7TS7TCP. IGSS Siemens S7 TCP/IP Interface Driver. User s Manual

Transcription

1 7TS7TCP IGSS Siemens S7 TCP/IP Interface Driver User s Manual IGSS SCADA Software * Schneider Electric Denmark A/S * Lautrupvang 1 * DK-2750 Ballerup * Denmark Phone: * DK-IGSS-support@schneider-electric.com *

2 DISCLAIMER The information contained in this user s manual is the property of Schneider Electric Denmark A/S. All rights reserved. No part may be reproduced or used except as authorised by contract or other written permission. The copyright and the foregoing restriction on reproduction and use extend to all media in which the information may be embodied. Any information provided in this document is subject to change and is provided for information purposes only, and is supplied without liability for errors or omissions. Due to the changing nature of the information contained in this document Schneider Electric shall have no liability whatsoever for any damages or losses arising directly or indirectly as a result of any of the information in this document not being accurate, complete or up to date. Schneider Electric Denmark A/S

3 Contents 1 INTRODUCTION Software Requirements Hardware Requirements INSTALLATION Automatic Installation Manual Installation CONFIGURING THE DRIVER EVENT DRIVEN COMMUNICATION MULTI READ FUNCTION FAST ACTIVATION CONFIGURING THE OBJECTS Supported Memory Types PERFORMANCE AND THROUGHPUT ERROR CODES SET UP PLC TO COMMUNICATE WITH IGSS (SIEMENS S & 1500 PLCS) Schneider Electric Denmark A/S

4 1 INTRODUCTION This document describes how to set up and troubleshoot the IGSS 7TS7TCP Interface Driver. 1.1 SOFTWARE REQUIREMENTS The driver requires a standard Microsoft TCP/IP protocol stack. This protocol stack is normally installed on all Microsoft systems and can be used as is. DNS and other helper protocols are not used by the driver and thus not required to be installed nor configured. The driver uses ISO transport on top of TCP/IP as defined by RFC. This means that TCP/IP port number 102 MUST be available and open for use. If you use any kind of Fire-Wall products then please make sure that TCP/IP port 102 is open for bidirectional use. If the network paths from the IGSS system to the PLC(s) include multiple Fire-Walls then these must be configured correctly as well. The driver is designed to be used with IGSS version 13.0 and higher. 1.2 HARDWARE REQUIREMENTS The driver requires a standard Ethernet NIC in the PC where the IGSS system is installed. The NIC must have a Microsoft approved NIC driver with an active TCP/IP stack. Schneider Electric Denmark A/S

5 2 INSTALLATION 2.1 AUTOMATIC INSTALLATION The driver is normally installed automatically along with the rest of the IGSS system. To verify if the driver has been installed, open the System Configuration (sysconfig.exe) and check if a driver with ID:67 is present in the list of available drivers: If the driver is present then you can proceed to the next section: Configuring the Driver, otherwise install the driver using the manual installation procedure described below. 2.2 MANUAL INSTALLATION Using the following step-by-step guide will install the driver manually on a PC where the IGSS system has already been installed. You need to stop the IGSS system prior to the installation and you need to be logged in with a user account with Administrator rights. Schneider Electric Denmark A/S

6 Step 1: Verify that the files: 7TS7TCP.DLL 7TS7TCPc.DLL 7TS7TCP.REG exists in the GSS\ directory. If the files doesn t exists run the IGSSUpdateClient to get the files from the IGSS Update server or contact IGSS Support (DK-IGSS-support@schneider-electric.com) to get the files via . Step 2: Double-click on the 7TS7TCP.REG file to import the registry settings needed for the system to recognize the driver. The driver is now installed. Schneider Electric Denmark A/S

7 3 CONFIGURING THE DRIVER This section describes how to configure the driver parameters. All parameters must be configured by using the System Configuration (sysconfig.exe) application. Please note that the IGSS system MUST be stopped and restarted for the configured parameters to take effect. Start the System Configuration application and add the driver 7TS7TCP (ID:72) to the requested station. Once the driver has been added to the relevant station then you are ready to proceed with adding PLC nodes. This is done by right-clicking on the driver and select New Node menu point. Schneider Electric Denmark A/S

8 Each PLC node requires following fundamental parameters: IGSS node number: This is the node number which IGSS uses to reference a unique PLC. This node number is required when binding and IGSS atom (tag) to a register in the PLC. Any number from the drop down list can be used. Processor type: This is for select of PLC type. IP address for PLC node: Here you must enter the IP address of the PLC node. The PLC programmer will be able to provide you with this number. The format must be in dotted decimal and the IP address must be reachable from the PC either through a gateway or directly on the subnet. IP port for PLC node: The port number of the PLC, standard is 102. Schneider Electric Denmark A/S

9 CPU rack number in PLC: Here you must fill in the rack number where the CPU is physically located. This will normally be rack 0 when using a single PLC. Using the PLC S7-400H 2 different rack numbers have to be selected, normally rack 0 and rack 1 for the CPU1 and CPU2. CPU slot number in PLC: Here you must fill in the slot number where the CPU is physically located in the PLC rack. This will normally be either slot number 2 or slot number 3 but is may vary depending on the PLC type and/or the power supply used in the rack. The PLC programmer will be able to give you information about which slot number is used for the CPU. Communication Timeout: Normally, you don t need to change this parameter. The default value of 1000 ms will be OK on most networks; However, if you are going to use the driver to communicate through the internet and/or through a complex network, you might want to increase this parameter in order to avoid undesired alarms from the communication monitor. If CPU stopped: The CPU variables can be read when the CPU is stopped and not giving any errors on IGSS objects. To avoid this, set checkbox and all messages from PLC will have error indication CPU stopped when CPU is switched to from run to stop mode. Schneider Electric Denmark A/S

10 Use optimized bit read: To avoid a lot of reading of bits in the PLC it is possible to read the whole word of the bits (bits have to be in the same data group and word offset) in the PLC and then split the bits in the driver before they are send to IGSS bit objects. To activate this function set checkbox. Telegram retries: If an error in the communication occurs the message can be retransmitted a number of times before an error response with error code is returned to IGSS. Processor max segment length: Each PLC can have its own specific max. segment length. Notice that the processor s max. segment length cannot be longer than the segment length defined under the tab Advanced for the Siemens S7 TCP/IP protocol driver. The processor s max. segment length can be used if you have new and old types of Siemens PLCs connected to IGSS with the old PLCs having max. up to 32 bytes per message, and new PLCs more than 200 bytes. Please note that it is EXTREMELY important that the IP address, the IP port, the CPU rack number and the CPU slot number parameters are configured correctly. If any of these parameters are not correct communication cannot be established. If the PLC and the PC are connected to the network, and are up running, the IP address can be verified by using the ping command. E.g. ping Please note that some Fire-Walls don t allow ping request/responses. In this case ping can t be used to verify the IP address. The CPU slot number parameter can t be verified easily. It is therefore important to be absolutely sure that this parameter is set correctly, otherwise communication can t be established. When a PLC node has been added, you can add another by clicking the New Node menu point again. The driver supports up to 16 PLC nodes. 3.1 EVENT DRIVEN COMMUNICATION Under the button Advanced Connection Properties you can set checkbox Use event driven communication messages to activate reception of spontaneous event messages from the PLC. This can be done simultaneously running scan of inputs from the PLC. Schneider Electric Denmark A/S

11 3.2 MULTI READ FUNCTION Under the button Advanced connection properties you can under the Multi read specification activate the packing of more scan records into one message that will be sent to the PLC. The response message from the PLC will contain data for the scan records in the message to the PLC. Schneider Electric Denmark A/S

12 If desired, you can pack the multi read message further by selecting the checkbox Use merge scans if possible. Then all messages having the same data group and following each other by offset and length will be packed together as one object in the message. This can be relevant if you are using a short segment length in order to get a better pack functionality. The scan records will then be calculated to follow each other. If you are using a PLC with different max. response length you can change this in Max response length of message. The same function is available for Max. number of objects in message. You can define how long time a read value from the PLC should be valid to avoid that old values are accepted be IGSS. If the defined time has passed, a new read in the PLC will be performed by the driver. To show the scan array containing the amount of the different lengths of the scan records, select the checkbox Dump multi read data in Driverlog. will pack the scan records as they occur in scan record table. If you only select Use multi read, the driver Explanation of Dump multi read data in the Driverlog (see screen dump below): len cnt cx Length of every scan record in the projects file nnn.prt. Amount of scan records with the same length. Count of number of scan records Schneider Electric Denmark A/S

13 cxt Rcvbytes total rcvbytes parts Sum of all the lengths of the scan records. The last cxt gives the optimal number of received bytes from the PLC. Sum of received bytes in actual multi read scan record Sum of rcvbytes for each multi read scan record Part length in bytes of each scan record in the scan message to the PLC. Data transfer from this PLC requires that part lengths consist of even numbers only, if possible of even length. Part lengths are therefore adjusted by adding typically 4 bytes to even numbers and 1 extra byte to uneven numbers. The last total rcvbytes gives the actual number of received bytes from the PLC. Example of Driverlog using multi read function and not sort of scan record table having Level 1 and Level 2 equal to /10/05 11:49:18: node:200 scaninterval:5000 MaxRspLen:466 MaxObjects:19 Level1:-1 Level2:-1 Merge:0 2017/10/05 11:49:18: node:200 scanarr[0] len:56 cnt:1 cx:1 cxt: /10/05 11:49:18: node:200 scanarr[1] len:52 cnt:2 cx:3 cxt: /10/05 11:49:18: node:200 scanarr[2] len:48 cnt:4 cx:7 cxt: /10/05 11:49:18: node:200 scanarr[3] len:44 cnt:1 cx:8 cxt: /10/05 11:49:18: node:200 scanarr[4] len:40 cnt:1 cx:9 cxt: /10/05 11:49:18: node:200 scanarr[5] len:24 cnt:10 cx:19 cxt: /10/05 11:49:18: node:200 scanarr[6] len:22 cnt:1 cx:20 cxt: /10/05 11:49:18: node:200 scanarr[7] len:20 cnt:13 cx:33 cxt: /10/05 11:49:18: node:200 scanarr[8] len:16 cnt:4 cx:37 cxt: /10/05 11:49:18: node:200 scanarr[9] len:8 cnt:3 cx:40 cxt: /10/05 11:49:18: node:200 scanarr[10] len:4 cnt:2 cx:42 cxt: /10/05 11:49:18: node:200 scanarr[11] len:2 cnt:2 cx:44 cxt: /10/05 11:49:18: node:200 scanarr[12] len:1 cnt:1 cx:45 cxt: /10/05 11:49:18: multiread:1 db: woff:9248 rcvbytes:420 total rcvbytes:420 parts /10/05 11:49:18: multiread:2 db:1946 woff:101 rcvbytes:452 total rcvbytes:872 parts /10/05 11:49:18: multiread:3 db:1925 woff:398 rcvbytes:420 total rcvbytes:1292 parts The scan records array can be sorted using a value different from -1 in position Level 1 for each scan interval. This can be done to reach the nearest value of the max. response length of the message, which is given by the type of PLC. Schneider Electric Denmark A/S

14 The position Level 1 indicates where to start making the multi read message to be sent to the PLC. If a value in the scan array is used in position Level 1, sorting will start picking up scan records from that position until cnt in scan array is 0 and then continue to the end of the scan array. Example of Driverlog using multi read function and sort of scan record table using position Level 1 set to 8. Schneider Electric Denmark A/S

15 2017/10/05 12:02:01: node:200 scaninterval:5000 MaxRspLen:466 MaxObjects:19 Level1:8 Level2:-1 Merge:0 2017/10/05 12:02:01: node:200 scanarr[0] len:56 cnt:1 cx:1 cxt: /10/05 12:02:01: node:200 scanarr[1] len:52 cnt:2 cx:3 cxt: /10/05 12:02:01: node:200 scanarr[2] len:48 cnt:4 cx:7 cxt: /10/05 12:02:01: node:200 scanarr[3] len:44 cnt:1 cx:8 cxt: /10/05 12:02:01: node:200 scanarr[4] len:40 cnt:1 cx:9 cxt: /10/05 12:02:01: node:200 scanarr[5] len:24 cnt:10 cx:19 cxt: /10/05 12:02:01: node:200 scanarr[6] len:22 cnt:1 cx:20 cxt: /10/05 12:02:01: node:200 scanarr[7] len:20 cnt:13 cx:33 cxt: /10/05 12:02:01: node:200 scanarr[8] len:16 cnt:4 cx:37 cxt: /10/05 12:02:01: node:200 scanarr[9] len:8 cnt:3 cx:40 cxt: /10/05 12:02:01: node:200 scanarr[10] len:4 cnt:2 cx:42 cxt: /10/05 12:02:01: node:200 scanarr[11] len:2 cnt:2 cx:44 cxt: /10/05 12:02:01: node:200 scanarr[12] len:1 cnt:1 cx:45 cxt: /10/05 12:02:01: multiread:1 db:1931 woff:518 rcvbytes:454 total rcvbytes:454 parts /10/05 12:02:01: multiread:2 db:1990 woff:210 rcvbytes:448 total rcvbytes:902 parts /10/05 12:02:01: multiread:3 db:1990 woff:570 rcvbytes:338 total rcvbytes:1240 parts The position Level 2 is used to spread the pickup of the different lengths in scan array. Schneider Electric Denmark A/S

16 Example of Driverlog using multi read function and sort of scan record table using position Level 1 value 8 and Level 2 value 11. The pickup of data starts in incrementing steps from position 8 (Level 1) of scan array, and ends in position 11 (Level 2). Then it continues from position 0 with as many scans of that length as possible, and finally it tries to achieve a fit of the MaxRspLen. 2017/10/05 13:13:13: node:200 scaninterval:5000 MaxRspLen:466 MaxObjects:19 Level1:8 Level2:11 Merge:0 2017/10/05 13:13:13: node:200 scanarr[0] len:56 cnt:1 cx:1 cxt: /10/05 13:13:13: node:200 scanarr[1] len:52 cnt:2 cx:3 cxt: /10/05 13:13:13: node:200 scanarr[2] len:48 cnt:4 cx:7 cxt: /10/05 13:13:13: node:200 scanarr[3] len:44 cnt:1 cx:8 cxt: /10/05 13:13:13: node:200 scanarr[4] len:40 cnt:1 cx:9 cxt: /10/05 13:13:13: node:200 scanarr[5] len:24 cnt:10 cx:19 cxt: /10/05 13:13:13: node:200 scanarr[6] len:22 cnt:1 cx:20 cxt: /10/05 13:13:13: node:200 scanarr[7] len:20 cnt:13 cx:33 cxt: /10/05 13:13:13: node:200 scanarr[8] len:16 cnt:4 cx:37 cxt: /10/05 13:13:13: node:200 scanarr[9] len:8 cnt:3 cx:40 cxt: /10/05 13:13:13: node:200 scanarr[10] len:4 cnt:2 cx:42 cxt: /10/05 13:13:13: node:200 scanarr[11] len:2 cnt:2 cx:44 cxt: /10/05 13:13:13: node:200 scanarr[12] len:1 cnt:1 cx:45 cxt: /10/05 13:13:13: multiread:1 db:1931 woff:518 rcvbytes:466 total rcvbytes:466 parts /10/05 13:13:13: multiread:2 db:1916 woff:688 rcvbytes:464 total rcvbytes:930 parts /10/05 13:13:13: multiread:3 db:1901 woff:271 rcvbytes:310 total rcvbytes:1240 parts Schneider Electric Denmark A/S

17 If a value of 1000 is added to the position Level 1, the same function will be performed as in the first example with a value of 8 in the position Level 1 except that a prior sorting of the scan records with the highest data group and the highest word offset as first scan records will be executed before the normal sort function is run. Schneider Electric Denmark A/S

18 If a value of 2000 is set in the position Level 1 a sorting of the scan record with the highest data group and the highest word offset will be executed. This can be done to optimize the merge scans if possible. Schneider Electric Denmark A/S

19 3.3 FAST ACTIVATION Newer PLCs can provide faster response on scan records e.g. 1-2 msec. However, the driver only has an activation interval of 5 msec (set under tab Advanced and Activation interval for the driver), giving only 200 scan records and output messages per second. This can be improved by the fast activation function. Select the checkbox Use faster handling of messages if a message is waiting. The driver will then send a new scan record or output message immeiately after having received the response message of the previous scan record from the PLC, instead of postponing the activation interval until it has checked if any scan records are waiting to be send. If no scan records are waiting, the driver will check for new scan records within the activation interval. Notice that if you use the multi read function, faster activation will automatically be performed. Schneider Electric Denmark A/S

20 4 CONFIGURING THE OBJECTS Once the driver and the PLC nodes have been defined, IGSS Objects and Atoms can be linked to the process variable in the PLC. Different types of PLC memory can be accessed for read/write operations using the driver. By using the Atom Mapping tab in the Object Properties dialog you can specify the binding between the object s atoms and the PLC process variables. Start by selecting an atom and select the 7TS7TCP driver in the Driver drop down list: Now select the desired PLC node number and continue by setting be desired Data Area (normally DB Data Block). Then specify the Data Block Number and the Adressing method and Offset. Note that the corresponding Simatic Mnemonic is displayed and updated as you select the appropriate parameters. This is a help to make sure you always bind to the correct process variable. Schneider Electric Denmark A/S

21 Continue this process for each atom on the object, and save the parameters by clicking the OK button when finished. 4.1 SUPPORTED MEMORY TYPES The driver supports a number of different memory types in the PLC and a number of different addressing methods. Data Blocks can be addressed in the range from DB0 to DB Process variables stored in Data Blocks can be specified using: Word (16-bit): Byte (8-bit): Bit (1-bit): The driver will read/write a 16 bit value from/to the PLC. E.g. DB47.DBW4. The driver will read/write an 8 bit value from/to the PLC. E.g. DB51.DBB211. The driver will read/write a single bit from/to the PLC. E.g. DB311.DBX15.3. These addressing methods allow you to bind to any type of process value in the PLC Data Block memory area. Please note that if you want to bind to a 32 bit (DWORD) value, use Word addressing and specify the external type as one of the supported 32 bit types. Then the system will automatically do the correct addressing. If you e.g. want to bind to a floating point process value at DB31.DBD70 you should specify: DB31.DBW70, Word (16-bit) and select the external type FLOAT. Other less used, also supported types are: Q (Output): I (Input): C (Counters): Read/write from/to Output addresses directly. Read from Input addresses directly. Read from Counters directly. IT IS HIGHLY RECOMMENDED to use Data Blocks as the primary memory type for exchanging variable information between IGSS and the PLC. Read- and especially write operations directly to Output or Counters cannot be verified by the PLC problem and might thus lead to hazards. Schneider Electric Denmark A/S

22 5 PERFORMANCE AND THROUGHPUT The driver is designed for maximum throughput on any given TCP/IP network. On a standard PC with a 100 Mbit/s connection to the PLC you should expect a throughput of 10+ request/response cycles pr. second. Each PLC node is handled concurrent and independently. This means that if you add more PLC s to the system, the throughput pr. PLC should only be affected marginally, provided that the overall network throughput is sufficient. IMPORTANT NOTICE: The IGSS communication engine optimizes communication throughput by seeking to group data whenever possible. This means that if the communication engine is required to read e.g. data block DB100.DBW20 and DB100.DBW40 then it will read data block 100 offset 20 and 21 through to data block 100 offset 40 as one block. This is much more efficient than reading the two data blocks using two separate read requests. Schneider Electric Denmark A/S

23 6 ERROR CODES #define _7TS7TCP_SEND_SOCKET_FAILED //Cause: Failed to send data to PLC. //Action: Check sub error code for details. //Subcode: Windows Socket error code 0x4801 #define _7TS7TCP_RECV_MAXLEN_EXCEED 0x4802 //Cause: Receive telegram length exceeded. Telegram too long. //Action: Contact 7T technical support //Subcode: Telegram length #define _7TS7TCP_RECV_TIMEOUT_DATA //Cause: Receive Timeout (data part) //Action: Increase driver Timeout parameter 0x4803 #define _7TS7TCP_RECV_TIMEOUT_HEADER //Cause: Receive Timeout (data part) //Action: Increase driver Timeout parameter 0x4804 #define _7TS7TCP_RECV_SOCKET_FAILED_HEADER //Cause: Failed to receive telegram header from PLC. //Action: Check sub error code for details. //Subcode: Windows Socket error code 0x4805 #define _7TS7TCP_RECV_SOCKET_FAILED_DATA //Cause: Failed to receive telegram data from PLC. //Action: Check sub error code for details. //Subcode: Windows Socket error code 0x4806 Schneider Electric Denmark A/S

24 #define _7TS7TCP_S7_CONNECT_FAILED //Cause: Failed to make S7 connection to PLC //Action: Check sub error code for details. //Subcode: PLC error code 0x4807 #define _7TS7TCP_S7_PDU_NEGOT_FAILED //Cause: Failed to negotiate PDU sizze with PLC //Action: Contact 7T technical support //Subcode: PLC error code 0x4808 #define _7TS7TCP_WRONG_SIZE_CODE_READ 0x4809 //Cause: Unsupported size code (only bits/bytes and words supported) //Action: Check addresses in configuration //Subcode: Size code #define _7TS7TCP_WRONG_TYPE_CODE_READ 0x480A //Cause: Unsupported type code (only DB/DI/A/E/TIM/CNT/MERKER supported) //Action: Check addresses in configuration //Subcode: Type code #define _7TS7TCP_S7_NO_DATA_REPLY //Cause: Received PDU with no data //Action: Check that requested data area exists 0x480B #define _7TS7TCP_S7_PDU_FORMAT_ERROR //Cause: Received PDU with unexpected format //Action: Check driver Log file for additional information 0x480C #define _7TS7TCP_S7_PDU_SEQ_ERROR 0x480D //Cause: Received PDU with unexpected sequence number //Action: Check network quality (use e.g. repeated ping commands). If problem persists contact 7T technical support Schneider Electric Denmark A/S

25 #define _7TS7TCP_WRONG_SIZE_CODE_WRITE 0x480E //Cause: Unsupported size code (only bits/bytes and words supported) //Action: Check addresses in configuration //Subcode: Size code #define _7TS7TCP_WRONG_TYPE_CODE_WRITE 0x480F //Cause: Unsupported type code (only DB/DI/A/E/TIM/CNT/MERKER supported) //Action: Check addresses in configuration //Subcode: Type code #define _7TS7TCP_CPU_NOT_IN_RUN_MODE 0x4810 //Cause: The driver has detected that the PLC CPU is not in RUN mode. // This warning is by default given every minute if the PCU is not in RUN state. //Action: Check the CPU state and the PLC program. //Subcode: CPU RUN state returned by the PLC: 0x08 => RUN, other => STOPPED #define _7TS7TCP_RECV_WRONG_NEXT_PART //Cause: Receive wrong start of next part of telegram. //Action: Contact 7T technical support 0x4811 Schneider Electric Denmark A/S

26 7 SET UP PLC TO COMMUNICATE WITH IGSS (Siemens S & 1500 PLCs) For Siemens S and 1500 series PLCs certain functions must be enabled in the PLC s properties before the IGSS SCADA system can read data from the PLC. Setup Optimized block access 1. Open the PLC s Program blocks folder 2. Right-click the Data block folder and select Properties 3. In the Data block s General pane, select Attributes and remove the check mark in the Optimized block access box (see screen dump next page). Schneider Electric Denmark A/S

27 Enable PUT/GET communication from remote partner 1. Open the PLC folder 2. Select Device configuration 3. In the PLC s General tab, select Webserver> Protection 4. Mark the Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC,..) box. Schneider Electric Denmark A/S