FATEK FBs-CMGSM PLC Communication Module User Manual

FATEK FBs-CMGSM PLC Communication Module

Introduction

FBs-CMGSM (CMGSM for short) is communication module for FATEK PLC systems FBs- xxMC. CMGSM uses the GSM network to transfer the data. CMGSM is based on the quad band GSM module (850/900/1800/1900 MHz). CMGSM is backed up by Li-Ion accumulator.
CMGSM offer three different ways of communication with connected PLC.
The first one is monitoring and remote control of PLC via SMS. CMGSM reads periodically PLC registers containing a flag to send SMS, if the flag is set, CMGSM reads destination phone number and string of characters (text), sends SMS and clears the flag. If there is a SMS received by CMGSM, it is written into PLC registers including another flag “SMS received” to be processed by PLC program. At the end the PLC program clears this flag. So these operational SMS must be processed by PLC program both on SMS reception and SMS sending. Some status and event SMS are predefined in CMGSM (e.g. “Connection to PLC failure”) and only the destination phone number have to be set in PLC registers.
The second way of communication with PLC via CMGSM is dial up data transfer via GSM network (CSD). The connection can be only incoming for CMGSM, that may be initiated from a control center for the purpose of remote system analysis and PLC software tuning and modification by WinProladder SW.
The third way of CMGSM communication over the GSM network is GPRS data connection using TCP/IP protocol. CMGSM opens the connection in TCP client mode. Any SIM card, that can provide internet connection over the GSM network, can be used. CMGSM connects to IP address and port specified in from PLC. It is important to notice, that the connection can be opened in direction from CMGSM to PC (server) only. PC cannot open a connection to CMGSM because CMGSM has no server implemented and usually does not have public IP address. GPRS has special data transfer properties (data grouping, data transfer delay 1 … 10 seconds), which are not suitable for WinProladder SW. WinProladder must use dial up data transfer (so called CSD) only.

Main features

• Three ways of GSM network use – SMS, GPRS, Data Call CSD (all of them practically at the same time)
• WinProladder remote GSM dial up data transfer connection (CSD)
• USB port for module monitoring
• One digital input IN and one digital output OUT
• Firmware update via GSM available
• Li-Ion backup accumulator – min. 2 days of operation w/o charging
• Lowest level super watchdog function (Hardware Power OFF)
• FBs-CMGSM can be used directly with PLC FBs-xxMC (Port 3)
• SMS functionality is fully under PLC program control
• Configuration of CMGSM means just to set several PLC registers
• No PLC program support is necessary for CSD and GPRS operation
• LEDs for indication of the CMGSM status and data flow signalization
• Unlimited number of logical and analog inputs and outputs can work with one CMGSM (PLC network)

1. GSM antenna connector
2. IO connector
3. SIM card holder
4. USB connector
5. DIN rail holder
6. FUNC button
7. Indication LEDs Rx, Tx
8. Flat cable for connection to PLC
9. Indication LEDs GSM, ERR

Content of the Delivery

• 1 pc of FBS-CMGSM
• 1 pc of antenna GSM-ANT05S
• 1 pc of 6 pin connector, pitch 3.81 mm
• 1 pc of CD with documentation

Typical Application, Installation

Note : FATEK PLC is not part of the delivery of this product. It is needed to order independently.

Warning
Turn off all power supply during installation of CMGSM to PLC to prevent damage to equipment!

Configuration

If a SIM card does not need PIN code, no configuration for basic use is necessary.
For the SIM card with PIN code the configuration in PLC is necessary. Read chapter 5.1 Configuration for more.

Hardware settings

• Switch off the power supply of PLC
• Connect GSM antenna
• Insert SIM card
• Connect the flat cable between CMGSM and PLC

Startup

Device status is indicated with blue GSM LED on the CMGSM front panel. Valid statuses are as follows:

occurs after start of device for approx. 30 seconds. If it remains, check: SIM card (is inserted?, is valid?) Antenna (is connected?) Configuration (is SIM PIN correct?)
75 ms on / 3 s off| Device is logged into the GSM network and is idle. (It means that no GPRS nor CSD connection is active.)
75 ms on / 75 ms off / 75 ms on / 3 s off| GPRS active, no data
500 ms on / 50 ms off| GPRS active, data transfer in progress
permanently on| CSD (data connection) in progress

Expressed line is common operating state.

Front Panel

mode.
SIM CARD| SIM card Holder| Press the SIM card to remove it from holder
USB| Connector| USB connection to PC for debugging purposes
RCV| LED yellow| Receiving SMS
SND| LED green| Sending SMS

Pushbutton “FUNC”

Pushbutton “FUNC” has several functions. Short press changes the state of the output OUT (DOUT2). Long press (longer than 3 seconds) will either RESTART CMGSM (if CMGSM is powered by the PLC) or enter the STAND BY MODE (if the CMGSM is powered from the internal accumulator – PLC is either disconnected or turned off).

IO Connector

IO connector has 6 terminals. Terminals “+” “-” are intended for service purposes only – for test of an internal accumulator. Terminals IN (“IN1”) are for digital input.
Terminals OUT (“DOUT2”) are for digital output.

Function of the Device

SMS

One of the primary functions of the CMGSM is to send and receive SMS messages.
There are 2 kinds of SMS, which have different functions and purposes:

• SMS for and from PLC FATEK, see chapters 4.1.1. and 4.1.2
• Service SMS commands processed by CMGSM, see chapter 4.3

Outgoing SMS from PLC FATEK are sent by PLC program, that writes the text and destination phone number into PLC registers and orders CMGSM to send the message by write special value to another register (SendFlag). CMGSM sends SMS and writes result of the sending to PLC register (SendFlag). Incoming messages for PLC FATEK are received by CMGSM and the text and origin phone number are written into PLC registers. Subsequently in another register (RecvFlag) is written value, that signalizes new received SMS. PLC program analyzes the registers and deactivates flag RecvFlag. All the SMS structure and security features must be done by PLC program, including confirmation, that SMS was received, if required.
SMS messages, which contains characters “#!” (hash and exclamation) followed by access code, are sent and received by CMGSM itself and their function, structure and security features cannot be changed by user or PLC program. Incoming SMS of this kind are described in chapter 4.3 Service SMS Commands and are used to get information about CMGSM status, to reset CMGSM or to get current CMGSM configuration. Outgoing SMS of this kind are described in chapter 4.5 Events. Events, it is information about emergency status of CMGSM module like lost communication with PLC. These events are sent to a predefined phone number (Master in configuration).

Sending a SMS

CMGSM periodically tests the first register of the Send Record, standard base is D3800. The Send Record is an area in PLC registers which must be filled by program in PLC in order to send a SMS message. For structure of the record see the following table.

0x0001 – Command to send (written by program in PLC)
0x0003 – SMS is sending (written by CMGSM)
0x0000 – SMS sent successfully (written by CMGSM)
0x0004 – Failed while sending SMS (written by CMGSM)
D3810-D3819| SendDestAddress| Phone number where to send the
message. Length 20 characters.
D3820-D3899| SendUserData| Text of the message. Length 160 characters.

This range of registers cannot be used for any other purposes!

How does the CMGSM send a message:

Every register of Phone number or Text contains two characters. String of characters ends with special character 0x00. Examples:

• String with one character – “A”: D3820 = 0x0041
• String “TEXT”: D3820 = 0x4554, D3821 = 0x5458, D3822 = 0x0000
• String “HELLO”: D3820 = 0x4548, D3821 = 0x4C4C, D3822 = 0x004F

If the length of a phone number is exactly 20 characters (or 160 characters of text) then the character 0x00 at the end is omitted!

Base of Send Record (D3800) may be changed to another D or R register via configuration key REGSEND. Only register SendFlag (D3800) is changed during sending a message.

Example of sending a message “WE ARE THE CHAMPIONS!” to phone “123465”:
(Check register D3800 – SendFlag for value 0x0000 before sending the message!)

Receiving a SMS
Incoming SMS messages are saved into registers of PLC in Recv Record, standard base D3700. Structure of the record is in following table.

– Message received (written by CMGSM)
D3710-D3719| RecvOrigAddress| Phone number of the message sender (originator). Length 20 characters.
D3720-D3799| RecvUserData| Text of the message. Length 160 characters.

This range of registers cannot be used for any other purposes!

How CMGSM stores a received message:

Every register of Phone number or Text contains two characters. String of characters ends with special character 0x00. Examples:

• String with one character – “A”: D3720 = 0x0041
• String “TEXT”: D3720 = 0x4554, D3721 = 0x5458, D3722 = 0x0000
• String “HELLO”: D3720 = 0x4548, D3721 = 0x4C4C, D3722 = 0x004F

If length of phone number is exactly 20 characters (or 160 characters of text) the character 0x00 at the end is omitted!

CMGSM contains a queue of up to 100 SMS messages. After the queue is full all other SMS messages are discarded. If a power failure occurs all received messages in the queue are lost. Base of Recv Record (D3700) may be changed to another D or R register via configuration key REGRECV. No other registers are changed than the necessary ones.

Example of receiving of message “TEST MESSAGE.” from phone “+420123456789”:

GSM Data Connection (Data Call, CSD)

Data connection can be established anytime, even if GPRS communication is in progress.

Warning
There is no security mechanism against unauthorized data connection to PLC. So it is highly recommended to set security in PLC (password).

Service SMS Commands

Received SMS message with string ‘#!’ and password at the beginning are considered to be service SMS commands. These messages are not forwarded to PLC, but they are processed in CMGSM. Device will check for a valid access code (ACODE parameter in configuration) and if the access code is valid, the message is searched for keywords. Only one keyword in every SMS is executed.
Example of this SMS:

#!1234 INFO
#!998877 CONFIG

Table of all keywords:

e.g.
CMGSM: NETWORK=Vodafone CZ 77%
IN1=off OUT2=off
CSD=no connection GPRS=no connection PLC=connected
CMGSM v8.2
RESET| Device will respond with confirmation SMS and restart itself. PLC is not affected.
This command is used after change of configuration in PLC register to accept the changes by CMGSM.
CONFIG| Device will respond with current configuration. (Current configuration is a default configuration with some values changed by configuration string in PLC, see Chapter 5 – Configuration.)
FACTORY| CMGSM will respond with confirmation SMS. CMGSM will write default configuration to attached PLC and restart itself.
ON| Activate digital output OUT2
OFF| Deactivate digital output OUT2

TCP over GPRS

One of the primary functions of this device is to establish and maintain TCP connection from PLC to a server. In order to achieve this goal FBs-CMGSM has to make following steps after power up:
Establish connection to PLC via serial port. Parameters of the serial port are: 9600 baud, 7 data bits, EVEN parity, 1 stop bit, no hw handshake (it is default FATEK settings for all serial ports), address 01h.
After power on the FBs-CMGSM will proceed steps:

• Read configuration from PLC register D3900 – D3999.
• Login to the GSM network, using PIN from configuration.
• Attach to GPRS, using APN, USER and PASSWD from configuration.
• Establish and maintain TCP connection to SERVER on port PORT.

CMGSM will try indefinitely to read configuration from PLC at the beginning. If there is no serial communication between CMGSM and PLC device will not login into the GSM network! If there is no configuration in PLC or the configuration is damaged or other problem occurs CMGSM writes default configuration into the PLC.

GPRS can be controlled and monitored via set of registers in PLC and via configuration:

(written by PLC)
D3511| GprsState| 0x00=no connection, idle 0x01=connecting 0x80=connected
0x81=disconnecting
D3512| GprsCntErr| Error counter for connection
D3516-D3517| GprsCntUp| Data        counter,        direction        UP (= PLCðTCP), D3516 LSB
D3518-D3519| GprsCntDown| Data      counter,      direction      DOWN (= TCPðPLC), D3518 LSB
D3520-D3523| GprsLocalIP| Local IP address if connected. “0.0.0.0” if not connected. (D3520=MSB)
Example:
If local IP address is 147.32.80.1, then D3520 … 0x0093 (147d)
D3521 … 0x0020 (32d)
D3522 … 0x0050 (80d) D3523 … 0x0001 (1d)
D3524| GprsLocalPort| Local TCP port if connected, 0 if not connected
D3525-D3528| GprsRemoteIP| Remote IP address if connected. “0.0.0.0” if not connected. (D2425=MSB)
D3529| GprsRemotePort| Remote TCP port if connected, 0 if not connected

This range of registers cannot be used for any other purposes!

GPRS diagnostic is part of Diagnostic (see chapter Diagnostic). Base of Diag Record (D3500) may be changed to another D or R register via configuration key REGDIAG.

Events

Device can detect special events and send a warning about them as a SMS:

• Connection to PLC failure/restore

It is needed to set parameter MASTER in configuration for both of these events, see chapter 5.2 Basic Parameters.

Diagnostic

Diagnostics values are written to Diagnostic Record, standard base D3500. Structure of the record is in following table:

receive queue
D3500.8-15| DiagGsmReg| result of command AT+CREG: 0=not registered, not searching 1=registered, home network 2=not registered, searching 3=registration denied
5=registered, roaming
D3501.0-7| DiagSigQuality| Signal quality in percent (0-100) or 255 if unknown.
D3501.8-15| DiagSigErr| Signal BER (0-7) or 255 if unknown.
D3502| DiagAlive| CMGSM writes value 0x0001 whenever diagnostic record is refreshed (cca 6 seconds). This is intended for PLC program to check if CMGSM is alive. In this case PLC program will write a 0x0000 into this register and wait for 0x0001 here.
D3503| DiagVersion| Version of CMGSM3, in high byte is high
version number, in low byte is low byte is low version number
D3504| 0x0000| For future use
D3505| DiagReset| If PLC writes value 0xF3A5 to this register the CMGSM will make reset of itself.
D3506| DiagAtFlag| 0x0000 – Idle
0x0001 – Execute        command       in DiagAtCmd (written by program in PLC) 0x0003 – Command is about to execute (written by CMGSM)
0x0000 – Command executed successfully (written by CMGSM)
0x0004 – Exception while executing the command (written by CMGSM)
D3508-D3509| DiagUpTime| 32 bit counter which is incremented whenever CMGSM updates DiagRegisters area in PLC. The counter is cleared after restart of CMGSM. The counter value indicates in a certain way how long the CMGSM is running without restart (so called Uptime).
D3510-D3529| Gprs …| Reserved for GPRS diagnostics See chapter “TCP over GPRS” for details
D3530-D3539| DiagOperator| String with name of operator when registered. Empty string if not registered.
Length 20 characters.
D3540-D3549| DiagCredit| Reserved
D3550-D3699| DiagAtCmd| Sending AT commands to modem directly. Write a command to this place and set D3506 (DiagAtFlag) to 0x0001. Command is executed and result is placed in this place (overwriting original command). In D3506 (DiagAtFlag) is signalized end of execution. The system is the same as with sending SMS.

This range of registers cannot be used for any other purposes!

Notation D3500.x means x-th bit of D3500 register. For example D3500.0 is the least significant bit in register D3500. Another example D3500.8-15 are eight most significant bits in register D3500 (high byte).
Base of Diag Record (D3500) may be changed to another D or R register via configuration key REGDIAG.

Configuration

How to

Configuration for CMGSM is located inside PLC Fatek. Range of internal PLC registers D3900 – D3999 is used. Configuration itself is a string of characters. This string is created via WinProladder (software from PLC FATEK manufacturer), see following images. This range of registers cannot be used for any other purposes!

Step 1 – Right click on Table edit – ASCII Table and select “New ASCII Table”

Step 2 – Enter Table Name „cfg“ and Table starting address „D3900“. Then click “OK”.

Step 3 – Enter configuration string
“CMGSM3;PIN=7608;ACODE=998877;$” into field “ASCII Editor” and click on button “Output Preview”. !!! Warning: Change PIN according your real SIM card !!!

Step 3 (GPRS) – Enter configuration string
“CMGSM3;PIN=7608;APN=internet;SERVER=test.server.com;PORT=5700 ;ACODE=998877;$” into field “ASCII Editor” and click on button “Output Preview”. !!! Warning: Change PIN according to your real SIM card !!!

Step 4 – Select “Non Output Format” and click “OK”

Step 5 – Configuration string is now black. Click “OK”.

Step 5 (GPRS) – Configuration string is now black. Click “OK”.

Step 6 – Result

Configuration is read after power up and only once. If you change configuration (for example by WinProladder and second serial port), it is not read automatically. You have to restart CMGSM. CMGSM will try to log in the GSM network without PIN if no configuration in PLC is found. (In this case SIM card without PIN authorization is requested.)

Configuration string is very simple. For example:

CMGSM3;PIN=7608;ACODE=998877;MASTER=+420777777497;$

For easy understanding this string says:

• CMGSM3 – It is a configuration for CMGSM.
• PIN=7608 – PIN code of the SIM card in order to register into the GSM network.
• ACODE=998877 – Access code for Service SMS Commands is 998877
• MASTER=+420777777497 – Warning SMS is sent to this phone number in case of any event. For example “Connection to PLC failure.” when communication between CMGSM and PLC is lost or “IN1 activated (L-

  H).” when digital input IN (IN1) is activated respectively “IN1 released
  (H->L).” when digital input IN (IN1) is deactivated.

Example of configuration string for GPRS:

CMGSM3;PIN=7608;APN=internet;
[SERVER=test.server.com](http://SERVER=test.server.com);PORT=5700;ACODE=998877;$

This string means:

• CMGSM3 – It is configuration for CMGSM.
• PIN=7608 – User PIN code of ‘7608’ for SIM card in order to register into the network.
• APN=internet – Access Point (APN) is needed in order to use GPRS service in GSM network. In this example APN is ‘internet’.
• SERVER=test.server.com – It is a name of a server, to which CMGSM will connect. (Using TCP connection.)
• PORT=5700 – Use TCP connection to port 5700
• ACODE=998877 – Access code for SMS control is 998877

General format of these messages is following:

CMGSM3;KEY1=VALUE1;KEY2=VALUE2;...[;]$

Part ‘CMGSM3’ at the beginning of the string is mandatory. It is a stamp of validity.
Acceptable keys are shown in table below. Unknown keys are ignored, no spaces are allowed inside keys or values. Order of pairs is not important. Keys are not case sensitive, values are case sensitive. Maximum length of configuration string is 200 characters. At the end of each part MUST be character ‘;’ (semicolon), after last pair MAY be character ‘;’ (semicolon) and MUST be character ‘$’ (dollar).

Basic parameters