Tag Name to ABB’s GUID Mapping Utility

I’ve recently came across the task that’s related to DCS (Distributed Control System). Specifically, the task is to develop a web application that directly perform access to DCS’s parameter values.

The existing DCS connects to the machine that still runs on Windows 2000 – until now :), and with the interface applications from ABB called the PPA System (Process Portal A).

There is already a standard interfaces that perform this kind of task called the OPC DA. So, after performing necessary studies of the related documents of the OPC DA, I am ready to create at first the prototype to test the possibility of accomplishing the given task.

This prototype is necessary it is to ascertain whether existing PPA in that machines supports OPC DA. If it isn’t then I can move on to another more promising tasks šŸ™‚

At first, I’ve successfully created a the tag name browser using IOPCBrowseServerAddressSpace interface. This is a standard OPC DA interface that’s should be supported by any DCS interface applications.

So far so good, I’ve now have the complete lists of the tag names of the existing system.

It is time to move on to the next step, i.e. to determine the properties of each of the tag name.

Again, I created another small application. This time, after creation’s of ABB’s DA Object, I will first utilize the IOPCItemProperties that supposed to get the all available properties of the given tag name.

This is done by calling the QueryInterface of the existing IOPCBrowseServerAddressSpace to get IOPCItemProperties and after that, calls the QueryAvailableProperties method to list out the available properties.

Later on this properties subsequently used to access the value of DCS parameters, or so I thought šŸ™‚

I was thinking of another steps of the task when activating the above application, and it returned error code 0x80004001, which means that this method is not implemented.

So, I perform QueryInterface using another object, but with the same result. It will successfully returns the object pointer, but when I try to call it’s QueryAvailableProperties method, it returns the above show stopper error. This continues on until I’ve exhausted all conceivable easier ways.

This is strange, I thought that every OPC DA compliance application should supports all the required interfaces in the OPC DA framework. So, I now have to realize that I have to perform a more difficult and time consuming endeavour regarding this task, i.e. life is never meant to be easier šŸ™‚

By performing more detailed runtime code checks using the windbg, I’ve known that the ABB PPA System’s implementation of OPC DA is accomplished using AfwDsOPCSurrogate.exe by utilizing Microsoft’s proxy stub mechanism.

And I’ve realized, why I exhausted all options, because, after stepping through the supposed QueryAvailableProperties method, the applications just happily returns 0x80004001 to my application. Just on line of moving 0x80004001 to eax register and execute ret opcode.

There must be some other methods to access the properties to get the value, precisely the ABB’s specific way.

After spending several days of poking around of existing PPA System, I’ve found that the properties for tag name of interest resides in the cache directory when I activates related windows called a “Faceplate” in PPA’s Workplace viewer.

This faceplate will creates the subscription file for a group of objects in the *.sub extention file. The object group is called an Aspect in ABB terminology.

The *.sub files contains all of the properties required to access each DCS value. This is arranged in the form of OLE Structured Storage, so it can be viewed using standard OLE document viewer, but each properties is arranged in the form of streams that has an internal format recognizes only by ABB’s PPA System.

Although each streams of unknown format, but each properties is in the form of clear wide char text which is fully readable by human šŸ™‚

By viewing this file, I can see that to access certain values of DCS System, I have to pass the Item Names in the form of [ItemName]:X:Y to AddItem Method of IOPCServer.

The [ItemName] is the Tag Name, and X and Y is the properties in question, for example T13UE059:Control Connection:Real_Res.

In ABB’s PPA System, the tag name is transformed to the GUID for example AD11B3EE-FE78-4E75-86AF-BFAA936A46B1.

Later on, this ID is used to construct the *.sub name in the form of _{AD11B3EE-FE78-4E75-86AF-BFAA936A46B1}.sub in ABB’s cache directory.

After this fact is known, one of the task is to perform the mapping of the tag name to the internal ID of ABB’s Object Structure. The idea is, after the ID is obtained, this can be used to search for existing *.sub file for this ID, and I can get the properties of interest in a couple of seconds.

By examining the mechanism of how ABB PPA System handles the AddItem method, I’ve found that the method to perform this task (i.e. of mapping the tag name to its ID) is inside GetStructureNodeArray method of AfwObjMgr.DLL. This methods is part of IAfwTranslate and has the functional prototype as below :

GetStructureNodeArray([in] long count, [in] BSTR* pQuerypaths, [out] HRESULT** pResults, [out] AfwStructureNode** pStructureNodes)

Two of the parameter of interest is pQuerypaths, this is the tag name to be mapped to ID and the output parameter is pStructureNodes in the form of GUID.

So, by passing for example the T13UE059, this method will returns for example AD11B3EE-FE78-4E75-86AF-BFAA936A46B1. This ID can be used as the name of *.sub file to find for properties of interest.

By utilizing this method, I can now create command line utility that accepts tag name as it’s parameter and returns the ID of tag names of interest. From this ID, I can now lookup into the generated *.sub file to find the property of interest to get DCS parameter values.

Here is the screen-shot of the utility in action :


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: