Presentation on theme: "Using the 2572 / 2572-A Ethernet Modules and the CPU Ethernet Port"— Presentation transcript:
1Using the 2572 / 2572-A Ethernet Modules and the CPU Ethernet Port .
22572 features 10 Mbit support RJ-45 and AUI interface IP addressing from serial port or PLCSerial port for configuration and PLC programmingSupports external power for transceiver100% compatibility with 505-CP2572Server mode for supporting HMI’s2 Client modes for peer-peercapabilityS7 send/receive support.
32572-A features 2572 compatibility Better performance (2x) 100Mb supportNew startup option to use DHCP for addressingEnhanced diagnostics stored in non-volatile RAMWeb server for configuration and diagnosticsBetter security for configuration changesPassword controlHardware lockout.
42572 Front Panel - Status LEDs ACTIVESolid = module status goodSlow blink = faultFast blink = no IP addressXMIT-1, XMIT-2, XMIT-ELights when data is transmitted on the portRCV-1, RCV-2, RCV-3Lights when data is received on the portLB (link beat)Lights when there is a good connection to a hub or switchAUILights when the AUI port is selected (automatically selected if no link beat on RJ45 portPOL (polarity)Lights when polarity is reversed on the RJ45 port (automatically corrected)COL (collision)Lights when a collision is detected.
52572 Front Panel - Serial ports Port 1: DB9 male – RS232Port 2: DB9 female – RS422Port parameters set by switches or PLC logicUsed for module configuration and PLC programming“Redirect” feature sends serial port data to another 2572 on the network (useful for APT and TISOFT programming).
62572 Front Panel - Ethernet 10bT AUI AUI power Connects to Ethernet UTP (unshielded twisted pair) using RJ45 connectorAUIConnects to an Ethernet transceiver, allowing attachment to coaxial for fiber networksAUI powerAllows user to optionally supply external power for the AUI (default is PLC powered)10bT port is primary; if no Link Beat then AUI port is usedA status bit is sent to the PLC indicating which port is selected.
72572-A Front Panel - Status LEDs MS (Module Status)Steady Green = module hardware and software is operationalFlashing green = module is starting upSteady red or flashing red = error conditions.NS (Network Status)Steady Green = network server is operational (IP address has been set)Steady red or flashing red = error conditionsOff = network server has not been started.LS (Link Status)Steady Green = a link exists between the module and the Ethernet hub or switchOff = no cable connected, or cable faultCOL (Collision)Lights when a collision is detected.
82572-A Front Panel - Status LEDs FDX (Full-Duplex)Steady green = full duplex mode. 100 (100 Mb)Steady Green = 100MbOff = 10MbXMT-S, XMIT-E (Transmit)Lights when data is transmitted on serial or Ethernet portsRCV-S, RCV-E (Receive)Lights when data is received on serial or Ethernet ports.
92572-A Front Panel Reset button Recessed to avoid accidental press Causes a hardware reset (like removing the module and reinstalling)Module ID switchesSet the module ID for use with DHCP auto-addressing.
102572-A Front Panel Serial port RS232 Works with PLC programming cables For module configuration onlyEthernet portSupports 10Mb or 100MbShielded or unshielded cable.
11Ethernet Module Functions PLC server – allows external clients to read and write PLC memory (HMI)Client sends request to the module using NITP or CAMP command embedded in TCP/IP packetModule sends the command to the PLC over the backplanePLC responds over the backplaneModule returns data or acknowledgement to the clientUp to 8 requests (2572) or 16 requests (2572-A) allowed per PLC scanPLC client (peer-peer)Under control of PLC logic:Sends messages to other nodesProcesses messages from other nodesCan support multiple concurrent connections.
12PLC command interfaceA command interface is used to trigger the module to send and receive dataNot required for simple HMI operationModule logs in as 2WX, 6WYCommand processPlace a command block in V-memoryPut the starting address of the command block in WY5-8Trigger a bit in WY4Monitor command status in WX2Up to 4 commands can be processed simultaneously.
13PLC command interface Logs in as 2WX and 6WY words Monitor status here Trigger the commands herePut V-memory addresses for command blocks here.
14WX / WY Map Module Status Word Module Control Word 12345678910111213141516Module Status WordWX1Command Status WordCMD 1CMD 2CMD 3CMD 4WX2Status BitsStatus BitsStatus BitsStatus BitsModule Control WordWY3Command Control WordCMD 1CMD 2CMD 3CMD 4WY4Control BitsControl BitsControl BitsControl BitsCommand Slot 1: V Memory Address of Command Block for CMD1WY5Command Slot 2: V Memory Address of Command Block for CMD2WY6Command Slot 3: V Memory Address of Command Block for CMD3WY7Command Slot 4: V Memory Address of Command Block for CMD4WY8.
15Module Status Word (WX1) 123456789 - 16MODFAILSERCFGNETCFGDIAGERRCFGERRAUIACTDSACTRSVDTimer E Code12345678 - 1516MODSTATUSRSVDNETCFGRSVDRSVDLINK STATUSRSVDRSVDHEART BEAT.
16Module Control Word (WY3) 123456789 - 16MODRESETRSVDRSVDRSVDRSVDRSVDRSVDRSVDRSVDTo perform a module reset, set MOD RESET AND set all 4 abort triggers in the Command Control word (WY4)..
17Command Control Word (WY4) 12345678910111213141516ERRAckCMDModeCMDTrigAbortTrigERRAckCMDModeCMDTrigAbortTrigERRAckCMDModeCMDTrigAbortTrigERRAckCMDModeCMDTrigAbortTrigCommand 1Command 2Command 3Command 4CMD Mode0 = uncoupled mode (command runs continuously as long as CMD Trig is high)1 = coupled mode (command runs once, then CMD Trig must go low and high to run command again).
18Command Status Word (WX2) 12345678910111213141516CMDERRPLC ErrCMDBusyAbortBusyCMDERRPLC ErrCMDBusyAbortBusyCMDERRPLC ErrCMDBusyAbortBusyCMDERRPLC ErrCMDBusyAbortBusyCommand 1Command 2Command 3Command 4CMD Err = error in executing commandError code is written into first word of command block in V-memoryPLC Err = no valid command block at specified V-memory addressNo error code is written.
19Command Block in V-Memory OffsetContentsCommon Commands4 = start network server3 = create connection2 = close connection513 = write remote514 = read remote515 = memory exchangeError Word1Command Code2Connection Number3Command Parameter 14-15Additional parametersCommand block is 16 contiguous words in V-MemoryIf error in processing, Error Word contains the code of the errorCommand code = type of commandConnection Number = which protocol manager executes the commandHigh byte of Connection Number must = 4B.
20Sample Command Block Start Network Server Sample Command Block Start Network ServerOffsetDescriptionHexValueDecimalValueCommand Error WordUpper byte = 4B1Command (Start Network Server)442Connection Number ( )4B62192983Protocol Manager Number35 = PLC Network server23354Startup Option Bits5TCP Keep Alive Interval in Seconds (0=default = 60) (Set to or greater to disable Keep Alive)6IP Address of this Module (High 16 bits)C7B8511287IP Address of this Module (Low 16 bits)B142453788TCP / UDP Port Number05E115059IP Address of Default Router (High 16 bits)10IP Address of Default Router (Low 16 bits)11Max Number of TCP Connections (0=default)Mask (High 16 bits)12Subnet Mask (High 16 bits)FFFF6553513Subnet Mask (Low 16 bits)FF006528014Unused - reserved for future use (Set to 0)15Unused - reserved for future use (Set to 0).
21Getting Started Using the 2572 Determine IP addressChoose network startup modeSet up switchesInstall 2572 and connect network cableEnter startup ladder logic if “PLC-start” selected or enter IP address into module if “auto-start” selectedVerify PC address is on the same network as the 2572Test connection using “ping”.
22Getting started using the 2572 Choose network startup modeAutomatically starting the network serverStarts the network server from onboard EEPROMRequires IP address to be pre-assigned using serial port with CTIDiag programRequires no PLC logicStarting the network server from PLC logicRequires PLC logic to trigger “start network server” command blockEnsures that any 2572 plugged into that slot will get the same IP addressEasy replacement of modulesAutomatic start with DHCP server (2572-A only)Ensures a replacement module will get the same address as the old moduleDoes not require any PLC logicRequires a DHCP server on the network which must be configured to support Module ID.
23Getting Started Using the 2572 Set switches2572Serial port protocol and baud rateSerial port handshakingNetwork startup modeEEPROM write protectAUI power2572-ASerial port baud rateDiagnostic startInterface modePassword bypassDownload lockConfiguration lock.
28Automatically Starting the Network Server Select Auto-Start on switchesSW2 position 4 on 2572SW1 position 4 on 2572-AAssign the IP address using the serial portAttach serial cableRun CTIDiagOpen I/O data portChoose “Module”, “Set network parameters”Reset the moduleVerify communication with the module using “ping”Start CTIDiag.
29Starting the Network Server from PLC Logic Select PLC-Start on switchesSW2 position 4 on 2572SW1 position 4 on 2572-ASetup the “Start Network Server” command block in V-memoryEnter the example logic for triggering the command blockStart the programVerify communication with the module using “ping”.
30Start Network Server Command Block Start Network Server Command BlockOffsetDescriptionHexValueDecimalValueCommand Error WordUpper byte = 4B1Command (Start Network Server)442Connection Number ( )4B62192983Protocol Manager Number35 = PLC Network server23354Startup Option Bits5TCP Keep Alive Interval in Seconds (0=default = 60) (Set to or greater to disable Keep Alive)6IP Address of this Module (High 16 bits)C7B8511287IP Address of this Module (Low 16 bits)B142453788TCP / UDP Port Number05E115059IP Address of Default Router (High 16 bits)10IP Address of Default Router (Low 16 bits)11Max Number of TCP Connections (0=default)Mask (High 16 bits)12Subnet Mask (High 16 bits)FFFF6553513Subnet Mask (Low 16 bits)FF006528014Unused - reserved for future use (Set to 0)15Unused - reserved for future use (Set to 0).
31Starting the Network Server from PLC Logic Load starting address of command block into WY5 (command slot 1). Note the rung runs only once.Example ladder logicIf network server is not started and command 1 is not busy, trigger the start server command.Net CfgCMD1 TrigCMD1 Busy.
32Open Socket Command Block (opens a connection to another 2572) Open Socket Command Block (opens a connection to another 2572).
33Write Remote Command Block\ (writes a block of v-memory to another 2572).
34Read Remote Memory Block (reads a block of v-memory from another 2572) Read Remote Memory Block (reads a block of v-memory from another 2572).
35Software package that runs on a PC CTI 2572-DDS2 DDE I/O ServerSoftware package that runs on a PCCan read / write data from the PLC and make it available to any application that supports DDE (Wonderware, MS-Excel, etc).
36Making a Simple Display Using Excel Install 2572 and start network serverStart DDE serverCreate topic in DDE serverSelect Configure / TopicEnter a topic nameEnter the IP address of the 2572Start ExcelEnter formulas using the syntax‘Application_name’|’topic_name’!’item_name’Application_name is the name of the CTI I/O serverTopic_name is the topic you createdItem_name is a valid 505 memory referenceExample: ‘cti2572’|’testplc’!’wx1’.
37CTI 2572-OPC ServerOPC (OLE for Process and Control) servers provide a standardized method of allowing multiple industrial applications to share data in a quick and robust manner.Includes a main server program which provides all of the OPC and DDE connectivity and user interface functions, and a plug-in communications drivers for the CTI 2572 Ethernet Module.OPC technology reflects the move from closed proprietary solutions to open architectures that provide more cost-effective solutions based on established standards.
382572 Application notes IP Addressing and the 2572 Getting Started with Networking and the 2572Using CTIDiag with the 2572Starting the 2572 Network Server from PLC LogicReading Values into Excel Spreadsheets Using the 2572Using the 2572 with Wonderware 7.0Creating a Client/Server Memory Transfer between Two 2572 ModulesUsing the 2572 UDP "Send To" Feature to Exchange Memory with Multiple PLCs.
39Ethernet Modules Specific Topics 2572Operation of the featureOperation of the send/receive featureOperation of the DataShare feature2572-AIP address assignment using DHCPBuilt-in web serverSecurity featuresRe-flashing firmwareModbus TCP ServerIP Mulitcast.
402572 Email Feature Allows PLC logic to transmit an email message Sample command block.
412572 Send / Receive FeatureAllows data exchange between TI505 and Siemens S5/S7 PLCsSend commands and receive commands must match-up on both sidesData block read from / written to V-MemoryFour command blocks are usedOpen active connectionOpen passive connectionSendReceiveClose connectionComplete details in chapter 5 of the 2572 user manual.
432572 DataShare FeatureAllows very high speed peer-peer connection between 2572sUseful whereSpeed is criticalOne PLC periodically need to update several others with the same set of dataMultiple PLCs need to exchange data on a cyclic basisActivated using SW2-2When active, limits performance of module as a serverUses reserved bits in the Module Status Word and Module Command WordCommand BlocksStart producer instanceTrigger producerStart consumer instanceClose datashare.
452572-A IP Address Assignment using DHCP Allows use of auto-start while still guaranteeing correct IP address in case of a module replacementHow it worksIf auto-start is selected and settings of module ID switches are non-zero, the module ID value is sent to the DHCP server as a “client identifier”DHCP server is set up to assign IP addresses based on client identifierAt CTI, we set up our server to assign the last part of the IP address based on the switch assignmentExampleSwitch setting of “70” receives IP address ofComplete information on setting up DHCP server in Appendix E of 2572-A user manual.
462572-A Built-In Web Server Web server features Module diagnosticsModule configurationFirmware downloadSecurity servicesProduct supportJust point your browser at the IP address of the module.
472572-A Security Features Password protection for Hardware lockout for Module configuration changesModule firmware downloadBypass password protection using SW1-7Hardware lockout forSet on SW1-5 and SW1-6.
482572-A Firmware UpgradeFirmware updates can be re-flashed in-place using the web server interfaceInstall a free TFTP server on your networkDownload and copy the upgrade file to the TFTP serverGo to the “firmware download” section of the 2572-A web server interfaceEnter the IP address of the TFTP serverComplete information in Appendix F of the user manual.
492572-A Modbus TCP Server Configuration The Modbus TCP server starts automatically. There is no configuration or startup logic required.Variable MappingModbus TCP uses a different nomenclature than the SIMATIC® 505 to describe data elements. The following table provides a cross reference.Modbus Variable505 PLC Equivalent VariableCoilControl Relay (C )(Discrete) InputDiscrete Input (X)Holding RegisterUser Variable Memory (V)Input RegisterWord Input (WX)
502572-A Modbus TCP Server Supported Modbus Function Codes (FC) (dec)(hex)Function Codes505VariableComments01Read Coil StatusCMax number of coils = 200002Read Input StatusXMax number of inputs = 200003Read Holding RegisterVMax = 12504Read Input RegisterWX05Write Single Coil06Write Single Register07Read Exception StatusTBD. This returns Y1-8 or C1-8 in 2573-MOD.150FWrite Multiple CoilsMax = 8001610Write Multiple RegistersMax = 100Supported Modbus Function Codes (FC)CodeNameDescription01Illegal FunctionUnsupported Function code02Illegal Data AddressRequested data address not included in the PLC configuration03Illegal Data ValueTypically indicates a problem in the query structure04Slave Device FailureUnrecoverable error occurred while processing the request
512572-A IP MulticastThere is no physical limit to the number of modules that can participate in a Multicast session.The number of words that may be transferred is words per module.The source, number of words ,and destination are defined in the Producers. This gives greater flexibility in determining the source data, the number of words that get written, and the destination that the data gets written to in the consumers in the Multicast session.Each station broadcasts its message asynchronously at the configured production intervals. This eliminates the need for each station to be polled to broadcast its data.The TCP/IP protocol reserves a block of IP addresses ( through ) for multicast use.
522572-A IP MulticastYou can configure a 2572-A to receive on a multicast address using the same methods used to establish the other TCP/IP network parameters.1. If you are using the PLC Start method, the multicast address can be specified in the Start Network Server command block.2. If you are starting the module using IP parameters stored in EEPROM, you can use the Web Server interface to enter the multicast address.3. If you are using DHCP, you can add the multicast address to the parameters that are provided by the DHCP server.
532572-A IP Multicast Start Network Server Example Only the values in offsets 6 and 7 would change to load that modules specific IP address.
542572-A IP Multicast Configuring IP Multicast After the network server has been started you need to do the following to send a multicast message:1. Execute a Create Socket command using a multicast address.2. Use the Unacknowledged Write command to send a multicast message containing the data you wish to write.
552572-A IP Multicast Create Socket Command The Create Socket command provides a means for your PLC logic to refer to another network node when sending messages. You must complete the Create Socket command before you send messages to another node on the network.For IP Multicast, UDP must be specified as the Type of Service. The 2572-A saves the Multicast address and port number as the default remote socket. The IP Multicast address is specified in offsets 6 and 7 of the Create Socket command block. Once the Create Socket command completes successfully, your logic can use the Connection Number to refer to the remote socket.
562572-A IP MulticastCreate Socket Command Example
572572-A IP Multicast Unacknowledged Write Command This command is designed to be used with multicast addresses, where one message can be used to update multiple modules. Like the standard write command, this command reads the contents of a designated area of V memory in the local PLC and writes the values to a specified area of memory in another PLC. However, because multiple modules could receive this message, CAMP servers that receive this command do not reply and the client does not verify that the message was received by any server.
582572-A IP Multicast Unacknowledged Write Command Example Note that offset 3 (V143) determines the starting V location of the write block in the local PLC. Offset 4 (V144) determines the number of words to be written. Offset 5 (V145) determines where this block of data gets written to in the remote PLC.
592500-CXXX CPU Ethernet Port Ethernet CommunicationsThe CTI 2500 controller provides a means to attach the controller to a plant network via an integrated 10/100Mb Ethernet port. The port offers auto-crossover capability, which allows you to connect a standard cable directly from your PC to the Ethernet port for local programming.The port uses the TCP/IP protocol, which is widely supported by programming software and HMI software. Before you can use the port, you must set the IP address and related parameters. To do this, you can use Workshop Version 4.11 or greater or the CTI standalone utility program IPSET (Demonstration).
602500-CXXX CPU Ethernet Port To prevent a possible bump in the process, the IP address can be set only while the PLC is in PROGRAM mode.IP addresses must be unique, even between the local Ethernet port and an Ethernet module in the same base. Duplicating IP addresses can cause unpredictable problems, including loss of communications with the Ethernet port.
612500-CXXX CPU Ethernet Port TCP/IP provides for multiple logical ports. Each “port” represents a particular service offered at the IP address. The CTI 2500 Controller supports the following logical ports:Programming Port (TCP Port 4452)The programming port is intended for use with network-capable programming software, such as PLC WorkShop. To use the programming port, connect to TCP port This port supports all programming, data access, and control requests. Only one client may be connected to the programming port at a time. The CTI 2500 gives priority to all requests to the programming port. UDP connections are not supported.When programming via local Ethernet port using TCP port 4452, you can prevent anyone else from concurrently modifying the program via another port or SF module by initiating port lockout using your programming software. Port lockout blocks requests to modify the User Program that originate from other physical ports, such as the serial port or a port on a special function module.
622500-CXXX CPU Ethernet Port Data Access Port (TCP Port 4450/1505)To use the Data Access port, it is preferable to connect to TCP port To provide compatibility with installations using the CTI 2572 and 2572-A, you may also connect to the Data Access port using TCP port A total of three concurrent TCP connections to port 4450 or 1505 are allowed. For example, you could have two connections to port 4450 and one connection to port UDP connections are not supported.The Data Access port is intended for use with HMI and SCADA software. Since the Data Access Port uses the same CAMP protocol used by CTI 2572 and 2572-A modules, drivers are available for most popular SCADA software packages.
632500-CXXX CPU Ethernet Port Data Access Port (TCP Port 4450/1505) Cont.It can also be used with network-capable programming software where you want to allow the User Program to be displayed but not modified. By default, the Data Access port will reject commands that attempt to alter the User Program, returning a “port lockout” error.Some legacy network programming interfaces, such as APTNET, support only Port If you need to use TCP Port 1505 as a full function programming port (allowing programs to be modified), you can set the Programming Port switch as described in Section 2.4.CautionWhen you choose to use Port 1505 as a full function programming port, there is no means to prevent two users from concurrently modifying the User Program, since more than one programming connection to the Ethernet port is allowed.
642500-CXXX CPU Ethernet Port Web Server PortThe Web Server port allows a standard Web browser to connect to the CTI 2500 to access the Event Log.The event log maintains a time stamped record of significant software events. All fatal and non-fatal errors result in an entry into the event log. The event log is stored in battery backed memory. It can be accessed using a standard web browser, such as Internet Explorer. You can access the Event Log by typing the controller IP address in the URL box in the browser. If you are experiencing problems, the event log will usually provide details relating to the problem.