Firmware for Saia PCD® COSinus

Yes it’s possible to connect a PCD directly to the internet, but you have to protect your PCD against unauthorised access or cyber-attacks.

To protect the PCD against unauthorised access or cyber-attacks, it’s imperatively needed to take some protective measures.

Information about protective measures can be found on the support hp

If you need a PCD with cyber security levels SL3+ and based on ANSI ISA 62443 then checkout our PCD3.M6893 (QronoX PCD), this PCD was developed for cybersecure applications.

Information's can be found here.

In January 2024:
the COSinus BACnet FW 1.28.59 was put on the support homepage.  

In April 2022:
the COSinus FW 1.28.51 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

In February 2019:
the COSinus FW 1.28.37 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

In June 2017:
the COSinus FW 1.28.16 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.28.51/1.28.59 was put into production, which do support the BACnet Revision 14.
To support the BACnet Revision 9 it's necessary to use the PCD and the BACnet FW 1.26.xx.

Attention:
The firmware 1.28.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx, 1.26.xx or newer to a not compatible PCD

Firmware 1.28.59 (only BACnet firmware) (January 2024)

Main corrections

• BACnet: MI/MO/MV objects, invalid values for Alarm_Values and Fault_Values are rejected
• BACnet: BI/BV/BO objects, present value of can only be 0 or 1
• BACnet: COMMAND object, present value writing returns an error if bigger that the number of actions
• BACnet: Trendlog objects, property value check is done according to specifications
• BACnet: Limit COV subscription to 3000 and send PDU-Error if length of response is too big
• BACnet: Disable I-Have response when state is disable / disable-init
• BACnet: Calendar Object Date List, don’t allow wild card in this property entries
• BACnet: writing invalid array to Array properties returns correct Error code
• BACnet: Pulse Converter Object, send out-of-range PDU-Error if count processing is < 0
• BACnet: Controller goes to HALT with SWTO error
• BACnet: MS/TP Controller goes to HALT with SWTO error
• BACnet: Schedule accepts Sundays in Week and Day
• BACnet: GetEnrollmentSummary: correct reply if list is empty

Firmware 1.28.51 (April 2022)

Main corrections

• All PCD’s: Saia PCD Modbus diag does not work if diag flag > 9999
• All PCD’s: SNTP and hardware RTC is diverging from more than 2 seconds, then History message ‘RTC Fail error’ is generated
• All PCD’s: SNTP Time synchronization does not work with DHCP
• All PCD’s: E-Mails send from PCD could contain unwanted characters like 0 or others
• All PCD’s: S-Monitoring values for S-Monitoring bar graphs are sometime wrong
• All PCD’s: S-Monitoring Year graph scaling displayed wrongly
• All PCD’s: TCP, open data mode protocol, communication is blocked after rejection of 32 connections
• All PCD’s: LonIP CSF is locked when an error occurs
• PCD2.M45x0: SRXM does not support FB parameters as operand 3 and 4 for source and destination
• PCD1.M2220-C15: Watchdog LED does not follow Relay when PCD goes in STOP or HALT
• PCD3.M6880: Data exchange between CPU 0 and CPU 1 does not work reliable if STL instruction is used
• BACnet: Calendar state not updating after add/remove list element service
• BACnet: Exception schedule writing to certain array index fails
• BACnet: Schedule crashes with SWTO error
• BACnet: MS/TP client properties are not written if many values change simultaneously
• BACnet: Problem reliability & out of service, reliability is not written when oos is high
• BACnet: Web CGI commands to read BACnet platform tags like ..AddFW,Version,BACnet don’t work
• BACnet: Web scheduler/calendar templates do not work
• BACnet: PCD3.M6860 no BACnet communication on ETH2 if router is used
• BACnet: Rev 4 not working with Name based Client
• BACnet: Rev14 does not allow high limit value below 5 on analogue input

Firmware 1.28.37 (February 2019)

New features

• All PCD’s: FW extension to close all open FTP connections
• BACnet: Calendar objects have been extended with a synchronization mode. Each server calendar object can be configured as Slave or Master calendar
• BACnet: New mappings for alarming counters have been added to Notification-Class objects.
• BACnet: The PCD will now accept AcknowledgeAlarm service requests, which use complete wildcards as timestamps.

Main corrections

• All PCD’s: On S-Bus data mode, if S-Bus CRC contains a S-Bus DLE as last character then S-Bus telegram is incorrect and not accepted from S-Bus recipient. (Since FW 1.28.20)
• All PCD’s: Not all bytes are transmitted when working with MC4 or MC5 mode on F2xxx module
• All PCD’s: RS485 driver keep holding bus after a while
• All PCD’s: Http request ‘is modified’ is not handled correctly on the PCD Web-Server which lead to the effect that web project is not loaded correctly on the browser
• All PCD’s: PCD can crash when breakpoint is updated during conditional RUN
• All PCD’s: PCD can crash on download in run since FW 1.28.27.
• All PCD’s: PCD can crash on download in run when Graftec is used
• All PCD’s: PCD crashes when using browser to access the default page of PCD with "Display Root Content Enabled = YES"
• All PCD’s: RCOB does not start COB when it was stopped before with SCOB
• All PCD’s: Profibus communcation using onboard FDL port. The FCS test for SD2 telegram was not implemented correctly.
• All PCD’s: When S-Bus IP Nodelist is used it’s possible that the communication using nodes does no more work after execute a download in run
• All PCD’s: XOB parameter as Registers does not work if 16bit addressing was used
• All PCD’s: LonFT10: SNVT_obj_status and SNVT_obj_request can be used in user profiles
• PCD3.Mxx60, PCD3.T6xx, PCD1.M2xx0, PCD2.M4x60: usage of I/O media mapping slows done the cycle time 2 times in comparison to FW 1.26.xx
• PCD2.M4x60: Download LonIP config not possible
• PCD2.M4x60: RTC gets sometime corrupted data when PCD7.F7500 is used on PCD2.M4x60
• PCD2.M4x60: RTC Time is wrong after several days of run
• PCD7.D443WTxR: uBrowser use alphapad.teq even if screen is rotated by 90°
• PCD7.D443WT5R: History entry Memory ‘Lost -1’ written in the History
• BACnet; Event Enrolment does not work correctly with external reference devices.
• BACnet; When using BACNet Webvisu the memory used increase each time the scheduler is edited.
• BACnet; PCD crash when BACnet Webvisu edit scheduler.
• BACnet; BACnet WebVisu does not display correct value for the WeeklySchedule value.
• BACnet; ACK Required bit in notification message is not set according to the related NV ack_required bits
• BACnet: The PCDAlarmStatus mapping property does not work correctly.
• BACnet: Mappings, which changed to the value 0 directly after a program download, are not updated correctly on the BACnet property.
• BACnet: The Priority-Array mapping does not work correctly after startup.
• BACnet: Initialization of Puls converter count with input reference gives error
• BACnet: Fix issue with weekly scheduler.
• BACnet: Fix issue with WeekNDay entries
• BACnet: The Restore functionality over BACnet does not work, when the PCD has been reset over factory reset.
• BACnet: The Action property in the command object does not handle NULL datatype and priority entries correctly, if they are used in the ActionCommand. Additionally, the Action property can now be read via index.
• BACnet: Priority_Array entry 16 will be overwritten on startup with the last Present_Value mapping
• BACnet: Out of Service -> Value for PV overridden after reboot by Input ref
• BACnet: The Log_Buffer to csv conversion for trend-log objects does not skip time change entries
• BACnet: Unmapped Priority-Array property array entries are not stored persistent
• BACnet: BACnet configuration on the PCD is not deleted when "unlinked" from PG5
• BACnet: Change Client Time_Of_Restart mapping to Unix time
• BACnet: Client mapping - Threshold is not implemented correctly
• BACnet: Mapped Reliability properties within analogue objects does interfere with the objects functionality. When the Reliability is mapped, the mapping has not full control over the property value.
• BACnet: The program download fails, when the BACnet config contained notification-class objects with event-counter mappings
• BACnet: BACnet Trend-Log(-Multiple) data can’t be retrieved as csv data
• BACnet: The SubscribeCOVProperty service can’t be executed on complete Priority_Arrays

Firmware 1.28.16 (June 2017)

New features

• All PCD's: When push button is pressed while power on then do not update FW from FS in order to execute a delete all.
• PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668:
  Enhancement for HTTP server to transparently support sending compressed files.

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.
• PCD7.D443WT5R: Alarming does not work since 1.28.00 FW.
• PCD7.D443WT5R: When watchdog timeout occurs PCD7.D443WT5R does't reboot and stays locked.

Firmware 1.28.11 (Arpil 2017)

New features

• All PCD's: Support of BACnet Revision 14

Main corrections

• All PCD's: Various Open Data Mode fixes: Read Timeout enhancement, Client Connection timeout and Client Keep alive with anonymous port issue fixed
• All PCD's: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occurring at the moment of the timeout.
• All PCD's: Battery status shows FAIL also if battery module is missing.
  All PCD's: Various minor issues fixed
• PCD1.M2xx0 & PCD3+: 38400/115200 baud settings adjustment
• PCD2.M4x60: PCD7.F7500 initialization

Symptoms
Programmable PCD devices that act as S-BUS master on RS485 with PCD Firmware >= 1.28.20 and <= 1.28.33 get no answer from Slave devices on some of the S-Bus master requests, although S-BUS address, baud rate, polarity and line termination are ok.

Possible effects of the issue

Until now we have found that E-Line RIO communication seems to be more concerned of this problem than e.g. RS485 S-Bus data communication between CPU's.

In some of the cases the effect was, that it was not possible to write to the outputs of the E-Line RIO's or the change of values on the E-Line RIO Inputs was not transfered to the S-Bus master.

With the concerned Firmware it might be very difficult or impossible to download the user program over a gateway connection.

PCD Firmware 1.28.x for all programmable PCD types are concerned.

Reason

The reason of the issue is a error in the Firmware of the S-Bus master.
The problem on the Firmware is, that telegrams which contain DLE characters (B5 or C5) as last character of the telegram (CRC) where malformed because the last character is missing.

Since the CRC is calculated during runtime this malformed S-Bus request occurs depending of the content of the S-Bus request.

The (malformed) CRC is transfered with the S-Bus request from the master to the slave.

If now the slave receives the S-Bus request and the received CRC does not fit with the calculated CRC, then the S-Bus slave reject the S-Bus telegram.

Solution

In case you use the concerned Firmware on an installation with RS485 S-Bus Data communication, update the S-Bus master PCD to the newest available Firmware >= 1.28.34.

This Firmware do fix the issue CVE-2017-9628 related to Ethernet frame padding information leakage.
To avoid any problems in relation to this leakage we do recommend strongly to update to the latest Firmware
1.28.16 / 1.24.69 or newer as mentioned on the security upgrade section on this web-page.

Impact of the CVE-2017-9628
IEEE 802 specifies that packets have a minimum size of 56 bytes.
The Ethernet driver is expected to fill the data field with octets of zero for padding when packets are less than 56 bytes.
Resident memory and other data are used for padding in some implementations that could cause information leakage.
This attack is passive; the attacker can only see data that the affected devices sent out as part of a packet.

Vulnerability overview of the CVE-2017-9628
The previous implementation of firmware allowed other data from a known area of memory to be used in this field and could exfiltrate or leak data.

In April 2022:
the COSinus FW 1.28.51 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

In February 2019:
the COSinus FW 1.28.37 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

In June 2017:
the COSinus FW 1.28.16 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.28.16 was put into production, which do support the BACnet Revision 14.
To support the BACnet Revision 9 it's necessary to use the PCD and the BACnet FW 1.26.xx.

Attention:
The firmware 1.28.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx, 1.26.xx or newer to a not compatible PCD

Firmware 1.28.51 (April 2022)

Main corrections

• All PCD’s: Saia PCD Modbus diag does not work if diag flag > 9999
• All PCD’s: SNTP and hardware RTC is diverging from more than 2 seconds, then History message ‘RTC Fail error’ is generated
• All PCD’s: SNTP Time synchronization does not work with DHCP
• All PCD’s: E-Mails send from PCD could contain unwanted characters like 0 or others
• All PCD’s: S-Monitoring values for S-Monitoring bar graphs are sometime wrong
• All PCD’s: S-Monitoring Year graph scaling displayed wrongly
• All PCD’s: TCP, open data mode protocol, communication is blocked after rejection of 32 connections
• All PCD’s: LonIP CSF is locked when an error occurs
• PCD2.M45x0: SRXM does not support FB parameters as operand 3 and 4 for source and destination
• PCD1.M2220-C15: Watchdog LED does not follow Relay when PCD goes in STOP or HALT
• PCD3.M6880: Data exchange between CPU 0 and CPU 1 does not work reliable if STL instruction is used
• BACnet: Calendar state not updating after add/remove list element service
• BACnet: Exception schedule writing to certain array index fails
• BACnet: Schedule crashes with SWTO error
• BACnet: MS/TP client properties are not written if many values change simultaneously
• BACnet: Problem reliability & out of service, reliability is not written when oos is high
• BACnet: Web CGI commands to read BACnet platform tags like ..AddFW,Version,BACnet don’t work
• BACnet: Web scheduler/calendar templates do not work
• BACnet: PCD3.M6860 no BACnet communication on ETH2 if router is used
• BACnet: Rev 4 not working with Name based Client
• BACnet: Rev14 does not allow high limit value below 5 on analogue input

Firmware 1.28.37 (February 2019)

New features

• All PCD’s: FW extension to close all open FTP connections
• BACnet: Calendar objects have been extended with a synchronization mode. Each server calendar object can be configured as Slave or Master calendar
• BACnet: New mappings for alarming counters have been added to Notification-Class objects.
• BACnet: The PCD will now accept AcknowledgeAlarm service requests, which use complete wildcards as timestamps.

Main corrections

• All PCD’s: On S-Bus data mode, if S-Bus CRC contains a S-Bus DLE as last character then S-Bus telegram is incorrect and not accepted from S-Bus recipient. (Since FW 1.28.20)
• All PCD’s: Not all bytes are transmitted when working with MC4 or MC5 mode on F2xxx module
• All PCD’s: RS485 driver keep holding bus after a while
• All PCD’s: Http request ‘is modified’ is not handled correctly on the PCD Web-Server which lead to the effect that web project is not loaded correctly on the browser
• All PCD’s: PCD can crash when breakpoint is updated during conditional RUN
• All PCD’s: PCD can crash on download in run since FW 1.28.27.
• All PCD’s: PCD can crash on download in run when Graftec is used
• All PCD’s: PCD crashes when using browser to access the default page of PCD with "Display Root Content Enabled = YES"
• All PCD’s: RCOB does not start COB when it was stopped before with SCOB
• All PCD’s: Profibus communcation using onboard FDL port. The FCS test for SD2 telegram was not implemented correctly.
• All PCD’s: When S-Bus IP Nodelist is used it’s possible that the communication using nodes does no more work after execute a download in run
• All PCD’s: XOB parameter as Registers does not work if 16bit addressing was used
• All PCD’s: LonFT10: SNVT_obj_status and SNVT_obj_request can be used in user profiles
• PCD3.Mxx60, PCD3.T6xx, PCD1.M2xx0, PCD2.M4x60: usage of I/O media mapping slows done the cycle time 2 times in comparison to FW 1.26.xx
• PCD2.M4x60: Download LonIP config not possible
• PCD2.M4x60: RTC gets sometime corrupted data when PCD7.F7500 is used on PCD2.M4x60
• PCD2.M4x60: RTC Time is wrong after several days of run
• PCD7.D443WTxR: uBrowser use alphapad.teq even if screen is rotated by 90°
• PCD7.D443WT5R: History entry Memory ‘Lost -1’ written in the History
• BACnet; Event Enrolment does not work correctly with external reference devices.
• BACnet; When using BACNet Webvisu the memory used increase each time the scheduler is edited.
• BACnet; PCD crash when BACnet Webvisu edit scheduler.
• BACnet; BACnet WebVisu does not display correct value for the WeeklySchedule value.
• BACnet; ACK Required bit in notification message is not set according to the related NV ack_required bits
• BACnet: The PCDAlarmStatus mapping property does not work correctly.
• BACnet: Mappings, which changed to the value 0 directly after a program download, are not updated correctly on the BACnet property.
• BACnet: The Priority-Array mapping does not work correctly after startup.
• BACnet: Initialization of Puls converter count with input reference gives error
• BACnet: Fix issue with weekly scheduler.
• BACnet: Fix issue with WeekNDay entries
• BACnet: The Restore functionality over BACnet does not work, when the PCD has been reset over factory reset.
• BACnet: The Action property in the command object does not handle NULL datatype and priority entries correctly, if they are used in the ActionCommand. Additionally, the Action property can now be read via index.
• BACnet: Priority_Array entry 16 will be overwritten on startup with the last Present_Value mapping
• BACnet: Out of Service -> Value for PV overridden after reboot by Input ref
• BACnet: The Log_Buffer to csv conversion for trend-log objects does not skip time change entries
• BACnet: Unmapped Priority-Array property array entries are not stored persistent
• BACnet: BACnet configuration on the PCD is not deleted when "unlinked" from PG5
• BACnet: Change Client Time_Of_Restart mapping to Unix time
• BACnet: Client mapping - Threshold is not implemented correctly
• BACnet: Mapped Reliability properties within analogue objects does interfere with the objects functionality. When the Reliability is mapped, the mapping has not full control over the property value.
• BACnet: The program download fails, when the BACnet config contained notification-class objects with event-counter mappings
• BACnet: BACnet Trend-Log(-Multiple) data can’t be retrieved as csv data
• BACnet: The SubscribeCOVProperty service can’t be executed on complete Priority_Arrays

Firmware 1.28.16 (June 2017)

New features

• All PCD's: When push button is pressed while power on then do not update FW from FS in order to execute a delete all.
• PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668:
  Enhancement for HTTP server to transparently support sending compressed files.

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.
• PCD7.D443WT5R: Alarming does not work since 1.28.00 FW.
• PCD7.D443WT5R: When watchdog timeout occurs PCD7.D443WT5R does't reboot and stays locked.

Firmware 1.28.11 (Arpil 2017)

New features

• All PCD's: Support of BACnet Revision 14

Main corrections

• All PCD's: Various Open Data Mode fixes: Read Timeout enhancement, Client Connection timeout and Client Keep alive with anonymous port issue fixed
• All PCD's: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occurring at the moment of the timeout.
• All PCD's: Battery status shows FAIL also if battery module is missing.
  All PCD's: Various minor issues fixed
• PCD1.M2xx0 & PCD3+: 38400/115200 baud settings adjustment
• PCD2.M4x60: PCD7.F7500 initialization

With Firmware >= 1.26.00, after Power off / on of the PCD, the LON bindings are lost.

Symptoms

The LON communication don’t works anymore after power off/on. In the commissioning tool, e.g. NL220  the Lon node is getting “red” after the function Network –>Test

Reason

In the FW 1.26.xx there is a problem with the file update on the Flash cards, the bindings are only updates in the memory but the operation to save them to the filesystem fails. Therefore the binding information is lost after power off / on.

Solution

The correction is done with >= 1.26.24. The firmware of the PCD and the LonIP FW have to be updated.

In the commissioning tool e.g. NL220 a Network -> Repair function has to be executed on the node.

Only the FW >= 1.26.00 are concerned. (e.g. FW 1.24.xx is not concerned of this problem)

In June 2017:
the COSinus FW 1.26.31 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.26.31 was released as maintenance version, which do support the BACnet Revision 9.
To support the BACnet Revision 14 it's necessary to use the PCD and the BACnet FW 1.28.xx.

In March 2017:
the COSinus FW 1.26.28 was introduced into production for the systems:

- PCD1.M2220, PCD1.Mxx60, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.26.28 was introduced into production

In June 2016:
the COSinus FW 1.26.15 was introduced into production for the systems:

- PCD1.M0xx0, PCD1.M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

The COSinus FW 1.26.16 was introduced into production for the systems: PCD3.T665/T666/T668.

The BACnet and LonIP FW 1.26.15 was introduced into production

Attention:
The firmware 1.26.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx or 1.26.xx to a not compatible PCD.

Firmware 1.26.31 (June 2017)

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.

Firmware 1.26.28 (March 2017)

Improvements

• Text Ram can now be cleared (all chars are set to blank space) with the cgi interface by writing a zero length string.
• Ping request on ETH2 over rooter from different sub net.
• LonIP Mapper improvement
• Web Server RAM Disk increased
• Error Led not set on IR overflow

Main corrections

• All PCD's: MC0 communication with F2xx module and related communication flags are handled correctly in case of transmission
• All PCD's: Text Ram can now be cleared (all chars are set to blank space) with the cgi interface by writing a zero length string.
• All PCD's: Multiple AlarmLists with similar names will now be "initialized" correctly.
• All PCP's: TCP client keep alive is not working when anonymous port is used.
• All PCD's: Profi-SBus GWY does not wor, Profi-SBus Master/GWY stop working after cable is re plugged.
• All PCD's: PCD crash when use DIGI(R)/DIGO(R) with first parameter as FB parameter.
• All PCD's: Correction for modbus RTU communication over F2xx communication module
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• PCD1.M22x0: While changing the analog output value, the Watchdog is switching. Switching the Watchdog Relais over the corresponding flag has no influence.
• PCD2.M4x60: Sometimes the Profibus DP module is not initialized correctly on startup.
• PCD2.M5xx0: When Restore program because of a missing or dead battery configuration (SBus/IP,..) is not restored correctly.
• PCD2.M5xx0: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occuring at the moment of the timeout.
• PCD2.M5xx0: Sometimes config is lost after download project with self-download tool.
• PCD3.Mxxx0: Battery status shows FAIL also if battery module is missing.
• PCD3.Mxxx0: FTP server processing with long commands resolved.
• PCD3.Mxxx0: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occuring at the moment of the timeout.
• PCD3.Mxxx0: Sometimes config is lost after download project with self-download tool.
• PCD3.Mxx60: Profi-SBus/DP/SIO does not work on port 2 on PCD3.M3x60 & PCD3.M5360.
• PCD3.M6860: Ping request from over rooter from different sub net is not respond.
• PCD3.M6860/M880: Profibus/S-IO/Profi-SBus does not work stable.
• PCD3.M6860: Set PCD to HALT if there is no or incompatible media transfer between the two CPU's.
• PCD3.T66x: The RIO Status web page does not allow to clear the diagnostics.
• BACnet: The memory usage of the BACnet FW was increasing for every SubscrobeCOVProperty service, which has been received by the PCD.
• BACnet: A client configuration for Priority_Array properties in commadable objects (e.g. Analog-Value) does now allow reading (ReadProperty/COV) and writing (WriteProperty service to server) at the same time.
  
  

Firmware 1.26.15 (June 2016)

New features

• Support of PCD1.M2220-C15
• Support of PCD2.M4x60
• Support of PCD3.M3160/PCD3.M3360/PCD3.M5360
• Support of PCD3.M6880, PCD3.T668 Standby-CPU-System

Improvements

• PCD2.M4x6x, support Interrupt when reaching the configured ref Value
• PCD1.Mxxx0, PCD2.M4x60, PCD3.Mxx60 PCD7.D4xx: Increase None Volatile Register to 1000
• PCD3.T666/8: Increase the User Program Memory for to 256k
• PCD3.T66x: Support the ESIO manager use tag values for IP address
• PCD2/3.F2xx modules Baudrate: Support 300/600/1200 baud settings for in MC mode.
• S-Monitoring: In bar displays where the current time is visible, the average for the period is calculated not in a optimal way (time slice, ref time, is a bar). New it's displayed in seconds
  
  

Main corrections

• PCD3.M6860/M6880: When update FW on extension using the file system after update the extension FW can stay in an endless loop
• PCD3.M6880: crash wen Timmer/Counter is mapped in the Read Symbols
• PCD3.M6880: PCD can crash with MuKe Error when use the SBus GWY in parallel with modbus TCP
• PCD3.M6880: Standby CPU1 does not always HALT when CPU0 crash
• PCD3.M6880: CPU0 to 1 From Read data communication sometimes stop works
• PCD3.M6880: Add a Transmit Error diagnostic tag "DataTxErrors"
• PCD3.Mxxx0: Battery module on IO slot 3 does not show battery status in history
• PCD3.Mxxx0/PCD1.M2xx0: Some baudrates on onboard ports are not correct
• PCD2.M4x60: RTC read/write locks the PCD for about 30ms
• PCD2.M4x60: Modem does not work because of the not working DCD
• PCD3.T66x: Add ELine CSF library
• PCD3.T66x: Serial com does not work with SASI instruction
• PCD3.T66x: CSF Modbus Server Init gives an error when port 502 is used becasue this port is already open
• PCD7.D443WT5R: Assignation/Configuration of port 1 should return an error because port 1 is not supported
• PCD7.D443WT5R: Remove IO access from the system. PCD goes now in HALT with "INVALIDE OPCODE"
• PCD2.W220 with Pt1000: Significant deviation between singel channels
• BACnet: List Properties (like Date_List, Exception_Schedule, ...) could disappear after a PCD restart, if a WriteProperty request with an empty list value has been received for these properties before the restart. This behavior was only present for persistent properties
• BACnet: The Log_Buffer property of a Trend-Log object could not be read anymore using the ReadRange service, after a Event-Log or Trend-Log-Multiple has been read via ReadRange
• BACnet: Writing a single analog output channel is not working. The output is not changing. Writing output channels over the mapped functionality is working
• BACnet: PCD with BACNet loops with restart if program has "INVALIDE OPCODE"
• Restart Warm does not work
• SBus ELine has sometimes retries
• When create a Text/DB the backup fails until a restart is done
• PCD Crash with BUS ERROR on STXT instruction when text is empty
• Modem does not work correctly
• Modem does not work or PCD crash when modem is configure
• PCD can crash when error occurs in Modbus RTU
• The PCD crash if a BITI is executed with number as FB parameter
• PCD crash when use Profi-S-Bus Master
• Sometimes the program is lost when update FW from 1.24.xx to 1.26.xx
• MOVX/DIVX function where not working on Task or Temporary data when use indexed
• Add config tag value for GWY mode "data_no_secure" to deasble the secure data mode
• Not possible to upload a file through the Web server FTP interface (ftp.cgi or ftp.json) if that file starts with a white space character (either a space or a tab)
• CSF CopyDBBytesToR crash when destination is bigger than last Register
• Diagnostic Flags in S-Bus Master mode are not correct if there are collisions on the RS-485 network
• CSF Backup/Restore Media does give an error on restore when data change while backup/restore
• MOV instruction with type position as FB parameter gives error flag and fails
• Web-Alarm: Fix alarming color with "group color mode" and group bigger than 8

It’s possible that after a FW update of the PCD to the FW 1.20.xx, 1.22.xx or 1.24.xx there is a entry in the FW history ‘FWDnld UnknownFW’ after the history line ‘FWDnld 1.2x.xx PLC CLASSIC’ as shown on the image below.

The history message ‘FWDnld UnknownFW’ was caused by an error in the old FW of the PCD and does have no signification.

Just ignore this message and clear the history messages.

In case an FBox library (or an IL program) uses a functionality which is not implemented in the PCD firmware, the PCD will not go in run but display the error message "SF not loaded" (e.g. in the PCD history or in the Online Configurator).

Symptom
After the download of a program a SBC-NT based PCD (e.g. PCD3) does not go in run but remains in halt. When going online with the Online Configurator a message "SF not loaded" is displayed.


Reason
The user program uses a functionality which is not implemented in the firmware (and therefore the PCD can not run the user program).

Solution
The solution is either updating the firmware, or avoiding the CSF which leads to the problem.
In case it is not know which CSF is responsible for the "SF not loaded", the SF library can be found based on the program line indicated by the Online Configurator (the program line is indicated with "Halt at xxx" in the Status; in the screenshot above the CSF is on program line 4). By using the Online Debugger, this CSF can be displayed by typing "DP4C10"):

   Display Program 4 Count 10 (Enter)
  

In this case, the CSF calls the SF library 26 (which is not implemented in the Firmware 1.10.51 which is used above).

How to know the functionality based on the library number?
Below you can find a list of the most commonly used System Function libraries (and in which FBox libarary they are used):

• SF library 0: S.SF.IP (e.g. Open Data Mode)
  Used by several IP communication drivers such as EIB/Net and for reading or writing the IP address of the PCD.
• SF library 2: System library
  Used by FBoxes for reading the Serial number
• SF library 4: S-Net library
  E.g. Used by FBoxes for Profi-S-Bus and Ether-S-Bus
• SF library 6: S.SF.DBLib (e.g. CopyTextBytes), previously the "ApplicationLib" for CopyText
  E.g. used by the Modem FBox library, HDLog to File library.
• SF library 7: File System library
  E.g. used by the FBoxes for the File System or "HDLog to File"
• SF library 9: IP Services (EMail, PPP, DNS, SNMP etc.)
  E.g. used by the EMail library and the WAA (Wide Area Automation) FBox library
• SF library 10: S-Web Alarming library
  E.g. used by the S-Web Alarming FBoxes and the DDC Suite
• SF library 13: Modbus library
  E.g. used by Modbus and the P-Bus FBox library
• SF library 19: LON over IP library
  used by LON over IP functions
• SF library 22: SPI framing protocol for PCD2/3.F2xx(x)
  e.g. used by the M-Bus library 2.6.100 and later
• SF library 23: Energy Manager library
• SF library 25: LON FT library
• SF library 27: ELine library for ELine modules
  Since PCD firmware version 1.24.xx

The single function codes (second line of the CSF call, "0" in the screenshot above) of the relevant libraries can be found in the definition files in folder
   c:\Documents and Settings\All Users\Saia-Burgess\PG5_20\Libs\SF\*.lib
(e.g. SFModbusLib_en.lib for the functions of the Modbus library.

As the "original" Instruction List Set (with the mnemonics STH, OUT etc.) could not be extended by an unlimited amount of new instructions, the call of new features such as the Open Data Mode, Sending of EMails etc. is realised with so called SFs (which stands fro "System Function"). These SFs are called using CSF instructions (Call System Function).

What is a SF library?
A System Function library is a a set of functions which are implemented in the firmware and which can be called with the IL mnemonic CSF. Usually one SF library contains several functions which are related to each other. A CSF expects the SF library and the function from this library, together with a set of parameters (described in the online help of the SF library which can be found in the IL Editor SEdit from PG5 2.0).

How is a CSF used?
In the user program a SF function is called using the mnemonic CSF, followed by the library, the function and the parameters:
CSF     [cc]     Library
                    Function
                    Parameter 1
                    Parameter 2
                    ...


This can be done from inside an FBox, or directly from an IL program (as the engineering is faster using the FBoxes, the most CSFs are called from FBox libraries).
The "translation" between meaningful names (e.g. S.SF.DBLIB.CopyTextBytes) and the code which is used by the firmware is done by PG5. For a list of the most commonly used SF libraries, please refer to FAQ 101568.

This FAQ contains an overview over the firmware versions currently used in production (which means that this firmware version is installed in our production facility).

Firmware versions used in production
The following firmware versions are currently used in production. For more information regarding the relevant firmware, please refer to the version information document of the according page.

PCD firmware versions

MB Panel firmware versions

RIO firmware versions

With an activated software watchdog the processor monitors itself and restarts the PCD in the event of a malfunction or a loop.

Description (extract from the hardware manual)
The hardware watchdog provides maximum security. However, for non-critical applications, a software watchdog may be suffcient, whereby the processor monitors itself and the CPU is restarted in the event of a malfunction or a loop.
The core of the software watchdog is the instruction SYSWR K 1000. When this is first issued, the software watchdog function is activated. This instruction must then be issued at least every 200 ms, or the watchdog will trigger and restart the controller.

Usage

• Placing a "Watchdog"-FBox in a FUPLA-file is the easiest solution:
  
• Instead of using the FBox it is possible calling the Software Watchdog in IL (using the instruction SYSWR K 1000)
  

In case a "non Saia PCD® COSinus" PCD or PCS1 system is connected with "Secure S-Bus Data mode" (e.g. over a serial cable or over modem) from time to time a telegram is not answered correctly.

Symptom
A PCD or a PCS connected with another system (e.g. PC or another PCD system) using the "Secure S-Bus Data mode" does not answer a telegram from time to time. This can e.g. be seen by a red LED on transmit or receive FBoxes (or in case a PC is used, by interpreting the tracewin files).
This phenomenon can be observed on PCD1.M1x5, PCD2.M150, PCD2/4.M170 and PCS1 systems (with firmware which are supporting the "Secure S-Bus Data mode"). Saia PCD® COSinus based systems (PCD2.M480, PCD2.M5xx0 and PCD3) are not concerned.

Reason
The reason for this behavior is that the PCD/PCS does not correcly answer telegrams where the sequence number in the secure S-Bus Data Mode header is 0xC5h. This is the case in every 255th telegram.
(The character "C5" should be replaced by "C5 01" but this is not done).

Solution
Please refer to the table below for firmware version which do correctly handle the "C5" and therefore the symptom described above is avoided.

When trying to write a text (with address higher than 4000) using the S-Web Server, the PCD system stopps working and in the PCD history a "68k add Error" is indicated.

Symptom
When trying to write a text (with address higher than 4000) using the S-Web Server, the PCD system stopps working and in the PCD history a "68k add Error" is indicated.
The following PCD systems are concerned:

• PCD1.M1x5 with firmware version higher than 0B0
• PCD2.M150 with firmware version higher than 0E0
• PCD2/4.M170 with firmware version higher than 030
• PCS1.Cxx0 with firmware version higher than 0C0 

Reason
This behaviour is not intended. Due to a problem in the firmware the write access fails.

Solution
This problem is solved in firmware version 0E6 (the version indication 0E6 is the same for all systems) which can be downloaded from the support site (www.sbc-support.ch).

This error message appears if the used firmware on the CPU does not support the "active and non ACK" filter for the S-Web alarming functionality (e.g. a PCD2.M150 with firmware 0D3).

Symptom
Instead of the alarm list of the S-Web alarming macro, the message "Failed to get data on alarm.exe" is displayed on the alarming page.

Reason
The reason is that the macro tries receiving the alarms filtered by the "active and not acknowledged" state of the alarms. This does only work if this feature is implemented in the according firmware.

Solution
Please update the firmware (FW) of your PCD system to the firmware supporting the according feature (see table below).

^*) On PCD3 and PCD2.M480 systems the "active and not acknowledged" filter has already been implemented in previous versions, but has been improved this indicated version.

Yes, this is possible by calling the system function (CSF) "IPGetLocalConfig".

Introduction
For having the possibility to read the current IP configuration from the user program, a specific System Function has been added to the firmware. This function does return the IP address, the subnet mask as well as the default gateway (each address in one register). The returned value contains the full IP address in one register (each byte or the register contains one octed of the IP address):

Example
This System Function is part of the IPD Library. In order to use these functions, the file "IPLib.inc" is to be included to the source file where the function is called. This can be done with the line:

$INCLUDE "IPLib.inc"

The IP configuration can then be read in th following way:

Returned IP address (hex):               0xAC100179h
IP address in "Dot-decimal notation": 172.16.1.121 (0xACh = 172, 0x10h = 16, 0x01h = 1, 0x79h = 121)

Firmware versions supporting the GetLocalIPConfig
Please refer to the table below for the first firmware versions that support the "IPGetLocalConfig" function.

Remark
The include file "IPLib.inc" from PG5 1.4.300 and earlyer versions needs to be updated in order to "know" this feature. Therefore please download the file "IPLib.inc" attached to this FAQ and replace the existing file from PG5 which is located in the "Libs/App" of PG5:

c:\Program Files\SAIA-Burgess\PG5 1_4\Libs\App\IPLib.inc

The booter versions up to version 0A2 can cause a register corruption after an power up of a PCD1.M1x5. The result of this problem can lead to wrong register contents after a short interruption of the power supply.

Symptom
If a booter version smaller 0A3 is used on the PCD1 it is possible that the register contents are corrupted after a short interruption of the power supply of the PCD1.M125 or PCD1.M135.
The booter version can be identfied by reading byte 800010 on the PCD1.M1x5. To do so, open the "Online Debugger" (PG5 Menu "Tools"-->"Online Debug") and type:
D Y 800010 <Enter> (for "Display memory Map")
After having done this, the booter version is indicated at the right side of the output line in the Online Debugger.

Reason
This problem is caused by a bug in the booter versions up to version 0A2

Solution
Update your booter to version 0A3 or newer. The easyest way to do so is using the Firmware- and Booter update tool that can be found in the PCD1.Mxxx section on the support page. This tool will establish a connection to the connected PCD in PGU mode and will download the new Booter and the Firmware.

There is an Error Led on nearly every PCD system that can indicate a problem on the system. Read this FAQ to learn more about the different reasons for a lit Error LED and how to find the problem causing the lit error LED.

What causes the Error LED to get lit?
There are different reasons for a lit error LED. The most common reasons are listed below:

• A problem while assigning a communication port (e.g. missing communication module or wrong parameters)
• A problem while sending an S-Bus telegram (e.g. missing port assignation or invalid data array or media)
• Invalid mathematical operation (e.g. division by zero or value overflow after a multiplication)
• Index register overflow

How to find the problem in the code/configuration?
One fast way to find the problem is reading the history entries of the PCD. This may be done by using either the Online Configurator or the Online Debugger (type "Display History"). In the History some of the problems are listed explicitely (e.g. IPM not present) for further information regarding the History entries, please refer to the PG5 Help. The chapter "Messages" contains "Halt and History messages".
If only an "Error Flag" is mentioned the next task is to find the program part where the Error status-flag is set. This is to be done by using the Online Debugger:

• Go online with your Fupla- or IL program.
• Open the Online Debugger and type "Restart Cold All CPUs".
• Still in the Online Debugger, type "Run Until Status-flag Error". As soon the Staus-flag "Error" is set, the PCD will be stopped. Therefore the Fupla Editor will jump to the page which actually is processed (only this page is part of the current Fupla file! If the Error isn't caused by this Fupla file, it will jump to any other page which doesn't cause the problem. Have a look at this page and the FBox with the "stop"-box on it and decide whether the problem could have been caused by this FBox!
  If there isn't any FBox that could cause any problems mentioned above, repeat the procedure while beeing online with the next Fupla file of the CPU).
• If you can't find the problem directly in a Fupla file, switch to the Online Debugger again. After having stopped, a line similar to the line written below will be shown:
  *001234  STH       I/O       48                                  A1   Z0     N0     P1    E1     IX      COB2
  This first number of this line indicates on which line of the code the problem happened: the last instruction BEFORE the line shown caused the problem (the error LED is lit after the problem).
• Type "Display Program <line indicated -10> Count 15". Now you can see the instruction that caused the problem: Refer to the IL instruction Set (Online Help of IL Editor SEDIT) in order to figure out what this instruction exactly does.

If a SASI instruction causes the problem, check out the following possible reasons:

• The port is already assigned (have a look at the HW configuration and search for further SASI instructions by typing "Locate Instruction SASI" in the Online Debugger!).
  Hint: Also have an eye on the SASI FBoxes you used as well as on the HMI Settings tab.
• The port doesn't exist
• The SASI text isn't valid
• S-Bus support isn't enabled in the Hardware Settings but an S-Bus assignation was executed. This won't work because in this case the PCD doesn't have an S-Bus address (which is required for S-Bus communication).

If it seems as a mathematical operation caused the error, use the online debugger to run shortly before the problem-causing part of the code by typing "Run Until Instruction-Pointer Equals <instruction line shortly before problem-line>" (note that the instruction line must contain an instruction!). Once reached this line, type "sTep". In the Step-mode, you will see the contents of the PCD medias [brackets].

Remark:
The Error LED is lit in case the Status Flag E (Error status flag is set high) and no XOB 13 is programmed. In case the XOB 13 is programmed, the Error Led won't get lit but this XOB is processed immediately.

We have made good experiences with the GALEP 4, for PCD1 FW together with the adaptor 210841. The local dealer for Switzerland is www.redacom.ch.

Order numbers for empty firmware chips:

PCD1.M1x0: 1x ASN 4 502 7178 (OTP27C4002), one time programmable
PCD1.M137: 1x ASN 4 502 7178 (OTP27C4002), one time programmable
PCD2.M110/M120: 2x ASN 4 502 7126 0 (27C1001-10, EPROM)
PCD2.M127: can be downloaded, refer to the product page on www.sbc-support.ch
PCD2.M150: 2x ASN 4 502 7341 0 (49F040 ,Flash-EPROM)
PCD2.M157: can be downloaded, refer to the product page on www.sbc-support.ch 
PCD2.M170: chip soldered on the main board, the FW can be downloaded with PG5 *
PCD2.M177: can be downloaded, refer to the product page on www.sbc-support.ch
PCD2.M480: chip soldered on the main board, the FW can be downloaded with PG5 *
PCD2.M487: can be downloaded, refer to the product page on www.sbc-support.ch
PCD3.Mxxxx: chip soldered on the main board, the FW can be downloaded with PG5 *

* Procedure to downlaod a firmware:
1) get the appropriate file from product page on the supportsite www.sbc-support.ch
2) open PG5 and go to the online-configurator; go offline
3) open the menu tools, download firmware
4) browse for the firmware file and start the download
5) load the HW configuration and the user program

Basically on PCD systems introduced before 2003 there are some restrictions to be considered about the maximum baud rate of serial communications.

Depending on firmware and hardware not all serial ports can be used at their theoretical maximum baud rate at the same time.

Systems introduced before 2003:

• All PCD1, PCD2 (except PCD2.M480), PCD4 and PCD6 as well as PCS1 classic contollers do have a baud rate limitation of 38.4 kB/s on each serial port.
  For older firmware (FW) versions there is a further restriction since there is one UART responsible for two serial ports and this UART cannot handle baud rates of 38.4 kB/s on both ports at the same time. The port allocation of the UARTs is the following: first UART: port 0 and 1; second UART: port 2 and 3 etc.
  This means that it isn't possible to set the concerned ports to
  - 38.4 kB/s each
  - one to 38.4 kB/s and one to 19.2 kB/s
  - but it is possible to set one port to 38.4 kB/s and one port to 9600 B/s.
  
• Due to more efficent port handling recent FW versions do have the following restriction (independent of production date of HW):
  Amount of ports available divided by 2 equal amount of ports that can communicate at 38.4 kB/s. All the residuary ports do have a maximal baud rate of 19.2 kB/s.
  In addition an UART of an PCD7.F5xx isn't able to handle 19.2 kB/s on one and 38.4 kB/s on the other port. But it is possible to assign both ports to 38.4 kB/s.

Systems introduced since 2003 (PCD2.M480 and PCD3.xxxx):

Due to faster hardware there are much higher baud rates possible on the serial ports (up to 115 kB/s)!
There is only one restriction regarding UART sharing left:
On a PCD7.F5xx it is not possible to communicate on one port at 19.2 kB/s and one the second port at 34.8 kB/s at the same time (but two times 38.4 kB/s is possible!).
This means that all ports may communicate at the maximum baud rate (which is specified in the technical information (TI) or in the manual) at the same time.

FW versions that support the new port handling mentioned above:
For the following and newer FW version the following rule is valid:
Amount of ports available divided by 2 equal amount of ports that can communicate at 38.4 kB/s.
All the residuary ports do have a maximal baud rate of 19.2 kB/s.

Communication interfaces containing a co-processor aren't restarted after a restart caused by the software watchdog with the option "Execute XOB0". In fact only a restart cold will be executed but without resetting the communication modules.

This behaviour is a bug and will be corrected in the next FW version for the corresponding CPU. As soon as the new FW is built it will be available on the support homepage.

In the meantime it is recommended not to use the option "Execute XOB0" for the software watchdog. In this case the communication modules will be reset normally on software watchdog execution.

Or "What is the difference between 0-, $- and #-firmware versions?". PCD firmware for non-Saia PCD® COSinus Systems (PCD1, PCD2.M1x0, PCD4, PCD6 and PCS) are named with 3 letters (e.g. 010, B0W or #31). This FAQ explains the meaning of these version and how to figure out which one is more recent.

The firmware version naming of non-Saia PCD® COSinus systems
In general the 3 letters (abc) are used for the following indications:

• a
  Definition of the kind version this firmware is. The possible versions are the following
  - 0xx versions are "official production versions" (010 is the first official production version)
  - Bxx versions are Beta versions which contain new features compared to the previous production version
  - #xx versions are "customer bug fix versions" of an official production FW version.
  - $xx versions (Pilot version) include new functionalities which are not yet fully tested. Therefore a $-version should only be used in field if the developement gives their ok!
• b
  The second letter defines the main production version (starting with 01x wich stands for first official production version, followed by 02x (where the 02x has important new features compared to the 01x version
• c
  The last letter is incremented for each build of the firmware (best observed for the bug-fix versions; #21 is based on the 020 firmware and contains corrections for the 020 firmware version) 

To figure out which version the base version of a bug fix- or pilot version is, have a look at the second character of the corresponding version (e.g. the "1" of the 013). This character indicates the official production version on which the bug fix or pilot version is based on.

Examples
010    is the official production version
018    is the production bug fix version of 010; no new functions
#19    is a customer bug fix version based on 018 (and therefore also on 010); no new functions
$19    is a pilot version based on 010 with new functions. The bug fixes done for e.g. 019 probably aren't implemented in this version! (the new features will be added to the production firmware versions in 020 or later.

Remark
Early versions of the Saia PCD® COSinus systems (PCD2.M480, PCD3, PCD2.M5) up to 039 were named with this system as well. In order to reduce confusion concerning features of a firmware the new firmware naming a.bb.cc has been applied (see FAQ 100741).

Some history entries introduced in new firmware versions can't be found in the Online Debugger Help nor in the online help of the Online Configurator.

Below you can find recently introduced History entries that can't be found in the Help files of PG5 versions older than PG5 1.3:

Error Messages concerning PCD1.M2, PCD2.M480, PCD2.M5xx0 and PCD3.Mxxx0 systems (SBC-NT)

The IL instruction DSP (display value on PCD7.F530 display) is not supported on Saia PCD® COSinus systems. When downloading it to a Saia PCD® COSinus system, the PCD will not go in RUN and give an error message such as "Invalid instruction" (e.g. a PCD2.M480), "Precompiler error" or "Invalid OPCODE" (on a PCD3.M5xx0 with firmware 1.10.16).

Why is the DSP instruction not supported on Saia PCD® COSinus systems?
Since it isn't allowed or even possibe to mount a PCD7.F530 card on a Saia PCD® COSinus system (e.g. a PCD2.M480, a PCD2.M5xx0, a PCD3 or a PCD1.M2xx0) the instruction for accessing the display of the PCD7.F530 is not supported by the CPU.

Remarks

• The PCD7.F530 can't be mouned on a PCD2.M170 or on a PCD2.M480 because it could cause a short circuit on the internal bus connector placed right under the slot B1.
• If a user program containing a DSP instruction is downloaded the PCD2.M480 won't run the program and the error message "Halt reason: invalid instruction" will be entered in the CPU's History.

Yes it’s possible to connect a PCD directly to the internet, but you have to protect your PCD against unauthorised access or cyber-attacks.

To protect the PCD against unauthorised access or cyber-attacks, it’s imperatively needed to take some protective measures.

Information about protective measures can be found on the support hp

If you need a PCD with cyber security levels SL3+ and based on ANSI ISA 62443 then checkout our PCD3.M6893 (QronoX PCD), this PCD was developed for cybersecure applications.

Information's can be found here.

In January 2024:
the COSinus BACnet FW 1.28.59 was put on the support homepage.  

In April 2022:
the COSinus FW 1.28.51 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

In February 2019:
the COSinus FW 1.28.37 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

In June 2017:
the COSinus FW 1.28.16 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.28.51/1.28.59 was put into production, which do support the BACnet Revision 14.
To support the BACnet Revision 9 it's necessary to use the PCD and the BACnet FW 1.26.xx.

Attention:
The firmware 1.28.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx, 1.26.xx or newer to a not compatible PCD

Firmware 1.28.59 (only BACnet firmware) (January 2024)

Main corrections

• BACnet: MI/MO/MV objects, invalid values for Alarm_Values and Fault_Values are rejected
• BACnet: BI/BV/BO objects, present value of can only be 0 or 1
• BACnet: COMMAND object, present value writing returns an error if bigger that the number of actions
• BACnet: Trendlog objects, property value check is done according to specifications
• BACnet: Limit COV subscription to 3000 and send PDU-Error if length of response is too big
• BACnet: Disable I-Have response when state is disable / disable-init
• BACnet: Calendar Object Date List, don’t allow wild card in this property entries
• BACnet: writing invalid array to Array properties returns correct Error code
• BACnet: Pulse Converter Object, send out-of-range PDU-Error if count processing is < 0
• BACnet: Controller goes to HALT with SWTO error
• BACnet: MS/TP Controller goes to HALT with SWTO error
• BACnet: Schedule accepts Sundays in Week and Day
• BACnet: GetEnrollmentSummary: correct reply if list is empty

Firmware 1.28.51 (April 2022)

Main corrections

• All PCD’s: Saia PCD Modbus diag does not work if diag flag > 9999
• All PCD’s: SNTP and hardware RTC is diverging from more than 2 seconds, then History message ‘RTC Fail error’ is generated
• All PCD’s: SNTP Time synchronization does not work with DHCP
• All PCD’s: E-Mails send from PCD could contain unwanted characters like 0 or others
• All PCD’s: S-Monitoring values for S-Monitoring bar graphs are sometime wrong
• All PCD’s: S-Monitoring Year graph scaling displayed wrongly
• All PCD’s: TCP, open data mode protocol, communication is blocked after rejection of 32 connections
• All PCD’s: LonIP CSF is locked when an error occurs
• PCD2.M45x0: SRXM does not support FB parameters as operand 3 and 4 for source and destination
• PCD1.M2220-C15: Watchdog LED does not follow Relay when PCD goes in STOP or HALT
• PCD3.M6880: Data exchange between CPU 0 and CPU 1 does not work reliable if STL instruction is used
• BACnet: Calendar state not updating after add/remove list element service
• BACnet: Exception schedule writing to certain array index fails
• BACnet: Schedule crashes with SWTO error
• BACnet: MS/TP client properties are not written if many values change simultaneously
• BACnet: Problem reliability & out of service, reliability is not written when oos is high
• BACnet: Web CGI commands to read BACnet platform tags like ..AddFW,Version,BACnet don’t work
• BACnet: Web scheduler/calendar templates do not work
• BACnet: PCD3.M6860 no BACnet communication on ETH2 if router is used
• BACnet: Rev 4 not working with Name based Client
• BACnet: Rev14 does not allow high limit value below 5 on analogue input

Firmware 1.28.37 (February 2019)

New features

• All PCD’s: FW extension to close all open FTP connections
• BACnet: Calendar objects have been extended with a synchronization mode. Each server calendar object can be configured as Slave or Master calendar
• BACnet: New mappings for alarming counters have been added to Notification-Class objects.
• BACnet: The PCD will now accept AcknowledgeAlarm service requests, which use complete wildcards as timestamps.

Main corrections

• All PCD’s: On S-Bus data mode, if S-Bus CRC contains a S-Bus DLE as last character then S-Bus telegram is incorrect and not accepted from S-Bus recipient. (Since FW 1.28.20)
• All PCD’s: Not all bytes are transmitted when working with MC4 or MC5 mode on F2xxx module
• All PCD’s: RS485 driver keep holding bus after a while
• All PCD’s: Http request ‘is modified’ is not handled correctly on the PCD Web-Server which lead to the effect that web project is not loaded correctly on the browser
• All PCD’s: PCD can crash when breakpoint is updated during conditional RUN
• All PCD’s: PCD can crash on download in run since FW 1.28.27.
• All PCD’s: PCD can crash on download in run when Graftec is used
• All PCD’s: PCD crashes when using browser to access the default page of PCD with "Display Root Content Enabled = YES"
• All PCD’s: RCOB does not start COB when it was stopped before with SCOB
• All PCD’s: Profibus communcation using onboard FDL port. The FCS test for SD2 telegram was not implemented correctly.
• All PCD’s: When S-Bus IP Nodelist is used it’s possible that the communication using nodes does no more work after execute a download in run
• All PCD’s: XOB parameter as Registers does not work if 16bit addressing was used
• All PCD’s: LonFT10: SNVT_obj_status and SNVT_obj_request can be used in user profiles
• PCD3.Mxx60, PCD3.T6xx, PCD1.M2xx0, PCD2.M4x60: usage of I/O media mapping slows done the cycle time 2 times in comparison to FW 1.26.xx
• PCD2.M4x60: Download LonIP config not possible
• PCD2.M4x60: RTC gets sometime corrupted data when PCD7.F7500 is used on PCD2.M4x60
• PCD2.M4x60: RTC Time is wrong after several days of run
• PCD7.D443WTxR: uBrowser use alphapad.teq even if screen is rotated by 90°
• PCD7.D443WT5R: History entry Memory ‘Lost -1’ written in the History
• BACnet; Event Enrolment does not work correctly with external reference devices.
• BACnet; When using BACNet Webvisu the memory used increase each time the scheduler is edited.
• BACnet; PCD crash when BACnet Webvisu edit scheduler.
• BACnet; BACnet WebVisu does not display correct value for the WeeklySchedule value.
• BACnet; ACK Required bit in notification message is not set according to the related NV ack_required bits
• BACnet: The PCDAlarmStatus mapping property does not work correctly.
• BACnet: Mappings, which changed to the value 0 directly after a program download, are not updated correctly on the BACnet property.
• BACnet: The Priority-Array mapping does not work correctly after startup.
• BACnet: Initialization of Puls converter count with input reference gives error
• BACnet: Fix issue with weekly scheduler.
• BACnet: Fix issue with WeekNDay entries
• BACnet: The Restore functionality over BACnet does not work, when the PCD has been reset over factory reset.
• BACnet: The Action property in the command object does not handle NULL datatype and priority entries correctly, if they are used in the ActionCommand. Additionally, the Action property can now be read via index.
• BACnet: Priority_Array entry 16 will be overwritten on startup with the last Present_Value mapping
• BACnet: Out of Service -> Value for PV overridden after reboot by Input ref
• BACnet: The Log_Buffer to csv conversion for trend-log objects does not skip time change entries
• BACnet: Unmapped Priority-Array property array entries are not stored persistent
• BACnet: BACnet configuration on the PCD is not deleted when "unlinked" from PG5
• BACnet: Change Client Time_Of_Restart mapping to Unix time
• BACnet: Client mapping - Threshold is not implemented correctly
• BACnet: Mapped Reliability properties within analogue objects does interfere with the objects functionality. When the Reliability is mapped, the mapping has not full control over the property value.
• BACnet: The program download fails, when the BACnet config contained notification-class objects with event-counter mappings
• BACnet: BACnet Trend-Log(-Multiple) data can’t be retrieved as csv data
• BACnet: The SubscribeCOVProperty service can’t be executed on complete Priority_Arrays

Firmware 1.28.16 (June 2017)

New features

• All PCD's: When push button is pressed while power on then do not update FW from FS in order to execute a delete all.
• PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668:
  Enhancement for HTTP server to transparently support sending compressed files.

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.
• PCD7.D443WT5R: Alarming does not work since 1.28.00 FW.
• PCD7.D443WT5R: When watchdog timeout occurs PCD7.D443WT5R does't reboot and stays locked.

Firmware 1.28.11 (Arpil 2017)

New features

• All PCD's: Support of BACnet Revision 14

Main corrections

• All PCD's: Various Open Data Mode fixes: Read Timeout enhancement, Client Connection timeout and Client Keep alive with anonymous port issue fixed
• All PCD's: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occurring at the moment of the timeout.
• All PCD's: Battery status shows FAIL also if battery module is missing.
  All PCD's: Various minor issues fixed
• PCD1.M2xx0 & PCD3+: 38400/115200 baud settings adjustment
• PCD2.M4x60: PCD7.F7500 initialization

Due to a production error it's possible that PCD2.M5540 which have been produced in 2020 may contain a wrong production date with year 2000 and calendar week 0.

This wrong production date leads to an error message being entered in the PCD history:
'FABINFO CRC FAIL'

and in the PG5 Online configurator hardware info and in the diagnostic file the warning:
'Fab. Date (year/week): 2000/00; BAD PROD INFO CHECKSUM'
is displayed.

Error description:

This wrong production date leads to an error message being entered in the PCD history and also in the hardware info of the PG5 Online configurator the warning is displayed.

However, the PCD2.M5540 works perfectly.

I.e. the functionality of the PCD2.M5540 and the user program which is processed on the PCD2.M5540 are in no way affected by this warning.

Information shown in PG5 online configurator, Hardware Info...

Information shown on PCD's history

Solution:

To fix the issue, load the attached program on the affected PCD2.M5540 and set PCD2.M5540 in Run mode.

The program will set the manufacturing date to the year 2020, calendar week 60 and store the information retentively in the uEprom of the PCD2.M5540.

Calendar week 60 was used to recognize that the fabrication date was modified using this PG5 program.

After switching an off and on of the 24VDC the warning
'Fab. Date (year/week): 2000/00; BAD PROD INFO CHECKSUM'
is no longer displayed and the fabrication date year 2020, calendar week 60 is displayed.

The program only needs to be run 1 time on the PCD2.M5540.

It is not necessary to integrate the program into your application program.

Then load your application program into the PCD.

Symptoms
Programmable PCD devices that act as S-BUS master on RS485 with PCD Firmware >= 1.28.20 and <= 1.28.33 get no answer from Slave devices on some of the S-Bus master requests, although S-BUS address, baud rate, polarity and line termination are ok.

Possible effects of the issue

Until now we have found that E-Line RIO communication seems to be more concerned of this problem than e.g. RS485 S-Bus data communication between CPU's.

In some of the cases the effect was, that it was not possible to write to the outputs of the E-Line RIO's or the change of values on the E-Line RIO Inputs was not transfered to the S-Bus master.

With the concerned Firmware it might be very difficult or impossible to download the user program over a gateway connection.

PCD Firmware 1.28.x for all programmable PCD types are concerned.

Reason

The reason of the issue is a error in the Firmware of the S-Bus master.
The problem on the Firmware is, that telegrams which contain DLE characters (B5 or C5) as last character of the telegram (CRC) where malformed because the last character is missing.

Since the CRC is calculated during runtime this malformed S-Bus request occurs depending of the content of the S-Bus request.

The (malformed) CRC is transfered with the S-Bus request from the master to the slave.

If now the slave receives the S-Bus request and the received CRC does not fit with the calculated CRC, then the S-Bus slave reject the S-Bus telegram.

Solution

In case you use the concerned Firmware on an installation with RS485 S-Bus Data communication, update the S-Bus master PCD to the newest available Firmware >= 1.28.34.

This Firmware do fix the issue CVE-2017-9628 related to Ethernet frame padding information leakage.
To avoid any problems in relation to this leakage we do recommend strongly to update to the latest Firmware
1.28.16 / 1.24.69 or newer as mentioned on the security upgrade section on this web-page.

Impact of the CVE-2017-9628
IEEE 802 specifies that packets have a minimum size of 56 bytes.
The Ethernet driver is expected to fill the data field with octets of zero for padding when packets are less than 56 bytes.
Resident memory and other data are used for padding in some implementations that could cause information leakage.
This attack is passive; the attacker can only see data that the affected devices sent out as part of a packet.

Vulnerability overview of the CVE-2017-9628
The previous implementation of firmware allowed other data from a known area of memory to be used in this field and could exfiltrate or leak data.

In April 2022:
the COSinus FW 1.28.51 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

In February 2019:
the COSinus FW 1.28.37 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

In June 2017:
the COSinus FW 1.28.16 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.28.16 was put into production, which do support the BACnet Revision 14.
To support the BACnet Revision 9 it's necessary to use the PCD and the BACnet FW 1.26.xx.

Attention:
The firmware 1.28.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx, 1.26.xx or newer to a not compatible PCD

Firmware 1.28.51 (April 2022)

Main corrections

• All PCD’s: Saia PCD Modbus diag does not work if diag flag > 9999
• All PCD’s: SNTP and hardware RTC is diverging from more than 2 seconds, then History message ‘RTC Fail error’ is generated
• All PCD’s: SNTP Time synchronization does not work with DHCP
• All PCD’s: E-Mails send from PCD could contain unwanted characters like 0 or others
• All PCD’s: S-Monitoring values for S-Monitoring bar graphs are sometime wrong
• All PCD’s: S-Monitoring Year graph scaling displayed wrongly
• All PCD’s: TCP, open data mode protocol, communication is blocked after rejection of 32 connections
• All PCD’s: LonIP CSF is locked when an error occurs
• PCD2.M45x0: SRXM does not support FB parameters as operand 3 and 4 for source and destination
• PCD1.M2220-C15: Watchdog LED does not follow Relay when PCD goes in STOP or HALT
• PCD3.M6880: Data exchange between CPU 0 and CPU 1 does not work reliable if STL instruction is used
• BACnet: Calendar state not updating after add/remove list element service
• BACnet: Exception schedule writing to certain array index fails
• BACnet: Schedule crashes with SWTO error
• BACnet: MS/TP client properties are not written if many values change simultaneously
• BACnet: Problem reliability & out of service, reliability is not written when oos is high
• BACnet: Web CGI commands to read BACnet platform tags like ..AddFW,Version,BACnet don’t work
• BACnet: Web scheduler/calendar templates do not work
• BACnet: PCD3.M6860 no BACnet communication on ETH2 if router is used
• BACnet: Rev 4 not working with Name based Client
• BACnet: Rev14 does not allow high limit value below 5 on analogue input

Firmware 1.28.37 (February 2019)

New features

• All PCD’s: FW extension to close all open FTP connections
• BACnet: Calendar objects have been extended with a synchronization mode. Each server calendar object can be configured as Slave or Master calendar
• BACnet: New mappings for alarming counters have been added to Notification-Class objects.
• BACnet: The PCD will now accept AcknowledgeAlarm service requests, which use complete wildcards as timestamps.

Main corrections

• All PCD’s: On S-Bus data mode, if S-Bus CRC contains a S-Bus DLE as last character then S-Bus telegram is incorrect and not accepted from S-Bus recipient. (Since FW 1.28.20)
• All PCD’s: Not all bytes are transmitted when working with MC4 or MC5 mode on F2xxx module
• All PCD’s: RS485 driver keep holding bus after a while
• All PCD’s: Http request ‘is modified’ is not handled correctly on the PCD Web-Server which lead to the effect that web project is not loaded correctly on the browser
• All PCD’s: PCD can crash when breakpoint is updated during conditional RUN
• All PCD’s: PCD can crash on download in run since FW 1.28.27.
• All PCD’s: PCD can crash on download in run when Graftec is used
• All PCD’s: PCD crashes when using browser to access the default page of PCD with "Display Root Content Enabled = YES"
• All PCD’s: RCOB does not start COB when it was stopped before with SCOB
• All PCD’s: Profibus communcation using onboard FDL port. The FCS test for SD2 telegram was not implemented correctly.
• All PCD’s: When S-Bus IP Nodelist is used it’s possible that the communication using nodes does no more work after execute a download in run
• All PCD’s: XOB parameter as Registers does not work if 16bit addressing was used
• All PCD’s: LonFT10: SNVT_obj_status and SNVT_obj_request can be used in user profiles
• PCD3.Mxx60, PCD3.T6xx, PCD1.M2xx0, PCD2.M4x60: usage of I/O media mapping slows done the cycle time 2 times in comparison to FW 1.26.xx
• PCD2.M4x60: Download LonIP config not possible
• PCD2.M4x60: RTC gets sometime corrupted data when PCD7.F7500 is used on PCD2.M4x60
• PCD2.M4x60: RTC Time is wrong after several days of run
• PCD7.D443WTxR: uBrowser use alphapad.teq even if screen is rotated by 90°
• PCD7.D443WT5R: History entry Memory ‘Lost -1’ written in the History
• BACnet; Event Enrolment does not work correctly with external reference devices.
• BACnet; When using BACNet Webvisu the memory used increase each time the scheduler is edited.
• BACnet; PCD crash when BACnet Webvisu edit scheduler.
• BACnet; BACnet WebVisu does not display correct value for the WeeklySchedule value.
• BACnet; ACK Required bit in notification message is not set according to the related NV ack_required bits
• BACnet: The PCDAlarmStatus mapping property does not work correctly.
• BACnet: Mappings, which changed to the value 0 directly after a program download, are not updated correctly on the BACnet property.
• BACnet: The Priority-Array mapping does not work correctly after startup.
• BACnet: Initialization of Puls converter count with input reference gives error
• BACnet: Fix issue with weekly scheduler.
• BACnet: Fix issue with WeekNDay entries
• BACnet: The Restore functionality over BACnet does not work, when the PCD has been reset over factory reset.
• BACnet: The Action property in the command object does not handle NULL datatype and priority entries correctly, if they are used in the ActionCommand. Additionally, the Action property can now be read via index.
• BACnet: Priority_Array entry 16 will be overwritten on startup with the last Present_Value mapping
• BACnet: Out of Service -> Value for PV overridden after reboot by Input ref
• BACnet: The Log_Buffer to csv conversion for trend-log objects does not skip time change entries
• BACnet: Unmapped Priority-Array property array entries are not stored persistent
• BACnet: BACnet configuration on the PCD is not deleted when "unlinked" from PG5
• BACnet: Change Client Time_Of_Restart mapping to Unix time
• BACnet: Client mapping - Threshold is not implemented correctly
• BACnet: Mapped Reliability properties within analogue objects does interfere with the objects functionality. When the Reliability is mapped, the mapping has not full control over the property value.
• BACnet: The program download fails, when the BACnet config contained notification-class objects with event-counter mappings
• BACnet: BACnet Trend-Log(-Multiple) data can’t be retrieved as csv data
• BACnet: The SubscribeCOVProperty service can’t be executed on complete Priority_Arrays

Firmware 1.28.16 (June 2017)

New features

• All PCD's: When push button is pressed while power on then do not update FW from FS in order to execute a delete all.
• PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668:
  Enhancement for HTTP server to transparently support sending compressed files.

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.
• PCD7.D443WT5R: Alarming does not work since 1.28.00 FW.
• PCD7.D443WT5R: When watchdog timeout occurs PCD7.D443WT5R does't reboot and stays locked.

Firmware 1.28.11 (Arpil 2017)

New features

• All PCD's: Support of BACnet Revision 14

Main corrections

• All PCD's: Various Open Data Mode fixes: Read Timeout enhancement, Client Connection timeout and Client Keep alive with anonymous port issue fixed
• All PCD's: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occurring at the moment of the timeout.
• All PCD's: Battery status shows FAIL also if battery module is missing.
  All PCD's: Various minor issues fixed
• PCD1.M2xx0 & PCD3+: 38400/115200 baud settings adjustment
• PCD2.M4x60: PCD7.F7500 initialization

With Firmware >= 1.26.00, after Power off / on of the PCD, the LON bindings are lost.

Symptoms

The LON communication don’t works anymore after power off/on. In the commissioning tool, e.g. NL220  the Lon node is getting “red” after the function Network –>Test

Reason

In the FW 1.26.xx there is a problem with the file update on the Flash cards, the bindings are only updates in the memory but the operation to save them to the filesystem fails. Therefore the binding information is lost after power off / on.

Solution

The correction is done with >= 1.26.24. The firmware of the PCD and the LonIP FW have to be updated.

In the commissioning tool e.g. NL220 a Network -> Repair function has to be executed on the node.

Only the FW >= 1.26.00 are concerned. (e.g. FW 1.24.xx is not concerned of this problem)

In June 2017:
the COSinus FW 1.26.31 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.26.31 was released as maintenance version, which do support the BACnet Revision 9.
To support the BACnet Revision 14 it's necessary to use the PCD and the BACnet FW 1.28.xx.

In March 2017:
the COSinus FW 1.26.28 was introduced into production for the systems:

- PCD1.M2220, PCD1.Mxx60, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.26.28 was introduced into production

In June 2016:
the COSinus FW 1.26.15 was introduced into production for the systems:

- PCD1.M0xx0, PCD1.M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

The COSinus FW 1.26.16 was introduced into production for the systems: PCD3.T665/T666/T668.

The BACnet and LonIP FW 1.26.15 was introduced into production

Attention:
The firmware 1.26.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx or 1.26.xx to a not compatible PCD.

Firmware 1.26.31 (June 2017)

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.

Firmware 1.26.28 (March 2017)

Improvements

• Text Ram can now be cleared (all chars are set to blank space) with the cgi interface by writing a zero length string.
• Ping request on ETH2 over rooter from different sub net.
• LonIP Mapper improvement
• Web Server RAM Disk increased
• Error Led not set on IR overflow

Main corrections

• All PCD's: MC0 communication with F2xx module and related communication flags are handled correctly in case of transmission
• All PCD's: Text Ram can now be cleared (all chars are set to blank space) with the cgi interface by writing a zero length string.
• All PCD's: Multiple AlarmLists with similar names will now be "initialized" correctly.
• All PCP's: TCP client keep alive is not working when anonymous port is used.
• All PCD's: Profi-SBus GWY does not wor, Profi-SBus Master/GWY stop working after cable is re plugged.
• All PCD's: PCD crash when use DIGI(R)/DIGO(R) with first parameter as FB parameter.
• All PCD's: Correction for modbus RTU communication over F2xx communication module
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• PCD1.M22x0: While changing the analog output value, the Watchdog is switching. Switching the Watchdog Relais over the corresponding flag has no influence.
• PCD2.M4x60: Sometimes the Profibus DP module is not initialized correctly on startup.
• PCD2.M5xx0: When Restore program because of a missing or dead battery configuration (SBus/IP,..) is not restored correctly.
• PCD2.M5xx0: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occuring at the moment of the timeout.
• PCD2.M5xx0: Sometimes config is lost after download project with self-download tool.
• PCD3.Mxxx0: Battery status shows FAIL also if battery module is missing.
• PCD3.Mxxx0: FTP server processing with long commands resolved.
• PCD3.Mxxx0: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occuring at the moment of the timeout.
• PCD3.Mxxx0: Sometimes config is lost after download project with self-download tool.
• PCD3.Mxx60: Profi-SBus/DP/SIO does not work on port 2 on PCD3.M3x60 & PCD3.M5360.
• PCD3.M6860: Ping request from over rooter from different sub net is not respond.
• PCD3.M6860/M880: Profibus/S-IO/Profi-SBus does not work stable.
• PCD3.M6860: Set PCD to HALT if there is no or incompatible media transfer between the two CPU's.
• PCD3.T66x: The RIO Status web page does not allow to clear the diagnostics.
• BACnet: The memory usage of the BACnet FW was increasing for every SubscrobeCOVProperty service, which has been received by the PCD.
• BACnet: A client configuration for Priority_Array properties in commadable objects (e.g. Analog-Value) does now allow reading (ReadProperty/COV) and writing (WriteProperty service to server) at the same time.
  
  

Firmware 1.26.15 (June 2016)

New features

• Support of PCD1.M2220-C15
• Support of PCD2.M4x60
• Support of PCD3.M3160/PCD3.M3360/PCD3.M5360
• Support of PCD3.M6880, PCD3.T668 Standby-CPU-System

Improvements

• PCD2.M4x6x, support Interrupt when reaching the configured ref Value
• PCD1.Mxxx0, PCD2.M4x60, PCD3.Mxx60 PCD7.D4xx: Increase None Volatile Register to 1000
• PCD3.T666/8: Increase the User Program Memory for to 256k
• PCD3.T66x: Support the ESIO manager use tag values for IP address
• PCD2/3.F2xx modules Baudrate: Support 300/600/1200 baud settings for in MC mode.
• S-Monitoring: In bar displays where the current time is visible, the average for the period is calculated not in a optimal way (time slice, ref time, is a bar). New it's displayed in seconds
  
  

Main corrections

• PCD3.M6860/M6880: When update FW on extension using the file system after update the extension FW can stay in an endless loop
• PCD3.M6880: crash wen Timmer/Counter is mapped in the Read Symbols
• PCD3.M6880: PCD can crash with MuKe Error when use the SBus GWY in parallel with modbus TCP
• PCD3.M6880: Standby CPU1 does not always HALT when CPU0 crash
• PCD3.M6880: CPU0 to 1 From Read data communication sometimes stop works
• PCD3.M6880: Add a Transmit Error diagnostic tag "DataTxErrors"
• PCD3.Mxxx0: Battery module on IO slot 3 does not show battery status in history
• PCD3.Mxxx0/PCD1.M2xx0: Some baudrates on onboard ports are not correct
• PCD2.M4x60: RTC read/write locks the PCD for about 30ms
• PCD2.M4x60: Modem does not work because of the not working DCD
• PCD3.T66x: Add ELine CSF library
• PCD3.T66x: Serial com does not work with SASI instruction
• PCD3.T66x: CSF Modbus Server Init gives an error when port 502 is used becasue this port is already open
• PCD7.D443WT5R: Assignation/Configuration of port 1 should return an error because port 1 is not supported
• PCD7.D443WT5R: Remove IO access from the system. PCD goes now in HALT with "INVALIDE OPCODE"
• PCD2.W220 with Pt1000: Significant deviation between singel channels
• BACnet: List Properties (like Date_List, Exception_Schedule, ...) could disappear after a PCD restart, if a WriteProperty request with an empty list value has been received for these properties before the restart. This behavior was only present for persistent properties
• BACnet: The Log_Buffer property of a Trend-Log object could not be read anymore using the ReadRange service, after a Event-Log or Trend-Log-Multiple has been read via ReadRange
• BACnet: Writing a single analog output channel is not working. The output is not changing. Writing output channels over the mapped functionality is working
• BACnet: PCD with BACNet loops with restart if program has "INVALIDE OPCODE"
• Restart Warm does not work
• SBus ELine has sometimes retries
• When create a Text/DB the backup fails until a restart is done
• PCD Crash with BUS ERROR on STXT instruction when text is empty
• Modem does not work correctly
• Modem does not work or PCD crash when modem is configure
• PCD can crash when error occurs in Modbus RTU
• The PCD crash if a BITI is executed with number as FB parameter
• PCD crash when use Profi-S-Bus Master
• Sometimes the program is lost when update FW from 1.24.xx to 1.26.xx
• MOVX/DIVX function where not working on Task or Temporary data when use indexed
• Add config tag value for GWY mode "data_no_secure" to deasble the secure data mode
• Not possible to upload a file through the Web server FTP interface (ftp.cgi or ftp.json) if that file starts with a white space character (either a space or a tab)
• CSF CopyDBBytesToR crash when destination is bigger than last Register
• Diagnostic Flags in S-Bus Master mode are not correct if there are collisions on the RS-485 network
• CSF Backup/Restore Media does give an error on restore when data change while backup/restore
• MOV instruction with type position as FB parameter gives error flag and fails
• Web-Alarm: Fix alarming color with "group color mode" and group bigger than 8

It’s possible that after a FW update of the PCD to the FW 1.20.xx, 1.22.xx or 1.24.xx there is a entry in the FW history ‘FWDnld UnknownFW’ after the history line ‘FWDnld 1.2x.xx PLC CLASSIC’ as shown on the image below.

The history message ‘FWDnld UnknownFW’ was caused by an error in the old FW of the PCD and does have no signification.

Just ignore this message and clear the history messages.

In case an FBox library (or an IL program) uses a functionality which is not implemented in the PCD firmware, the PCD will not go in run but display the error message "SF not loaded" (e.g. in the PCD history or in the Online Configurator).

Symptom
After the download of a program a SBC-NT based PCD (e.g. PCD3) does not go in run but remains in halt. When going online with the Online Configurator a message "SF not loaded" is displayed.


Reason
The user program uses a functionality which is not implemented in the firmware (and therefore the PCD can not run the user program).

Solution
The solution is either updating the firmware, or avoiding the CSF which leads to the problem.
In case it is not know which CSF is responsible for the "SF not loaded", the SF library can be found based on the program line indicated by the Online Configurator (the program line is indicated with "Halt at xxx" in the Status; in the screenshot above the CSF is on program line 4). By using the Online Debugger, this CSF can be displayed by typing "DP4C10"):

   Display Program 4 Count 10 (Enter)
  

In this case, the CSF calls the SF library 26 (which is not implemented in the Firmware 1.10.51 which is used above).

How to know the functionality based on the library number?
Below you can find a list of the most commonly used System Function libraries (and in which FBox libarary they are used):

• SF library 0: S.SF.IP (e.g. Open Data Mode)
  Used by several IP communication drivers such as EIB/Net and for reading or writing the IP address of the PCD.
• SF library 2: System library
  Used by FBoxes for reading the Serial number
• SF library 4: S-Net library
  E.g. Used by FBoxes for Profi-S-Bus and Ether-S-Bus
• SF library 6: S.SF.DBLib (e.g. CopyTextBytes), previously the "ApplicationLib" for CopyText
  E.g. used by the Modem FBox library, HDLog to File library.
• SF library 7: File System library
  E.g. used by the FBoxes for the File System or "HDLog to File"
• SF library 9: IP Services (EMail, PPP, DNS, SNMP etc.)
  E.g. used by the EMail library and the WAA (Wide Area Automation) FBox library
• SF library 10: S-Web Alarming library
  E.g. used by the S-Web Alarming FBoxes and the DDC Suite
• SF library 13: Modbus library
  E.g. used by Modbus and the P-Bus FBox library
• SF library 19: LON over IP library
  used by LON over IP functions
• SF library 22: SPI framing protocol for PCD2/3.F2xx(x)
  e.g. used by the M-Bus library 2.6.100 and later
• SF library 23: Energy Manager library
• SF library 25: LON FT library
• SF library 27: ELine library for ELine modules
  Since PCD firmware version 1.24.xx

The single function codes (second line of the CSF call, "0" in the screenshot above) of the relevant libraries can be found in the definition files in folder
   c:\Documents and Settings\All Users\Saia-Burgess\PG5_20\Libs\SF\*.lib
(e.g. SFModbusLib_en.lib for the functions of the Modbus library.

As the "original" Instruction List Set (with the mnemonics STH, OUT etc.) could not be extended by an unlimited amount of new instructions, the call of new features such as the Open Data Mode, Sending of EMails etc. is realised with so called SFs (which stands fro "System Function"). These SFs are called using CSF instructions (Call System Function).

What is a SF library?
A System Function library is a a set of functions which are implemented in the firmware and which can be called with the IL mnemonic CSF. Usually one SF library contains several functions which are related to each other. A CSF expects the SF library and the function from this library, together with a set of parameters (described in the online help of the SF library which can be found in the IL Editor SEdit from PG5 2.0).

How is a CSF used?
In the user program a SF function is called using the mnemonic CSF, followed by the library, the function and the parameters:
CSF     [cc]     Library
                    Function
                    Parameter 1
                    Parameter 2
                    ...


This can be done from inside an FBox, or directly from an IL program (as the engineering is faster using the FBoxes, the most CSFs are called from FBox libraries).
The "translation" between meaningful names (e.g. S.SF.DBLIB.CopyTextBytes) and the code which is used by the firmware is done by PG5. For a list of the most commonly used SF libraries, please refer to FAQ 101568.

Even the firmware filename suggests hardware rev. 'D' is needed this firmware is suitable for revisions 'A' and later.

With PG5 2.0 the current production firmwares gets also installed on the computer. They are located in the directory
"c:\Program Files\SAIA-Burgess\PG5_20\FW\Classic\" or similar.



The filename for the PCD2.M5_ contains a wrong minimum hardware revision description and is named "PCD2M5xx0_1.14.23(HW min D).blk" by mistake.
So in contrast to the filename the firmware 1.14.23 is applicaple to PCD2.M5xx0 with hardware revision 'A' and later.
The filename will be corrected with the next service pack for PG5 2.0.

In July 2010 the firmware 1.14.23 has been introduced into production for the PCD2.M5xx0 and the PCD3.Mxxx0. This FAQ lists the main differences between versions 1.10.51 and 1.14.23.

New features
please note that in order to take advantage of these new features PG5 2.0 SP1 (PG5 2.0.150) is required.

• Increased amount of available flags (14335 instead of 8191), see FAQ 101447
• S-Web and FTP Server as well as the IP Enhancements (DHCP, DNS, SNTP and PPP) can be configured in the Device Configurator, see FAQ 101464
• Webserver access levels can now be configured in the Device Configurator (was before in the WebBuilder settings), see FAQ 101613
• IEEE floating point values can be displayed on the S-Web server (display format is “e”), see FAQ 101188
• Number of COBs increased to 32, see FAQ 101467

Main corrections

• SYSWR for DB backup failed after a lot of backups, see FAQ 101466
• STXT with more than 512 bytes sent a wrong text, see FAQ 101468
• The IP address for the Open Data Mode System Function “ConnectTCP” could not be given as constant 

Hardware compatibility of firmware 1.14.23 with PCD3 systems
The firmware 1.14.23 requires a PCD equipped with 4 MB onboard flash. Therefore the minimal hardware versions for installing the 1.14.23 and later are:

For PCD3 systems older than listed the firmware 1.10.61 is the last firmware which can be installed on these systems. This firmware is and remains available on the support site in parallel to the 1.14.23.

Remarks 

• When updating from 1.10.xx
  Please note that the user program as well as the communication settings are lost during the firmware update from 1.10.xx to 1.14.xx (or 1.16.xx) 
• BACnet applications
  The BACnet firmware 1.14.26 is compatible to this new production firmware. Please download the latest BACnet firmware package for PCD firmware 1.14.xx from the support page (link below).

In case a text with more than 512 bytes is sent with a firmware older than 1.14.23 the according text has not been sent correctly.

Symptom
When sending a text with a length of more than 512 bytes on a PCD3 or a PCD2.M5 with a firmware older than 1.14.23 the text which is sent is not correct.
In case the text to be sent contains sub-texts which are introduced using interpreted text (e.g. the $Lnnnn) and the final length to be sent is more than 512 bytes, the same phenomenon can be observed.

Solution
Please update the firmware of your PCD to version 1.14.23 or later.

Up to firmware version 1.14.23 the maximal amount of COBs (Cyclic Organization Blocks) has been 16. In firmware 1.14.23 the amoung of COBs has been increased to 32. Thus on PCD2.M5 and PCD3 and newer systems up to 32 COBs can be used (COB to 31).

Remark
Please note that PG5 2.0 Service Pack 1 (PG5 2.0.150) is required in order to program the COBs 16 and higher.

In some cases, usually after a lot of backups which have been executed, the error bit 7 (flash task already started) or 8 (flash error) is set with firmware older than 1.14.23.

Symptom
A backup DB to flash (IL instruction "copy TEXT/DB to flash card", SYSWR 3000 or 3100) fails and the error bits 7 and/or 8 are set. This error remains, even after waiting several minutes without re-attempting a backup to flash.

Solution
This problem is corrected in firmware 1.14.23 or later. Please update your PCD firmware in order to solve this problem.

In May 2010 the firmware 1.10.51 has been introduced into production for the PCD2.M5xx0 and the PCD3.Mxxx0. This FAQ lists the main differences between these versions.

New features

• The Serial-S-Bus mode “Parity master” is now supported on all serial ports of the PCD, see FAQ 101103

Main corrections

• Increased stability for BACnet upload/merge (requires BACnet firmware version 1.10.50), see FAQ 101417
• Correction which avoids potential data loss on the SD cards when a card with more than 256 kBytes capacity is filled by 70%, see FAQ 101377
  In case an SD card is used on the PCD, the update of the firmware to the version 1.10.51 is strongly recommended!
• Avoided inter-character delay on port 2 and 3 (PCD2.M5) or 0 and 3 (PCD3) which could lead to communication problems, see FAQ 101382
• A Bus Error could occur in some specific cases, see FAQ 101418
• Reading Ni1000 sensors with a PCD2/3.W340 by the media mapping returned wrong values, see FAQ 101416
• Profi-S-I/O and Profibus DP Master did not work, see FAQ 101244

For writing data to files on the PCD file system and for sending SMS or EMails it is possible to enter the content of medias (registers, flags etc.) into the text to be written or sent. This is done by placing e.g. a $R0100 into the text to be sent. At the time of writing, the "$R0100" will be replaced by the content of the register 100.

While in the beginning only points could be used as seperators in interpreted texts, it is also possible using the comma as separator with recent firmware versions. In this case, instead of a point a comma is to be used:


Firmware dependencies
The comma separator can be used starting with the following firmware versions:

Under certain circumstances (if the file system is occupied by more than 70%) data losses on SD cards bigger than 256 MBytes have been observed.

Symptom
Under certain circumstances data losses on SD cards bigger than 256 MBytes have been observed. By analyzing these reports we have seen that in case more than 70% of the available memory on such a card is used it is possible that data is lost on the next power-up of the PCD or after the card has been re-inserted into the memory module holder (R600 / R6000) or opened by the SD Flash Explorer.
In case of many delete operations executed by the module the mentioned data loss can also occur if less than 70% of the available memory is used (due to the ware-out management of the SD card which varies the used memory areas).

Solution
An additional safety mechanism in the PCD firmware 1.10.51 as well as in the SD Flash Explorer in order to avoid future potential data loss on concerned cards has been implemented.
As soon as the system is rebooted (or the SD card is re-inserted into the R600 / R6000 mounted on a PCD with a new firmware versions) actions are taken in order to avoid the mentioned potential data loss.

The according firmware 1.10.51 (for PCD2.M5xx0 and for PCD3.Mxxx0 systems) with the new safety mechanism can be found on the support site www.sbc-support.ch.

In addition to the safety mechanism a new SD Flash Explorer version 2.0.215.0 features a “Backup” and a “Restore” feature which allows the creation of a backup of the file system.
This SD Flash Explorer can be downloaded from the support site from the section for the PCD7.R-SDxxx and will be distribued with the SP1 for PG5 2.0.

Remarks

• Even if the file system on a SD card is already filled up by more than 70%, it is still possible to download the data over FTP as long as the PCD is NOT switched off. This method is recommended before updating the firmware in order to guarantee that no data is lost.
• SD cards delivered by Saia-Burgess Controls AG after week7 of 2010 contain a mechanism that avoids the above mentioned data loss (as long as the card is not formatted with a firmware older than 1.10.51).
  

This FAQ contains an overview over the firmware versions currently used in production (which means that this firmware version is installed in our production facility).

Firmware versions used in production
The following firmware versions are currently used in production. For more information regarding the relevant firmware, please refer to the version information document of the according page.

PCD firmware versions

MB Panel firmware versions

RIO firmware versions

When working with PCD systems you will cross the expression "Saia PCD® COSinus" sooner or later. This FAQ explains what "Saia PCD® COSinus system" stands for.

The expression "Saia PCD® COSinus"
In general the expression "Saia PCD® COSinus" stands for PCD systems which are equipped with Freescale (previously Motorola) Coldfire CPU technology. The "non-Saia PCD® COSinus" systems from Saia-Burgess Controls AG are based on Freescale 68k CPU technology (e.g. PCS1, PCD2.M170 etc.).
The Coldfire CPU technology is a new and more performant CPU generation, new development is generally realized on Coldfire CPU (while the 68k CPUs still are available in parallel).
The first PCD system based on the Saia PCD® COSinus technology has been the PCD2.M48x. For this system the whole firmware has been re-written. The firmware of new systems is built up based on the firmware developed for the PCD2.M48x platform (having the same core modules). New firmware functionalities (e.g. Modbus which is implemented in the firmware) are basically designed for the Coldfire CPU technology and thus for Saia PCD® COSinus systems.

Saia PCD® COSinus based systems
The following list contains the main PCD systems which are based on Saia PCD® COSinus technology.

• PCD3.Mxxx
• PCD2.M48x
• PCD2.M5xxx
• PCD7.D4xx
• PCD1.M2xx (currently under development)

Does this mean that all Saia PCD® COSinus systems support the same firmware features?
No! Although the same base modules of the firmware are used, it is depending on the PCD system whether a specific feature is supported or not. For example the http protocol is supported by PCD3 and PCD2.M5xxx systems, but not on PCD2.M48x.

With an activated software watchdog the processor monitors itself and restarts the PCD in the event of a malfunction or a loop.

Description (extract from the hardware manual)
The hardware watchdog provides maximum security. However, for non-critical applications, a software watchdog may be suffcient, whereby the processor monitors itself and the CPU is restarted in the event of a malfunction or a loop.
The core of the software watchdog is the instruction SYSWR K 1000. When this is first issued, the software watchdog function is activated. This instruction must then be issued at least every 200 ms, or the watchdog will trigger and restart the controller.

Usage

• Placing a "Watchdog"-FBox in a FUPLA-file is the easiest solution:
  
• Instead of using the FBox it is possible calling the Software Watchdog in IL (using the instruction SYSWR K 1000)
  

If there is a SIO-Master and a DP-Master configured the SIO-Master does not go in the "Operate" state to make the data exchange.

Symptom
It can happen with the firmware version 1.10.16 that a PCD3 or a PCD2.M5 does not work as SIO-Master if they are also DP-Master.

Solution
This behavior is solved with the version 1.10.51 or newer (the first version which corrected this situation was 1.10.20). Please update the firmware of your PCD in order to solve this issue.

The WebServer2 is a re-implementation of the previous WebServer on Saia PCD® COSinus systems and of course compatibel to the previous version.

History
The first implementation of a Web Server on PCD systems has been realized around the year 2000. With growing experience additional features and higher performance have been requested. In order to fullfil this requirement, the WebServer has been re-implemented (with the result of the WebServer2).

What is new in the WebServer2?
In general the WebServer2 is functionally compatible to the previous implementation. In addition the following new features are supported:

• HTTP 1.1 support
• HTTP caching is supported. As result the in FAQ 100708 is no longer to be applied; It is recommended to enable the caching for the JVM (option "keep temprary files on PC") when working with the WebServer2.
  
  Remark: If the caching is not enabled, you will not profit from the supported caching; it will then work as it has before with the previous WebServer. 
• Better performance
• Parallel acces to files is properly supported (acces is no longer interrupted if another client loads the IMaster applet)
• Multiple Web clients can access the Web Server on the same physical interface with (Ether-S-Bus or Profi-S-Bus)
• Easier understandable error messages
• When texts are entered, the length of the text is specified (and no longer filled up with space characters)
• The WebServer2 does provide more information on the default page and has a nicer look. By viewing this page it is easy figuring out whether the WebServer2 is running on a PCD
  

  View of previous WebServer	View of WebServer2

Firmware (FW) supporting the WebServer2
The table below indicates the first firmware versions supporting the WebServer2. Systems not listed in this table do not feature the WebServer2.

^*) Please note that in the first pilot firmware not all features have been supported.

Remark
The only incompatibe difference between the previous WebServer and the WebServer2 concerns users that use the "HTML forms":

• The previous Web Server used:
  %%TAG%
• The WebServer2 expects (the "value" is no longer automatically added by the Web Server):
  value=%%TAG%

An example for the HTML forms on the WebServer2 can be found in the attached document.

Yes, a new set of instructions for calculation with IEEE floating point values (single and double) has been added to the firmware of PCD2.M480, PCD2.M5xx0 and PCD3.

Introduction
Motorola FFP (Fast Floating Point) has been used for floating point calculations since the beginning of PCD history. In order to simplify the interface against systems which do not support FFp but IEEE format for floating point values the instruction set of the PCD has been extended. All "twin" of all instructions available for the calculation with FFP values are now also available for IEEE calculations.

What are the instructions in detail?
Each of the existing instructions for FFP (the default) do also exist for IEEE Float and IEEE Double data. 

• For IEEE Float, precede the mnemonic with an 'E' character, for example EIFP, EFADD (instead of IFP or FADD) etc.
• For IEEE Double, precede the mnemonic with 'D', for example: DIFP, DFSUB.

Minimum Firmware (FW) requirement for this feature

PCD systems not listed in this table do not support this function.

Remarks

• These instructions can only be used with PG5 2.0.
• There is also a new instruction for the conversion from IEEE single to IEEE double (and vice versa):
  EFPD (single to double) and DFPE (double to single). These instructions are supported by firmware version 1.10.15 and later.
• The instructions for convertig a IEEE double value to an integer value and vice versa (DFPI and DIFP) are working correctly starting with firmware 1.14.23.
• IEEE single values can be displayed by the S-Web Server using the format "e" (e.g. 172.16.1.127/cgi-bin/readVal.exe,e) 

For "reading" a value from a PCD text (e.g. copying "1234" from a PCD text with content "The next number is: 1234" into a Register) a new System Function has been added for PCD3 and PCD2.M5xx0.

What does this System Function (SF) do?
The new function "S.SF.DBLIB.ReadANumberFromText" allows reading a number from a text and copy it into a register. Starting from a provided pointer, the next number will be searched and copied.

Where do I find the documentation for this function?
This function is documented in PG5 2.0. The easiest way to open the documentation is opening the SEdit, selecting the "SF DB Access Library" and hitting "F1":


Minimum Firmware (FW) requirement for this feature

PCD systems not listed in this table do not support this function.

Remark
This feature can only be used with PG5 2.0.

For parsing a PCD text for a specific expression (e.g. finding "world" in a PCD text with content "Hello world") a new System Function has been added for PCD3 and PCD2.M5xx0.

What does this System Function (SF) do?
The new function "S.SF.DbLib.SearchText" allows searching a text for a specific expression. If this expression is found, the SF returns the position of the expression within the text.

Where do I find the documentation for this function?
This function is documented in PG5 2.0. The easiest way to open the documentation is opening the SEdit, selecting the "SF DB Access Library" and hitting "F1":


Minimum Firmware (FW) requirement for this feature

PCD systems not listed in this table do not support this function.

Remark
This feature can only be used with PG5 2.0.

In case a "non Saia PCD® COSinus" PCD or PCS1 system is connected with "Secure S-Bus Data mode" (e.g. over a serial cable or over modem) from time to time a telegram is not answered correctly.

Symptom
A PCD or a PCS connected with another system (e.g. PC or another PCD system) using the "Secure S-Bus Data mode" does not answer a telegram from time to time. This can e.g. be seen by a red LED on transmit or receive FBoxes (or in case a PC is used, by interpreting the tracewin files).
This phenomenon can be observed on PCD1.M1x5, PCD2.M150, PCD2/4.M170 and PCS1 systems (with firmware which are supporting the "Secure S-Bus Data mode"). Saia PCD® COSinus based systems (PCD2.M480, PCD2.M5xx0 and PCD3) are not concerned.

Reason
The reason for this behavior is that the PCD/PCS does not correcly answer telegrams where the sequence number in the secure S-Bus Data Mode header is 0xC5h. This is the case in every 255th telegram.
(The character "C5" should be replaced by "C5 01" but this is not done).

Solution
Please refer to the table below for firmware version which do correctly handle the "C5" and therefore the symptom described above is avoided.

The XOB 8 who is called when the firmware detects an invalid instruction (Invalid OPC) in the user program is no longer called on the systems Saia PCD® COSinus (PCD3, PCD2.M5, PCD2.M480).

On the new systems, the control of the Invalid OPC is executed at the startup during the precompilation. So the XOB 8 will never be called.
This new mechanism is implemented to increase the speed and the flexibility of the systems Saia PCD® COSinus.

The PCD3 systems equipped with an Ethernet port and the PCD2.M5540 are able to send emails. But sending e-Mails is not only depending on the CPU itself.

The PCD3 systems equipped with an Ethernet port and the PCD2.M554x support SMTP (Simple Mail Transfer Protocol). Sending emails does not only depend on this feature but as well on the ISP (Internet Service Provider), the firewalls and router configurations between PCD and ISP.

The attached checklist with the criterias to verify with your provider and / or your IT support shall help to check whether sending E-Mail is possible.

When trying to write a text (with address higher than 4000) using the S-Web Server, the PCD system stopps working and in the PCD history a "68k add Error" is indicated.

Symptom
When trying to write a text (with address higher than 4000) using the S-Web Server, the PCD system stopps working and in the PCD history a "68k add Error" is indicated.
The following PCD systems are concerned:

• PCD1.M1x5 with firmware version higher than 0B0
• PCD2.M150 with firmware version higher than 0E0
• PCD2/4.M170 with firmware version higher than 030
• PCS1.Cxx0 with firmware version higher than 0C0 

Reason
This behaviour is not intended. Due to a problem in the firmware the write access fails.

Solution
This problem is solved in firmware version 0E6 (the version indication 0E6 is the same for all systems) which can be downloaded from the support site (www.sbc-support.ch).

This error message appears if the used firmware on the CPU does not support the "active and non ACK" filter for the S-Web alarming functionality (e.g. a PCD2.M150 with firmware 0D3).

Symptom
Instead of the alarm list of the S-Web alarming macro, the message "Failed to get data on alarm.exe" is displayed on the alarming page.

Reason
The reason is that the macro tries receiving the alarms filtered by the "active and not acknowledged" state of the alarms. This does only work if this feature is implemented in the according firmware.

Solution
Please update the firmware (FW) of your PCD system to the firmware supporting the according feature (see table below).

^*) On PCD3 and PCD2.M480 systems the "active and not acknowledged" filter has already been implemented in previous versions, but has been improved this indicated version.

Yes, this is possible by calling the system function (CSF) "IPGetLocalConfig".

Introduction
For having the possibility to read the current IP configuration from the user program, a specific System Function has been added to the firmware. This function does return the IP address, the subnet mask as well as the default gateway (each address in one register). The returned value contains the full IP address in one register (each byte or the register contains one octed of the IP address):

Example
This System Function is part of the IPD Library. In order to use these functions, the file "IPLib.inc" is to be included to the source file where the function is called. This can be done with the line:

$INCLUDE "IPLib.inc"

The IP configuration can then be read in th following way:

Returned IP address (hex):               0xAC100179h
IP address in "Dot-decimal notation": 172.16.1.121 (0xACh = 172, 0x10h = 16, 0x01h = 1, 0x79h = 121)

Firmware versions supporting the GetLocalIPConfig
Please refer to the table below for the first firmware versions that support the "IPGetLocalConfig" function.

Remark
The include file "IPLib.inc" from PG5 1.4.300 and earlyer versions needs to be updated in order to "know" this feature. Therefore please download the file "IPLib.inc" attached to this FAQ and replace the existing file from PG5 which is located in the "Libs/App" of PG5:

c:\Program Files\SAIA-Burgess\PG5 1_4\Libs\App\IPLib.inc

In firmware version 1.08.xx for systems running the Saia PCD® COSinus firmware, the system watchdog has been introduced. If a PCD reboots because of the system watchdog, the message "SWTO ERROR" is entered in the PCD history.

What for is a system watchog?
The system watchdog is a security measure which avoids a situation where the system (PCD) is blocked and does not properly execute the program any more. If the OS (Operating System) is "locked" in a loop and does no longer properly execute its tasks (among others, the user program), the PCD is automatically re-started. 

What does the system watchdog do?
The (internal) system watchog is configured directly on the CPU and will cause a re-boot if it is not triggered in a cyclic manner. Every reboot caused by the system watchdog is entered in the PCD history with the message SWTO ERROR (SWTO stands for System Watchdog TimeOut).
The behaviour after the automatic reboot caused by the system watchdog is depending on the software watchdog which can be programmed in the user program:

• If the software watchdog in the user program is enabled, the PCD will automatically go in RUN after a reboot caused by the system watchdog. 
• If no software watchdog is programmed in the user program, the PCD will go to "Halt" after it has rebooted because of the system watchdog.

Does the system watchdog conflict with other watchdogs?
No, the system watchdog does not conflict with e.g. the software watchdog programmed in the user program or with a hardware watchdog.  
 
When has the system watchdog been implemented?
The system watchdog has been implemented in firmware version 1.08.xx. The first production versions for the relevant systems can be found in the table below:

Remark
Note that the system watchog does not detect a bogus user program (e.g. an infinite loop) and therefore the usage of the software watchdog in the user program is still recommended.

In firmware 03B and 03C an S-Bus broadcast telegram will block the communication interface until the next reboot of the PCD.

Symptom
When using firmware version 03B or 03C on either a PCD2.M480 or a PCD3.Mxxx0, the communication stops working after a sent broadcast. This only applies if the concerned PCD is acting as master on the S-Bus network.
This phenomenon occurs on S-Bus (Serial-S-Bus, Ether-S-Bus or Profi-S-Bus).

Reason
In firmware 03B and 03C an S-Bus broadcast telegram will block the communication interface until the next reboot of the PCD.

Solution
In order to resolve this problem, please update the firmware of your concerned PCD.

In order to simplify the interpretation of firmware versions and to avoid confusion regarding implemented features and bug fixes in different firmware versions, a new firmware version format for Saia PCD® COSinus based systems will be introduced.

Arguments for the new format
The new firmware version naming allows a clear and easy comparison between the different versions and their implemented features (PCD type specific) and bug fixes.
Questions like "Why is the Alarming functionality of the PCD3 Web Server implemented in firmware version $31 but not in version 031? - They both do have the same number..." should be past (however, if you're interested in the answer, please refer to FAQ100176)

Format description
The new firmware version name does consist of a major version, a branch version and a minor version separated by a dot (.).
Note that the prefix characters “0”, “$” or “#” are no longer used in this notation.

Concerned systems
The new firmware version format is applied to the systems based on Saia PCD® COSinus firmware (Classic and xx7). These are

• PCD1.M2xxx
• PCD2.M48x
• PCD2.M5xxx
• PCD3.Mxxxx
• PCD7.D4xx (MB Panels)

While the firmware names for the MB Panels and PCD1.M2xxx do have this format from beginning, it was introduced on the PCD3 and PCD2.M480 systems with the firmware version after 03B.

Version flow example
Below an example for a version flow. If e.g. a bug is corrected in the version 1.06.01, also version 1.07.02 and all following 1.06.xx versions do/will have this correction implemented.


Version types

• Released beta- or maintenance versions (equivalent to the current “Bxx” or “#xx” versions).
• Released Production versions (equivalent to the current “0xx” versions): These versions are introduced in the production.
• New function versions (equivalent to the current “$xx” versions).

Compatibility with PG5
The new firmware names are fully supported by PG5 V 1.4.200:

Previous versions of PG5 will only show the first three digits of the firmware version (e.g. “106” instead of “1.06.08”). The full firmware version can always be read by displaying byte F0F0 in the “Online Debugger” (type DYF0F0 ):

The diagnostic flag TBSY of the "Character Mode" (used for sending characters over a serial line) is not handled the same way on a PCD3 compared to "older" systems like e.g. PCD2.M170.

Symptom
If the relevant port is assigned in MC mode, the diagnostic flag TBSY is indicating that the serial port is busy sending characters. This is the case on e.g. a PCD2.M170.
This behaviour is not the same on a PCD2.M5xxx or a PCD3.Mxxxx, especially not when using a PCD3.F121 or a F2xx(x) modules. On a PCD3/PCD2.M5 the TBSY flag is not any more high during the whole time the port is busy. Instead, it is only high a short time at the very beginning of the send task.

Reason
The reason for this difference is a new manner to access the UART of the port. On older systems the characters were directly written to the UART while on the PCD3 a buffer is placed in-between. Instead of indicating the "send-state" of the UART like on older systems, the TBSY represents the state of this buffer (the size can be found at the end of this FAQ) on the PCD3 or the PCD2.M5.

Solution
This difference shouldn't lead to problem is most cases. However, in some applications the state of the TBSY is used to control e.g. the RTS signal of the line (using the instruction SOCL). In this case the communication (working on a PCD2.M170) won't work any more on a PCD3 or a PCD2.M5.
In this situation one of the following workarounds could be applied:

• Instead of assigning the port in MC0 it could be assigned in MC4 (MC4 is usually described as "MC for RS485"). In this mode the UART is managing the RTS autonomously (and therefore there is no more need to set the RTS by the user program). Note that in this case the SOCL commands are to be removed from the program!
• The duration while the RTS is to be set could be calculated beforehand (based on the amount of characters to be sent) and loaded into a timer. While this timer is high, the RTS can be set using the SOCL command.
  Note that this solution is not really a "nice" one and can only work with very low baud rates.

Notes

• All firmware versions of the PCD3xxx and PCD2.M5xxx do treat the TBSY as described in this FAQ.
• The buffer size is depending on the port used:
  PCD3 port 1 and 2: 24 characters
  PCD3 port 0 and 3:  2 characters
  PCD2.M5 port 0 and 1: 24 characters
  PCD2.M5 port 2 and 3:  2 characters
  

This FAQ applies in case the booter of a PCD2.M150 needs to be updated.

How can a booter be upgraded?
There are mainly two ways how the booter of a PCD2.M150 can be upgraded:

• A new firmware chip is burned with an EEPROM burner. In this case a *.hex file is written onto the flash chip in a tool like e.g. GALEP. The *.hex file contains a booter as well as a firmware for the PCD2.M150 (e.g. the firmware 0D3 and the booter 012).
  
• The other method is that the booter is downloaded directly onto the PCD2.M150. In this case some conditions need to be fulfilled: The currently installed booter must support an update of the booter on the present flash chip.

Flash chips used and the support of downloading the booter

• SST 39SF040 firmware flash
  In case the firmware is stored on a flash chip from the manufacturer SST (not used in production any more) the minimal booter version for updating the booter is 010. See procedure below.
  
• AMIC A29040 firmware flash
  In case the firmware is stored on a flash chip from the manufacturer AMIC the minimal booter version for updating the booter is 013. If an older version of the booter is present, the new booter must be written by using an EPROM burner.
  
• ATMEL AT49F040 firmware flash
  The first versions of the PCD2.M150 were delivered with this chip. This chip does not support the update of the firmware or the update of the booter with PG5. A new firmware must be written by using an EPROM burner in every case.

How to find out the currently installed booter version?
The booter version present on your PCD2.M150 (firmware 0D0 or newer) can be read using the online debugger:
Type: D Y 800010                 (Display bYte 800010)
The booter version will be indicated at the end of the line shown.

What can I do if I have a chip listed above but there is a too old booter installed
In this case, please download the hex file version of the firmware used in production from the product section "Programmable Controller" --> "PCD2" --> "Mxxx CPUs" --> "PCD2.M150". These hex files can be written to your chips using a suitable EEPROM burner like Galep.
Once this firmware has been written to your chips, the firmware update can be done from the firmware download tool from PG5 (*.blk files are to be downloaded).

From firmware version 0D0 it is possible to download the firmware to the PCD2.M150. It is not any more necessary to write the firmware chips (Flash) on an EPROM burner.

Introduction
For an easyer firmware upgrade procedure the booter and firmware of the PCD2.M150 has been improved in a way that it is possible to download the firmware directyl with the PG5 firmware downloader. The minimal firmware version for enabling this firmware download is 0D0 (the accoring *.hex files do contain the appropriate booter version 010 or higher).

Of course it is still possible to write the firmware flash on a EPROM burner as it is to be done for older versions.
In case your PCD is equipped with a firmware older than 0D0 (e.g. 0C4) you have to burn a new firmware chip (manufacturer either AMIC or SST) with a firmware 0D0 or newer. You can find these files as usual on the support site in the product folder of the PCD2.M150.

Official introduction in production
The first official firmware supporting the download of a new firmware is 0D3. This firmware has been officialized and introduced into production in week 30 of 2006. The booter version installed with this firmware is 012.

Firmware download procedure
As soon as you have installed the firmware 0D0 or higher, you can simply downlod a new firmware with the following procedure (given the installed chip supports the download of the firmware, see FAQ 100606).

• Open PG5
• From the menu "Tools" select the "Online Configurator"
• In the Online Configurator click the button "Go offline" (for downloading the firmware PG5 must be offline)
• From the Online Configurator menu "Tools" select "Download Firmware"
• In the Firmware Download Utility click the button "Add" and browse to the new firmware for the PCD2.M150 (the file must have the extension *.blk). Make sure only this file is visible in the window. If there are other files, remove them with the button "Del".
  
• Click "Start" for starting the download

The file to be downloaded is a *.blk file which can be downloaded from the support site as well.

Flash chips supporting the download of the firmware
There are several flash chips holding the frimware on the PCD2.M150. Unfortunately the first introduced chip does not support the download of the firmware. Below a list of the used flash chips:

• AMIC A29040 (A29040B-70F)
  This chip supports the download of the firmware. The download of the booter is supported from booter version 013 (to be installed together with firmware 0E3 hex files). 
• SST 39SF040
  This chip supports the download of the firmware as well as the download of the booter^*).
• ATMEL AT49F040
  This chip doesn't support the download of the firmware. For updating the firmware, the new firmware version has to be burned to the chip using an EPROM burner.

^*) For updating the booter out of booter version 010, 011 and 012 the PCD must be set in the bootloader mode first.

If the Port 3 is initialized in mode S-Bus slave it won't work anymore with FW 020. The bug is corrected in FW Versions > 020 (#21) and did not appear in versions < 020.

check before Firmware download over a network TCP/IP or Modem:

before you update the PCD- firmware, check that your hardwaresettings and user program is stored in to the flash memory 

There are firmware depending differences in the handling of the Serial-S-Bus communication diagnosic flags TDIA and RDIA. Those flags are refreshed continuously by older FW versions but not by the Saia PCD® COSinus Classic PCD firmware (used for PCD2.M480 and PCD3 controllers).

Symptom
The diagnosic flags do indicate whether there has been a communication error. The flags are directly depending on the diagnostic register RDIA. If the RDIA holds any value not equal to 0, the according diagnostic flag is set.
The state of the diagnostic flags is refreshed every ms by conventional FW versions (used for PCD1, PCD2.M1x0, PCD4, PCD6).
The Saia PCD® COSinus Classic PCD firmware (used for PCD2.M480 and PCD3) does not any more refresh the diagnostic flags cyclically. On this FW, the diagnostic flags are only refreshed on a communication event (such as e.g. a SRXM instruction).

Reason
Basically the diagnositc flags are refreshed by the communication routine of the FW. Conventional FW is polling the communication routine cyclically (every ms).
The Saia PCD® COSinus Classic PCD dosn't call the communication routine cyclically but only on interrupt (e.g. the communication instruction SRXM does generate such an interrupt). This means that the diagnostic flags are only refreshed on a communication event.
The advantage of this method is a minimized CPU load due to the communication task.

Conclusion
This change of the behaviour of the diagnostic flags isn't conflicting with any description or manual. However, there could be some program code that bases on the automatic refres of those flags. In this case the code has to be adapted when intended to use on a PCD running Saia PCD® COSinus Classic PCD FW.
The adaption could be realized in the way that on reset of the RDIA (which has to be done anyways) also the diagnostic flags are reset.

The Profibus DP configurator of PG5 1.3 (older than SP1.3.120) does create configuration files that don't run on a PCD2.M110/120 equipped with FW 080 and older.

Symptom
The Profibus DP Module can't be initialised. The error LED is lit instead and "PROFIBUS FAIL 000" is entered in the History of the PCD. Profibus DB Master and Slave configurations are concerned.

Reason
The reason for this problem is that the Profibus DP configurator (coming along with PG5 1.3.100 or SP1.3.110) will store the configurations in DBX 4. This address isn't available in FW versions up to 080 (since only 4 DBX are available, address 0 included).

Solution

• Either update to the latest official FW for the PCD2

• Or Update to PG5 SP1.3.120 (or higher)

Some PCD types (Classic and xx7) have stored their firmware on 4 Mbit flash chips plugged on the main board. Further on the user memory/backup memory of many PCDs may be extended by mounting a flash chip. This FAQ contains a list of those memory chips in relation to the usage.

The possible applications for the 4 MBit flash chips

The possible applications for 1 MBit flash chips

There is an Error Led on nearly every PCD system that can indicate a problem on the system. Read this FAQ to learn more about the different reasons for a lit Error LED and how to find the problem causing the lit error LED.

What causes the Error LED to get lit?
There are different reasons for a lit error LED. The most common reasons are listed below:

• A problem while assigning a communication port (e.g. missing communication module or wrong parameters)
• A problem while sending an S-Bus telegram (e.g. missing port assignation or invalid data array or media)
• Invalid mathematical operation (e.g. division by zero or value overflow after a multiplication)
• Index register overflow

How to find the problem in the code/configuration?
One fast way to find the problem is reading the history entries of the PCD. This may be done by using either the Online Configurator or the Online Debugger (type "Display History"). In the History some of the problems are listed explicitely (e.g. IPM not present) for further information regarding the History entries, please refer to the PG5 Help. The chapter "Messages" contains "Halt and History messages".
If only an "Error Flag" is mentioned the next task is to find the program part where the Error status-flag is set. This is to be done by using the Online Debugger:

• Go online with your Fupla- or IL program.
• Open the Online Debugger and type "Restart Cold All CPUs".
• Still in the Online Debugger, type "Run Until Status-flag Error". As soon the Staus-flag "Error" is set, the PCD will be stopped. Therefore the Fupla Editor will jump to the page which actually is processed (only this page is part of the current Fupla file! If the Error isn't caused by this Fupla file, it will jump to any other page which doesn't cause the problem. Have a look at this page and the FBox with the "stop"-box on it and decide whether the problem could have been caused by this FBox!
  If there isn't any FBox that could cause any problems mentioned above, repeat the procedure while beeing online with the next Fupla file of the CPU).
• If you can't find the problem directly in a Fupla file, switch to the Online Debugger again. After having stopped, a line similar to the line written below will be shown:
  *001234  STH       I/O       48                                  A1   Z0     N0     P1    E1     IX      COB2
  This first number of this line indicates on which line of the code the problem happened: the last instruction BEFORE the line shown caused the problem (the error LED is lit after the problem).
• Type "Display Program <line indicated -10> Count 15". Now you can see the instruction that caused the problem: Refer to the IL instruction Set (Online Help of IL Editor SEDIT) in order to figure out what this instruction exactly does.

If a SASI instruction causes the problem, check out the following possible reasons:

• The port is already assigned (have a look at the HW configuration and search for further SASI instructions by typing "Locate Instruction SASI" in the Online Debugger!).
  Hint: Also have an eye on the SASI FBoxes you used as well as on the HMI Settings tab.
• The port doesn't exist
• The SASI text isn't valid
• S-Bus support isn't enabled in the Hardware Settings but an S-Bus assignation was executed. This won't work because in this case the PCD doesn't have an S-Bus address (which is required for S-Bus communication).

If it seems as a mathematical operation caused the error, use the online debugger to run shortly before the problem-causing part of the code by typing "Run Until Instruction-Pointer Equals <instruction line shortly before problem-line>" (note that the instruction line must contain an instruction!). Once reached this line, type "sTep". In the Step-mode, you will see the contents of the PCD medias [brackets].

Remark:
The Error LED is lit in case the Status Flag E (Error status flag is set high) and no XOB 13 is programmed. In case the XOB 13 is programmed, the Error Led won't get lit but this XOB is processed immediately.

We have made good experiences with the GALEP 4, for PCD1 FW together with the adaptor 210841. The local dealer for Switzerland is www.redacom.ch.

Order numbers for empty firmware chips:

PCD1.M1x0: 1x ASN 4 502 7178 (OTP27C4002), one time programmable
PCD1.M137: 1x ASN 4 502 7178 (OTP27C4002), one time programmable
PCD2.M110/M120: 2x ASN 4 502 7126 0 (27C1001-10, EPROM)
PCD2.M127: can be downloaded, refer to the product page on www.sbc-support.ch
PCD2.M150: 2x ASN 4 502 7341 0 (49F040 ,Flash-EPROM)
PCD2.M157: can be downloaded, refer to the product page on www.sbc-support.ch 
PCD2.M170: chip soldered on the main board, the FW can be downloaded with PG5 *
PCD2.M177: can be downloaded, refer to the product page on www.sbc-support.ch
PCD2.M480: chip soldered on the main board, the FW can be downloaded with PG5 *
PCD2.M487: can be downloaded, refer to the product page on www.sbc-support.ch
PCD3.Mxxxx: chip soldered on the main board, the FW can be downloaded with PG5 *

* Procedure to downlaod a firmware:
1) get the appropriate file from product page on the supportsite www.sbc-support.ch
2) open PG5 and go to the online-configurator; go offline
3) open the menu tools, download firmware
4) browse for the firmware file and start the download
5) load the HW configuration and the user program

Basically on PCD systems introduced before 2003 there are some restrictions to be considered about the maximum baud rate of serial communications.

Depending on firmware and hardware not all serial ports can be used at their theoretical maximum baud rate at the same time.

Systems introduced before 2003:

• All PCD1, PCD2 (except PCD2.M480), PCD4 and PCD6 as well as PCS1 classic contollers do have a baud rate limitation of 38.4 kB/s on each serial port.
  For older firmware (FW) versions there is a further restriction since there is one UART responsible for two serial ports and this UART cannot handle baud rates of 38.4 kB/s on both ports at the same time. The port allocation of the UARTs is the following: first UART: port 0 and 1; second UART: port 2 and 3 etc.
  This means that it isn't possible to set the concerned ports to
  - 38.4 kB/s each
  - one to 38.4 kB/s and one to 19.2 kB/s
  - but it is possible to set one port to 38.4 kB/s and one port to 9600 B/s.
  
• Due to more efficent port handling recent FW versions do have the following restriction (independent of production date of HW):
  Amount of ports available divided by 2 equal amount of ports that can communicate at 38.4 kB/s. All the residuary ports do have a maximal baud rate of 19.2 kB/s.
  In addition an UART of an PCD7.F5xx isn't able to handle 19.2 kB/s on one and 38.4 kB/s on the other port. But it is possible to assign both ports to 38.4 kB/s.

Systems introduced since 2003 (PCD2.M480 and PCD3.xxxx):

Due to faster hardware there are much higher baud rates possible on the serial ports (up to 115 kB/s)!
There is only one restriction regarding UART sharing left:
On a PCD7.F5xx it is not possible to communicate on one port at 19.2 kB/s and one the second port at 34.8 kB/s at the same time (but two times 38.4 kB/s is possible!).
This means that all ports may communicate at the maximum baud rate (which is specified in the technical information (TI) or in the manual) at the same time.

FW versions that support the new port handling mentioned above:
For the following and newer FW version the following rule is valid:
Amount of ports available divided by 2 equal amount of ports that can communicate at 38.4 kB/s.
All the residuary ports do have a maximal baud rate of 19.2 kB/s.

Communication interfaces containing a co-processor aren't restarted after a restart caused by the software watchdog with the option "Execute XOB0". In fact only a restart cold will be executed but without resetting the communication modules.

This behaviour is a bug and will be corrected in the next FW version for the corresponding CPU. As soon as the new FW is built it will be available on the support homepage.

In the meantime it is recommended not to use the option "Execute XOB0" for the software watchdog. In this case the communication modules will be reset normally on software watchdog execution.

If once the Software Watchdog is configured on a PCD2.M150, the system can't be started any more until the FW will be changed to either an older version (not recommended) or to the latest version 0E3 (recommended)!

This problem is due to a too long starting sequence of the FW which will cause the Software Watchdog to restart the system right after its initial start. This causes the PCD not booting up at all any more.
In the concerned state, all LEDs (RUN, HALT and ERROR) are lit; the restart will be proceeded before the actual boot sequence indicated by the running LED's of the PCD starts.

To solve this problem the FW chips have to be replaced. These chips either can be ordered at your SBC representative or the actually used chips can be rewritten using a EPROM burner such as GALEP IV.
Since the FW of a PCD2.M150 is written in Flash EPROMs, it can be ereased and reloaded with the hex files of the FW version 0E3 available on the Support Site www.sbc-support.ch or at your SBC representative.

Or "What is the difference between 0-, $- and #-firmware versions?". PCD firmware for non-Saia PCD® COSinus Systems (PCD1, PCD2.M1x0, PCD4, PCD6 and PCS) are named with 3 letters (e.g. 010, B0W or #31). This FAQ explains the meaning of these version and how to figure out which one is more recent.

The firmware version naming of non-Saia PCD® COSinus systems
In general the 3 letters (abc) are used for the following indications:

• a
  Definition of the kind version this firmware is. The possible versions are the following
  - 0xx versions are "official production versions" (010 is the first official production version)
  - Bxx versions are Beta versions which contain new features compared to the previous production version
  - #xx versions are "customer bug fix versions" of an official production FW version.
  - $xx versions (Pilot version) include new functionalities which are not yet fully tested. Therefore a $-version should only be used in field if the developement gives their ok!
• b
  The second letter defines the main production version (starting with 01x wich stands for first official production version, followed by 02x (where the 02x has important new features compared to the 01x version
• c
  The last letter is incremented for each build of the firmware (best observed for the bug-fix versions; #21 is based on the 020 firmware and contains corrections for the 020 firmware version) 

To figure out which version the base version of a bug fix- or pilot version is, have a look at the second character of the corresponding version (e.g. the "1" of the 013). This character indicates the official production version on which the bug fix or pilot version is based on.

Examples
010    is the official production version
018    is the production bug fix version of 010; no new functions
#19    is a customer bug fix version based on 018 (and therefore also on 010); no new functions
$19    is a pilot version based on 010 with new functions. The bug fixes done for e.g. 019 probably aren't implemented in this version! (the new features will be added to the production firmware versions in 020 or later.

Remark
Early versions of the Saia PCD® COSinus systems (PCD2.M480, PCD3, PCD2.M5) up to 039 were named with this system as well. In order to reduce confusion concerning features of a firmware the new firmware naming a.bb.cc has been applied (see FAQ 100741).

Some history entries introduced in new firmware versions can't be found in the Online Debugger Help nor in the online help of the Online Configurator.

Below you can find recently introduced History entries that can't be found in the Help files of PG5 versions older than PG5 1.3:

Error Messages concerning PCD1.M2, PCD2.M480, PCD2.M5xx0 and PCD3.Mxxx0 systems (SBC-NT)

The IL instruction DSP (display value on PCD7.F530 display) is not supported on Saia PCD® COSinus systems. When downloading it to a Saia PCD® COSinus system, the PCD will not go in RUN and give an error message such as "Invalid instruction" (e.g. a PCD2.M480), "Precompiler error" or "Invalid OPCODE" (on a PCD3.M5xx0 with firmware 1.10.16).

Why is the DSP instruction not supported on Saia PCD® COSinus systems?
Since it isn't allowed or even possibe to mount a PCD7.F530 card on a Saia PCD® COSinus system (e.g. a PCD2.M480, a PCD2.M5xx0, a PCD3 or a PCD1.M2xx0) the instruction for accessing the display of the PCD7.F530 is not supported by the CPU.

Remarks

• The PCD7.F530 can't be mouned on a PCD2.M170 or on a PCD2.M480 because it could cause a short circuit on the internal bus connector placed right under the slot B1.
• If a user program containing a DSP instruction is downloaded the PCD2.M480 won't run the program and the error message "Halt reason: invalid instruction" will be entered in the CPU's History.

Yes it’s possible to connect a PCD directly to the internet, but you have to protect your PCD against unauthorised access or cyber-attacks.

To protect the PCD against unauthorised access or cyber-attacks, it’s imperatively needed to take some protective measures.

Information about protective measures can be found on the support hp

If you need a PCD with cyber security levels SL3+ and based on ANSI ISA 62443 then checkout our PCD3.M6893 (QronoX PCD), this PCD was developed for cybersecure applications.

Information's can be found here.

In January 2024:
the COSinus BACnet FW 1.28.59 was put on the support homepage.  

In April 2022:
the COSinus FW 1.28.51 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

In February 2019:
the COSinus FW 1.28.37 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

In June 2017:
the COSinus FW 1.28.16 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.28.51/1.28.59 was put into production, which do support the BACnet Revision 14.
To support the BACnet Revision 9 it's necessary to use the PCD and the BACnet FW 1.26.xx.

Attention:
The firmware 1.28.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx, 1.26.xx or newer to a not compatible PCD

Firmware 1.28.59 (only BACnet firmware) (January 2024)

Main corrections

• BACnet: MI/MO/MV objects, invalid values for Alarm_Values and Fault_Values are rejected
• BACnet: BI/BV/BO objects, present value of can only be 0 or 1
• BACnet: COMMAND object, present value writing returns an error if bigger that the number of actions
• BACnet: Trendlog objects, property value check is done according to specifications
• BACnet: Limit COV subscription to 3000 and send PDU-Error if length of response is too big
• BACnet: Disable I-Have response when state is disable / disable-init
• BACnet: Calendar Object Date List, don’t allow wild card in this property entries
• BACnet: writing invalid array to Array properties returns correct Error code
• BACnet: Pulse Converter Object, send out-of-range PDU-Error if count processing is < 0
• BACnet: Controller goes to HALT with SWTO error
• BACnet: MS/TP Controller goes to HALT with SWTO error
• BACnet: Schedule accepts Sundays in Week and Day
• BACnet: GetEnrollmentSummary: correct reply if list is empty

Firmware 1.28.51 (April 2022)

Main corrections

• All PCD’s: Saia PCD Modbus diag does not work if diag flag > 9999
• All PCD’s: SNTP and hardware RTC is diverging from more than 2 seconds, then History message ‘RTC Fail error’ is generated
• All PCD’s: SNTP Time synchronization does not work with DHCP
• All PCD’s: E-Mails send from PCD could contain unwanted characters like 0 or others
• All PCD’s: S-Monitoring values for S-Monitoring bar graphs are sometime wrong
• All PCD’s: S-Monitoring Year graph scaling displayed wrongly
• All PCD’s: TCP, open data mode protocol, communication is blocked after rejection of 32 connections
• All PCD’s: LonIP CSF is locked when an error occurs
• PCD2.M45x0: SRXM does not support FB parameters as operand 3 and 4 for source and destination
• PCD1.M2220-C15: Watchdog LED does not follow Relay when PCD goes in STOP or HALT
• PCD3.M6880: Data exchange between CPU 0 and CPU 1 does not work reliable if STL instruction is used
• BACnet: Calendar state not updating after add/remove list element service
• BACnet: Exception schedule writing to certain array index fails
• BACnet: Schedule crashes with SWTO error
• BACnet: MS/TP client properties are not written if many values change simultaneously
• BACnet: Problem reliability & out of service, reliability is not written when oos is high
• BACnet: Web CGI commands to read BACnet platform tags like ..AddFW,Version,BACnet don’t work
• BACnet: Web scheduler/calendar templates do not work
• BACnet: PCD3.M6860 no BACnet communication on ETH2 if router is used
• BACnet: Rev 4 not working with Name based Client
• BACnet: Rev14 does not allow high limit value below 5 on analogue input

Firmware 1.28.37 (February 2019)

New features

• All PCD’s: FW extension to close all open FTP connections
• BACnet: Calendar objects have been extended with a synchronization mode. Each server calendar object can be configured as Slave or Master calendar
• BACnet: New mappings for alarming counters have been added to Notification-Class objects.
• BACnet: The PCD will now accept AcknowledgeAlarm service requests, which use complete wildcards as timestamps.

Main corrections

• All PCD’s: On S-Bus data mode, if S-Bus CRC contains a S-Bus DLE as last character then S-Bus telegram is incorrect and not accepted from S-Bus recipient. (Since FW 1.28.20)
• All PCD’s: Not all bytes are transmitted when working with MC4 or MC5 mode on F2xxx module
• All PCD’s: RS485 driver keep holding bus after a while
• All PCD’s: Http request ‘is modified’ is not handled correctly on the PCD Web-Server which lead to the effect that web project is not loaded correctly on the browser
• All PCD’s: PCD can crash when breakpoint is updated during conditional RUN
• All PCD’s: PCD can crash on download in run since FW 1.28.27.
• All PCD’s: PCD can crash on download in run when Graftec is used
• All PCD’s: PCD crashes when using browser to access the default page of PCD with "Display Root Content Enabled = YES"
• All PCD’s: RCOB does not start COB when it was stopped before with SCOB
• All PCD’s: Profibus communcation using onboard FDL port. The FCS test for SD2 telegram was not implemented correctly.
• All PCD’s: When S-Bus IP Nodelist is used it’s possible that the communication using nodes does no more work after execute a download in run
• All PCD’s: XOB parameter as Registers does not work if 16bit addressing was used
• All PCD’s: LonFT10: SNVT_obj_status and SNVT_obj_request can be used in user profiles
• PCD3.Mxx60, PCD3.T6xx, PCD1.M2xx0, PCD2.M4x60: usage of I/O media mapping slows done the cycle time 2 times in comparison to FW 1.26.xx
• PCD2.M4x60: Download LonIP config not possible
• PCD2.M4x60: RTC gets sometime corrupted data when PCD7.F7500 is used on PCD2.M4x60
• PCD2.M4x60: RTC Time is wrong after several days of run
• PCD7.D443WTxR: uBrowser use alphapad.teq even if screen is rotated by 90°
• PCD7.D443WT5R: History entry Memory ‘Lost -1’ written in the History
• BACnet; Event Enrolment does not work correctly with external reference devices.
• BACnet; When using BACNet Webvisu the memory used increase each time the scheduler is edited.
• BACnet; PCD crash when BACnet Webvisu edit scheduler.
• BACnet; BACnet WebVisu does not display correct value for the WeeklySchedule value.
• BACnet; ACK Required bit in notification message is not set according to the related NV ack_required bits
• BACnet: The PCDAlarmStatus mapping property does not work correctly.
• BACnet: Mappings, which changed to the value 0 directly after a program download, are not updated correctly on the BACnet property.
• BACnet: The Priority-Array mapping does not work correctly after startup.
• BACnet: Initialization of Puls converter count with input reference gives error
• BACnet: Fix issue with weekly scheduler.
• BACnet: Fix issue with WeekNDay entries
• BACnet: The Restore functionality over BACnet does not work, when the PCD has been reset over factory reset.
• BACnet: The Action property in the command object does not handle NULL datatype and priority entries correctly, if they are used in the ActionCommand. Additionally, the Action property can now be read via index.
• BACnet: Priority_Array entry 16 will be overwritten on startup with the last Present_Value mapping
• BACnet: Out of Service -> Value for PV overridden after reboot by Input ref
• BACnet: The Log_Buffer to csv conversion for trend-log objects does not skip time change entries
• BACnet: Unmapped Priority-Array property array entries are not stored persistent
• BACnet: BACnet configuration on the PCD is not deleted when "unlinked" from PG5
• BACnet: Change Client Time_Of_Restart mapping to Unix time
• BACnet: Client mapping - Threshold is not implemented correctly
• BACnet: Mapped Reliability properties within analogue objects does interfere with the objects functionality. When the Reliability is mapped, the mapping has not full control over the property value.
• BACnet: The program download fails, when the BACnet config contained notification-class objects with event-counter mappings
• BACnet: BACnet Trend-Log(-Multiple) data can’t be retrieved as csv data
• BACnet: The SubscribeCOVProperty service can’t be executed on complete Priority_Arrays

Firmware 1.28.16 (June 2017)

New features

• All PCD's: When push button is pressed while power on then do not update FW from FS in order to execute a delete all.
• PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668:
  Enhancement for HTTP server to transparently support sending compressed files.

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.
• PCD7.D443WT5R: Alarming does not work since 1.28.00 FW.
• PCD7.D443WT5R: When watchdog timeout occurs PCD7.D443WT5R does't reboot and stays locked.

Firmware 1.28.11 (Arpil 2017)

New features

• All PCD's: Support of BACnet Revision 14

Main corrections

• All PCD's: Various Open Data Mode fixes: Read Timeout enhancement, Client Connection timeout and Client Keep alive with anonymous port issue fixed
• All PCD's: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occurring at the moment of the timeout.
• All PCD's: Battery status shows FAIL also if battery module is missing.
  All PCD's: Various minor issues fixed
• PCD1.M2xx0 & PCD3+: 38400/115200 baud settings adjustment
• PCD2.M4x60: PCD7.F7500 initialization

Symptoms
Programmable PCD devices that act as S-BUS master on RS485 with PCD Firmware >= 1.28.20 and <= 1.28.33 get no answer from Slave devices on some of the S-Bus master requests, although S-BUS address, baud rate, polarity and line termination are ok.

Possible effects of the issue

Until now we have found that E-Line RIO communication seems to be more concerned of this problem than e.g. RS485 S-Bus data communication between CPU's.

In some of the cases the effect was, that it was not possible to write to the outputs of the E-Line RIO's or the change of values on the E-Line RIO Inputs was not transfered to the S-Bus master.

With the concerned Firmware it might be very difficult or impossible to download the user program over a gateway connection.

PCD Firmware 1.28.x for all programmable PCD types are concerned.

Reason

The reason of the issue is a error in the Firmware of the S-Bus master.
The problem on the Firmware is, that telegrams which contain DLE characters (B5 or C5) as last character of the telegram (CRC) where malformed because the last character is missing.

Since the CRC is calculated during runtime this malformed S-Bus request occurs depending of the content of the S-Bus request.

The (malformed) CRC is transfered with the S-Bus request from the master to the slave.

If now the slave receives the S-Bus request and the received CRC does not fit with the calculated CRC, then the S-Bus slave reject the S-Bus telegram.

Solution

In case you use the concerned Firmware on an installation with RS485 S-Bus Data communication, update the S-Bus master PCD to the newest available Firmware >= 1.28.34.

This Firmware do fix the issue CVE-2017-9628 related to Ethernet frame padding information leakage.
To avoid any problems in relation to this leakage we do recommend strongly to update to the latest Firmware
1.28.16 / 1.24.69 or newer as mentioned on the security upgrade section on this web-page.

Impact of the CVE-2017-9628
IEEE 802 specifies that packets have a minimum size of 56 bytes.
The Ethernet driver is expected to fill the data field with octets of zero for padding when packets are less than 56 bytes.
Resident memory and other data are used for padding in some implementations that could cause information leakage.
This attack is passive; the attacker can only see data that the affected devices sent out as part of a packet.

Vulnerability overview of the CVE-2017-9628
The previous implementation of firmware allowed other data from a known area of memory to be used in this field and could exfiltrate or leak data.

In April 2022:
the COSinus FW 1.28.51 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

In February 2019:
the COSinus FW 1.28.37 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

In June 2017:
the COSinus FW 1.28.16 was introduced into production for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.28.16 was put into production, which do support the BACnet Revision 14.
To support the BACnet Revision 9 it's necessary to use the PCD and the BACnet FW 1.26.xx.

Attention:
The firmware 1.28.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx, 1.26.xx or newer to a not compatible PCD

Firmware 1.28.51 (April 2022)

Main corrections

• All PCD’s: Saia PCD Modbus diag does not work if diag flag > 9999
• All PCD’s: SNTP and hardware RTC is diverging from more than 2 seconds, then History message ‘RTC Fail error’ is generated
• All PCD’s: SNTP Time synchronization does not work with DHCP
• All PCD’s: E-Mails send from PCD could contain unwanted characters like 0 or others
• All PCD’s: S-Monitoring values for S-Monitoring bar graphs are sometime wrong
• All PCD’s: S-Monitoring Year graph scaling displayed wrongly
• All PCD’s: TCP, open data mode protocol, communication is blocked after rejection of 32 connections
• All PCD’s: LonIP CSF is locked when an error occurs
• PCD2.M45x0: SRXM does not support FB parameters as operand 3 and 4 for source and destination
• PCD1.M2220-C15: Watchdog LED does not follow Relay when PCD goes in STOP or HALT
• PCD3.M6880: Data exchange between CPU 0 and CPU 1 does not work reliable if STL instruction is used
• BACnet: Calendar state not updating after add/remove list element service
• BACnet: Exception schedule writing to certain array index fails
• BACnet: Schedule crashes with SWTO error
• BACnet: MS/TP client properties are not written if many values change simultaneously
• BACnet: Problem reliability & out of service, reliability is not written when oos is high
• BACnet: Web CGI commands to read BACnet platform tags like ..AddFW,Version,BACnet don’t work
• BACnet: Web scheduler/calendar templates do not work
• BACnet: PCD3.M6860 no BACnet communication on ETH2 if router is used
• BACnet: Rev 4 not working with Name based Client
• BACnet: Rev14 does not allow high limit value below 5 on analogue input

Firmware 1.28.37 (February 2019)

New features

• All PCD’s: FW extension to close all open FTP connections
• BACnet: Calendar objects have been extended with a synchronization mode. Each server calendar object can be configured as Slave or Master calendar
• BACnet: New mappings for alarming counters have been added to Notification-Class objects.
• BACnet: The PCD will now accept AcknowledgeAlarm service requests, which use complete wildcards as timestamps.

Main corrections

• All PCD’s: On S-Bus data mode, if S-Bus CRC contains a S-Bus DLE as last character then S-Bus telegram is incorrect and not accepted from S-Bus recipient. (Since FW 1.28.20)
• All PCD’s: Not all bytes are transmitted when working with MC4 or MC5 mode on F2xxx module
• All PCD’s: RS485 driver keep holding bus after a while
• All PCD’s: Http request ‘is modified’ is not handled correctly on the PCD Web-Server which lead to the effect that web project is not loaded correctly on the browser
• All PCD’s: PCD can crash when breakpoint is updated during conditional RUN
• All PCD’s: PCD can crash on download in run since FW 1.28.27.
• All PCD’s: PCD can crash on download in run when Graftec is used
• All PCD’s: PCD crashes when using browser to access the default page of PCD with "Display Root Content Enabled = YES"
• All PCD’s: RCOB does not start COB when it was stopped before with SCOB
• All PCD’s: Profibus communcation using onboard FDL port. The FCS test for SD2 telegram was not implemented correctly.
• All PCD’s: When S-Bus IP Nodelist is used it’s possible that the communication using nodes does no more work after execute a download in run
• All PCD’s: XOB parameter as Registers does not work if 16bit addressing was used
• All PCD’s: LonFT10: SNVT_obj_status and SNVT_obj_request can be used in user profiles
• PCD3.Mxx60, PCD3.T6xx, PCD1.M2xx0, PCD2.M4x60: usage of I/O media mapping slows done the cycle time 2 times in comparison to FW 1.26.xx
• PCD2.M4x60: Download LonIP config not possible
• PCD2.M4x60: RTC gets sometime corrupted data when PCD7.F7500 is used on PCD2.M4x60
• PCD2.M4x60: RTC Time is wrong after several days of run
• PCD7.D443WTxR: uBrowser use alphapad.teq even if screen is rotated by 90°
• PCD7.D443WT5R: History entry Memory ‘Lost -1’ written in the History
• BACnet; Event Enrolment does not work correctly with external reference devices.
• BACnet; When using BACNet Webvisu the memory used increase each time the scheduler is edited.
• BACnet; PCD crash when BACnet Webvisu edit scheduler.
• BACnet; BACnet WebVisu does not display correct value for the WeeklySchedule value.
• BACnet; ACK Required bit in notification message is not set according to the related NV ack_required bits
• BACnet: The PCDAlarmStatus mapping property does not work correctly.
• BACnet: Mappings, which changed to the value 0 directly after a program download, are not updated correctly on the BACnet property.
• BACnet: The Priority-Array mapping does not work correctly after startup.
• BACnet: Initialization of Puls converter count with input reference gives error
• BACnet: Fix issue with weekly scheduler.
• BACnet: Fix issue with WeekNDay entries
• BACnet: The Restore functionality over BACnet does not work, when the PCD has been reset over factory reset.
• BACnet: The Action property in the command object does not handle NULL datatype and priority entries correctly, if they are used in the ActionCommand. Additionally, the Action property can now be read via index.
• BACnet: Priority_Array entry 16 will be overwritten on startup with the last Present_Value mapping
• BACnet: Out of Service -> Value for PV overridden after reboot by Input ref
• BACnet: The Log_Buffer to csv conversion for trend-log objects does not skip time change entries
• BACnet: Unmapped Priority-Array property array entries are not stored persistent
• BACnet: BACnet configuration on the PCD is not deleted when "unlinked" from PG5
• BACnet: Change Client Time_Of_Restart mapping to Unix time
• BACnet: Client mapping - Threshold is not implemented correctly
• BACnet: Mapped Reliability properties within analogue objects does interfere with the objects functionality. When the Reliability is mapped, the mapping has not full control over the property value.
• BACnet: The program download fails, when the BACnet config contained notification-class objects with event-counter mappings
• BACnet: BACnet Trend-Log(-Multiple) data can’t be retrieved as csv data
• BACnet: The SubscribeCOVProperty service can’t be executed on complete Priority_Arrays

Firmware 1.28.16 (June 2017)

New features

• All PCD's: When push button is pressed while power on then do not update FW from FS in order to execute a delete all.
• PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668:
  Enhancement for HTTP server to transparently support sending compressed files.

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.
• PCD7.D443WT5R: Alarming does not work since 1.28.00 FW.
• PCD7.D443WT5R: When watchdog timeout occurs PCD7.D443WT5R does't reboot and stays locked.

Firmware 1.28.11 (Arpil 2017)

New features

• All PCD's: Support of BACnet Revision 14

Main corrections

• All PCD's: Various Open Data Mode fixes: Read Timeout enhancement, Client Connection timeout and Client Keep alive with anonymous port issue fixed
• All PCD's: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occurring at the moment of the timeout.
• All PCD's: Battery status shows FAIL also if battery module is missing.
  All PCD's: Various minor issues fixed
• PCD1.M2xx0 & PCD3+: 38400/115200 baud settings adjustment
• PCD2.M4x60: PCD7.F7500 initialization

With Firmware >= 1.26.00, after Power off / on of the PCD, the LON bindings are lost.

Symptoms

The LON communication don’t works anymore after power off/on. In the commissioning tool, e.g. NL220  the Lon node is getting “red” after the function Network –>Test

Reason

In the FW 1.26.xx there is a problem with the file update on the Flash cards, the bindings are only updates in the memory but the operation to save them to the filesystem fails. Therefore the binding information is lost after power off / on.

Solution

The correction is done with >= 1.26.24. The firmware of the PCD and the LonIP FW have to be updated.

In the commissioning tool e.g. NL220 a Network -> Repair function has to be executed on the node.

Only the FW >= 1.26.00 are concerned. (e.g. FW 1.24.xx is not concerned of this problem)

In June 2017:
the COSinus FW 1.26.31 was released as maintenance version for the systems:

- PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.26.31 was released as maintenance version, which do support the BACnet Revision 9.
To support the BACnet Revision 14 it's necessary to use the PCD and the BACnet FW 1.28.xx.

In March 2017:
the COSinus FW 1.26.28 was introduced into production for the systems:

- PCD1.M2220, PCD1.Mxx60, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668.

the BACnet and LonIP FW 1.26.28 was introduced into production

In June 2016:
the COSinus FW 1.26.15 was introduced into production for the systems:

- PCD1.M0xx0, PCD1.M2xx0, PCD2.M4x60, PCD3.Mxx60 and PCD3.M6880.

The COSinus FW 1.26.16 was introduced into production for the systems: PCD3.T665/T666/T668.

The BACnet and LonIP FW 1.26.15 was introduced into production

Attention:
The firmware 1.26.xx or later can be used only on the following PCD's with 8 MB onboard firmware memory:
PCD1.M0xx0/M2xx0, PCD2.M4x60, PCD3.Mxx60, PCD3.M6880 and PCD3.T665/T666/T668

The table below does show the hardware dependencies in relation with the COSinus firmware versions

Do use at least the PG5 firmware downloader version 2.1.311 or newer (included in PG5 patch 2.1.311 or newer) to prevent the loading of the FW 1.24.xx or 1.26.xx to a not compatible PCD.

Firmware 1.26.31 (June 2017)

Main corrections

• All PCD's SBUS parity mode, correction when NAK character is received as first byte of response.
• All PCD's: When download new Ethernet-RIO Program with the option ‘Delete all backups’ it can happen that the RIO is not commission and no goes no more in ‘data exchange mode’ until the PCD reboots.
• All PCD's: When RIO name is not in upper case the RIO file is not updated until a restart is executed.
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• All PCD's: Ethernet Frame Padding Information Leakage fixed (CVE-2017-9628)
• All PCD's: The Modbus CSF CloseSRPort does not free the port then a open/SASI call give an error and the port does not work.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: PCD can crash while power down when XOB 0 is programmed.
• PCD1.M2xx0 PCD1.M22x0 PCD2.M4x60: MC0 mode with start/stop flag working again.

Firmware 1.26.28 (March 2017)

Improvements

• Text Ram can now be cleared (all chars are set to blank space) with the cgi interface by writing a zero length string.
• Ping request on ETH2 over rooter from different sub net.
• LonIP Mapper improvement
• Web Server RAM Disk increased
• Error Led not set on IR overflow

Main corrections

• All PCD's: MC0 communication with F2xx module and related communication flags are handled correctly in case of transmission
• All PCD's: Text Ram can now be cleared (all chars are set to blank space) with the cgi interface by writing a zero length string.
• All PCD's: Multiple AlarmLists with similar names will now be "initialized" correctly.
• All PCP's: TCP client keep alive is not working when anonymous port is used.
• All PCD's: Profi-SBus GWY does not wor, Profi-SBus Master/GWY stop working after cable is re plugged.
• All PCD's: PCD crash when use DIGI(R)/DIGO(R) with first parameter as FB parameter.
• All PCD's: Correction for modbus RTU communication over F2xx communication module
• All PCD's: When RIO file is downloaded with download changed RIO file then RIO file is not sent to RIO until a restart is executed.
• PCD1.M22x0: While changing the analog output value, the Watchdog is switching. Switching the Watchdog Relais over the corresponding flag has no influence.
• PCD2.M4x60: Sometimes the Profibus DP module is not initialized correctly on startup.
• PCD2.M5xx0: When Restore program because of a missing or dead battery configuration (SBus/IP,..) is not restored correctly.
• PCD2.M5xx0: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occuring at the moment of the timeout.
• PCD2.M5xx0: Sometimes config is lost after download project with self-download tool.
• PCD3.Mxxx0: Battery status shows FAIL also if battery module is missing.
• PCD3.Mxxx0: FTP server processing with long commands resolved.
• PCD3.Mxxx0: Modbus RTU on all ports but specially on the F2xx module has been corrected to handle the response timeout processing in the case that the response is just occuring at the moment of the timeout.
• PCD3.Mxxx0: Sometimes config is lost after download project with self-download tool.
• PCD3.Mxx60: Profi-SBus/DP/SIO does not work on port 2 on PCD3.M3x60 & PCD3.M5360.
• PCD3.M6860: Ping request from over rooter from different sub net is not respond.
• PCD3.M6860/M880: Profibus/S-IO/Profi-SBus does not work stable.
• PCD3.M6860: Set PCD to HALT if there is no or incompatible media transfer between the two CPU's.
• PCD3.T66x: The RIO Status web page does not allow to clear the diagnostics.
• BACnet: The memory usage of the BACnet FW was increasing for every SubscrobeCOVProperty service, which has been received by the PCD.
• BACnet: A client configuration for Priority_Array properties in commadable objects (e.g. Analog-Value) does now allow reading (ReadProperty/COV) and writing (WriteProperty service to server) at the same time.
  
  

Firmware 1.26.15 (June 2016)

New features

• Support of PCD1.M2220-C15
• Support of PCD2.M4x60
• Support of PCD3.M3160/PCD3.M3360/PCD3.M5360
• Support of PCD3.M6880, PCD3.T668 Standby-CPU-System

Improvements

• PCD2.M4x6x, support Interrupt when reaching the configured ref Value
• PCD1.Mxxx0, PCD2.M4x60, PCD3.Mxx60 PCD7.D4xx: Increase None Volatile Register to 1000
• PCD3.T666/8: Increase the User Program Memory for to 256k
• PCD3.T66x: Support the ESIO manager use tag values for IP address
• PCD2/3.F2xx modules Baudrate: Support 300/600/1200 baud settings for in MC mode.
• S-Monitoring: In bar displays where the current time is visible, the average for the period is calculated not in a optimal way (time slice, ref time, is a bar). New it's displayed in seconds
  
  

Main corrections

• PCD3.M6860/M6880: When update FW on extension using the file system after update the extension FW can stay in an endless loop
• PCD3.M6880: crash wen Timmer/Counter is mapped in the Read Symbols
• PCD3.M6880: PCD can crash with MuKe Error when use the SBus GWY in parallel with modbus TCP
• PCD3.M6880: Standby CPU1 does not always HALT when CPU0 crash
• PCD3.M6880: CPU0 to 1 From Read data communication sometimes stop works
• PCD3.M6880: Add a Transmit Error diagnostic tag "DataTxErrors"
• PCD3.Mxxx0: Battery module on IO slot 3 does not show battery status in history
• PCD3.Mxxx0/PCD1.M2xx0: Some baudrates on onboard ports are not correct
• PCD2.M4x60: RTC read/write locks the PCD for about 30ms
• PCD2.M4x60: Modem does not work because of the not working DCD
• PCD3.T66x: Add ELine CSF library
• PCD3.T66x: Serial com does not work with SASI instruction
• PCD3.T66x: CSF Modbus Server Init gives an error when port 502 is used becasue this port is already open
• PCD7.D443WT5R: Assignation/Configuration of port 1 should return an error because port 1 is not supported
• PCD7.D443WT5R: Remove IO access from the system. PCD goes now in HALT with "INVALIDE OPCODE"
• PCD2.W220 with Pt1000: Significant deviation between singel channels
• BACnet: List Properties (like Date_List, Exception_Schedule, ...) could disappear after a PCD restart, if a WriteProperty request with an empty list value has been received for these properties before the restart. This behavior was only present for persistent properties
• BACnet: The Log_Buffer property of a Trend-Log object could not be read anymore using the ReadRange service, after a Event-Log or Trend-Log-Multiple has been read via ReadRange
• BACnet: Writing a single analog output channel is not working. The output is not changing. Writing output channels over the mapped functionality is working
• BACnet: PCD with BACNet loops with restart if program has "INVALIDE OPCODE"
• Restart Warm does not work
• SBus ELine has sometimes retries
• When create a Text/DB the backup fails until a restart is done
• PCD Crash with BUS ERROR on STXT instruction when text is empty
• Modem does not work correctly
• Modem does not work or PCD crash when modem is configure
• PCD can crash when error occurs in Modbus RTU
• The PCD crash if a BITI is executed with number as FB parameter
• PCD crash when use Profi-S-Bus Master
• Sometimes the program is lost when update FW from 1.24.xx to 1.26.xx
• MOVX/DIVX function where not working on Task or Temporary data when use indexed
• Add config tag value for GWY mode "data_no_secure" to deasble the secure data mode
• Not possible to upload a file through the Web server FTP interface (ftp.cgi or ftp.json) if that file starts with a white space character (either a space or a tab)
• CSF CopyDBBytesToR crash when destination is bigger than last Register
• Diagnostic Flags in S-Bus Master mode are not correct if there are collisions on the RS-485 network
• CSF Backup/Restore Media does give an error on restore when data change while backup/restore
• MOV instruction with type position as FB parameter gives error flag and fails
• Web-Alarm: Fix alarming color with "group color mode" and group bigger than 8

It’s possible that after a FW update of the PCD to the FW 1.20.xx, 1.22.xx or 1.24.xx there is a entry in the FW history ‘FWDnld UnknownFW’ after the history line ‘FWDnld 1.2x.xx PLC CLASSIC’ as shown on the image below.

The history message ‘FWDnld UnknownFW’ was caused by an error in the old FW of the PCD and does have no signification.

Just ignore this message and clear the history messages.

This error is in fact a kernel error produced when different systems of the PCD are called simultaneously and get pointed on a invalid address. As the result the PCD goes in halt unless the software watchdog has been programme!                 

According to our experience the error happens very very rarely and most probably won't happen again!

In case an FBox library (or an IL program) uses a functionality which is not implemented in the PCD firmware, the PCD will not go in run but display the error message "SF not loaded" (e.g. in the PCD history or in the Online Configurator).

Symptom
After the download of a program a SBC-NT based PCD (e.g. PCD3) does not go in run but remains in halt. When going online with the Online Configurator a message "SF not loaded" is displayed.


Reason
The user program uses a functionality which is not implemented in the firmware (and therefore the PCD can not run the user program).

Solution
The solution is either updating the firmware, or avoiding the CSF which leads to the problem.
In case it is not know which CSF is responsible for the "SF not loaded", the SF library can be found based on the program line indicated by the Online Configurator (the program line is indicated with "Halt at xxx" in the Status; in the screenshot above the CSF is on program line 4). By using the Online Debugger, this CSF can be displayed by typing "DP4C10"):

   Display Program 4 Count 10 (Enter)
  

In this case, the CSF calls the SF library 26 (which is not implemented in the Firmware 1.10.51 which is used above).

How to know the functionality based on the library number?
Below you can find a list of the most commonly used System Function libraries (and in which FBox libarary they are used):

• SF library 0: S.SF.IP (e.g. Open Data Mode)
  Used by several IP communication drivers such as EIB/Net and for reading or writing the IP address of the PCD.
• SF library 2: System library
  Used by FBoxes for reading the Serial number
• SF library 4: S-Net library
  E.g. Used by FBoxes for Profi-S-Bus and Ether-S-Bus
• SF library 6: S.SF.DBLib (e.g. CopyTextBytes), previously the "ApplicationLib" for CopyText
  E.g. used by the Modem FBox library, HDLog to File library.
• SF library 7: File System library
  E.g. used by the FBoxes for the File System or "HDLog to File"
• SF library 9: IP Services (EMail, PPP, DNS, SNMP etc.)
  E.g. used by the EMail library and the WAA (Wide Area Automation) FBox library
• SF library 10: S-Web Alarming library
  E.g. used by the S-Web Alarming FBoxes and the DDC Suite
• SF library 13: Modbus library
  E.g. used by Modbus and the P-Bus FBox library
• SF library 19: LON over IP library
  used by LON over IP functions
• SF library 22: SPI framing protocol for PCD2/3.F2xx(x)
  e.g. used by the M-Bus library 2.6.100 and later
• SF library 23: Energy Manager library
• SF library 25: LON FT library
• SF library 27: ELine library for ELine modules
  Since PCD firmware version 1.24.xx

The single function codes (second line of the CSF call, "0" in the screenshot above) of the relevant libraries can be found in the definition files in folder
   c:\Documents and Settings\All Users\Saia-Burgess\PG5_20\Libs\SF\*.lib
(e.g. SFModbusLib_en.lib for the functions of the Modbus library.

As the "original" Instruction List Set (with the mnemonics STH, OUT etc.) could not be extended by an unlimited amount of new instructions, the call of new features such as the Open Data Mode, Sending of EMails etc. is realised with so called SFs (which stands fro "System Function"). These SFs are called using CSF instructions (Call System Function).

What is a SF library?
A System Function library is a a set of functions which are implemented in the firmware and which can be called with the IL mnemonic CSF. Usually one SF library contains several functions which are related to each other. A CSF expects the SF library and the function from this library, together with a set of parameters (described in the online help of the SF library which can be found in the IL Editor SEdit from PG5 2.0).

How is a CSF used?
In the user program a SF function is called using the mnemonic CSF, followed by the library, the function and the parameters:
CSF     [cc]     Library
                    Function
                    Parameter 1
                    Parameter 2
                    ...


This can be done from inside an FBox, or directly from an IL program (as the engineering is faster using the FBoxes, the most CSFs are called from FBox libraries).
The "translation" between meaningful names (e.g. S.SF.DBLIB.CopyTextBytes) and the code which is used by the firmware is done by PG5. For a list of the most commonly used SF libraries, please refer to FAQ 101568.

In July 2010 the firmware 1.14.23 has been introduced into production for the PCD2.M5xx0 and the PCD3.Mxxx0. This FAQ lists the main differences between versions 1.10.51 and 1.14.23.

New features
please note that in order to take advantage of these new features PG5 2.0 SP1 (PG5 2.0.150) is required.

• Increased amount of available flags (14335 instead of 8191), see FAQ 101447
• S-Web and FTP Server as well as the IP Enhancements (DHCP, DNS, SNTP and PPP) can be configured in the Device Configurator, see FAQ 101464
• Webserver access levels can now be configured in the Device Configurator (was before in the WebBuilder settings), see FAQ 101613
• IEEE floating point values can be displayed on the S-Web server (display format is “e”), see FAQ 101188
• Number of COBs increased to 32, see FAQ 101467

Main corrections

• SYSWR for DB backup failed after a lot of backups, see FAQ 101466
• STXT with more than 512 bytes sent a wrong text, see FAQ 101468
• The IP address for the Open Data Mode System Function “ConnectTCP” could not be given as constant 

Hardware compatibility of firmware 1.14.23 with PCD3 systems
The firmware 1.14.23 requires a PCD equipped with 4 MB onboard flash. Therefore the minimal hardware versions for installing the 1.14.23 and later are:

For PCD3 systems older than listed the firmware 1.10.61 is the last firmware which can be installed on these systems. This firmware is and remains available on the support site in parallel to the 1.14.23.

Remarks 

• When updating from 1.10.xx
  Please note that the user program as well as the communication settings are lost during the firmware update from 1.10.xx to 1.14.xx (or 1.16.xx) 
• BACnet applications
  The BACnet firmware 1.14.26 is compatible to this new production firmware. Please download the latest BACnet firmware package for PCD firmware 1.14.xx from the support page (link below).

In case a text with more than 512 bytes is sent with a firmware older than 1.14.23 the according text has not been sent correctly.

Symptom
When sending a text with a length of more than 512 bytes on a PCD3 or a PCD2.M5 with a firmware older than 1.14.23 the text which is sent is not correct.
In case the text to be sent contains sub-texts which are introduced using interpreted text (e.g. the $Lnnnn) and the final length to be sent is more than 512 bytes, the same phenomenon can be observed.

Solution
Please update the firmware of your PCD to version 1.14.23 or later.

Up to firmware version 1.14.23 the maximal amount of COBs (Cyclic Organization Blocks) has been 16. In firmware 1.14.23 the amoung of COBs has been increased to 32. Thus on PCD2.M5 and PCD3 and newer systems up to 32 COBs can be used (COB to 31).

Remark
Please note that PG5 2.0 Service Pack 1 (PG5 2.0.150) is required in order to program the COBs 16 and higher.

In some cases, usually after a lot of backups which have been executed, the error bit 7 (flash task already started) or 8 (flash error) is set with firmware older than 1.14.23.

Symptom
A backup DB to flash (IL instruction "copy TEXT/DB to flash card", SYSWR 3000 or 3100) fails and the error bits 7 and/or 8 are set. This error remains, even after waiting several minutes without re-attempting a backup to flash.

Solution
This problem is corrected in firmware 1.14.23 or later. Please update your PCD firmware in order to solve this problem.

In May 2010 the firmware 1.10.51 has been introduced into production for the PCD2.M5xx0 and the PCD3.Mxxx0. This FAQ lists the main differences between these versions.

New features

• The Serial-S-Bus mode “Parity master” is now supported on all serial ports of the PCD, see FAQ 101103

Main corrections

• Increased stability for BACnet upload/merge (requires BACnet firmware version 1.10.50), see FAQ 101417
• Correction which avoids potential data loss on the SD cards when a card with more than 256 kBytes capacity is filled by 70%, see FAQ 101377
  In case an SD card is used on the PCD, the update of the firmware to the version 1.10.51 is strongly recommended!
• Avoided inter-character delay on port 2 and 3 (PCD2.M5) or 0 and 3 (PCD3) which could lead to communication problems, see FAQ 101382
• A Bus Error could occur in some specific cases, see FAQ 101418
• Reading Ni1000 sensors with a PCD2/3.W340 by the media mapping returned wrong values, see FAQ 101416
• Profi-S-I/O and Profibus DP Master did not work, see FAQ 101244

For writing data to files on the PCD file system and for sending SMS or EMails it is possible to enter the content of medias (registers, flags etc.) into the text to be written or sent. This is done by placing e.g. a $R0100 into the text to be sent. At the time of writing, the "$R0100" will be replaced by the content of the register 100.

While in the beginning only points could be used as seperators in interpreted texts, it is also possible using the comma as separator with recent firmware versions. In this case, instead of a point a comma is to be used:


Firmware dependencies
The comma separator can be used starting with the following firmware versions:

Under certain circumstances (if the file system is occupied by more than 70%) data losses on SD cards bigger than 256 MBytes have been observed.

Symptom
Under certain circumstances data losses on SD cards bigger than 256 MBytes have been observed. By analyzing these reports we have seen that in case more than 70% of the available memory on such a card is used it is possible that data is lost on the next power-up of the PCD or after the card has been re-inserted into the memory module holder (R600 / R6000) or opened by the SD Flash Explorer.
In case of many delete operations executed by the module the mentioned data loss can also occur if less than 70% of the available memory is used (due to the ware-out management of the SD card which varies the used memory areas).

Solution
An additional safety mechanism in the PCD firmware 1.10.51 as well as in the SD Flash Explorer in order to avoid future potential data loss on concerned cards has been implemented.
As soon as the system is rebooted (or the SD card is re-inserted into the R600 / R6000 mounted on a PCD with a new firmware versions) actions are taken in order to avoid the mentioned potential data loss.

The according firmware 1.10.51 (for PCD2.M5xx0 and for PCD3.Mxxx0 systems) with the new safety mechanism can be found on the support site www.sbc-support.ch.

In addition to the safety mechanism a new SD Flash Explorer version 2.0.215.0 features a “Backup” and a “Restore” feature which allows the creation of a backup of the file system.
This SD Flash Explorer can be downloaded from the support site from the section for the PCD7.R-SDxxx and will be distribued with the SP1 for PG5 2.0.

Remarks

• Even if the file system on a SD card is already filled up by more than 70%, it is still possible to download the data over FTP as long as the PCD is NOT switched off. This method is recommended before updating the firmware in order to guarantee that no data is lost.
• SD cards delivered by Saia-Burgess Controls AG after week7 of 2010 contain a mechanism that avoids the above mentioned data loss (as long as the card is not formatted with a firmware older than 1.10.51).
  

Since summer 2010 the PCD3 family (PCD3.M2xxx, PCD3.M3xxx, PCD3.M5xxx and PCD3.M6xxx) do support the "full-duplex mode" and Auto-MDIX on the Ethernet port.

The PCD systems PCD1.M2, PCD2.M5 and the PCD3.T665/665 as well as the MB Panels PCD7.D4xx do support the "full-duplex mode" and Auto-MDIX since the first hardware version.

PCD3
The easiest way to detect wheter a PCD3 features the full duplex mode as well as Auto-MDIX is checking whether the RJ45 plug is equipped with LEDs. If it is, the PCD supports the full duplex mode as well as the Auto-MDIX feature (auto-crossing the signals).
In detail the following hardware version or later are required in order to support full duplex and Auto-MDIX:

• The PCD3.M3xxx, PCD3.M5xxx and PCD3.M6xxx since hardware F.
• The PCD3.M2x30A4T1 and PCD3.M2x30A4T3 since hardware B.
• The PCD3.M2x30A4T5 since hardware C.

Before these hardware versions the PHY which was mounted on the PCD3.M3xxx, PCD3.M5xxx and PCD3.M6xxx CPUs was configured by hardware to work in half-duplex mode and not to support Auto-MDIX. As result, the half duplex mode was used even if the partner device was configured in auto negation mode and the port should be initialized in full duplex mode.
This was the case on all PCD3.M3xxx and PCD3.M5xxx up to hardware version E 4.

Remark

• With "half-duplex": The data throughput is not devided by two because of this configuration as the limiting factor is not the the full/half duplex mode of the ethernet interface but rather the time it takes for the PCD to treat the received telegrams. The data throughput of the whole network is not affected either, since the next switch/hub will have an own port configuration for every port used (so on one port half-duplex can be used, and on another port full duplex can be used at the same time).
• If the Auto-MDIX is supported it is not necessary to use a crossover cable for directly connecting e.g. a PC to a PCD, or a MB Panel to a PCD.

This FAQ contains an overview over the firmware versions currently used in production (which means that this firmware version is installed in our production facility).

Firmware versions used in production
The following firmware versions are currently used in production. For more information regarding the relevant firmware, please refer to the version information document of the according page.

PCD firmware versions

MB Panel firmware versions

RIO firmware versions

When working with PCD systems you will cross the expression "Saia PCD® COSinus" sooner or later. This FAQ explains what "Saia PCD® COSinus system" stands for.

The expression "Saia PCD® COSinus"
In general the expression "Saia PCD® COSinus" stands for PCD systems which are equipped with Freescale (previously Motorola) Coldfire CPU technology. The "non-Saia PCD® COSinus" systems from Saia-Burgess Controls AG are based on Freescale 68k CPU technology (e.g. PCS1, PCD2.M170 etc.).
The Coldfire CPU technology is a new and more performant CPU generation, new development is generally realized on Coldfire CPU (while the 68k CPUs still are available in parallel).
The first PCD system based on the Saia PCD® COSinus technology has been the PCD2.M48x. For this system the whole firmware has been re-written. The firmware of new systems is built up based on the firmware developed for the PCD2.M48x platform (having the same core modules). New firmware functionalities (e.g. Modbus which is implemented in the firmware) are basically designed for the Coldfire CPU technology and thus for Saia PCD® COSinus systems.

Saia PCD® COSinus based systems
The following list contains the main PCD systems which are based on Saia PCD® COSinus technology.

• PCD3.Mxxx
• PCD2.M48x
• PCD2.M5xxx
• PCD7.D4xx
• PCD1.M2xx (currently under development)

Does this mean that all Saia PCD® COSinus systems support the same firmware features?
No! Although the same base modules of the firmware are used, it is depending on the PCD system whether a specific feature is supported or not. For example the http protocol is supported by PCD3 and PCD2.M5xxx systems, but not on PCD2.M48x.

With an activated software watchdog the processor monitors itself and restarts the PCD in the event of a malfunction or a loop.

Description (extract from the hardware manual)
The hardware watchdog provides maximum security. However, for non-critical applications, a software watchdog may be suffcient, whereby the processor monitors itself and the CPU is restarted in the event of a malfunction or a loop.
The core of the software watchdog is the instruction SYSWR K 1000. When this is first issued, the software watchdog function is activated. This instruction must then be issued at least every 200 ms, or the watchdog will trigger and restart the controller.

Usage

• Placing a "Watchdog"-FBox in a FUPLA-file is the easiest solution:
  
• Instead of using the FBox it is possible calling the Software Watchdog in IL (using the instruction SYSWR K 1000)
  

If there is a SIO-Master and a DP-Master configured the SIO-Master does not go in the "Operate" state to make the data exchange.

Symptom
It can happen with the firmware version 1.10.16 that a PCD3 or a PCD2.M5 does not work as SIO-Master if they are also DP-Master.

Solution
This behavior is solved with the version 1.10.51 or newer (the first version which corrected this situation was 1.10.20). Please update the firmware of your PCD in order to solve this issue.

The WebServer2 is a re-implementation of the previous WebServer on Saia PCD® COSinus systems and of course compatibel to the previous version.

History
The first implementation of a Web Server on PCD systems has been realized around the year 2000. With growing experience additional features and higher performance have been requested. In order to fullfil this requirement, the WebServer has been re-implemented (with the result of the WebServer2).

What is new in the WebServer2?
In general the WebServer2 is functionally compatible to the previous implementation. In addition the following new features are supported:

• HTTP 1.1 support
• HTTP caching is supported. As result the in FAQ 100708 is no longer to be applied; It is recommended to enable the caching for the JVM (option "keep temprary files on PC") when working with the WebServer2.
  
  Remark: If the caching is not enabled, you will not profit from the supported caching; it will then work as it has before with the previous WebServer. 
• Better performance
• Parallel acces to files is properly supported (acces is no longer interrupted if another client loads the IMaster applet)
• Multiple Web clients can access the Web Server on the same physical interface with (Ether-S-Bus or Profi-S-Bus)
• Easier understandable error messages
• When texts are entered, the length of the text is specified (and no longer filled up with space characters)
• The WebServer2 does provide more information on the default page and has a nicer look. By viewing this page it is easy figuring out whether the WebServer2 is running on a PCD
  

  View of previous WebServer	View of WebServer2

Firmware (FW) supporting the WebServer2
The table below indicates the first firmware versions supporting the WebServer2. Systems not listed in this table do not feature the WebServer2.

^*) Please note that in the first pilot firmware not all features have been supported.

Remark
The only incompatibe difference between the previous WebServer and the WebServer2 concerns users that use the "HTML forms":

• The previous Web Server used:
  %%TAG%
• The WebServer2 expects (the "value" is no longer automatically added by the Web Server):
  value=%%TAG%

An example for the HTML forms on the WebServer2 can be found in the attached document.

Yes, a new set of instructions for calculation with IEEE floating point values (single and double) has been added to the firmware of PCD2.M480, PCD2.M5xx0 and PCD3.

Introduction
Motorola FFP (Fast Floating Point) has been used for floating point calculations since the beginning of PCD history. In order to simplify the interface against systems which do not support FFp but IEEE format for floating point values the instruction set of the PCD has been extended. All "twin" of all instructions available for the calculation with FFP values are now also available for IEEE calculations.

What are the instructions in detail?
Each of the existing instructions for FFP (the default) do also exist for IEEE Float and IEEE Double data. 

• For IEEE Float, precede the mnemonic with an 'E' character, for example EIFP, EFADD (instead of IFP or FADD) etc.
• For IEEE Double, precede the mnemonic with 'D', for example: DIFP, DFSUB.

Minimum Firmware (FW) requirement for this feature

PCD systems not listed in this table do not support this function.

Remarks

• These instructions can only be used with PG5 2.0.
• There is also a new instruction for the conversion from IEEE single to IEEE double (and vice versa):
  EFPD (single to double) and DFPE (double to single). These instructions are supported by firmware version 1.10.15 and later.
• The instructions for convertig a IEEE double value to an integer value and vice versa (DFPI and DIFP) are working correctly starting with firmware 1.14.23.
• IEEE single values can be displayed by the S-Web Server using the format "e" (e.g. 172.16.1.127/cgi-bin/readVal.exe,e) 

For "reading" a value from a PCD text (e.g. copying "1234" from a PCD text with content "The next number is: 1234" into a Register) a new System Function has been added for PCD3 and PCD2.M5xx0.

What does this System Function (SF) do?
The new function "S.SF.DBLIB.ReadANumberFromText" allows reading a number from a text and copy it into a register. Starting from a provided pointer, the next number will be searched and copied.

Where do I find the documentation for this function?
This function is documented in PG5 2.0. The easiest way to open the documentation is opening the SEdit, selecting the "SF DB Access Library" and hitting "F1":


Minimum Firmware (FW) requirement for this feature

PCD systems not listed in this table do not support this function.

Remark
This feature can only be used with PG5 2.0.

For parsing a PCD text for a specific expression (e.g. finding "world" in a PCD text with content "Hello world") a new System Function has been added for PCD3 and PCD2.M5xx0.

What does this System Function (SF) do?
The new function "S.SF.DbLib.SearchText" allows searching a text for a specific expression. If this expression is found, the SF returns the position of the expression within the text.

Where do I find the documentation for this function?
This function is documented in PG5 2.0. The easiest way to open the documentation is opening the SEdit, selecting the "SF DB Access Library" and hitting "F1":


Minimum Firmware (FW) requirement for this feature

PCD systems not listed in this table do not support this function.

Remark
This feature can only be used with PG5 2.0.

The XOB 8 who is called when the firmware detects an invalid instruction (Invalid OPC) in the user program is no longer called on the systems Saia PCD® COSinus (PCD3, PCD2.M5, PCD2.M480).

On the new systems, the control of the Invalid OPC is executed at the startup during the precompilation. So the XOB 8 will never be called.
This new mechanism is implemented to increase the speed and the flexibility of the systems Saia PCD® COSinus.

If the communication on both ports of a PCD3.F281 does not work then it's possible that the PCD3 does contain a FW which not does recognise the PCD3.F281 module.

Symptom
The communication on both ports of the PCD3.F281 does not work at all. The firmware installed is 1.08.23.

Reason
The firmware does not recognize the Belimo MP Bus module.

Solution
To solve the problem please install PCD3 firmware version 1.10.16 (the first firmware solving the problem was  version 1.08.51).

In very special situations a PCD can get overloaded because of external influences in a way that a "KERNEL ERROR" or a "SWTO ERROR" (System Watchdog Timeout Error) is causing the PCD to restart automatically.

Symptom
In some very special circumstances (if a PCD is stressed by extreme external influences) the PCD3 automatically executes a reboot and then goes in HALT (if the software watchdog is programmed, the PCD automatically goes in RUN after the restart).
When going online and reading the PCD history, an entry "KERNEL ERROR" (on firmware versions 1.08.xx and earlier) or "SWTO ERROR" (on firmware versions 1.10.xx and later) can be found.

Reason
For saftey reasons the PCD executes a reboot in case the System Watchdog is no longer called within a specific time (this is the same behavior as the Software Watchdog, but directly on firmware level). In case of the Kernel Error a task-overload has been detected (FW indicating a Kernel Error (1.08.xx and earlier) do not feature the System Watchdog). 
Such a situation could e.g. be caused by an Ethernet telegram bombardement of several thousend telegrams per second or if a connected FDL network is disturbed heavily over a long time. In such a situation the PCD (with FW older than 1.10.xx) does only treat the interrupts generated by e.g. the IP telegrams and no longer executes the rest of its tasks (for security reasons, this state is interrupted by the automated reboot of the system).
 
Solution
A new Kernel together with other improvements which can avoid situations leading to SWTO Errors have been implemented in firmware version 1.10.xx (or in the special firmware with new kernel 1.08.19.12). Thanks to these improvements the PCD is even more robust against the mentioned influences which can cause a "SWTO Error" (or a "KERNEL ERROR").

Important

• Please note that in case a Software Watchdog is programmed, the PCD does automatically go in RUN after the restart executed by the System Watchdog (if no Software Watchdog is programmed, the PCD goes in HALT after the reboot caused by the System Watchdog)
• In general it is recommended using firmware version 1.10.16 or later rather than 1.08.19.12.

The PCD3 systems equipped with an Ethernet port and the PCD2.M5540 are able to send emails. But sending e-Mails is not only depending on the CPU itself.

The PCD3 systems equipped with an Ethernet port and the PCD2.M554x support SMTP (Simple Mail Transfer Protocol). Sending emails does not only depend on this feature but as well on the ISP (Internet Service Provider), the firewalls and router configurations between PCD and ISP.

The attached checklist with the criterias to verify with your provider and / or your IT support shall help to check whether sending E-Mail is possible.

This error message appears if the used firmware on the CPU does not support the "active and non ACK" filter for the S-Web alarming functionality (e.g. a PCD2.M150 with firmware 0D3).

Symptom
Instead of the alarm list of the S-Web alarming macro, the message "Failed to get data on alarm.exe" is displayed on the alarming page.

Reason
The reason is that the macro tries receiving the alarms filtered by the "active and not acknowledged" state of the alarms. This does only work if this feature is implemented in the according firmware.

Solution
Please update the firmware (FW) of your PCD system to the firmware supporting the according feature (see table below).

^*) On PCD3 and PCD2.M480 systems the "active and not acknowledged" filter has already been implemented in previous versions, but has been improved this indicated version.

Yes, this is possible by calling the system function (CSF) "IPGetLocalConfig".

Introduction
For having the possibility to read the current IP configuration from the user program, a specific System Function has been added to the firmware. This function does return the IP address, the subnet mask as well as the default gateway (each address in one register). The returned value contains the full IP address in one register (each byte or the register contains one octed of the IP address):

Example
This System Function is part of the IPD Library. In order to use these functions, the file "IPLib.inc" is to be included to the source file where the function is called. This can be done with the line:

$INCLUDE "IPLib.inc"

The IP configuration can then be read in th following way:

Returned IP address (hex):               0xAC100179h
IP address in "Dot-decimal notation": 172.16.1.121 (0xACh = 172, 0x10h = 16, 0x01h = 1, 0x79h = 121)

Firmware versions supporting the GetLocalIPConfig
Please refer to the table below for the first firmware versions that support the "IPGetLocalConfig" function.

Remark
The include file "IPLib.inc" from PG5 1.4.300 and earlyer versions needs to be updated in order to "know" this feature. Therefore please download the file "IPLib.inc" attached to this FAQ and replace the existing file from PG5 which is located in the "Libs/App" of PG5:

c:\Program Files\SAIA-Burgess\PG5 1_4\Libs\App\IPLib.inc

In firmware version 1.08.xx for systems running the Saia PCD® COSinus firmware, the system watchdog has been introduced. If a PCD reboots because of the system watchdog, the message "SWTO ERROR" is entered in the PCD history.

What for is a system watchog?
The system watchdog is a security measure which avoids a situation where the system (PCD) is blocked and does not properly execute the program any more. If the OS (Operating System) is "locked" in a loop and does no longer properly execute its tasks (among others, the user program), the PCD is automatically re-started. 

What does the system watchdog do?
The (internal) system watchog is configured directly on the CPU and will cause a re-boot if it is not triggered in a cyclic manner. Every reboot caused by the system watchdog is entered in the PCD history with the message SWTO ERROR (SWTO stands for System Watchdog TimeOut).
The behaviour after the automatic reboot caused by the system watchdog is depending on the software watchdog which can be programmed in the user program:

• If the software watchdog in the user program is enabled, the PCD will automatically go in RUN after a reboot caused by the system watchdog. 
• If no software watchdog is programmed in the user program, the PCD will go to "Halt" after it has rebooted because of the system watchdog.

Does the system watchdog conflict with other watchdogs?
No, the system watchdog does not conflict with e.g. the software watchdog programmed in the user program or with a hardware watchdog.  
 
When has the system watchdog been implemented?
The system watchdog has been implemented in firmware version 1.08.xx. The first production versions for the relevant systems can be found in the table below:

Remark
Note that the system watchog does not detect a bogus user program (e.g. an infinite loop) and therefore the usage of the software watchdog in the user program is still recommended.

The information provided in the history or the "Diagnostic file" of the PCD does not always give enough information for the firmware developpers to find the reason for e.g. a crash of a PCD. If more information is required in order to trace back a crash, a dump of the whole memory (SRAM, DRAM and FLASH) of a PCD can be done. This FAQ does apply to PCD1.M2, PCD2.M480, PCD2.M5xxx, PCD2.M45x0, PCD3 (including PCD3.Mxx60) and PCD7.D4xxxT5F (Programable MB-panels).

Working principle
For dumping the memory of one of the following systems a dedicated small executable SaiaDump.exe is available as standalone tool.

• PCD1.M2
• PCD2.M480
• PCD2.M5
• PCD2.M45x0
• PCD3
• PCD3.Mxx60 (fast CPU)
• PCD7.D4xxxT5F (programmable MB-panels)

Usage of the stand alone tool SaiaDump.exe:
This tool is called by a batch file which will call an executable (SaiaDump.exe) with hardware specific parameters. The executable will establish an USB connection to the PCD and will read out the memory content. This content will be stored in 4 files and all these files will automatically be stored in a *.zip archive.

General remark:
In order to obtain all necessary information it is important that the dump is made while the CPU's memory still contains the last information.
Since this information is lost (overwritten) when the PCD re-boots, it must be achieved that the PCD does not reboot in case of a crash (e.g. Bus Error or Kernel Error).
Therefore a specific SYSWR has been implemented.
This command is to be executed on the PCD e.g. in XOB 16 before a crash occurs (on every boot, because it is reset on each power off).

Software installation of SaiaDump.exe tool

• Download the archive "SaiaDump_V1_3_006_Rev211101.zip" from this FAQ
• Unpack the *.zip archive on your PC or Laptop
• In the extracted folder "SaiaDump" you'll find several batch files (e.g. RUN_DUMP.bat or RUN_DUMP_PCD1M2xx0.bat).
  By double-clicking on the file RUN_DUMP.bat, a dump is started (make sure that PCD is connected with a USB cable and no PG5 is running)
  
  After a successful dump a new *.zip archive with the name "PCDDump_date" will be stored in the same directory.
  Please send this archive (it should contain four files with the extension *.blk or *.bin and a log file) to the support. 

Preparing the PCD
In order to cause the PCD not to reboot in case of a crash, add the following lines to the code of your CPU (and remove the watchdogs, if present).
Alternatively, you can also add and link the file "DontRestartAfterCrash.src" which is contained in the folder "PCD_Preparation" off the "SaiaDump_exe.zip" to the concerned CPU in your PG5 project.

$INIT                   ; Add the following lines to the XOB 16
SYSWR K 9999     ; Instruction to cause the PCD not to
K 1                       ; reboot after a crash
$ENDINIT

This instruction has been implemented first in PCD3 firmware version 03A.
Therefore please also make sure that FW version 03A or higher is installed on the system.
The SBC Dump tool can only dump the memory of a PCD that has boot loader version 035 (created in April 2006) or higher installed.
In case your PCD has a too old boot loader or if you are in doubt of the boot loader version of your PCD, please refer to FAQ 100680 in order to learn more about how to find out the boot loader version and how to update the boot loader version. 

Dumping the PCD memory
After the next crash, the PCD will not re-boot anymore and will blink with all tree LEDs simultaneously instead. Please note that the SYSWR K 9999 (see above) must have been introduced before the crash and the LEDs must blink in this state! In this (and only in this) situation it is possible dumping the memory of the PCD:

Use of the stand alone tool SaiaDump.exe:
Launch the SaiaDump.exe for retrieving valuable debug information (it is also possible dumping the PCD if the PCD is in boot loader state or run for test purposes, but no valuable debug information can be retrieved from these files).
For launching the SBC Dump is should be enough to double-click the file RUN_DUMP.bat.

Additional information for PCD3.Mxxx7
The same tool can also be used for dumping the memory of a PCD3.Mxxx7. But note that the usage of the SYSWR listed above is not to be used.

FAQ updates

• December 2021(Version 1_3_006_Rev211101)
  - Support also the PCD2.M45x0
• March 2013 (version 1.3.006)
  - Support also the PCD7.D4xxxT5F (programmable MB-panels)
• July 2011 (version 1.3.005)
  - created batch files for easy launch or the SBC Dump executable 
  - added log file creation during dump process
• November 2010 (version 1.2)
  - supports new hardware: PCD1.M2 and PCD3.Mxx60 (fast CPU)
  - supports the new USB driver (for 64Bit OS) 
  - removed the firmware files from the package in order to make it smaller
• June 2010 (version 1.1)
  - increased SRAM memory Dump (2 MByte) for recent PCD systems (PCD3, PCD2.M5).
  - update of firmware delivered in the package to 1.10.51. 
• Mai 2009
  Version 1.0 of the SBC Dump: This version does also dump the internal SRAM of the PCD.

In firmware 03B and 03C an S-Bus broadcast telegram will block the communication interface until the next reboot of the PCD.

Symptom
When using firmware version 03B or 03C on either a PCD2.M480 or a PCD3.Mxxx0, the communication stops working after a sent broadcast. This only applies if the concerned PCD is acting as master on the S-Bus network.
This phenomenon occurs on S-Bus (Serial-S-Bus, Ether-S-Bus or Profi-S-Bus).

Reason
In firmware 03B and 03C an S-Bus broadcast telegram will block the communication interface until the next reboot of the PCD.

Solution
In order to resolve this problem, please update the firmware of your concerned PCD.

The first versions of the PCD3.M5340 controller have been delivered with a firmware that does not support the usage of the RS485 port on port 3.

Problem
The communication RS 485 on port 3 of the PCD3.M5340 is not working correctly. 

Reason
Due to a problem in the firmware, the port is not correctly initialized to RS 485.

Solution
Upgrade the PCD3 firmware to version 1.08.23 or higher.

Remark
There is no problem for the usage of the port 3 as RS422 port.

If a wrong or invalid firmware is downloaded to a PCD3, the firmware download progress bar reaches 100%. After the download finished, an error message appears indicating a failure caused by a NAK response.

Symptom
After the download of a firmware file the following error message from the Firmware Downloader (FWDnld) appears. The message is "Download failed on END command. Error: NAK response."
§ix100527§

Reason
The reason for this message is a "NAK" (Not Acknowledged) response from the PCD. Before the PCD loads a new firmware, it is verified by the PCD. If this verification fails (because of e.g. a wrong checksum of the firmware of because the firmware is not intended for this CPU type), a NAK response is sent by the PCD to the Firmware Downloader.

Solution

• Make sure the firmware you download is created for the CPU type you have attached (a firmware for e.g. the PCD2.M480 will not run on a PCD3.Mxxx0 system)

• Make sure the file you have downloaded is not corrupted (e.g. while the download from the internet or similar). In case of doubt, re-download it.

In order to simplify the interpretation of firmware versions and to avoid confusion regarding implemented features and bug fixes in different firmware versions, a new firmware version format for Saia PCD® COSinus based systems will be introduced.

Arguments for the new format
The new firmware version naming allows a clear and easy comparison between the different versions and their implemented features (PCD type specific) and bug fixes.
Questions like "Why is the Alarming functionality of the PCD3 Web Server implemented in firmware version $31 but not in version 031? - They both do have the same number..." should be past (however, if you're interested in the answer, please refer to FAQ100176)

Format description
The new firmware version name does consist of a major version, a branch version and a minor version separated by a dot (.).
Note that the prefix characters “0”, “$” or “#” are no longer used in this notation.

Concerned systems
The new firmware version format is applied to the systems based on Saia PCD® COSinus firmware (Classic and xx7). These are

• PCD1.M2xxx
• PCD2.M48x
• PCD2.M5xxx
• PCD3.Mxxxx
• PCD7.D4xx (MB Panels)

While the firmware names for the MB Panels and PCD1.M2xxx do have this format from beginning, it was introduced on the PCD3 and PCD2.M480 systems with the firmware version after 03B.

Version flow example
Below an example for a version flow. If e.g. a bug is corrected in the version 1.06.01, also version 1.07.02 and all following 1.06.xx versions do/will have this correction implemented.


Version types

• Released beta- or maintenance versions (equivalent to the current “Bxx” or “#xx” versions).
• Released Production versions (equivalent to the current “0xx” versions): These versions are introduced in the production.
• New function versions (equivalent to the current “$xx” versions).

Compatibility with PG5
The new firmware names are fully supported by PG5 V 1.4.200:

Previous versions of PG5 will only show the first three digits of the firmware version (e.g. “106” instead of “1.06.08”). The full firmware version can always be read by displaying byte F0F0 in the “Online Debugger” (type DYF0F0 ):

While the serial PGU port of systems before the PCD3 did always work as PGU port when connecting a PCD8.K111, the serial PGU port of the PCD3 can be configured for using a modem. If this is done, it is no longer possible attaching a PCD8.K111 and establishing a PGU connection.

Symptom
It is not possible going online with the PGU communication mode using a PCD8.K111 programming cable plugged in on the D-SUB labeled "Com/PGU" of a PCD3.M5xx0.

Reason
The port "Com/PGU" of the PCD3.M5xx0 can be used as either PGU port for programming the PCD or for connecting an external modem to the PCD3. In case a modem is connected, the full handshake must be enabled and by doing so the detection mechanism for a PGU connection established with a PCD8.K111 is disabled.
A second reason could be that the firmware 039 is installed on the PCD3. In this case a firmware problem avoids a successful serial PGU connection.

Solution
Connect to the PCD using a USB cable (which always works as programming connection) and upload the current hardware settings of your PCD3.
§ix100519§
After having uploaded the current configuration of the PCD3, check that the checkbox "Full RS232-handshaking on Port 0" is not checked. If it is checked, uncheck it and download the modified hardware configuration in order beeing able going online with a "serial PGU" connection.

If it is still not possible going online with the PCD3, please check the firmware version of the PCD3. Note that the version 039 has a known problem that avoids going online over the Serial PGU connection. In case you are concerned by this problem, please contact your local sales office and request a firmware that fixes this problem (e.g. 03A).

Due to a firmware problem the clock of a PCD3.Mxxxx equipped with a firmware x3x older than version 037 can be corrupted in run time.

Symptom
The clock value of a PCD3.Mxxxx equipped with a firmware x3x older than version 037 can run "accelerated" while the PCD is in run. After a power off / on of the PCD, the clock will be set correctly again.

Reason
This behaviour is caused by a problem in the firmware and is related to the "Soft RTC" which has been introduced in version 030.

Solution
This problem is corrected in firmware version 037. Please refer to the support site where you can find the latest version of the PCD3 firmware in the section "Product information --> PCD3 --> Mxxx0"

Depending of the PCD type and the used port it's possible to use the XON/XOFF protocol.

Symptom
A SASI (Assign Serial Interface) in mode MC2 (Character mode with Xon/Xoff protocol) fails. The error flag is set after the SASI instruction.

Reason
The XON/XOFF protocol is not supported on this PCD or port.

List of supported ports
PCD3.M5xxx: the mode MC2 is supported on port 0 (Com/PGU) and also on the PCD3M5340 in RS422 on port 3 (S-Net/MPI).
PCD2.M5xxx: the mode MC2 is supported on port 2.
PCD1.M2xxx: the mode MC2 is not supported.


Remark
Please note that on the PCD2/3.F2xx modules, the XON/XOFF mode is not yet supported (which is not correctly documented in the manual 26/789).

When downloading a recent PCD3 firmware (e.g. 031) over e.g. USB it can occur that the error message "Download failed on END command" is shown at the end of the download. The LEDs of the PCD remain blinking in the "Firmware download" sequence.

Symptom
At the end of the firmware download (in S-Bus USB mode) of e.g. version $33 the "PCD Firmware Downloader" an error message window pops up saying "Download failed on END command, Error: No response."
After a reboot the PCD boots properly and has loaded the new firmware version.
§ix100473§

Reason
The PCD does answer the "END command" telegram too slowly. This is because the PCD first needs to calculate the CRC of the firmware wich takes a bit longer than 250 ms (which is the default timeout on S-Bus PGU).

Solution
In order to avoid this error message please increase the timeout of the "S-Bus USB" to e.g. 500 ms:

• Go offline with your PCD3

• In the "Online Settings" of the relevant CPU click the button "Setup" behind the channel selection "S-Bus USB"

• Change the default value of 250 ms to 500 ms

• Accept with "Ok" and close the "Online Settings"

Note
The same symptom can also appear when using other communication channels, e.g. Ethernet. In case the same message apperas also on Ethernet, please also update the accoring settings.

In case a PCD3 has installed a firmware version older than version 020 the download of a recent firmware version (e.g. 031) fails. The error message of the "PCD Firmware Downloader" in this case is "NAK response".

Symptom
It is not possible downloading a firmware newer than $25 (e.g. 031) to a PCD3 having installed a firmware version older than 020 (e.g. 018). The progress bar of the "PCD Firmware Downloader" nearly reaches 100% but then a message pops up saying "Download Failure, Error: NAK response".

Reason
The firmware download fails because the installed firmware (e.g. 018) first stores the downloaded firmware file to the onboard RAM (before copying the new firmware to the flash). The space required on this RAM is not sufficient for firmware versions newer than version $25.

Solution
The new firmware can only be loaded if the PCD is first switched to the "Loader State". In this state not the firmware itself but the boot loader handles the downloaded firmware file (and the boot loader does not copy the firmware to the RAM first).

Procedure for switching the PCD3 into "Loader State"

• Switch the power of the PCD on.
• On a PCD3.M5xx0
  Switch the RUN/STOP switch up and down as soon as the green RUN LED starts flashing.
  On a PCD3.M3xx0
  Press the RUN/STOP push button and release it as soon as the green RUN LED starts flashing.
• Verify that the PCD is switched to the “Loader State”:
  In case the PCD was successfully switched to the “Loader State” the “Run/Halt” LED will blink in an infinite sequence (dark-red-green-red) which is the indication of the “Loader State”.
  On the PCD3.M5xxx additionally the LED’s on the battery module will blink in the sequence “Run-Halt-Error-Halt-Run”.

Note
This procedure is only required for updating the firmware to a recent version. Once the firmware is updated this procedure is not required any more.

Remark
In case the booter version installed on the PCD is older than or equal to 024 it is only possible downloading the firmware in PGU mode using a PGU cable (PCD8.K111).

The diagnostic flag TBSY of the "Character Mode" (used for sending characters over a serial line) is not handled the same way on a PCD3 compared to "older" systems like e.g. PCD2.M170.

Symptom
If the relevant port is assigned in MC mode, the diagnostic flag TBSY is indicating that the serial port is busy sending characters. This is the case on e.g. a PCD2.M170.
This behaviour is not the same on a PCD2.M5xxx or a PCD3.Mxxxx, especially not when using a PCD3.F121 or a F2xx(x) modules. On a PCD3/PCD2.M5 the TBSY flag is not any more high during the whole time the port is busy. Instead, it is only high a short time at the very beginning of the send task.

Reason
The reason for this difference is a new manner to access the UART of the port. On older systems the characters were directly written to the UART while on the PCD3 a buffer is placed in-between. Instead of indicating the "send-state" of the UART like on older systems, the TBSY represents the state of this buffer (the size can be found at the end of this FAQ) on the PCD3 or the PCD2.M5.

Solution
This difference shouldn't lead to problem is most cases. However, in some applications the state of the TBSY is used to control e.g. the RTS signal of the line (using the instruction SOCL). In this case the communication (working on a PCD2.M170) won't work any more on a PCD3 or a PCD2.M5.
In this situation one of the following workarounds could be applied:

• Instead of assigning the port in MC0 it could be assigned in MC4 (MC4 is usually described as "MC for RS485"). In this mode the UART is managing the RTS autonomously (and therefore there is no more need to set the RTS by the user program). Note that in this case the SOCL commands are to be removed from the program!
• The duration while the RTS is to be set could be calculated beforehand (based on the amount of characters to be sent) and loaded into a timer. While this timer is high, the RTS can be set using the SOCL command.
  Note that this solution is not really a "nice" one and can only work with very low baud rates.

Notes

• All firmware versions of the PCD3xxx and PCD2.M5xxx do treat the TBSY as described in this FAQ.
• The buffer size is depending on the port used:
  PCD3 port 1 and 2: 24 characters
  PCD3 port 0 and 3:  2 characters
  PCD2.M5 port 0 and 1: 24 characters
  PCD2.M5 port 2 and 3:  2 characters
  

There is a problem when placing a communication module PCD3.F1xx and a memory module (PC3.Rxxx) on the same PCD3.

Problem
If a communication module is per example on slot 0 of the PCD3 and a memory module is per example on slot 1, it is possible that one of them will not work. If one of the modules is removed, the remaining one will work correctly.

Reason
There is a problem in the firmware. As soon as more than one intelligent module (e.g. PCD3.F1xx, PCD3.F2xx, PCD3.R5xx or PCD3.R6xx) are plugged on the PCD3.Mxxxx the detection of the module can fail.
This problem will be corrected in firmware version 031 (but is is existent also in version 030 / $31).

Solution
As long as firmware 031 is not released the two modules will not work properly together. A workaround could be to put the memory module PCD7.R550M04 directly on the communication module. Open the memory module PCD3.R550 and remove the card PCD7.R550. Open the communication module PCD3.F1xx and plug the card on this module.

the minimum firmware version for PCD3.M5540 hardware version D is V023

For the correct handling of the new flash modules PCD3.Rxxx an and the PCD3.Fxxx communication modules an "I/O module check" has been implemented in the firmware. Unfortunately this check can cause problems on older hardware versions if more than two PCD3.Cxxx modules (extension cabinets) are used.

Symptom
The communication module PCD3.F121 as well as memory modules PCD3.Rxxx do not work when more then 2 extension cabinets PCD3.Cxxx are connected to a PCD3.
It is possible that the same PCD3 was working correctly but after an update of the PCD firmware this symptom appeared. In this case with the firmware update a new I/O module check has been introduced (please refer to the table below to find out in which versions this I/O module check is implemented).

Reason
An I/O module check has been introduced for the correct identification of the modules. In this way it is possible to avoid e.g. flickering outputs of an output module if a modem is (unintentionally) configured on this I/O slot. Also flash modules can be identified properly before accessing their content.

Unfortunately this check does not correctly recognize the modules plugged in to the PCD if the PCD is equipped with an old CPLD (Complex Programmable Logic Device) version as soon as more than two extension cabinets PCD3.Cxx0 are connected to the PCD.

Solution
Upgrading the CPLD version will solve the problems as the modules will correctly be recognized by the firmware. The upgrade of the CPLD corresponds to the hardware modification 8 on the PCD3 CPUs.

Hardware version D or above
The hardware version D has a correctly programmed CPLD and will therefore also detect intelligent I/O modules if more than 2 PCD3.Cxxx extensions are connected to the PCD3 CPU. No further action is to be taken.

Hardware version
These CPUs need to be updated to hardware modification 8 (CPLD update). Once this is done these PCD3s will support all PCD3.F1xx on slot 0 and also newer intelligent modules like per example the new flash moduls PCD3.Rxxx.
The update can be done with the "Firmware download Assistant in the following ways:

This is related to a firmware problem in the PCD3 FW 018. Update to the next official version.

A firmware bug in version 018 does disable the power supply for the PCD8.K120 (Profi-S-Link cable) after a firmware download. A reboot of the controller is needed in order to get the adapter running again.

Symptom
After a firmware download to the PCD3.Mxxx0 the Profi-S-Link adapter doesn't work. No online connection over this cable is possible any more until the PCD3 is rebooted.

Reason
This is a bug of the firmware version 018 for the PCD3.

Solution
Upgrade the firmware to the next version (downloadable from the support site www.sbc-support.com). In case you cannot find the firmware there, contact support@saia-pcd.com.

Configuration:
PCD3
PCD3.F121 Port 1
or on Port 0 (just with FW $26)

Problem
When using a Sasi Slave F-Box for the configuration of channel 1 and choosing RS Type RS 232, it will generate an error and the communication will never work. Otherwise the same configuration works on a PCD2.

Reason
There is a difference in the Firmware of the PCD3 which doesn't allow this configuration

Solution
Choose RS Type Default in the Sasi Slave F-Box and it will work.

If you use the instructionlist command "TEST 10" for controlling the real time clock in the PCD3, the

systemcycletime will get down to approximitally 2 or 3 cycle. The bug will be fixed in the next FW_Version

check before Firmware download over a network TCP/IP or Modem:

before you update the PCD- firmware, check that your hardwaresettings and user program is stored in to the flash memory 

There are firmware depending differences in the handling of the Serial-S-Bus communication diagnosic flags TDIA and RDIA. Those flags are refreshed continuously by older FW versions but not by the Saia PCD® COSinus Classic PCD firmware (used for PCD2.M480 and PCD3 controllers).

Symptom
The diagnosic flags do indicate whether there has been a communication error. The flags are directly depending on the diagnostic register RDIA. If the RDIA holds any value not equal to 0, the according diagnostic flag is set.
The state of the diagnostic flags is refreshed every ms by conventional FW versions (used for PCD1, PCD2.M1x0, PCD4, PCD6).
The Saia PCD® COSinus Classic PCD firmware (used for PCD2.M480 and PCD3) does not any more refresh the diagnostic flags cyclically. On this FW, the diagnostic flags are only refreshed on a communication event (such as e.g. a SRXM instruction).

Reason
Basically the diagnositc flags are refreshed by the communication routine of the FW. Conventional FW is polling the communication routine cyclically (every ms).
The Saia PCD® COSinus Classic PCD dosn't call the communication routine cyclically but only on interrupt (e.g. the communication instruction SRXM does generate such an interrupt). This means that the diagnostic flags are only refreshed on a communication event.
The advantage of this method is a minimized CPU load due to the communication task.

Conclusion
This change of the behaviour of the diagnostic flags isn't conflicting with any description or manual. However, there could be some program code that bases on the automatic refres of those flags. In this case the code has to be adapted when intended to use on a PCD running Saia PCD® COSinus Classic PCD FW.
The adaption could be realized in the way that on reset of the RDIA (which has to be done anyways) also the diagnostic flags are reset.

There is an Error Led on nearly every PCD system that can indicate a problem on the system. Read this FAQ to learn more about the different reasons for a lit Error LED and how to find the problem causing the lit error LED.

What causes the Error LED to get lit?
There are different reasons for a lit error LED. The most common reasons are listed below:

• A problem while assigning a communication port (e.g. missing communication module or wrong parameters)
• A problem while sending an S-Bus telegram (e.g. missing port assignation or invalid data array or media)
• Invalid mathematical operation (e.g. division by zero or value overflow after a multiplication)
• Index register overflow

How to find the problem in the code/configuration?
One fast way to find the problem is reading the history entries of the PCD. This may be done by using either the Online Configurator or the Online Debugger (type "Display History"). In the History some of the problems are listed explicitely (e.g. IPM not present) for further information regarding the History entries, please refer to the PG5 Help. The chapter "Messages" contains "Halt and History messages".
If only an "Error Flag" is mentioned the next task is to find the program part where the Error status-flag is set. This is to be done by using the Online Debugger:

• Go online with your Fupla- or IL program.
• Open the Online Debugger and type "Restart Cold All CPUs".
• Still in the Online Debugger, type "Run Until Status-flag Error". As soon the Staus-flag "Error" is set, the PCD will be stopped. Therefore the Fupla Editor will jump to the page which actually is processed (only this page is part of the current Fupla file! If the Error isn't caused by this Fupla file, it will jump to any other page which doesn't cause the problem. Have a look at this page and the FBox with the "stop"-box on it and decide whether the problem could have been caused by this FBox!
  If there isn't any FBox that could cause any problems mentioned above, repeat the procedure while beeing online with the next Fupla file of the CPU).
• If you can't find the problem directly in a Fupla file, switch to the Online Debugger again. After having stopped, a line similar to the line written below will be shown:
  *001234  STH       I/O       48                                  A1   Z0     N0     P1    E1     IX      COB2
  This first number of this line indicates on which line of the code the problem happened: the last instruction BEFORE the line shown caused the problem (the error LED is lit after the problem).
• Type "Display Program <line indicated -10> Count 15". Now you can see the instruction that caused the problem: Refer to the IL instruction Set (Online Help of IL Editor SEDIT) in order to figure out what this instruction exactly does.

If a SASI instruction causes the problem, check out the following possible reasons:

• The port is already assigned (have a look at the HW configuration and search for further SASI instructions by typing "Locate Instruction SASI" in the Online Debugger!).
  Hint: Also have an eye on the SASI FBoxes you used as well as on the HMI Settings tab.
• The port doesn't exist
• The SASI text isn't valid
• S-Bus support isn't enabled in the Hardware Settings but an S-Bus assignation was executed. This won't work because in this case the PCD doesn't have an S-Bus address (which is required for S-Bus communication).

If it seems as a mathematical operation caused the error, use the online debugger to run shortly before the problem-causing part of the code by typing "Run Until Instruction-Pointer Equals <instruction line shortly before problem-line>" (note that the instruction line must contain an instruction!). Once reached this line, type "sTep". In the Step-mode, you will see the contents of the PCD medias [brackets].

Remark:
The Error LED is lit in case the Status Flag E (Error status flag is set high) and no XOB 13 is programmed. In case the XOB 13 is programmed, the Error Led won't get lit but this XOB is processed immediately.

Use caution when downloading FW to a PCD3.Mxxxx controller because it is possible downloading a wrong FW (e.g. the one for the PCD2.M480).

Once the wrong FW is downloaded follow this procedure for downloading the correct FW:

Once a FW which is written for the PCD2.M480 is downloaded into a PCD3, there is only one way to get the PCD running again:

1. PLC power on
2. Switch the RUN/STOP switch two times up and down while RUN LED is blinking. Then download the FW via PGU cable (PCD8.K111) in PGU mode.

We have made good experiences with the GALEP 4, for PCD1 FW together with the adaptor 210841. The local dealer for Switzerland is www.redacom.ch.

Order numbers for empty firmware chips:

PCD1.M1x0: 1x ASN 4 502 7178 (OTP27C4002), one time programmable
PCD1.M137: 1x ASN 4 502 7178 (OTP27C4002), one time programmable
PCD2.M110/M120: 2x ASN 4 502 7126 0 (27C1001-10, EPROM)
PCD2.M127: can be downloaded, refer to the product page on www.sbc-support.ch
PCD2.M150: 2x ASN 4 502 7341 0 (49F040 ,Flash-EPROM)
PCD2.M157: can be downloaded, refer to the product page on www.sbc-support.ch 
PCD2.M170: chip soldered on the main board, the FW can be downloaded with PG5 *
PCD2.M177: can be downloaded, refer to the product page on www.sbc-support.ch
PCD2.M480: chip soldered on the main board, the FW can be downloaded with PG5 *
PCD2.M487: can be downloaded, refer to the product page on www.sbc-support.ch
PCD3.Mxxxx: chip soldered on the main board, the FW can be downloaded with PG5 *

* Procedure to downlaod a firmware:
1) get the appropriate file from product page on the supportsite www.sbc-support.ch
2) open PG5 and go to the online-configurator; go offline
3) open the menu tools, download firmware
4) browse for the firmware file and start the download
5) load the HW configuration and the user program

Or "What is the difference between 0-, $- and #-firmware versions?". PCD firmware for non-Saia PCD® COSinus Systems (PCD1, PCD2.M1x0, PCD4, PCD6 and PCS) are named with 3 letters (e.g. 010, B0W or #31). This FAQ explains the meaning of these version and how to figure out which one is more recent.

The firmware version naming of non-Saia PCD® COSinus systems
In general the 3 letters (abc) are used for the following indications:

• a
  Definition of the kind version this firmware is. The possible versions are the following
  - 0xx versions are "official production versions" (010 is the first official production version)
  - Bxx versions are Beta versions which contain new features compared to the previous production version
  - #xx versions are "customer bug fix versions" of an official production FW version.
  - $xx versions (Pilot version) include new functionalities which are not yet fully tested. Therefore a $-version should only be used in field if the developement gives their ok!
• b
  The second letter defines the main production version (starting with 01x wich stands for first official production version, followed by 02x (where the 02x has important new features compared to the 01x version
• c
  The last letter is incremented for each build of the firmware (best observed for the bug-fix versions; #21 is based on the 020 firmware and contains corrections for the 020 firmware version) 

To figure out which version the base version of a bug fix- or pilot version is, have a look at the second character of the corresponding version (e.g. the "1" of the 013). This character indicates the official production version on which the bug fix or pilot version is based on.

Examples
010    is the official production version
018    is the production bug fix version of 010; no new functions
#19    is a customer bug fix version based on 018 (and therefore also on 010); no new functions
$19    is a pilot version based on 010 with new functions. The bug fixes done for e.g. 019 probably aren't implemented in this version! (the new features will be added to the production firmware versions in 020 or later.

Remark
Early versions of the Saia PCD® COSinus systems (PCD2.M480, PCD3, PCD2.M5) up to 039 were named with this system as well. In order to reduce confusion concerning features of a firmware the new firmware naming a.bb.cc has been applied (see FAQ 100741).

Some history entries introduced in new firmware versions can't be found in the Online Debugger Help nor in the online help of the Online Configurator.

Below you can find recently introduced History entries that can't be found in the Help files of PG5 versions older than PG5 1.3:

Error Messages concerning PCD1.M2, PCD2.M480, PCD2.M5xx0 and PCD3.Mxxx0 systems (SBC-NT)