Brayden PMC-1 v4 Pulse to Modbus Converter Instruction Manual

1. “Reset Cumulative Energy & Pulses Channel 1 ? (y or n)” Enter either y or n depending on whether or not you wish to start the energy register and pulse count for Channel 1 over from zero. Press Channel 1’s . If you selected “y” and hit , you will then see a confirmation that says “Cumulative Energy and Pulses for Channel 1 was reset to zero.” If you selected “n” and hit you will then see a confirmation that says “Cumulative Energy was
   NOT reset.” Pressing without pressing y or n results in no reset and no confirmation message.

2. “Reset Cumulative Energy & Pulses Channel 2 ? (y or n)” Enter either y or n as above. Press .

3. “This IP address, (XXX.XXX.XXX.XXX) ?” Type in a new Static IP address and hit . Enter the static IP address which the PMC-1 will use within your network. This is generally a 192.168.xxx.xxx number or a 172.16.xxx.xxx number used for LANs only. The default IP address is 192.168.0.250. If the PMC-1 is to be accessible from an external (public) Internet, usually the IP address of a router that forwards a port to the PMC-1 would be used to access the PMC1, but that address would not be entered here. This IP address would still generally be one of the LAN address ranges above. The actual IP address to be entered would need to be obtained in consultation with the IT service provider, network administrator, or the person who configures the router or switch that forwards a port to the PMC-1. Once you have programmed the static IP address into the PMC-1 v4, you can either finish programming all of the settings here using the USB Programming port, or you can access it using the PMC-1 v4’s internal Webserver. See page 5 for programming using the Webserver. If you choose to use the Webserver, hit continuously until you reach the end of the programming mode. Then power down the PMC-1 v4 and follow the directions on page 5 to use the Webserver.

4. “Gateway IP address, 0.0.0.0 if local only (XXX.XXX.XXX.XXX) ?” Enter the Gateway IP address and hit .
   This is generally the IP address of your router if the PMC-1 is to be accessed from outside the Local Area Network (LAN) the PMC-1 is connected to. The default IP address of 0.0.0.0 can be used if the PMC-1 will only be accessed from a computer on the same LAN as the PMC-1. If you just hit without entering a Gateway IP address, it will retain the previous value which will be the default Gateway IP address the first time. Load the default IP address of 0.0.0.0. Hitting “?” then will return the current Gateway IP address in memory.

5. “NetMask (XXX.XXX.XXX.XXX) ?” Enter the Netmask and hit . If you just hit without entering a new NetMask IP address, it will load the default IP address of 255.255.255.0. Hitting “?” then will return the current NetMask IP address in memory.

6. “Port Number, 502 is well-known for ModBus (502 or 1024 thru 65535) ?” Port 502 is a “well-known” port address for Modbus devices. If more than one PMC-1 is to be accessed from the same external IP address, use any unused Port number. If you just hit without entering a new Port Number, it will retain the previous value which will be the default Port Number the first time. Each subsequent time, hitting will display the current port number.
   Hitting “?” then will also return the current port number.

7. “Slave Unit Number, only 1 per IP & Port Combination (0-247) ?” The Slave unit number default is one(1).
   Simply hitting without changing the Slave Unit number will use the default of 1, unless the Slave Unit number was previously changed to a different number. Each subsequent time, hitting will display the current Slave Unit number. Hitting “?” then will also return the current Slave Unit number. Any number may be used between 0 and 247, however the standard for the master device is Zero(0) and slave device 1. The slave number cannot be used to address more than one PMC-1 with the same IP and port number. A ModBus query must be addressed to the slave number entered here, otherwise the PMC-1 will not respond.

8. “Pulse Constant (x.xxxx kWh/pulse) for Channel 1?” Enter the Pulse Constant value in kWh’s per pulse, and hit . The number must be between .0001 kWh and 999.999999 kWh. (You will need to divide your Wh value for a pulse by 1000 to get the kilowatt-hour value.) For example, if your Form A (2-Wire) value is 144 Wh/pulse, then your kilowatt-hour value per pulse is .144 kWh/p. Enter .144.

9. “Number of KYZ wires (2 or 3) for Channel 1 ?” Enter 2 for a 2-wire value or 3 for a 3-wire pulse value, and hit . The PMC-1 only uses two physical wires in both cases but is capable of directly entering either a 2-wire number or a 3-wire number(value). Simply specify which type the pulse constant value is. This is simply a convenience mechanism for the user in the event that they have either a 2-wire or 3-wire number and do not know how to convert the value properly. Hitting without entering 2 or 3 will return the current value. Hitting “?” then will also return the current value. In electric metering 2-wire pulse values (called Form A) are always double 3-wire pulse values (Form C). In most other types of pulse metering, gas and water, for instance, there are only 2-wire values. The default for this mode is 2-wire.

10. “Scale for Cumulative Energy Channel 1? (1 for kWhr, 1000 for MWhr)” Enter a 1 for the kilowatt-hour scale or 1000 for megawatt-hour scale. This is designed to be able to be used on electrical distribution systems with very large pulse values. For building scale use, normally kWh would be suitable. This feature simply determines where the decimal point is located and the units of measure used, either kWh or MWh.

11. “Averaging time for measurement each 5 seconds, (5 or 15) secs for Channel 1 ?” Enter 5 for 5-second or 15 for 15 second. This is the update interval of the PMC-1 registers. Hitting without entering 5 or 15 will return the current value. Hitting “?” then will also return the current value.

12. “Pulse Constant (x.xxxx kWh/pulse) for Channel 2?” Enter the Pulse Constant value in kWh’s per pulse, and hit . The number must be between .0001 kWh and 999.999999 kWh. (You will need to divide your Wh value for a pulse by 1000 to get the kilowatt-hour value.) For example, if your Form A (2-Wire) value is 144 Wh/pulse, then your kilowatt-hour value per pulse is .144 kWh/p. Enter .144.

13. “Number of KYZ wires (2 or 3) for Channel 2 ?” Enter 2 for a 2-wire value or 3 for a 3-wire pulse value, and hit . The PMC-1 only uses two physical wires in both cases but is capable of directly entering either a 2-wire number or a 3-wire number. Simply specify which type the pulse value is. The default for this mode is 2-wire.

14. “Scale for Cumulative Energy Channel 2? (1 for kWhr, 1000 for MWhr)” Enter a 1 for the kilowatt-hour scale or 1000 for megawatt-hour scale.

15. “Averaging time for measurement each 5 seconds, (5 or 15) secs for Channel 2 ?” Enter 5 for 5-second or 15 for 15 second. This is the update interval of the PMC-1 registers. Hitting without entering 5 or 15 will return the current value. Hitting “?” then will also return the current value.

16. “64 bit Password to remotely reset Cumulative values:
    Password_A: Enter 8 hexadecimal characters 0-9, A-F or 00000000 to disable (just to leave as is)”
    Enter the 8 digits of the first 8-digit word of the password and hit . The unit will return the following: Value stored in configuration = (8-digit value). Hitting without entering a new value will return the current value. Hitting “?”
    then will also return the current value. “0xFFFFFFFF has a special meaning described elsewhere, and will also disable the reset function.

17. “Password_B: Enter 8 hexadecimal characters 0-9, A-F or 00000000 to disable (just to leave as is)” Enter the 8 digits of the second 8-digit word of the password and hit . The unit will return the following: Value stored in configuration = (8-digit value). Hitting without entering a new value will return the current value.
    Hitting “?” then will also return the current value.

18. “Password to change settings via Ethernet:”
    Enter a password from 4 to 16 characters. The default password is the MAC address. Enter any character from the following: a-z, A-Z, 0-9, !*#$%&+-/:;<=>?@. Care should be taken when copying and pasting password that unseen characters may be inadvertently included. In addition, the Webserver can be disabled by entering 0000000000000000.
    (16 zeros). In this mode, changes can only be made through the USB Programming port.

19. “Enter to save configuration changes to abort.” Upon pressing the PMC-1 will return the following message: “New Configuration has been written to flash.”

20. The PMC-1 will now scroll several status messages to indicate that it is implementing the new configuration. The PMC-1 is now programmed. Hit any key to start the setup dialog again. If programming is complete, power down the PMC-1, disconnect serial cable, and install it in the desired location. Power it up and it will begin collecting energy use data.
    At any point in the dialog routine, if the key is pressed, you will be returned to the start of the routine.
    Setting up the PMC-1 with the Webserver

21. The PMC-1 v4 can be configured using the PMC-1’s Webserver. However, before you can do this, you must program the PMC-1 v4’s static IP address using the USB serial port. Make sure that the webserver is not be disabled.
    See Page 3 for instructions on setting up the programming port and programming the static IP address. The PMC-1 cannot be plugged into the network while you are programming the IP address or other parameters using the programming port. Proceed with programming using the webserver once the IP address is programmed. It can be programmed from within your LAN at this point.

22. Plug the PMC-1 v4 into your local area network. Power up the PMC-1 v4. Open your browser and type in the IP address that you assigned to the PMC-1v4, like 192.168.23.201. Press . The Introduction page will come up.
    This page is divided into 3 sections. The top section is dedicated to “Description” and contains the PMC-1 v4’s general information, a table showing the meaning of the 8 PMC-1 v4’s side diagnostic LED’s, and a link to further PMC-1 v4 information.
    The middle section shows “Unit Identification” which includes: the device MAC address, Static IP, port number assignments and Firmware version. The bottom section contains the “Password, Authentication for Setup” and the link to perform Password Authentication. Note the MAC address of the device on this page. You will need it on the next page.

23. Press (single click) the “Click here to go to password authentication” link. The Login window will appear. Enter “Brayden_user” (without quote marks) in the user name field and the MAC address from the previous page’s middle section for the password.
    (Note: The Alpha characters of the MAC address must be entered in UPPER CASE.)

24. Upon pressing , the PMC-1 v4 setup page will appear, giving you access to 5 links representing 5 different set-up, reset and/or informational areas.
    1. To Reset Cumulative Registers
    Use this tab to reset both channel 1 and 2 cumulative registers individually (Reset Channel 1, Reset Channel 2) or reset both together along with the elapsed time by selecting Reset Both Channels and Time. (Note: Click to Return to Setup Menu appears in all 5 tabs.)
    2. To Change IP Parameters or Name
    Use this tab to change the Static IP address, the Gateway IP address, the netmask IP, port number and slave number. This tab is also used to change the Unit Name.
    3. To Change Pulse Input or Output Parameters
    Use this tab to change the Pulse Constant (value), the number of KYZ Wires (2 or 3) that the pulse value represents, the Scale for Cumulative Energy (kWh or MWh) and the Averaging time for measurement.
    4. To see Modbus Register Assignments
    This tab is informational only and contains no user settings or entries. Use this tab if you need information regarding the 5 groups of registers used to constantly update and store data. The register assignments are not widely published to minimize the security risks from hackers.
    5. To Change Password, or Allow Serial Port Configuration
    Use this tab to change the Password from the MAC address to a different arbitrary password of your choice.
    Also from this tab you can select whether you want to allow the configuration and/or password changes to be made via the RS-232 serial port. The three options are:
    – Allow Serial Config. and Password Change (default)
    – Allow Serial Config. but Not Password Change
    – No Serial Configuration or Password Change

25. The PMC-1 will now be accessible from within your network using only the internal IP address. If you require accessing the PMC-1 from outside your network over the internet make sure you are properly programmed the Gateway and Netmask IP addresses.

26. Port Forwarding – Your IT department, network administrator or IT service company will need to configure your router to forward 2 ports to the internal IP address you have assigned to the PMC-1 v4 as follows: Port 502 (or another designated Port for Modbus, from port 1024 up to 65535)
    Port 80 Standard for HTTP

27. If you have not already done so, plug your PMC-1 v4 into your LAN using an ethernet cable. Power the PMC-1 v4 up.

28. Once your port forwarding has been done, you can test your access from outside of your network over the internet.
    Open a browser on a computer located at a location that is NOT within your network. Enter the public IP address of the PMC-1 v4 on the URL line. Click

    and the PMC-1 v4’s webserver Introduction Page will open. Click on the Login link at the bottom of the page and the Login window will appear. Enter your new username and password and press . The Setup page will appear and you can change any remaining items that have not been previously programmed or changed.

29. Close your browser. Your PMC-1 v4 is now collecting data and is ready to be accessed by your Modbus client software or device.

Troubleshooting the PMC-1

1. If it is not possible to access the PMC-1’s ModBus registers, check the following:
   a.) Power is on to the unit;
   b.) The RJ-45 Ethernet Jack is connected to a switch or router;
   c.) The Green LED on the RJ-45 jack (on the end of the PMC-1v4) is on solid (meaning the Ethernet cable is connected on both ends);
   d.) The Amber LED on the RJ-45 jack (on the end of the PMC-1v4) flashes intermittently indicating communications activity.
   e.) Insure that the Static IP address assigned to the PMC-1 is correct and has not been changed.
   f.) Insure that the port number and slave unit number in the Modbus query match the values programmed into the PMC-1.
   g.) Insure that the IT department has set up port forwarding for Port 80 and 502 to your selected IP address.
   2.) The PMC-1 Pulseconnex Device has 8 diagnostic LED’s on the side to help diagnose any connectivity problems.
   LED #1 is the one closest to the Pulse Inputs. LED #8 is the one closest to the RJ-45 Jack. All are sequentially numbered in between. Here is the meaning of each LED. They are designed to provide a checklist in sequential order of the device status:
   LED#1: Power is on to the PMC-1.
   LED#2: Flickers intermittently during normal operation; Indicates that the processor is active.
   LED#3: Configuration obtained from flash OK. Will be on even if the configuration still is defaults before user programming.
   LED#4: Have Ethernet link (cable connected to switch), (Same meaning as the green LED on the Ethernet connector).
   LED#5: Ethernet Interface is up, meaning that the PMC-1 is connected to the network.
   LED#6: The PMC-1 is preparing data to update all output values. Flashes very briefly every 5 seconds.
   LED#7: A TCP socket is open from a ModBus client (a Master). Flashes very briefly every time a ModBus register is accessed.
   LED#8: The client has received the reply packet and sent back an ACK acknowledgment message.
   Each LED in this “chain” is sequential and cumulative. LED#1 must be on before LED#2. LED #2 must be on before LED #3. Once LED #1 through #5 are on, they will be remain fully ON (lit) with the exception of the flickering of #2. Then LED#6 will go on, then #7, and #8 will follow in sequence and then go out. LED’s #6 through #8 will flash each time the PMC-1 is accessed by the ModBus client, and therefore may be off most of the time, unless the PMC-1 is accessed frequently.

2. Troubleshooting Pulse input problems
   If you have communications but your pulse count and energy registers never change, you may not be receiving pulses.
   This can be verified by the RED Pulse LED being ON or OFF all the time and not flashing each time a pulse is received.
   a.) If the RED LED is ON all the time, check the polarity of the input. On open-collector NPN transistor or opendrain FET transistor outputs the Collector(Drain) must be tied to the “Y” input and the Emitter(Source) must be tied to the “K” input terminal. On any polarized output configuration the Y input is + (positive) and the K input is – (negative).
   b). If the RED LED is OFF all the time, this is an open circuit or an inoperative pulse output from the sending device or meter. Disconnect the pulse output from the PMC-1’s pulse input and use a jumper wire between the K and Y terminals to test the PMC-1’s input. When the jumper wire is touched between the K and Y terminals, the RED LED should turn ON to indicate that a pulse has been received. Assuming the PMC-1’s pulse input(s) is(are) functioning normally, check for an open circuit or defective pulse output on the pulse sending device or meter.
   c.) Make sure your sending device or meter is sending pulses that are at least 10mS, preferably at least 20mS, in length.

Technical Support
Contact Brayden Automation Corp. Tech Support at 888-BRAYDEN (888-272-9336) if you need assistance on the application of the PMC-1 or the PulseConnex Website.

Testing the PMC-1

If your Modbus client software is not yet available to retrieve data from the PMC-1, you can test it with a program called Simply Modbus TCP Client. Go to simplymodbus.ca and download the following program: https://www.simplymodbus.ca/SimplyModbusTCPclient7.1.2Install.zip
Install the program and purchase the license for approximately $60.00 USD. Open the program and configure the parameters similar to what is shown below. Once the parameters are entered. press “Connect”. Once connected and assuming you have pulses being received by the PMC-1, click on “Send”. Observe the pulse count in the registers shown. It will increment by the number of pulses receiving since you last sent a Send command.

Security issues regarding the PMC-1 Pulse to ModBus Converter

The PMC-1 uses the ModBus TCP protocol for data communication. The ModBus TCP protocol is inherently insecure, meaning it does not support encryption or user authentication (passwords).
Anyone that becomes aware of the presence of any ModBus device at a particular IP address can interrogate registers and read data from the device.
If a ModBus device is accessible from the Internet, there are hackers that routinely probe random IP addresses with various protocol requests to see if they get a response. Such people would be delighted to find a ModBus device they could play with, to see if they could obtain interesting information or to see if they can disrupt its operation. Many such people are basically hobbyists, but others are criminals who can sell information they obtain, even if it is simply the fact that a ModBus device is present at a particular IP address. A person eavesdropping on an Internet backbone or even a local Ethernet path can see ModBus packets (and therefore see the ModBus IP address) by using a readily available packet sniffer.
Clearly it is best if ModBus devices in general are used only on Local Area Networks (LANs) that are isolated from the Internet, either physically, or by a carefully configured firewall. Even on an isolated LAN, it is well to be aware that anybody with access to the LAN will be able to read ModBus registers. If a firewall is relied upon to protect the Modbus device, it can be defeated unless configured very expertly. A common method of protection is to set up a rule that only packets from a particular external IP address are allowed to be sent to the ModBus device IP address. There is usually a trade off of security vs. convenience. If a user’s external IP address must change for any reason, the firewall would need to be reconfigured, which usually would incur a cost for an IT professional to implement the change.
A ModBus device in general is able to be written to, as well as read from, and may control other equipment. The PMC-1 is restricted to read-only for security, with one possible exception that can be enabled during configuration via the USB programming port. The exception is the ability to remotely reset the cumulative values that otherwise would eventually roll over from 2^32-1 to 0.
This reset can be accomplished by writing a pre-configured 64-bit password to specific registers. It is important to be aware that the password is transmitted to the PMC-1 “in the clear” (not encrypted), so it would be possible for an eavesdropper to see the password and subsequently use it to reset values without the legitimate user’s knowledge. If the cumulative values obtained from the PMC-1 are used for any important purpose, it would be best to disable the ability to reset them via the Ethernet (or Internet) by configuring the PMC-1 with a password equal to zero (which is the default).
The PMC-1 does allow certain procedures to be used that can obfuscate the ModBus registers from casual eavesdroppers using a packet sniffer. This can make it difficult for the casual eavesdropper to determine which particular registers return useful information, but a determined professional hacker would still be able to obtain the information. The countermeasures available can be enabled by configuring the PMC-1 via the USB programming port with a password segment containing the hexadecimal value 0xFFFFFFFF. This allows ANY ModBus holding register number 40001 to 49999 to be read and report a numerical value. If the register number read is NOT one of the functional registers, a random value will be reported. If the functional registers are not read in order, but several arbitrary registers are read with the functional register numbers interspersed, a casual eavesdropper would just see apparently random data that would be challenging to make sense of. The 64-bit password is made up of two 32-bit values called PasswordA (most significant) and PasswordB (least significant). If PasswordA or PasswordB does contain 0xFFFFFFFF, enabling the above procedure, the cumulative values cannot be reset via Ethernet. If 0xFFFFFFFF is not one of the password segments, a read of a non-functional register number would return a error code, which is the standard behavior for the ModBus protocol. If 0x00000000 is one of the password segments, remote reset of cumulative values via Ethernet (or Internet) is disabled, and non-functional register reads return an error code.
If remote reset of cumulative values is considered necessary, there is danger of an eavesdropper noticing the correlation of particular registers being written with particular values (the segmented password) causing other registers to return zero or low numbers. There is a procedure allowed by the PMC-1 that makes is less likely that that pattern would become apparent. Four nonconsecutive registers must be written with the pre-configured password segments to cause reset of cumulative values. Twelve (12) other registers surrounding the password registers (in numerical register order) may be written with any random value without causing an error code being returned.
This allows a (hopefully) random appearing series of register writes to reset the cumulative values.
If the password segments are successfully written, there is no response confirming that the cumulative registers were reset to zero. The only way to confirm success is to read  one or more of the cumulative registers, but it would be best NOT to immediately read a cumulative register to avoid creating a pattern of cause and effect that an eavesdropper could notice. There are other non-cumulative registers that can be read first, even if their information is not immediately needed, to obfuscate the pattern. Note that the random register read feature discussed above is not available when the password is enabled.
ModBus TCP is commonly used in industry without security problems coming to light. This should not mean that security can be ignored, rather that it is possible to operate with a reasonable level of security. However the user should be aware that it is virtually impossible to eliminate all security vulnerabilities. If nothing else, there is the possibility of a person with access to the LAN being told what registers are used for what data and using the information illegitimately. Note that it must be assumed that anyone with physical access to the PMC-1 serial port is trustworthy. Finally, there is a way to determine if unauthorized register reads are often being done on a PMC-1: There is a register pair that can be read to return the number of cumulative ModBus TCP packets received by the PMC-1. If this register is read occasionally and it increases by significantly more than the number of packets legitimately sent, it is clear someone else is reading registers. The packets received count includes all ModBus TCP packets, even those that attempt to read non-functional registers. It does not include ping requests.

PMC-1 v4 Setup
Network Connection
The PMC-1 v4 acts as a HTML server for setup of operating parameters.
By default, it is shipped having two IP addresses, each of which it listens on alternately, every 4 seconds. IP address 192.168.0.250 is listened to when LEDs 1,2,and 7 are on. IP address 10.0.0.250 is listened to when LEDs 1,2,and 8 are on. This makes it likely that one PMC-1 v4 plugged into a Local Area Network (LAN) can be reached from a Personal Computer (PC) on the same LAN.
Before connecting the PMC-1 v4 to your LAN, try pinging each of them from your PC. This can normally be done from a command prompt by typing:
ping 192.168.0.250
and:
ping 10.0.0.250
If the resulting message is similar to “Request timed out” that is good because there is not already a device using that IP address on the LAN.
Connect the PMC-1 v4 to the LAN using an Ethernet cable, and connect it to power using its wall mount transformer connected to the green terminal block. Ping the two IP addresses from your PC a few times alternately with a few seconds pause between, or watch the LEDs and ping the appropriate IP address while the PMC-1 v4 is listening to that address. If the ping indicates a reply was obtained, you will be able to set up the PMC-1 v4 via HTML using a browser.
Once the PMC-1 v4 receives a connection on either default IP address (even just a ping), it will permanently use that static IP address unless it is changed manually in the Setup page. It will never again listen on two alternating IP addresses.
Note that if the PMC-1 v4 is later moved to another LAN where it needs a different IP address, it will need to be reprogrammed by the USB programming cable method.
The PMC-1 v4 will need its current or default IP address changed to a new static IP address. This can be done by using the PMC-1 v4’s programming port.
Once the PMC-1 v4 has a static IP on the network, its operating parameters can be set up using a browser by entering the PMC-1 v4’s IP address in the browser URL line. The PMC-1 v4 will respond with a page headed by:
“Brayden Automation PMC-1 v4 Pulse to MODBUS Converter”

SOLID STATE INSTRUMENTS
a division of Brayden Automation Corp.
6230 Aviation Circle, Loveland, Colorado 80538
Phone: (970)461-9600
E-mail: support@brayden.com
Brayden Automation Corp./Solid State Instruments div.
6230 Aviation Circle
Loveland, CO 80538
(970)461-9600
support@brayden.com
www.solidstateinstruments.com

References

• Data Communication Solutions | Simply Modbus Software
• Title

Read User Manual Online (PDF format)

Download This Manual (PDF format)

Download this manual  >>