Siemens Guarto 3000 Alarm System

This function block integrates a Siemens Guarto 3000 intrusion alarm panel. The states of the areas (sections) and inputs are displayed, and areas can be armed and disarmed.

Requirement: The SSH access data of the panel (IP address, user and private key as a .pem file) — provided by the installer or Siemens. The controller sets up the connection itself; for this, PHP must be installed on the controller (if missing, the block reports an error on the output and in the log).

Setup — step by step:

Insert the block and open its properties.
Enter the alarm panel IP address and SSH user and load the private key from the .pem file via Load SSH key....
Set the main/middle groups as well as Number of areas and Number of inputs to match the panel.
Use Generate addresses to create the group addresses for the state and name of all areas/inputs as well as the command addresses for arming/disarming.
Link the controls and buttons to the generated addresses.

Arm/disarm: A write telegram with value 1 to the command address of an area arms it (state 5), value 0 disarms it (state 1).

Important — disarming belongs at the panel: Disarming via the visualisation or the APP is not recommended. An intrusion alarm system should only ever be disarmed at the panel itself — at the keypad, with a key switch or a code. Otherwise anyone with access to the APP can lift the intrusion protection; a lost or unlocked mobile device is then enough. Depending on the insurance policy and local regulations, operating it this way may also not be permitted.

It is therefore recommended to use the command addresses for display only, and at most for arming. The safest approach is to withdraw the right to disarm from the panel's SSH account in its user profile — the panel then rejects the command itself, regardless of what the visualisation is configured to do.

The connection is monitored continuously. If communication stops working, the block automatically tries to restart the gateway and records this in the log. The Status output shows the connection state, the error counter counts faults.

Note: The block writes states and names to the configured group addresses; these must exist in the project. The sub group corresponds to the area or input number of the panel. If Number of areas or Number of inputs is set lower than the panel actually has, the addresses of the remaining areas and detectors are missing and their states are lost. The block reports this in the log.

Outputs
ST	Status	0 = no connection to the panel, 1 = connected (states are being received).
ER	Error counter	Counts up on faults (panel unreachable, no response, rejected command) and is kept across a re-initialisation. Returns to 0 once the panel responds — but no earlier than one minute after the last fault. Without this hold time a rejected command would not be visible: the very reply that reports the fault would clear the counter again at the same moment. The reason for the rejection is given in the log.
Parameters
	Alarm panel IP address	IP address of the Guarto panel on the network.
	SSH user	User name for the panel's SSH access (from the installer / Siemens).
	SSH key (PEM)	Private SSH key of the panel. Load it from the .pem file via the Load SSH key... button (not .ppk — convert first if needed).
	Main group	Main group of the generated group addresses.
	Middle group area command	Middle group of the arm/disarm addresses per area. Writing to it switches the area.
	Middle group area state	Middle group for the state per area (1 = disarmed, 5 = armed).
	Middle group area name	Middle group for the name per area (text).
	Middle group input state	Middle group for the state per input (0 = closed, 1 = open/alarm).
	Middle group input name	Middle group for the name per input (text).
	Number of areas	Number of areas for which addresses are created by Generate addresses.
	Number of inputs	Number of inputs for which addresses are created by Generate addresses.
	Resync interval	Interval at which all states are fully re-synchronised as a safeguard (in addition to the continuous updates). 0 = off. Default 10 minutes. Only what has actually changed is written, so the resynchronisation does not load the bus even with a large number of detectors.
	Map detectors via ID	Off (default): The sub group of the address is the running number of the detector in the panel — exactly as the addresses are generated. On: The address is instead looked up via the ID number that the panel provides in field 3 of the detector list (for example 3054-1). For this it has to be the first word in the comment of the corresponding state address; the rest of the comment is free, usually for the plain text name: 3054-1 Kitchen window east. The purpose: the running number shifts as soon as a detector is added or deleted at the panel — after that, every address behind it points at the wrong detector. The ID number stays fixed. If it is in the comments, the assignment stays correct even after such a change. Please note: the comments are then no longer just labels but are evaluated — they must not be edited freely any more. If the block cannot find the ID number of a detector in any comment, that detector's state is discarded and reported in the log — on every sync for every affected detector separately, so that the missing comments are listed completely (at most 200 lines per sync), and on every automatic message of the panel that is lost because of it. The messages view shows this every time; the controller's log file receives each detector only once, so that an overlooked fault does not churn the file for months. It deliberately does not fall back to the running number, as that would be another detector's address. If no comment contains an ID number at all, all states are discarded — the block reports this on every sync and does not list the detectors individually, as all of them are missing. It does not fall back to the running number in this case either: a silent fallback would make an unfinished setup look like a finished one, and nobody would notice that the mapping is not running. The automatic messages of the panel contain only the running number, not the ID number. They are therefore mapped via the most recently read detector list and are only evaluated once that list has arrived completely. A message that arrives before the list is discarded and reported as well.
	Debug	Additional diagnostic output (lines sent and received) in the error log; in addition, the controller writes a continuous log of the connection. For commissioning and troubleshooting only, and must be switched off again afterwards — left on permanently, Debug wears the controller's storage medium for no benefit. Toggling it re-establishes the connection to the panel.

Commands sent to the panel
The block controls the panel through its SSH interface. It sends these commands on its own, they do not have to be configured — the list is provided for understanding and troubleshooting (with Debug switched on, the lines sent and received appear in the log).
au -tA1	Automatic messages	With this, the panel reports every change of state on its own; changes therefore appear at the addresses without delay. Sent when the connection is established and repeated every five minutes. Repeating is necessary because the panel loses this setting on a restart — without it, changes would only arrive with the resync interval.
al	Read areas	Reads the number, name and state of all areas. Sent after every connection setup, at the resync interval and immediately after every switching command. If the panel does not reply yet after the connection has been set up — its login can take more than a minute on a large system — the query is repeated for up to ten minutes.
il	Read inputs	Reads the number, name and state of all inputs (detectors). Sent after every connection setup and at the resync interval; if no reply arrives it is likewise repeated for up to ten minutes — regardless of whether the area list has already been received.
sa -a<no> -s<state>	Switch area	Arms (<state> = 5) or disarms (<state> = 1) area <no>. Triggered by a write telegram to the command address of the area; the sub group of the address is the area number. It is immediately followed by al so that the state is updated even if no automatic message arrives.
gi systemversion	Keep-alive	Sent once a minute. The reply proves that the panel can be reached and is responding. If several replies fail to arrive, the block reports "no response from alarm" in the log, sets the Status output to 0 and re-establishes the connection.
The panel acknowledges every command; a negative acknowledgement increments the error counter and its wording is written to the log. The log also shows when the panel rejects a command because the SSH account lacks the required right. State messages and the replies to al/il are written by the block directly to the state and name addresses of the areas and inputs. Alarm and warning messages of the panel are not evaluated.

See also the general parameters of all function blocks.

Siemens Guarto 3000 Alarm System

Outputs

Parameters

Commands sent to the panel