Promotic
WikipediaLinkedInYoutubeTwitterFacebook

PmS7 - Driver for communication by S7-TCP/IP protocol

The "S7-TCP/IP" protocol is also known as "RFC1006" or "ISO on top of TCP". The PLCs usually communicate by this protocol via PROFINET connector (connector for Ethernet network).

This protocol can be used, for example, for communication with following devices:

- Siemens Simatic:
- S7-200 via the CP243-Ethernet module
- S7-300 via the CP343-Ethernet module, with the NETLink PRO ETH converter, or via processor with Ethernet interface
- S7-400 via the CP443-Ethernet module, with the NETLink PRO ETH converter, or via processor with Ethernet interface
- S7-1200 (Ethernet interface is integrated)
- S7-1500 (Ethernet interface is integrated)

Caution: For correct setup of Simatic devices see Important settings of Simatic PLC communication by the TIA portal software.

- ET-200S, ET-200SP (CPU1512) (Ethernet interface is integrated)
- IPC + WinAC (software PLC)
- Frequency inverters (Sinamics, Micromaster).
- VIPA (control system 300S, SLIO, ...)
- Pilz PSS (www.pilz.com)
 
Before using this driver in the PROMOTIC application it is highly recommended to read the chapter: Communicaton using the PROMOTIC drivers.
 
Basic properties of the driver:
- Using this driver is bound to purchase the license: PmS7. With the freeware version PmFree, or when developing the application (with development environment for tersting purposes), this component is always functional.
- The communication is done via Ethernet. A standard Ethernet card is sufficient for communication. If the NETLink PRO ETH converter is used it is also possible to communicate via the interfaces MPI, PROFIBUS or PPI.
- The driver requires no special libraries or hardware.
- The PROMOTIC application is the MASTER (i.e. it initiates the data transfer) from this communication point of view.
- The driver optimalizes the physical transfers of data messages with the PLC. Single message can be used for transfering values from different data areas (data blocks, inputs, outputs,...) and therefore the communication is still fast enough even if large data volumes are transfered. This way it is possible to refresh the data in the Ethernet network, for example 15x per second.
- The driver is incorporated into the PROMOTIC system by means of the PmComm object.

Driver supports to usage of PmCommData object. The PmCommMsg object cannot be used.

For easy integration of this driver into the application it is handy to use: Preconfigurations in group "S7 protocol"

 
The following Data areas are supported:
- I = Input: Digitál inputs. Bit values (X typ), that are read only.

These values can be accessed also as 1-byte (8 bits, B type), 2-byte (16 bits, W typ) or 4-byte (32 bits, DINT type). Then each bit can be accessed by the Var.Bit property or by the Pm.GetBit / SetBit methods.

- Q = Output: Digitál outputs. Bit values (X typ), that are available for both read and write.

These values can be accessed also as 1-byte (8 bits, B type), 2-byte (16 bits, W typ) or 4-byte (32 bits, DINT type). Then each bit can be accessed by the Var.Bit property or by the Pm.GetBit / SetBit methods.

- M = Memory, Marker, Flag: Memory that is available for both read and write. Compared to data blocks, this memory is not persistent, i.e. it is cleared after the PLC is switched off.

The values in this memory can be accessed by using all supported data types (X, W, INT, STRING ...).

- DB = Data Block: Persistent memory that is available for both read and write.

The values in this memory can be accessed by using all supported data types (X, W, INT, STRING ...).

- T = Timer: Timers (for read only). The values can be read as data types S5T(=default), Wbcd and W.
- C = Counter: Counters (for read only). The values can be read as data types Wbcd(=default) and W.
 
Following S7 data types are supported:
- X: Bit, Boolean - Bit defined by bit address and bit number. In the PROMOTIC application represented by the data type: Boolean.
- B: Unsigned Byte - 1-byte integer (from 0 to 255). In the PROMOTIC application represented by the data type: Byte.
- W: Unsigned Word - 2-byte integer (from 0 to +65 535). In the PROMOTIC application represented by the data type: Long.
- INT: Signed Word - 2-byte integer (from -32 768 to +32 767). In the PROMOTIC application represented by the data type: Integer.
- D: Unsigned Double Word - 4-byte integer (from 0 to +4 294 967 295). Because the VBScript language does not have the wholenumber data type for unsigned 4-byte value, the PROMOTIC system stores the value as Double data type.
- DINT: Signed Double Word - 4-byte integer (from -2 147 483 648 to +2 147 483 647). In the PROMOTIC application represented by the data type: Long.
- Bbcd: Unsigned Byte in BCD code - 1-byte integer. In the PLC is stored in BDC coding (from 0 to 99). In the PROMOTIC application represented by the data type: Byte.
- Wbcd: Unsigned Word in BCD code - 2-byte integer. In the PLC is stored in BDC coding (from 0 to 9999). In the PROMOTIC application represented by the data type: Integer.
- Dbcd: Unsigned Word in BCD code - 4-byte integer. In the PLC is stored in BDC coding (from 0 to 99999999). In the PROMOTIC application represented by the data type: Long.
- REAL: Real number, 4B IEEE - 4-byte real number formated as IEEE-754 (32-bit). In the PROMOTIC application represented by the data type: Single.
- LREAL: Long Real number, 8B IEEE - 8-byte real number formated as IEEE-754 (64-bit). This type is used, for example, by the Simatic S7-1200. This type is not supported by okder PLCs. In the PROMOTIC application represented by the data type: Double.
- CHAR: Signed Byte, Raw string - The character sequence with defined number of characters (1 character = 1 Byte). In the PLC, this data type is stored without the text lenght information. If the text written to the PLC is shorter than defined number of characters, then the empty characters are appended by zeros. In the PROMOTIC application represented by the data type: String.
- STRING: S7 string - Text with defined number of characters (1 character = 1 Byte). This type is stored in the PLC together with a header that contains the value of text lenght. If the text written to the PLC is shorter than defined number of characters, then the empty characters are appended by zeros. In the PROMOTIC application represented by the data type: String.
- DTL: Date and Time, 12B Bin format - Date and time. It is stored binary in the PLC to 12B. This type is supported, for example, by Simatic S7-1200. It is not supported by older PLCs. In the PROMOTIC application represented by the data type: Date.
- DT: Date and Time, 8B BCD format - Date and time. It is stored in BDC code in the PLC to 12B. It is supported by older PLCs. In the PROMOTIC application represented by the data type: Date.
- S5T: S5TIME, Time Duration - Time or duration. It is stored in BDC code in the PLC to 4B. It is supported by older PLCs. It is usually used in memory of the "Timer" type. In the PROMOTIC application represented by the data type: Long = number of milliseconds.
 
Note1: The TIME data type is in fact the number of milliseconds and the value can be read as DINT data type. Therefore the TIME type itself is not supported by the driver.
Note2: If the value of the date/time is stored as Date data type, then the values of year/month/day/hour/minute/second can be obtained, for example, by the VBScript methods Year/Month/Day/Hour/Minute/Second. See also VBScript date and time functions and Pm date and time methods.
 

Recommended parameters values:

Recommended values for the Ethernet parameters:
TCP/UDP port number Number of ethernet port. This number is defined by the selection of S7 communication type:
102 - The communication is direct with the PLC supporting the S7 protocol (with Ethernet interface).
7777 - The communication is indirect via the NETLink PRO ETH converter.
Ethernet transfer typeTCP
Number of repeats after unsuccessful transmissionIf the opposite side does not respond, then the driver closes the port and starts reconnection. Therefore it is recommended to set this configurator to "no reconnection", i.e.. the value of 0.
Timeout of one packet transfer [ms]If "Communication type = Ethernet ISOonTCP Standard" it is necessary to set 4000 ms. Otherwise 2000 ms is sufficient.
Close connection after every transferNOT checked (mandatory). After each connection with the PLC, it is necessary to transfer several initialization messages and if the connection is closed repeatedly, the communication speed would be decreased significantly.
Description and recommended values for the Protocol parameters:
Communication typeSpecifies the communication type with the device.
Ethernet ISOonTCP Standard - (for S7-300/400/1200..) - The communication will be executed with device that supports Ethernet communication with the S7 protocol (supports PROFINET).
Ethernet ISOonTCP for CP243 - (for S7-200) - The communication will be executed with Simatic S7-200 via the CP243-Ethernet module.
Ethernet NETLink PRO ETH - (Helmholz, Softing, Accon) - The communication will be executed with NETLink PRO ETH converter.
Max. PDU lengthHere, it is possible to define the maximum lenght transmitted in a single communication message. Standard values are 240, 480 or 960. Commonly the maximum is set, i.e. 960. While communcation is being initialized, the driver detects the message lenght supported by the PLC and if the supported lenght is smaller then the value is lowered automaticaly.

In reality the PLC sometimes sends smaller ammount of data (e.g. only 240) although during initialization it was detected that the maximum data ammount is higher (e.g. 480). The result is that after data receive in the PmCommData only some of the variables are filles with data. The rest of the varibles are not communicated. Then it is necessary to modify the lenght from 960 to 240.

Rack(0-7) Defines the rack number where the CPU for communication is located. The default value is 0.

Defined only if Communication type = "Ethernet ISOonTCP Standard"

CPU Slot(0-31) Defines the slot number where the CPU for communication is located. (Caution: it is NOT the slot of the communication card!)
- Very often the value is 2.
- For built-in Ethernet interface (e.g. S7-1200, CPU1512SP ..) the value is 1.

Example: The slo no. 1 is usually populated by the power source and if the source is bigger (e.g. for S7-400), then more slots can be taken. If the power source populates the slots no. 1 and 2 and slot no.3 is taken, for example, by the fan (or the slot is empty), then the CPU is in slot no. 4. This configurator will then hold the value of 4.

Defined only if Communication type = "Ethernet ISOonTCP Standard"

Local TSAP(hex) Defines the hexadecimal address of LocalTSAP. The default value is 4d57 ('MW').

Defined only if Communication type = "Ethernet ISOonTCP for CP243"

Remote TSAP(hex) Defines the hexadecimal address of RemoteTSAP. The default value is 4d57.

Defined only if Communication type = "Ethernet ISOonTCP for CP243"

MPI/DP address(0-31) Defines the MPI or DP-PROFIBUS address of the CPU for communication. The default MPI value is 2.

Defined only if Communication type = "Ethernet NETLink PRO ETH".

Connection typeConnection type. In the network configuration, it is possible to set the maximum number of connections for corresponding type.

Defined only if Communication type = "Ethernet ISOonTCP Standard" or "Ethernet NETLink PRO ETH".

1 = PG-connection - Programming device
2 = OP-connection - Operator panel
3 = OTHER-connection - Other type

The communication description by the PmCommData objects

The PmCommData objects can be used for this driver.

The variables in the PmCommData object (or even better the variables in the PmData object with ExtComm data extension) can be of arbitrary number, type and order. The driver uses optimalised internal communication messages for reading the data from the device.

All variables are read (if the Data refresh enabled configurator is enabled). When writing to the variable, only the single value is sent (if the Auto write when writing to item configurator is enabled).

 
Description of the ItemID configurator:

ItemId is the text identifier of the item that is used for addressing the value in the device. The ItemID configurator tells the driver how to receive or send the item value. The text can be written manually, or it can be assembled in the window opened by the button to the right of the configurator. Macro expression can be used for input (it is evaluated while the application is launching).

Examples of identifier syntax:

- "I0.2" = Value saved in I=Input on the address 0 in the second bit as X=bit=default data type.
- "Q0.2" = Value saved in Q=Output on the address 0 in the second bit as X=bit=default data type.
- "QB0" = Value saved in Q=Output on the address 0 as B=Byte=8 bits data type.
- "MREAL30" = Value saved in M=Memory on address 30 as REAL=4-byte real number data type.
- "DB10.W83" = Value saved in DB=DataBlock no.10 on address 83 as W=Unsigned Word data type.
- "DB3.Wbcd83" = Value saved in DB=DataBlock no.3 on address 83 as Wbcd=Unsigned Word in BCD code data type.
- "DB24.CHAR0.12" = Value saved in DB=DataBlock no. 24 from address 0 (on address 0,1,..11) as 12 items of the CHAR type that are stored in the PROMOTIC system as a single String.
- "DB25.STRING0.12" = Value saved in DB=DataBlock no. 25 from address 0 as S7 STRING data type that is stored in the PROMOTIC system as a single String.
- "T15" = Value saved in T=Timer on address 15 as S5T data type that is stored in the PROMOTIC system as Date value type.
- "TWbcd15" = Value saved in T=Timer on address 15 as Wbcd=Unsigned Word in BCD code data type.
- "C20" = Value saved in C=Counter on address 20 as Wbcd=Unsigned Word in BCD code data type.
- "CW20" = Value saved in C=Counter on address 20 as W=Unsigned Word data type.
 
Note: The driver so far does not support transfers of vector of values in a single variable with one ItemId (except for CHAR type vectors).
 
Description of the PmCommData > Parameters > Special Parameters configurator:
This configurator is not used for given driver.

Communication with the NETLink PRO ETH converter

The NETLink PRO ETH converter converts Ethernet S7 protocol to MPI, PROFIBUS or PPI physical interface. If the converter is connected to the MPI/PROFIBUS network, then multiple CPUs can be connected to this network for communication (each CPU will have different MPI/DP address). Each PmComm object communiactes with a single CPU. It is possible to have multiple PmComm objects connected to the same IP address of the converter but with different "MPI/DP address" value.

 
The NETLink PRO ETH converter is supplied for example by:
- The Helmholz company (www.helmholz.cz, www.helmholz.com). Some hardware components by this company are used also by other companies for manufacturing their converters (see further).

If the configurator "Go online after boot" is set via the Web interface, then the converter owrks as transparent and in the PmS7 driver you can set "Communication type = Ethernet ISOonTCP Standard".

- Softing company (www.softing.com). These converters use the hardware by Helmholz company.
- Deltalogic company (www.deltalogic.de, typ ACCON). These converters use the hardware by Helmholz company.
- Other converters (e.g. IBH NETLink, NETLink Kepware ...). It has not been tested whether these converters work with the PmS7 driver.

Important settings of Simatic PLC communication by the TIA portal software

The versions of Simatic-1200 and -1500 since 2014 require programming in TIA portal 13 or higher.

Caution: In 2015 for new versions of PLCs (e.g. Simatic S7/1200 V.4.1.1 - 4.1.3) it is necessary to upgrade TIA portal 13 SP1 to Update 5 (9/2015).

 
In this software, some configurators are set by default in order to prevent external SCADA systems (including PROMOTIC system) to communicate with such PLCs.

In TIA portal it is therefore necessary to modify following settings:

 
1) Protection:

Select the "CPU project" on the left side and press Alt+Enter keys or in the contextual menu select "Properties". In the "Protection" section, select "Full access" and check "Permit access with PUT/GET communication from remote partner".

 
2) DB optimized:

Select the "DB" on the left side under "Program blocks" and press Alt+Enter keys or in the contextual menu select "Properties". Uncheck "Optimized block access" (it is checked by default).


© MICROSYS, spol. s r. o.Tavičská 845/21 703 00 Ostrava-Vítkovice