1. Using the 2572 / 2572-A Ethernet Modules and the CPU Ethernet Port.

2. 2572 features 10 Mbit support RJ-45 and AUI interface
IP addressing from serial port or PLC
Serial port for configuration and PLC programming
Supports external power for transceiver
100% compatibility with 505-CP2572
Server mode for supporting HMI’s
2 Client modes for peer-peer
capability
S7 send/receive support .

3. 2572-A features 2572 compatibility Better performance (2x)
100Mb support
New startup option to use DHCP for addressing
Enhanced diagnostics stored in non-volatile RAM
Web server for configuration and diagnostics
Better security for configuration changes
Password control
Hardware lockout .

4. 2572 Front Panel - Status LEDs
ACTIVE
Solid = module status good
Slow blink = fault
Fast blink = no IP address
XMIT-1, XMIT-2, XMIT-E
Lights when data is transmitted on the port
RCV-1, RCV-2, RCV-3
Lights when data is received on the port
LB (link beat)
Lights when there is a good connection to a hub or switch
AUI
Lights when the AUI port is selected (automatically selected if no link beat on RJ45 port
POL (polarity)
Lights when polarity is reversed on the RJ45 port (automatically corrected)
COL (collision)
Lights when a collision is detected .

5. 2572 Front Panel - Serial ports
Port 1: DB9 male – RS232
Port 2: DB9 female – RS422
Port parameters set by switches or PLC logic
Used for module configuration and PLC programming
“Redirect” feature sends serial port data to another 2572 on the network (useful for APT and TISOFT programming) .

6. 2572 Front Panel - Ethernet 10bT AUI AUI power
Connects to Ethernet UTP (unshielded twisted pair) using RJ45 connector
AUI
Connects to an Ethernet transceiver, allowing attachment to coaxial for fiber networks
AUI power
Allows user to optionally supply external power for the AUI (default is PLC powered)
10bT port is primary; if no Link Beat then AUI port is used
A status bit is sent to the PLC indicating which port is selected .

7. 2572-A Front Panel - Status LEDs
MS (Module Status)
Steady Green = module hardware and software is operational
Flashing green = module is starting up
Steady red or flashing red = error conditions.
NS (Network Status)
Steady Green = network server is operational (IP address has been set)
Steady red or flashing red = error conditions
Off = network server has not been started.
LS (Link Status)
Steady Green = a link exists between the module and the Ethernet hub or switch
Off = no cable connected, or cable fault
COL (Collision)
Lights when a collision is detected .

8. 2572-A Front Panel - Status LEDs
FDX (Full-Duplex)
Steady green = full duplex mode. 100 (100 Mb)
Steady Green = 100Mb
Off = 10Mb
XMT-S, XMIT-E (Transmit)
Lights when data is transmitted on serial or Ethernet ports
RCV-S, RCV-E (Receive)
Lights when data is received on serial or Ethernet ports .

9. 2572-A Front Panel Reset button Recessed to avoid accidental press
Causes a hardware reset (like removing the module and reinstalling)
Module ID switches
Set the module ID for use with DHCP auto-addressing .

10. 2572-A Front Panel Serial port RS232 Works with PLC programming cables
For module configuration only
Ethernet port
Supports 10Mb or 100Mb
Shielded or unshielded cable .

11. Ethernet Module Functions
PLC server – allows external clients to read and write PLC memory (HMI)
Client sends request to the module using NITP or CAMP command embedded in TCP/IP packet
Module sends the command to the PLC over the backplane
PLC responds over the backplane
Module returns data or acknowledgement to the client
Up to 8 requests (2572) or 16 requests (2572-A) allowed per PLC scan
PLC client (peer-peer)
Under control of PLC logic:
Sends messages to other nodes
Processes messages from other nodes
Can support multiple concurrent connections .

12. PLC command interface
A command interface is used to trigger the module to send and receive data
Not required for simple HMI operation
Module logs in as 2WX, 6WY
Command process
Place a command block in V-memory
Put the starting address of the command block in WY5-8
Trigger a bit in WY4
Monitor command status in WX2
Up to 4 commands can be processed simultaneously .

13. PLC command interface Logs in as 2WX and 6WY words Monitor status here
Trigger the commands here
Put V-memory addresses for command blocks here .

14. WX / WY Map Module Status Word Module Control Word1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
Module Status Word
WX1
Command Status Word
CMD 1
CMD 2
CMD 3
CMD 4
WX2
Status Bits
Status Bits
Status Bits
Status Bits
Module Control Word
WY3
Command Control Word
CMD 1
CMD 2
CMD 3
CMD 4
WY4
Control Bits
Control Bits
Control Bits
Control Bits
Command Slot 1: V Memory Address of Command Block for CMD1
WY5
Command Slot 2: V Memory Address of Command Block for CMD2
WY6
Command Slot 3: V Memory Address of Command Block for CMD3
WY7
Command Slot 4: V Memory Address of Command Block for CMD4
WY8 .

15. Module Status Word (WX1)1 2 3 4 5 6 7 8
9 - 16
MOD
FAIL
SER
CFG
NET
CFG
DIAG
ERR
CFG
ERR
AUI
ACT DS
ACT
RSVD
Timer E Code 1 2 3 4 5 6 7
8 - 15 16
MOD
STATUS
RSVD
NET
CFG
RSVD
RSVD
LINK STATUS
RSVD
RSVD
HEART BEAT .

16. Module Control Word (WY3)1 2 3 4 5 6 7 8
9 - 16
MOD
RESET
RSVD
RSVD
RSVD
RSVD
RSVD
RSVD
RSVD
RSVD
To perform a module reset, set MOD RESET AND set all 4 abort triggers in the Command Control word (WY4). .

17. Command Control Word (WY4)1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
ERR
Ack
CMD
Mode
CMD
Trig
Abort
Trig
ERR
Ack
CMD
Mode
CMD
Trig
Abort
Trig
ERR
Ack
CMD
Mode
CMD
Trig
Abort
Trig
ERR
Ack
CMD
Mode
CMD
Trig
Abort
Trig
Command 1
Command 2
Command 3
Command 4
CMD Mode
0 = uncoupled mode (command runs continuously as long as CMD Trig is high)
1 = coupled mode (command runs once, then CMD Trig must go low and high to run command again) .

18. Command Status Word (WX2)1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
CMDERR
PLC Err
CMD
Busy
Abort
Busy
CMDERR
PLC Err
CMD
Busy
Abort
Busy
CMDERR
PLC Err
CMD
Busy
Abort
Busy
CMDERR
PLC Err
CMD
Busy
Abort
Busy
Command 1
Command 2
Command 3
Command 4
CMD Err = error in executing command
Error code is written into first word of command block in V-memory
PLC Err = no valid command block at specified V-memory address
No error code is written .

19. Command Block in V-Memory
Offset
Contents
Common Commands
4 = start network server
3 = create connection
2 = close connection
513 = write remote
514 = read remote
515 = memory exchange
Error Word 1
Command Code 2
Connection Number 3
Command Parameter 1
4-15
Additional parameters
Command block is 16 contiguous words in V-Memory
If error in processing, Error Word contains the code of the error
Command code = type of command
Connection Number = which protocol manager executes the command
High byte of Connection Number must = 4B .

20. Sample Command Block Start Network Server
Sample Command Block Start Network Server
Offset
Description
Hex
Value
Decimal
Value
Command Error Word
Upper byte = 4B 1
Command (Start Network Server) 4 4 2
Connection Number ( )
4B62
19298 3
Protocol Manager Number
35 = PLC Network server 23 35 4
Startup Option Bits 5
TCP Keep Alive Interval in Seconds (0=default = 60) (Set to or greater to disable Keep Alive) 6
IP Address of this Module (High 16 bits)
C7B8
51128 7
IP Address of this Module (Low 16 bits)
B142
45378 8
TCP / UDP Port Number
05E1
1505 9
IP Address of Default Router (High 16 bits) 10
IP Address of Default Router (Low 16 bits) 11
Max Number of TCP Connections (0=default)
Mask (High 16 bits) 12
Subnet Mask (High 16 bits)
FFFF
65535 13
Subnet Mask (Low 16 bits)
FF00
65280 14
Unused - reserved for future use (Set to 0) 15
Unused - reserved for future use (Set to 0) .

21. Getting Started Using the 2572
Determine IP address
Choose network startup mode
Set up switches
Install 2572 and connect network cable
Enter startup ladder logic if “PLC-start” selected or enter IP address into module if “auto-start” selected
Verify PC address is on the same network as the 2572
Test connection using “ping” .

22. Getting started using the 2572
Choose network startup mode
Automatically starting the network server
Starts the network server from onboard EEPROM
Requires IP address to be pre-assigned using serial port with CTIDiag program
Requires no PLC logic
Starting the network server from PLC logic
Requires PLC logic to trigger “start network server” command block
Ensures that any 2572 plugged into that slot will get the same IP address
Easy replacement of modules
Automatic start with DHCP server (2572-A only)
Ensures a replacement module will get the same address as the old module
Does not require any PLC logic
Requires a DHCP server on the network which must be configured to support Module ID .

23. Getting Started Using the 2572
Set switches
2572
Serial port protocol and baud rate
Serial port handshaking
Network startup mode
EEPROM write protect
AUI power
2572-A
Serial port baud rate
Diagnostic start
Interface mode
Password bypass
Download lock
Configuration lock .

24. Setting Switches
2572
2572-A
SW1
SW1
SW2 .

25. Setting Switches (2572) SW1 controls serial port 1 SW1 1 2 3 4 5 6 7 8
OPEN
SW1 controls serial port 1 .

26. Setting Switches (2572) SW2 controls serial port 2 and network startup
OPEN
SW2 controls serial port 2 and network startup .

27. Setting Switches (2572-A)
SW1
OPEN .

28. Automatically Starting the Network Server
Select Auto-Start on switches
SW2 position 4 on 2572
SW1 position 4 on 2572-A
Assign the IP address using the serial port
Attach serial cable
Run CTIDiag
Open I/O data port
Choose “Module”, “Set network parameters”
Reset the module
Verify communication with the module using “ping”
Start CTIDiag .

29. Starting the Network Server from PLC Logic
Select PLC-Start on switches
SW2 position 4 on 2572
SW1 position 4 on 2572-A
Setup the “Start Network Server” command block in V-memory
Enter the example logic for triggering the command block
Start the program
Verify communication with the module using “ping” .

30. Start Network Server Command Block
Start Network Server Command Block
Offset
Description
Hex
Value
Decimal
Value
Command Error Word
Upper byte = 4B 1
Command (Start Network Server) 4 4 2
Connection Number ( )
4B62
19298 3
Protocol Manager Number
35 = PLC Network server 23 35 4
Startup Option Bits 5
TCP Keep Alive Interval in Seconds (0=default = 60) (Set to or greater to disable Keep Alive) 6
IP Address of this Module (High 16 bits)
C7B8
51128 7
IP Address of this Module (Low 16 bits)
B142
45378 8
TCP / UDP Port Number
05E1
1505 9
IP Address of Default Router (High 16 bits) 10
IP Address of Default Router (Low 16 bits) 11
Max Number of TCP Connections (0=default)
Mask (High 16 bits) 12
Subnet Mask (High 16 bits)
FFFF
65535 13
Subnet Mask (Low 16 bits)
FF00
65280 14
Unused - reserved for future use (Set to 0) 15
Unused - reserved for future use (Set to 0) .

31. Starting the Network Server from PLC Logic
Load starting address of command block into WY5 (command slot 1). Note the rung runs only once.
Example ladder logic
If network server is not started and command 1 is not busy, trigger the start server command.
Net Cfg
CMD1 Trig
CMD1 Busy .

32. Open Socket Command Block (opens a connection to another 2572)
Open Socket Command Block (opens a connection to another 2572) .

33. Write Remote Command Block\ (writes a block of v-memory to another 2572) .

34. Read Remote Memory Block (reads a block of v-memory from another 2572)
Read Remote Memory Block (reads a block of v-memory from another 2572) .

35. Software package that runs on a PC
CTI 2572-DDS2 DDE I/O Server
Software package that runs on a PC
Can read / write data from the PLC and make it available to any application that supports DDE (Wonderware, MS-Excel, etc) .

36. Making a Simple Display Using Excel
Install 2572 and start network server
Start DDE server
Create topic in DDE server
Select Configure / Topic
Enter a topic name
Enter the IP address of the 2572
Start Excel
Enter formulas using the syntax
‘Application_name’|’topic_name’!’item_name’
Application_name is the name of the CTI I/O server
Topic_name is the topic you created
Item_name is a valid 505 memory reference
Example: ‘cti2572’|’testplc’!’wx1’ .

37. CTI 2572-OPC Server
OPC (OLE for Process and Control) servers provide a standardized method of allowing multiple industrial applications to share data in a quick and robust manner.
Includes a main server program which provides all of the OPC and DDE connectivity and user interface functions, and a plug-in communications drivers for the CTI 2572 Ethernet Module.
OPC technology reflects the move from closed proprietary solutions to open architectures that provide more cost-effective solutions based on established standards.

38. 2572 Application notes IP Addressing and the 2572
Getting Started with Networking and the 2572
Using CTIDiag with the 2572
Starting the 2572 Network Server from PLC Logic
Reading Values into Excel Spreadsheets Using the 2572
Using the 2572 with Wonderware 7.0
Creating a Client/Server Memory Transfer between Two 2572 Modules
Using the 2572 UDP "Send To" Feature to Exchange Memory with Multiple PLCs .

39. Ethernet Modules Specific Topics
2572
Operation of the feature
Operation of the send/receive feature
Operation of the DataShare feature
2572-A
IP address assignment using DHCP
Built-in web server
Security features
Re-flashing firmware
Modbus TCP Server
IP Mulitcast .

40. 2572 Email Feature Allows PLC logic to transmit an email message
Sample command block .

41. 2572 Send / Receive Feature
Allows data exchange between TI505 and Siemens S5/S7 PLCs
Send commands and receive commands must match-up on both sides
Data block read from / written to V-Memory
Four command blocks are used
Open active connection
Open passive connection
Send
Receive
Close connection
Complete details in chapter 5 of the 2572 user manual .

42. 2572 Send / Receive Sample Command Block.

43. 2572 DataShare Feature
Allows very high speed peer-peer connection between 2572s
Useful where
Speed is critical
One PLC periodically need to update several others with the same set of data
Multiple PLCs need to exchange data on a cyclic basis
Activated using SW2-2
When active, limits performance of module as a server
Uses reserved bits in the Module Status Word and Module Command Word
Command Blocks
Start producer instance
Trigger producer
Start consumer instance
Close datashare .

44. 2572 DataShare Sample Command Block.

45. 2572-A IP Address Assignment using DHCP
Allows use of auto-start while still guaranteeing correct IP address in case of a module replacement
How it works
If auto-start is selected and settings of module ID switches are non-zero, the module ID value is sent to the DHCP server as a “client identifier”
DHCP server is set up to assign IP addresses based on client identifier
At CTI, we set up our server to assign the last part of the IP address based on the switch assignment
Example
Switch setting of “70” receives IP address of
Complete information on setting up DHCP server in Appendix E of 2572-A user manual .

46. 2572-A Built-In Web Server Web server features
Module diagnostics
Module configuration
Firmware download
Security services
Product support
Just point your browser at the IP address of the module .

47. 2572-A Security Features Password protection for Hardware lockout for
Module configuration changes
Module firmware download
Bypass password protection using SW1-7
Hardware lockout for
Set on SW1-5 and SW1-6 .

48. 2572-A Firmware Upgrade
Firmware updates can be re-flashed in-place using the web server interface
Install a free TFTP server on your network
Download and copy the upgrade file to the TFTP server
Go to the “firmware download” section of the 2572-A web server interface
Enter the IP address of the TFTP server
Complete information in Appendix F of the user manual .

49. 2572-A Modbus TCP Server Configuration
The Modbus TCP server starts automatically. There is no configuration or startup logic required.
Variable Mapping
Modbus TCP uses a different nomenclature than the SIMATIC® 505 to describe data elements. The following table provides a cross reference.
Modbus Variable
505 PLC Equivalent Variable
Coil
Control Relay (C )
(Discrete) Input
Discrete Input (X)
Holding Register
User Variable Memory (V)
Input Register
Word Input (WX)

50. 2572-A Modbus TCP Server Supported Modbus Function Codes (FC)
(dec)
(hex)
Function Codes
505
Variable
Comments 01
Read Coil Status C
Max number of coils = 2000 02
Read Input Status X
Max number of inputs = 2000 03
Read Holding Register V
Max = 125 04
Read Input Register WX 05
Write Single Coil 06
Write Single Register 07
Read Exception Status
TBD. This returns Y1-8 or C1-8 in 2573-MOD. 15 0F
Write Multiple Coils
Max = 800 16 10
Write Multiple Registers
Max = 100
Supported Modbus Function Codes (FC)
Code
Name
Description 01
Illegal Function
Unsupported Function code 02
Illegal Data Address
Requested data address not included in the PLC configuration 03
Illegal Data Value
Typically indicates a problem in the query structure 04
Slave Device Failure
Unrecoverable error occurred while processing the request

51. 2572-A IP Multicast
There is no physical limit to the number of modules that can participate in a Multicast session.
The number of words that may be transferred is words per module.
The source, number of words ,and destination are defined in the Producers. This gives greater flexibility in determining the source data, the number of words that get written, and the destination that the data gets written to in the consumers in the Multicast session.
Each station broadcasts its message asynchronously at the configured production intervals. This eliminates the need for each station to be polled to broadcast its data.
The TCP/IP protocol reserves a block of IP addresses ( through ) for multicast use.

52. 2572-A IP Multicast
You can configure a 2572-A to receive on a multicast address using the same methods used to establish the other TCP/IP network parameters.
1. If you are using the PLC Start method, the multicast address can be specified in the Start Network Server command block.
2. If you are starting the module using IP parameters stored in EEPROM, you can use the Web Server interface to enter the multicast address.
3. If you are using DHCP, you can add the multicast address to the parameters that are provided by the DHCP server.

53. 2572-A IP Multicast Start Network Server Example
Only the values in offsets 6 and 7 would change to load that modules specific IP address.

54. 2572-A IP Multicast Configuring IP Multicast
After the network server has been started you need to do the following to send a multicast message:
1. Execute a Create Socket command using a multicast address.
2. Use the Unacknowledged Write command to send a multicast message containing the data you wish to write.

55. 2572-A IP Multicast Create Socket Command
The Create Socket command provides a means for your PLC logic to refer to another network node when sending messages. You must complete the Create Socket command before you send messages to another node on the network.
For IP Multicast, UDP must be specified as the Type of Service. The 2572-A saves the Multicast address and port number as the default remote socket. The IP Multicast address is specified in offsets 6 and 7 of the Create Socket command block. Once the Create Socket command completes successfully, your logic can use the Connection Number to refer to the remote socket.

56. 2572-A IP Multicast
Create Socket Command Example

57. 2572-A IP Multicast Unacknowledged Write Command
This command is designed to be used with multicast addresses, where one message can be used to update multiple modules. Like the standard write command, this command reads the contents of a designated area of V memory in the local PLC and writes the values to a specified area of memory in another PLC. However, because multiple modules could receive this message, CAMP servers that receive this command do not reply and the client does not verify that the message was received by any server.

58. 2572-A IP Multicast Unacknowledged Write Command Example
Note that offset 3 (V143) determines the starting V location of the write block in the local PLC. Offset 4 (V144) determines the number of words to be written. Offset 5 (V145) determines where this block of data gets written to in the remote PLC.

59. 2500-CXXX CPU Ethernet Port
Ethernet Communications
The CTI 2500 controller provides a means to attach the controller to a plant network via an integrated 10/100Mb Ethernet port. The port offers auto-crossover capability, which allows you to connect a standard cable directly from your PC to the Ethernet port for local programming.
The port uses the TCP/IP protocol, which is widely supported by programming software and HMI software. Before you can use the port, you must set the IP address and related parameters. To do this, you can use Workshop Version 4.11 or greater or the CTI standalone utility program IPSET (Demonstration).

60. 2500-CXXX CPU Ethernet Port
To prevent a possible bump in the process, the IP address can be set only while the PLC is in PROGRAM mode.
IP addresses must be unique, even between the local Ethernet port and an Ethernet module in the same base. Duplicating IP addresses can cause unpredictable problems, including loss of communications with the Ethernet port.

61. 2500-CXXX CPU Ethernet Port
TCP/IP provides for multiple logical ports. Each “port” represents a particular service offered at the IP address. The CTI 2500 Controller supports the following logical ports:
Programming Port (TCP Port 4452)
The programming port is intended for use with network-capable programming software, such as PLC WorkShop. To use the programming port, connect to TCP port This port supports all programming, data access, and control requests. Only one client may be connected to the programming port at a time. The CTI 2500 gives priority to all requests to the programming port. UDP connections are not supported.
When programming via local Ethernet port using TCP port 4452, you can prevent anyone else from concurrently modifying the program via another port or SF module by initiating port lockout using your programming software. Port lockout blocks requests to modify the User Program that originate from other physical ports, such as the serial port or a port on a special function module.

62. 2500-CXXX CPU Ethernet Port
Data Access Port (TCP Port 4450/1505)
To use the Data Access port, it is preferable to connect to TCP port To provide compatibility with installations using the CTI 2572 and 2572-A, you may also connect to the Data Access port using TCP port A total of three concurrent TCP connections to port 4450 or 1505 are allowed. For example, you could have two connections to port 4450 and one connection to port UDP connections are not supported.
The Data Access port is intended for use with HMI and SCADA software. Since the Data Access Port uses the same CAMP protocol used by CTI 2572 and 2572-A modules, drivers are available for most popular SCADA software packages.

63. 2500-CXXX CPU Ethernet Port
Data Access Port (TCP Port 4450/1505) Cont.
It can also be used with network-capable programming software where you want to allow the User Program to be displayed but not modified. By default, the Data Access port will reject commands that attempt to alter the User Program, returning a “port lockout” error.
Some legacy network programming interfaces, such as APTNET, support only Port If you need to use TCP Port 1505 as a full function programming port (allowing programs to be modified), you can set the Programming Port switch as described in Section 2.4.
Caution
When you choose to use Port 1505 as a full function programming port, there is no means to prevent two users from concurrently modifying the User Program, since more than one programming connection to the Ethernet port is allowed.

64. 2500-CXXX CPU Ethernet Port
Web Server Port
The Web Server port allows a standard Web browser to connect to the CTI 2500 to access the Event Log.
The event log maintains a time stamped record of significant software events. All fatal and non-fatal errors result in an entry into the event log. The event log is stored in battery backed memory. It can be accessed using a standard web browser, such as Internet Explorer. You can access the Event Log by typing the controller IP address in the URL box in the browser. If you are experiencing problems, the event log will usually provide details relating to the problem.