1. HART, SNMP, TNM, BacNet, MMS
Industrial Automation
Automation Industrielle Industrielle Automation
Device Management Protocols Protocoles de gestion des appareils Gerätezugangsprotokolle 4.
4.1
HART, SNMP, TNM, BacNet, MMS
Prof. Dr. H. Kirrmann
ABB Research Center, Baden, Switzerland

2. Contents
This part treats device remote access in order of increasing complexity
4.1.1 current loop mA
4.1.2 HART
4.1.3 SNMP: Simple Network Management Protocol
4.1.4 Train Network Management
4.1.5 BACnet
4.1.6 Manufacturing Messaging Specification

3. The classical solution for analog values
4.1.1 Current Loop
The classical solution for analog values

4. Field device: example differential pressure transducer
4..20 mA current loop
fluid
The device transmits its value by means of a current loop

5. 4-20 mA loop - the conventional, analog standard (recall)
The 4-20 mA is the most common analog transmission standard in industry
sensor
transducer
reader
reader
reader
voltage source
10V..24V 1 2 3
i(t) = f(v) v
RL1 R1
RL2 R2
RL3 R3
RL4
RL4 conductor resistance
i(t) = 0, mA
The transducer limits the current to a value between 4 mA and 20 mA, proportional to the measured value, while 0 mA signals an error (wire break)
The voltage drop along the cable and the number of readers induces no error.
Simple devices are powered directly by the residual current (4mA)
allowing to transmit signal and power through a single pair of wires.

6. 4.1.2 HART
Data over mA loops

7. HART - Principle
HART (Highway Addressable Remote Transducer) was developed by Fisher-Rosemount to retrofit 4-to-20mA current loop transducers with digital data communication.
HART modulates the 4-20mA current with a low-level frequency-shift-keyed (FSK) sine-wave signal, without affecting the average analogue signal.
HART uses low frequencies (1200Hz and 2200 Hz) to deal with poor cabling, its rate is 1200 Bd - but sufficient.
HART uses Bell 202 modem technology, ADSL technology was not available in 1989, at the time HART was designed

8. Hart frame format (character-oriented):
HART - Protocol
Hart communicates point-to-point, under the control of a master, e.g. a hand-held device
Master
Slave
command
Indication
Request
time-out
response
Response
Confirmation
Hart frame format (character-oriented):
preamble
start
address
command
bytecount
[status]
data
data
checksum
5..20 (xFF) 1
1..5 1 1
[2] (slave response)
0..25 (recommended) 1

9. total 44 standard commands
HART - Commands
Universal commands (mandatory): identification, primary measured variable and unit (floating point format) loop current value (%) = same info as current loop
read current and up to four predefined process variables
write short polling address sensor serial number instrument manufacturer, model, tag, serial number, descriptor, range limits, …
Common practice (optional) time constants, range, EEPROM control, diagnostics,…
total 44 standard commands
Transducer-specific (user-defined) calibration data, trimming,…

10. HART - Importance
Practically all 4..20mA devices come equipped with HART today
About 40 Mio devices are sold per year.
more info:

11. (Simple Network Management Protocol for the Internet)
4.1.3 SNMP
(Simple Network Management Protocol for the Internet)

12. SNMP (Simple Network Management Protocol) - Principle
Oldest protocol for management of computer networks
simple node: addresses, protocols, performance
Network Management Station
SNMP
Agent Protocol
Machine
MIB
router, bridge,firewall,… routing & translation tables
domain name server: directories
router
router
MIB
MIB
Network Management Station

13. SNMP - Access to Managed Objects
User
User
manager
agent
interface
interface
object interface
MIB
managed
information
base
Manager
Agent
call
(request)
call
(indication)
reply
(confirm)
reply
(response)
UDP
UDP IP IP
ISO Type 1
ISO Type 1
ISO (Ethernet)
Token
Ring
ATM
ISO (Ethernet)
Token
Ring
ATM
management
messages
internet

14. SNMP - Assumptions about the underlying communication network
- the network is connectionless (datagrams): only UDP is used (no TCP).
- manager and agent can send spontaneously messages to each other
- all entities must be able to receive and send packets of at least 484 octets
- the network must be able of broadcasting (!)

15. SNMP - Which are the MIB objects ?
TCP/UDP/IP (171 objects)
NT network (90 objects)
DHCP (14 objects)
WINS (70 objects)
Appletalk
Nowell
IPX
DecNet
…..
CISCO (proprietary)
The objects are mostly parameters, statistics and error counters used exclusively for
the communication itself

16. SNMP - Operations on objects
There are only five operations:
Get (read)
GetNext (transversal reading)
GetResponse (retrieve response)
Set (alter)
Trap (asynchronous agent notification)
Since SNMP does not provide authentication, “Set” commands are normally disabled,
Traps are seldom used.

17. SNMP - How are objects identified ?
ISO defined a world-wide addressing scheme on a hierarchical basis:
MIB objects are identified by a concatenation of identifiers
(e.g = atInput)
quite wasteful, but bearable in LANs

18. SNMP - Importance
SNMP (SNMP 2) is the keystone for data network management of the Internet
It is restricted to the manipulation of communication components.
It introduced the concepts of MIB (Managed Information Data base)
and universally addressable objects

19. 4.1.4 Train Network Management - Principle
The TNM (Train Network Management) was developed in 1995 for the Train Communication Network (TCN), an on-board network characterized by modest speed (1,0 resp. 1.5 Mbit/s) and specific operations (e.g. autonumbering of vehicles).
It allows to control not only the communication stack,
the routers and the gateways, but also application variables, downloading and
start/stop of processes, …
Device
slide door
Made by
Westinghouse
Model
Crank2000
Serial Number W
Software
Status
closed
Openings
1554
MVB = vehicle bus
door
air condition
passenger info
light
power
brakes
vehicle equipment
maintenance tool

20. Network Management defines a set of services for:
TNM - Services
managed objects
agent
agent
agent
PLCs
network
manager
SPY
engineering
workstation
agent
agent
agent
simple devices
Network Management defines a set of services for: •
development, testing and conformance testing •
commissioning: configuration, downloading, routing and marshalling •
operation: error and performance monitoring •
maintenance: evaluation of error reports, access to equipment information
Transmission of network management data takes place interleaved with transmission of time-critical variables

21. TNM - Summary of managed objects
station
MVB link
WTB link
messenger
variable
domain
task
clock
journal
equipment
objects
objects
objects
objects
objects
objects
objects
object
object
objects
status
status
status
status
task 1
domain
control
control
control
Function
Directory
task 2
reservation
devices
topography
task 3
inventory
Station
Bindings
domain
Directory
task 4
bus administrator
Group
Directory
Node
remote
access to
variables
log for
debugging
Directory
databases and tasks
communication management
All objects have read or write services, and special services such as:
force
set_up
start
reserve
unforce
download
stop
release
upload
bindings
attach
verify_domain

22. there are no events, i.e. no spontaneous calls from Agent to Manager
TNM - Communication
All communication is by Remote Procedure Calls (paired Call from Manager with Reply from Agent)
there are no events, i.e. no spontaneous calls from Agent to Manager
Manager
Agent
call
Indication
Request
time-out
reply
Response
Confirmation
A management session is initiated by the manager writing to the reservation object,
(a lock which reserves the device for this manager until freed or timed out).
Domain download has a special state machine at Manager and Agent since it writes into flash memory (segment after segment).

23. TNM - Importance
TNM is limited to the TCN, it is the base for vehicle diagnostics and remote monitoring
over the Internet.
It is an optimised, minimal set of services, which cannot be extended outside of TCN.
It has strongly been influenced by MMS (see later).

24. The building automation messaging specification
4.1.5 BacNet
The building automation messaging specification

25. BACnet - Building Automation & Control Network
BACnet is a standard for information interchange in building automation issued by
ASHRAE (American Society of Heating, Refrigerating and Air-Conditioning Engineers)
It is a lightweight version of MMS intended for simple devices, and intended to be the sole
information exchange protocol of these devices with other devices.
BACnet is not a network in itself, it is a message interchange convention which makes use
of existing networks such as LON, Ethernet, …
Its origin is in now-extinct building automation busses (M/S) and Echelon’s LonWorks.
Ethernet and TCP/IP came later.
It does not cover EIB (a popular building automation bus), but EIB adapters exist.

26. BACnet - Network concept
clients
air
condition
control
intrusion
access
logging
housekeeper
and
tenant
backbone (e.g. Ethernet)
BACnet
server
gateway & local control
gateway & local control
router
room
controller
BACnet
servers
BACnet
servers
direct wiring
EIB
LON centralized
LON decentralized
BACnet
server
BACnet
server
BACnet
servers
BACnet
servers

27. BACnet Application Layer
BACnet - Stack
“Application”
BACnet Application Layer
BACnet Network Layer
“Network”
MS/TP
PTP
ISO Type 1
BVLCI
UDP IP
any network
“Link”
LonTalk
ISO (Ethernet)
Arcnet
RS 485
RS 232
Physical
obsolete
new (Appendix J)
BACnet duplicates much of the (possible) functionality of the communication stack.
For instance, it has its own message segmenting protocol and operates with datagrams
(connectionless).

28. BACnet - Requirements to the communication system
Devices should be able to communicate directly with peer devices on their network;
Devices should be able to do local broadcasts, received by all peer devices on their network (for unconfirmed services);
Devices should be able to send remote broadcasts to devices residing on networks with different network numbers;
Devices should be able to do global broadcasting.
These requirements are difficult to fulfil on TCP/IP, but a proposal for UDP/IP exists,
by way of a special device, the BACnet Broadcast Management Device" (BBMD)

29. BACnet - Object model
32-bit BACnet Object Identifier: unique and valid throughout an installation
10-bit type
22-bit object instance
Object
Device Object
(one per device)
Object
Object
property0
Object
property1
property..
Object
Within a device, an object is identified by its 32-bit object identifier.
Objects are identified in the whole network by the concatenation of their device object
identifier and their own object identifier (64 bits).
Properties of an object are identified by a 32-bit BACnetPropertyIdentifier

30. BACnet - 21 Object types
0 Analog Input Sensor input
1 Analog Output actor input
2 Analog Value analog parameter
3 Binary Input switch
4 Binary Output relay
5 Binary Value Binary parameter
6 Calendar Event scheduling by date
7 Command generic command
8 Device describes and controls the device
9 Event Enrolment events and alarm declaration
10 File data file
11 Group device grouping
12 Loop control loop
13 Multi-state Input device with multiple states
14 Multi-state Output status of devics with multiple states
15 Notification Class list of devices to be notified of event and alarm
16 Program start, stop, status of program
17 Schedule weekly event scheduling
18 Averaging minimum, maximum and average value
19 Multistate Value multiple status value
20 Trendlog logging of properties for a set criteria
Application-specific
Events

31. BACnet - Simple object: Analog input object
lim
Alarm
A/D
converter d dt
From the plant
ChangeOfValue
lim
Alarm
Present_Value
Units
Update interval
Max_Pres_Value
Min_Pres_Value
Alarms&Events
(main properties)

32. BACnet - Example of simple object: Analog input object properties
Property Identifier
Property Data Type
Code
Conformance
Object_Identifier
Object_Name
Object_Type
Present_Value
Description
Device_Type
Status_Flags
Event_State
Reliability
Out_Of_Service
Update_Interval
Units
Min_Pres_Value
Max_Pres_Value
Resolution
COV_Increment
Time_Delay
Notification_Class
High_Limit
Low_Limit
Deadband
Limit_Enable
Event_Enable
Acked_transitions
Notify_Type
BACnetObjectIdentifier
CharacterString
BACnetObjectType
REAL
BACnetStatusFlags
BACnetEventState
BACnetReliability
BOOLEAN
Unsigned
BACnetEngineeringUnits
BAcnetLimitEnable
BACnetEventTransitionBits
BacnetEventTransitionBits
BACnetNotifyType R R1 O O2 O3
10 bit object type + 22 bit object instance corresponding visible string
here: ANALOG_INPUT actual value
user defined
description of sensor (not device), e.g. “TC103”
{IN_ALARM, FAULT, OVERIDDEN, OUT_OF_SERVICE}
{NO_FAULT, NO_SENSOR, OVER_RANGE,…}
in 10 ms increments
square meters (0), square feet (1), milliamperes (2)(?!)
range of the present value
a change by more than this value causes an event
(optional) notification class to which this object is tied
exceeding these limits triggers an event
1: writable if Out_of_service=true 2: mandatory if COV_reporting 3: mandatory if intrinsic reporting

33. BACnet - Analog Input Object Example

34. BACnet - Complex Object: Loop object (PID controller)
Setpoint_Ref
Setpoint
PID Ki
Analog Value Object dt AO
Plant AI
Setpoint Kp
lim d dt Kd
Integral_Constant
Proportional_Constant
manipulated variable
Derivative_Constant
Max/Min_Output
Present_Value
Manipulated_Var_Ref
Analog Output Object
Controlled_Var_Ref
controlled variable
Loop Object
Present_Value
Analog Input Object

35. BACnet - Complex object: loop object properties
Object_Identifier
Object_Name
Object_Type
Present_Value
Description
Status_Flags
Event_State
Reliability
Out_Of_Service
Update_Interval
Output_Units
Manipulated_Var_Ref.
Controlled_Var_Ref.
Controlled_Var_Value
Controlled_Var_Units
Setpoint_Ref
Setpoint
Action
Proportional_Constant
Proportional_Const_Units
Integral_Constant
Integral_Const_Units
Derivative_Constant
Derivative_Const_Units
Bias
Maximum_Output
Minimum_Output
Priority_For_Writing
COV_Increment
Time_Delay
Notification_Class
Error_Limit
Event_Enable
Acked_transitions
Notify_Type
BACnetObjectIdentifier
CharacterString
BACnetObjectType
REAL
BACnetStatusFlags
BACnetEventState
BACnetReliability
BOOLEAN
Unsigned
BACnetEngineeringUnits
BACnetObjectPropertyReference
BACnetSetpointRefence
BACnetAction
BACnetEventTransitionBits
BACnetNotifyType
Property Identifier
Property Data Type CC R O O1 O2 O3 O4 O5
Conformance
10 bit object type + 22 bit object instance corresponding visible string
here: LOOP actual value
user defined
description of sensor (not device)
references to the three analog objects associated with the loop
{direct, reverse}
PID controller parameters

36. BACnet - Events
Events are change of value of any object in a device (including the device object)
There are three kinds of event:
1) change-of-value (COV) event: a client subscribes with a server to a certain event
2) intrinsic events: changes to configuration
3) algorithmic events: calculations based on values according to a formula

37. BACnet - Event Enrolment
Property Identifier
Property Data Type CC
Meaning
Object_Identifier
Object_Name
Object_Type
Description
Event_Type
Notify_Type
Event_Parameters
Object_Property_Reference
Event_state
Event_Enable
Acked_Transition
Notification_Class
Recipient
Process_Identifier
Priority
Issue_Conformed Notifications
BACnetObjectIdentifier
CharacterString
BACnetObjectType
BACnetEventType
BACnetNotifyType
BACnetEventParameter
BACnetObjectPropertyReference
BacnetEventState
BACnetEventTransitionBits
BacnetEventTransitionBits
unsigned
BACnetRecipient
Unsigned
BOOLEAN R O O1 O2
10 bit object type + 22 bit object instance corresponding visible string
here: ANALOG_OUTPUT user defined
algorithm, see next slide
alam, event, ack-notification
see next slide
unique property identifier
{normal, fault, offnormal, high_limit, low_limit,..}
ONE OF (to-offnormal, to_fault, to_normal)
pointer to notification object
device OR address handle within notified recipient
priority
this object is present in the event server (the one which takes the initiative)
the BACnet client has no corresponding object
1: only if Notification Object used 2: only if Notification Object not used

38. BACnet - Event_Type, Event_States and Parameters
Meaning
CHANGE_OF_BITSTRING CHANGE_OF_STATE
CHANGE_OF_VALUE
COMMAND_FAILURE
FLOATING_LIMIT
OUT_OF_RANGE
NORMAL OFFNORMAL
NORMAL HIGH_LIMIT
LOW_LIMIT
Time_Delay Bitmask List_Of_Bitstring_Values
Time_Delay, List_Of_Values
Time_Delay Bitmask Referenced_Property_Increment
Time_Delay Feedback_Property_Reference
Time_Delay
Setpoint_Reference Low_Diff_Limit Hi_Diff_Limit Deadband
Time_Delay Low_Limit Hi_Limit Deadband
seconds to wait before trigger
relevant bits in bitstring
several bitstrings
seconds
reaching one of these states triggers
either bit mask (BITSTRING) or value change (REAL) which triggers
BACnetObjectPropertyReference
Setpoint_Reference REAL
REAL
REAL REAL

39. BACnet - Notification Object
Property Identifier
Property Data Type CC
Meaning
Object_Identifier
Object_Name
Object_Type
Description
Notification_Class
Priority
Ack_Required
Recipient_List
BACnetObjectIdentifier
CharacterString
BACnetObjectType
Unsigned
BACnetARRAY[3] of Unsigned
BACnetEventTransitionBits
List of BACnetDestination R O
10 bit object type + 22 bit object instance corresponding visible string
here: NOTIFICATION CLASS user defined
reference given to event-generating object
List of destinations, with for each the address
of the recipient along with its entry point,
the time window during which the event is
relevant, and whether an acknowledgement is
required to clear the event.

40. BACnet - Importance
BACnet is slowly becoming an established standard in building automation.
It is supported by most firms in the building automation business.
Although it started as an “MMS”-light, it has acquired in the years about the same
complexity as its model.

41. The Original Manufacturing Messaging Specification (MMS)

42. MMS - Manufacturing Message Specification
Developed 1980 (!) for the MAP project (General Motor’s flexible manufacturing initiative)
Originally unluckily tied to the OSI communication stack and Token Bus (IEEE 802.4)
Reputed for being heavy, complicated and costly due to poor implementations.
Boeing adopted MMS as TOPs (MMS on Ethernet), a wise step.
Adopted by the automobile industry and power distribution
Standardized as:
[1] ISO/IEC : Industrial Automation systems - Manufacturing Message Specification -
Part 1: Service Definition (IS 1990)
[2] ISO/IEC : Industrial Automation systems - Manufacturing Message Specification -
Part 2: Protocol Specification (IS 1990)

43. MMS - Application field
schedule
robot configuration

44. MMS - Concept
MMS (Manufacturing Message Specifications) defines:
• A set of standard objects which must exist in every conformant device, on which
operations can be executed (example: local variables, read and write) or which
can start spontaneously a transmission
• A set of standard messages exchanged between a manager and an agent station
for the purpose of controlling these objects
• A set of encoding rules for these messages
• A set of rules for exchanging messages between devices (basic protocol)
MMS does not specify application-specific operations(e.g. change motor speed).
This is covered by application-specific, “companion standards” (e.g. flexible manufacturing, drives, remote meter reading)

45. MMS - Distributed Control System mode of operation
MMS Clients
MMS client process database
(cache)
MMS Servers
MMS server process database
1) Polling:
a) the bus scans periodically the variables and actualises the local databases
b) the Operator Workstation polls cyclically the variables it is interested in
2) Events:
a) the Controllers signal predefined events and broadcasts the corresponding values
b) the Operator Workstation defines the relevant events and their destination(s)

46. MMS - Example: External view of a PLC device
Human-Machine Interface
Journal
programs
keep track of
debugging
Operator
Station
domains
(download / upload memory)
Files
file store
variables
events
only if mass storage available
named
variables
unnamed
variables
events
& alarms
program variables
state machines for alarms and events
memory locations and markers

47. MMS - Manufacturing Message Specification
device
device
MMS specifies a set
(e.g. SCADA)
MMS specifies a set
(e.g. PC)
of messages which
of objects which
allow an MMS client
an MMS server is
to control an MMS
MMS
client
expected to contain
MMS
server
server
remote
request
response
procedure
(command)
(reply)
call interface
communication
stack
communication
stack
network
linking
device
(example)
router

48. MMS - Basic Communication Principles
MMS assumes that the communication stack offers two services:
MMS Requester
MMS Responder
(client)
network
(server)
Request
Indication 1)
Remote Procedure Call
(Call paired with Reply,
synchronous, unicast)
processing
Confirmation
Response 2)
Event Reporting
event
(spontaneous messages sent
by server)
Request
Indication
MMS does not specify how to address clients and servers.
Messages contain only a communication reference (number which identifies the
connection) obtained by unspecified means.

49. MMS - Communication Stack
Association Control Service Element, ACSE, ISO 8649/8650, N2526,N2327
“Application”
Abstract syntax notation,ISO 8822/8823, 8824/8825
Presentation
ISO 8326/8327
Session
ISO 8073 Class 4
Transport
ISO 8473 connectionless
Network
ISO Type 1
Link
ISO (Ethernet)
ISO
MAC
(token bus)
Physical
quite heavy… Boeing decided to drop ISO for TCP/IP, is called "TOP".

50. MMS - Concept of Virtual Manufacturing Device
A virtual device represents a piece of equipment
A physical device may support one or more virtual devices in parallel
e.g.
viscometer
valve
flowmeter
Virtual
Virtual
Virtual
Device
Device
Device
Application Programming Interface
connection
(MMSI = MMS interface)
MMS messages
establishment
communication
ACSE
stack
presentation
session
transport
network
link
physical

51. MMS - Virtual Manufacturing Device (VMD)
An element of typed data (e.g.
integer, floating point, array, etc.)
A runnable program consisting
of one or more domains.
Named
A list of variables
Variable
named as a list.
Program
Named
Invocation
Variable List
Represents a resource
A description of
(e.g. a program) within
the format of a
the VMD.
Domain
. The device itself is
Types
a VMD object
variable's data.
A display and
Operator
A file in a
keyboard for use
Transaction
File
file store or
Station
by an operator.
fileserver.
Journal
Semaphore
A time based
An object used to
record of events
control access to a
and variables.
Event
shared resource.
Event
Condition
Represents an individual MMS
Enrolment
Event
service request. Not a
named object.
Action
An object that
Represents the action
Which network application to
represents the
taken when an event
notify when an event condition
state of an event.
condition changes state.
changes state.

52. MMS - 84 Services on the objects
Domain
VMD
Management
Support
Variable
Environment
Access
and General
Management
MMS
Semaphore
Services
File
Management
Management
Event
Operator
Management
Journal
Communication
Management
1. Creation - Deletion
2. Read (Get, Report)
3. Modify (Alter)
4. Invoke (for domains)
5. Operate (Start, Stop,…)

53. MMS - Variables
Through the “Variables” service, a client can read and write local variables in a remote device.
Variables are identified by the address of the device and either a local address or a name.
Variables can be read or written as individual variables (not very efficient) or as lists.
In the latter case, a variables list object on the remote device is used.
Consistency can be ensured by scattered access.
The type of the variable (Real, Unsigned,….) defines its data representation, it is stored in
a Named Type object.

54. MMS - Types
MMS defines the following simple variable types:
BOOLEAN
BIT STRING
BOOLEAN ARRAY
INTEGER
UNSIGNED
FLOATING POINT (IEEE 754)
REAL (8824)
OCTET STRING
VISIBLE STRING
GENERALIZED TIME
BINARY TIME
BCD
OBJECT IDENTIFIER
Array
Structures

55. MMS - Variable Access Services
Read read a remote variable
Write write a remote variable
InformationReport(optional) spontaneous send the value to a client
DefineNamedVariable assigns named variable to an unnamed & type
GetVariableAccessAttributes
DefineScatteredAccess
GetScatteredAccessAttributes
DeleteVariableAccess
DefineNamedVariableList defines lists of variables
GetNamedVariableListAttributes
DeleteNamedVariableList
DefineNamedType defines the types
GetNamedTypeAttributes
deleteNamedType

56. MMS - Domains
Domains are named memory regions, for the purpose of downloading
and uploading large unstructured variables such as program code.
Domain loading / uploading requires a special protocol because it can involve the
MMS driver itself or even the communication stack.

57. MMS provides services to:
MMS - Event services
MMS provides services to:
- Event Condition (define the boolean condition that triggers an event and its priority)
- Event Enrolment (define the MMS client(s) to notify when an event is triggered)
- Event Action (define the MMS confirmed service to be executed when the event occurs)
MMS client
MMS client
DefineEventCondition
EventNotification
AlterEventCondition
AckEventNotification
VMD
(MMS server)
enables/disables event conditions
Event
Enrolment
Event
Condition
Event
Action
Who?
When?
What?
event notification and confirmation
Events are the most complicated part of MMS

58. AckEventNotification
MMS - Event triggering
MMS client
MMS client
TriggerEvent
EventNotification
AckEventNotification
VMD
NETWORK-TRIGGERED
Event
Enrolment
Event
Condition
Event
Action
boolean variable
MONITORED
cyclic monitoring
plant
events are triggered by a change in a boolean variable in the server (monitored event) or
by an MMS client (trigger event) as an invitation procedure

59. (Requesting MMS-user) (Receiving MMS-user)
MMS - Primitives
MMS Responder
MMS Requester
(Requesting MMS-user)
(Receiving MMS-user)
Request
Indication
Confirmation
Response
M_Associate_Req(
M_Associate_Ind(
MMS_responder_address,
MMS_responder_address,
calling_application_reference,
calling_application_reference,
called_application_reference,
called_application_reference,
communication_parameters,
communication_parameters,
authentication,..
authentication,..
shorter form to describe parameters....

60. rather than an actual implementation.
MMS - Importance
MMS is becoming (after 12 years of existence) a reference model for industry
rather than an actual implementation.
Its high complexity makes it very general, but difficult to implement
It gave rise to several other "simpler" models (DLMS, BacNet, ....)
It is the base of the Utility Communication Architecture (UCA), an EPRI-sponsored
standardisation of data exchange between control centers.
For more information, see:

61. MMS - Users
Renault,
FIAT,
British Aerospace,
Bull,
Computervision,
Dassault Systèmes,
IBM,
Matra Datavision,
Silicomp,
Fraunhofer Institute,
Daimler-Benz.
Esprit Projects:
CNMA (1996), CIMOSA,…

62. 4.1.7 MMS companion standards
MMS does not define the meaning of the exchanged information.
For this, companion standards exist, such as:
IEC/ISO Industrial automation systems - Manufacturing message specification - Part 3: Companion Standard for Robots (1992)
Part 4: Companion Standard for Numeric Control (1993)
Part 5: Companion Standard for Programmable Controllers (1997)
Part 6: Companion Standard for Process Control (1994)
One standard which emerged in direct line from MMS is the IEC 61850
„Communication networks and systems in substations“
IEC defines an MMS implementation based on Ethernet,
and elaborates on the object model.
It is currently being developed at ABB, Siemens and Alstom for substation automation.

63. IEC 61850 - Example of Object Description
Key Attribute: PointName
Attribute: PointType (REAL, STATE, DISCRETE)
Constraint PointType=REAL
Attribute: PointRealValue
Constraint PointType=STATE
Attribute:PointStateValue
Constraint PointType=DISCRETE
Attribute: PointDiscreteValue
Attribute: QualityClass: (QUALITY, NOQUALITY)
Attribute: CurrentSource (TELEMETERED, CALCULATED, ENTERED, ESTIMATED)
Constraint: QualityClass = QUALITY
Attribute: Validity (VALID, HELD, SUSPECT, NOTVALID)
Attribute: NormalSource (TELEMETERED, CALCULATED, ENTERED, ESTIMATED)
Attribute: NormalValue (NORMAL,ABNORMAL)
Attribute: TimeStampClass: (TIMESTAMP, NOTIMESTAMP)
Constraint: TimeStampClass = TIMESTAMP
Attribute: TimeStamp
Attribute: TimeStampQuality: (VALID, INVALID)
Attribute: COVClass: (COV, NOCOV)
Constraint: COVClass = COV
Attribute: COVCounter

64. Conclusion
Although MMS itself had little success, the concepts behind MMS have inspired numerous other standards.
Industrial Communication protocols require a comfortable bandwidth and a certain
processing power at the servers, which is incompatible with low-cost, decentralized periphery, but fully in line with the concept “Ethernet in the factory floor”.
While HART, NIST and TCN are able to connect relatively simple devices, the same is not true for MMS and its derivatives.
The MMS concept is being challenged by OPC/COM/DCOM and by Web Services,
but these protocols address a lower level in the communication stack.