SINUMERIK. SINUMERIK 840Di sl/840d sl/ 840Di/840D, SIMATIC S7-300/S7-400 eps Network Services. Preface. Introduction 1. Check lists for quick start 2

Transcription

1 Preface Introduction 1 SINUMERIK SINUMERIK 840Di sl/840d sl/ 840Di/840D, SIMATIC S7-300/S7-400 Configuration Manual Check lists for quick start 2 Setting up a PLC-aided test series 3 Interface signals 4 Proxy Server 5 Data concept 6 Alarms on the HMI 7 Appendix A Valid for: Version /2008

2 Legal information Warning notice system This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are graded according to the degree of danger. DANGER indicates that death or severe personal injury will result if proper precautions are not taken. WARNING indicates that death or severe personal injury may result if proper precautions are not taken. CAUTION with a safety alert symbol, indicates that minor personal injury can result if proper precautions are not taken. CAUTION without a safety alert symbol, indicates that property damage can result if proper precautions are not taken. NOTICE indicates that an unintended result or situation can occur if the corresponding information is not taken into account. If more than one degree of danger is present, the warning notice representing the highest degree of danger will be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to property damage. Qualified Personnel The device/system may only be set up and used in conjunction with this documentation. Commissioning and operation of a device/system may only be performed by qualified personnel. Within the context of the safety notes in this documentation qualified persons are defined as persons who are authorized to commission, ground and label devices, systems and circuits in accordance with established safety practices and standards. Proper use of Siemens products Note the following: WARNING Siemens products may only be used for the applications described in the catalog and in the relevant technical documentation. If products and components from other manufacturers are used, these must be recommended or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and maintenance are required to ensure that the products operate safely and without any problems. The permissible ambient conditions must be adhered to. The information in the relevant documentation must be observed. Trademarks All names identified by are registered trademarks of the Siemens AG. The remaining trademarks in this publication may be trademarks whose use by third parties for their own purposes could violate the rights of the owner. Disclaimer of Liability We have reviewed the contents of this publication to ensure consistency with the hardware and software described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the information in this publication is reviewed regularly and any necessary corrections are included in subsequent editions. Siemens AG Industry Sector Postfach NÜRNBERG GERMANY P 01/2009 Copyright Siemens AG Technical data subject to change

3 Preface SINUMERIK documentation The SINUMERIK documentation is organized in three parts: General documentation User documentation Manufacturer/service documentation An overview of publications, which is updated on a monthly basis and provides information about the language versions available, can be found on the Internet at: ( Follow the menu items "Support" "Technical Documentation" "Ordering Documentation" "Printed Documentation". The Internet version of DOConCD (DOConWEB) is available at: ( Information about training courses and FAQs (Frequently Asked Questions) can be found at the following website: ( at menu item "Support" Target group Readership of this publication are planning and application engineers. The Configuration Manual enables the target group to apply the rules and guidelines to be observed when configuring products and systems. It helps you select products and functions. Benefits The Configuration Manual helps the target group to create a system or plant configuration. Utilization phase: Planning and configuration phase Standard version This documentation only describes the functionality of the standard version. Extensions or changes made by the machine manufacturer are documented by the machine manufacturer. Other functions not described in this documentation might be executable in the control. However, no claim can be made regarding the availability of these functions when the equipment is first supplied or in the event of servicing. Configuration Manual, 12/2008 3

4 Preface Further, for the sake of simplicity, this documentation does not contain all detailed information about all types of the product and cannot cover every conceivable case of installation, operation or maintenance. Questions about this documentation If you have any queries (suggestions, corrections) in relation to this documentation, please send a fax or to the following address: Fax docu.motioncontrol@siemens.com (mailto:docu.motioncontrol@siemens.com) A fax form is available at the end of this document. Service & Support If you have any technical questions, please contact our hotline: Europe / Africa Phone Fax Internet ( America Phone Fax techsupport.sea@siemens.com (mailto:techsupport.sea@siemens.com) Asia / Pacific Phone Fax techsupport.asia@siemens.com (mailto:techsupport.asia@siemens.com) Note National telephone numbers for technical support are provided under the following Internet address: ( Calls are subject to charge, e.g /min. from a German landline. Tariffs of other phone providers may differ. 4 Configuration Manual, 12/2008

5 Preface SINUMERIK Internet address ( EC Declaration of Conformity The EC Declaration of Conformity for the EMC Directive can be found on the Internet at: ( under the Product Order No , or at the relevant branch office of I DT MC Division of Siemens AG. CompactFlash cards for users: The SINUMERIK CNC supports the file systems FAT16 and FAT32 for CompactFlash cards. You may need to format the memory card if you want to use a memory card from another device or if you want to ensure the compatibility of the memory card with the SINUMERIK. However, formatting the memory card will permanently delete all data on it. Do not remove the memory card while it is being accessed. This can lead to damage of the memory card and the SINUMERIK as well as the data on the memory card. If you cannot use a memory card with the SINUMERIK, it is probably because the memory card is not formatted for the control system (e.g. Ext3 Linux file system), the memory card file system is faulty or it is the wrong type of memory card. Insert the memory card carefully with the correct orientation into the memory card slot (take note of arrows, etc.). This way you avoid mechanical damage to the memory card or the device. Only use memory cards that have been approved by Siemens for use with SINUMERIK. Even though the SINUMERIK keeps to the general industry standards for memory cards, it is possible that memory cards from some manufacturers will not function perfectly in this device or are not completely compatible with it (you can obtain information on compatibility from the memory card manufacturer or supplier). The CompactFlash card from SanDisk "CompactFlash 5000 Industrial Grade" has been approved for SINUMERIK (Order Number 6FC5313-5AG00-0AA0). Configuration Manual, 12/2008 5

6 Preface 6 Configuration Manual, 12/2008

7 Table of contents Preface Introduction System requirements Check lists for quick start Steps for installing SINUMERIK PLCs Sequence of a basic configuration Setting machine data Setting up a PLC-aided test series Configuring test series Automatic test series Interface signals Signal profile for normal operations Signal flow for alternative sequences Signal flow in error case Additional information Interface signals Proxy Server How does a Proxy Server work? Roles of a Proxy Server Setting up SSL connections Handshake protocol with SSL Proxy Access control options Controlling access by means of user authentication Data concept Implementation of data transmission Data security Installation on the server Alarms on the HMI A Appendix A.1 Feedback on the documentation...57 Index Configuration Manual, 12/2008 7

8 Table of contents 8 Configuration Manual, 12/2008

9 Introduction 1 Overview This document provides support to users who are installing and configuring the eps Client software and preparing a machine or plant for operation with. Platform and communication Figure 1-1 Communication Communication with the eps Server is always initiated by the eps Client (machine control panel, or service PC). This mechanism is similar to the one deployed for standard Web applications: 1. Entering the Internet address. 2. The Internet server returns the requested contents to the screen. Configuration Manual, 12/2008 9

10 Introduction 1.1 System requirements Safety 100% compatible with IT security processes: Firewall Proxy Server Virus detection Server-Client architecture: CNC and PC are clients. Communication is always initiated at the client. No variable access to other servers or Internet addresses. Identification: Server certificates Client certificates Encryption: 128-bit SSL encryption Firewall: Uses port 443. CNC Internet browser: No "surfing" possible Static server address Note IP addresses or hardware-dependent characteristics such as MAC addresses are not used to identify the nodes. The certification keys for are exchanged during the initial logon process. This certification enables the definite identification of the control panel as communication partner. Encryption by means of the MAC address of the PCU 50 network adapters is available for the eps Client powerline V04.03 or higher. NOTICE eps Client powerline V04.03 A copy of the certificate is included during the transfer of a PCU 50 Ghost to a different PCU 50. The effect is that two operating panels respond with the same key. In this scenario, the latter operating panel is active and the other is disabled in a static operation. The data packets transferred are discarded if the server outputs a new request. See also Additional information in Chapter Data concept (Page 45) 10 Configuration Manual, 12/2008

11 Introduction 1.1 System requirements 1.1 System requirements PLCs supported: Control Software version PCU 50/70 with software version SINUMERIK 810D from NCK Version from HMI-Advanced V 6.0 SINUMERIK 840D from NCK Version from HMI-Advanced V 6.0 SINUMERIK 840Di from system from HMI-Advanced V 6.0 SIMATIC S7-300 no restriction from HMI-Advanced V 6.0 SIMATIC S7-400 no restriction from HMI-Advanced V 6.0 Industrial PC Operator panel / service PC: Operator Panel Service PC Type PCU or industrial PC PC AT Processor from 166 MHz from 166 MHz Hard disk memory Min. 25 MB Min. 10 MB RAM Min. 128 MB Min. 32 MB Pointing device No Yes Monitor resolution min. 640*480 min. 1024*768 Internet access Dial-in only via router or dedicated line with a minimum data rate of 64 kbps Dial-in or dedicated line with a minimum data rate of 64 kbps Operating system: Operator panel Service PC Windows NT4 with Service Pack 6 Windows 2000 Windows XP Browser component: Operator panel Service PC From Internet Explorer ActiveX activated JavaScript activated Cookies Internet Explorer Configuration Manual, 12/

12 Introduction 1.1 System requirements 12 Configuration Manual, 12/2008

13 Check lists for quick start Steps for installing SINUMERIK PLCs General conditions SINUMERIK 840D/840D sl Current versions of : eps Client powerline V (Build V ) PLC project : V03.00 eps Server V eps installation setup files (the eps Client software is available at esupport.) PC/programming device with SIMATIC STEP 7 Current PLC project of the target machine Overview of the architecture of the LAN/Internet connection (e.g. router, LAN, etc.) IP address: Subnet: Gateway: DNS Adr.1: DNS Adr.2: Domain: Domain Suffix1: Domain Suffix2: Domain Suffix3: WinS 1: WinS 2 : Proxy address: Proxy port: Proxy script: Note eps Client installation The eps Client can also be installed by means of "Silent Installation". A "log file" for logging all requests is generated at the start of the operation. The setup/update runs automatically without user input in accordance with specifications in the "log file". Example: Creating the log file: Input: setup /a /r /f1"d:\setup.iss" Initiation of the "Silent Installation" by means of: Input: setup /s /f1"d:\setup.iss" Configuration Manual, 12/

14 Check lists for quick start 2.1 Steps for installing SINUMERIK PLCs Steps for installation (for a detailed description, refer to: Installation instructions) Restarting the PCU and selecting the service mode Transferring the eps installation files to PCU 50/70 or updating the files (target folder: F:\ePS_Network_Install) Note: The eps Client software can be obtained from esupport. Configuring Internet access General settings are made in: "Start" "Settings" "Control Panel" "Network" "Start" "Settings" "Control Panel" "Internet Options" "Connections" "LAN Settings" "Start" "Settings" "Control Panel" "Internet Options" "Security" "Internet" "Custom Level" "Download signed ActiveX controls" = ENABLE Testing Internet connection At the DOS command line input using the "ping command: ping <Input> key or: ping <Input> key (without name resolution) Installing on the PCU Run SETUP.EXE from the folder F:\ePS_Network_Install. Note: If Internet Explorer with version < 5.5 is installed on the PCU you must update this component. You must restart the PCU after having installed the update. Re-select the service mode after the restart. Setup of eps is resumed automatically. Optional: Conclusive test of the Internet settings Start Internet Explorer and open the following page: ( 14 Configuration Manual, 12/2008

15 Check lists for quick start 2.1 Steps for installing SINUMERIK PLCs Concluding the installation Restart PCU 50/70 for normal operation. Set the machine data for the "Universal axis test and NC monitor". Integrate the STEP 7 PLC monitor blocks in the program of the target machine. Integrate the STEP 7 PLC monitor blocks of : To enable the use of the "PLC Trigger/Trace" function within the PLC monitors, the blocks included in the package must be implemented in the machine PLC. The blocks are supplied in a PLC library. Those components include an FC191 function block and the three data blocks DB239, DB240 and DB250 The maximum number of addressable variables (bit memories, times,...) can be set up in DB239. Installation: Copy the blocks to the project. Configure the function in the cyclic block. Transfer the blocks to the S7 CPU. Configuration: The data blocks used must be configured in the eps PC application. See also Chapter: Proxy Server (Page 35) Configuration Manual, 12/

16 Check lists for quick start 2.2 Sequence of a basic configuration 2.2 Sequence of a basic configuration Requirements for the basic configuration has been successfully installed on the PCU. The Internet connection is available. Your log-on data for (user name, password, organization): You obtain this data from your organization (eps administrator) The target machine is created in the database. The data such as the machine number/id can be obtained from your organization (eps administrator) Operator input sequence (for a detailed description, refer to: Function manual) Start Operator actions on the PCU (using the softkeys): "eps Network" "Online Services" Log on with your user ID You might have to change your password when logging on for the first time. Register the machine Operator actions: "Management" "Connect machines and upload the alarm model" "Register the machine initially" "Connect" Confirm the next operating steps. Optional: complete "machine information" Operator actions: "Home" "Administration" "Master data" "Change entry" Upload the alarm model Operator actions: "Home" "Administration" "Register the machine and upload the alarm model" "Upload the alarm model" Synchronization setup/test: Operator actions: "Home" "Administration" "Set up functions" "Synchronize" Setting-up a data archive for the NCK and PLC Set-up the first NCK archive as complete data set from MD11210: $MN_UPLOAD_MD_CHANGES_ONLY 0Hex, original value again after setup Operator actions: "Home" "Maintenance services" "Data services" "Create" Log out Operator actions: "Log out" Completion The machine synchronizes with the eps server and can now be used for eps Network Services. See also Chapter: Alarms on the HMI (Page 51) 16 Configuration Manual, 12/2008

17 Check lists for quick start 2.3 Setting machine data 2.3 Setting machine data Dependencies Machine data category "Universal axis test" relates to the function of SinuComNC Trace Server; meaning that there is a dependency on the HMI version and the NCU software version. If one of the conditions is not met, or the Trace Server is not used for other reasons, the machine data for the universal axis test do not have to be set, with the exception of MD19330 for SINUMERIK powerline. The machine data category "NC Monitor" only depends on the NCU software version and not on the HMI version, i.e. the function can also be used for older HMI versions. NOTICE Machine data: A change to machine data (MDx8xxx) triggers re-organization of the memory. The "Manufacturer" password must be entered in order to edit machine data. After editing the data: Create an NC archive Trigger an NCK reset (Safety Integrated). Restore NCK archive from the backup file. Machine data for universal axis test (HMI Advanced ) General MD: MD no. Name Old New Remarks PL SL PL(ST) PROTOC_FILE_MEM[5] 1 Data buffer in DRAM X X MM_PROTOC_NUM_FILES[5] 2 X MM_PROTOC_NUM_ETPD_STD_LIST[5] 25 X MM_PROTOC_NUM_SERVO_DATA[5] 10 X Option: IPO_FUNCTION_MASK Bit 3 = 1 (add 8Hex) X X Channel MD: MD No. Name Old New Remarks PL SL PL(ST) MM_PROTOC_USER_ACTIVE[5] 1 X MM_PROTOC_NUM_ETP_STD_TYP[5] 20 X Axis MD: MD No. Name Old New Remarks PL SL PL(ST) DRIVE_SIGNAL_TRACKING 1 Each axis and spindle X X Configuration Manual, 12/

18 Check lists for quick start 2.3 Setting machine data Machine data for variable monitor (NC axes) General MD: MD No. Name Old New Remarks PL SL PL(ST) MM_MAINTENANCE_MON 1 X X X SYSTEM_FUNCTION_MASK Bit 6 = 1 (add 40Hex) X X Axis MD: MD No. Name Old New Remarks PL SL PL(ST) MAINTENANCE_DATA 7 Each axis and spindle X X X Machine data according to the control model: PL(ST) = PL = SL = SINUMERIK powerline System NCU 840D/810D/840Di Data logging with Servo Trace SINUMERIK powerline System with NCU 840D/810D/840Di Data logging with Trace Server SINUMERIK solution line System with NCU 710, 720, 730, 740, 840Di sl Data logging with Trace Server or Servo Trace Dependency on the NCU software version: PL = Universal axis test: NCU with Trace Server or: NCU xx with Servo Trace NC Monitor: NCU SL = Universal axis test: NCU HF3 (NCK 67.03) NC Monitor: NCU HF3 (NCK 67.03) Note Machine data As of eps Server V4.4 all axis test types can be executed with Servo Trace. You only have to adapt MD19330 in the "Universal axis test" area accordingly. The additional machine data listed in the "Universal axis test" are valid if the measured values are logged by means of Trace Server (standard as of HMI xx saved to the MMC2 folder). The machine data and included in the eps package represent expansion levels which are subject to SINUMERIK license agreements. In SINUMERIK solution line NCU software V2.4 HF3 or higher this data is managed by the system (NCK 67.03), i.e. the options (MDx9xxx), including MD19330 do not have to be activated. 18 Configuration Manual, 12/2008

19 Check lists for quick start 2.3 Setting machine data Optional setting Data storage in SRAM or DRAM You can configure either SRAM or DRAM as the storage location for the log files (Protoc) of SinuComNC Trace Server. The default setting for the machine data for SinuCom NC Trace Server defines SRAM as buffer for Trace data that has been acquired. However, this data can also be saved to DRAM of the NCU. You must accordingly define the maximum size of the data buffer as machine parameter (cannot be set up on solution line systems). MD no. Name Old New Remarks PROTOC_FILE_MEM[5] 0 1 0=Protoc in SRAM 1=Protoc in DRAM MM_DRAM_FILE_MEM_SIZE add KB additionally reserved for Protoc Note The setting in $MN_MM_DRAM_FILE_MEM_SIZE is not available for the solution line system. The logs for solution line systems are always saved to DRAM. Handshake between the PLC and eps Condition Monitor axis test: The PLC user program of the machine can lock execution of external program elements. Interface signals are provided to enable the function. NOTICE In PLC Toolbox V7.2 or higher those bits are reset automatically to "0" in the PLC program. If you are using a Toolbox of a lower version number you must program this initialization in the startup OB. You should also clear the bits with a RESET if necessary. See also Chapter 3 for more information Important Internet addresses: Service PC ( Installation on the PCU: ( ( Meaning PC Service Technician Start Page HMI start page HMI data communication Configuration Manual, 12/

20 Check lists for quick start 2.3 Setting machine data Service PC Additional addresses: ( ( Meaning Check the Internet settings Check transmission quality 20 Configuration Manual, 12/2008

21 Setting up a PLC-aided test series Configuring test series General conditions The presence of an operator on the machine should not be required explicitly to run a test series. It must be possible to control the test series remotely at the eps System. The PLC should only be able to initiate a test series if requested by the eps System. Instead of the PLC, the configuration saved to the eps System determines the test series to be executed. The PLC only performs test series which do not include any unverified measuring series. Any failure of the execution of a test series which was requested by the PLC is logged to the eps System. You can react to errors generated within an automatic test series by means of control monitors. Configuration Maintenance schedules: The test series for the measurements should be configured on the PLC by means of maintenance jobs. Cyclic measurements can be configured using maintenance schedules. In combination with control monitors, a maintenance job and its associated test series can be generated based on a specific event (interval trigger). Enabling of the maintenance job for the test series by the PLC: Operators configuring the maintenance schedule must enable automatic execution of the linked test series. Maintenance jobs that are not enabled for automatic execution can only be initiated in manual mode. Maintenance jobs in which a test series is enabled for automatic execution can also be initiated in manual mode. Configuration Manual, 12/

22 Setting up a PLC-aided test series 3.2 Automatic test series 3.2 Automatic test series Enabling the sequence An eps background job is activated as soon as a maintenance job with a linked test series is pending execution. The test series may not contain any unverified measuring series. If several maintenance jobs with test series are pending, the chronologically oldest job pending is executed. The eps System notifies the PLC of a test series pending execution and requests the corresponding enable. The PLC is also informed as to whether the test series is to be controlled only by the PLC, or whether it is to be carried out in manual mode. A control monitor can be used to ensure that maintenance jobs do not remain unprocessed for any greater amount of time. Communication between the PLC user program and the eps System is handled by means of commands and status signals in a data block of the basic program. The signal profiles of the log are specified in detail. PLC task Within an automatic sequence the PLC must set a machine and/or the control state that allows execution of the test series. You can accordingly run any NC program on the configured NC channel. The PLC sets the NC channels to the RESET state and the feed function enable, the axis enable, the AUTOMATIC mode, and feed override=100%. The PLC also has to execute other machine-specific settings as required. Preparing the control The header and trailer program can also be used in automatic test series to move the axes to a safe home position and to set NC functions. There are no differences compared to the execution of axis tests in manual mode. Additional requirements: Execution at weekly intervals In the configuration of the maintenance schedule you can set up the generation of maintenance jobs within fixed intervals, i.e. weekly, or of several weeks. The next job is not generated unless the active job has been closed. Configurable due time You can define the due time of a maintenance job in the configuration of the maintenance schedule. Explicit configuration of the automatic execution of a linked test series Operators can explicitly configure automatic execution of the test series when linking it to a maintenance schedule. The PLC only automatically executes test series that are linked to a maintenance schedule by means of this option. 22 Configuration Manual, 12/2008

23 Interface signals Signal profile for normal operations Overview The signals generated at the interface of the basic program of the PLC are used to coordinate functions the eps System executes with control sequences. The PLC can use those signals to control execution of the eps System functions. Example: Running a test series with PLC control The time profile of signals in a normal sequence and in error situations is illustrated on the basis of a test series with PLC control. Within an automatic sequence the PLC must set a machine or control state that allows execution of the test series. It must be possible accordingly to download NC programs to the control and to run any NC program on the configured NC channel. The PLC must set the NC channels to the RESET state, set the feed enable, the axis enable, the "Automatic" mode, and feed override = 100%. The PLC also has to execute other machine-specific settings as required. Normal sequence The system detects a test series that is pending automatic execution. The system coordinates this test series with the PLC by means of the log described below: Step Sequence DB10.DBX91.0 = 1: "Execution of axis test is interlocked" DB10.DBX90.2 = 1: "Automatic request of the test series" This signal is only valid if DB10.DBX90.0 = 1. After DB10.DBX90.0 is set, DB10.DBX90.2 is not changed until DB10.DBX90.0 has been cleared. The PLC sets the control to the required state: "Automatic" mode NC channels in the Reset state Axis enable is set 4 5 Feed enable is set Feed override 100% DB10.DBX91.0 = 0: "Execution of axis test has been enabled" The eps System loads the NC programs, selects the NC program, prepares the recording, etc. DB10.DBX90.1 =1: "Request program start" The PLC ensures that the NC program is started (either by the PLC itself generating a cycle start, or by displaying a screen on the HMI that requests the operator to take an action). Configuration Manual, 12/

24 Interface signals 4.1 Signal profile for normal operations Step Sequence DB10.DBX90.1 =0: "Program start identified" The eps System detects the started state of the test program. All phases of the test series are executed in succession without any further program start. DB10.DBX90.0 =0: "Test series completed" DB10.DBX90.2 = 0 DB10.DBX91.0 = 1: "Execution of axis test is interlocked" The PLC resumes its program, or enables execution of a further test series (restart at step 1). Note The step numbers correspond to the numbers contained in the following signal flow charts. Figure 4-1 Normal signal flow Result On successful completion of the the test series, the system sets the maintenance job to which the test series is linked to the state "Closed, OK". 24 Configuration Manual, 12/2008

25 Interface signals 4.2 Signal flow for alternative sequences 4.2 Signal flow for alternative sequences Cancelation by NC RESET The normal sequence is canceled if the eps System detects that the active NC program running the measurements was cancelled by means of NC RESET. The signals below are changed at the PLC interface in the given order: DB10.DBX90.3 = 1 (error in sequence) DB10.DBX90.0 = 0 (end of sequence) DB10.DBX90.3 = 0 (error signal is reset) In this situation it cannot be ensured that the trailer of the performance test is executed. We distinguish between two scenarios: 1. If the program is cancelled after the eps System has acknowledged its start by clearing the start request (step 6 of the normal sequence), the maintenance job is set to the "Closed, error" state. 2. If the NC program is cancelled before the eps System has acknowledged its start by clearing the start request (step 6 of the normal sequence), the PLC has to cancel the performance tests as specified in "Cancelled by the PLC". In this situation the maintenance job retains the "open" state. Configuration Manual, 12/

26 Interface signals 4.2 Signal flow for alternative sequences Scenarios 1 with cancelation by means of NC RESET 1 eps detects the cancelation by Reset Figure 4-2 NC (scenario 1): Signal flow 26 Configuration Manual, 12/2008

27 Interface signals 4.2 Signal flow for alternative sequences Scenario 2 with cancelation by means of NC RESET 1 NC start before eps has acknowledged the start. 2 Cancelation of the sequence by the PLC 3 Test series canceled, or trailer completed Figure 4-3 NC (scenario 2): Signal flow Cancelation by the PLC The PLC can cancel execution of the performance test at any time by interlocking the test execution (step 8 of the normal sequence). The eps System responds to this request to cancel by: Setting the error signal at the PLC interface Clearing the start request Canceling the active motion at the end of measurement, and then executing the trailer Clearing the request of test execution after execution of the trailer. Configuration Manual, 12/

28 Interface signals 4.2 Signal flow for alternative sequences We distinguish between two scenarios: 1. If the program is cancelled after the eps System has acknowledged its start by clearing the start request (step 6 of the normal sequence), the maintenance job is set to the "Closed, error" state. 2. If the NC program is cancelled before the eps System has acknowledged its start by clearing the start request (step 6 of the normal sequence), the PLC has to cancel the performance tests as specified in "Cancelled by the PLC". In this situation the maintenance job retains the "open" state. Scenario 1 with cancelation by the PLC 1 Request of test execution 2 Enable test execution 3 Cancel test execution 4 Trailer completed Figure 4-4 PLC (scenario 1): Signal flow 28 Configuration Manual, 12/2008

29 Interface signals 4.2 Signal flow for alternative sequences Scenario 2 with cancelation by the PLC Figure 4-5 Request of test execution Enable test execution Cancel test execution Trailer completed PLC (scenario 2): Signal flow Cancelled by the operator on the machine If the operator presses a key on the user interface of the eps System to cancel a sequence, the eps System responds similar to the cancelation of a sequence by the PLC. Configuration Manual, 12/

30 Interface signals 4.3 Signal flow in error case 4.3 Signal flow in error case The control is in an unsuitable state after having been enabled for an axis test The normal sequence was executed up to step 3. The system detects that the control is not in the required state. This state is identified by: Automatic mode NC channels in the Reset state Axis enable is set Feed enable is set Feed override 100% The system cancels the sequence. The signals below are changed at the PLC interface in the given order: DB10.DBX90.3 = 1 (error in sequence) DB10.DBX90.0 = 0 (end of sequence) DB10.DBX90.3 = 0 (error signal is reset) The maintenance job remains in the open state. Control alarms The eps System detects control alarms that prevent a measurement from being resumed (e.g., NC alarm with axis at zero speed). The relevant measurement is cancelled and the failure is entered in the test series log. The eps system cancels the test series. The signals below are changed at the PLC interface in the given order: DB10.DBX90.3 = 1 (error in sequence, V4.5 and higher) DB10.DBX90.0 = 0 (end of sequence) DB10.DBX90.3 = 0 (error signal is reset) The maintenance job goes into the "Closed, error" state. Error message of the eps System Error events that occur during the test series and that do not inhibit continuation of the test series are saved to the test series log. The test series continues as in manual mode. The maintenance job is set to the "Closed, error" state in this case. The first error detected within the sequence of a test series is reported with DB10.DBX90.3 = 1 at the PLC interface. The error signal is not cleared unless DB10.DBX90.0 = 0 was set to report completion of the test series. Execution is not interlocked at the start of the normal sequence The test execution interlock must be set at the start of the normal sequence if the test series is executed with PLC control. 30 Configuration Manual, 12/2008

31 Interface signals 4.3 Signal flow in error case The normal sequence is not started if the test execution interlock is not set by the PLC at the start of a normal sequence, i.e., DB10.DBX91.0 == 0. The normal sequence starts as soon as the PLC sets the interlock (i.e., DB10.DBX91.0 = 1). The NC program is not started after a start request The eps system has executed step 4 within the normal sequence and has set the start request (DB10.DBX90.1 =1). The eps system cancels the sequence if the program fails to start within a configured time (approx. 1 minute). In this case, the signals below are changed at the PLC interface in the order given: DB10.DBX90.3 = 1 (error in sequence) DB10.DBX90.1 = 0 (start request cleared) DB10.DBX90.0 = 0 (end of sequence) DB10.DBX90.3 = 0 (error signal is reset) The maintenance job remains in the open state NC start request Sequence canceled due to timeout Test series canceled Figure 4-6 Signal flow in error case Configuration Manual, 12/

32 Interface signals 4.4 Additional information 4.4 Additional information Overview Additional interface signals: Signal for Condition Monitoring test in the channel In addition to the DB10.DBX90.0 signal ("Request execution axis test"), a signal in DB21 to DB30 displays the NC channel involved in test execution. This signal is set if the signal DB10.DBX90.0 ("Request execution axis test") is set. It is not changed as long as DB10.DBX90.0 is set. The signal flow of the normal sequence is also valid for test series executed in manual mode If a test series is executed in manual mode the signals at the PLC interface are handled or interpreted similar to automatic mode. The only exception is the signal that indicates automatic execution (DB10.DBX90.2). On completion of the sequence a minimum time must expire before the next sequence is requested After the eps System has reported completion of the sequence by clearing the request signal (DB10.DBX90.0 =0), the request for the next sequence (DB10.DBX90.0 =1) must be delayed by a latency time which is sufficient for the PLC to detect the clearance of the request signal. This latency time has minimum duration of one second. Maximum interval between the end of the program and clearance of the request signal The interval between the end of NC program execution of the test series and clearance of the request signal (DB10.DBX90.0 = 0) must not exceed a duration of 5 minutes. The PLC might interpret any longer duration as an error state of the eps System and can then force cancelation by clearing the enable signal (DB10.DBX91.0 = 1). Maximum interval between the enable signal and the start request The interval between the triggering of the enable signal at the PLC (DB10.DBX91.0 = 0) and the start request signal at the eps System (DB10.DBX90.1 = 1) must not exceed five minutes. The PLC might interpret any longer duration as an error state of the eps System and can then force cancelation by clearing the enable signal (DB10.DBX91.0 = 1). Loading startup archives The eps System sets DB10.DBX90.7 = 1 to indicates that a startup archive is to be loaded to the control. The PLC can interlock startup archive loading by setting DB10.DBX91.7 = 1. Loading does not start until DB10.DBX91.7 = 0 is set. On completion of loading the eps System sets DB10.DBX90.7 = Configuration Manual, 12/2008

33 Interface signals 4.5 Interface signals 4.5 Interface signals Interface signals PLC eps Client DB10.DBB90 Signals from the eps Client PLC as of version Bit0 = 0 Bit0 = 1 Bit1 = 0 Bit1 = 1 Bit2 = 0 Bit2 = 1 Bit3 = 0 Bit3 = 1 Bit4 Bit5 Bit6 Bit7 = 0 Bit7 = 1 Condition Monitoring test completed / no active request for a Condition Monitoring test. Condition Monitoring test busy / request for Condition Monitoring test is pending. No NC start request / NC start was detected. NC start request pending / NC start not yet detected. Bit1 is only valid if Bit0 = 1 Condition Monitoring test is executed in manual mode. Condition Monitoring test is executed in automatic mode. Bit2 is only valid if Bit0 = 1 Error during execution of the Condition Monitoring test No error during execution of the Condition Monitoring test. Error during execution of the Condition Monitoring test. Bit3 is only valid if Bit0 = 1 Reserved Reserved Reserved Request to load startup archive: No request to load startup archive. Request to enable startup archive loading is pending. V3 V4.3 V4.3 V4.5 V3 DB21... DB30.DBB24 Bit0 = 0 Bit0 = 1 Signals from the eps Client PLC Request Condition Monitoring test: Condition Monitoring is not executed in the channel. Condition Monitoring is executed in the channel. as of version V3 Configuration Manual, 12/

34 Interface signals 4.5 Interface signals Interface signals from PLC eps: DB10.DBB91 Signals from the PLC eps Client as of version Bit0 = 0 Bit0 = 1 Bit1 Bit2 Bit3 Bit4 Bit5 Bit6 Bit7 = 0 Bit7 = 1 Enable Condition Monitoring test eps is allowed to run the Condition Monitoring test. eps is not allowed to run the Condition Monitoring test. Reserved Reserved Reserved Reserved Reserved Reserved Enable startup archive loading: Startup archive loading is enabled. Startup archive loading is disabled. V3 V3 34 Configuration Manual, 12/2008

35 Proxy Server How does a Proxy Server work? Principle of the WWW A Web Server runs a specific program that provides information in a platform-independent format to users of the WWW and supports users with comfortable bookmarks for browsing additional sources of information. Starting at the beginning of the nineties, the rather simple principle of the WWW has propagated the rapid expansion of the pool of available Web Servers from only a few to more than 160 million sites. This development was accompanied by a constantly rising number of users on the WWW. Band width requirements on the Internet developed at the same rate and it was not possible to provide comprehensive coverage at all locations. Corresponding techniques were therefore developed with the aim on reducing the rate of persistent Internet access. Definition of a proxy The English term "Proxy" denotes a representative or proxy agent. That is, the primary objective of the Proxy Server as representative of a client is to transmit requests to a Web Server and to receive and transfer their response to the client station. The client is disconnected completely from the Web Server in this process, i.e. clients query the proxy and are returned a response from this proxy, the proxy transmits the request to the Web Server and receives the response from this Web Server. Configuration Manual, 12/

36 Proxy Server 5.2 Roles of a Proxy Server 5.2 Roles of a Proxy Server Security Instead of directly transmitting requests on the Internet, clients transmit these via the Proxy Server in order to minimize the risk of malicious attacks. Such attacks would be focused primarily on the Proxy Server without direct effect on the client. Communication control It is not necessary for all clients to know the sources of information and the rules governing their acquisition. In many situations it is easier to save and maintain such sources at a central location. Access control In certain situations client access should be controlled in accordance with specific rules. Certain clients should only be allowed access to specific Web sites. Authentication might be required for a specific access. Access can also be controlled on a time basis. Caching Web sites: Caching Proxy Server After having received a response frame from a Web Server, the Proxy Server transfers this information to the required client and saves the data to its cache. The Proxy Server is now able to return those objects from its internal cache at the next client request, without having to acquire this data once again from the Web Server. Implementation of a Caching Proxy Server usually leads to significantly reduced response times for the clients. Reduction of the data traffic between the Proxy and the Web Servers can also return added values. Implementation of Caching Proxy Servers can compensate for poor availability of Web Servers or for insecure connections and increase the availability of relevant contents. The Web sites of usually provide scripts with dynamic control of contents and should not be saved to cache. The "Last Modified", "Expire" and "Cache Control" header data are not used for precisely this reason. Domain of Caching Proxy Servers Operation of larger networks requires implementation of several Caching Proxy Servers, either to cope with numerous requirements, or to ensure the adequate distribution of load within the network. Best practice in this context is to interconnect several Caching Proxy Servers based on specific rules, instead of interconnecting the Proxy Servers at random. To respond to a client request, the Caching Proxy Server in a domain must resolve the following tasks if it has not saved the relevant object to cache: Which one of the Proxy Server contains the object Which one of the Proxy Servers can provide the object with the least delay (if several instances of the object are available) Which one of the Proxy Servers requires the least time to acquire the object (if this is not available on any one of the Proxy Servers). Logging Web access is frequently logged for the purpose of accounting, supervision, or statistics. 36 Configuration Manual, 12/2008

37 Proxy Server 5.3 Setting up SSL connections 5.3 Setting up SSL connections Overview The performance both of "normal" Proxy Servers and of SSL Proxy Servers is appropriate to cope with the primary tasks of a Proxy Server. That means, a generally valid recommendation for integration of a specific type of Proxy Server cannot be made. Within the framework of their IT policy, certain companies define the integration of functionality for scanning all Internet data streams for virus attacks, or for an extended logging of contents. Such requirements can only be met by implementing SSL Proxy Servers. Protocols To understand the function principle of SSL Proxy Servers it is necessary to know certain details concerning the structure of SSL connections. If you already have knowledge of SSL connections, continue at Chapter Handshake protocol with SSL Proxy (Page 39). SSL (Secure Socket Layer) is a cryptographic protocol which offers functionality for encryption, authentication and integrity monitoring. SSL is split up into five protocol elements: Handshake protocol ChangeCipherSpec protocol Alert protocol ApplicationData protocol SSL Record protocol Handshake protocol The Handshake protocol is used to authenticate communication partners (clients and servers), to agree on the cryptographic method and to exchange the symmetrical key. Phases of a typical handshake protocol: 1. The client transmits a message frame to the server. The message frame contains the request for an SSL connection. Moreover, the client informs the server of the cryptographic methods it supports (at least one method for symmetrical encryption, for the hash function and for key exchange). 2. The server returns a response frame to inform the client of the selected cryptographic method. The response frame also contains a digital certificate of the server. 3. The client now validates the certificate; in IE 6.0, for example, only the following characteristics are verified: Query 1: Does the certificate originate from a trustworthy certification institution? Query 2: Is the date of the certificate valid? Query 3: Does the security certificate specify a valid name that corresponds with the name of the Website? Configuration Manual, 12/

38 Proxy Server 5.3 Setting up SSL connections 4. The client now transmits its own certificate plus a session key which is encrypted with the public key of the server. After those conditions were met, the client and server share a secret key which is used in the SSL Record protocol for encryption and integrity checks with key-dependent hash function. NOTICE Communication setup As you can see, all https connections are initiated by means of non-encrypted communication. Other protocols We'll briefly mention the other protocols in the section below for the sake of completeness: The ChangeSipherSpec protocol reports the method agreed in the handshake protocol to the Record layer and is then only used to report any changes to this method. The Alert protocol transmits error messages and warnings and is triggered for unscheduled data exchange. The ApplicationData protocol transfers data received from the application to the SSL Record protocol. 38 Configuration Manual, 12/2008

39 Proxy Server 5.4 Handshake protocol with SSL Proxy 5.4 Handshake protocol with SSL Proxy Data packets A normal Proxy (not an SSL Proxy) receiving a client request for an SSL connection cannot intervene in the encrypted https connection after successful agreement on the handshake method. The only choice it has is the transparent transfer of the encrypted data packets between the client and server. A normal Proxy can neither scan the content of such data packets, nor save them to cache. However, it still represents a link for communication between the client and server. Such a proxy is not exactly an intelligent link as it always causes unnecessary communication delay. Nonetheless, the proxy still handles the security task. Overview An SSL Proxy receiving a client request for an SSL connection intervenes in communication within the handshake phase. Of the two-digit numbers used in the table below, the first digit identifies the step number, while the second one identifies the SSL connections (Example of Step 3.2: step 3, SSL connection 2): Step Description 1.1 SSL connection 1: The client transmits a message frame to an external server. The message frame contains the request for an SSL connection. Moreover, the client informs the external server of the cryptographic methods it supports (at least one method for symmetrical encryption, for the hash function and for key exchange). Special features with SSL Proxy Server The SSL Proxy now intercepts the client request and assumes the role of an active gateway for this bilateral SSL communication: SSL connection 1: Between the client and the SSL Proxy SSL connection 2: Between the SSL Proxy and the external server There is no direct SSL connection between the client and the external server. The clients now waits for a response (see Step 3). 1.2 SSL connection 2: Instead of transferring the client request to the external server, the SSL Proxy replaces this request with its own. 2.2 SSL connection 2: The external server now returns a response frame to the SSL Proxy, but not to the client. The selected cryptographic method is reported as expected in this frame. The response frame also contains a digital certificate of the external server. 3.2 Special features of the SSL Proxy Server The SSL Proxy now validates the certificate. This operation can be far more comprehensive and secure compared to the validation in Internet Explorer. After successful validation, the SSL Proxy now processes the client request defined in item SSL connection 2: The SSL Proxy now transmits its own certificate to the external server, including a session key which is encrypted with the public key of the Web Server. After those conditions were met, the SSL Proxy and the external Web Server share a secret key which is used in the SSL Record protocol for encryption and integrity checks with keydependent hash function. Configuration Manual, 12/