Protocols & Integration Technologies

How a Protocol Becomes Points in a Station

Every driver in Niagara has the same three-level shape: a network under the station's Drivers container, devices under the network, and points under each device. The point itself is an ordinary control point, identical to one holding a calculated value. What makes it live is the proxy extension attached to it, which holds the field address, the conversion and the facets that turn a raw reading into engineering units at a defined precision, and the tuning policy that sets the minimum and maximum time between updates and the point at which a value is considered stale.

Once a value is a proxy point, everything above it stops caring which protocol produced it. Logic, alarm extensions, histories and graphics attach to a Modbus register and a BACnet analog value in exactly the same way, which is what makes a mixed station one system rather than several running side by side in one box.

• Network level. Driver-wide settings live here: the poll scheduler and its rate buckets, the worker queue, and for serial drivers the port, baud rate, parity and stop bits. A rate changed here changes it for every device beneath it.
• Device level. The address the driver uses to reach the equipment (a BACnet device instance, an IP address plus unit ID for Modbus TCP, a subnet and node for Lon), the ping monitor that tracks reachability, and, where the protocol supports it, device extensions sitting beneath the device in the station tree that import its own alarm, schedule and trend log objects instead of rebuilding them in the station.
• Proxy point level. The field address and whether the point reads, writes or both. A BACnet write lands in a slot of the object's priority array, so releasing a write does not return the object to its previous value but to whatever lower priority still holds one, or to the relinquish default if none do.

Names, Tags and What a Rename Costs Later

Discovery names points after the vendor's own artifacts. What arrives is AI_3, or a register offset, or a truncated abbreviation from the controller's configuration tool, because that is the only name the driver has to work with. Those names then propagate into histories, alarm messages, graphics bindings and every report built on top of them.

Renaming afterward is not free, and how expensive it is depends on how the references were written. A history takes its ID from the station and point name at the moment it is created; renaming the point later leaves the collected data under the old ID rather than following the point. Links and bindings written as slot path ords break on a rename, while handle ords survive it, because a handle refers to the component itself rather than to its position and name in the tree.

Tagging is the part that pays back. A tag dictionary lets a point carry what it measures and what equipment it belongs to independently of where it sits in the tree, so a BQL query or a Nav tree can gather every discharge air temperature on a site regardless of which driver produced it or how the vendor named it. Applied while each device type is being brought in, tagging is part of the same pass; applied afterward it is a separate one across every point already built.

Modbus Addressing and Word Order

The 40001 convention is documentation, not wire protocol. On the wire, reading holding register 40001 is function code 3 with a starting address of zero. Vendors write the same register as 40001, 4x0001, 400001 or 0, and some publish 1-based tables for devices that are 0-based, so the first thing to establish about any register list is which convention it uses.

An off-by-one does not announce itself. Adjacent registers in a device map usually hold quantities of the same type and similar magnitude, so a whole block shifted by one register still returns numbers that sit in the range an operator expects. Verifying two points at opposite ends of a block against the device's own display exposes it, because a shifted block runs past its own end: the last register lands in an unrelated part of the map or returns an exception while the first still looks ordinary.

• 32-bit values occupy two consecutive 16-bit registers, and Modbus does not specify which word comes first. A float read with the words reversed lands wildly out of range or near zero, which is at least visible; the same reversal on a 32-bit counter can produce a number that merely looks large. Many devices expose a word order setting, and it is worth reading before assuming the driver is at fault.
• Function code 3 reads holding registers and function code 4 reads input registers, and those are separate address spaces. The same numeric address in the wrong space returns an unrelated value on some devices and an exception on others.
• An exception response is the device answering rather than failing to answer. Code 02 means that address does not exist in its map; code 03 means the quantity or value is outside what it accepts.
• Modbus TCP carries a unit identifier. A native TCP device usually ignores it, but a serial gateway uses it to select which RTU slave behind it a request is for, so one IP address with several unit IDs is several devices, each needing its own device entry.
• The response timeout is the only evidence available that a device has stopped answering, so the timeout value and retry count decide how quickly that becomes visible.

Ports, Discovery and What the Network Has to Allow

BACnet/IP runs over UDP, normally on port 47808 (0xBAC0), and its discovery mechanism is a broadcast. Who-Is does not cross a router, so a station on one subnet discovers nothing on another until either a BBMD exists on each subnet with the others in its broadcast distribution table, or the station registers as a foreign device with a BBMD that has room for it. Foreign device registration carries a time to live and has to be renewed, which is why a station can discover devices one week and see none the next with no configuration having changed. A device that answers a directed read but never appears in a discovery is the signature of a broadcast problem, not of broken equipment.

MS/TP is token passing over RS-485, so a segment's throughput is shared and shaped by properties set on the devices themselves. Max_Master sets the highest MAC address the token is offered to; left at the default of 127 on a segment whose highest address is 12, every device spends part of each token rotation soliciting masters that do not exist. MAC addresses must be unique on the segment, and BACnet device instance numbers must be unique across the entire internetwork rather than just the segment, so two controllers shipped with the same default instance produce reads that contradict each other intermittently.

• RS-485 wants a daisy chain, with termination at the two physical ends only and bias applied once on the segment. Star wiring and long spurs often work at 9600 baud and fail at 38400, which makes the baud rate look like the cause when the topology is.
• A standard RS-485 segment is specified for 32 unit loads. Transceivers rated at a fraction of a unit load allow more devices than that, which is why some segments run well past 32 devices and others will not.
• COV subscriptions replace polling on devices that support them, but a subscription has a lifetime and has to be renewed. If a renewal is lost the device is still online and answering, so nothing about it looks wrong; the point simply stops changing.
• SNMP polls go out to UDP 161 and traps arrive unsolicited on UDP 162, so a firewall rule that permits polling can still drop every trap. v1 and v2c carry the community string in cleartext; v3 adds authentication and privacy but requires matching user and engine configuration at both ends.
• MQTT is a connection the station makes outward, usually to TCP 8883 with TLS, and never one it accepts, so it crosses a firewall that would block an inbound protocol. Retained messages and a last will topic are the only way a subscriber learns state that was published before it connected, or learns that the publisher dropped off.

Reading Point Status Before Opening a Tool

Niagara does not discard a value it cannot trust, it flags it, and the flags narrow the problem. Stale means the value did not refresh inside the maximum update time set in its tuning policy. Fault carries a cause string from the driver, and those causes are specific: an unknown object or property, an illegal data address, a write the device rejected, or a license limit reached on the host. Overridden means something inside the station, not the field, is holding the value.

Where the trouble sits in the tree points at the layer to examine, before any trace is enabled.

• Every device on one network failing at once: the network. Port, baud rate and parity on a serial driver; IP reachability and credentials on a network driver; or the converter or gateway they all share.
• One device failing while its neighbors on the same network read normally: that device's address, or the device itself. A wrong device instance, a wrong unit ID, or a duplicate MAC on an MS/TP segment all present this way.
• A single point in fault on a device whose other points are fine: that point's address, its data type, or a property the device does not actually implement despite listing the object.
• Nothing conclusive from the station: raising the driver's log level to trace records the actual requests and responses in the station log. On a serial network that shows whether the station transmitted at all, which separates a wiring or converter problem from a device that received the request and answered with an exception.