Applies To:
  • CitectSCADA 5.xx

How do I communicate to a Mauell ME30 system via the 3964R protocol? 

The ME30 system is an RTU system, you can use analog and digital modules to connect I/O. Mauell have a lot of applications in the electricity distribution, where you see a large network of remote stations.

Via a CNAS60 Module, you can connect a 3964R link. This is a point-to-point connection to the COM port of the computer. In Citect the SIEMENS protocol is used. For the 3964R the switch on the CNAS60 module has to be set to C.

The bus module CNBS70 determines the exact addressing of the I/O modules. The switch on CNBS70 was set to 20 (Hex). All I/O modules also have a switch with an address setting.

In my case I had a

CNBB18 (8 x Digital In, switchvalue: 1)

CNBB18 ( switchvalue: 2)

CNBR28 (8 x Relay Output, switchvalue: 3)

CNBR28 (switchvalue: 9)

CNBU14 (4 x Analog In, switchvalue: 5)

CNBU24 (4 x Analog Out, switchvalue: 6) module.

For all the digital module DB16 is used by default. The values of the IO modules are packed in bytes. ME30 system uses an inverted logic. The address of the data word is determined by two address switches; it is the sum of the address setting of the CNBS70 and the address setting of the specific IO module.


- CNBB18 (switch value: 1 + 20(from CNBS70) = 21 Hex (33 decimal)); So DB16, data word 33 is the right address.

- CNBB18 (switch value: 2 + 20 = 22 Hex (34 decimal)); So DB16, data word 34.

- CNBR28 (switch value: 3 + 20 = 23 Hex (35 decimal)); So DB16, data word 35.

- CNBR28 (switch value: 9 + 20 = 29 Hex (41 decimal)); So DB16, data word 41.

For analog modules by default DB17 is used. For each module 4 channels are available, the value of each channel is contained in one data word. The right address is the setting of the switches multiplied by 4.

- CNBU14 (switch value: 5 + 20 = 25 Hex (37 decimal)); So DB17, data words 37 x 4 = 148 the address of the first analog input. 149,150,151 contain the other values.

- CNBU24 (switch value: 6 + 20 = 26 Hex (38 decimal)); So DB16, data word 38 x 4 = 152 is start address. 153, 154, 155 are the addresses of the other channels.

The system time is stored in data block 48, datawords 8, 9, 10. First 8 bits (Hi) of DW 8 contain the year value, Last 8 bytes (Lo) contain the month value. First 5 bits (Hi) of DW 9 contain the day value, next 5 bits contain the hour value, last 6 bits (Lo) contain the minute value. First 6 bits of DW10 contain the seconds value, the last 10 bits contain the milliseconds value.


Year = (DB48:8 BITAND 65280)/256
Month = (DB48:8 BITAND 255)
Day = (DB48:9 BITAND 63488)/2048
Hour = (DB48:9 BITAND 1984)/64
Minute = (DB48:9 BITAND 63)
Second = (DB48:10 BITAND 64512)/1024
Millisecond  = (DB48:10 BITAND 1023)

 In Citect all datawords are defined as UINT. To get individual bits the first 8 bits (Hi) of the datawords are used, so for example DB16:33.8 to DB16:33.15 contain the input bits of the first digital module.

In Citect, a standard SIEMENS connection was configured via the Express Wizard, with the following settings:

Boards form:
Type: Comx
Ports form:
Baud Rate: 9600
Data Bits: 8
Stop Bits: 1
Parity: EVEN
I/O Devices form:
Address: 0
Protocol: SIEMENS

The parameter [SIEMENS]Status had to be set to 0.