents of this document, and the hardware and software described in it, for compatibility. We cannot however exclude possibilities of deviations and cannot guarantee complete conformity of the document with the equipment it describes. If any corrections or improvements are to be made, they will be taken into consideration in the next edition of this document. Important instructions are marked by the expressions "Important", "Note" or “Caution!”. These should be carefully observed. Explanations regarding these precautions can be found in the website www.TETRAModem.com, in the Login Area pages.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 6 of 112 1.4 Rules for using the TMO-100 in the USA or in Canada This device complies with part 15 of the FCC Rules. Operation is subject to the following two conditions: (1) This device may not cause harmful interference, and (2) this device must accept any interference received, including interference that may cause undesired operation. 1.4.1 Labeling As the TMO-100 usually will be installed on a DIN rail inside an enclosure and the label on the back side will not be visible, the second label (see inside of the TMO-100 box) has to be placed outside of the cabinet where it is readable. If this second label gets lost or damaged the following should be an example how to create one. 1.4.2 Outside Label This is the label that has to be placed on the outside of the enclosure, if the label of the TMO-100 is not readable 1.4.3 Changes and Modifications Any changes or modifications not explicitly approved by Funk-Electronic Piciorgros GmbH as the responsible party for compliance could void the end user's authority to operate the equipment.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 8 of 112 1.4.6 Label on the backside of the TTS-2000 (USA)
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 9 of 112 Interference with other equipment or services This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:  Reorient or relocate the receiving antenna.  Increase the separation between the equipment and receiver.  Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.  Consult the dealer or an experienced radio/ TV technician for help. 1.4.7 FCC RF exposure compliance To comply with the FCC RF exposure compliance the antenna used for the TMO-100 must be installed to provide a minimum separation distance to any person as shown below: Radio Tx Power [W] 1.8 1.8 1.8 1.8 1.8 Antenna Gain [dBi] 0 3 7 10 13 Antenna Output Power [EIRP] 1.8 W 3.6 W 9 W 18 W 36 W Minimum Separation Distance [m] 1 m 1.4 m 2.1 m 3 m 4.2 m 1.4.8 FCC Part 15.19 Warning Statement THIS DEVICE COMPLIES WITH PART 15 OF THE FCC RULES. OPERATION IS SUBJECT TO THE FOLLOWING TWO CONDITIONS: (1) THIS DEVICE MAY NOT CAUSE HARMFUL INTERFERENCE, AND (2) THIS DEVICE MUST ACCEPT ANY INTERFERENCE RECEIVED, INCLUDING INTERFERENCE THAT MAY CAUSE UNDESIRED OPERATION. 1.4.9 FCC Part 15.21 Warning Statement NOTE: THE GRANTEE IS NOT RESPONSIBLE FOR ANY CHANGES OR MODIFICATIONS NOT EXPRESSLY APPROVED BY THE PARTY RESPONSIBLE FOR COMPLIANCE. SUCH MODIFICATIONS COULD VOID THE USER’S AUTHORITY TO OPERATE THE EQUIPMENT.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 10 of 112 1.4.10 FCC Part 15.105(b) Warning Statement NOTE: This equipment has been tested and found to comply with the limits for a Class B digital device, pursuant to part 15 of the FCC Rules. These limits are designed to provide reasonable protection against harmful interference in a residential installation. This equipment generates, uses and can radiate radio frequency energy and, if not installed and used in accordance with the instructions, may cause harmful interference to radio communications. However, there is no guarantee that interference will not occur in a particular installation. If this equipment does cause harmful interference to radio or television reception, which can be determined by turning the equipment off and on, the user is encouraged to try to correct the interference by one or more of the following measures:  Reorient or relocate the receiving antenna.  Increase the separation between the equipment and receiver.  Connect the equipment into an outlet on a circuit different from that to which the receiver is connected.  Consult the dealer or an experienced radio/TV technician for help. 1.4.11 IC RSS-GEN, Sec 8.4 Warning Statement- (Required for license-exempt devices) ENGLISH: This device complies with Industry Canada license-exempt RSS standard(s). Operation is subject to the following two conditions: (1) this device may not cause interference, and (2) this device must accept any interference, including interference that may cause undesired operation of the device. FRENCH: Le présent appareil est conforme aux CNR d'Industrie Canada applicables aux appareils radio exempts de licence. L'exploitation est autorisée aux deux conditions suivantes : (1) l'appareil ne doit pas produire de brouillage, et (2) l'utilisateur de l'appareil doit accepter tout brouillage radioélectrique subi, même si le brouillage est susceptible d'en compromettre le fonctionnement. 1.4.12 IC RSS-GEN, Sec 8.3 Warning Statement- (Required for Transmitters w/ detachable antennas) ENGLISH: This radio transmitter (identify the device by certification number, or model number if Category II) has been approved by Industry Canada to operate with the antenna types listed below with the maximum permissible gain and required antenna impedance for each antenna type indicated. Antenna types not included in this list, having a gain greater than the maximum gain indicated for that type, are strictly prohibited for use with this device. 
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 11 of 112 Immediately following the above notice, the manufacturer shall provide a list of all antenna types approved for use with the transmitter, indicating the maximum permissible antenna gain (in dBi) and required impedance for each. FRENCH: Le présent émetteur radio (identifier le dispositif par son numéro de certification ou son numéro de modèle s'il fait partie du matériel de catégorie I) a été approuvé par Industrie Canada pour fonctionner avec les types d'antenne énumérés ci-dessous et ayant un gain admissible maximal et l'impédance requise pour chaque type d'antenne. Les types d'antenne non inclus dans cette liste, ou dont le gain est supérieur au gain maximal indiqué, sont strictement interdits pour l'exploitation de l'émetteur. 1.4.13 IC RSS-102, Sec 2.6 Warning Statement Requirements The applicant is responsible for providing proper instructions to the user of the radio device, and any usage restrictions, including limits of exposure durations. The user manual shall provide installation and operation instructions, as well as any special usage conditions, to ensure compliance with SAR and/or RF field strength limits. For instance, compliance distance shall be clearly stated in the user manual. The user manual of devices intended for controlled use shall also include information relating to the operating characteristics of the device; the operating instructions to ensure compliance with SAR and/or RF field strength limits; information on the installation and operation of accessories to ensure compliance with SAR and/or RF field strength limits; and contact information where the user can obtain Canadian information on RF exposure and compliance. Other related information may also be included. English CAUTION: This repeater emits radio frequency (RF) energy when transmitting. Make sure to observe all RF energy exposure standards when installing, testing, repairing, and operating this radio equipment. Proper operation of this repeater under normal conditions results in user exposure to RF energy below standard acceptable limits. • Do not allow the antenna to touch or come in very close proximity with the eyes, face, or any exposed body parts while the radio is transmitting. • Do not operate the transmitter of a stationary radio (base station or marine radio) when a person is within the dangerous range of the antenna. ( See 1.4.6 for details ) • Do not operate the radio in explosive or flammable atmospheres. The transmitted RF energy could trigger blasting caps or cause an explosion. • Do not operate the radio without the proper antenna installed. • Do not allow children to operate transmitter equipped radio equipment. Note: The preceding warning list is not intended to include all hazards that may be encountered when using this radio.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 12 of 112 Français ATTENTION: Ce répéteur émet des fréquences radio (RF) lors de la transmission. Assurez-vous de respecter toutes les normes d' exposition à l'énergie RF lors de l'installation, les essais, la réparation et l'utilisation de ce matériel radio. Le bon fonctionnement de ce répéteur dans des conditions normales entraîne l'exposition de l'utilisateur à l'énergie RF en dessous des limites du standard acceptables. • Ne pas laisser l'antenne entrer en contact ou à proximité des yeux, du visage ou des parties du corps exposées lorsque le répéteur transmet. • Ne pas faire fonctionner l'émetteur d'une radio fixe (station de base ou radio marine) quand une personne est dans les espacement de l'antenne. ( voir 1.4.6 pour details ) • Ne pas faire fonctionner le radio dans des atmosphères explosives ou inflammables. Le RF énergie du radio qui transmet pourrait déclencher des détonations ou provoquer une explosion. • Ne pas faire fonctionner le radio sans l'antenne appropriée installée. • Ne pas laisser les enfants utiliser le radio équipé du matériel de répéteur. Note: La liste d’avertissement précédente ne vise pas à inclure tous les dangers qui peuvent survenir lorsque vous utilisez ce radio..
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 13 of 112 1.5 Labeling for the Kingdom of Thailand All Piciorgros TETRA products approved and delivered to Thailand can be identified with the country specific NTC-ID (National Telecommunications Commission Identifier) NTC-ID: TMO-100 TMO-100 (Thailand Label) for 806 to 869 MHz operating range NTC-ID: TMO-100B01 TMO-100 (Thailand Label) for 370 to 400 MHz operating range
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 14 of 112 1.6 Functions and Features The TMO-100 is a radio data communication modem for TETRA networks. These modems allow transparent data communication between two or more nodes in a TETRA network. The TMO-100 conveniently combines the functions of a controller, router, modem, and radio transceiver in a single compact enclosure. The TMO-100 supports standard serial and IP-based data communication protocols. It has two serial data interfaces (RS-232 or RS-485/422) and an Ethernet (10/100 Mbits/sec) port. For TETRA radio networking, either of two modes can be selected: SDS based communication or packet data transmission. An optional voice communication feature is also available, by which field personnel can talk with a control room. The TMO-100 can also be optionally provided with built-in inputs and outputs that can be read and set remotely using the MODBUS-RTU protocol. It is possible to transmit information about an input change automatically to another station as soon as an alarm condition occurs ["unsolicited message"]. The TMO-100 has a rugged aluminum housing compatible with standard DIN rail mounting. The wide power input voltage range of 12-24 VDC [+/- 20%] makes it easy to integrate the unit into monitoring and control systems.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 15 of 112 1.7 Hardware Options The TMO-100 is available in different hardware versions with various additional software options that can be enabled by license keys. The following hardware options are available:  TMO-100 TETRA modem with two serial ports, one Ethernet port and Microphone-Speaker connector. (Remark: The voice feature has to be enabled with a license key)  TMO-100/DA1 TETRA modem with two serial ports, one Ethernet port, 16DI, 8DO, 4AI (0-20mA, 4-20mA) and an expansion port connector for expansion modules with additional I/O.  TMO-100/DA2 TETRA modem with two serial ports, one Ethernet port, 16DI, 8DO, no embedded AI and an expansion port connector for PEM-type expansion modules with additional I/O.  TMO-100/DA3 TETRA modem with two serial ports, one Ethernet port, 16DI, 16DO, no embedded AI and an expansion port connector for PEM-type expansion modules with additional I/O.  TMO-100/DA4 TETRA modem with two serial ports, one Ethernet port, 16DI, 8DO, 2AI (0-20mA, 4-20mA), 2AO (0-20mA, 4-20mA) and an expansion port connector for expansion modules with additional I/O.  TMO-100/DA5 TETRA modem with two serial ports, one Ethernet port, 16DI, 8DO, 4AO (0-20mA, 4-20mA) and an expansion port connector for expansion modules with additional I/O.  TMO-100/CP Version with two serial ports, one Ethernet port, 16DI, 8DO and 4AO for the use in cathodic protection (CP) systems. The analog input configuration by default is: - Port D0: 0-100V - Port D1: 0-2V - Port D2: 0-4V - Port D3: 0-20mA All ports are protected against overvoltage with gas discharge surge suppressors and additional suppressor diodes. The resolution of the analog ports is 12 bits, different hardware configurations (Measurement ranges, voltages etc.) can be delivered on request.  TMO-100/DVI (US and Canada)
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 16 of 112 TMO-100 version of the DVI-100. Please refer to the Document DVI-100 By default the TMO-100 will be delivered with two serial RS-232 ports, prepared to use the air interface encryption with TEA1. TEA2, TEA3, RS-422 or RS-485 options can be ordered as options.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 17 of 112 1.8 Software Options License keys can enable a number of additional options. Each key is individually valid for one TMO-device. The activation of the license keys can be done easily with the embedded web server using the “Service / Configuration” menu. When ordering an additional license, the user has to submit the serial number of the TMO to be updated. 1.8.1 Packet Data Option for IP based data communication. 1.8.2 Multi Slot Packet Data ( MSPD) Option for IP based data communication 1.8.3 Secondary Control Channel (SCCH) Option to use secondary control channels 1.8.4 Authentication With Authentication the device can attach to secure TETRA networks. Please note that an additional key loader software is needed for generation and programming the authentication keys 1.8.5 Air Interface Encryption TEA1, TEA2 and TEA3 encryption (By default TEA1 is preset). Remark: The encryption method (TEA 1/2/3) is done by a hardware option and cannot be updated in the field. Additional key loader software is required for generating and programming the encryption keys 1.8.6 Voice (PA-feature) For all TMO-100 with no embedded I/O, the voice option can be enabled with a license key. Please note that the voice option is designed as a fallback feature and not fully supported with a keyboard and a display as a handheld terminal. Pre defined ISSI or GSSI will be used when pressing the PTT button of the (optional) available Microphone-Speaker Handset. If TMO-100 with embedded I/O should have the voice option, the expansion port connector will be replaced with the Microphone-Speaker plug. In this case PEM-expansion modules cannot be used.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 18 of 112 1.8.7 PicoLogo – embedded User Application Interface The PicoLogo option is a powerful User Application Interface that can be used similar to a Micro PLC to generate Alarms, Text-Messages, M2M-Communication or to monitor and supervise digital or analog values. An additional graphical editor for developing PicoLogo functions is also available.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 19 of 112 1.9 Software Versions The software (firmware) versions and document editions history is listed below: Firmware Version Document Version Comments / Changes 1.0 1.2 First Release 1.10  Nat supported with keeping the source port (Fieldbus Foundation HSE)  SDS Gateway Option for ETELM Infrastructure (TGW-100)  IP Gateway for serial data over Packet Data communication (TGW-100) 1.16  Firmware update of TMO-100 now with TFTP supported  Sinaut Protocol implemented  Modbus TCP supports up to fife simultaneous TCP connections 1.50 1.50  PPP-Authentication now can be chosen with PAP or CHAP  Stacked-SDS receive now supports up to 136 different SDS-Fragments from up to 32 different outstations simultaneously  Operating Frequencies now are displayed in MHz rather than Hz  The operating channel now can be chosen by entering the frequency or the channel number with or without offset  New operating Mode for the serial interfaces “SDS/Status” implemented. SDS and Status can now easily be generated using the #-Commands. The output of these data will be in the same format.  Secondary Control Channel enabled  TMO-Power down and power up can be now forced using the embedded web server 1.74 1.70  MMI Commands implemented 1.82  User Information needed for USA and IC included 1.823  User Information needed for Thailand (Labeling) included 2.62 2.62  Voice-Multicall implemented, up to 8 voice destinations can be configured and selected  A device reset can be triggered remotely by a status message  Cell Black/Whitelisting described in the documentation 2.62D  Added supported MODBUS commands to the documentation 2.82  Added description of the IP application interface 2.84  Added description of the Voice Alarm feature
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 20 of 112 2 Connections and Hardware Installation 2.1 Mechanical Details The dimensions of the TMO-100 housing conform to DIN 43880, and therefore it can be mounted on a standard 35mm DIN rail [DIN EN 50022]. Two serial interfaces are provided for connecting the TMO-100 to a PC/PLC or other local terminal equipment. The main serial interface ("COM") uses a standard 9-pin D-sub connector, while the secondary serial interface ("AUX") uses a standard RJ-11 socket. On the lower side of the housing an RJ-45 connector for the Ethernet port allows the TMO-100 to be hard-wire networked with local terminal equipment or PLC’s. On the upper side of unit another RJ-45 connector is provided for connecting a voice handset, for speech communication over the TETRA network. On the upper side of the unit is located the plug-in terminal connector for the power supply (12-24 VDC +/-20%) and a BNC socket for the antenna. A 10-pole DIP-switch allows quick changes to the unit's settings: e.g., changeover to Programming Mode. LED lamps on the front panel provide information about the operating condition of the unit: e.g., received TETRA RF signal strength, error conditions, etc. 2.1.1 Dimensions The dimensions of the TMO-100 are as follows: 162mm (9T) wide x 80mm high x 62mm deep All dimensions exclude connectors and antenna. RFBDAC080123001911210223113341244513556146671577CCOut CC+++++-----012301234567CC0819210311412513614In InIn In715CC80 mm60 mm162 mmRadioRx Rx RxTx Tx Tx OK PwrEth/Aux SystemComF1 F2 F4F3
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 21 of 112 2.1.2 Mounting The DIN-rail mounting clip is at the bottom of the Module. First the lower lip (spring-loaded) of the clip is engaged with the lower flange of the DIN rail, with the Module tilted downward slightly. The Module is then pushed upward (1) and rotated backward (2) until the upper lip of the clip snaps onto the upper flange of the DIN rail. 2.1.3 Dismounting To dismount the Module, force it upwards (1), and then rotate its upper end outward (2) until the upper lip of the Module's clip disengages from the upper flange of the rail. Then move the Module down slightly to disengage its lower lip from the rail flange. Mounting Dismounting
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 22 of 112 2.2 Electrical Connections 2.2.1 Power Supply Input The required supply voltage (12-24 VDC +/-20%) is connected through 3-way screw terminal connector located on the upper side of the enclosure. The terminals are assigned as follows (viewed from the front of the module, facing the front panel): Outer (left): Enclosure Ground (electrical earth) Middle: + 12 Volt to + 24 Volt (+/- 20%) Inner (right): GND, 0 Volt from Power Supply Radi oRx Rx RxTx Tx Tx OK PwrEth/AuxC01234567SystemComPwr Antenna COM DIP AUDIOEthernetAUXF1 F2 F4F3 Configuration: Ethernet, two serial ports, and voice interface
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 23 of 112 2.2.2 Serial Interfaces The TMO-100 has two serial data interfaces. The primary interface (COM) has a 9-pin D-sub connector on the upper side of the unit. The secondary interface [AUX] has an RJ-11 socket on the lower side of the unit. The COM interface can be either RS-232 or user-selectable RS-422/485. The AUX interface can be RS-232 or RS-485 (only). The following parameters are user adjustable: baud rate in the range 1200 - 57600 bps, data word length 7 or 8 bits, odd / even / no parity, and 1 or 2 stop bits. The factory setting is 9600 bps, 8 data bits, no parity, 1 stop bit. If a frame error is detected, or if the parity bit does not conform to the setting, the received data block is rejected. Both serial interfaces are supplied as RS-232, unless ordered otherwise. The primary interface is optionally available as a user-selectable RS-485 / RS-422 port, while the AUX interface is optionally available as an RS-485 port. Note that the RS-485 / RS-422 interface does not have the CTS/RTS lines. Pin No. Pin Assignment: Primary Interface, RS-232 2 TxD Send data TMO-100  peripheral 3 RxD Receive data TMO-110  peripheral 4 DTR Shorted to Pin 6 5 GND 6 DSR Shorted to Pin 4 7 RTS Handshake TMO-100  peripheral 8 CTS Handshake TMO-100  peripheral Pin No. Pin Assignment: Primary Interface, RS-422 2 A Receiver + (input) 3 Z Transmitter – (output) 5 GND 7 B Receiver – (input) 8 Y Transmitter + (output) Pin No. Pin Assignment: Primary Interface, RS-485 3 B Transceiver – 5 GND 8 A Transceiver + For the connection of the COM interface to a PC or PLC, use a standard 1:1 connector-terminated cable (9-pin D-sub male to 9-pin D-sub female).
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 24 of 112 2.2.3 Secondary Serial Interface (AUX Interface) The AUX interface socket is on the lower side of the unit. This interface allows the implementation of special applications, e.g., switching of the data-flow through this interface by a command, or feeding data from a predefined ISSI to this port rather that to COM. The secondary interface is provided through a 6-pin RJ-12 connector and equipped default with an RS-232 interface. The unit can be ordered optional with an RS-485 interface (RS-422 is not possible on the AUX port). Pin No. Pin Assignment: Auxiliary Interface, RS-232 1 GPS Supply voltage 2 RTS Handshake TMO-100  peripheral 3 RxD Receive data TMO-100  peripheral 4 TxD Send data TMO-100  peripheral 5 CTS Handshake TMO-100  peripheral 6 GND Pin No. Pin Assignment: Auxiliary Interface, RS-485 1 GND 3 B Transceiver – 4 A Transceiver + 6 GND
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 25 of 112 2.2.4 Ethernet Interface The Ethernet interface is provided via an RJ-45 socket on the underside the unit. This is a standard 10/100 Mbit/s interface. Two LEDs indicate the operating condition of this interface:  Green LED: Lights up when an Ethernet network is connected (LINK)  Yellow LED: Blinks when data transfer is taking place (DATA) Network parameters such as IP address, net mask, and gateway address can be assigned over DHCP as a static or dynamic address. 2.2.5 Voice Interface (Optional) The optional voice communication feature allows voice communication over the TETRA network, using a PTT (push to talk) pushbutton switch and voice transceiver (handset or headphone/microphone headset) connected to the TMO-100. When the PTT switch is pressed, data communication is interrupted, allowing only voice communication during this temporary period. If a gap in speech communication from either side exists for 10 seconds, voice communication mode is terminated and data communication restored automatically. The voice transceiver is connected via an RJ-45 connector on the lower part of the unit. The pins are assigned as follows: 12345678 Pin Pin out Voice-Interface 1 GND 2 Microphone + 3 PTT Switch 4 Speaker + 5 Speaker - 6 NC 7 Microphone - 8 (Alarm Button, optional)
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 26 of 112 2.2.6 Extension Port for additional I/O modules (only devices with embedded I/O) The I/O expansion connector is located at the upper right part of the TMO-100 of all TMO versions with embedded I/O. The connector is grey and has the same color as the expansion port modules connector. The TMO-100 w/o embedded I/O will be equipped with the same connector (but marked with RED color) for connecting the Speaker/Microphone Handset. Up to 16 expansion modules can be connected to the TMO to enlarge the numbers of inputs and outputs. The access to all I/O can be performed by using the Modbus RTU or Modbus TCP protocol. The following I/O modules are available: PEM-16DI 16 digital inputs PEM-32DI 32 digital inputs PEM-16DO 16 digital outputs PEM-32DO 32 digital outputs PEM-16DIO 16 digital inputs and 16 digital outputs PEM-08AI 8 analog inputs (0-20mA 4-20mA) PEM-04AO 4 analog outputs (0-20mA 4-20mA) I/O modules should only be connected to or disconnected from the TMO-100 when power supply is disconnected!
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 27 of 112 2.2.7 Connecting the I/O (TMO-100/DAx types only) Binary inputs: The binary inputs are divided into two groups per port. Each group contains 4 inputs with one common terminal. The inputs are bipolar, so they can be switched with an active "+" or active "-" signal. If the "C" terminal is connected to the ground, the inputs will be active if the positive voltage (12-14V) applies. If the "C" terminal is connected to the positive voltage, the inputs are activated by applying the ground connection. Please note that the input voltage should not exceed 24V +20%! Binary outputs: The supply voltage for the binary outputs must be connected to the "+" and "-" terminal of port C. Active outputs will have the positive supply switched to the related terminal. The maximum load is 0.5A per outputs.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 28 of 112 Analog inputs: The analog inputs needs to be in the current loop, the power supply must be provided externally in the loop. The input range is 0-20mA with a resolution of 12 bit. Note: All I/O are electrically isolated!
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 29 of 112 2.2.8 Connecting the Antenna A BNC socket is provided for connecting the antenna. Ensure that the antenna is selected correctly for the operating radio frequency. The antenna cable (50 ohm) should not be longer than 5 meters, and should be good quality low-loss type (RG-213 or Aircell). Overvoltage protection suitable for protecting the modem is available. This should be attached to the modem using a feed through bush (see diagram). Ensure that the modem's grounding point, antenna input lightning protection, and the antenna system are connected to a common grounding point.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 30 of 112 2.3 LED Functions Groups of LED lamps on the front panel of the TMO-100 indicate the operating condition of the modem, the field strength of the received TETRA radio signal, and error conditions if any. Specific LED functions are described below. RFBDAC08012300 1911 21022 31133 41244 51355 61466 71577CCOut CC+++++-----012301234567CC0819210311412513614In InIn In715CCRadi oRx Rx RxTx Tx Tx OK PwrEth /Aux SystemComF1 F2 F4F3 Configuration: Ethernet, two serial interfaces, and audio and integrated I/O board.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 31 of 112 LED Function System Pwr Power supply input System OK Indicates the "Ready" status of the modem (continuously lit). Also indicates error conditions (coded blink sequences). COM Tx Lights up while the TMO-100 sends data via the COM interface COM Rx Lights up while the TMO-100 receives data via the COM interface AUX Tx Lights up while the TMO-100 sends data via the AUC interface AUX Tx Lights up while the TMO-100 receives data via the AUX interface Radio Tx Blinks while data is being sent in SDS mode. Continuously lit while packet data communication is in progress. In this case, the LED is shortly switched off when data is being transmitted over this connection. Radio Rx Blinks while data is being received in SDS mode. Continuously lit while packet data communication is in progress. In this case, the LED is shortly switched off while data is being received over this connection. RF These eight Led indicate the field strength of the received radio signal. More Led’s lit means stronger radio signal, fewer Led’s lit means weaker radio signal. If none of these 8 Led’s are lit, it means that the modem is not attached to a TETRA network. When the modem is switched on its initialization sequence is indicated by Led’s lighting up momentarily in sequence from right to left. During a voice call this LED bar flashes as follows:  Continuous flashing: No Voice call established  2 x blinking – pause: Voice call is being established  Fast blinking: Voice call is active, the user can talk  Slow blinking: Voice call is active, the user can listen  Continuous flashing: The voice call is being disconnected PPP Data This LED lights up when data is being transmitted or receive over the PPP link PPP Link (blue)  Fast flashing: Packet-Data connection is being set up  Continuous lit: Packet-Data connection is established  Slow flashing: Packet-Data has been disconnected temporary due to a requested voice call. After finishing the voice call, the PPP will be re established automatically by the TMO-100 IP Rx Indicates, when data is being received over the local Ethernet port IP Tx Indicates, when data is being transmitted to the local Ethernet port
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 32 of 112 2.3.1 OK LED: Blink Pattern Error Indication When the TMO-100 is powered up, the OK LED should be constantly “on” to indicate the proper device operation. If this LED is flashing or off, it indicates an exception. Different “blinking codes” can indicate different problems as shown in the table below: Blink Pattern Meaning LED off Controller (CPU sub-module) fault or the modem is not in "Ready" state. Continuously lit Device in "Ready" state, no fault/error conditions Slow blinking, 1:1 tempo The device is in programming mode. 4 blinks, then pause The internal TETRA Device does not respond 5 blinks, then pause The programmed TETRA frequency does not fit to the TETRA Modem frequency range 2.3.2 Start Up Indication using the RF-LED Chain After connecting the power to the TMO-100, the start up sequence is indicated using the RF-LED’s chain. An LED dot will step from right to left indicating: LED-Position Indication 7 TETRA -Modem is not or not yet powered up 6 TETRA Modem has been powered up and (re)starts 5 Initializing the TETRA Modem 4 TETRA Modem configured properly 3 Reading the TETRA parameter from the Modem 2 Updating MCC, MNC and ISSI 1 Updating scan range and scan frequency 0 Group assignment is being updated Once all parameters are set (LED 2 or below), the embedded TETRA device is restarted again. Also the start up procedure (including the LED indication) runs through a second time.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 33 of 112 2.4 Reset to factory default The TMO-100 can be reset to the factory default configuration. Also the Ethernet parameter can be reset independently, if the IP address is not known any more. 2.4.1 General Reset of the Device to Factory Default Using the following procedure, the TMO will be reset to factory default. All parameter will be cleared; the IP address will be set to 192.168.0.199.  Disconnect the device from power supply  Set DIP-switch 10,9,6,5 and 1 to "on" all other to “off”  Apply power to the device  If the LEDs in the RF-display step from left to right (single LED), set DIP 10 to „off“  Now two pairs of 4 LED each flash indicating that the unit is resetting. Now wait until the device reset is ready, and the unit will restart again.  After the restart, all DIP-switches should be reset to „off“
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 34 of 112 2.4.2 Resetting the Ethernet Parameter Using the following procedure, the Ethernet parameter of the TMO will be reset to factory default and the IP address will be set to 192.168.0.199, subnet mask 255.255.255.0. All other parameter will be unaltered.  Disconnect the device from power supply  Set all DIP-switches to “on”  Apply power to the device  If the LEDs in the RF-display step from left to right (single LED), set DIP 10 to „off“  Now two pairs of 4 LED each flash indicating that the unit is resetting. Now wait until the device reset is ready, and the unit will restart again.  After the restart, all DIP-switches should be reset to „off“ If you set all DIP switches to "On" during operation, the IP address of the TMO-100 is changed to 192.168.0.199 "on the fly". This IP address is valid as long as all DIP switches are set to "on". The webserver can now be accessed on this IP address. The originally configured IP address is maintained in the configuration and can be viewed / changed on the page "Ethernet  Network".
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 35 of 112 2.5 Configuration of the TMO using the embedded web server The TMO can easily be configured using the embedded web server. Connect the device to your Laptop / PC using a standard Ethernet cable. Then start your web browser (all our tests have been successfully made using the Firefox browser) Enter the IP address 192.168.0.199 into the input box of your browser (that is the default IP address of the TMO). The following screen will then be displayed: The login will be done using the default username and password (take care, as both are case sensitive): Username: “user” Password: “user“ These passwords can be changed any time using the menu “Service / Manage Passwords”. After a successful login, the configuration menu of the TMO will be displayed. On the left part of the screen the menu is listed, on the right part the parameters can be changed. A separate footer displays the most important device parameters. Please note that the menu and footer line are only loaded once at the beginning from the device to reduce traffic load. On demand the Menu and Footer Line can be reloaded.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 36 of 112 2.5.1 Navigation using the Menu To select a menu, move the cursor over the desired headword and click it. Then the menu will open displaying the next options
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 37 of 112 2.5.2 Requesting Restart of the Device Some configuration changes (change of Ethernet or TETRA parameter) need a restart of the device before they will take effect. If the user has made these changes, an orange button with the text “Restart Device” is displayed. The button has not to be pressed until all changes have been made, even if it is necessary to change to another menu page.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 38 of 112 3 Data Communication over TETRA Networks The TMO-100 can transfer data between any of its wired data interfaces (serial and Ethernet ports) on one side, and the TETRA radio network on the other. The TMO-100 can handle any of the common industrial automation and instrumentation protocols (MODBUS, MODBUS/TIP, IEC-60870-5-101, IEC-60870-5-104, PakBus, ROC, BSAP DNP3 etc.…), custom protocols, and configuration data. Data communication is possible in any of three modes (of which two are supported presently): SDS based data transfer: With SDS based data communication, the TMO-100 can transfer data in serial data packets of up to 1000 bytes each. The packets are broken down if necessary (transparent to the user) into smaller SDS data blocks. Serial data communication protocols such as MODBUS, DNP3 or IEC-60870-5-101 are smart routed to the slave modems. To do this, the TMO-100 extracts the logical addresses, looks up a routing table, and sends the data onward to the slave/receiving station modem with corresponding ISSI address. The maximum length of an SDS data block is configurable up to 255 characters. Restriction of SDS data block length is necessary because not all TETRA infrastructures support the full length of 2047 bit. If the data block to be transferred is longer than the maximum SDS length supported form the TETRA infrastructure, it is split into several SDS data blocks by the transmitting TMO-100 and automatically re-assembled by the receiving TMO-100. Setting the SDS parameter SDS based data transfer is possible only through the serial interfaces (COM or AUX) of the TMO-100 modems. Data received from a specific (preconfigured) transmitting ISSI address can be directed to the secondary serial interface (AUX) instead of the primary interface (COM). This is useful, for example, where process data must be directed to the primary serial interface, and configuration data to the secondary serial interface.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 39 of 112 Packet-data based data transfer (option): IP packets can be transferred if the TETRA infrastructure supports the packet data transfer mode. In this case data communication with terminal equipment connected to the TMO-100 is via the Ethernet interface of the TMO-100. Here the TMO-100 functions as router. Up to 16 IP port addresses can be stored in the Port Forwarding Table of the TMO-100. Data packets arriving over the TETRA network are automatically routed to the designated IP ports. For the reverse route a NAT function provides the correct address for routing return data to the sending station. Several terminal devices can be connected to the Ethernet interface of the TMO-100 via a network switch, and addressed by any station on the same TETRA network. Circuit switched data: Line based data communication (CSD) is not supported by all TETRA infrastructures, and is not at this time supported by the TMO-100.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 40 of 112 3.1 Data Communication by SDS Data communication by SDS does not necessarily require an IP switch within the TETRA network: therefore it is compatible even with smaller installations. SDS Data communication takes place only through the Control Channel (MCCH). Therefore no additional timeslots or RF-Carriers are required for data communication. The use of a Secondary Control Channel (SCCH) is supported by TMO-100. The TMO-100 supports a maximum SDS length of 2047 bits (254 bytes) in accordance with the ETSI specification. However, since not all TETRA infrastructures support this length, users can set a lower maximum length for SDS data blocks. If the data block to be transferred is longer than the maximum SDS length, it is split into several SDS data blocks by the transmitting TMO-100 and automatically re-assembled by the receiving TMO-100. This fragmentation/de fragmentation of data blocks is transparent to the terminal equipment connected to the TMO-100 at either end, and makes the TMO-100 compatible even with older TETRA networks. In this respect, radio data communication through TMO-100 modems behaves like wire communication, with minimum transmission delay. If a TMO-100 receiving data detects a checksum error, the entire data block is discarded. SDS data communication supports data communication only via the serial interfaces: RS-232 or RS-422/485. Transfer and routing of IP packets is not possible. In the SDS mode of operation, the Ethernet interface can be used for configuration of the modem by MODBUS/TCP or Web server. The serial interface settings of TMO-100 modems on the same TETRA network do not have to be the same. Therefore it is no problem if the master modem is set for 38400 bps, 8N1, - while the slave is set for 9600 bps, 8E1. For performance-critical applications the serial interface should be set for the highest possible baud rate compatible with the terminal equipment, as this naturally minimizes data communication delay time.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 41 of 112 3.1.1 Use of the TMO-100 as master modem A Routing Table must be loaded into the TMO-100 when it is designated as a master modem. Up to 1280 ISSI addresses can be registered. Each of the ISSI addresses In the Routing Table is assigned to a logical address in sequential order, corresponding to the addresses used by the serial data communication protocol. The Routing table can be set up using the embedded Web-Server or by Modbus RTU protocol. The TMO-100 is configured (user setting) for the specific serial data communication protocol to be used. Any of the commonly used protocols can be selected, e.g., MODBUS, IEC-60870 or DNP3. Customized (non-standard) protocols may also be used because the position of the address byte and its length (1 or 2 bytes) are also user-programmable. Protocol Configuration
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 42 of 112 When a data block is received at the serial interface of the TMO-100, it waits for the complete data block to be received. The data block end criterion is that no further data byte is received after a lapse of a user-programmed time (default: 10 milliseconds). The protocol-dependent logical address of the destination terminal equipment is extracted from the data received via the serial interface. Using this, the ISSI address of the target modem is looked up from the Routing Table, added to the data block, and transmitted over the TETRA network. If a broadcast address is reserved in the serial data communication protocol (e.g., MODBUS-RTU), a corresponding GISSI (Group ISSI address) included in the Routing Table. Therefore broadcast can be supported, whereby a data block can be sent simultaneously to several modems on the same TETRA network. If multiple-address routing is not possible or desired, then the TMO-100 can be configured to use a single ISSI, to which all transmitted data is addressed. The slave modems would be part of a group: all modems of this group receive the same data. Each terminal equipment connected to the save modems is then responsible for determining whether a data block is intended for it or not. It should be noted that when SDS is broadcast to a group, the SDS is sent from all base stations on the same TETRA network. This obviously generates a higher network load because when transmitting to an individual ISSI, the base station sends the SDS intended only for the specific base station to which the target terminal equipment is connected.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 43 of 112 3.1.2 Using the TMO-100 as Slave Modem A TMO-100 used as slave modem need not be configured for handling a specific serial data communication protocol. Basically, the modem passes on each data record that it receives from a master modem out through its serial interface. When this happens, it tags the ISSI of the master modem from which data is received, so that when it gets a response to this data record from its local terminal equipment, it sends that response data back to the ISSI of the master modem. Because of this procedure, a slave modem can receive data from several master modems provided that such communications from multiple masters does not occur at the same time. The return address refers the slave modem to the data record of the master modem. The response data record from the local terminal equipment is always sent back to the ISSI of the master modem from which the last communication was received. Alternatively, the ISSI of a specific master modem can be set in the slave modem, so that all data received from local terminal equipment is sent only to this ISSI. 3.1.2.1 Routing SDS Data to the Primary (COM) or Secondary (AUX) Interface The TMO-100 is equipped with two serial ports, “COM” and “AUX”. For each of these ports, a destination port can be configured and so it can be determined whether the data is feed from the source COM or AUX to the destination COM or AUX If the COM routing is set to AUX, data received at the COM port will be sent to the AUX port of the destination device. Also if the AUX routing is set to COM, data received at the AUX port will be sent to the COM port of the destination device. As factory default, COM is routed to COM and AUX is routed to AUX. This feature of using two different serial ports at the same time provides the ability to use one port for data communication and the second port for configuration or for a second protocol if different devices (PLC and Meter or Filed bus device) are connected to the Outstation. Another application can use two different ports of the same device from different master units placed also on different location. The AUX interface is restricted, as it cannot be used for RS-422, only RS-232 or RS-485.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 44 of 112 3.1.3 Data Compression using the LZ77 algorithm The TMO-100 has data compression capability and all data records received over the serial interface are compressed before sending as SDS. At the receiving station, the data is decompressed before moving it out. Detailed information regarding the LZ77 can be found at: http://de.wikipedia.org/wiki/LZ77 Data compression can improve performance when large data blocks are involved, by reducing the data that is conveyed over the TETRA network, even if additional SDS blocks are created (in cases where the original data block does not fit within an SDS). If using the TMO-100 in conjunction with TRM-, RTU-, or MDP-Type TETRA units, (these ones do not have the compression feature) compression can be disabled. Enabling the Data Compression feature
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 45 of 112 3.2 Sending and receiving SDS- and Status Messages using the Hash (#) Command Sequence SDS- and Status messages can be sent over the TMO-100s serial ports using the #-command (Hash Command) The idea behind the #-commands is to have a simple method of sending and receiving SDS and Status messages for machine to machine, for human to machine or for human to Voice-Terminal applications. The Hash-Command is defined as a header control sequence within two #-characters, followed by a SDS or status information in the following way: # Control+SSI # Text, Data or Status Control character ISSI / GSSI Text or Status Remark T Yes Text Sends a Text SDS S Yes Numeric Status: 0-65535 Sends a Status Message D Yes Text or Data Sends Text or Data including specific header information C Yes/No MMI Command Sends a MMI command to a different TMO-100 or to the own device Rules: The transmitting TMO serial interface (COM or AUX) has to be in Hash Command Mode The first character inside the # signs is the control character T, S or D Followed by an ISSI or GSSI The characters outside the # signs are: Text Information, Data or Status Information On manual (human) input: Choose the CR LF on "COM Port Serial Parameter Settings" and use a terminal software (e.g. HyperTerminal on your computer) On PLC or PC communication: Choose Timeout or 3964R (CR LF will work also)
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 46 of 112 The following example will explain what happens on the receiver side, if the following #-commands will be sent to a TMO-100 with an ISSI=4711 that is configured for #-command mode: Example 1: #T12345#This is a test message Will be stored as an SDS in a TETRA Terminal with the ISSI (GSSI) 12345 as: This is a test message Will be sent out on the TMO-100s (ISSI: 12345) serial port that is configured for #-commands as: #T4711# This is a test message Remark: 4711 is the sender ISSI Example 2: #S12345#52000 Will be sent as a status message to a TETRA Terminal with the ISSI (GSSI) 12345 Will be sent out on the TMO-100s (ISSI: 12345) serial port that is configured for #-commands as: #S4711# 52000 Remark: 4711 is the sender ISSI Example 3: #D12345# This is a test message Can not be displayed correctly on a TETRA Terminal with the ISSI (GSSI) 12345 Will be sent out on the TMO-100s (ISSI: 12345) serial port that is configured as slave as: This is a test message Remark: No sender ISSI will be included in the output
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 47 of 112 3.3 Processing MMI Commands sent by a TMO-100, Terminal, Mobile or Dispatcher The TMO-100 can process so called "MMI commands" (Man Machine Interface) which were sent from another device in the TETRA network. The MMI command is basically a text SDS, which can be sent out by another TMO-100, a handheld terminal, a mobile or a dispatcher. With these MMI commands, outputs can be set or reset or input values, RF field strength or other values can be queried. The access is protected by a 4 digit PIN, which must be included in every MMI message to the device. If the PIN does not match, the MMI command SDS will be discarded and no commands will be processed. By default this PIN is set to 4711, it can be changed using the webserver configuration menu "TETRA -> SDS/Status/MMI": Within one MMI command message, several MMI commands can be submitted. The commands must be separated by a comma "," or a dash "-" in this case. If the MMI string contains an error, the faulty part will be sent back with 2 additional "?" signs added: #M#1-4711-T2=1234 #M#2-0000-T2=1234?? All commands, which appeared before this faulty part were executed, commands after the error were not processed!
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 48 of 112 3.3.1 Submitting MMI commands using a TMO-100 A TMO-100 is able to directly send MMI command strings to any other TMO-100, using a serial port in "#-command mode". It can even process MMI commands to itself. As MMI commands to other devices were sent by SDS, the processing of incoming SDS MMI commands must be enabled in the configuration (TETRA -> SDS/Status/MMI) of the remote devices. If the MMI is sent to the same device, they will be processed and answered locally. To use or transmit the MMI commands, the assigned serial port must be set to the operation mode "'#'-command port". To use or transmit MMI command with a TMO-100, they always use the format: # C issi # 1-4711-Commands The commands are sent out to a device or group "ssi" and they are processed by all devices, which received the SDS, matching the PIN code. It must be noticed that a MMI SDS to a group may cause lots of response SDS by the devices in the group. Answers will be put out in the format #C issi # 2-0000-Answer to the same serial port. The white spaces in the text strings here are only used in the documentation to make it clearer, they should not be used in the real MMI commands! Example: To query the RF field strength and the serial number of a device, the command string #C1234#1-4711-RF=?-SN=? has to be sent to the serial port. The answer from the remote machine will be like this: #C1234#2-0000-RF=-87dBm-SN=2000
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 49 of 112 If the SSI matches the ISSI of the own, local device, or if the SSI is left away, the MMI will be processed locally. Example: The own TMO-100 has the ISSI 2345. The MMI command #C2345#1-4711-RF=? will return the own RF field strength of the local TMO-100 we are connected to: #C2345#2-0000-RF=-87dBm Alternatively the MMI command can be like: #C#1-4711-RF=-87dBm which will also cause the locally processed answer: #C#2-0000-RF=-87dBm
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 50 of 112 3.3.2 Sending MMI commands by a TETRA terminal or dispatcher MMI commands can also be sent to the TMO-100 using a terminal, mobile or dispatcher. The command should be sent as a normal type 4 text-SDS (simple messaging or TL-4). The command string "#M#" must be set as a prefix, the required format should be like: #M#1-4711-Commands As described before, "4711" is the PIN to access the TMO-100, which can be changed in the device configuration "TETRA -> SDS/Status/MMI". In addition to this, the MMI access by SDS must be enabled in the same configuration area to allow the processing of the MMI SDS. Example: The MMI command string #M#1-4711-C0=1,Z=1,RF=? sent by a terminal to the TMO-100 will cause the following actions:  The binary output "C0" will be set to on  The response will include the timestamp of the TMO-100  The RF field strength will be returned The answer sent back to the terminal will be like this: #M#2-0000-110210151027-RF=-65dBm Important notice: In default state the "t-timeout" in the TMO-100 is activated, which will cause all outputs will be reset after the given time if the TMO-100 is not accessed by MMI commands or MODBUS telegrams. If the TMO-100 should be used only for MMI processing, the t-timeout should be disabled in the configuration (RTU features -> Setup)!
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 51 of 112 3.3.3 List of MMI commands Description: Query of internal digital inputs Command: A0=? .... A7=? .... B8=? .... B15=? Answer: A0=1 ... A7=0 .... B8=1 ... B15=0 Comment: A "1" means that the corresponding input is active, a "0" means that it is inactive. Description: Query of all internal digital inputs Command: AB=? Answer: A=B3;B=01 Comment: The values of the digital input ports will be returned in hexadecimal values. Description: Query of any digital inputs Command: DIxx=? Answer: DIxx=0 oder DIxx=1 Comment: Queries the state of a digital input, where the input can also be located at a PEM extension module connected to the TMO. The first digital input on the system starts with index "0". The answer returns an active input with "1", an inactive input with "0". Description: Switching of an internal digital Output Command: C0=1-C5=0-D15=1 Answer: No answer Comment: In this example the output C0 will be set active, C5 will be set inactive and D15 will be set active. The outputs D8-D15 are only available at the device type "/DA3". Description: Query of internal digital outputs Command: C4=?-C0=? Answer: C4=1-C0=0 Comment: A "1" means that the corresponding input is active, a "0" means that it is inactive. Description: Query of all internal digital outputs Command: CD=? Answer: C=80;D=00 oder C=80;D=nn Comment: The values of the digital input ports will be returned in hexadecimal values. On other devices than "/DA3" the value for port D will be returned as "nn".
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 52 of 112 Description: Query of any digital inputs Command: DOxx=? Answer: DOxx=0 oder DOxx=1 Comment: Queries the state of a digital output, where the output can also be located at a PEM extension module connected to the TMO. The first digital output on the system starts with index "0". The answer returns an active output with "1", an inactive output with "0". Description: Switching of an any digital Output Command: DOxx=1 order DOxx=0 Answer: Keine Antwort Comment: Switches the state of a digital output, where the output can also be located at a PEM extension module connected to the TMO. The first digital output on the system starts with index "0". The parameter "1" sets the output to active state; the parameter "0" switches it to inactive state. Description: Query of an internal analog input (TMO-100/DA1) Command: Dx=? oder Dx%=? x=0..3 Answer: Dx=1000 oder Dx=24% Comment: The query "Dx=?" returns the raw value of the 12 bit analog input in the range from 0 to 4095. The query "Dx%=?" returns the percentage value in the range from 0 to 100%. On devices with no internal analog inputs an error message will be sent back.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 53 of 112 Description: Query of any internal analog inputs Command: AIxx=? oder AIxx%=? Answer: AIx=1000 oder AIx=24% Comment: Queries the state of an analog input, where the input can also be located at a PEM extension module connected to the TMO. The first analog input on the system starts with index "0". The query "Dx=?" returns the raw value of the 12 bit analog input in the range from 0 to 4095. The query "Dx%=?" returns the percentage value in the range from 0 to 100%. On devices with no internal analog inputs an error message will be sent back. Description: Query of the RF field strength Command: RF=? Answer: RF=-xxdBm Comment: Returns the actual RF field strength of the TETRA network in –dBm Description: Query of the serial number Command: SN=? Answer: SN=1234 Comment: Returns the serial number of the device Description: Receipt request Command: Q=1 Answer: Answer from the TMO-100 Comment: If "Q=1" is included in the command data to the TMO-100, an answer SDS will be sent back to the originator – even if no command would not send back any answer. Description: Receipt suppression Command: Q=0 Answer: No answer from the TMO-100 Comment: If "Q=1" is included in the command data to the TMO-100, no answer SDS will be sent back to the originator – even if a command would send back an answer. Description: Time stamp Command: Z=1 Answer: Z=YYMMDDhhmmss Comment: If "Z=1" is included in the command data to the TMO-100, a timestamp will be included in the answer.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 54 of 112 Description: Read register Command: R0001=? Answer: R0001=4F7D Comment: Any register of the TMO-100, which is enabled for being read out can be queried with this command. Forbidden registers will always return 0000. The register address is given in decimal format, the register value is always returned in hexadecimal format. Description: Write register Command: R0001=0001 Answer: No answer Comment: Any register of the TMO-100, which is enabled for being written can be set with this command. The register address is given in decimal format; the register value must always be in hexadecimal format.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 55 of 112 3.4 Packet Data (IP) Communication Packet data (PD) communication essentially differs from SDS data communication in that the TETRA infrastructure must support the use of packet data. The ISSIs of the modems must be enabled for packet data communication. Data communication takes place not through the Control Channel (as in the case of SDS data communication) but through normal traffic channels. Thus an active PD connection over which data is to be transferred, affects the availability of the voice channels: this must be taken into account at the time of network planning. By supporting Multi-Slot Packet Data (MPSD), network data throughput can be increased, as several slots can be combined for data transmission. This results in higher information flow-rate than SDS based data or Single-Slot Packet Data transmission. The main advantage of packet-data based communication in TETRA infrastructures is that it supports protocols using IP data packets. After powered on, the TMO-100 auto-matically establishes a PPP link to the TETRA infrastructure. If the ISSI has been enabled for PD communication, the TETRA infrastructure will assign a corresponding IP address to the Modem. The TMO-100 is thereafter is IP accessible within the TETRA network. Terminal equipment locally connected to the TMO-100 via its Ethernet interface can then be addressed through its router function. The TMO-100 acts as an intermediary between its Ethernet interface and the TETRA network, so to speak. Enabling the Packet Data Option 3.4.1 IP Assignment in the TETRA Network The TMO-100 is assigned an IP address when it establishes connection with the TETRA infrastructure. This IP address is a part of the network administration set-up, and is not a configuration parameter of the TMO-100. Care should be taken if dynamic IP-addresses are assigned from the TETRA infrastructure to the TMO-100, because once the device will be turned off and on again, it may be possible that it receives a different IP-address. In that case a unique correlation of the device is not possible.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 56 of 112 3.4.2 IP Assignment for the Ethernet Interface The IP address of the Ethernet interface of the TMO-100 is preconfigured before delivery as 192.168.0.199 with the net mask 255.255.255.0. These settings can be changed by the users whenever necessary. All local terminal devices that are to transfer data over the TETRA network using the TMO-100 as router must operate within the same IP subnet, and the IP address of the TMO-100 must be declared in the IP configuration as the gateway for the connected local terminal equipment. All data packets from the local terminal equipment that are not addressed to an IP address in the same sub-net are passed through to the TETRA network as a result of the IP configuration. Application example:
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 57 of 112 3.4.3 Router Function of the TMO-100 The TMO-100 has separate IP addresses for the TETRA network and its Ethernet interface. The requirement here is to convert the IP addresses of the two networks so that local terminal equipment connected on local Ethernet of one TMO-100 can communicate with remote participants in the TETRA network, and vice versa. The task of the NAT-router is therefore to link the devices that are “hidden” behind the TETRA IP-Address, to services or protocols. 3.4.3.1 Port Forwarding Identification of the services and routing of the local terminal equipment (for which the IP addresses on the TETRA side are unambiguously defined) is determined through the port numbers. The Port Forwarding Table of the TMO-100 has a list of local Ethernet IP addresses and their corresponding port numbers. Data from the TETRA network addressed to a particular port number is forwarded to the target local terminal equipment by looking up its IP address corresponding against that port number. Port Forwarding Table
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 58 of 112 Example: The IP address 192.168.0.100 corresponds to a PLC connected to the Ethernet interface of the TMO-100. The default (factory configured) IP address of the Ethernet interface of the TMO-100 is 192.168.0.99. The TMO-100 has the IP address 10.0.66.17 on the TETRA network side. The PLC is addressed using the MODBUS/TCP protocol by its port number: Port 502. In the Port Forwarding Table of the TMO-100 the Port 502 has been assigned IP address 192.168.0.100 (factory configuration). With this configuration, all packets sent over the TETRA infrastructure to the IP address 10.0.66.17, Port 502, are redirected by the TMO-100 via its Ethernet interface to the PLC with the IP address 192.168.0.100. The following port forwarding settings are factory programmed (before delivery) in the TMO-100:  Port 502 TCP/UDP  192.168.0.100 (MODBUS-RTU)  Port 2404 TCP/UDP  192.168.0.101 (IEC-60870-5-104)  Port 20000 TCP/UDP  192.168.0.102 (DNP3) Therefore the local terminal equipment needs only to be configured with the appropriate IP address depending on the protocol used. The user can reconfigure the table as needed. If a port is forwarded here, it overrides an internal service of the TMO-100 for this port. If i.e. the webserver port 80 is forwarded to an external equipment, the internal webserver of the TMO-100 can't be accessed anymore over TETRA. A solution in this case would be to change the internal webserver port of the TMO-100 to another port which is not used by the forwarding (Device -> Access).
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 59 of 112 3.4.3.2 Global port forwarding (forward all) In very most cases only one single device is connected to a TMO-100 in the field. The easiest getting the data from the TETRA network to this single machine is to set a global forward. This setting can be found in Ethernet -> NAT: In a first step, the forward feature must be turned on. After clicking on "Apply", the Destination IP field becomes active and the destination IP for the forwarding can be entered. In this case, all incoming data from the TETRA network will be forwarded to the connected PLC on the Ethernet port, which has the IP address 192.168.0.100. No single port forwards needs to be configured in this case and there will be no hassle with "forgotten" forwards or additional ports which are dynamically assigned by the application protocol. Note that these internal ports used by the TMO-100 are excluded from the global port forwarding as they are used to access the TMO-100 itself over the TETRA network:  Port 80 (Webserver)  Port 69 (TFTP service)  Port 4502 (MODBUS access)  Port 4711 (Serial-over-IP service) The port 80, 69 or 4502 can be changed for the internal service of the TMO-100 in DeviceAccess in case that one of these ports is needed for the external connected equipment.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 60 of 112 3.4.3.3 NAT Function (Network Address Translation) In the same way that packets from received over the TETRA network must have the IP addresses changed by the TMO-100 before they can be forwarded to local terminal equipment connected to its Ethernet interface, this must also be done in the reverse direction. This is the case whenever local terminal equipment connected to the Ethernet interface of the TMO-100 sends data to an IP address over the TETRA network. This process needs no configuration: it is an automatic operation that is executed whenever a local terminal device sends data to an unknown IP address. The TMO-100 tags the local Ethernet address from which data is received and the unknown IP address to which it is to be sent (from which a response is expected). The expected response (of the remote device) received over the TETRA network will be passed on automatically to the correct IP address via the Ethernet interface. The NAT table can store up 32 entries. Entries that are not used for 60 seconds are purged.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 61 of 112 3.4.3.4 Keeping the Port Numbers when using the NAT function (KeepPort, from Firmware Version 1.10) Some protocols exchange information using specific port numbers. (e.g. Fieldbus Foundation HSE). As a standard NAT function will (could) alter the port information, these protocols could not be used. The TMO-100 can be configured to keep the same port number as transmitted from the source device. The following options are available:  Set the NAT-Function to standard operation. In this case the port numbers from the sender will (or can) be changed to a port number available from a port address pool (e.g. 40000) IP-Setting in the “Keep Port Option”: 0.0.0.0  If it is necessary to keep the same port address as transmitted from the sending device, this option can be chosen. Care should be taken that only one device attached to the TMO is using that specific port number. In case a second device would request a transmit using the same port address, the port number will be changed by the NAT-function and a port number out of the port number pool would be taken. IP-Setting in the “Keep Port Option”: 255.255.255.255  IP- und Net Mask Settings: The NAT Function will try to keep the port numbers for all devices that match to the IP address and the net mask that is configured in the Keep Prot Configuration table (see below) Configuration of the Keep Port Option
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 62 of 112 3.4.3.5 NAT - Port Number Translation Some protocols (e.g. HSE - Fieldbus Foundation) need to transmit special port number ranges between the Master- and Slave-Devices. In that case a classic router would translate the port numbers to the ones dedicated for the NAT function (40000 and up), and therefore the communication between master- and slave-device would fail. In contrast to that, the TMO-100 can be configured in various ways to support all communication methods used between master and slave devices. The following options are available:  The Source Port Numbers are translated as performed by a classic router  The Source Port Numbers will not be changed and forwarded straight. Care should be taken if this port already is in use. In that case the router will translate the Port Number to one available out of his NAT pool.  Only the Port Numbers of previously defined IP numbers or IP ranges will not be changed. Also here care should be taken if this port already is in use. In that case the router will translate the Port Number to one available out of his NAT pool.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 63 of 112 3.4.4 NAT - IP Address Screening In case the TMO-100 is connected via its Ethernet port to a LAN network, a PC or another device where a lot of IP traffic is expected, all IP packets the TMO-100 would receive that could not be delivered to one of the attached terminals would be transferred via the router to the TETRA network. As all this data rubbish would be transmitted via the PPP link to the TETRA switch, an overload of that link could be the result, causing the properly transmitted IP packets to fail or being delayed. Due to this reason, two screening functions can be activated in the TMO-100 witch prevent the transmission of unwanted data to the TETRA network:  The Source-Filter that defines a special source IP-address, address range or an IP-subnet for data that is permitted to pass the PPP link  The Destination-Filter that defines a special destination IP-address, address range or an IP-subnet for data that is permitted to pass the PPP link Once one or both of these filter function are enabled, only IP-packets that match the filter criteria are forwarded and fed to the TETRA network. It is strongly recommended to set this filter especially when operating with personal computers; a huge number of different IP-packets will be sent to the TMO-100 and (if no filter is set) forwarded to the TETRA infrastructure. Settings for the NAT-Filter
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 64 of 112 3.4.5 MTU (Maximum Transfer Unit) Size The TMO-100 supports a maximum packet size (MTU = maximum transfer unit) of 1500 bytes. This packet size is compatible with automation applications. If a received packet exceeds this length, or is fragmented, it is rejected. 3.4.6 Data Compression using Packet Data TMO-100 provides the function to receive data via its serial interface, convert it to IP-Data, send it via TETRA-PPP (Packet-Data) to a destination device, convert it back to serial data, and to pass it back to the serial interface. In this case the received serial data stream automatically is compressed by the LZ77 algorithm and decompressed on the receiver side. Routing from a serial interface to an Ethernet port or vice versa is not supported. 3.4.7 Transmission of Serial Data using Packet Data Mode When using the TMO-100 in Packet Data mode, serial data received on the COM or AUX interface will be sent as UDP-packets rather than sending them by SDS. The mechanisms used for that are the same as used when transmitting in SDS mode, except the routing table in the master unit contains IP-addresses instead of ISSI. Likewise in SDS mode, an outstation will store the IP number of received data and sends back any answer or any further data stream to this IP address.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 65 of 112 3.5 Special TETRA features 3.5.1 Prefer or avoid TETRA cells In some cases it's necessary to distribute the TMO-100 over a number of available TETRA cells or to "lock" the TMO-100 to a given TETRA cell. Each TETRA cell has a specific number, the "location area code" (LAC). The LAC is unique for each TETRA base station in a network and a cell can be identified by it. The TMO-100 prefers or avoid cells by this identification method. For this, the Black/Whitelist feature is used. The lists can be configured on "TETRA  Black/Whitelist". There are three different types of lists, each containing up to 10 entries.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 66 of 112 3.5.1.1 Priority cells list Each entry of the priority cells list has two fields to configure: The LAC for the TETRA cell and the minimum RSSI level. Any cell must be received with at least the defined RSSI level (or better) to be taken into account here. The list will be chosen from LAC 1 to LAC 10 with the highest priority on LAC entry 1. If the TMO-100 receives the specified cell with at least the configured RSSI level, it will register to this cell regardless if there are other cells with a better field strength. In this example, the TMO-100 will register to LAC 17 if this cell can be received with -80dBm or better. Even if LAC 15 is at -50dBm, it will stay on LAC 17. If LAC 17 is not available or below -80dBm, the TMO-100 will connect to LAC 21, if the field strength is at least -75dBm. If none of these cells is available with the minimum RSSI level, the TMO-100 will register to any other available cell.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 67 of 112 3.5.1.2 Cell Blacklist The Cell Blacklist can hold up to 10 entries where the LAC code of TETRA cells can be entered. The TMO-100 will not register to any cell included in the blacklist, as long as there are other cells it can connect to. In the configuration above the TMO-100 will never register to LAC 10, 11 or 12 – if there is any other cell it can register to. If the LAC 10, 11 or 12 are the only base stations where it can go, it will register to the best of these cells. As soon as another cell becomes available, the TMO-100 will change to this it it's not in the blacklist – even if the RSSI level is much worse.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 68 of 112 3.5.1.3 Forbidden Cells List The Forbidden Cells list is similar to the Cell Blacklist, but the difference is that the TMO-100 will never go to any of these cells. If the LAC 14 in this example is the only available cell, the TMO-100 will not register to the network and remains unregistered. Compared to the Cell Blacklist, where the TMO-100 will register to a cell on this list in case that there are no other cells available, it will definitely ignore the LAC's listed in the Forbidden Cells List – even if these are the only available cells.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 69 of 112 3.5.1.4 Dynamic Blacklisting for cells without Packet Data capability In some networks not all cells are capable of doing a packet data connection. These may be cells where only voice traffic channels are configured in the network management, or where the base station is unable to do packet data. Normally the TMO-100 will relocate to a cell with a better field strength if the cell where it's actually registered to drops below a certain reception level. Going to a cell which does not support packet data will cause an uncontrolled loss of a packet data connection. In a proper configured network, a cell, which is not supporting packet data, it will report this in the SYSINFO (the flag "Advanced Link" is not set). If the Parameter "Cell without PD blacklisting time" is set to a number of minutes, the TMO-100 will automatically blacklist a LAC where it registers to as soon as packet data is activated on this TMO-100 and it recognizes that the cell does not support packet data. The dynamic blacklisting will cause the TMO-100 to change away from this cell immediately after discovering this, looking for another cell in hope that is supports packet data. If the next cell does also not support it, it will be also blacklisted and the TMO-100 continues its search for a cell with packet data capabilities. The blacklisting for a given number of minutes will prevent the TMO-100 to go back to this cell during the given time. The TMO-100 can hold up to 10 dynamic blacklisted LAC's simultaneously. Important: If a TMO-100 is installed on a fixed location and there are known cells around which does not support packet data, it'll be good to enter these cells into the static blacklist. This avoids cell relocations to these cells and connection breaks right from the beginning!
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 70 of 112 3.6 IP Application Interface The IP Application Interface is an additional data interface which is very similar to the serial interfaces, but with IP as the communication method. It can be used to pass data, which are structurally protocols designed for serial interfaces, over an IP link. The important thing is that the TMO-100 is the endpoint for the IP communication, which makes it totally different from using the TMO-100 as a router for IP based applications. SCADA protocols which are designed as IP protocols uses different IP addresses to address each slave, therefore the TMO-100 must act as a router and the TETRA infrastructure must be capable of routing the IP data to its destination. For that reason the use of packet data is mandatory in this type of application. Using the IP application interface the IP connection ends at the TMO-100 and the payload data inside the IP packet is extracted by the TMO-100 and used for further routing, similar as using the serial interfaces. Because of this reason either SDS based transfer or packet data based transfer can be chosen as transmission method in the TETRA network. All IP data must be addressed to the TMO-100 as the IP connection is just locally. To route the data to different destinations in the TETRA network, the known mechanism of address detection and the use of the routing tables can be applied to the data which was sent inside the IP packet. To make it even easier to understand: The IP application interface works exactly like the two serial interfaces with the difference that the "physical" connection is not a simple wire but an IP connection.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 71 of 112 3.6.1 Operating modes The operating modes available for the IP Application Interface are exactly the same as for the serial ports, they are not described here again in detail: An important information is that the "Destination port at target device" can be also set to any serial port on the device receiving the data over the TETRA network. With this flexibility the interface can i.e. be configured that the link to the master modem is the IP Application Interface, but the data will be put out in the field on any serial port.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 72 of 112 3.6.2 Address detection and routing As on the serial interfaces, also on the IP Application Interface the TMO-100 can extract address bytes which are inside the data payload received on the interface. This may be common and known serial SCADA protocols which are embedded in the IP packet to the TMO-100, but also customer specific data containing an address information. The extracted address is used as an index to one of the two routing tables, determining the TETRA ISSI or TETRA IP address of the TMO-100 in the field, where the data should be sent to.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 73 of 112 3.6.3 Configuring the IP link The IP Application Interface can be configured to act in these three modes: 3.6.3.1 UDP operation Configured for UDP operation, the TMO-100 will accept data sent by UDP to the port specified as "Listening port" (in this example port 5000). If no IP/Port is specified for a "receiver device", the TMO-100 will learn the source IP and port of the last packet which was sent to it and send any received data for the IP Application Interface back to it. If an IP/port is configured here, received data from the TETRA side will always be sent to this destination. 3.6.3.2 TCP server operation Configured as a TCP server the TMO-100 is waiting for an incoming TCP connection on the port configured as "Listening port". Once one device has established a TCP connection to this port data can be sent and received on this connection.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 74 of 112 3.6.3.3 TCP client operation Configured as TCP client the TMO-100 will periodically try to establish a TCP connection to the server specified as "Receiver device". IP address and port number must be specified in this case. Once the TMO-100 could establish the TCP connection it can be used to send and receive data. 3.6.4 IP link status information On top of the configuration page the status of the connection can be seen: In TCP modes, the status is "CONNECTED" once a TCP link to the external equipment has been established. In UDP mode the status is always "CONNECTED" as UDP is a connectionless protocol. In this case the IP address given in this line is the IP address of the external equipment which has sent the last data to the TMO-100. If no data transfer has happened, the IP is shown as "0.0.0.0".
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 75 of 112 4 Protocols 4.1 Layer one Protocols between TMO-100 and the external device, connected via serial interface 4.1.1 Timeout Protocol Using the “Timeout Protocol”, the TMO-100 will accept any data received via its serial interface(s) accepting the whole character range from hex 00 to hex FF. The “Data End” criteria in that case are just the facts, that there is no more data received over a predefined period of time. (Factory default is set to 10 ms for 9600 bps. That reflects 10 characters in sequence). Basically if used other baud rates, a timeout period of 10 character-times is suggested. Using the COM interface, a timeout period between 3-1000 ms, using the AUX interface 10-1000 ms is programmable. 4.1.2 3964R Protocol The 3964R often is used in the „Siemens World“, connecting PLC’s to PLS’s or PLS’s to SCADA systems. That “Layer One” protocol is fully supported by the TMO-100. If possible, the priority settings of the device connected to the TMO-100 should be set to “low priority”. Character delay and handshaking can be set up using the TMO’s embedded Web Server Settings for the Serial Port(s)
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 76 of 112 4.2 Serial Protocols (RS-232 or RS-485/RS-422) When setting the TMO as a master unit, it is useful to know what communication protocol is used. Regarding that, the TMO-100 knows, where inside the data stream the address byte(s) is (are) located. With that knowledge, the TMO extracts this “logical address byte” and using the predefined address translation (or routing) table, it can convert the protocol address into the destination ISSI of the TETRA target device. Using that technology, in comparison to GISSI (group transmission) the load of the TETRA network can be reduced enormously. The outstation devices do not need any routing or address translation table. As these units usually are used as “polled devices”, they just answer to the polling request ISSI. The following protocols are supported by the TMO-100.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 77 of 112 4.2.1 Modbus RTU As the Modbus RTU protocol can be used either for internal device access or for communication with an external device, care should be taken when sharing out the Modbus addresses. Under no circumstances, an external device should have the same Modbus address as the TMO-100. 4.2.2 ROC protocol The ROC protocol has the same basic data structure for the address byte location and data packet detection than MODBUS, so MODBUS and ROC protocol shares the same protocol setting in the configuration. 4.2.3 DNP3 Using the Link Address out of the DNP3 protocol, the routing to the outstation can be calculated. In case of transmitting multiple DMP3-Data Segments while the timeout period is not considered, each data segment will be transmitted individually. Outstations can send data at any time to the master device (unsolicited messaging) Serial DNP3 was tested with the TMO-100 simultaneously with the HART protocol. The DNP3 was communicating over the COM port while HART was transferred via AUX. In that application the TMO-100G Serial-to-TETRA Gateway was used with an ETELM switch and Infrastructure. 4.2.4 IEC 60870-5-101 The routing for this protocol is similar to the DMP3. Also in this case it may be that multiple data segments are sent, to complete one message. 4.2.5 PakBus Pak bus is a rather unknown protocol, but it is fully supported by the TMO-100. 4.2.6 BSAP The TGW-100 detects the difference between the normal and the extended messages in BSAP protocol and extracts the address information accordingly. The node address contains 7 bit, so the address range, which can be used for routing here is 0-127. As any device can also act itself as a router, you may enable a master-to-master communication for the used serial port. Any node can then itself contain a routing table for a retransmission of information to other nodes (which is not possible when acting in slave mode)
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 78 of 112 4.2.7 User-Protocol Using user-defined protocols, the exact position of the address bytes and the address length can be pre defined. If these parameters are unknown, the “Transparent Data Communication” can be used (see below). 4.2.8 Transparent Data Communication without Protocol Filter (User Defined) Protocols, where the address byte cannot be extracted, or where the „Address Range“ exceeds the TMO-100 storage spectrum, (1024 entries, e.g.: sometimes that can happen using the HART protocol) can be transmitted using the Group ISSI or a fixed, prede-fined ISSI. Care should be taken when using the GISSI communication, as this method increases the over all load of TETRA networks. In case the ISSI parameter is set to not equal zero for COM or AUX, all data will be transmitted to that particular ISSI. In this particular case, the routing is ignored 4.2.9 Hart-Protocol Serial HART was tested with the TMO-100 simultaneously with the DNP3 protocol. The DNP3 was communicating over the COM port while HART was transferred data via AUX. In that application the TMO-100G Serial-to-TETRA Gateway was used with an ETELM switch and Infrastructure.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 79 of 112 4.3 IP based Communication Protocols 4.3.1 Modbus/IP Supported by the TMO-100 and tested in applications 4.3.2 DNP3/IP Supported by the TMO-100 and tested in applications where the HSE protocol was used simultaneously 4.3.3 IEC 60870-5-104 Supported by the TMO-100 and tested 4.3.4 HSE-Field bus Foundation Supported by the TMO-100 and tested in applications where the DMP3/IP protocol was used simultaneously Remark on using HSE (Fieldbus Foundation): As HSE FF needs to send data from the slave to the master device with an unaltered port number and vice versa, the NAT function should be set to “Keep Port”. In this case the source port number will not be changed by the NAT function and forwarded to the destination device.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 80 of 112 5 Configuring the TMO-100 5.1 Configuring the TMO-100 through the Integrated Web Server The adjustable parameters of the TMO-100 can be configured through the integrated Web server from a conventional browser. This can be done either over its Ethernet interface or over the TETRA network, in packet data mode. The Web server responds to queries through Port 80. Example: The TMO-100 is delivered with a factory-installed IP address 192.168.0.199 for the Ethernet interface. A PC connected to this interface has the e.g. IP address 192.168.0.26. To configure the TMO-100, type http//192.168.0.199 in the address window of the browser and hit "Enter". If necessary, a fixed IP address in the range 192.168.0.xxx may need to be assigned to the connected PC. The TMO-100 can be connected using a 1:1 patch cable if connecting to the PC via a switch or hub. If connecting to a PC directly, use a crossed cable. If the TMO-100 is operated in “Packet-Data Mode” with an assigned IP address, it can be configured locally or remote over the TETRA Network. For example, if the TMO-100 has the IP address 10.0.66.17 on the TETRA network side, a remote PC can access this TMO-100 via another TMO-100 (here “the another” TMO-100 is just used to link the PC to the TETRA network). In that case on the browser input line of the PC http://10.0.66.17 followed by [RETURN] would access the Web server of the remote TMO-100 that has to be configured. Note that a registered port forwarding linkage has higher priority than the internal functions of the TMO-100. Therefore, if Port 80 is assigned in the Port Forwarding Table to an IP address of the local Ethernet, then the Web server of the TMO-100 is no longer accessible remotely over the TETRA network.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 81 of 112 5.2 Configuring the TMO-100 using MODBUS Protocol The internal registers of the TMO-100 can be accessed using the MODBUS-RTU protocol. Service information can read from the TMO-100, or its configuration settings can be changed, using this access method. MODBUS-RTU access can be achieved locally via the serial or Ethernet interface of the TMO-100, or remotely over the TETRA network (only in packet data communication mode). For this, the TMO-100 must be configured with a device address in the range 1 - 239 (factory setting = 1). This device address is the same as the MODBUS logical address that is used for accessing the modem. For access over MODBUS/IP, the modem responds to Port 4502. The standard Port 502 is not used because it has been assigned as a factory setting for communication with external MODBUS devices thorough IP address 192.168.0.100. The configuration registers of the TMO-100 are detailed in a separate document (available on request). 5.2.1 Access through the Serial Interface If it is requested to access the TMO-100 registers directly using the serial port(s), the previously defined Modbus address has to be used. This address can be configured using the “Device / Access” configuration menu. Additional the COM or AUX port has to be set to “Modbus local” Interface settings for Modbus access 5.2.2 Access through the Ethernet Interface To access the TMO-100 through its Ethernet interface using MODBUS/IP, the Ethernet IP address of the modem must be used (factory setting 192.168.0.99), and Port 4502 designated. The optional logical MODBUS address is ignored here.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 82 of 112 5.2.3 Access over the TETRA Network The IP address of the TMO-100, statically or dynamically assigned by the TETRA network, must be used when accessing the modem over the TETRA network. Port 4502 must be addressed. The optional logical MODBUS address will be ignored.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 83 of 112 6 Auxiliary Functions 6.1 Sending Restart (Reset) and Ok-Messages Optional the TMO can transmit OK-Messages to indicate its presents and proper operation within the TETRA network. This message is sent as an SDS and contains the Device-Name and the Receive Field strength, displayed in -dBm. This option can be enabled in “TETRA  SDS/Status/MMI” by entering the time interval (in minutes) between two OK-Messages. Configuration of the OK- and Restart Message As soon as an ISSI as programmed into the ISSI-Field of the OK/Restart box, a message will be sent to an individual or to a group, if the device restarts. That can be used to monitor the device-, the network- and the power supply behavior of the remote TMO.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 84 of 112 6.2 Monitoring the Receive Field Strength using a Status Message In the menu "TETRA  SDS/Status/MMI" a status number can be predefined that is used to monitor the receive field strength of the TMO. If the TMO receives this status information, it immediately responds with an SDS that contains its Device Name and the Field Strength value in –dBm. Using that feature, the device and also the TETRA network can be monitored. The ability to get the RSSI level from the device by this method can be limited to a range of authorized SSI's. In that case only the SSI's in the defined range are able to trigger that function. Setting the Status for RF field strength request Defining the SSI range, which is allowed to perform an action
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 85 of 112 6.3 Remote device restart using a Status Message The TMO-100 can be restarted remotely by an incoming status message. The restart will cause a complete reregistration at the TETRA network, which may be useful under some circumstances. In the menu "TETRA  SDS/Status/MMI" a status number can be predefined that is used for this. The feature is initially turned off for security reasons. To enable this feature, it must first be set to "On", followed by a click on the "Apply" button (or just pressing the "Enter" key). After this, the status number for this action can be configured. In this example, an incoming status message 50505 from an authorized calling ID (SSI) can trigger the restart procedure on the TMO-100. Any triggered restart will cause an entry in the eventlogger, including the SSI which has triggered this action. The ability to get the RSSI level from the device by this method can be limited to a range of authorized SSI's. In that case only the SSI's in the defined range are able to trigger that function.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 86 of 112 6.4 Speech Communication (Voice Function) The optional voice function allows speech communication of the TETRA network, between the TMO-100 and another station (e.g. a control room). A service technician (for example) can call the control room to give a field report or notify an emergency. For this, a voice transceiver (headset or handset) is connected to the TMO-100 (RJ-45 "Audio" socket). The PTT (push to talk) pushbutton switch is pressed when speech communication is required. When this happens, data communication is interrupted because simultaneous data and speech communication is not possible. After the PTT button is pressed an audio signal through the earphone indicates that voice connection has been established and the user can now talk. Data communication remains suspended while speech communication is in progress, or until a silent period of 10 seconds is detected. Then the data link is re-established by the TMO-100, and data communication is resumed.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 87 of 112 6.4.1 Configuration of the voice feature The configuration of the voice feature will be done on "TETRA  Voice". This menu is available only if the voice feature is activated. On the top of the page, up to 8 voice targets can be configured, each can be an individual SSI or a group SSI. The active voice target for outgoing calls can be selected below. The selection is limited to voice targets where a SSI is configured, empty places (SSI=0) can't be chosen. The selection of the voice target is avialable from firmware version 2.62, the previous version do only offer a single number as voice target.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 88 of 112 The voice call priority can be also configured, this will affect all outgoing calls from the TMO-100. It may be important that data communications by SDS has a high priority in the application. As outgoing SDS can't be transmitted during an active transmitting voice call, the "SDS priority in case of voice PTT" can be set. If activated, a transmitting voice call will be disrupted for a short time if the TMO-100 needs to send out an alarm or data SDS. The disrupton will be signalized by tones in the speaker handset. Finally, the loudness of the speaker and the microphone can be adjusted on this page. It's set to medium level by default.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 89 of 112 6.4.2 Voice target selection with the speaker handset Starting from February 2013 the TMO-100 will allow a selection of the active voice target for outgoing calls by the speaker handset. This requires a hardware modification and can't be upgraded just by software on older devices. To switch the voice call destination, the small red button on the left side of the speaker handset can be used. With the first press of this button the active call destination (Voice-SSI 0 to Voice-SSI 7) will be displayed by a flashing LED on the RSSI LED bar. A flashing RF LED 5 means that the voice SSI "5" is selected for the next outgoing call. The initial press on the button does not change the destination. The LED will display the destination for 3 seconds, then the display will revert to normal operation (showing the RSSI field strength). By pressing one or more times within the 3 seconds after the initial key press, the destination can be changed. Each key press will increase the destination, which is still displayed on the RF LED bar. Unconfigured Voice-SSI will not be chosen; they will be left out by the selection process. If only the voice-SSI 1-4 are configured in the TMO-100, only these destinations can be selected by this way. The selection is made right when the flashing LED displays this, the call can be made immediately after the successful selection of the voice target. During the voice call, an inverted flashing LED on the LED bar will show the active destination. This will be the case on any call, not only after a reselection of the voice destination SSI.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 90 of 112 6.4.3 Voice Alarm Feature The voice alarm feature gives the ability to transmit pre-recorded voice messages by the use of PicoLogo. Voice alarm is a commercial feature which needs activation before it becomes available. Up to 16 messages can be recorded, each message can have up to around 18 seconds length. The recording and playback-check is done in the webserver of the TMO-100. After the messages have been recorded, their playback can be triggered by the "VOICE SEND" block in a PicoLogo application. 6.4.4 Recording of messages For recording messages it's actually required to have the packet data connection switched off! Once a message is played back and packet data is active, the packet data connection will be put on hold during the transmission of the voice message. The messages can be administered in the two webserver pages "Voice alarms 1-8" and "Voice alarms 9-16" which can be found in the menu "TETRA". If these pages are not available there, the voice alarm feature is not activated on your device. In this case please contact us to purchase the option or to get a trial period: info@piciorgros.com For security reasons the ISSI of the terminal / dispatcher which is allowed to record messages must be entered in the field "Authorized SSI for recording". This SSI must match the SSI which is seen when the recording device makes a PTT call toward the TMO-100. For each alarm message the length of an existing message ist listed, if the length is 0 seconds there is currently no message recorded in this slot. Any recoding action will overwrite an existing message in the selected slot!
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 91 of 112 To record a message, the "REC" button of the slot which should hold this message must be pressed. After the click it'll change its color from grey to yellow. Once the button is yellow, the TMO-100 is ready to receive a PTT call to record the message. If no incoming call is received within 30 seconds, the recording will time out and the button will revert back to grey color. With the yellow button, the terminal which SSI is listed in the authorized SSI field must start a PTT call to the TMO-100, either to the TMO's ISSI or to any group where the TMO is a member of. Once the TMO recognizes the incoming call and the received SSI matches the authorized SSI, the button will turn red and the recording will start. As soon as the PTT key of the speaking terminal is released the button will turn back to grey color and the length of the recoded message will appear in the line. (8 seconds in this example). Once the still existing call is cleared, the message can be played back to check it. The playback call will always be made to the playback SSI configured at the top of the page: During playback, the "PLAY" button will be green colored. Any recorded message can be deleted by hitting the "DEL" button in the line.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 92 of 112 6.4.5 Backup and clone a set of messages If a set of messages are recorded, they can be backed up with the IPLoader tool or any other TFTP software. To save the message set to the computer, hit "Get file" at the IPLoader and specify the filename "voicealarms.tmo" The file will be fetched from the TMO-100: Once the file is saved to the computer, it can be renamed to any name which is comfortable as long as the extension ".tmo" will be kept. This file can be loaded in any other TMO which allows to clone a set of pre-recorded messages to several TMO-100.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 93 of 112 6.5 Control and Measurement I/O (RTU Functionality) (Note: in the following paragraph Ports A, B, C, & D are not to be confused with IP ports mentioned elsewhere in this document). A version of the TMO-100 is optionally available with control and measurement inputs and outputs integrated with the modem. The basic version has 16 on-off inputs (Ports A and B) and 8 on-off outputs (Port C). A further optional version has Port D, which can be ordered as 8 additional on-off outputs, or as 4 analog inputs. Each of the 16 on-off inputs of Port A have independent event counting functions that can be enabled by the user. Port A inputs counters operate as event counters, while Port B counters operate as time-totalizing counters. The maximum counting rate [input pulse rate] is 10 Hz. The control and measurement I/O can be accessed using any of the following protocols:  MODBUS RTU through the serial interface or Ethernet interface, or over the TETRA network.  IEC-60870-5-101 through the serial interface or over the TETRA network.  IEC-60870-5-104 (future: not presently supported)  DNP3 (future: not presently supported) The RTU function of the TMO-100 can be configured so that a status change of an on-off input can cause an appropriate message to be sent (for example) to a TMO-100 Master Modem that has MODBUS access enabled, and stored there in a MODBUS Alarm List. Alarms can then be sent to a control system for appropriate action.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 94 of 112 6.5.1 Accessing I/Os using the MODBUS Protocol The TMO-100 can be accessed remotely over the TETRA network or locally through its serial or Ethernet interface. That access is made through Port 4502 (not Port 502 because that has been assigned as a factory setting for another communication function). If the Port number is to be changed from the standard Port 502, the previous entry (factory setting) relating to this Port is removed from the Forwarding Table, as otherwise the TMO-100 will function as a router for MODBUS message frames and pass these through to the local Ethernet, instead of reading and acting on them. The I/Os are accessible as 16 bit values from the following register addresses: Register Assignment 0 - 199 0: Modbus address of the TMO-100 1: High Byte: RF Field Strength in -dBm 1: Low Byte: Device Status 2- …: the input register in packed format as …  digital inputs  analog inputs  counter  32 virtual PicoLogo input registers (from Firmware 2.80) 400-449 Analog inputs (if available), 12-bit A/D resolution. The upper 4 bits are 0000 300 On-off outputs. Output C0 is represented by the least significant bit 500-515 Counters. 16 bits per count value. The first counter is assigned to Port A0. Port A inputs are factory-set as event counters, and Port B inputs as time totalizes.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 95 of 112 The I/O ports, the virtual PicoLogo input/output registers as well as other information of the TMO can be accessed using the following 16 Bit registers (e.g. using the Modbus RTU-Protocol) Register Assignment 0 1 (High Byte) 1 (Low Byte) 2- …. Own Device ID (address) Field strength of the TETRA network in –dBm A value of 90 means i.e. that the network is received with -90dBm by the TMO-100. Will be "255" if the TMO-100 is not registered to the network. Device status as follows:  Bit 7: Will be set on device restart. The bit can be cleared if the status register is written with a value where bit 7 is set.  Bit 6: A set bit means that an I/O-error has occurred. This can be a failed or removed expansion module or a non-matching I/O monitoring value. The bit can be cleared if the status register is written with a value where bit 6 is set. If the error still exists, the bit will not reset to 0  Bit 4: Is set if the system time is valid  Bit 3: Is set on a properly operating device  Bit 1: If this bit is set, the TETRA radio is on error All Input Data and Timer / Counter in packed format:  Digital Inputs  Analog Inputs as 12 Bit values  Counter and Timer  32 virtual PicoLogo input registers 200-231 32 virtual PicoLogo input registers. These can be written by a PicoLogo application and be read out from the TMO-100 (i.e. by a SCADA). (Available from Firmware 2.80) 232-263 32 virtual PicoLogo output registers. These can be written to the TMO-100 (i.e. by a SCADA) and can be read out by a PicoLogo application. (Available from Firmware 2.80) 300-399 All Output Data in packed format:  Digital Output  Analog Output as 12 Bit values  32 virtual PicoLogo output registers 400-449 Digital Inputs, I/O port A0 is the LSB 450-599 Analog Inputs (if present) as 12 Bit values The upper four Bit are set to 0000 (can be changed in future) 600-749 Counter, 16 Bit each. The first counter relates to I/O port A0, followed by A1, … , B15 As factory default, the port A counters are set as event counter, the port B counters are set to Time-Counters (resolution is one second) 750-799 Digital outputs, I/O-port C0 is the LSB 800-899 Analog Outputs (if present), first value reflects input D0
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 96 of 112 6.5.2 MODBUS Coil- and Input commands The binary in- and outputs as well as 32 virtual in- and outputs from PicoLogo can be accessed with the coil / input commands by using the MODBUS protocol. Coil / Input Assignment Coils 0-299 Binary hardware outputs of the TMO-100 Coils 1000-1031 32 virtual coils which can be written by the SCADA or master and be read/written by a PicoLogo application Inputs 0-299 Binary hardware inputs of the TMO-100 Inputs 1000-1031 32 virtual inputs which can be written by a PicoLogo application and can be read out by the SCADA or master
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 97 of 112 6.5.3 Supported MODBUS commands These MODBUS commands are supported by the TMO-100: Command Description 1 (0x01) Read Coil Status 2 (0x02) Read Input Status 3 (0x03) Read Holding Registers 4 (0x04) Read Input Registers 5 (0x05) Force Single Coil 6 (0x06) Write Single Register 8 (0x08) Sub 0: Local Loopback 15 (0x0F) Force Multiple Coils 16 (0x10) Preset Multiple Registers 23 (0x17) Read/Write Multiple Registers
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 98 of 112 6.6 Accessing the I/O using the IEC60870 protocol The TMO-100 offers the access to the hardware I/O and virtual PicoLogo I/O by the use of the IEC60870 protocol. Currently the IEC60870-5-101 protocol is supported, the IEC60870-5-104 protocol is in preparation. The IEC60870 protocol is a commercial option which must be purchased on a per-device basis. An activation for an existing device is possible on any time with an activation key. IEC60870 support is officially starting with firmware version 2.80. There are two ways of accessing the I/O of the TMO-100 with IEC60870 protocol which are explained below. 6.6.1 Native (internal) IEC60870 support for the basic I/O's If the IEC60870 option is active in a TMO-100, the internal inputs and outputs of the TMO-100 are directly supported and can be easily configured with the webserver. This implementation supports up to 16 binary inputs, up to 16 binary outputs and up to 4 analog inputs. The native support will match most applications in small substation environments. For each I/O the object address and the data class (class 1 or class 2) can be configured individually. In this mode, only single inputs and single outputs are supported. To activate the internal IEC60870 support it must be set on IEC60870  Native Configuration:
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 99 of 112 6.7 Setting the RTU-Parameter (Device with Embedded I/O) 6.7.1.1 I/O Presence Supervision As up to 16 different I/O modules can be connected to the TMO-100, a various number of digital and/or analog I/O can be available on the device. Using the “RTU Features / Setup” for each type of I/O an individual monitoring can be enabled. With that feature it can be avoided that when replacing an I/O module a different one can be replaced (16 DI instead of 16 DO). The same would occur if one expansion module would be taken out of the chain and not be replaced. Configuration of the I/O supervision If the monitoring is enabled, the value entered in the RTU-Setup Menu has to match exactly the number of physically connected I/O’s. If it does not match, the device sets the I/O error flag in the status byte, the OK-LED flashes on the front panel and all outputs will be disabled (set to off or zero).
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 100 of 112 6.7.1.2 T-Timeout The T-Timeout refers to an internal TMO timer that monitors all access to the device. Each time the TMO is accessed (e.g. by Modbus RTU protocol) this timer is reloaded with the T-Timeout value. If this timer has timed out (that means that there was no access over a period of time due to network mal function or other reasons), all outputs of the device will be reset (set to save state). The T-Timeout can be enabled and disabled Setting the T-Timeout
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 101 of 112 6.7.1.3 Input Delay of the embedded Digital Inputs If the TMO is equipped with embedded digital inputs (this feature is not available on the extension modules) an On- and Off-Delay can be programmed for each of the 16 inputs individually. That protects the device from setting (or resetting) the input data on each short signal change, caused for example when switching on or off huge loads on the power line. The delays can be disabled (factory default) or set in 100mS steps. It is also possible to activate only the ON-Delay or both, the On- and OFF-Delay. In that case the delay in ms will be the same for on and off. Setting the On- and OFF-Delays of the Embedded Digital Inputs
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 102 of 112 6.7.1.4 Setting the TMO’s embedded Timer and Counter Each of the 16 embedded digital inputs (this feature is not available on the extension modules) can be read as an input signal, but is also directly connected to a 16 bit Counter or Timer. A Counter can count events with a speed up to ten counts a second (10 Hz) and the Timer is able to count the length of a signal (active low) in seconds. Using the “RTU-Features / Counters”, each of the 16 digital inputs can be defined if it will be used additionally as a Counter or a Timer. As a factory default, the input port A (A0 – A7) is set to Counter and the input port B (B8 – B15) is set to Timer. Timer and Counter settings
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 103 of 112 6.8 Master Modem for MODBUS Protocol A TMO-100 configured as a master modem for MODBUS protocol can process status messages transmitted by TMO-100 slave stations that have integrated inputs and outputs. As described earlier in this chapter, a TMO-100 slave station that has RTU functionality (integrated I/O) can send predetermined status messages upon status change of specific inputs. However, it should be noted that it can report such changes not more frequently than 1 change per second. If a TMO-100 is configured as master modem and local Modbus protocol is enabled, it can be accessed using the Modbus RTU protocol. In such a case, it will reply to MODBUS message frames that are sent to its MODBUS address, over the TETRA network, from its local Ethernet, or through its serial interface. Message frames from local terminal equipment that carries any other MODBUS address will be forwarded over the TETRA network to the appropriate remote station. 6.8.1 Modbus Protocol with unsolicited Messaging Additional to the answering of the normal Modbus polling algorithm from a SCADA or PLC where the TMO-100 outstation acts as a Modbus slave device, it can send instant status messages. These messages can be enabled and are sent, whenever one of the 16 inputs of the TMO-100 outstations changes their logic state. The master modem stores these changes in a 16-bit register that is assigned to that slave station. Such registers are available for each of up to 240 slave outstations. Each of these registers, which are also writable, represents the current status of the 16 on-off inputs of the corresponding slave TMO-100 RTU device. Example: Monitoring an Alarm Message If several slave TMO-100-RTU stations on a network are cyclically polled using the MODBUS protocol then there could be a considerable delay for an emergency alarm notification to reach the central control system by normal polling of the RTU stations. In this example, when on-off input A0 of a slave RTU station is switched on (activated), it means, that an alarm condition has occurred. The central control system interrogates all existing slave stations by MODBUS RTU polling. However, it also polls the mirror registers of the master TMO-100 that reflect the inputs of the slave RTU stations. Because this interrogation does not go over the TETRA network, but to the registers of the master modem, response to this polling is very fast. In addition, the registers corresponding to several slave stations can be read simultaneously. As soon as in one of these registers Bit 0 is set (this corresponds to change in status from "0" to "1" of the on-off input A0 of the corresponding slave station), the central control system is immediately notified of an emergency condition and can take direct action (for example, it can poll the alarm reporting slave RTU station immediately). In addition, the central control system can reset the registers that mirror the slave stations'
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 104 of 112 inputs, so that the next change in status from "0" to "1" of the input of the slave station results in a new alarm notification.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 105 of 112 7 PicoLogo® User Application Interface (PicoLogo® - Available from Q1/2011) PicoLogo® is an easy to use Application Platform that can be used to:  combine the embedded I/O with logic functions  set up M2M communication  supervise TETRA Base stations (Field Strength, Air Condition, Door Contacts)  set up automated radio controlled process automation  send text- and alarm-messages to TETRA terminals or other TMO-100  for versatile control- and supervision functions For creating the logical functions for PicoLogo®, an graphical editor is optional available
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 106 of 112 8 Start-Up / Troubleshooting 8.1 Brief Instructions The following brief instructions provide a brief overview of the start-up steps for putting the TMO-100 into operation: 8.1.1 Configuring the TETRA Network Parameters The network parameters must be set into the TMO-100 (if this was not done at the factory before delivery, for project specific orders): MNC, MCC, ISSI, frequency. These settings are done directly in the TMO-100. 8.1.2 Antenna Ensure that an antenna appropriate for the frequency band used by the TETRA network is connected to the modem. An outdoor antenna will generally result in better performance than a plug-in (modem mounted) corkscrew antenna. If the modem is installed inside a metal cabinet, the antenna should be completely outside the cabinet. If the modem is installed inside a steel-reinforced concrete or steel structured building, the antenna should be installed outside the building. 8.1.3 Power Supply and Power-Up Sequence When a voltage of 12-24 VDC +/-20% is applied to the power supply input terminal-block of the TMO-100, it starts up immediately. The "Pwr" LED lights up first, and a short time later the "OK" LED lights up and stays continuously lit. If "OK" LED blinks, this indicates as error condition corresponding to the blink pattern (see Section 2.3.1 - OK LED: Blink Pattern Error Indication) While the TETRA engine of the TMO-100 is being initialized, the LED lamps of the RF signal strength indicator array flash in sequence, from right to left. When the initialization is complete, the modem attempts to tie into the TETRA network. If this is successful, then several consecutive LEDs of the RF signal strength indicator array light up (the number of LEDs lighting up is proportional the RF received signal strength). A minimum of 3 LEDs (from left to right) should be lit for reliable communication.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 107 of 112 During the setup of the embedded TETRA engine, the LED display RF indicates the LED’s stepping from right to left as a single dot. Once the configuration is terminated and the device has successfully logged into the TETRA network, a bar of LED’s (from left to right) indicates the RF field strength of the received TETRA signal. For a proper communication, at least 3 LED should be indicated. It should be considered, that the displayed RF field strength is the received field strength from the base station and maybe the base station can still be received, while the base station does not receive the TMO any more. Number of LED Field Strength 1 below -103 dBm 2 -103 dBm 3 -95 dBm 4 -87 dBm 5 -79 dBm 6 -71 dBm 7 -63 dBm 8 -55 dBm or higher 8.1.4 Power up Indication using a PPP Link (Packet Data Connection) Once the TMO is configured for “Packet Data”, after logging to the TETRA network it immediately tries to set up the PPP-Link indicated by the flashing blue PPP_L (link) LED. Once the link is established, the PPP_L LED will be continuously turned on, while the PPP_D (data) LED only indicates transmitting and receiving data. 8.1.5 Failure to Register on the TETRA Network If the TMO-100 does not succeed in registering on the TETRA network and all LEDs of the RF Signal Strength Indicator are unlit, the antenna system modem settings of the TETRA network parameters should carefully checked and corrected as necessary. A TETRA terminal can be used to quickly determine whether TETRA network coverage is available at a site. Take the TETRA terminal near the installed equipment antenna. If the terminal (when it is switched on) indicates that it has tied into the TETRA network, then the TETRA network coverage is available at the antenna location. If the TETRA network settings have been correctly done on the TMO-100, then the antenna system should be examined to see whether it is correctly installed, and the antenna has been correctly selected for operating frequency range. In addition, the length and type of antenna cable are important considerations. If the antenna cable is longer than 5m, low-loss cable should be used (e.g., RG-213 or Aircell). As a general practice, it is recommended that the antenna cable is kept as short as possible (20m RG-213 reduces the transmit and receive signal strength by half). Antenna cable loss should be compensated by using an antenna of appropriate gain.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 108 of 112 8.2 TMO-100 Firmware update procedure The update mechanism of the TMO-100 was introduced with firmware version 1.16. Previous versions can not be updated by this method, for such devices please contact your Piciorgros partner who will be able to upgrade the devices to at least this version. To perform the update, just a TFTP client is needed. A simple command-line client is built directly into Windows operating system. 8.2.1 Preparation and setup For updating the TMO-100 you will need the following equipment:  PC with Ethernet connection  TFTP client software (Windows command line or i.e. "PumpKIN" software)  Firmware files for the TMO-100 8.2.2 Update procedure For the update, two firmware files are needed. The file with the extension ".pfw" is the firmware file, the one with the extension ".pch" is the keyfile to activate the loaded firmware. To perform the update, the ".pfw" file must be sent first to the TMO-100. Unless the ".pch" file is sent to the TMO-100, the device will just store the new firmware file. As soon as the matching ".pch" file is also transferred to the TMO-100, the device will restart and reprogram itself to the new firmware. Important! This reprogramming after sending the ".pch"-file to the device will take about 15-20 seconds. During this action, DO NOT INTERRUPT THE POWER TO THE TMO-100. Otherwise the update fails and the device must be restored by a Piciorgros partner. After the update process has ended, the device will start immediately with the new firmware.
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 109 of 112 8.2.3 Connecting the TMO-100 Connect the Ethernet port of the TMO-100 to the PC. The IP-settings of the PC must allow it to access the TMO-100 (default IP: 192.168.0.199). 8.2.4 Update using the Windows command line client Start the Windows command line by using "Start" / "Execute" and then type "cmd" Change to the directory where you've put the firmware files Transfer the .pfw file to the device, using the command tftp –i 192.168.0.199 PUT filename.pfw The IP here is the default IP of the TMO-100, if this IP is changed you have to give the correct IP address instead. Also "filename.pfw" must be replaced by the real firmware file name. The transfer will take some seconds. Unfortunately the software will not give you any feedback of the progress. After some seconds you should see the success output like this:
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 110 of 112 Now you'll perform the same action again, but now for the ".pch" file. The device should restart now, doing the internal update process. Important! Do not disconnect the TMO-100 from its power until the update process has finished (the TMO will not show any action on it's LED for about 15-20 seconds, then it will restart). After the TMO has restarted and is alive, the power can be disconnected. The .pch file must always match to the corresponding firmware. Otherwise an error message will be displayed and the update operation will not be started:
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 111 of 112 9 Specifications Functions:  Radio Modem for Serial Data Communication  Remote Alarm Monitor  TETRA IP Router  TETRA RTU  TETRA Base Station Monitor RF output power: Class 3 (for 350 – 470 MHz) Class 4 (for 806 - 868 MHz) RF power adjustment: 4 steps, each 5 dB Frequency range: Band 0: 350 MHz - 370 MHz Band 1: 370 MHz - 400 MHz Band 2: 400 MHz - 430 MHz Band 3: 450 MHz - 470 MHz Band 10: 806 MHz - 869 MHz Receiver Sensitivity: Static: min -112 dBm (Typ -115 dBm) Dynamic: min -103 dBm (Typ -107 dBm) Interfaces: COM: AUX: Ethernet:  RS-232 or RS-485/422, Sub-D (F)  RS-232 or RS-485, RJ12  10/100 Mbit/s RTU I/O (optional): On-off inputs: On-off outputs: Analog inputs: All I/Os have separate electrical isolation  16 on-off inputs (Vin = 12 to 24 VDC +/-20%)  8 (optional 16) outputs PNP (max. 500 mA per output)  4 analog inputs, 0-20mA / 4-20mA, 12-bit A/D resolution I/O extension port: (optional) Voice: Speech transceiver interface (RJ45) Operating modes:  SDS-based data communication  Status messages for alarm inputs  Packet data based communication  Circuit switched data (on request) Protocols:  MODBUS-RTU, MODBUS/TCP  IEC-60870-5-101, IEC-60870-5-104  DNP3, DNP3/IP, PakBus  Custom protocols: serial or IP based RF field strength indication: Front panel LED bar graph display (for received radio signal) Encryption (Option): Air Interface End to End TEA1, TEA2, TEA3 AES, optional IDEA
Funk-Electronic Piciorgros GmbH TMO-100 V2.84 - Page 112 of 112 RF Conformance EN 300 394-1 EMC Conformance EN 301 489-1 und -18 ESD Conformance 61000-4-2 von 1998 IOP certified yes Power supply voltage: 12-24 VDC +/- 20% Power consumption (av.) Receive: Transmit: Registered to the TETRA network 110mA @24V, 210mA @12V (TBD) Enclosure: Extruded aluminum body; plastic end caps Operating Temperature: -20°C to +65°C Mounting: 35 mm DIN rail, symmetrical Dimensions: 80mm x 162mm x 62 mm (excluding antenna and power connectors)

Navigation menu